[TheGreatAxios]

Linear: https://linear.app/abklabs/issue/CL-7096/myra-first-launch-can-succeed-setup-without-a-published-corbits-tools

[linear-code]

CL-7096

[TheGreatAxios]

Self-review

Rebased onto origin/main (apps/hub/src/index.ts moved a lot; resolved with no conflicts — this PR's hook was just adding publishToolRegistryFn to the existing createBenchProvisioner call). Fixed the CI typecheck red. Verdict: ready for human review.

• CONFIRMED-FIXED: publish.test.ts cast (async () => …) as typeof fetch (TS2352, unsafe conversion — Bun's typeof fetch also carries a preconnect static member the stub can't satisfy). Narrowed putTarball's injected fetch to a FetchTarballPut type ((input, init) => Promise<Response>, the only shape actually called) in publish.ts, used it for PublishCorbitsToolsRegistryArgs.fetchImpl, and typed the test stub with satisfies FetchTarballPut instead of casting.
• DISMISSED: "empty means unseeded" re-publishing a registry an operator deliberately emptied, without a guard. Checked the Linear issue text (CL-7096): "First launch without tarballs is a setup bug, not an operator mistake" — the ticket explicitly scopes out the deliberate-empty case; there's no way for the code to distinguish it from the dangling-git-init-no-commit case CL-7096 targets. There is an audit trail: each republish logs published <pkg>@<version> to corbits-tools (publish.ts), and a publish failure goes through reportError with tenantId in bench-provisioning.ts.
• DISMISSED: product-rule placement. isCorbitsToolsRegistrySeeded, tarballsCoverRequiredSeedPackages, EmptyRegistryPublishError, and the republish decision all live in packages/tool-registry-publish and packages/onboarding; apps/hub/src/index.ts only wires publishCorbitsToolsRegistry into the existing createBenchProvisioner call — no product logic in apps/*.
• DISMISSED: exactOptionalPropertyTypes hazards — the added optional-spread sites (...(args.publishToolRegistry !== undefined ? {...} : {})) match the repo's established pattern.
• DISMISSED: bare catches — the new catches in bench-provisioning.ts call reportError + logError; publishRootToolRegistry's catch rethrows as ProvisionError.

Targeted tests run after the fix and rebase (all pass):

• bun run typecheck — pass (after bun install, which the worktree was missing)
• bun test packages/onboarding packages/seeding packages/tool-registry-publish — 312 pass, 12 skip (DB-gated, no DATABASE_URL locally, expected), 0 fail