feat(acpmux): durable native workflow CI machines [ask-6ef2624788]
Native workflow machine(command, {on: "ci"}) now submits through the installed authenticated cmux-ci client. Each activity persists its exact repository, source SHA, relative working directory, requested worker, command, and stable request key before submission; retries attach to the same controller binding and cancellation uses its exact receipt and digest.
The adapter reads verified complete output and the command's actual exit status, refuses missing or conflicting bindings, and never falls back to local execution. Arbitrary peer command execution remains refused.
Leo-ask: ask-6ef2624788
go do all those/help out where you can + examine how you can improve yourself and your available options and capabilities and speed
Validation: static prepush checks pass. The initial adapter compiled and passed its focused remote test run 41662771589 at 100e4bba495adb5a1dbc453d1e09b5ec0383fdbe. Integrated verification 41670356514 passed 91 workflow library tests and strict acpmux library clippy at ef86e85e13feead6c1a5441f772c56cf3346d2d6. Final checked-range successor cf8224938b9f51e366dacbe91512ab7432b3b67a passed the same 91 workflow tests and strict clippy in 41672647323, exit 0. Independent Opus 5.5 medium review is SHIP at that exact head. Coverage exercises lost acknowledgement, immutable resume inputs, conflicting binding, exact conditional cancellation, complete output and nonzero exit status, and unavailable client.
Follow-ups from independent review: #34029 retains retryable cleanup after cancellation failure; #34030 handles pause before first submission; #34031 preserves late background-descendant output. Additional Opus follow-ups: #34037 hardens exit-marker framing, #34038 avoids duplicated durable logs, #34039 retries transient wait errors, #34040 verifies unpinned assigned-worker echoes, and #34041 improves unpushed-HEAD diagnostics. The CI adapter lane owns these follow-ups.
The panic ratchet has the same base count (acpmux: clippy::indexing_slicing 714 > baseline 686), with no added indexing sites. The protocol IR check fails the same protocol::tests::protocol_ir_is_current test on base 63381baf63019d678cffac2288ad00b3cfc2e871, run 41669629482, confirmed by the repository base-red comparator.
Risk: replay/cancellation behavior depends on the existing request-key controller contract; older controllers fail closed. No controller, capabilities, or security-policy changes.
Waiting uses bounded controller long polls and rechecks the run generation between waits. Client processes have a 300-second deadline, stop when their future is dropped, and keep the same saved request key. Temporary receipts and complete logs are removed with their activity-owned temporary directory.
Built on merged workflow foundations #33779 and #33811; the integrated diff contains only this CI adapter.
🤖 Generated with Codex
Agent session: agent session