[TheGreatAxios]

Fixes CL-7393

Summary

• packages/onboarding/src/provision.ts called publishRootToolRegistry (which runs publishCorbitsToolsRegistry, freshness check included) at first-login creation and on every sign-in for an unparented root personal bench. A dirty packages/*/src under an unchanged version made that freshness check fail root first-login provisioning with tool_registry_publish_failed — a CI-gating check landing on the sign-in hot path.
• Delete both call sites, the publishRootToolRegistry helper, and the publishToolRegistry hook on ProvisionArgs entirely. Provision now only deploys the default workflow set; it never touches the tool registry.
• Root-tenant tool registry publish keeps exactly two callers: workbench setup (CLI) and hub boot (apps/hub/src/system-seed.ts), which already publishes unconditionally on every boot and retries (logs and lets the next boot retry) rather than failing sign-in.
• Freshness checking now only ever runs inside publishCorbitsToolsRegistry's own callers (setup/boot), never inline in provisioning.

Manual check (documented per ticket, not automated — would require a full hub+DB e2e harness)

With a tool package's src/ edited and no version bump:

1. bun run dev (hub boot) logs a tool-registry freshness/publish failure from system-seed.ts and keeps running (retries next boot).
2. First login on the root tenant still succeeds — provisioning only deploys workflows, so it never touches the tool registry and never surfaces tool_registry_publish_failed.

Tests

• bun test packages/onboarding/test/provision.test.ts — 18 pass.
• bun test packages/onboarding/test — 151 pass, 12 skip (DB-gated, no DATABASE_URL locally).
• bunx tsc --noEmit -p packages/onboarding/tsconfig.json — clean.
• bunx eslint packages/onboarding/src/provision.ts packages/onboarding/test/provision.test.ts — clean.
• bun run scripts/checks/report-error.ts — 0 new findings.
• bun run scripts/checks/tool-package-freshness.ts, scripts/checks/browser-safe-subpaths.ts — ok.
• grep -rn publishRootToolRegistry packages/onboarding — no matches.

Test plan

• Unit tests for provision pass
• Typecheck clean
• Lint clean
• Structural checks (report-error, tool-package-freshness, browser-safe-subpaths) pass

[linear-code]

CL-7393

[TheGreatAxios]

Self-review

Verdict: the change is correct and complete — provision no longer publishes the tool registry, hub boot and workbench setup remain the two publish sites, and the CL-7096 empty-registry-as-unseeded detection is preserved (just no longer auto-repaired inline during provisioning).

• CONFIRMED-OPEN — none.
• DISMISSED — no remaining caller passes publishToolRegistry/ProvisionArgs.publishToolRegistry; grepped the whole repo, only bench-provisioning.ts's unrelated publishToolRegistryFn (a separate CL-7096 code path for explicit bench creation, untouched by this PR) remains. bunx tsc --noEmit on packages/onboarding and apps/hub is clean.
• DISMISSED — hub boot (apps/hub/src/system-seed.ts) still calls publishCorbitsToolsRegistry unconditionally every boot and returns (logs via reportError/log.error) without throwing once its deadline passes, so a failure never blocks the server from serving traffic.
• DISMISSED — CL-7096's "empty registry counts as unseeded" detection still lives in isCorbitsToolsRegistrySeeded/isFullySeeded and is exercised by the renamed test (asserts seeded: false, not just absence of a publish call — the mock's api throws on any unexpected PUT, so a stray publish attempt would still fail the test). The repair half (republish inline during provisioning) is deliberately narrowed to setup/boot only, as stated in the PR description; bench-provisioning.ts's own CL-7096 repair path for explicit child-bench creation is untouched.
• DISMISSED — renamed tests assert real outcomes (tarballPuts empty, seeded value, unhandled-PUT throws), not just parameter absence.

Targeted tests: bun test packages/onboarding/test/provision.test.ts — 18 pass. bunx eslint packages/onboarding/src/provision.ts packages/onboarding/test/provision.test.ts — clean.

No defects found; nothing pushed.