Intx cutover: chat tenancy + hub stock composition (combines #740/#741)

.env.example

@@ -44,27 +44,16 @@ HUB_ALLOW_GIT_INSIDE_WORK_TREE=1
 HUB_STATIC_DIR=../web/dist
 
 # The administrator identity `bun run dev` seeds for local development:
-# the dev script signs this account up and makes it the owner of the root
-# tenant (WORKBENCH_DEFAULT_TENANT below), so a fresh checkout can sign in
-# immediately. Unset values fall back to the defaults shown — fine for
-# local development, set both for real deployments.
+# the dev script signs this account up on the fresh hub, so a fresh
+# checkout can sign in immediately. Unset values fall back to the defaults
+# shown — fine for local development, set both for real deployments.
 # HUB_ADMIN_EMAIL=alice@example.com
 # HUB_ADMIN_PASSWORD=password123
 
 # Everything below is optional. Leave a variable unset to leave the
 # feature it configures off; the hub never treats a partially-set group
 # as configured — it fails loudly at boot instead.
 
-# Slug of the root tenant first signup mints. Every self-served
-# personal bench parents under it, and `workbench setup`/`seed` resolve
-# the same slug. Unset falls back
-# to "workbench". ORG_SLUG is an alias when this is unset — set only one.
-# Upgrading a deploy whose existing root was not "workbench": set this
-# to that slug (do not leave OPERATOR_TENANT_ID; the hub refuses to boot
-# while that stale key is set).
-# WORKBENCH_DEFAULT_TENANT=workbench
-# ORG_SLUG=workbench
-
 # Per-IP rate limit on email sign-up. Defaults to 5 sign-ups per 60
 # seconds when unset.
 # SIGNUP_RATE_LIMIT_WINDOW_SECONDS=60
@@ -79,15 +68,10 @@ HUB_STATIC_DIR=../web/dist
 # SIGNIN_RATE_LIMIT_WINDOW_SECONDS=60
 # SIGNIN_RATE_LIMIT_MAX=10
 
-# Self-serve signup mode. Hub default is closed (owner adds users or
-# shares a copy-link invite). Local `bun run dev` opens signup when this
-# is unset so the first admin can seed — set closed explicitly to test
-# the closed gate. See docs/TENANCY.md.
-# WORKBENCH_SIGNUP=open
-
-# When WORKBENCH_SIGNUP=open, optionally restrict which email domains
-# may register (comma-separated). Empty/unset = any domain.
-# WORKBENCH_ALLOWED_EMAIL_DOMAINS=acme.example
+# Self-serve signup is ungated: stock Interchange composition carries no
+# signup mode, domain allowlist, or email-verification gate, so anyone
+# can register (rate-limited only — see SIGNUP_RATE_LIMIT_* above). Gate
+# access in the composition that embeds the hub if a deployment needs it.
 
 # Provider API keys are no longer read from the environment: hub boot
 # plants nothing, and setting ANTHROPIC_API_KEY or any other provider's
@@ -271,15 +255,6 @@ HUB_STATIC_DIR=../web/dist
 # even if this file is copied verbatim.
 ALLOW_PLAINTEXT_SECRETS=1
 
-# Opt-out of @workbench/access-policy's email-verification requirement.
-# The hub has no transactional email wired yet, so NO account can ever
-# become verified — leaving this unset makes `bun run setup` and every
-# self-signup provisioning fail with signup_not_allowed. It therefore
-# ships ON for local development. Turn it off (and wire verification)
-# before exposing a deployment where invite redemption must prove
-# address ownership.
-ALLOW_UNVERIFIED_EMAILS=1
-
 # Artifacts plane (@corbits/artifacts) uses DATABASE_URL too — different
 # schema only (`artifacts.*` FKs into public.tenant/principal). Nothing to
 # configure here; `bun run dev` mounts Library automatically.

README.md

@@ -169,9 +169,8 @@ in any order:
 | File                       | Proves                                                                                                                |
 | -------------------------- | --------------------------------------------------------------------------------------------------------------------- |
 | `smoke-auth.test.ts`       | Email sign-up mints a session cookie that authorizes a session-gated route                                            |
-| `smoke-onboarding.test.ts` | `POST /api/onboarding/provision` mints a personal bench and reports it unseeded when no seed model is configured      |
+| `smoke-onboarding.test.ts` | A brand-new signup starts benchless and mints its first tenant through an ordinary `POST /api/tenants`                |
 | `smoke-chat.test.ts`       | A workbench is created, a message posts and reads back intact, and the invited-agent listing has its documented shape |
-| `smoke-library.test.ts`    | An artifact uploads through the multipart route and round-trips through list and get-by-id                            |
 | `smoke-webhook.test.ts`    | A signed delivery to the public webhook ingress route launches a real run for a routine bound to that trigger         |
 
 **Needs:** a reachable Postgres named by `DATABASE_URL` in `.env` (see

apps/hub/README.md

@@ -18,15 +18,18 @@ native tenant middleware.
   explicit import plus one `app.route(...)` call, inside or outside the
   tenant prefix as the extension requires. `src/index.ts` is the single
   file where all of this comes together.
-- `src/*-mount.ts` files (`artifacts-mount.ts`, `memory-mount.ts`,
-  `skills-mount.ts`, `slack-tag-mount.ts`) are wiring helpers that resolve
-  and mount one extension's routes with its own DB handle/config.
+- There are no local `src/*-mount.ts` wiring helpers: each extension's
+  routes mount directly in `src/index.ts` with the shared DB
+  handle/config passed inline at the `app.route(...)` call site.
 - Serves the built `apps/web` SPA from its own origin
   (`HUB_STATIC_DIR` points at `apps/web/dist`), so every `/api` call the
   interface makes is same-origin.
-- `credential-expiry-sweep.ts`, `cron-due.ts`, `workflow-scheduler.ts`,
-  `tenant-create-guard.ts` are host-level
-  background jobs and guards wired at boot, alongside the route mounts.
+- `credential-expiry-sweep.ts`, `workflow-scheduler.ts`, and
+  `inbox-unsnooze-sweep.ts` are host-level periodic sweeps wired at boot,
+  alongside the route mounts; `cron-due.ts` is a re-export seam onto
+  `@corbits/workflows`' own cron matcher, not a second implementation.
+  Tenancy is the stock platform's own middleware — there is no local
+  tenant-create guard.
 - `in-flight-requests.ts` and `shutdown.ts` bound SIGINT/SIGTERM: the hub
   waits for Hono handlers that have not yet returned a Response (a
   request still in a Postgres transaction, a git write), then
@@ -47,7 +50,6 @@ bun run start
 cd apps/hub && bun test
 ```
 
-Several suites (`artifacts-mount.test.ts`, `memory-mount.test.ts`,
-`memory-workflow-routes.test.ts`) exercise mount wiring against a real
-database:
+Suites under `test/` exercise composition and wiring; the DB-backed
+ones run against a real database:
 `DATABASE_URL=postgres://localhost:5432/workbench_e2e bun test`.