fix(cmux-next): make web OTA publication fail closed

Merged
TE
7d ago
+211-33

Fixes HQ#5160, HQ#5159 and HQ#5170.

What changed

  • The production every-merge pointer job now fails when CMUX_WEB_OTA_SIGNING_KEY is absent. There is no green no-pointer path.
  • The nightly web channel is removed from the user-facing settings schema and updater enum until a promoted NEXT nightly publisher exists. The pointer script and channel-matrix test expose only channels with a writer and read-back verification.
  • Bun 1.4.4 and Node 24.22.1 are part of web-bundle-key.py --source, so a toolchain change gets a new write-once publication identity. The workflow also records and checks the manifest toolchain fields.
  • Settings exports, MDM docs, web control types and the OTA plan now match the supported channel set.

Validation

  • python3 tests/test_web_ota_publication_contract.py
  • bash tests/test_web_ota_pointer.sh
  • bash tests/test_web_bundle_key_inputs.sh
  • python3 scripts/cmux-next/gen-settings-sources.py --check
  • git diff --check

Risk: high for the production OTA path because a missing signing secret now fails the check; the nightly channel remains unavailable until its publisher is implemented.

šŸ¤– Generated with Claude Code

Agent-Session: agent session

Agent-identity footer: agent session