[TheGreatAxios]

Summary

• Client installer holds a portable needs-list and converges a stock Interchange hub over stock routes (tenants, assets, deployments) — no hub-side product seam.
• Deletes tenant-create-guard, tenant-create-onboard, signup-tenancy hub routes and the onboarding genesis/provision paths (0→1 moved to the client needs-list).
• POST /complete and POST /complete-setup converge instead of deploying or kicking reconciles.
• Stacked on feat(onboarding)!: delete pending-seed drain and bench provisioner (CL-7586) #730 (cl-7586-pending-seed-drain); supersedes local approach of feat(hub)!: delete Slack ingress #743 (not depended on).

Myra retry follow-up (b84bff1)

• Genesis converge reports an unresolvable agent deploy as pending (retry contract: never silent, never thrown); the finishing-setup page drives the Myra deploy itself over stock routes once the credential seed lands (fire-and-forget on the direct-submit path, awaited in the poll path; transport errors reported, never silent).
• Setup poll is bounded: 20 attempts / 2s delay with explicit timeout (hands back last answer, still drives deploy + navigates) and cancelled (unmount) outcomes.
• No new hub routes; no hub-side tenant gate (brief-ordered removal stays).

Verification (local)

• bun run scripts/typecheck.ts ✅ clean
• bun run lint ✅ 0 errors (10 pre-existing noInlineConfig warnings in untouched files)
• bun run scripts/test-scripts/test_all.ts ✅ 82/82
• packages/onboarding ✅ 143/143 (incl. new connect-deploys-nothing suite)
• apps/web installer tests ✅ 64/64
• packages/access-policy ✅ 39/39
• One full bun run test run went fully green earlier (a5d512fb, exit 0).
• Remaining local full-gate failures are shared-host Postgres saturation (106/100 conns, timeouts in untouched files) from concurrent sibling suites; pre-push hook bypassed with --no-verify per director approval — CI to arbitrate.
• Follow-up commit: apps/web bun test ./src ./test ✅ 973/973 (incl. new myra-deploy, setup-completion-poll, converge-pending suites); tsc --noEmit ✅ clean; eslint on touched files ✅ 0 errors.

Client convergence-as-owner (ec99651)

Convergence contract (all client-driven, no hub provision seam):

• First signup creates the root over stock POST /api/tenants ({name, slug} → 201) and becomes its owner; signup itself mints no tenant and seeds nothing.
• Later members join by owner invite (POST /api/tenants/:id/members/invite → 201) + activate (PATCH .../principals/:id {status: active} → 200) into the member role; no second tenant is minted.
• The deleted first-login hook stays deleted: POST /api/onboarding/provision 404s; re-creating the same slug conflicts (409), never duplicates.
• Suites rewired onto the contract: apps/hub/test/signup-genesis, boot-does-not-seed, composition, and e2e smoke-onboarding, local-rip, greeting-delivery. Client wording aligned (stock/myra prefixes), onboarding provisioning failures now carry a reportError refId.

Per-job triage (local, ec99651):

• Touched suites green: signup-genesis 3/3, myra-deploy 9/9, needs-converge + needs-list 25/25 (combined re-run 37/37, exit 0).
• bun run lint ✅ 0 errors (prettier clean on all touched files; remaining warnings pre-existing in untouched files); bun run typecheck ✅ clean (pre-push hook stages passed).
• Full bun run test still flakes on shared-host Postgres saturation in untouched suites (applyBenchMigrations / applyNotifyMigrations / applyInferenceCatalogMigrations, scripts/db-setup old-numbering) — each passes in isolation; same class as the previously recorded saturation flakes. Pushed with --no-verify on that basis — CI to arbitrate.
• Pre-push hook also caught and fixed two real issues in this commit before push: prettier reflows (folded in, plus a shortened suite label to avoid a whole-file re-indent) and two unused bob bindings left by the join-path rewrite (dropped, account-creation calls kept).

Sign-off needed

• Ungated POST /api/tenants remains as brief-ordered (CL-8085): any authenticated account can create tenants with no hub-side gate. Flagged as a known risk needing explicit sign-off before merge. Re-vendor item STILL-OPEN.
• Do not merge without B2 sign-off.

Closes CL-8085

[linear-code]

CL-8085

[TheGreatAxios]

Superseded: main already carries the portable client driver (needs-list/needs-converge from #739/#742); hub-zero T7 (CL-8131) wires it. The one durable finding here — stock members/invite without roleId yields a principal with zero grants (403) — is noted on CL-8131.