Cloud: capture remote turns and reconnect owner rewinds durably

TE
13h ago
+3381-73

An owner Cloud attachment enrolls its existing workspace/carrier through the platform before starting or attaching a chat. Enrollment never allocates another VM. Each native Cloud prompt then reserves its daemon turn, captures the workspace machine using native owner authentication, and dispatches a scoped one-use execution capability. cmux machine turns lists captures; cmux machine rewind restores a selected turn and reconnects the workspace to its verified replacement. Owner-verified bindings persist per account so refresh and relaunch resolve the current carrier.

Request: “snapshot per turn so a user can rewind the whole machine (files + state) to any earlier turn.” This PR connects native owner authentication, the guest daemon transport, and the rewind commands. The platform ledger/carrier enrollment and acpmux execution fence are separate dependencies. Supported app-link targets require an owner-verified logical carrier; raw VM API IDs remain unsupported.

Owner tokens stay native and use the selected Cloud team. Preparation and execution have separate capability purposes bound to one prompt/turn, generation, and attempt. Capture or authorization failure stops dispatch; accepted replays neither capture nor submit twice. Uncertain submission retains its external fence. The attachment pins the owner ticket that opened it and verifies the connected carrier/generation before releasing preparation authorization. A stale attachment cannot borrow a replacement connection's proof: it closes so the pane reattaches. Concurrent attachments share enrollment, and provisioning can force a fresh same-generation connection.

The guest host loads the three non-secret scope variables from /var/lib/cmux/turn-scope.json, a bounded root-owned 0600 regular file in a protected directory. Missing scope preserves existing machines; invalid scope refuses startup. A configured owner attachment checks the actual acpmux capability. If the running acpmux predates that scope, the session daemon uses its existing installed-binary shutdown --keep-agents/start handoff under the start lock, then checks capability again. Concurrent attaches recheck within that lock; an old installed binary or failed handoff gets at most one attempt per daemon lifetime. Enrolled native Cloud sessions refuse uncaptured prompts when support is absent. Ordinary remote sessions and observer permissions retain their existing behavior.

The remote pane host moves into the existing daemon service target; the app keeps authentication and registry wiring. Command selection and guest handoff live in Rust. This coherent capture/rewind/reconnect change spans about 3,150 added lines including tests and the host move: splitting those native seams would leave an unusable command or unsafe stale connection. The App module shrinks by 42 source lines. Prior art read: #28613, #30001, and #30337; the daemon dependency is coordinated with its owner.

At head 62d1382dd74cac27bf9bab584d95c72e2d74fd90, the daemon dependency and its registry/TLS repair are integrated. First enrollment uses generation zero as an absence fence, validates generation one, and uses the returned generation thereafter. Owner origins map to their corresponding platform environment; unknown origins refuse before token mint.

Validation:

  • Exact-head Opus review: SHIP. The owner-connection read was reviewed with its shared validator and allowlist; no blocking findings. Its ownership-refusal test follow-up is tracked in #30835.
  • Exact-head App compile passed in 80 seconds. The current CloudTurnCommandsTests fleet run and exact-head capture DEV build are in progress.
  • Ten Swift suites passed 46/46 at the dependency-integration head. The subsequent origin change passed CloudWorkspaceImportTests 8/8; the current head carries the independently reviewed daemon registry/TLS repair unchanged.
  • Executed Rust test logs confirm 152 attachment tests and two scope-loader tests passed; those source files are unchanged at this head. The former CLI command targeted the thin binary and ran zero tests; the corrected library-target run passed both CLI tests at the previous head; those Rust files are unchanged (receipt exit zero; 149.7 seconds).

The owner-scoped cloud.turn.connection read exposes only workspace, logical machine, generation, provider, and validated physical VM identity; no provider capabilities or credentials are exported.

The live native check records independent structured command stdout fenced by owner connection reads, mutates the RAM workload/file/SQLite fixture, rewinds the automatic capture, binds the pinned source, fixture, PID/start time/cwd, nonce and exact external capture ledger, and compares actual reads after rewind, forced native inventory refresh, and app relaunch. The capture harness now has its broker-aware installer and fresh-reply matcher. Authenticated fleet-slot relaunch support is being implemented with process-only credential delivery. No native end-to-end success is claimed yet.

HOLD: Finish real native capture, rewind, fresh reply, refresh and relaunch readback.

Agent session: agent session