PR #30435 - manaflow-ai/cmux

Leo: "i mean the linux things cant our minis just run them" and "if we gotta use shit, we use it and we maximize the absolulte f***ing out of every second."

What

A new repo variable, vars.CI_LINUX_GATE_OWNED_RUNNER, sits ahead of Blacksmith in the runs-on of the gate jobs that need no Linux kernel:

ci.yml: macos-admission-gate, linux-preflight, ci-status. Order: fork branch, then the owned member, then fromJSON(vars.RUNNER_POOLS).linux. changes stays on RUNNER_POOLS.linux: it mints GLAEDA_ROUTE_APP_KEY and uploads the owned-pool marker the rescue waits on.
ci-web.yml: react-apps-check-shard, react-apps-base-check, react-apps-check. Order: owned member, then the existing Blacksmith expression. Every owned member is reachable only on push or a same-repository pull_request, never merge_group or a fork.

Unset (the default), nothing changes. Set it to a glaeda-side-* label (for example glaeda-side-light-xcode-26.6) and these jobs go to owned minis when a Blacksmith backlog leaves them stuck. Clear it and they go back.

web-subarea-scope is left out because lane/fleet1-web-scope-pool owns its runs-on (it takes the picker's side label there).

Why

On 2026-11-01 a Blacksmith backlog of about 2,500 jobs left PR CI (changes, job 124777863132) and the webview shards queued for many minutes, so no PR got a webview verdict.

No Linux kernel needed

The ci.yml gates: bash and python3 summaries, with no secrets.
The webview jobs: bun, node and Playwright. playwright install --with-deps installs system packages only on Linux, and .github/actions/playwright-apt-cache is gated on runner.os == 'Linux'. The shard and base check move together, so the head and the base run on the same OS.

Risk

Webview tests on macOS can differ from Linux (fonts, WebKit). That is why the variable defaults off and is meant for backlogs. A mini label also has no idle-capacity check like portable placement has. Setting it with only a few idle light minis queues those jobs behind them.

Guards

scripts/ci/runner_label_policy.py: the variable is held to the side-lane rule (glaeda-side-* or the workflow policy).
ci-repo-variables.yml and ci-health-report.yml report it.
tests/test_ci_repo_variable_defaults.py accepts the member only when a RUNNER_POOLS read follows it directly and the fork branch comes first.
tests/test_ci_linux_single_size.py: ci-web.yml allowance goes from 6 to 5. lane/fleet1-web-scope-pool lowers the same number, so whichever lands second sets 4.

Local runs: test_ci_linux_single_size, test_ci_repo_variable_defaults, test_runner_label_policy, test_ci_check_repo_variables, test_ci_fork_runner_routing and test_ci_runner_set pass. test_ci_self_hosted_guard.sh (check_no_self_hosted_fleet_runners, cmux-next.yml and nightly.yml lines), test_ci_blacksmith_linux_failover, test_ci_change_areas (2 of 231) and test_ci_signing_keychain fail the same way on base.

Performance

metric	before	after	delta	source
Blacksmith minutes/day	unchanged with the variable unset	unchanged; with it set, the gate jobs move to owned minis	0 by default	this PR
`changes` queue wait in a Blacksmith backlog	5+ min (job 124777863132)	an idle mini starts it within seconds when set	not measured yet	run 41282762708

Agent session: agent session

🤖 Generated with Claude Code

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by cubic

Adds a CI_LINUX_GATE_OWNED_RUNNER repo variable so the no-kernel Linux CI gates can run on owned minis ahead of Blacksmith when Blacksmith has a backlog. Unset by default, so routing is unchanged until an operator opts in; fork pull requests and merge-group runs never reach the owned member, and changes stays on the ephemeral Linux pool because it mints keys and uploads the owned-pool marker.

Set it to a glaeda-side-* label and the ci.yml gates (macos-admission-gate, linux-preflight, ci-status) and the ci-web.yml react-apps-* jobs go to owned minis; only reachable on push or same-repository pull_request.
The variable is held to the side-lane label rule, reported in ci-repo-variables.yml, and covered by default and pool-order tests.