From b1e6caa5d695b74c2023ec24af33b09afb344754 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sat, 5 Sep 2026 23:41:15 -0700
Subject: [PATCH 01/10] Add test for workflowDeployBody's catalog-offering
 shape

---
 scripts/e2e/harness.test.ts | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/scripts/e2e/harness.test.ts b/scripts/e2e/harness.test.ts
index 5b4d148005..37f4f93e4e 100644
--- a/scripts/e2e/harness.test.ts
+++ b/scripts/e2e/harness.test.ts
@@ -11,6 +11,7 @@ import {
   createCleanupHarness,
   parseEnvFileDatabaseUrl,
   runCleanups,
+  workflowDeployBody,
   type SpawnedApp,
 } from "./harness.ts";
 
@@ -67,6 +68,29 @@ describe("createCleanupHarness", () => {
   });
 });
 
+describe("workflowDeployBody", () => {
+  test("carries catalog offering ids, never a raw provider/apiKey source", () => {
+    const body = workflowDeployBody({
+      assetId: "asset-1",
+      commitSha: "deadbeef",
+      sourceOfferingIds: ["offering-1", "offering-2"],
+      defaultSourceOfferingId: "offering-1",
+    });
+    expect(body).toEqual({
+      source: {
+        kind: "asset",
+        assetId: "asset-1",
+        package: { format: "source", commitSha: "deadbeef" },
+      },
+      entry: (body as { entry: string }).entry,
+      sourceOfferingIds: ["offering-1", "offering-2"],
+      defaultSourceOfferingId: "offering-1",
+    });
+    expect(body).not.toHaveProperty("sources");
+    expect(body).not.toHaveProperty("defaultSource");
+  });
+});
+
 describe("parseEnvFileDatabaseUrl", () => {
   test("reads DATABASE_URL and ignores comments and blanks", () => {
     expect(

From fae77c0682222b8149cb08b6b169e1caab79d33b Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sat, 5 Sep 2026 23:41:23 -0700
Subject: [PATCH 02/10] e2e: deploy workflows by catalog offering ids

The native workflow deploy route now requires sourceOfferingIds/
defaultSourceOfferingId resolved against the tenant's own catalog,
rather than a raw provider/baseURL/apiKey source chain. Update
workflowDeployBody accordingly, and extract the zero-cost noop
catalog chain smoke-webhook.test.ts already built (an anthropic-
plugin provider pointed at the hub's noop-inference endpoint) into
a shared seedNoopCatalogOffering harness helper.

Every deploying e2e suite now seeds or resolves a real catalog
offering before deploying: walking-skeleton keeps a never-real
placeholder host (assertNeverRealProvider still guards it), chat
resolves the offering seedCatalog already planted rather than
seeding a second chain, and heartbeat/workbench-digest/smoke-webhook
seed the noop chain via the shared helper. cl-6324-launch-proof's
section-mode deploy now reuses the offering id the proof already
resolved when it narrowed the bench catalog to its pinned model.
---
 scripts/e2e/chat.test.ts             |  48 +++++++++--
 scripts/e2e/cl-6324-launch-proof.ts  |  29 ++++---
 scripts/e2e/harness.ts               | 121 +++++++++++++++++++++++----
 scripts/e2e/heartbeat.test.ts        |  19 +++--
 scripts/e2e/smoke-webhook.test.ts    |  89 +++-----------------
 scripts/e2e/walking-skeleton.test.ts |  23 +++--
 scripts/e2e/workbench-digest.test.ts |  19 +++--
 7 files changed, 219 insertions(+), 129 deletions(-)

diff --git a/scripts/e2e/chat.test.ts b/scripts/e2e/chat.test.ts
index deea7c8268..da9b255c89 100644
--- a/scripts/e2e/chat.test.ts
+++ b/scripts/e2e/chat.test.ts
@@ -266,6 +266,47 @@ describe.skipIf(databaseUrl === undefined)("chat e2e", () => {
       log: () => undefined,
     });
 
+    // The echo deploy resolves against the catalog offering `seedCatalog`
+    // just planted for the same provider/model this workflow declares,
+    // rather than seeding a second inference chain.
+    const echoModelsListed = await api(
+      "GET",
+      `/api/tenants/${tenantId}/catalog/models`,
+      undefined,
+      user1.cookies,
+    );
+    expectStatus("list catalog models", echoModelsListed, 200);
+    const echoModelRows = (
+      echoModelsListed.data as { data: { id: string; canonicalName: string }[] }
+    ).data;
+    const echoModelId = echoModelRows.find(
+      (row) => row.canonicalName === "claude-sonnet-5",
+    )?.id;
+    if (echoModelId === undefined) {
+      throw new Error(
+        `no catalog model named "claude-sonnet-5": ${JSON.stringify(echoModelsListed.data)}`,
+      );
+    }
+
+    const echoOfferingsListed = await api(
+      "GET",
+      `/api/tenants/${tenantId}/catalog/offerings`,
+      undefined,
+      user1.cookies,
+    );
+    expectStatus("list catalog offerings", echoOfferingsListed, 200);
+    const echoOfferingRows = (
+      echoOfferingsListed.data as { data: { id: string; modelId: string }[] }
+    ).data;
+    const echoOfferingId = echoOfferingRows.find(
+      (row) => row.modelId === echoModelId,
+    )?.id;
+    if (echoOfferingId === undefined) {
+      throw new Error(
+        `no catalog offering for model "${echoModelId}": ${JSON.stringify(echoOfferingsListed.data)}`,
+      );
+    }
+
     // Seed the echo workflow as a deployed, invitable definition: the
     // same asset-publish → git-token → smart-HTTP push → native deploy
     // path `scripts/e2e/walking-skeleton.test.ts` proves end to end.
@@ -334,11 +375,8 @@ describe.skipIf(databaseUrl === undefined)("chat e2e", () => {
         workflowDeployBody({
           assetId: echoAssetId,
           commitSha: echoPushed.commitSha,
-          sourceId: "src-echo-e2e",
-          provider: "anthropic",
-          baseURL: "https://inference.invalid",
-          apiKey: "e2e-placeholder",
-          model: "claude-sonnet-5",
+          sourceOfferingIds: [echoOfferingId],
+          defaultSourceOfferingId: echoOfferingId,
         }),
         user1.cookies,
       );
diff --git a/scripts/e2e/cl-6324-launch-proof.ts b/scripts/e2e/cl-6324-launch-proof.ts
index 6743150908..ef3be6297c 100644
--- a/scripts/e2e/cl-6324-launch-proof.ts
+++ b/scripts/e2e/cl-6324-launch-proof.ts
@@ -369,7 +369,7 @@ async function main(): Promise<void> {
   // on purpose, so it narrows the bench's own catalog to that model
   // through the catalog API rather than leaving the turn's model to a
   // coin flip the proof is not about.
-  await hop("narrow the bench catalog to the pinned model", async () => {
+  const pinnedOfferingId = await hop("narrow the bench catalog to the pinned model", async () => {
     await plantGrant("model-offering:*", "read");
     await plantGrant("model-offering:*", "manage");
     await plantGrant("model:*", "read");
@@ -409,8 +409,13 @@ async function main(): Promise<void> {
       "data",
       "model offerings",
     ) as { id: string; modelId: string; disabled: boolean }[];
+    let pinnedOffering: { id: string; modelId: string } | undefined;
     for (const offering of offeringRows) {
-      if (offering.modelId === pinned.id || offering.disabled) continue;
+      if (offering.modelId === pinned.id) {
+        pinnedOffering = offering;
+        continue;
+      }
+      if (offering.disabled) continue;
       const patched = await api(
         hub.baseUrl,
         "PATCH",
@@ -420,10 +425,17 @@ async function main(): Promise<void> {
       );
       expectStatus(`disable offering ${offering.id}`, patched, 200);
     }
+    if (pinnedOffering === undefined) {
+      throw new Error(
+        `no catalog offering resolves the pinned model ${proofModelSource.model} ` +
+          `(id ${pinned.id})`,
+      );
+    }
     console.log(
       `  TRANSCRIPT — bench catalog narrowed to ${proofModelSource.model} ` +
         `(${String(offeringRows.length - 1)} other offerings disabled)`,
     );
+    return pinnedOffering.id;
   });
 
   const assistantDefinitionId = await hop(
@@ -694,7 +706,6 @@ async function main(): Promise<void> {
   // own durable event log, which is the artefact the milestone's
   // `RunStarted` assertion was always about.
   const SECTION_ASSET_NAME = "cl6324-section";
-  const SECTION_SOURCE_ID = "cl6324-section-source";
   const SECTION_TURN_TIMEOUT_MS = 180_000;
   const sectionAddress = `${SECTION_ASSET_NAME}@${tenant.tenantDomain}`;
 
@@ -780,16 +791,8 @@ async function main(): Promise<void> {
                 package: { format: "source", commitSha: pushed.commitSha },
               },
               entry: WORKFLOW_SOURCE_ENTRY,
-              sources: [
-                {
-                  id: SECTION_SOURCE_ID,
-                  provider: model.provider,
-                  baseURL: model.baseURL,
-                  apiKey: model.apiKey,
-                  model: model.model,
-                },
-              ],
-              defaultSource: SECTION_SOURCE_ID,
+              sourceOfferingIds: [pinnedOfferingId],
+              defaultSourceOfferingId: pinnedOfferingId,
             },
             user.cookies,
           );
diff --git a/scripts/e2e/harness.ts b/scripts/e2e/harness.ts
index 099a7a2109..27cd392047 100644
--- a/scripts/e2e/harness.ts
+++ b/scripts/e2e/harness.ts
@@ -653,16 +653,17 @@ export async function pushWorkflowSource(options: {
 /**
  * The deploy body a code-sourced asset deployment takes: the pushed
  * commit is the definition's pin, and the entry names the
- * `interchange.workflow` module the sidecar evaluates.
+ * `interchange.workflow` module the sidecar evaluates. The native route
+ * resolves inference against the tenant's own catalog, so the caller
+ * supplies the ordered catalog offering ids to deploy against rather
+ * than a raw provider/baseURL/apiKey triple — see `seedNoopCatalogOffering`
+ * for the zero-cost way to obtain one.
  */
 export function workflowDeployBody(options: {
   assetId: string;
   commitSha: string;
-  sourceId: string;
-  provider: string;
-  baseURL: string;
-  apiKey: string;
-  model: string;
+  sourceOfferingIds: string[];
+  defaultSourceOfferingId: string;
 }): Record<string, unknown> {
   return {
     source: {
@@ -671,15 +672,103 @@ export function workflowDeployBody(options: {
       package: { format: "source", commitSha: options.commitSha },
     },
     entry: WORKFLOW_SOURCE_ENTRY,
-    sources: [
-      {
-        id: options.sourceId,
-        provider: options.provider,
-        baseURL: options.baseURL,
-        apiKey: options.apiKey,
-        model: options.model,
-      },
-    ],
-    defaultSource: options.sourceId,
+    sourceOfferingIds: options.sourceOfferingIds,
+    defaultSourceOfferingId: options.defaultSourceOfferingId,
   };
 }
+
+/**
+ * Plants the zero-cost catalog chain every deploying e2e suite needs: a
+ * catalog model, an `anthropic`-plugin provider/credential pointed at
+ * `noopBaseUrl` (never a real provider host — enforced below), and the
+ * catalog offering joining them. Returns the offering id a deploy's
+ * `sourceOfferingIds`/`defaultSourceOfferingId` resolves against.
+ * Mirrors the chain `smoke-webhook.test.ts` proved out by hand.
+ */
+export async function seedNoopCatalogOffering(options: {
+  call: (
+    method: string,
+    path: string,
+    body?: unknown,
+    cookies?: string[],
+  ) => Promise<ApiResult>;
+  tenantId: string;
+  cookies: string[];
+  noopBaseUrl: string;
+}): Promise<{ offeringId: string }> {
+  assertNeverRealProvider(options.noopBaseUrl, "noop catalog provider baseURL");
+  const { call, tenantId, cookies } = options;
+
+  const model = await call(
+    "POST",
+    `/api/tenants/${tenantId}/catalog/models`,
+    { canonicalName: "noop" },
+    cookies,
+  );
+  expectStatus("create catalog model", model, 201);
+  const modelId = stringFieldOf(model.data, "id", "create catalog model");
+
+  const provider = await call(
+    "POST",
+    `/api/tenants/${tenantId}/providers`,
+    { name: "anthropic", plugin: "anthropic" },
+    cookies,
+  );
+  expectStatus("create provider", provider, 201);
+  const providerId = stringFieldOf(provider.data, "id", "create provider");
+
+  const credential = await call(
+    "POST",
+    `/api/tenants/${tenantId}/credentials`,
+    {
+      providerId,
+      name: "anthropic-default",
+      type: "api_key",
+      secret: "noop",
+    },
+    cookies,
+  );
+  expectStatus("create credential", credential, 201);
+  const credentialId = stringFieldOf(
+    credential.data,
+    "id",
+    "create credential",
+  );
+
+  const catalogProvider = await call(
+    "POST",
+    `/api/tenants/${tenantId}/catalog/providers`,
+    {
+      name: "anthropic",
+      plugin: "anthropic",
+      baseURL: options.noopBaseUrl,
+      credentialId,
+    },
+    cookies,
+  );
+  expectStatus("create catalog provider", catalogProvider, 201);
+  const catalogProviderId = stringFieldOf(
+    catalogProvider.data,
+    "id",
+    "create catalog provider",
+  );
+
+  const offering = await call(
+    "POST",
+    `/api/tenants/${tenantId}/catalog/offerings`,
+    { modelId, providerId: catalogProviderId },
+    cookies,
+  );
+  expectStatus("create catalog offering", offering, 201);
+  return { offeringId: stringFieldOf(offering.data, "id", "create catalog offering") };
+}
+
+function stringFieldOf(data: unknown, field: string, what: string): string {
+  if (typeof data === "object" && data !== null && field in data) {
+    const value = (data as Record<string, unknown>)[field];
+    if (typeof value === "string" && value !== "") return value;
+  }
+  throw new Error(
+    `${what}: missing string field "${field}": ${JSON.stringify(data)}`,
+  );
+}
diff --git a/scripts/e2e/heartbeat.test.ts b/scripts/e2e/heartbeat.test.ts
index c19a6b6a2c..9aefb900fb 100644
--- a/scripts/e2e/heartbeat.test.ts
+++ b/scripts/e2e/heartbeat.test.ts
@@ -29,6 +29,7 @@ import {
   hop,
   provisionSidecar,
   pushWorkflowSource,
+  seedNoopCatalogOffering,
   workflowDeployBody,
   startHub,
   startSidecar,
@@ -203,16 +204,22 @@ describe.skipIf(databaseUrl === undefined)("heartbeat workflow", () => {
     // whole point of this suite: a run started against this source
     // actually completes an inference call, at zero cost, because
     // noop-inference answers it locally without reaching a real model.
+    const { offeringId } = await hop("noop catalog seeding", () =>
+      seedNoopCatalogOffering({
+        call: (method, path, body, cookies) =>
+          api(hub.baseUrl, method, path, body, cookies),
+        tenantId,
+        cookies: user.cookies,
+        noopBaseUrl: `${hub.baseUrl}/api/chat/noop-inference`,
+      }),
+    );
+
     const deploymentId = await hop("workflow deploy", async () => {
-      const sourceId = "src-heartbeat-e2e";
       const body = workflowDeployBody({
         assetId,
         commitSha,
-        sourceId: sourceId,
-        provider: "anthropic",
-        baseURL: `${hub.baseUrl}/api/chat/noop-inference`,
-        apiKey: "noop",
-        model: "noop",
+        sourceOfferingIds: [offeringId],
+        defaultSourceOfferingId: offeringId,
       });
       const deadline = Date.now() + 60_000;
       let res: ApiResult;
diff --git a/scripts/e2e/smoke-webhook.test.ts b/scripts/e2e/smoke-webhook.test.ts
index 1d248defaf..760aca6a34 100644
--- a/scripts/e2e/smoke-webhook.test.ts
+++ b/scripts/e2e/smoke-webhook.test.ts
@@ -30,7 +30,6 @@ import {
 } from "../../workflows/heartbeat/src/index.ts";
 import {
   api,
-  assertNeverRealProvider,
   connectE2eDb,
   createCleanupHarness,
   e2eDatabaseUrl,
@@ -39,6 +38,7 @@ import {
   hop,
   provisionSidecar,
   pushWorkflowSource,
+  seedNoopCatalogOffering,
   workflowDeployBody,
   startHub,
   startSidecar,
@@ -138,77 +138,17 @@ describe.skipIf(databaseUrl === undefined)("smoke: webhook trigger", () => {
 
       // The zero-cost catalog chain: an anthropic-plugin provider whose
       // base URL is the hub's own noop-inference endpoint, never a real
-      // model. Mirrors `workbench-digest.test.ts`'s noop catalog seeding.
+      // model.
       const noopBaseUrl = `${hub.baseUrl}/api/chat/noop-inference`;
-      assertNeverRealProvider(noopBaseUrl, "noop catalog provider baseURL");
-      await hop("noop catalog seeding", async () => {
-        const model = await api(
-          hub.baseUrl,
-          "POST",
-          `/api/tenants/${tenantId}/catalog/models`,
-          { canonicalName: "noop" },
-          cookies,
-        );
-        expectStatus("create catalog model", model, 201);
-        const modelId = stringField(model.data, "id", "create catalog model");
-
-        const provider = await api(
-          hub.baseUrl,
-          "POST",
-          `/api/tenants/${tenantId}/providers`,
-          { name: "anthropic", plugin: "anthropic" },
-          cookies,
-        );
-        expectStatus("create provider", provider, 201);
-        const providerId = stringField(provider.data, "id", "create provider");
-
-        const credential = await api(
-          hub.baseUrl,
-          "POST",
-          `/api/tenants/${tenantId}/credentials`,
-          {
-            providerId,
-            name: "anthropic-default",
-            type: "api_key",
-            secret: "noop",
-          },
-          cookies,
-        );
-        expectStatus("create credential", credential, 201);
-        const credentialId = stringField(
-          credential.data,
-          "id",
-          "create credential",
-        );
-
-        const catalogProvider = await api(
-          hub.baseUrl,
-          "POST",
-          `/api/tenants/${tenantId}/catalog/providers`,
-          {
-            name: "anthropic",
-            plugin: "anthropic",
-            baseURL: noopBaseUrl,
-            credentialId,
-          },
+      const { offeringId } = await hop("noop catalog seeding", () =>
+        seedNoopCatalogOffering({
+          call: (method, path, body, cookies2) =>
+            api(hub.baseUrl, method, path, body, cookies2),
+          tenantId,
           cookies,
-        );
-        expectStatus("create catalog provider", catalogProvider, 201);
-        const catalogProviderId = stringField(
-          catalogProvider.data,
-          "id",
-          "create catalog provider",
-        );
-
-        const offering = await api(
-          hub.baseUrl,
-          "POST",
-          `/api/tenants/${tenantId}/catalog/offerings`,
-          { modelId, providerId: catalogProviderId },
-          cookies,
-        );
-        expectStatus("create catalog offering", offering, 201);
-      });
+          noopBaseUrl,
+        }),
+      );
 
       const assetName = "heartbeat";
       const { assetId, commitSha } = await hop(
@@ -256,16 +196,11 @@ describe.skipIf(databaseUrl === undefined)("smoke: webhook trigger", () => {
       );
 
       const definitionId = await hop("workflow deploy", async () => {
-        const sourceId = "src-smoke-webhook-e2e";
-        assertNeverRealProvider(noopBaseUrl, "workflow deploy source baseURL");
         const body = workflowDeployBody({
           assetId,
           commitSha,
-          sourceId: sourceId,
-          provider: "anthropic",
-          baseURL: noopBaseUrl,
-          apiKey: "noop",
-          model: "noop",
+          sourceOfferingIds: [offeringId],
+          defaultSourceOfferingId: offeringId,
         });
         const deadline = Date.now() + 60_000;
         for (;;) {
diff --git a/scripts/e2e/walking-skeleton.test.ts b/scripts/e2e/walking-skeleton.test.ts
index 833612dd67..8937f9b5e5 100644
--- a/scripts/e2e/walking-skeleton.test.ts
+++ b/scripts/e2e/walking-skeleton.test.ts
@@ -35,6 +35,7 @@ import {
   hop,
   provisionSidecar,
   pushWorkflowSource,
+  seedNoopCatalogOffering,
   workflowDeployBody,
   startHub,
   startSidecar,
@@ -199,20 +200,30 @@ describe.skipIf(databaseUrl === undefined)("walking skeleton", () => {
       },
     );
 
+    // Hop: noop catalog seeding. The native deploy resolves inference
+    // against a real catalog offering; this suite's chosen offering
+    // still names an unreachable placeholder host, since deployment
+    // never calls inference and full run-completion is not asserted.
+    const { offeringId } = await hop("noop catalog seeding", () =>
+      seedNoopCatalogOffering({
+        call: (method, path, body, cookies) =>
+          api(hub.baseUrl, method, path, body, cookies),
+        tenantId,
+        cookies: user.cookies,
+        noopBaseUrl: "https://inference.invalid",
+      }),
+    );
+
     // Hop: workflow deploy via the native deploy API. Retries while
     // the hub still answers 502 (the sidecar's dial-in may not have
     // completed yet); any other failure is final. The inference
     // source is a placeholder — deployment does not call inference.
     const deploymentId = await hop("workflow deploy", async () => {
-      const sourceId = "src-echo-e2e";
       const body = workflowDeployBody({
         assetId,
         commitSha,
-        sourceId: sourceId,
-        provider: "anthropic",
-        baseURL: "https://inference.invalid",
-        apiKey: "e2e-placeholder",
-        model: "claude-sonnet-5",
+        sourceOfferingIds: [offeringId],
+        defaultSourceOfferingId: offeringId,
       });
       const deadline = Date.now() + 60_000;
       let res: ApiResult;
diff --git a/scripts/e2e/workbench-digest.test.ts b/scripts/e2e/workbench-digest.test.ts
index ecf2dc56eb..8917bf8236 100644
--- a/scripts/e2e/workbench-digest.test.ts
+++ b/scripts/e2e/workbench-digest.test.ts
@@ -29,6 +29,7 @@ import {
   hop,
   provisionSidecar,
   pushWorkflowSource,
+  seedNoopCatalogOffering,
   workflowDeployBody,
   startHub,
   startSidecar,
@@ -207,16 +208,22 @@ describe.skipIf(databaseUrl === undefined)("workbench-digest workflow", () => {
     // whole point of this suite: a run started against this source
     // actually completes an inference call, at zero cost, because
     // noop-inference answers it locally without reaching a real model.
+    const { offeringId } = await hop("noop catalog seeding", () =>
+      seedNoopCatalogOffering({
+        call: (method, path, body, cookies) =>
+          api(hub.baseUrl, method, path, body, cookies),
+        tenantId,
+        cookies: user.cookies,
+        noopBaseUrl: `${hub.baseUrl}/api/chat/noop-inference`,
+      }),
+    );
+
     const deploymentId = await hop("workflow deploy", async () => {
-      const sourceId = "src-workbench-digest-e2e";
       const body = workflowDeployBody({
         assetId,
         commitSha,
-        sourceId: sourceId,
-        provider: "anthropic",
-        baseURL: `${hub.baseUrl}/api/chat/noop-inference`,
-        apiKey: "noop",
-        model: "noop",
+        sourceOfferingIds: [offeringId],
+        defaultSourceOfferingId: offeringId,
       });
       const deadline = Date.now() + 60_000;
       let res: ApiResult;

From b03ce16b54f9de7e1bb8f14a7efce6a50cd7f9ab Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sat, 5 Sep 2026 23:43:45 -0700
Subject: [PATCH 03/10] Fix formatting

---
 scripts/e2e/cl-6324-launch-proof.ts | 125 ++++++++++++++--------------
 scripts/e2e/harness.ts              |   4 +-
 2 files changed, 67 insertions(+), 62 deletions(-)

diff --git a/scripts/e2e/cl-6324-launch-proof.ts b/scripts/e2e/cl-6324-launch-proof.ts
index ef3be6297c..80766c99db 100644
--- a/scripts/e2e/cl-6324-launch-proof.ts
+++ b/scripts/e2e/cl-6324-launch-proof.ts
@@ -369,74 +369,77 @@ async function main(): Promise<void> {
   // on purpose, so it narrows the bench's own catalog to that model
   // through the catalog API rather than leaving the turn's model to a
   // coin flip the proof is not about.
-  const pinnedOfferingId = await hop("narrow the bench catalog to the pinned model", async () => {
-    await plantGrant("model-offering:*", "read");
-    await plantGrant("model-offering:*", "manage");
-    await plantGrant("model:*", "read");
+  const pinnedOfferingId = await hop(
+    "narrow the bench catalog to the pinned model",
+    async () => {
+      await plantGrant("model-offering:*", "read");
+      await plantGrant("model-offering:*", "manage");
+      await plantGrant("model:*", "read");
 
-    const models = await api(
-      hub.baseUrl,
-      "GET",
-      `/api/tenants/${tenant.tenantId}/catalog/models?limit=200`,
-      undefined,
-      user.cookies,
-    );
-    expectStatus("list the bench catalog models", models, 200);
-    const modelRows = arrayField(models.data, "data", "catalog models") as {
-      id: string;
-      canonicalName: string;
-    }[];
-    const pinned = modelRows.find(
-      (row) => row.canonicalName === proofModelSource.model,
-    );
-    if (pinned === undefined) {
-      throw new Error(
-        `the bench catalog carries no model named ${proofModelSource.model}; ` +
-          `it has ${JSON.stringify(modelRows.map((m) => m.canonicalName))}`,
+      const models = await api(
+        hub.baseUrl,
+        "GET",
+        `/api/tenants/${tenant.tenantId}/catalog/models?limit=200`,
+        undefined,
+        user.cookies,
       );
-    }
-
-    const offerings = await api(
-      hub.baseUrl,
-      "GET",
-      `/api/tenants/${tenant.tenantId}/catalog/offerings?limit=200`,
-      undefined,
-      user.cookies,
-    );
-    expectStatus("list the bench model offerings", offerings, 200);
-    const offeringRows = arrayField(
-      offerings.data,
-      "data",
-      "model offerings",
-    ) as { id: string; modelId: string; disabled: boolean }[];
-    let pinnedOffering: { id: string; modelId: string } | undefined;
-    for (const offering of offeringRows) {
-      if (offering.modelId === pinned.id) {
-        pinnedOffering = offering;
-        continue;
+      expectStatus("list the bench catalog models", models, 200);
+      const modelRows = arrayField(models.data, "data", "catalog models") as {
+        id: string;
+        canonicalName: string;
+      }[];
+      const pinned = modelRows.find(
+        (row) => row.canonicalName === proofModelSource.model,
+      );
+      if (pinned === undefined) {
+        throw new Error(
+          `the bench catalog carries no model named ${proofModelSource.model}; ` +
+            `it has ${JSON.stringify(modelRows.map((m) => m.canonicalName))}`,
+        );
       }
-      if (offering.disabled) continue;
-      const patched = await api(
+
+      const offerings = await api(
         hub.baseUrl,
-        "PATCH",
-        `/api/tenants/${tenant.tenantId}/catalog/offerings/${offering.id}`,
-        { disabled: true },
+        "GET",
+        `/api/tenants/${tenant.tenantId}/catalog/offerings?limit=200`,
+        undefined,
         user.cookies,
       );
-      expectStatus(`disable offering ${offering.id}`, patched, 200);
-    }
-    if (pinnedOffering === undefined) {
-      throw new Error(
-        `no catalog offering resolves the pinned model ${proofModelSource.model} ` +
-          `(id ${pinned.id})`,
+      expectStatus("list the bench model offerings", offerings, 200);
+      const offeringRows = arrayField(
+        offerings.data,
+        "data",
+        "model offerings",
+      ) as { id: string; modelId: string; disabled: boolean }[];
+      let pinnedOffering: { id: string; modelId: string } | undefined;
+      for (const offering of offeringRows) {
+        if (offering.modelId === pinned.id) {
+          pinnedOffering = offering;
+          continue;
+        }
+        if (offering.disabled) continue;
+        const patched = await api(
+          hub.baseUrl,
+          "PATCH",
+          `/api/tenants/${tenant.tenantId}/catalog/offerings/${offering.id}`,
+          { disabled: true },
+          user.cookies,
+        );
+        expectStatus(`disable offering ${offering.id}`, patched, 200);
+      }
+      if (pinnedOffering === undefined) {
+        throw new Error(
+          `no catalog offering resolves the pinned model ${proofModelSource.model} ` +
+            `(id ${pinned.id})`,
+        );
+      }
+      console.log(
+        `  TRANSCRIPT — bench catalog narrowed to ${proofModelSource.model} ` +
+          `(${String(offeringRows.length - 1)} other offerings disabled)`,
       );
-    }
-    console.log(
-      `  TRANSCRIPT — bench catalog narrowed to ${proofModelSource.model} ` +
-        `(${String(offeringRows.length - 1)} other offerings disabled)`,
-    );
-    return pinnedOffering.id;
-  });
+      return pinnedOffering.id;
+    },
+  );
 
   const assistantDefinitionId = await hop(
     "PROOF 1 — 'assistant' is invitable tenant-wide",
diff --git a/scripts/e2e/harness.ts b/scripts/e2e/harness.ts
index 27cd392047..cebc4e53db 100644
--- a/scripts/e2e/harness.ts
+++ b/scripts/e2e/harness.ts
@@ -760,7 +760,9 @@ export async function seedNoopCatalogOffering(options: {
     cookies,
   );
   expectStatus("create catalog offering", offering, 201);
-  return { offeringId: stringFieldOf(offering.data, "id", "create catalog offering") };
+  return {
+    offeringId: stringFieldOf(offering.data, "id", "create catalog offering"),
+  };
 }
 
 function stringFieldOf(data: unknown, field: string, what: string): string {

From f981798f2aad5db7e0a8c14a0234e8e1860c4cbe Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sat, 5 Sep 2026 23:53:52 -0700
Subject: [PATCH 04/10] Add tests for deploying default workflows by catalog
 offering ids

seedTenant currently deploys every default workflow with a bare
provider/baseURL/apiKey source, but the hub's deploy route now requires
sourceOfferingIds/defaultSourceOfferingId resolved from the tenant's
catalog. Update the seeding, onboarding, and hub config test suites to
expect the new offering-id based deploy body and provider/model-only
ModelSource shape ahead of the implementation change.
---
 apps/hub/test/config.test.ts                  |   1 -
 .../test/complete-credential.test.ts          |  55 +++++++--
 packages/onboarding/test/provision.test.ts    | 101 +++++++++++++++++
 .../test/routine-launchability.test.ts        |   2 -
 packages/seeding/test/seed.test.ts            | 106 +++++++++++++++---
 5 files changed, 237 insertions(+), 28 deletions(-)

diff --git a/apps/hub/test/config.test.ts b/apps/hub/test/config.test.ts
index 9d34351174..b4d41908e4 100644
--- a/apps/hub/test/config.test.ts
+++ b/apps/hub/test/config.test.ts
@@ -277,7 +277,6 @@ describe("readHubConfig", () => {
     expect(config.seedModel).toEqual({
       provider: "anthropic",
       model: "claude-sonnet-5",
-      baseURL: "https://api.anthropic.com",
       apiKey: "sk-ant-test",
     });
   });
diff --git a/packages/onboarding/test/complete-credential.test.ts b/packages/onboarding/test/complete-credential.test.ts
index c9ac97c2db..8a4ae6a789 100644
--- a/packages/onboarding/test/complete-credential.test.ts
+++ b/packages/onboarding/test/complete-credential.test.ts
@@ -63,6 +63,36 @@ function seedHandshake(method: string, path: string) {
   return { ...handshake, cookies: [] };
 }
 
+// `ensureDeployment` resolves a real (non-noop-pinned) workflow's deploy
+// source from the tenant's own catalog offerings (CL-7461). A test that
+// never seeds its own catalog (it stubs `seedCatalogFn` instead) still
+// needs one listable offering for the "assistant" workflow's own deploy
+// to succeed — this fixed single row is that.
+function fixedOfferingsResponse() {
+  return {
+    status: 200,
+    data: {
+      data: [
+        {
+          id: "off_1",
+          tenantId: TENANT_ID,
+          modelId: "mdl_1",
+          providerId: "mpr_1",
+          priority: 0,
+          deploymentTags: [],
+          capabilities: [],
+          quirks: null,
+          disabled: false,
+          createdAt: "2026-01-01T00:00:00.000Z",
+          updatedAt: "2026-01-01T00:00:00.000Z",
+        },
+      ],
+      nextCursor: null,
+    },
+    cookies: [],
+  };
+}
+
 function principalsResponse() {
   return {
     status: 200,
@@ -165,8 +195,6 @@ describe("modelSourceFor", () => {
     ).toEqual({
       provider: "anthropic",
       model: "claude-sonnet-5",
-      baseURL: "https://api.anthropic.com",
-      apiKey: "sk-ant",
     });
   });
 
@@ -192,8 +220,6 @@ describe("modelSourceFor", () => {
     ).toEqual({
       provider: "openai-compatible",
       model: "llama3.2",
-      baseURL: "http://localhost:11434/v1",
-      apiKey: "ollama",
     });
   });
 
@@ -339,7 +365,12 @@ describe("modelSourceFor", () => {
     expect(result.model).toBe("gpt-oss:20b");
   });
 
-  test("ollama's baseURLOverride is normalized to the /v1 form", async () => {
+  // `modelSourceFor` resolves a provider/model pair only — the deploy
+  // itself resolves inference from the tenant's own catalog offerings
+  // (CL-7461), so a `baseURLOverride` here is accepted (every caller
+  // already resolved one for `seedCatalog`'s earlier catalog plant) but
+  // never affects this resolution.
+  test("ollama resolves the same model whether or not a baseURLOverride is given", async () => {
     const api: ApiCall = async (method, path) => {
       if (method === "GET" && path === `/api/tenants/${TENANT_ID}/models`) {
         return resolvedCatalogResponse([
@@ -365,8 +396,6 @@ describe("modelSourceFor", () => {
     ).toEqual({
       provider: "openai-compatible",
       model: "qwen3.8:27b",
-      baseURL: "https://home-mac.example.ts.net/v1",
-      apiKey: "ollama",
     });
   });
 });
@@ -808,6 +837,12 @@ describe("completeCredentialSetup", () => {
       if (method === "GET" && path === `/api/tenants/${TENANT_ID}`) {
         return tenantResponse();
       }
+      if (
+        method === "GET" &&
+        path === `/api/tenants/${TENANT_ID}/catalog/offerings`
+      ) {
+        return fixedOfferingsResponse();
+      }
       if (
         method === "GET" &&
         path.startsWith(`/api/tenants/${TENANT_ID}/grants?`)
@@ -1791,6 +1826,12 @@ describe("ensureSeeded (the slow half)", () => {
     let deploymentCreatePosts = 0;
 
     const api: ApiCall = async (method, path, body) => {
+      if (
+        method === "GET" &&
+        path === `/api/tenants/${TENANT_ID}/catalog/offerings`
+      ) {
+        return fixedOfferingsResponse();
+      }
       if (
         method === "GET" &&
         path.startsWith(`/api/tenants/${TENANT_ID}/grants?`)
diff --git a/packages/onboarding/test/provision.test.ts b/packages/onboarding/test/provision.test.ts
index af1594cbc6..b1feabe081 100644
--- a/packages/onboarding/test/provision.test.ts
+++ b/packages/onboarding/test/provision.test.ts
@@ -87,6 +87,41 @@ function collector() {
   return { lines, log: (line: string) => lines.push(line) };
 }
 
+// `ensureDeployment` resolves a real (non-noop-pinned) workflow's deploy
+// source from the tenant's own catalog offerings (CL-7461); every test
+// that seeds a real default workflow needs at least one listable, since
+// none of these tests seed a catalog of its own.
+function catalogOfferingsResponse(
+  method: string,
+  path: string,
+  tenantId: string,
+): { status: number; data: unknown; cookies: string[] } | undefined {
+  if (method !== "GET" || path !== `/api/tenants/${tenantId}/catalog/offerings`)
+    return undefined;
+  return {
+    status: 200,
+    data: {
+      data: [
+        {
+          id: "off_1",
+          tenantId,
+          modelId: "mdl_1",
+          providerId: "mpr_1",
+          priority: 0,
+          deploymentTags: [],
+          capabilities: [],
+          quirks: null,
+          disabled: false,
+          createdAt: "2026-01-01T00:00:00.000Z",
+          updatedAt: "2026-01-01T00:00:00.000Z",
+        },
+      ],
+      nextCursor: null,
+    },
+    cookies: [],
+  };
+}
+
 function firstLoginSeedHub(args: { expectedParentId?: string }) {
   let principalsCalls = 0;
   const startedRuns: string[] = [];
@@ -206,6 +241,33 @@ function firstLoginSeedHub(args: { expectedParentId?: string }) {
     ) {
       return { status: 200, data: [], cookies: [] };
     }
+    if (
+      method === "GET" &&
+      path === `/api/tenants/${TENANT_ID}/catalog/offerings`
+    ) {
+      return {
+        status: 200,
+        data: {
+          data: [
+            {
+              id: "off_1",
+              tenantId: TENANT_ID,
+              modelId: "mdl_1",
+              providerId: "mpr_1",
+              priority: 0,
+              deploymentTags: [],
+              capabilities: [],
+              quirks: null,
+              disabled: false,
+              createdAt: "2026-01-01T00:00:00.000Z",
+              updatedAt: "2026-01-01T00:00:00.000Z",
+            },
+          ],
+          nextCursor: null,
+        },
+        cookies: [],
+      };
+    }
     if (
       method === "GET" &&
       path.startsWith(`/api/tenants/${TENANT_ID}/workflows/definitions`)
@@ -638,6 +700,33 @@ describe("provisionPersonalTenantIfNeeded", () => {
         "missing",
       );
       if (registry !== undefined) return registry;
+      if (
+        method === "GET" &&
+        path === `/api/tenants/${TENANT_ID}/catalog/offerings`
+      ) {
+        return {
+          status: 200,
+          data: {
+            data: [
+              {
+                id: "off_1",
+                tenantId: TENANT_ID,
+                modelId: "mdl_1",
+                providerId: "mpr_1",
+                priority: 0,
+                deploymentTags: [],
+                capabilities: [],
+                quirks: null,
+                disabled: false,
+                createdAt: "2026-01-01T00:00:00.000Z",
+                updatedAt: "2026-01-01T00:00:00.000Z",
+              },
+            ],
+            nextCursor: null,
+          },
+          cookies: [],
+        };
+      }
       if (method === "GET" && path === "/api/me/principals") {
         return membership();
       }
@@ -890,6 +979,8 @@ describe("provisionPersonalTenantIfNeeded", () => {
         SEEDED_MEMORY_TARBALL,
       ]);
       if (registry !== undefined) return registry;
+      const offerings = catalogOfferingsResponse(method, path, TENANT_ID);
+      if (offerings !== undefined) return offerings;
       if (method === "GET" && path === "/api/me/principals") {
         return {
           status: 200,
@@ -1019,6 +1110,8 @@ describe("provisionPersonalTenantIfNeeded", () => {
         SEEDED_MEMORY_TARBALL,
       ]);
       if (registry !== undefined) return registry;
+      const offerings = catalogOfferingsResponse(method, path, TENANT_ID);
+      if (offerings !== undefined) return offerings;
       if (method === "GET" && path === "/api/me/principals") {
         return {
           status: 200,
@@ -1133,6 +1226,8 @@ describe("provisionPersonalTenantIfNeeded", () => {
         "missing",
       );
       if (registry !== undefined) return registry;
+      const offerings = catalogOfferingsResponse(method, path, TENANT_ID);
+      if (offerings !== undefined) return offerings;
       if (method === "GET" && path === "/api/me/principals") {
         return {
           status: 200,
@@ -1243,6 +1338,8 @@ describe("provisionPersonalTenantIfNeeded", () => {
         "missing",
       );
       if (registry !== undefined) return registry;
+      const offerings = catalogOfferingsResponse(method, path, TENANT_ID);
+      if (offerings !== undefined) return offerings;
       if (method === "GET" && path === "/api/me/principals") {
         return {
           status: 200,
@@ -1485,6 +1582,8 @@ describe("provisionPersonalTenantIfNeeded", () => {
         "missing",
       );
       if (registry !== undefined) return registry;
+      const offerings = catalogOfferingsResponse(method, path, TENANT_ID);
+      if (offerings !== undefined) return offerings;
       if (method === "GET" && path === "/api/me/principals") {
         return {
           status: 200,
@@ -1832,6 +1931,8 @@ describe("provisionPersonalTenantIfNeeded", () => {
         [],
       );
       if (registry !== undefined) return registry;
+      const offerings = catalogOfferingsResponse(method, path, TENANT_ID);
+      if (offerings !== undefined) return offerings;
       if (method === "GET" && path === "/api/me/principals") {
         return {
           status: 200,
diff --git a/packages/seeding/test/routine-launchability.test.ts b/packages/seeding/test/routine-launchability.test.ts
index 427fa0b001..746e0e2021 100644
--- a/packages/seeding/test/routine-launchability.test.ts
+++ b/packages/seeding/test/routine-launchability.test.ts
@@ -27,8 +27,6 @@ import {
 const FAKE_MODEL: ModelSource = {
   provider: "ollama",
   model: "qwen-test",
-  baseURL: "http://localhost:11434",
-  apiKey: "test-key",
 };
 
 type SerializedStepDefinition = {
diff --git a/packages/seeding/test/seed.test.ts b/packages/seeding/test/seed.test.ts
index b6291fc941..720250165c 100644
--- a/packages/seeding/test/seed.test.ts
+++ b/packages/seeding/test/seed.test.ts
@@ -38,10 +38,38 @@ installDisposableHubDataDir();
 const MODEL = {
   provider: "anthropic",
   model: "claude-sonnet-4-5",
-  baseURL: "https://api.anthropic.com",
-  apiKey: "sk-test",
 };
 
+// The tenant's one real catalog offering — every `seedTenant` test that
+// deploys a real (non-noop-pinned) workflow needs at least one of these
+// listable, since `ensureDeployment` now resolves its deploy source from
+// the tenant's catalog rather than a bare `ModelSource`.
+const OFFERING_ID = "off_1";
+
+function offeringsPage(
+  ids: readonly string[] = [OFFERING_ID],
+): { status: number; data: unknown } {
+  return {
+    status: 200,
+    data: {
+      data: ids.map((id, index) => ({
+        id,
+        tenantId: TENANT_ID,
+        modelId: `mdl_${id}`,
+        providerId: `mpr_${id}`,
+        priority: index,
+        deploymentTags: [],
+        capabilities: [],
+        quirks: null,
+        disabled: false,
+        createdAt: "2026-01-01T00:00:00.000Z",
+        updatedAt: "2026-01-01T00:00:00.000Z",
+      })),
+      nextCursor: null,
+    },
+  };
+}
+
 const instantSleep = async (_ms: number) => {};
 
 const recordingPusher = () => {
@@ -98,6 +126,40 @@ function baseRoutes(method: string, path: string) {
     path === `/api/tenants/${TENANT_ID}/workflows/deployments`
   )
     return { status: 200, data: [] };
+  if (
+    method === "GET" &&
+    path === `/api/tenants/${TENANT_ID}/catalog/offerings`
+  )
+    return offeringsPage();
+  // The noop catalog chain `ensureNoopCatalogOffering` plants for a
+  // modelSource-pinned workflow (heartbeat) — every seedTenant test that
+  // deploys one needs this fresh chain to succeed, so it lives in the
+  // shared fallback rather than every such test repeating it.
+  if (method === "POST" && path === `/api/tenants/${TENANT_ID}/catalog/models`)
+    return { status: 201, data: catalogModelRow("mdl_noop", "noop") };
+  if (method === "POST" && path === `/api/tenants/${TENANT_ID}/providers`)
+    return { status: 201, data: providerRow("prv_noop", "noop") };
+  if (method === "POST" && path === `/api/tenants/${TENANT_ID}/credentials`)
+    return {
+      status: 201,
+      data: credentialRow("cre_noop", "prv_noop", "noop-default"),
+    };
+  if (
+    method === "POST" &&
+    path === `/api/tenants/${TENANT_ID}/catalog/providers`
+  )
+    return {
+      status: 201,
+      data: catalogProviderRow("cpv_noop", "noop", "cre_noop", "anthropic"),
+    };
+  if (
+    method === "POST" &&
+    path === `/api/tenants/${TENANT_ID}/catalog/offerings`
+  )
+    return {
+      status: 201,
+      data: catalogOfferingRow("off_noop", "mdl_noop", "cpv_noop"),
+    };
   const handshake = pristineScheduledDefinitionHandshake(method, path);
   if (handshake) return handshake;
   return undefined;
@@ -860,11 +922,9 @@ describe("seedTenant", () => {
     expect(assistant?.displayName).toBe("Myra");
   });
 
-  test("NOOP_MODEL_SOURCE resolves to the hub's own noop-inference endpoint", () => {
-    const resolved = NOOP_MODEL_SOURCE("http://localhost:3000");
-    expect(resolved.baseURL).toBe(
-      "http://localhost:3000/api/chat/noop-inference",
-    );
+  test("NOOP_MODEL_SOURCE names the noop provider/model pair", () => {
+    const resolved = NOOP_MODEL_SOURCE();
+    expect(resolved.provider).toBe("anthropic");
     expect(resolved.model).toBe("noop");
   });
 
@@ -934,8 +994,8 @@ describe("seedTenant", () => {
       (w) => w.assetName === "heartbeat",
     );
     if (!heartbeat) throw new Error("expected the heartbeat workflow");
-    const resolved = heartbeat.modelSource?.("http://localhost:3000");
-    expect(resolved).toEqual(NOOP_MODEL_SOURCE("http://localhost:3000"));
+    const resolved = heartbeat.modelSource?.();
+    expect(resolved).toEqual(NOOP_MODEL_SOURCE());
   });
 
   test("fresh run pushes, deploys, and confirms the heartbeat workflow against the noop source", async () => {
@@ -1012,12 +1072,17 @@ describe("seedTenant", () => {
     expect(definition.triggers[0]?.to).toBe(`heartbeat@${TENANT_DOMAIN}`);
     expect(definition.stepOrder).toEqual(["heartbeat"]);
 
-    // The deploy's own source, not the tenant's real MODEL, is what
-    // proves the noop pin took effect: it must name the noop provider
-    // fixture, not the ordinary anthropic/claude-sonnet-4-5 model this
-    // test file's `args()` helper hands every other workflow.
-    const deployedBody = deployedSources as { sources: { model: string }[] };
-    expect(deployedBody.sources[0]?.model).toBe("noop");
+    // The deploy's own source offering, not the tenant's real catalog
+    // offering, is what proves the noop pin took effect: it must name
+    // the dedicated noop offering `ensureNoopCatalogOffering` plants,
+    // never the tenant's own `OFFERING_ID` this test file's `baseRoutes`
+    // fixture hands every real workflow.
+    const deployedBody = deployedSources as {
+      sourceOfferingIds: string[];
+      defaultSourceOfferingId: string;
+    };
+    expect(deployedBody.sourceOfferingIds).toEqual(["off_noop"]);
+    expect(deployedBody.defaultSourceOfferingId).toBe("off_noop");
 
     const output = lines.join("\n");
     expect(output).toContain("deployed workflow heartbeat as dep_3");
@@ -1135,9 +1200,14 @@ describe("seedTenant", () => {
     ]);
     expect(definition.stepOrder).toEqual(["workbench-digest"]);
 
-    // Defaults deploy against the tenant's real model (not noop).
-    const deployedBody = deployedSources as { sources: { model: string }[] };
-    expect(deployedBody.sources[0]?.model).not.toBe("noop");
+    // Defaults deploy against the tenant's real catalog offering, never
+    // the noop one.
+    const deployedBody = deployedSources as {
+      sourceOfferingIds: string[];
+      defaultSourceOfferingId: string;
+    };
+    expect(deployedBody.sourceOfferingIds).toEqual([OFFERING_ID]);
+    expect(deployedBody.defaultSourceOfferingId).toBe(OFFERING_ID);
 
     const output = lines.join("\n");
     expect(output).toContain("deployed workflow workbench-digest as dep_4");

From 1ce35c4fa2202730eabe41578a95978cff05c8cf Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sat, 5 Sep 2026 23:54:00 -0700
Subject: [PATCH 05/10] Seeding: deploy default workflows by catalog offering
 ids
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ensureDeployment posted a bare {provider, baseURL, apiKey, model}
source, but the hub's deploy route requires sourceOfferingIds and a
defaultSourceOfferingId resolved from the tenant's catalog, so seeding
a connect flow's "assistant" workflow 400'd. seedTenant now resolves
the tenant's real catalog offerings (sorted by priority, lowest wins
the default) for a normal workflow, and plants a dedicated noop
catalog offering for a modelSource-pinned one (heartbeat), pointed at
the hub's own noop-inference endpoint. ModelSource shrinks to a bare
provider/model pair — the baseURL/apiKey it used to carry only mattered
for the old deploy body, and callers that still need a key for seeding
a catalog (system-seed's root tenant, config's env-key auto-plant) keep
it on their own local type instead.
---
 apps/hub/src/config.ts                        |   8 +-
 apps/hub/src/system-seed.ts                   |  23 +-
 .../onboarding/src/complete-credential.ts     |  51 +--
 packages/seeding/src/seed.ts                  | 316 +++++++++++++++---
 4 files changed, 305 insertions(+), 93 deletions(-)

diff --git a/apps/hub/src/config.ts b/apps/hub/src/config.ts
index d9fdad334a..1d3afcf793 100644
--- a/apps/hub/src/config.ts
+++ b/apps/hub/src/config.ts
@@ -272,7 +272,6 @@ function parsePositiveMsEnv(
 
 const SEED_MODEL_PROVIDER = "anthropic";
 const SEED_MODEL = "claude-sonnet-5";
-const SEED_MODEL_BASE_URL = "https://api.anthropic.com";
 
 // Matches boot-time seeding's own defaults (`system-seed.ts`) exactly,
 // so a zero-.env-edit local checkout that seeds its admin account
@@ -282,10 +281,14 @@ const DEFAULT_PLANT_ADMIN_EMAIL = "alice@example.com";
 const DEFAULT_PLANT_ADMIN_PASSWORD = "password123";
 const DEFAULT_PLANT_ORG_SLUG = "workbench";
 
+/** The root tenant's boot-time seed model: a provider/model pair
+ * `seedTenant` names in every deployed definition, plus the real (or
+ * placeholder) key `seedCatalog` plants a launchable credential with. No
+ * `baseURL` — a workflow deploy resolves inference from the tenant's
+ * catalog offerings, never a bare source tuple (CL-7461). */
 export type ModelSource = {
   readonly provider: string;
   readonly model: string;
-  readonly baseURL: string;
   readonly apiKey: string;
 };
 
@@ -624,7 +627,6 @@ function seedModelFrom(parsed: ParsedHubEnv): ModelSource | undefined {
   return {
     provider: SEED_MODEL_PROVIDER,
     model: SEED_MODEL,
-    baseURL: SEED_MODEL_BASE_URL,
     apiKey,
   };
 }
diff --git a/apps/hub/src/system-seed.ts b/apps/hub/src/system-seed.ts
index 7f9291fc54..52f0ff8e66 100644
--- a/apps/hub/src/system-seed.ts
+++ b/apps/hub/src/system-seed.ts
@@ -26,7 +26,6 @@ import {
   publishCorbitsToolsRegistry,
   DEFAULT_WORKFLOWS,
   PLACEHOLDER_CATALOG_API_KEY,
-  type ModelSource,
 } from "@corbits/seeding";
 import { createHubAPI, signIn, type ApiCall } from "@corbits/hub-api-client";
 import { findPersonalTenant } from "@workbench/onboarding";
@@ -43,14 +42,26 @@ const DEFAULT_POLL_INTERVAL_MS = 2_000;
 // and the catalog is still browsable, just not launchable.
 const SEED_MODEL_PROVIDER = "anthropic";
 const SEED_MODEL = "claude-sonnet-5";
-const SEED_MODEL_BASE_URL = "https://api.anthropic.com";
 
-function resolvedModel(seedModel: ModelSource | undefined): ModelSource {
+/**
+ * The root tenant's seed model: a provider/model pair for
+ * `seedTenant`'s deployed definitions, plus the real (or placeholder)
+ * API key `seedCatalog` needs to plant a launchable credential. Distinct
+ * from `@corbits/seeding`'s `ModelSource`, which carries no key —
+ * `seedTenant` never needs one; the deploy itself resolves inference
+ * from the tenant's catalog offerings (CL-7461).
+ */
+export type SeedModelConfig = {
+  readonly provider: string;
+  readonly model: string;
+  readonly apiKey: string;
+};
+
+function resolvedModel(seedModel: SeedModelConfig | undefined): SeedModelConfig {
   return (
     seedModel ?? {
       provider: SEED_MODEL_PROVIDER,
       model: SEED_MODEL,
-      baseURL: SEED_MODEL_BASE_URL,
       apiKey: PLACEHOLDER_CATALOG_API_KEY,
     }
   );
@@ -60,7 +71,7 @@ export type SystemSeedDeps = {
   baseUrl: string;
   orgSlug: string;
   admin: { email: string; password: string };
-  seedModel?: ModelSource;
+  seedModel?: SeedModelConfig;
   deadlineMs?: number;
   pollIntervalMs?: number;
 };
@@ -116,7 +127,7 @@ export async function runSystemSeed(deps: SystemSeedDeps): Promise<void> {
           principalId: tenant.principalId,
           domain: tenant.tenantDomain,
         },
-        model,
+        model: { provider: model.provider, model: model.model },
         pushWorkflow,
         log: (line) => log.info`${line}`,
         workflows: DEFAULT_WORKFLOWS,
diff --git a/packages/onboarding/src/complete-credential.ts b/packages/onboarding/src/complete-credential.ts
index 5af80e3f77..f5f4a930aa 100644
--- a/packages/onboarding/src/complete-credential.ts
+++ b/packages/onboarding/src/complete-credential.ts
@@ -60,10 +60,7 @@ import {
   TenantResponse,
   paginatedSchema,
 } from "@intx/types";
-import {
-  ollamaOpenAICompatBaseURL,
-  type SupportedCredentialProvider,
-} from "@corbits/connections/credential-test";
+import { type SupportedCredentialProvider } from "@corbits/connections/credential-test";
 import { preferCompletionCapable } from "@corbits/connections/model-capability";
 import {
   CATALOG_SEEDS,
@@ -280,13 +277,8 @@ async function resolveOllamaModelSource(
   api: ApiCall,
   cookies: string[],
   tenantId: string,
-  apiKey: string,
-  baseURLOverride: string | undefined,
 ): Promise<ModelSource> {
   const catalogSeed = CATALOG_SEEDS.ollama;
-  const baseURL = ollamaOpenAICompatBaseURL(
-    baseURLOverride ?? catalogSeed.provider.baseURL,
-  );
 
   const response = await api(
     "GET",
@@ -368,39 +360,32 @@ async function resolveOllamaModelSource(
   return {
     provider: winner.plugin,
     model: winner.canonicalName,
-    baseURL,
-    apiKey,
   };
 }
 
-/** The `ModelSource` `ensureSeeded` deploys every default workflow
- * against. Every provider but `ollama` has a fixed, always-available
- * curated model list (`CATALOG_SEEDS`), so its curated default is a safe
- * pin. `ollama` is the one provider whose actual model list is
- * per-instance and can diverge from that curated name entirely
- * (CL-6366) — its resolution defers to `resolveOllamaModelSource`, which
- * reads back what `seedCatalog` actually found on the instance rather
- * than repeating the static pin. `baseURLOverride` is the
- * configurable-base-URL seam every provider but `ollama` ignores (a
- * fixed origin); for `ollama` it is the root the person actually pointed
- * their instance at, normalized to the OpenAI-compatible `/v1` form this
- * deploys against. */
+/** The `ModelSource` `ensureSeeded` names in every deployed definition's
+ * inference preferences — never what the deploy itself resolves
+ * inference against (the tenant's catalog offerings, CL-7461). Every
+ * provider but `ollama` has a fixed, always-available curated model list
+ * (`CATALOG_SEEDS`), so its curated default is a safe pin. `ollama` is
+ * the one provider whose actual model list is per-instance and can
+ * diverge from that curated name entirely (CL-6366) — its resolution
+ * defers to `resolveOllamaModelSource`, which reads back what
+ * `seedCatalog` actually found on the instance rather than repeating the
+ * static pin. `apiKey`/`baseURLOverride` are accepted only because every
+ * caller already resolved them for `seedCatalog`'s own credential/catalog
+ * plant, which runs ahead of this in the same connect flow; this
+ * function itself needs neither. */
 export async function modelSourceFor(
   api: ApiCall,
   cookies: string[],
   tenantId: string,
   provider: SupportedCredentialProvider,
-  apiKey: string,
-  baseURLOverride?: string,
+  _apiKey: string,
+  _baseURLOverride?: string,
 ): Promise<ModelSource> {
   if (provider === "ollama") {
-    return resolveOllamaModelSource(
-      api,
-      cookies,
-      tenantId,
-      apiKey,
-      baseURLOverride,
-    );
+    return resolveOllamaModelSource(api, cookies, tenantId);
   }
 
   const catalogSeed = CATALOG_SEEDS[provider];
@@ -413,8 +398,6 @@ export async function modelSourceFor(
   return {
     provider: catalogSeed.provider.plugin,
     model: defaultModel.canonicalName,
-    baseURL: catalogSeed.provider.baseURL,
-    apiKey,
   };
 }
 
diff --git a/packages/seeding/src/seed.ts b/packages/seeding/src/seed.ts
index 2b34e98c3d..20e350303e 100644
--- a/packages/seeding/src/seed.ts
+++ b/packages/seeding/src/seed.ts
@@ -141,11 +141,6 @@ const DILIGENCE_BRIEF_TURN_TIMEOUT_MS = 2 * 60 * 1000;
 const RUN_START_TIMEOUT_MS = 30_000;
 const RUN_POLL_INTERVAL_MS = 1000;
 
-// The deploy source the per-step agents launch against. The id is the
-// routing key `defaultSource` must name; with exactly one source there
-// is exactly one honest value for it.
-const SEED_SOURCE_ID = "default";
-
 // The provider/model pair `noop-inference` (packages/chat/src/noop-inference.ts)
 // answers for any request, regardless of what is actually sent — the
 // route ignores its body and `x-api-key` entirely. Naming a distinct
@@ -154,24 +149,31 @@ const SEED_SOURCE_ID = "default";
 // UI and logs.
 const NOOP_PROVIDER = "anthropic";
 const NOOP_MODEL = "noop";
+// The catalog provider/credential name a noop-pinned deployment's own
+// offering is planted under — distinct from any real curated provider
+// name (`CATALOG_SEEDS`'s keys), so `ensureNoopCatalogOffering` never
+// collides with a tenant's real catalog and is trivially recognizable
+// in the hub's own catalog UI.
+const NOOP_CATALOG_PROVIDER_NAME = "noop";
+// Priority is meaningless for this offering — it is never included in
+// a real workflow's `sourceOfferingIds` (`ensureNoopCatalogOffering`'s
+// id is threaded through explicitly, never discovered by sorting), so
+// any fixed value is honest here.
+const NOOP_OFFERING_PRIORITY = 0;
 
 /**
- * A `ModelSource` pointed at the hub's own `noop-inference` endpoint
+ * The provider/model pair naming the hub's own `noop-inference` endpoint
  * instead of a real provider — the same substitution
  * `packages/chat/src/platform-adapter.ts`'s `noopSourcesOverride` makes
- * for workbench-host launches, reused here so a workflow deployed with
- * this source resolves every turn instantly against a constant,
- * locally served reply and never reaches a real model. `hubUrl` is the
- * same base URL `seedTenant` already receives, so no new configuration
- * is required to use it.
+ * for workbench-host launches, reused here so a workflow's rendered
+ * definition names this pair in its inference preferences. The actual
+ * deploy source is a catalog offering pinned at this same endpoint
+ * (`ensureNoopCatalogOffering`), not this pair directly — a workflow
+ * deployment resolves inference from catalog offering ids, never a bare
+ * provider/model/baseURL/apiKey tuple (CL-7461).
  */
-export function NOOP_MODEL_SOURCE(hubUrl: string): ModelSource {
-  return {
-    provider: NOOP_PROVIDER,
-    model: NOOP_MODEL,
-    baseURL: `${hubUrl}/api/chat/noop-inference`,
-    apiKey: "noop",
-  };
+export function NOOP_MODEL_SOURCE(): ModelSource {
+  return { provider: NOOP_PROVIDER, model: NOOP_MODEL };
 }
 
 const GitTokenMintResponse = type({ id: "string", secret: "string" });
@@ -191,11 +193,18 @@ const WorkflowRunTriggerResponse = type({
   messageId: "string",
 });
 
+/**
+ * A provider/model pair a deployed workflow's rendered definition names
+ * in its inference preferences (`DefaultWorkflow.buildJson`'s second
+ * argument). What a deployment actually resolves inference against is
+ * the tenant's catalog offerings, resolved separately by `ensureDeployment`
+ * (or, for a noop-pinned workflow, `ensureNoopCatalogOffering`) — this
+ * type carries no `baseURL`/`apiKey` because `seedTenant` never needs
+ * either (CL-7461).
+ */
 export type ModelSource = {
   readonly provider: string;
   readonly model: string;
-  readonly baseURL: string;
-  readonly apiKey: string;
 };
 
 /**
@@ -240,9 +249,9 @@ export type DefaultWorkflow = {
    * Renders the definition's JSON given the tenant's mail domain and the
    * ordered provider/model preferences to deploy against. Takes the bare
    * preference list — never a full `ModelSource` — so this same
-   * function serves both `seedTenant`'s HTTP-deploy path (which also
-   * needs a `ModelSource`'s `baseURL`/`apiKey` for the deployment's
-   * `sources`, resolved separately) and a native in-process deploy path
+   * function serves both `seedTenant`'s HTTP-deploy path (whose actual
+   * deploy source is a set of catalog offering ids, resolved separately
+   * by `ensureDeployment`) and a native in-process deploy path
    * (`apps/hub/src/templates/block-workflows.ts`) that only ever has the
    * tenant's real, possibly multi-entry inference preferences on hand.
    */
@@ -251,15 +260,16 @@ export type DefaultWorkflow = {
     inferencePreferences: readonly InferencePreference[],
   ) => string;
   /**
-   * Overrides the deploy's inference source for this workflow only,
-   * given the hub's own base URL. Present on the catalog-test workflow
-   * `heartbeat`, which must stay free to run continuously: it names
-   * `NOOP_MODEL_SOURCE` instead of the tenant's real catalog model.
-   * Absent on every conversational workflow and on the seeded
-   * workbench-digest automation, which deploy against the tenant's real
-   * model.
+   * Overrides the deploy's inference source for this workflow only.
+   * Present on the catalog-test workflow `heartbeat`, which must stay
+   * free to run continuously: it names `NOOP_MODEL_SOURCE` instead of
+   * the tenant's real catalog model, and `seedTenant` deploys it against
+   * a dedicated noop catalog offering (`ensureNoopCatalogOffering`)
+   * rather than the tenant's own resolved offerings. Absent on every
+   * conversational workflow and on the seeded workbench-digest
+   * automation, which deploy against the tenant's real model.
    */
-  modelSource?: (hubUrl: string) => ModelSource;
+  modelSource?: () => ModelSource;
   /**
    * When true, PUT the authored definition to `stopped` after deploy so
    * a native ScheduleTrigger does not fire every tenant at the next
@@ -901,7 +911,8 @@ async function ensureDeployment(
     assetId: string;
     assetName: string;
     commitSha: string;
-    model: ModelSource;
+    sourceOfferingIds: readonly string[];
+    defaultSourceOfferingId: string;
   },
   log: (line: string) => void,
 ): Promise<string> {
@@ -950,16 +961,8 @@ async function ensureDeployment(
         package: { format: "source", commitSha: args.commitSha },
       },
       entry: WORKFLOW_SOURCE_ENTRY,
-      sources: [
-        {
-          id: SEED_SOURCE_ID,
-          provider: args.model.provider,
-          baseURL: args.model.baseURL,
-          apiKey: args.model.apiKey,
-          model: args.model.model,
-        },
-      ],
-      defaultSource: SEED_SOURCE_ID,
+      sourceOfferingIds: args.sourceOfferingIds,
+      defaultSourceOfferingId: args.defaultSourceOfferingId,
     },
     cookies,
   );
@@ -984,6 +987,170 @@ async function ensureDeployment(
   return deployment.id;
 }
 
+/**
+ * Lists every catalog offering owned directly by a tenant, paging past
+ * `paginatedSchema`'s cursor. This is deliberately the tenant-owned list
+ * (`GET .../catalog/offerings`, never the ancestor-inheriting "resolved"
+ * view `listVisibleOfferings` computes in-process, `apps/hub/src/index.ts`'s
+ * `workflowDeployer` and `packages/chat/src/platform-adapter.ts`'s
+ * `catalogOfferings`): `seedCatalog` always plants a tenant's catalog
+ * directly on that same tenant, so the owned list already carries
+ * everything a plain `workbench seed` or the self-served connect flow
+ * ever seeded, with no HTTP surface exposing the resolved view to a
+ * caller outside the hub process.
+ */
+async function listTenantCatalogOfferings(
+  api: ApiCall,
+  cookies: string[],
+  tenantId: string,
+): Promise<(typeof ModelOfferingResponse.infer)[]> {
+  const items: (typeof ModelOfferingResponse.infer)[] = [];
+  let cursor: string | undefined;
+  for (;;) {
+    const query =
+      cursor === undefined ? "" : `?cursor=${encodeURIComponent(cursor)}`;
+    const listed = await api(
+      "GET",
+      `/api/tenants/${tenantId}/catalog/offerings${query}`,
+      undefined,
+      cookies,
+    );
+    const page = parseAs(
+      paginatedSchema(ModelOfferingResponse),
+      listed.data,
+      "catalog offerings response",
+    );
+    items.push(...page.data);
+    if (page.nextCursor === null) return items;
+    if (items.length > 10_000) {
+      throw new HubApiError(
+        `catalog offerings list for tenant ${tenantId} did not terminate while paging`,
+        "check the hub logs for the underlying failure, then re-run: workbench seed",
+      );
+    }
+    cursor = page.nextCursor;
+  }
+}
+
+/**
+ * Resolves the catalog offering ids a REAL (non-noop-pinned) workflow
+ * deploys against: every enabled offering the tenant owns, ordered by
+ * priority ascending, with the lowest-priority offering as the default —
+ * the SAME rule `apps/hub/src/index.ts`'s `workflowDeployer.deploy` and
+ * `packages/chat/src/platform-adapter.ts`'s `catalogOfferings` apply
+ * in-process via `listVisibleOfferings`. `excludeOfferingId` drops the
+ * noop offering (`ensureNoopCatalogOffering`) from this list when one
+ * has already been planted on the same tenant this run — it must never
+ * win a real workflow's default just because it happens to sort first.
+ *
+ * Throws when nothing is left to deploy against: "seeded but not
+ * launchable" (`seedCatalog` with no credential) is a valid catalog
+ * state, but a workflow deploy that names zero sources is not a
+ * lesser success, it is the failure this function exists to catch
+ * before the hub's own `sourceOfferingIds` validation would.
+ */
+async function resolveRealSourceOfferingIds(
+  api: ApiCall,
+  cookies: string[],
+  tenantId: string,
+  excludeOfferingId: string | undefined,
+): Promise<{
+  sourceOfferingIds: readonly string[];
+  defaultSourceOfferingId: string;
+}> {
+  const offerings = (await listTenantCatalogOfferings(api, cookies, tenantId))
+    .filter(
+      (offering) =>
+        !offering.disabled && offering.id !== excludeOfferingId,
+    )
+    .sort((a, b) => a.priority - b.priority);
+  const defaultSourceOfferingId = offerings[0]?.id;
+  if (defaultSourceOfferingId === undefined) {
+    throw new HubApiError(
+      "this tenant has no catalog offerings to deploy against — nothing is launchable yet",
+      "seed the tenant's catalog with a real provider key (or a placeholder credential for a keyless dev/CI run), then re-run: workbench seed",
+    );
+  }
+  return {
+    sourceOfferingIds: offerings.map((offering) => offering.id),
+    defaultSourceOfferingId,
+  };
+}
+
+/**
+ * Plants (or finds) the dedicated catalog offering a noop-pinned
+ * workflow (`DefaultWorkflow.modelSource`, e.g. `heartbeat`) deploys
+ * against: a catalog model named `NOOP_MODEL`, a provider pointed at the
+ * hub's own `noop-inference` endpoint, and a placeholder credential —
+ * the same `ensureCatalogModel` / `ensureProvider` / `ensureCredential` /
+ * `ensureCatalogProvider` / `ensureCatalogOffering` sequence
+ * `seedCatalog` runs for a real provider, run here for this one
+ * synthetic one. Idempotent, same as every other seed step: a re-run
+ * finds the existing rows by name and reuses them.
+ */
+async function ensureNoopCatalogOffering(
+  api: ApiCall,
+  cookies: string[],
+  tenantId: string,
+  hubUrl: string,
+  log: (line: string) => void,
+): Promise<string> {
+  const baseURL = `${hubUrl}/api/chat/noop-inference`;
+  const modelId = await ensureCatalogModel(
+    api,
+    cookies,
+    { tenantId, canonicalName: NOOP_MODEL },
+    log,
+  );
+  const providerId = await ensureProvider(
+    api,
+    cookies,
+    {
+      tenantId,
+      name: NOOP_CATALOG_PROVIDER_NAME,
+      plugin: NOOP_PROVIDER,
+      apiBaseUrl: baseURL,
+    },
+    log,
+  );
+  const credentialId = await ensureCredential(
+    api,
+    cookies,
+    {
+      tenantId,
+      providerId,
+      name: inferenceCredentialName(NOOP_CATALOG_PROVIDER_NAME),
+      secret: PLACEHOLDER_CATALOG_API_KEY,
+      type: "api_key",
+    },
+    log,
+  );
+  const catalogProviderId = await ensureCatalogProvider(
+    api,
+    cookies,
+    {
+      tenantId,
+      name: NOOP_CATALOG_PROVIDER_NAME,
+      plugin: NOOP_PROVIDER,
+      baseURL,
+      credentialId,
+    },
+    log,
+  );
+  return ensureCatalogOffering(
+    api,
+    cookies,
+    {
+      tenantId,
+      modelId,
+      providerId: catalogProviderId,
+      priority: NOOP_OFFERING_PRIORITY,
+      capabilities: [],
+    },
+    log,
+  );
+}
+
 /**
  * After deploy, PUT a pristine authored definition to `stopped` so a native
  * ScheduleTrigger does not fire every tenant. A member-restored row
@@ -1160,6 +1327,14 @@ export type SeedTenantArgs = {
   cookies: string[];
   hubUrl: string;
   tenant: SeedTenant;
+  /**
+   * The provider/model pair a real (non-noop-pinned) workflow's rendered
+   * definition names in its inference preferences. The deploy itself
+   * resolves inference from the tenant's own catalog offerings
+   * (`resolveRealSourceOfferingIds`), not from this pair — a tenant with
+   * no catalog offerings still fails clearly at deploy time even if this
+   * pair happens to name a real model.
+   */
   model: ModelSource;
   pushWorkflow: WorkflowPusher;
   log: (line: string) => void;
@@ -1228,9 +1403,41 @@ export async function seedTenant(args: SeedTenantArgs): Promise<void> {
 
   await plantDefaultSkills(api, cookies, tenant.tenantId, log);
 
+  // Resolved lazily and cached across the loop below: most seed runs
+  // deploy several workflows against the same tenant catalog state, so
+  // this fetches the tenant's real offerings (or plants the noop one)
+  // at most once each, however many workflows ask for them.
+  let noopOfferingId: string | undefined;
+  let realOfferings:
+    | { sourceOfferingIds: readonly string[]; defaultSourceOfferingId: string }
+    | undefined;
+
   let confirmed = 0;
   for (const workflow of workflows) {
-    const workflowModel = workflow.modelSource?.(hubUrl) ?? model;
+    const workflowModel = workflow.modelSource?.() ?? model;
+
+    let sourceOfferingIds: readonly string[];
+    let defaultSourceOfferingId: string;
+    if (workflow.modelSource !== undefined) {
+      noopOfferingId ??= await ensureNoopCatalogOffering(
+        api,
+        cookies,
+        tenant.tenantId,
+        hubUrl,
+        log,
+      );
+      sourceOfferingIds = [noopOfferingId];
+      defaultSourceOfferingId = noopOfferingId;
+    } else {
+      realOfferings ??= await resolveRealSourceOfferingIds(
+        api,
+        cookies,
+        tenant.tenantId,
+        noopOfferingId,
+      );
+      ({ sourceOfferingIds, defaultSourceOfferingId } = realOfferings);
+    }
+
     const assetId = await ensureWorkflowAsset(
       api,
       cookies,
@@ -1265,7 +1472,8 @@ export async function seedTenant(args: SeedTenantArgs): Promise<void> {
         assetId,
         assetName: workflow.assetName,
         commitSha: pushed.commitSha,
-        model: workflowModel,
+        sourceOfferingIds,
+        defaultSourceOfferingId,
       },
       log,
     );
@@ -1666,7 +1874,7 @@ async function ensureCatalogOffering(
     quirks?: Record<string, unknown>;
   },
   log: (line: string) => void,
-): Promise<void> {
+): Promise<string> {
   const body: Record<string, unknown> = {
     modelId: args.modelId,
     providerId: args.providerId,
@@ -1681,9 +1889,13 @@ async function ensureCatalogOffering(
     cookies,
   );
   if (created.status === 201) {
-    parseAs(ModelOfferingResponse, created.data, "catalog offering response");
+    const offering = parseAs(
+      ModelOfferingResponse,
+      created.data,
+      "catalog offering response",
+    );
     log("created catalog offering");
-    return;
+    return offering.id;
   }
   if (created.status === 409) {
     let cursor: string | null = null;
@@ -1715,7 +1927,7 @@ async function ensureCatalogOffering(
     }
     if (existing.priority === args.priority) {
       log("catalog offering already exists (skipped)");
-      return;
+      return existing.id;
     }
 
     const updated = await api(
@@ -1730,9 +1942,13 @@ async function ensureCatalogOffering(
         "check the hub logs for the underlying failure, then re-run: workbench seed",
       );
     }
-    parseAs(ModelOfferingResponse, updated.data, "catalog offering response");
+    const offering = parseAs(
+      ModelOfferingResponse,
+      updated.data,
+      "catalog offering response",
+    );
     log("updated catalog offering priority");
-    return;
+    return offering.id;
   }
   throw new HubApiError(
     `the hub rejected creation of the catalog offering with status ${created.status}: ${JSON.stringify(created.data)}`,

From 2587cd2b5af3ecbb27bb13bcb652910bd10b29aa Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sat, 5 Sep 2026 23:54:46 -0700
Subject: [PATCH 06/10] longevity-sim: deploy workflows by catalog offering ids

Another workflowDeployBody caller CI's typecheck job caught: this
stack seeds one catalog offering per real inference target already,
so track each one's id and pass it through to the deploy body
instead of the raw provider/baseURL/apiKey shape.
---
 packages/longevity-sim/src/stack.ts | 38 ++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/packages/longevity-sim/src/stack.ts b/packages/longevity-sim/src/stack.ts
index a7dc917761..59c4ff72aa 100644
--- a/packages/longevity-sim/src/stack.ts
+++ b/packages/longevity-sim/src/stack.ts
@@ -437,7 +437,9 @@ export async function bootLongevityStack(
     // credential row still requires some string, so each target's own
     // `apiKey` (expected to be the same placeholder) is threaded through
     // unchanged rather than this package inventing its own convention.
-    async function seedCatalogChain(target: InferenceTarget): Promise<void> {
+    async function seedCatalogChain(
+      target: InferenceTarget,
+    ): Promise<{ offeringId: string }> {
       const model = await api(
         hub.baseUrl,
         "POST",
@@ -509,10 +511,15 @@ export async function bootLongevityStack(
         owner.cookies,
       );
       expectStatus(`create catalog offering ${target.model}`, offering, 201);
+      return {
+        offeringId: stringField(offering.data, "id", "create catalog offering"),
+      };
     }
 
+    const offeringIdByTargetLabel = new Map<string, string>();
     for (const target of options.realTargets) {
-      await seedCatalogChain(target);
+      const { offeringId } = await seedCatalogChain(target);
+      offeringIdByTargetLabel.set(target.label, offeringId);
     }
 
     for (const skill of options.skills ?? []) {
@@ -668,6 +675,13 @@ export async function bootLongevityStack(
         workflowJson,
       });
 
+      const offeringId = offeringIdByTargetLabel.get(target.label);
+      if (offeringId === undefined) {
+        throw new Error(
+          `agent ${spec.key}: no catalog offering seeded for realTarget "${target.label}"`,
+        );
+      }
+
       const deployDeadline = Date.now() + 90_000;
       for (;;) {
         if (sidecar.exited()) {
@@ -682,11 +696,8 @@ export async function bootLongevityStack(
           workflowDeployBody({
             assetId,
             commitSha: pushed.commitSha,
-            sourceId: `src-agent-${spec.handle}`,
-            provider: target.provider,
-            baseURL: target.baseURL,
-            apiKey: target.apiKey,
-            model: target.model,
+            sourceOfferingIds: [offeringId],
+            defaultSourceOfferingId: offeringId,
           }),
           owner.cookies,
         );
@@ -847,6 +858,12 @@ export async function bootLongevityStack(
     if (routineTarget === undefined) {
       throw new Error("unreachable: realTargets checked non-empty above");
     }
+    const routineOfferingId = offeringIdByTargetLabel.get(routineTarget.label);
+    if (routineOfferingId === undefined) {
+      throw new Error(
+        `no catalog offering seeded for realTarget "${routineTarget.label}"`,
+      );
+    }
     const assetName = "longevity-heartbeat";
     const heartbeatAssetCreated = await api(
       hub.baseUrl,
@@ -912,11 +929,8 @@ export async function bootLongevityStack(
         workflowDeployBody({
           assetId: heartbeatAssetId,
           commitSha: heartbeatPushed.commitSha,
-          sourceId: "src-longevity-heartbeat",
-          provider: "openai-compatible",
-          baseURL: routineTarget.baseURL,
-          apiKey: routineTarget.apiKey,
-          model: routineTarget.model,
+          sourceOfferingIds: [routineOfferingId],
+          defaultSourceOfferingId: routineOfferingId,
         }),
         owner.cookies,
       );

From 2430449e41b11a77a87cc902e4e2f7c264736125 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sat, 5 Sep 2026 23:56:16 -0700
Subject: [PATCH 07/10] Fix formatting: prettier

---
 apps/hub/src/system-seed.ts        | 4 +++-
 packages/seeding/src/seed.ts       | 3 +--
 packages/seeding/test/seed.test.ts | 7 ++++---
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/apps/hub/src/system-seed.ts b/apps/hub/src/system-seed.ts
index 52f0ff8e66..1637f2e89d 100644
--- a/apps/hub/src/system-seed.ts
+++ b/apps/hub/src/system-seed.ts
@@ -57,7 +57,9 @@ export type SeedModelConfig = {
   readonly apiKey: string;
 };
 
-function resolvedModel(seedModel: SeedModelConfig | undefined): SeedModelConfig {
+function resolvedModel(
+  seedModel: SeedModelConfig | undefined,
+): SeedModelConfig {
   return (
     seedModel ?? {
       provider: SEED_MODEL_PROVIDER,
diff --git a/packages/seeding/src/seed.ts b/packages/seeding/src/seed.ts
index 20e350303e..24fc1ce6eb 100644
--- a/packages/seeding/src/seed.ts
+++ b/packages/seeding/src/seed.ts
@@ -1060,8 +1060,7 @@ async function resolveRealSourceOfferingIds(
 }> {
   const offerings = (await listTenantCatalogOfferings(api, cookies, tenantId))
     .filter(
-      (offering) =>
-        !offering.disabled && offering.id !== excludeOfferingId,
+      (offering) => !offering.disabled && offering.id !== excludeOfferingId,
     )
     .sort((a, b) => a.priority - b.priority);
   const defaultSourceOfferingId = offerings[0]?.id;
diff --git a/packages/seeding/test/seed.test.ts b/packages/seeding/test/seed.test.ts
index 720250165c..99f9728045 100644
--- a/packages/seeding/test/seed.test.ts
+++ b/packages/seeding/test/seed.test.ts
@@ -46,9 +46,10 @@ const MODEL = {
 // the tenant's catalog rather than a bare `ModelSource`.
 const OFFERING_ID = "off_1";
 
-function offeringsPage(
-  ids: readonly string[] = [OFFERING_ID],
-): { status: number; data: unknown } {
+function offeringsPage(ids: readonly string[] = [OFFERING_ID]): {
+  status: number;
+  data: unknown;
+} {
   return {
     status: 200,
     data: {

From 602ad68f72898a1342ec88f5090eac80999493a4 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sun, 6 Sep 2026 08:35:25 -0700
Subject: [PATCH 08/10] sandbox-sidecar: add tests for generation-0
 ensure/destroy requests

The allocation service's initial sidecar_allocation and workflow_probe
rows start at generation 0 (@intx/db enforces generation >= 0, not >
0), so the first ensure() for a freshly allocated sidecar must be
accepted at generation 0. These tests cover that acceptance, later
generations, non-integer/negative rejection, and that stale-generation
fencing still rejects an older generation once a newer one has been
observed.
---
 .../sandbox-sidecar/src/provisioner.test.ts   | 154 ++++++++++++++++++
 .../sandbox-sidecar/src/state-store.test.ts   |  10 ++
 2 files changed, 164 insertions(+)
 create mode 100644 packages/sandbox-sidecar/src/provisioner.test.ts

diff --git a/packages/sandbox-sidecar/src/provisioner.test.ts b/packages/sandbox-sidecar/src/provisioner.test.ts
new file mode 100644
index 0000000000..753478bf01
--- /dev/null
+++ b/packages/sandbox-sidecar/src/provisioner.test.ts
@@ -0,0 +1,154 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { createAllocationStateStore, type AllocationStateStore } from "./state-store";
+import { createSidecarProvisioner } from "./provisioner";
+import type { SidecarBackend } from "./backend";
+
+const TOKEN = "s3cr3t-bootstrap-token";
+
+let dataDir: string;
+let store: AllocationStateStore;
+let started: string[];
+
+beforeEach(async () => {
+  dataDir = await mkdtemp(join(tmpdir(), "sandbox-sidecar-provisioner-"));
+  store = createAllocationStateStore(join(dataDir, "state.json"));
+  started = [];
+});
+
+afterEach(async () => {
+  await rm(dataDir, { recursive: true, force: true });
+});
+
+function fakeBackend(): SidecarBackend {
+  let counter = 0;
+  return {
+    async startUnit() {
+      counter += 1;
+      const externalRef = `unit-${String(counter)}`;
+      started.push(externalRef);
+      return externalRef;
+    },
+    async stopUnit() {},
+    async findUnitsByAllocation() {
+      return [];
+    },
+  };
+}
+
+function baseEnsureRequest(overrides: Partial<Record<string, unknown>> = {}) {
+  return {
+    allocationId: "alloc-1",
+    generation: 0,
+    tenantId: "tenant-1",
+    anchorRunId: "run-1",
+    sidecarId: "sidecar-1",
+    token: TOKEN,
+    hubWebSocketUrl: "wss://hub.example.com/ws",
+    ...overrides,
+  } as never;
+}
+
+function makeProvisioner(backend: SidecarBackend = fakeBackend()) {
+  return createSidecarProvisioner({
+    id: "test-provisioner",
+    apiVersion: 1,
+    bindingFingerprint: "test",
+    capabilities: [],
+    backend,
+    store,
+  });
+}
+
+describe("ensure request validation", () => {
+  test("accepts generation 0, the allocation service's initial generation", async () => {
+    const provisioner = makeProvisioner();
+
+    const result = await provisioner.ensure(baseEnsureRequest({ generation: 0 }));
+
+    expect(result).toEqual({ kind: "accepted", externalRef: "unit-1" });
+  });
+
+  test("accepts a later generation", async () => {
+    const provisioner = makeProvisioner();
+
+    await provisioner.ensure(baseEnsureRequest({ generation: 0 }));
+    const result = await provisioner.ensure(baseEnsureRequest({ generation: 1 }));
+
+    expect(result).toEqual({ kind: "accepted", externalRef: "unit-2" });
+  });
+
+  test("rejects a negative generation", async () => {
+    const provisioner = makeProvisioner();
+
+    const result = await provisioner.ensure(
+      baseEnsureRequest({ generation: -1 }),
+    );
+
+    expect(result).toMatchObject({
+      kind: "rejected",
+      code: "invalid_ensure_request",
+    });
+    expect(started).toHaveLength(0);
+  });
+
+  test("rejects a non-integer generation", async () => {
+    const provisioner = makeProvisioner();
+
+    const result = await provisioner.ensure(
+      baseEnsureRequest({ generation: 1.5 }),
+    );
+
+    expect(result).toMatchObject({
+      kind: "rejected",
+      code: "invalid_ensure_request",
+    });
+    expect(started).toHaveLength(0);
+  });
+
+  test("still rejects a stale generation once fencing has observed a later one", async () => {
+    const provisioner = makeProvisioner();
+
+    await provisioner.ensure(baseEnsureRequest({ generation: 1 }));
+    const result = await provisioner.ensure(baseEnsureRequest({ generation: 0 }));
+
+    expect(result).toMatchObject({
+      kind: "rejected",
+      code: "stale_generation",
+    });
+    expect(started).toHaveLength(1);
+  });
+});
+
+describe("destroy request validation", () => {
+  test("accepts generation 0", async () => {
+    const provisioner = makeProvisioner();
+    await provisioner.ensure(baseEnsureRequest({ generation: 0 }));
+
+    const result = await provisioner.destroy({
+      allocationId: "alloc-1",
+      sidecarId: "sidecar-1",
+      generation: 0,
+    });
+
+    expect(result).toEqual({ kind: "destroyed" });
+  });
+
+  test("rejects a negative generation", async () => {
+    const provisioner = makeProvisioner();
+
+    const result = await provisioner.destroy({
+      allocationId: "alloc-1",
+      sidecarId: "sidecar-1",
+      generation: -1,
+    });
+
+    expect(result).toMatchObject({
+      kind: "rejected",
+      code: "invalid_destroy_request",
+    });
+  });
+});
diff --git a/packages/sandbox-sidecar/src/state-store.test.ts b/packages/sandbox-sidecar/src/state-store.test.ts
index d9bdadffb0..abd723afd8 100644
--- a/packages/sandbox-sidecar/src/state-store.test.ts
+++ b/packages/sandbox-sidecar/src/state-store.test.ts
@@ -30,6 +30,16 @@ describe("observeEnsure", () => {
     expect(result.kind).toBe("observed");
   });
 
+  test("accepts generation 0, the allocation service's initial generation", async () => {
+    const store = createAllocationStateStore(statePath());
+    const result = await store.observeEnsure({
+      allocationId: "alloc-1",
+      sidecarId: "sidecar-1",
+      generation: 0,
+    });
+    expect(result.kind).toBe("observed");
+  });
+
   test("is idempotent when observed again at the same generation", async () => {
     const store = createAllocationStateStore(statePath());
     await store.observeEnsure({

From e01fedad96a1991c9b05eb612462fb18bd654db4 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sun, 6 Sep 2026 08:35:30 -0700
Subject: [PATCH 09/10] sandbox-sidecar: accept the allocation service's
 initial generation

@intx/db's sidecar_allocation and workflow_probe tables both check
generation >= 0 and the allocation service records the first row for
an allocation at generation 0, but validateEnsureRequest() and
validateDestroyRequest() in packages/sandbox-sidecar rejected anything
that wasn't strictly positive, and the on-disk fencing schema in
state-store.ts required generation > 0. The first ensure() for any
newly allocated sidecar was rejected with 'generation must be a
positive integer', failing every deploy.

Accept generation >= 0 in both validators and the state-store schema;
stale-generation fencing in observeEnsure()/observeDestroy() already
compares against the stored generation rather than assuming positivity,
so it is unaffected.
---
 packages/sandbox-sidecar/src/provisioner.ts | 8 ++++----
 packages/sandbox-sidecar/src/state-store.ts | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/sandbox-sidecar/src/provisioner.ts b/packages/sandbox-sidecar/src/provisioner.ts
index 209d9e725a..9771be3198 100644
--- a/packages/sandbox-sidecar/src/provisioner.ts
+++ b/packages/sandbox-sidecar/src/provisioner.ts
@@ -218,8 +218,8 @@ function validateEnsureRequest(request: EnsureSidecarRequest): string | null {
   if (request.token === "") return "token must not be empty";
   if (request.hubWebSocketUrl === "")
     return "hubWebSocketUrl must not be empty";
-  if (!Number.isInteger(request.generation) || request.generation <= 0) {
-    return "generation must be a positive integer";
+  if (!Number.isInteger(request.generation) || request.generation < 0) {
+    return "generation must be a non-negative integer";
   }
   return null;
 }
@@ -227,8 +227,8 @@ function validateEnsureRequest(request: EnsureSidecarRequest): string | null {
 function validateDestroyRequest(request: DestroySidecarRequest): string | null {
   if (request.allocationId === "") return "allocationId must not be empty";
   if (request.sidecarId === "") return "sidecarId must not be empty";
-  if (!Number.isInteger(request.generation) || request.generation <= 0) {
-    return "generation must be a positive integer";
+  if (!Number.isInteger(request.generation) || request.generation < 0) {
+    return "generation must be a non-negative integer";
   }
   return null;
 }
diff --git a/packages/sandbox-sidecar/src/state-store.ts b/packages/sandbox-sidecar/src/state-store.ts
index 12e5bed2a9..9e600e2286 100644
--- a/packages/sandbox-sidecar/src/state-store.ts
+++ b/packages/sandbox-sidecar/src/state-store.ts
@@ -12,7 +12,7 @@ import { type } from "arktype";
 const AllocationRecord = type({
   allocationId: "string > 0",
   sidecarId: "string > 0",
-  generation: "number.integer > 0",
+  generation: "number.integer >= 0",
   desiredState: "'ensured' | 'destroyed'",
   externalRef: "string | null",
   tokenHashSha256: "string | null",

From c6da1fa7ba9e2607098f1e566456e8ebc8b84b9b Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Sun, 6 Sep 2026 08:37:36 -0700
Subject: [PATCH 10/10] sandbox-sidecar: fix formatting in provisioner test

---
 .../sandbox-sidecar/src/provisioner.test.ts     | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/packages/sandbox-sidecar/src/provisioner.test.ts b/packages/sandbox-sidecar/src/provisioner.test.ts
index 753478bf01..b858c03cc6 100644
--- a/packages/sandbox-sidecar/src/provisioner.test.ts
+++ b/packages/sandbox-sidecar/src/provisioner.test.ts
@@ -3,7 +3,10 @@ import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { createAllocationStateStore, type AllocationStateStore } from "./state-store";
+import {
+  createAllocationStateStore,
+  type AllocationStateStore,
+} from "./state-store";
 import { createSidecarProvisioner } from "./provisioner";
 import type { SidecarBackend } from "./backend";
 
@@ -67,7 +70,9 @@ describe("ensure request validation", () => {
   test("accepts generation 0, the allocation service's initial generation", async () => {
     const provisioner = makeProvisioner();
 
-    const result = await provisioner.ensure(baseEnsureRequest({ generation: 0 }));
+    const result = await provisioner.ensure(
+      baseEnsureRequest({ generation: 0 }),
+    );
 
     expect(result).toEqual({ kind: "accepted", externalRef: "unit-1" });
   });
@@ -76,7 +81,9 @@ describe("ensure request validation", () => {
     const provisioner = makeProvisioner();
 
     await provisioner.ensure(baseEnsureRequest({ generation: 0 }));
-    const result = await provisioner.ensure(baseEnsureRequest({ generation: 1 }));
+    const result = await provisioner.ensure(
+      baseEnsureRequest({ generation: 1 }),
+    );
 
     expect(result).toEqual({ kind: "accepted", externalRef: "unit-2" });
   });
@@ -113,7 +120,9 @@ describe("ensure request validation", () => {
     const provisioner = makeProvisioner();
 
     await provisioner.ensure(baseEnsureRequest({ generation: 1 }));
-    const result = await provisioner.ensure(baseEnsureRequest({ generation: 0 }));
+    const result = await provisioner.ensure(
+      baseEnsureRequest({ generation: 0 }),
+    );
 
     expect(result).toMatchObject({
       kind: "rejected",