refactor(workflows): cut detail read to native rows, delete Workbench deploy-source store (CL-7591)

apps/hub/src/index.ts

@@ -2002,8 +2002,8 @@ export async function createHub(config: HubConfig) {
   // `createWorkflowDefinitionRoutes` (`vendor/intx/hub-api/src/app.ts`
   // already mounts that one at this same `/workflows/definitions`
   // prefix): this GET is a Workbench-owned read composed over native
-  // rows plus `@corbits/workflows`'s `./deploy-source`, so it lives in
-  // `@corbits/workflows`'s `./detail`, not the vendored tree.
+  // rows, so it lives in `@corbits/workflows`'s `./detail`, not the
+  // vendored tree.
   app.route(
     `${TENANT_PREFIX}/workflows/definitions`,
     createWorkflowDetailRoute({

docs/package-migrations.md

@@ -72,8 +72,10 @@ package onto the transactional pattern — see below):
 1. **Self-contained, transactional** — `@corbits/chat`, `@corbits/notify`,
    `@corbits/webhook-triggers`, `@corbits/insights`,
    `@corbits/skills`, `@corbits/bench`, `@corbits/preferences`,
-   `@corbits/inference-catalog`, `@corbits/evals`, `@corbits/access-policy`,
-   `@corbits/workflows`'s `./deploy-source`.
+   `@corbits/inference-catalog`, `@corbits/evals`, `@corbits/access-policy`.
+   (`@corbits/workflows`'s `./deploy-source` followed this shape until
+   CL-7591 deleted it; it is no longer wired through
+   `scripts/db-setup.ts`.)
    The package's `src/migrations.ts` owns only a literal `{ name, sql }[]`
    array and a thin `applyXMigrations(databaseUrl)` wrapper; the mechanics —
    schema/ledger bootstrap, the transactional apply loop, and the advisory

docs/workflow-deploy-source-vs-launch-spec.md

@@ -1,5 +1,10 @@
 # `workflow_deploy_source` vs `workflow_run_launch_spec`
 
+> Superseded by CL-7591: `@corbits/workflows`'s `./deploy-source` (the
+> `workflow_deploy_source` table) is deleted and the workflow detail read
+> is native-only. This analysis is kept as the historical decision record
+> for CL-7271; do not read it as a description of the current schema.
+
 Analysis for CL-7271. Read against the vendored pin `a8bc06ae`.
 
 ## The claim under test

docs/workflow-detail.md

@@ -11,10 +11,10 @@ useful version — read-only, no editing surface here.
 - **Lifecycle**: `source-only`, `pending-approval`, `deployed`,
   `superseded`, or `build-failed` — derived by the pure
   `deriveWorkflowLifecycle` (`packages/workflows/src/
-definition-lifecycle.ts`) from the asset's newest `workflow_definition`
-  row plus whether `@corbits/workflows`'s `./deploy-source` ever recorded a
-  deploy attempt for it. No new Postgres column: everything it reads is
-  native or already Workbench-owned.
+definition-lifecycle.ts`) from the asset's `workflow_definition` rows
+  alone. Native-only since CL-7591: the deleted Workbench deploy-source
+  store is no longer a deploy-attempt signal. No new Postgres column:
+  everything it reads is native.
 - **Steps**: read from the frozen `wire_projection` (`@intx/db`'s
   `loadFrozenWireProjection`) in `stepOrder`, each carrying its role
   (`kind`), best-effort director/model/tool pins (the wire step schema is
@@ -29,9 +29,9 @@ definition-lifecycle.ts`) from the asset's newest `workflow_definition`
   actually approved. Credential binding **names** only
   (`workflow_definition.credential_bindings[].handle`); no value is ever
   read or returned.
-- **Source**: the deploying commit sha, entry module, and origin kind, from
-  `@corbits/workflows`'s `./deploy-source`'s per-asset deploy record — `null` when
-  no deploy was ever attempted.
+- **Source**: always `null` since CL-7591 — the Workbench deploy-source
+  store is deleted, so the native-only read records no per-asset deploy
+  provenance.
 
 ## Authorization
 

docs/workflow-model.md

@@ -55,7 +55,7 @@ separate routine table.
 | Approve                           | Native `POST /api/tenants/:tenantId/approvals/:id/approve`                                                                                    | A principal holding `approval:*`/`resolve` — a human; no agent holds it                                                                                                                                                 | This is the approval                                                                                             |
 
 Credentials and resolved provider secrets never enter source trees or deploy
-requests recorded by `@corbits/workflows`'s `./deploy-source`.
+requests.
 Inference sources are re-resolved from the tenant catalog at deploy and
 redeploy (`resolveDefinitionSources`).
 

packages/workflows/README.md

@@ -1,11 +1,10 @@
 # @corbits/workflows
 
 The workflow domain package: `./source` (the two-file source codebase
-every authoring path renders/reads), `./deploy-source` (the durable
-deploy-source record), `./detail` (the definition detail read a
-workflow's own page uses), and `./authoring` (letting an agent author,
-republish, and deploy a workflow through Interchange's native source
-pipeline).
+every authoring path renders/reads), `./detail` (the definition detail
+read a workflow's own page uses), and `./authoring` (letting an agent
+author, republish, and deploy a workflow through Interchange's native
+source pipeline).
 
 Server code imports `@corbits/workflows`; browser code imports
 `@corbits/workflows/client` for the browser-safe subset (source

packages/workflows/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@corbits/workflows",
   "private": true,
-  "description": "The workflow domain package: the two-file source codebase every authoring path renders/reads (`./source`), the durable deploy-source record for a code-sourced deploy (`./deploy-source`), the definition detail read a workflow's own page uses (`./detail`), and letting an agent author/republish/deploy a workflow through Interchange's native source pipeline (`./authoring`)",
+  "description": "The workflow domain package: the two-file source codebase every authoring path renders/reads (`./source`), the definition detail read a workflow's own page uses (`./detail`), and letting an agent author/republish/deploy a workflow through Interchange's native source pipeline (`./authoring`)",
   "version": "0.0.1",
   "license": "LGPL-2.1-or-later",
   "type": "module",
@@ -16,7 +16,6 @@
   },
   "dependencies": {
     "@corbits/error-sink": "workspace:*",
-    "@corbits/migration-runner": "workspace:*",
     "@intx/authz": "0.3.0",
     "@intx/db": "workspace:*",
     "@intx/hub-api": "workspace:*",
@@ -27,8 +26,7 @@
     "arktype": "catalog:",
     "cronstrue": "^3.24.0",
     "drizzle-orm": "catalog:",
-    "hono": "catalog:",
-    "postgres": "catalog:"
+    "hono": "catalog:"
   },
   "devDependencies": {
     "@types/bun": "catalog:",