#32347 api: production forwards NEXT Cloud to cmux-platform-production

HOLD: lands once cmux-platform-production serves Cloud: manaflow-ai/cmux-platform#542 merged and deployed, and both JWT_PRIVATE_JWK and CLOUD_LINK_SIGNING_KEYS set on cmux-platform-production. Until then a forwarded request would get a 503 owner.unreachable.

Leo, 2026-11-02: "why should it still point at old stuff if we are already doing this in platform" and "cmux-platform is blue water."

What changes

backend/apps/api/wrangler.jsonc, the production block only:

• "PLATFORM_SURFACES": "cloud": the forwarder (#29400, src/platform-forward.ts) sends NEXT Cloud's ops (cloud:CloudDO on /v1/ops and /v1/read) and its machine routes (bind, keyset, acpmux, client-session, guest) to the platform.
• "services": [{ "binding": "PLATFORM", "service": "cmux-platform-production" }].

CloudDO stays this Worker's class. cmux-platform-production binds it, along with UserDO, TeamDO and DomainDO, by script_name: "cmux-api" (cmux-platform#542), so forwarded requests meet the same objects and data and no class moves. This is the same shape staging has in #29488, not development's (#30401), where the platform owns CloudDO.

test/platform-cloud-development.test.ts pins production's var and binding, and checks that CloudDO stays local.

How it reaches production

Through feat-cmux-next's hold-gated promote (CMUX_NEXT_PRODUCTION_HOLD, promote-gates), never on merge. It adds no DO tag and no guarded var. Rollback: drop the var. With the binding absent, the forwarder serves locally.

Still needed before NEXT nightly can use this

• CLOUD_LINK_SIGNING_KEYS on cmux-api production itself (GET https://cloud-api.cmux.dev/v1/cloud/keyset answers 503 today), with the same value on cmux-platform-production.
• JWT_PRIVATE_JWK on cmux-platform-production, the same value as cmux-api's.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Forwards cmux-api's production NEXT Cloud traffic to cmux-platform-production through the platform forwarder, matching the staging setup. CloudDO stays cmux-api's own class — the platform binds this Worker's DOs by script name, so no objects or data move.

• Adds PLATFORM_SURFACES: "cloud" and the PLATFORM binding to the production block only; the test pins both. Reach production requires the hold-gated promote, never merge. Rollback is dropping the var.

Still required before promoting

• CLOUD_LINK_SIGNING_KEYS on cmux-api production, same value on cmux-platform-production (currently 503s).
• JWT_PRIVATE_JWK on cmux-platform-production, same value as cmux-api's.