feat(hub-zero)!: T6 signup policy to native authz (CL-8130)

apps/hub/README.md

@@ -13,7 +13,7 @@ native tenant middleware.
   provide the platform's own routes, auth, and tenant middleware; this
   app never re-implements them.
 - Every `@corbits/*` and `@workbench/*` package route (chat, approvals,
-  bench, insights, access-policy, mailbox, memory, skills, artifacts,
+  bench, insights, mailbox, memory, skills, artifacts,
   routines, tasks, webhooks, and more) mounts here as one
   explicit import plus one `app.route(...)` call, inside or outside the
   tenant prefix as the extension requires. `src/index.ts` is the single

apps/hub/src/hub-error-handler.ts

@@ -33,9 +33,8 @@ function hasGuidance(err: unknown): err is Error & { guidance: string } {
  * `app.onError` runs for routes mounted both inside and outside the
  * platform's tenant middleware, so `c`'s `Variables` aren't statically
  * known here; this borrows the same `TenantEnv` a tenant-scoped route
- * types `c.get("tenant")` with (see `packages/access-policy/src/routes.ts`)
- * to read `tenant.id` when a tenant-scoped route set it, without claiming
- * the wider type up front.
+ * types `c.get("tenant")` with to read `tenant.id` when a tenant-scoped
+ * route set it, without claiming the wider type up front.
  */
 function extractTenantId(c: Context): string | undefined {
   return (c as unknown as Context<TenantEnv>).var.tenant?.id;

docs/GLOSSARY.md

@@ -64,5 +64,5 @@ Naming conventions for this repository's packages:
   plain local domain code — with a kebab-case kind suffix where the
   package is one of a family (`-agent`, `-tool`).
 - `@workbench/*` is a legacy scope being migrated to `@corbits/*` package
-  by package; a handful of packages still carry it (`access-policy`,
-  `connections`, `onboarding`). New packages never use it.
+  by package; a handful of packages still carry it (`connections`,
+  `onboarding`). New packages never use it.