#26891 ci(nightly-next): the cmux NIGHTLY-identity verify takes a free owned Mac first

Leo: "it is unacceptable to have nightlies >30min out of date." Routing order: Linux, then owned Macs, then Blacksmith macOS as the last resort ("IT WAS ALWAYS FUCKING LAST RESORT").

What changed

• verify-nightly-identity-legacy checks the cmux NIGHTLY-identity DMG statically. It has no environment and reads no secrets.
  • Before this change it could run only on Blacksmith macOS: the label legacy-identity-target picked, then vars.MACOS_RUNNER_26, then 6 vCPU.
  • Now it first takes the owned Mac that pick-nightly-sign-runner offers to verify-signed-nightly, verify-final-dmg-nightly and signer-dmg-image. That pick is read only on the attempt it was made for.
  • When there is no owned pick, or on a re-run, it takes its own Blacksmith labels exactly as before. A re-run takes sign_alternate.
  • The Xcode pin follows the same rule as verify-signed-nightly: the PR pin on an owned Mac, the macOS 26 pin on Blacksmith.
• legacy-identity-verify-build-source.sh now runs git worktree prune before git worktree add into $RUNNER_TEMP/build-src. An owned Mac keeps its workspace between jobs while RUNNER_TEMP is emptied, so an earlier job's registration could otherwise refuse the add.
• The signing jobs (sign-nightly-identity-legacy, generate-nightly-deltas) hold the keys and stay on Blacksmith. No new secret, environment or permission.
• Test: tests/test_nightly_sign_runner.py gets test_the_legacy_verify_reads_the_owned_pick_then_its_own_labels. The secret-holding guard (test_no_job_that_holds_a_secret_reads_the_owned_pick) still covers every job that reads the owned pick.

Before / after

• Before: on 2026-10-28, blacksmith-12vcpu-macos-26 started nothing from about 02:11Z, and every nightly Mac job fell to blacksmith-6vcpu-macos-26 behind pull request jobs.
  • Run 40704770348's verify-nightly-identity-legacy has been queued there since 15:07Z.
  • Run 40688132401's waited 24 min (14:48Z to 15:12Z).
  • The cmux NIGHTLY-identity feed (nightly-next/appcast-arm64.xml) has been on 4062224162001 since 04:00Z.
• After: the verify runs on a free owned Mac when one is idle. glaeda admits nightly jobs ahead of PR jobs.

Tests run locally (single files): test_nightly_sign_runner.py (18 OK), test_nightly_legacy_publish_linux.py (8 OK), test_nightly_next_ring.py (39 OK), test_nightly_next_post_publish.py, test_nightly_cmux_tui_resolve.py, test_nightly_workflow_size.py (OK; 485 KB).

Risk: low. One secret-free job gains the owned route its three sibling verify jobs already use. A stuck owned verify is moved by the owned-pool rescue's re-run to the Blacksmith alternate.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

The cmux NIGHTLY-identity verify now takes a free owned Mac first instead of always queuing on Blacksmith macOS, where nightlies were running 20+ minutes behind.

• verify-nightly-identity-legacy reads the owned Mac pick from pick-nightly-sign-runner only for the attempt it was made for, then falls back to its own Blacksmith labels; re-runs take the Blacksmith alternate. The job holds no environment and no secrets.
• The Xcode pin follows the same rule as verify-signed-nightly: the PR pin on an owned Mac, the macOS 26 pin on Blacksmith.
• legacy-identity-verify-build-source.sh now runs git worktree prune before adding a worktree, since an owned Mac keeps its workspace between jobs.
• Signing jobs stay on Blacksmith; no new secrets, environments, or permissions.
• Adds test_the_legacy_verify_reads_the_owned_pick_then_its_own_labels; the secret-holding guard still covers every job that reads the owned pick.