PR #33385 - manaflow-ai/cmux

Hidden local owner subagents can request permission without a workspace showing it. Home now displays an Allow once / Deny card by default. The native app verifies its local person proof, a fresh click, the exact pending request and the session's parent Home before sending a one-time answer.

Leo-ask: ask-6ef2624788

yeah austin might already be doing A the messages for chief

anyways what about prettier ui wrt talkin to chief as in like i dont mean changing away from imessage but as in the "other" sorts of ui that we wanna be bolting on that aren't there yet

oh stuff yeah actually we should be able to surface permissions/multiple choice related things inside chief... idk if y'all have researched dot/grokbot but those are def thng to look into

No new approval gate or unanswered hang

This respects #22747: the Home card displays an existing harness request and changes no Chief turn or spawn policy. Owner turns keep their configured policy. Other-person ask children, cloud peers and turn sessions remain excluded. Chat messages and phone answers grant no local approval authority. It does not restore #22639's broader approval gates, automatic approval or daemon-trust changes.

This preserves #22941: every hidden pending request keeps the existing 120-second deadline even after Home acknowledges delivery. A delivery receipt does not prove Home is open. Replayed permission events do not reset the deadline. The Chief can still deny or steer the subagent, and a local workspace keeps its existing answer path. Timeout, completion and replacement retire the card; late acknowledgements close stale cards. A missing/unavailable daemon grants nothing and leaves the card retryable until the host resolves it.

Removed the Preview Features checks, settings observer, rollout polling timer and documentation opt-in. Native person proof, fresh-click expiry and replay prevention, exact-request revalidation and one-shot option selection remain enforced.

Base refresh

Merged c0042014babff945613f3372bfe04ddab9266489 from feat-cmux-next into the reviewed branch at a9d9da51fed0ce3a12ba5702550c58337e1334f6 to resolve the reported merge conflict. The sole conflict was two independent test blocks appended to approval_gates.rs: this PR's Home approval cases and #33729's trusted-relay cases. Both blocks are preserved byte-for-byte; the merged suite contains 39 tests. Production changes merged automatically. The local person proof, hidden-request watchdog and cloud/ask exclusions remain intact.

Validation at a9d9da51

Opus merge-delta review: SHIP at a9d9da51fed0ce3a12ba5702550c58337e1334f6; both conflicting test blocks preserved, no product-diff changes.
Static pre-push gate passed with no new violations (71.3 seconds); working tree and whitespace checks clean.
Rust formatting, 39 approval-gate tests and the permission-note test passed in 41636612200, broker job 19912087498d4b45a1d0e3169bd95bce. All 39 + 1 passed with no failures or ignored tests. The broker verified tested SHA a9d9da51fed0ce3a12ba5702550c58337e1334f6, snapshot 75a883db4c20c638640cc73561ae56e94df162e4, and source tree c5597c2b8999c313c2aecefac7f911a74eeaecb5 (exit 0).
iOS kit run 41634816509 completed 1649 tests with one issue and no crash. Both affected Chief suites and the phone regression tests passed. The sole failure remains PushAppGroupLaunchTests.aLookupThatDoesNotAnswerNeverHoldsTheMainThread at line 78 (2.672 seconds against 2 seconds), the same assertion as base 5181467c; the test and implementation are unchanged and test_reds.py classifies it own:false. NEXT simulator validation remains pending after that skipped step. The successful run 41634816524 builds classic ios/cmux.xcworkspace, so it is not claimed as NEXT/CmuxMobileKit evidence.
Guard run 41634816601: DigestTests.test_the_repository_highlights_validate fails on team-invitations-in-settings.md lacking an action/docs link; ThisTree.test_every_compile_job_names_its_warm_sources fails on stable-next.yml:perf-budgets being exempt while wiring deriveddata-reuse. Both failures reproduce identically in isolated static snapshots at this head and merged base c0042014babff945613f3372bfe04ddab9266489; both are named base warnings.
App compile passed at this head (job c3f8be96, 59 seconds). Fresh-home passed: Home appeared at 5.9 seconds, alive for 30 seconds, no crash. The routed webview verdict (41634816714) remains pending; seven shards have passed and shard 6 is running.

The receipts below belong to the previous head; they are historical and do not establish validation of the base-refresh head. New-head checks and review are pending.

Historical validation at 4a233c

Reviewed implementation: 25cfd576d14eab40821873fe60f644c1b02eb0e8. Previously published head: 4a233c202b7e33ca138ce58e33f4ad7a3d401586. One base merge incorporates b695980afce2bdd103f0a1f3955a67b49d3bf30d.

Added a_delivered_home_card_expires_when_home_is_never_opened: delivered request, duplicate event just before the deadline, one rejection at the original deadline, no pending request, cancelled card.
Preserved workspace answer-path coverage and late-ACK tombstoning coverage across loss of local conversation ownership.
Pre-push gate passed with no new violations at final candidate 4a233c202b7e33ca138ce58e33f4ad7a3d401586 (68.8 seconds). Static preflight passed eight checks; localization parity produced the same named diagnostics after normalizing checkout roots/output ordering, and workspace package grouping produced byte-identical diagnostics on final candidate and base (both exit 1).
Additive independent source audit found no blocking defect in implementation commit 25cfd576d14eab40821873fe60f644c1b02eb0e8; the following commit changes only documentation. Its later delta review is linked below.
Fleet Rust formatting and approval-gate tests passed in run 41619154265, job d214952241ae44bc96f0a8d5ac45ef18, at the exact final head. The tested SHA was 4a233c202b7e33ca138ce58e33f4ad7a3d401586; its source receipt matched the snapshot tree. cargo fmt --all -- --check, 35 approval-gate tests, and the permission-note unit test passed (35 + 1, no failures or ignored tests). Earlier run 41614945733 failed before tests on two formatting deltas; those are fixed here.
Fresh-home launch passed at final head 4a233c202b7e33ca138ce58e33f4ad7a3d401586, fleet build fc6b7fb395dfd7f0e16ee3f3: Home appeared at 9.5 seconds, up for 30 seconds, no crash. Earlier head 25cfd576 also passed (26.6 seconds).
Opus review: SHIP at 25cfd576d14eab40821873fe60f644c1b02eb0e8. The requested review deltas are committed in the final candidate. Final-head Opus delta review: SHIP at 4a233c202b7e33ca138ce58e33f4ad7a3d401586.
Leo’s done-check remains a real Allow/Deny request resolved and read back on screen in the delivered build after landing. Earlier receipts at the original PR head do not validate this revision.
Final app compile passed at the exact final head in job 5f4a67e4f1c991cb1e1441a1, 64 seconds. The final PR CI iOS run 41617765337 tested the PR merge (4a233c into 5dee1ab9): both new phone tests and ChiefAnswerFlowTests / ChiefQuestionBackendTests passed. Its sole failure was PushAppGroupLaunchTests.aLookupThatDoesNotAnswerNeverHoldsTheMainThread, line 78: 3.189 seconds against a 2-second limit. Base run 41589998439, at 5181467c939f4475ae175c93cb4866ccf39290c9, failed the same test/assertion (2.679 seconds against 2 seconds). The test and PushAppGroup.swift are unchanged between that base and this head. Both runs completed, with one issue and no crash. This named failure is a base warning; The later fleet iOS simulator app and CmuxMobileKit compile passed at the exact final head, step 2be81f111ba5bd6bf89a03b9; ChiefAnswerFlowTests and ChiefQuestionBackendTests passed 12/12. PushAppGroupLaunchTests passed 3/3 on the iOS simulator at head (step 27f183bc968bcdd2778fe255) and merge-base b695980a (step 44f8fc6e48f9b4dfc01dce72). The timing failure is limited to the macOS Swift test run.
Chief-area teammate lawrencecchen was requested as reviewer; the awareness comment is posted and risk:normal is applied.

The final candidate also excludes Mac-only approval cards from the phone question feed and refuses cached cards before signing or sending, with two regression tests. It removes obsolete config forwarding and corrects the Chief note and release-note link. Fleet iOS compile and the affected question suites passed at the final head.

Warm-source guard comparison: tests/test_ci_warm_sources.py::ThisTree.test_every_compile_job_names_its_warm_sources failed identically on CI merge fbd350a6, base 5dee1ab9, and current base 8f4516ba: stable-next.yml:swift-suites is exempt but wires deriveddata-reuse. The named failure is a base warning; the comparison was interpreter-only in isolated snapshots and made no branch edits.
Opus delta review, app compile, iOS simulator compile, affected Chief question tests, and fresh-home launch passed at the final head. The routed webview per-test verdict remains pending in run 41617765461; that old run does not validate the base-refresh head.

Review follow-ups

#33591: avoid redundant approval persistence on unrelated status updates.
#33592: retire old approval cards on conversation switches.

Scope and risk

This is one existing permission request's path from the Chief host through delivery, native rendering, person-proven response and terminal state. The larger original diff belongs together for that end-to-end boundary. Risk is an approval entry point; the native identity and click checks and denial deadline are required. Feed, cmux-imessage and the separate question-answer bridge are untouched by this adoption.

Design references: design/home-inbox.md, design/chief-web.md; Claude's approval card with choices (apps/claude/live/approvals-question-card-with-choices.png, private reference). No private capture is attached publicly.

Changelog

Added: Home shows one-time permission requests from hidden local owner subagents by default. Unanswered hidden requests still expire even when Home is never opened.

🤖 Generated with Codex

Agent session: agent session