Repository navigation
Intx cutover: chat tenancy + hub stock composition (combines #740/#741) - #742
Merged
Merged
Conversation
Summary: - New forward migration 0031 drops chat.workbench_tenancy and its index; history untouched, chat_bench_settings kept (product data, no drop). - Delete workbench-tenancy.ts, workbench-tenancy-routes.ts (POST /kinds), POST /workbenches/:id/move, and POST /participants/mint-dm. - Delete mint wrappers (createWorkbenchTenant, mintNativeChildTenant, mintAgentDm, provisionSpaceWorkbench), tenancy compensations, grant planting, addWorkbenchMember conferral, withTenancy annotator, legacy true/false and no_tenancy paths, find-or-reopen. - Retain pure native principal reads in new neutral module src/native-principal.ts (refId projection for DM 1:1 validation); server mints nothing, settings writes take client-minted ids. - Update no-product-tenancy structural allowlist (workbench_tenancy removed) and chat-local README. Verification: - bun run typecheck (packages/chat): exit 0 - bun test (packages/chat): 928 pass, 0 fail (two consecutive full runs) - bunx prettier --check on changed files: pass; bunx eslint packages/chat: exit 0 - bun run check:structural no-product-tenancy: ok
Summary: Collapse the second person-DM principal lookup into the pre-mint gate's validated result, reusing it with the full kind/status predicate instead of re-fetching with an undefined-only check. Add pins for agent-kind and cross-bench principalId rejection plus a single-lookup assertion. Clear stale deleted-test-file and workbenchTenancy comment pointers. Verification: bun test (931 pass, 0 fail), bun run typecheck (exit 0), prettier --check and eslint on touched files (clean).
Summary: - Delete Workbench product-policy mounts, guards, and onboarding from apps/hub (artifacts/memory/skills/slack-tag mounts, tenant-create guard/onboard, dispatch tenant guard, signup tenancy, connection-live reconcile) and repair composition wiring/imports. - Rename WORKBENCH_CHAT_IDLE_REAP_MS to HUB_CHAT_IDLE_REAP_MS; drop product-only signup/genesis knobs (WORKBENCH_SIGNUP, WORKBENCH_ALLOWED_EMAIL_DOMAINS, WORKBENCH_DEFAULT_TENANT/ORG_SLUG). - Update wiring-pin tests for cut routes; drop the dead draft-routes pin; shrink the report-error baseline to the remaining matches. Verification: - bun run --cwd apps/hub test: 216 pass, 0 fail (plus 1 file-level isolation-harness error: the shared test database carries an unknown chat migration 0031_workbench_tenancy_drop, so the live-sidecar probe cannot create workbenches; unrelated to this change). - bun run --cwd apps/hub typecheck: clean. - bun run lint: 0 errors (10 pre-existing warnings in unrelated packages). - bun run check:structural: exit 0, 18 checks ok.
HARD REFRESH - EXISTING DATABASES MUST RESET (bun run reset). There is no upgrade path for the removed entries: any dev/test database whose chat.chat_migrations ledger already contains 0005_channel_tenancy or 0006_channel_tenancy_parent_index will NOT replay them (they no longer exist in the chain), and must be rebuilt from scratch rather than migrated forward. Summary: - Delete the dead chain rendered moot by 0031_drop_workbench_tenancy: 0005_channel_tenancy CREATE, 0006_channel_tenancy_parent_index, and the three 0018 tenancy rename rows (table/column/index renames that only ever served the link table). Fresh databases now build clean with no backfill and no legacy rows; the tenancy table is never created. - Keep 0031 as the forward-drop guard (SQL untouched, table stays dropped): a no-op DROP IF EXISTS on fresh databases, still drops the leftover table/index on pre-purge databases. - No other entries touched: audit found no additional backfill or no_tenancy-era migrations whose sole purpose dies with the dropped table (the only tenancy references in the chain were 0005/0006/0018/ 0031). Ledger names are stable identifiers, so later entries keep their numbers - the chain now has gaps at 0005/0006 by design and must never be renumbered. - Update test/migrations.test.ts ledger assertions to the 29-entry purged chain. No allowlist change: no-product-tenancy still passes at 16 tables (workbench_tenancy was already removed there), and its 0018 comment stays accurate. Verification: - bun test test/migrations.test.ts (isolated scratch DBs, never the shared DATABASE_URL): 4 pass, 0 fail - fresh replay applies the purged chain idempotently, tenancy tables/indexes absent - bun test (packages/chat): 931 pass, 0 fail - bun run typecheck (packages/chat): exit 0 - bunx prettier --check on changed files: pass; bunx eslint packages/chat: exit 0 - bun run check:structural: 17 ok; check:report-error FAILs on 4 stale baseline entries in routes.ts/workbench-service.ts left by the earlier cutover commits (pre-existing, unrelated to this change)
Summary: - test/isolation/setup.ts, scripts/e2e/harness.ts: drop WORKBENCH_SIGNUP/ALLOW_UNVERIFIED_EMAILS boot env (stock composition leaves signup ungated). - scripts/dev.ts: drop WORKBENCH_SIGNUP=open injection and the signup_closed seed branch. - scripts/e2e/local-rip.test.ts: closed-signup hop becomes signup-stays-ungated against the main hub. - .env.example: remove WORKBENCH_SIGNUP/WORKBENCH_ALLOWED_EMAIL_DOMAINS/ALLOW_UNVERIFIED_EMAILS/WORKBENCH_DEFAULT_TENANT/ORG_SLUG blocks. - docs/TENANCY.md, docs/local-rip.md: describe ungated stock signup, caller-chosen root slug, removed tenant-create guard. Verification: - Hub typecheck (apps/hub tsc --noEmit): exit 0. - prettier --check + eslint on all touched files: clean. - Worktree grep for deleted keys: only intentional historical mentions remain (listed in report).
Summary: - access-policy: drop envSignupMode/envAllowedDomains bootstrap from evaluateSignupGate/checkSignupGate; rowless evaluation is closed defaults. allowUnverifiedEmails stays as an explicit caller option. - bench-ui: delete SignupMode, DEFAULT_SIGNUP_MODE, emailAllowedForSignup, parseAllowedEmailDomains, parseSignupMode and their exports/tests; README prose updated. - settings-ui: remove envSignupClosed notice/probe from AccessPolicyBlock/Editor; delete getAuthConfig/AuthConfig client for the removed /api/auth-config endpoint and its string/test. - hub-api-client: remove signup_closed env-fix branch from authenticate; failure prose points at hub logs, never an env key. - onboarding: thread the trimmed gate options through genesis/provision/routes; gate-specific tests wire the policy explicitly, other tests run without a gate. Verification: - bun test in packages/access-policy (36 pass), packages/onboarding (223 pass), packages/bench-ui (22 pass), packages/settings-ui (161 pass), packages/hub-api-client (13 pass) - bun run typecheck: exit 0 - bun run lint: exit 0 (0 errors, 10 pre-existing warnings) - bun run check:structural: exit 0
…config Stock Interchange exposes no sign-in discovery endpoint, so the hub stops serving GET /api/auth-config and the web sign-in screen draws its OAuth buttons from a static client list (SOCIAL_SIGN_IN_PROVIDERS) instead of probing the hub. better-auth still decides which providers actually work. The settings-ui oauth-configured probe is untouched.
… baseline The chat cutover lane removed the workbench-tenancy surface (routes, drizzle store) and reshaped the route deps: createChatRoutes now takes principals (NativePrincipalStore) and createWorkflowParticipantRoutes no longer takes tenancy or sessionFor. This wires the hub to the new shape: removes the /api/workbench-tenancies mount, the chatTenancy store, and the tenancy-only composition test; chatDeps gains principals via createDrizzleNativePrincipalStore(db). Also regenerates the report-error baseline for the single stale apps/web/src/session.ts occurrence-4 entry (that catch no longer exists; signOut is now .catch(() => false)).
bench-session.ts has zero importers repo-wide and no test coverage (orphaned when sessionFor wiring was removed). The sessionFor seam in packages/onboarding bench-provisioning.ts stays: it is live within the package (read at bench-provisioning.ts:216, covered by package tests). Docs Sessions section no longer claims a hub filler; report-error baseline drops the file's single entry.
The listActivity summary test relied on serial inserts producing strictly increasing created_at values, but created_at defaults to now() at millisecond precision, so contended inserts share one timestamp and a message lands exactly on the read cursor, dropping out of the strict-> unread count (2-vs-1 / 2-vs-0 flake). The test now pins explicit whole-second-apart timestamps for the three BUSY rows and derives the cursor and newest expectations from those pinned values. Production listActivity untouched.
Stock Interchange removed the skills surface, so plantDefaultSkills 404s and skill pins can never converge. The plant now skips loudly on 404; the reconcile re-reads skill pins after seeding and reports still-absent pins 'blocked' (never installed), holding readiness false only when a workflow is also pending. E2E hops assert the stock steady state: workflows present, skills pending-but-absent.
The console.warn tripped the no-console lint rule and bypassed the pipeline log the reconcile report already reads; the skip is now a plain log call — the reconcile re-read reports blocked pins on its own, so swallow-tolerant diagnostics are the correct channel.
- isolation: replace the deleted workbench move block with cross-tenant refusal hops on the surviving chat detail routes (stock: workbench id = conversation tenant id, one bench per tenant) - chat/greeting-delivery: install the tenant's corbits-tools registry before seeding so the assistant's sidecar allocation initializes; without it every agent run stayed at zero events - greeting-delivery/smoke-onboarding: replace deleted /api/onboarding/provision hops with the stock signup + POST /api/tenants + native invite flow (local-rip pattern) - smoke-library: deleted with the artifact routes (cutover) - tenant-seed: stock composition exposes no definition-stop route, so startStopped is now a logged no-op instead of a 404 (local-rip)
The webhook-fired run's sidecar initialization resolves its @corbits scope pins against the tenant's own corbits-tools package registry (CL-7071 cutover). smoke-webhook never installed it, so the launch failed with sidecar_initialization_failed and the run recorded no inference_turn within the CL-5910 hop's 60s deadline. Publish the registry inside the deploy hop's retry loop, the same way the chat/greeting lanes do.
This was referenced Sep 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Combined, pre-verified cutover PR superseding #740 and #741 (both blocked red on order-dependence: each deletes what the other still references).
Contents (all reviewed, all green on isolated DBs):
Verification: typecheck/lint/structural green; chat 931, hub 215x2, web 985+ on isolated scratch DBs; 10+ independent critic verdicts. Client driver already merged as #739.
Closes #740, closes #741 (close those after this merges).
Linear IDs pending — branch rename to cl-- on filing.