Cut hub over to stock Interchange composition

.env.example

@@ -44,27 +44,16 @@ HUB_ALLOW_GIT_INSIDE_WORK_TREE=1
 HUB_STATIC_DIR=../web/dist
 
 # The administrator identity `bun run dev` seeds for local development:
-# the dev script signs this account up and makes it the owner of the root
-# tenant (WORKBENCH_DEFAULT_TENANT below), so a fresh checkout can sign in
-# immediately. Unset values fall back to the defaults shown — fine for
-# local development, set both for real deployments.
+# the dev script signs this account up on the fresh hub, so a fresh
+# checkout can sign in immediately. Unset values fall back to the defaults
+# shown — fine for local development, set both for real deployments.
 # HUB_ADMIN_EMAIL=alice@example.com
 # HUB_ADMIN_PASSWORD=password123
 
 # Everything below is optional. Leave a variable unset to leave the
 # feature it configures off; the hub never treats a partially-set group
 # as configured — it fails loudly at boot instead.
 
-# Slug of the root tenant first signup mints. Every self-served
-# personal bench parents under it, and `workbench setup`/`seed` resolve
-# the same slug. Unset falls back
-# to "workbench". ORG_SLUG is an alias when this is unset — set only one.
-# Upgrading a deploy whose existing root was not "workbench": set this
-# to that slug (do not leave OPERATOR_TENANT_ID; the hub refuses to boot
-# while that stale key is set).
-# WORKBENCH_DEFAULT_TENANT=workbench
-# ORG_SLUG=workbench
-
 # Per-IP rate limit on email sign-up. Defaults to 5 sign-ups per 60
 # seconds when unset.
 # SIGNUP_RATE_LIMIT_WINDOW_SECONDS=60
@@ -79,15 +68,10 @@ HUB_STATIC_DIR=../web/dist
 # SIGNIN_RATE_LIMIT_WINDOW_SECONDS=60
 # SIGNIN_RATE_LIMIT_MAX=10
 
-# Self-serve signup mode. Hub default is closed (owner adds users or
-# shares a copy-link invite). Local `bun run dev` opens signup when this
-# is unset so the first admin can seed — set closed explicitly to test
-# the closed gate. See docs/TENANCY.md.
-# WORKBENCH_SIGNUP=open
-
-# When WORKBENCH_SIGNUP=open, optionally restrict which email domains
-# may register (comma-separated). Empty/unset = any domain.
-# WORKBENCH_ALLOWED_EMAIL_DOMAINS=acme.example
+# Self-serve signup is ungated: stock Interchange composition carries no
+# signup mode, domain allowlist, or email-verification gate, so anyone
+# can register (rate-limited only — see SIGNUP_RATE_LIMIT_* above). Gate
+# access in the composition that embeds the hub if a deployment needs it.
 
 # Provider API keys are no longer read from the environment: hub boot
 # plants nothing, and setting ANTHROPIC_API_KEY or any other provider's
@@ -271,15 +255,6 @@ HUB_STATIC_DIR=../web/dist
 # even if this file is copied verbatim.
 ALLOW_PLAINTEXT_SECRETS=1
 
-# Opt-out of @workbench/access-policy's email-verification requirement.
-# The hub has no transactional email wired yet, so NO account can ever
-# become verified — leaving this unset makes `bun run setup` and every
-# self-signup provisioning fail with signup_not_allowed. It therefore
-# ships ON for local development. Turn it off (and wire verification)
-# before exposing a deployment where invite redemption must prove
-# address ownership.
-ALLOW_UNVERIFIED_EMAILS=1
-
 # Artifacts plane (@corbits/artifacts) uses DATABASE_URL too — different
 # schema only (`artifacts.*` FKs into public.tenant/principal). Nothing to
 # configure here; `bun run dev` mounts Library automatically.

apps/hub/README.md

@@ -18,15 +18,18 @@ native tenant middleware.
   explicit import plus one `app.route(...)` call, inside or outside the
   tenant prefix as the extension requires. `src/index.ts` is the single
   file where all of this comes together.
-- `src/*-mount.ts` files (`artifacts-mount.ts`, `memory-mount.ts`,
-  `skills-mount.ts`, `slack-tag-mount.ts`) are wiring helpers that resolve
-  and mount one extension's routes with its own DB handle/config.
+- There are no local `src/*-mount.ts` wiring helpers: each extension's
+  routes mount directly in `src/index.ts` with the shared DB
+  handle/config passed inline at the `app.route(...)` call site.
 - Serves the built `apps/web` SPA from its own origin
   (`HUB_STATIC_DIR` points at `apps/web/dist`), so every `/api` call the
   interface makes is same-origin.
-- `credential-expiry-sweep.ts`, `cron-due.ts`, `workflow-scheduler.ts`,
-  `tenant-create-guard.ts` are host-level
-  background jobs and guards wired at boot, alongside the route mounts.
+- `credential-expiry-sweep.ts`, `workflow-scheduler.ts`, and
+  `inbox-unsnooze-sweep.ts` are host-level periodic sweeps wired at boot,
+  alongside the route mounts; `cron-due.ts` is a re-export seam onto
+  `@corbits/workflows`' own cron matcher, not a second implementation.
+  Tenancy is the stock platform's own middleware — there is no local
+  tenant-create guard.
 - `in-flight-requests.ts` and `shutdown.ts` bound SIGINT/SIGTERM: the hub
   waits for Hono handlers that have not yet returned a Response (a
   request still in a Postgres transaction, a git write), then
@@ -47,7 +50,6 @@ bun run start
 cd apps/hub && bun test
 ```
 
-Several suites (`artifacts-mount.test.ts`, `memory-mount.test.ts`,
-`memory-workflow-routes.test.ts`) exercise mount wiring against a real
-database:
+Suites under `test/` exercise composition and wiring; the DB-backed
+ones run against a real database:
 `DATABASE_URL=postgres://localhost:5432/workbench_e2e bun test`.

apps/hub/src/bench-session.ts

@@ -27,7 +27,7 @@ import type { SessionForUser } from "@workbench/onboarding";
  * provisioning pass can never have its session expire mid-flight. */
 const REMINT_LEAD_MS = 60 * 60 * 1000;
 
-const PROVISIONER_USER_AGENT = "workbench-bench-provisioner";
+const PROVISIONER_USER_AGENT = "hub-bench-provisioner";
 
 type MintedSession = {
   readonly cookies: string[];