From 951bae1988e0d1187d44469d9c8fc5b33126c1f6 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Thu, 17 Sep 2026 10:23:50 -0700
Subject: [PATCH 1/8] feat(connections): fold the concrete connector set back
 into the package

CL-7384 split CONNECTOR_REGISTRY and MCP_PRESETS out into
templates/connectors.ts so the connections package stayed a pure
generic library. CL-8156 deletes templates/ entirely, so this data
comes back to its one remaining home: packages/connections/src/registry.ts
and mcp-presets.ts.

Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
---
 packages/connections/package.json         |   2 +
 packages/connections/src/mcp-presets.ts   | 157 ++++-
 packages/connections/src/registry.test.ts | 462 +++++++++++++++
 packages/connections/src/registry.ts      | 692 +++++++++++++++++++++-
 4 files changed, 1297 insertions(+), 16 deletions(-)
 create mode 100644 packages/connections/src/registry.test.ts

diff --git a/packages/connections/package.json b/packages/connections/package.json
index 85025d53b7..bd11ec4e90 100644
--- a/packages/connections/package.json
+++ b/packages/connections/package.json
@@ -34,6 +34,7 @@
   },
   "dependencies": {
     "@corbits/code-review": "workspace:*",
+    "@corbits/codex-provider": "workspace:*",
     "@corbits/credential-providers": "workspace:*",
     "@corbits/error-sink": "workspace:*",
     "@corbits/github-tools": "workspace:*",
@@ -43,6 +44,7 @@
     "@corbits/mcp-tools": "workspace:*",
     "@corbits/oauth-core": "github:corbitsdev/corbits-oauth-core#v0.1.1",
     "@corbits/workflows": "workspace:*",
+    "@corbits/xai-provider": "workspace:*",
     "@intx/crypto": "0.3.0",
     "@intx/db": "workspace:*",
     "@intx/hub-api": "workspace:*",
diff --git a/packages/connections/src/mcp-presets.ts b/packages/connections/src/mcp-presets.ts
index 9d702d024c..f4cb0a5cb8 100644
--- a/packages/connections/src/mcp-presets.ts
+++ b/packages/connections/src/mcp-presets.ts
@@ -1,7 +1,15 @@
-// The `McpPreset` shape and the generic helpers a caller needs to work
-// with a preset list — the concrete curated presets themselves (Granola,
-// Exa, Linear, GitHub MCP, ...) moved to `templates/connectors.ts` as
-// part of CL-7384, alongside `./registry.ts`'s connector descriptors.
+// The `McpPreset` shape, the generic helpers a caller needs to work with a
+// preset list, and Workbench's curated remote MCP servers — folded back in
+// here by CL-8156 from `templates/connectors.ts` (CL-7384 had split them
+// out) now that `@workbench/templates` no longer exists to own them.
+import {
+  siGithub,
+  siNotion,
+  siPosthog,
+  siRailway,
+  siSentry,
+} from "simple-icons";
+
 export type McpPresetConnectionMode = "oauth" | "keyless" | "token";
 
 export type McpPreset = {
@@ -48,3 +56,144 @@ export function mcpPresetByName(
       preset.slug === needle || preset.displayName.toLowerCase() === needle,
   );
 }
+
+/**
+ * Curated remote MCP servers that Workbench can connect without asking a
+ * person for a URL, API key, client id, or client secret. OAuth entries have
+ * been verified to advertise OAuth discovery, PKCE, and dynamic client
+ * registration; keyless entries can be probed and stored immediately; token
+ * entries accept a pasted access token as the bearer (GitHub's MCP server
+ * does OAuth only for clients pre-registered with GitHub — it offers no
+ * dynamic client registration — so its connect here is the token walk).
+ */
+export const MCP_PRESETS: readonly McpPreset[] = [
+  {
+    slug: "granola",
+    displayName: "Granola",
+    description: "Search meeting notes, transcripts, and action items.",
+    url: "https://mcp.granola.ai/mcp",
+    connectionMode: "oauth",
+    docsUrl: "https://docs.granola.ai/help-center/sharing/integrations/mcp",
+    nativeConnectorId: "granola",
+  },
+  {
+    slug: "exa",
+    displayName: "Exa",
+    description: "Search and research the live web.",
+    url: "https://mcp.exa.ai/mcp",
+    connectionMode: "keyless",
+    docsUrl: "https://docs.exa.ai/reference/exa-mcp",
+    nativeConnectorId: "exa",
+  },
+  {
+    slug: "linear",
+    displayName: "Linear",
+    description: "Read and update issues, projects, and comments.",
+    url: "https://mcp.linear.app/mcp",
+    connectionMode: "oauth",
+    docsUrl: "https://linear.app/docs/mcp",
+    nativeConnectorId: "linear",
+  },
+  {
+    // Deliberately NOT slug "github" and NOT nativeConnectorId "github":
+    // the native GitHub connector (PAT/OAuth-App feeding
+    // @corbits/github-tools) stays its own card, and preset lookups by
+    // "github" must keep resolving to it, never here.
+    slug: "github-mcp",
+    displayName: "GitHub MCP",
+    description: "Search code, work with issues and pull requests.",
+    url: "https://api.githubcopilot.com/mcp/",
+    connectionMode: "token",
+    docsUrl: "https://github.com/settings/tokens",
+    icon: { path: siGithub.path, hex: siGithub.hex },
+    tokenSteps: [
+      "Open github.com/settings/tokens and generate a new token.",
+      "Give it the repo scope — that lets agents read code, issues, and pull requests.",
+      "Paste it below. It's stored encrypted, only your agents use it, and you can disconnect any time.",
+    ],
+  },
+  {
+    slug: "notion",
+    displayName: "Notion",
+    description: "Search and update pages, databases, and workspace content.",
+    url: "https://mcp.notion.com/mcp",
+    connectionMode: "oauth",
+    docsUrl: "https://developers.notion.com/guides/mcp/get-started-with-mcp",
+    icon: { path: siNotion.path, hex: siNotion.hex },
+  },
+  {
+    slug: "sentry",
+    displayName: "Sentry",
+    description: "Investigate errors, traces, releases, and projects.",
+    url: "https://mcp.sentry.dev/mcp",
+    connectionMode: "oauth",
+    docsUrl: "https://mcp.sentry.dev/",
+    icon: { path: siSentry.path, hex: siSentry.hex },
+  },
+  {
+    slug: "attio",
+    displayName: "Attio",
+    description: "Work with CRM records, lists, notes, and tasks.",
+    url: "https://mcp.attio.com/mcp",
+    connectionMode: "oauth",
+    docsUrl: "https://docs.attio.com/mcp/overview",
+  },
+  {
+    slug: "railway",
+    displayName: "Railway",
+    description: "Inspect and manage projects, services, and deployments.",
+    url: "https://mcp.railway.com",
+    connectionMode: "oauth",
+    docsUrl: "https://docs.railway.com/ai/mcp-server",
+    icon: { path: siRailway.path, hex: siRailway.hex },
+  },
+  {
+    slug: "posthog",
+    displayName: "PostHog",
+    description: "Explore product analytics, errors, flags, and experiments.",
+    url: "https://mcp.posthog.com/mcp",
+    connectionMode: "oauth",
+    docsUrl: "https://posthog.com/docs/model-context-protocol",
+    icon: { path: siPosthog.path, hex: siPosthog.hex },
+  },
+  {
+    slug: "sumble",
+    displayName: "Sumble",
+    description: "Research accounts, people, technologies, and buying signals.",
+    url: "https://mcp.sumble.com/",
+    connectionMode: "oauth",
+    docsUrl: "https://sumble.com/guides/account-research",
+  },
+  {
+    // No simple-icons listing for Canva (CL-6647) — same gap as Granola
+    // and Sumble above, so this card falls back to the initial-letter
+    // tile rather than risk a hand-traced or doctored mark.
+    slug: "canva",
+    displayName: "Canva",
+    description: "Design decks, docs, and graphics.",
+    url: "https://mcp.canva.com/mcp",
+    connectionMode: "oauth",
+    docsUrl: "https://www.canva.dev/docs/mcp/",
+    oauthScopes: [
+      "profile:read",
+      "design:meta:read",
+      "design:content:write",
+      "design:content:read",
+      "folder:read",
+      "folder:write",
+      "brandtemplate:content:read",
+      "brandtemplate:meta:read",
+      "brandtemplate:content:write",
+      "comment:write",
+      "comment:read",
+      "asset:read",
+      "asset:write",
+      "brandkit:read",
+      "help:answers:read",
+      "help:answers:write",
+    ],
+  },
+];
+
+export const MCP_PRESET_CONNECTOR_IDS: readonly string[] =
+  mcpPresetConnectorIds(MCP_PRESETS);
diff --git a/packages/connections/src/registry.test.ts b/packages/connections/src/registry.test.ts
new file mode 100644
index 0000000000..c34e835c2a
--- /dev/null
+++ b/packages/connections/src/registry.test.ts
@@ -0,0 +1,462 @@
+import { describe, expect, test } from "bun:test";
+import { CODEX_SCOPES } from "@corbits/codex-provider/constants";
+import { CONNECTOR_REGISTRY, connectorDescriptors } from "./registry";
+import {
+  MCP_PRESET_CONNECTOR_IDS,
+  MCP_PRESETS,
+  mcpPresetByName,
+  mcpPresetBySlug,
+} from "./mcp-presets";
+
+describe("CONNECTOR_REGISTRY", () => {
+  test("every entry has an id, displayName, and docsUrl", () => {
+    for (const descriptor of Object.values(CONNECTOR_REGISTRY)) {
+      expect(descriptor.id.length).toBeGreaterThan(0);
+      expect(descriptor.displayName.length).toBeGreaterThan(0);
+      expect(descriptor.docsUrl.length).toBeGreaterThan(0);
+    }
+  });
+
+  test("every api-key entry has a probe", () => {
+    for (const descriptor of Object.values(CONNECTOR_REGISTRY)) {
+      if (descriptor.authKind !== "api-key") continue;
+      expect(descriptor.probe).toBeDefined();
+    }
+  });
+
+  // `github` is the one deliberate exception (CL-6386): it stays
+  // `authKind: "api-key"` (the PAT paste form is always available) but
+  // also carries an `oauth` config a caller checks `GET
+  // /oauth-configured` before offering, ahead of the paste form, as a
+  // hosted one-click connect. Every other api-key connector still names
+  // no `oauth` at all.
+  test("only github carries an oauth config alongside api-key", () => {
+    for (const descriptor of Object.values(CONNECTOR_REGISTRY)) {
+      if (descriptor.authKind !== "api-key") continue;
+      if (descriptor.id === "github") {
+        expect(descriptor.oauth).toBeDefined();
+        continue;
+      }
+      expect(descriptor.oauth).toBeUndefined();
+    }
+  });
+
+  // CL-6258: every provider row in Settings > Connections needs a logo
+  // tile -- a simple-icons mark where one exists, a monochrome initial
+  // tile (rendered from `displayName` alone) where it doesn't.
+  test("every inference provider with a simple-icons listing carries a hex-keyed icon", () => {
+    for (const id of [
+      "anthropic",
+      "google-genai",
+      "deepseek",
+      "mistral",
+      "ollama",
+      "openrouter",
+      "huggingface",
+    ]) {
+      const descriptor = CONNECTOR_REGISTRY[id];
+      expect(descriptor?.icon?.path.length).toBeGreaterThan(0);
+      expect(descriptor?.icon?.hex).toMatch(/^[0-9A-F]{6}$/i);
+    }
+  });
+
+  test("providers with no simple-icons listing fall back to no icon (initial tile)", () => {
+    for (const id of ["openai", "xai", "groq", "opencode-zen"]) {
+      expect(CONNECTOR_REGISTRY[id]?.icon).toBeUndefined();
+    }
+  });
+
+  test("includes OpenRouter and Hugging Face as oauth-pkce connectors, no probe", () => {
+    for (const id of ["openrouter", "huggingface"]) {
+      const descriptor = CONNECTOR_REGISTRY[id];
+      expect(descriptor?.authKind).toBe("oauth-pkce");
+      expect(descriptor?.probe).toBeUndefined();
+      expect(descriptor?.oauth).toBeDefined();
+      expect(descriptor?.oauth?.usesPKCE).toBe(true);
+      expect(descriptor?.oauth?.deploysDefaultWorkflows).toBe(true);
+      expect(descriptor?.feedsTools).toEqual([]);
+    }
+  });
+
+  test("only Hugging Face requires a configured client id", () => {
+    expect(CONNECTOR_REGISTRY["openrouter"]?.oauth?.clientId).toBeUndefined();
+    expect(
+      CONNECTOR_REGISTRY["huggingface"]?.oauth?.clientId?.({}),
+    ).toBeUndefined();
+    expect(
+      CONNECTOR_REGISTRY["huggingface"]?.oauth?.clientId?.({
+        huggingfaceClientId: "hf_1",
+      }),
+    ).toBe("hf_1");
+  });
+
+  test("only Hugging Face echoes state back in its callback query", () => {
+    expect(CONNECTOR_REGISTRY["openrouter"]?.oauth?.echoesState).toBe(false);
+    expect(CONNECTOR_REGISTRY["huggingface"]?.oauth?.echoesState).toBe(true);
+  });
+
+  test("includes the eight non-OAuth inference providers", () => {
+    for (const id of [
+      "anthropic",
+      "openai",
+      "google-genai",
+      "xai",
+      "opencode-zen",
+      "groq",
+      "deepseek",
+      "mistral",
+    ]) {
+      expect(CONNECTOR_REGISTRY[id]).toBeDefined();
+      expect(CONNECTOR_REGISTRY[id]?.feedsTools).toEqual([]);
+    }
+  });
+
+  test("ollama collects a URL, not a key, and needs no probed secret to reach reachability", () => {
+    const descriptor = CONNECTOR_REGISTRY["ollama"];
+    expect(descriptor?.authKind).toBe("api-key");
+    expect(descriptor?.credentialInputKind).toBe("url");
+    expect(descriptor?.credentialPlaceholder).toBe("http://localhost:11434");
+    expect(descriptor?.probe).toBeDefined();
+    expect(descriptor?.feedsTools).toEqual([]);
+  });
+
+  test("includes Codex and xai-oauth as oauth-loopback connectors, no probe", () => {
+    for (const id of ["codex", "xai-oauth"]) {
+      const descriptor = CONNECTOR_REGISTRY[id];
+      expect(descriptor?.authKind).toBe("oauth-loopback");
+      expect(descriptor?.probe).toBeUndefined();
+      expect(descriptor?.oauth).toBeDefined();
+      expect(descriptor?.oauth?.usesPKCE).toBe(true);
+      expect(descriptor?.oauth?.deploysDefaultWorkflows).toBe(true);
+      expect(descriptor?.feedsTools).toEqual([]);
+      // The OAuth client ids are the provider CLIs' public identifiers.
+      expect(descriptor?.oauth?.clientId?.({})).toBeDefined();
+    }
+  });
+
+  test("pins each loopback provider to its own fixed redirect URI", () => {
+    const codexUrl = CONNECTOR_REGISTRY["codex"]?.oauth?.buildAuthorizeUrl({
+      callbackUrl: "https://bench.example.com/ignored",
+      state: "s",
+      codeChallenge: "c",
+      clientId: "app_1",
+    });
+    expect(codexUrl?.origin).toBe("https://auth.openai.com");
+    expect(codexUrl?.searchParams.get("redirect_uri")).toBe(
+      "http://localhost:1455/auth/callback",
+    );
+    expect(codexUrl?.searchParams.get("originator")).toBe("codex_cli_rs");
+    // Pinned against the upstream Codex CLI's scope grant — the
+    // api.connectors.* scopes are what let the backend serve connector
+    // tools to this client, and the authorization server issues them only
+    // to the Codex client id. Asserted against the exported constant so
+    // the descriptor cannot drift from the adapter's refresh path.
+    expect(codexUrl?.searchParams.get("scope")?.split(" ")).toEqual([
+      ...CODEX_SCOPES,
+    ]);
+
+    const xaiUrl = CONNECTOR_REGISTRY["xai-oauth"]?.oauth?.buildAuthorizeUrl({
+      callbackUrl: "https://bench.example.com/ignored",
+      state: "s",
+      codeChallenge: "c",
+      clientId: "client_1",
+    });
+    expect(xaiUrl?.origin).toBe("https://auth.x.ai");
+    expect(xaiUrl?.searchParams.get("redirect_uri")).toBe(
+      "http://127.0.0.1:1456/callback",
+    );
+    expect(xaiUrl?.searchParams.get("scope")).toContain("grok-cli:access");
+  });
+
+  test("exchanges a loopback code for tokens against the provider's own token endpoint", async () => {
+    const originalFetch = globalThis.fetch;
+    const requestedURLs: string[] = [];
+    globalThis.fetch = (async (input: string) => {
+      requestedURLs.push(input);
+      return new Response(
+        JSON.stringify({
+          access_token: "at_1",
+          refresh_token: "rt_1",
+          expires_in: 3600,
+        }),
+        { status: 200 },
+      );
+    }) as unknown as typeof fetch;
+    try {
+      const result = await CONNECTOR_REGISTRY["codex"]?.oauth?.exchange({
+        code: "abc",
+        codeVerifier: "ver",
+        redirectUri: "http://localhost:1455/auth/callback",
+        clientId: "app_1",
+      });
+      expect(result).toMatchObject({
+        ok: true,
+        apiKey: "at_1",
+        refreshToken: "rt_1",
+      });
+      expect(requestedURLs).toEqual(["https://auth.openai.com/oauth/token"]);
+      expect(requestedURLs[0]).toContain("auth.openai.com");
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("reports a failed loopback exchange without throwing", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async () =>
+      new Response("nope", { status: 400 })) as unknown as typeof fetch;
+    try {
+      const result = await CONNECTOR_REGISTRY["xai-oauth"]?.oauth?.exchange({
+        code: "abc",
+        codeVerifier: "ver",
+        redirectUri: "http://127.0.0.1:1456/callback",
+        clientId: "client_1",
+      });
+      expect(result?.ok).toBe(false);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  });
+
+  test("includes the tool connectors with the right feedsTools", () => {
+    expect(CONNECTOR_REGISTRY["granola"]?.feedsTools).toEqual([
+      "@corbits/granola-tools",
+    ]);
+    expect(CONNECTOR_REGISTRY["manus"]?.feedsTools).toEqual([
+      "@corbits/manus-tools",
+    ]);
+    expect(CONNECTOR_REGISTRY["manus"]?.credentialPlugin).toBe(
+      "http-x-manus-api-key",
+    );
+    expect(CONNECTOR_REGISTRY["manus"]?.authKind).toBe("api-key");
+    expect(CONNECTOR_REGISTRY["manus"]?.icon).toBeUndefined();
+    expect(CONNECTOR_REGISTRY["exa"]?.feedsTools).toEqual([
+      "@corbits/web-search-tools",
+    ]);
+    expect(CONNECTOR_REGISTRY["scrapecreators"]?.feedsTools).toEqual([
+      "@corbits/reddit-tools",
+    ]);
+    expect(CONNECTOR_REGISTRY["scrapecreators"]?.displayName).toBe(
+      "ScrapeCreators",
+    );
+    expect(CONNECTOR_REGISTRY["linear"]?.feedsTools).toEqual([
+      "@corbits/linear-tools",
+    ]);
+    expect(CONNECTOR_REGISTRY["github"]?.feedsTools).toEqual([
+      "@corbits/github-tools",
+    ]);
+  });
+});
+
+describe("granola-webhook", () => {
+  test("is a webhook-secret connector with no probe, no oauth, and no feedsTools", () => {
+    const descriptor = CONNECTOR_REGISTRY["granola-webhook"];
+    expect(descriptor?.authKind).toBe("webhook-secret");
+    expect(descriptor?.probe).toBeUndefined();
+    expect(descriptor?.oauth).toBeUndefined();
+    expect(descriptor?.feedsTools).toEqual([]);
+    expect(descriptor?.credentialPlugin).toBe("http");
+  });
+});
+
+describe("connectorDescriptors", () => {
+  test("returns every registry entry", () => {
+    expect(connectorDescriptors(CONNECTOR_REGISTRY).length).toBe(
+      Object.keys(CONNECTOR_REGISTRY).length,
+    );
+  });
+
+  test("each connector mediates through the header plugin its API actually expects", () => {
+    expect(CONNECTOR_REGISTRY["linear"]?.credentialPlugin).toBe(
+      "http-raw-authorization",
+    );
+    expect(CONNECTOR_REGISTRY["exa"]?.credentialPlugin).toBe("http-x-api-key");
+    expect(CONNECTOR_REGISTRY["scrapecreators"]?.credentialPlugin).toBe(
+      "http-x-api-key",
+    );
+    expect(CONNECTOR_REGISTRY["manus"]?.credentialPlugin).toBe(
+      "http-x-manus-api-key",
+    );
+    const nonBearer = new Set(["linear", "exa", "scrapecreators", "manus"]);
+    for (const [id, descriptor] of Object.entries(CONNECTOR_REGISTRY)) {
+      if (nonBearer.has(id)) continue;
+      expect(descriptor.credentialPlugin).toBe("http");
+    }
+  });
+});
+
+describe("gmail connector", () => {
+  test("is a pure oauth-code connector with a hosted-app env pair", () => {
+    const descriptor = CONNECTOR_REGISTRY["gmail"];
+    expect(descriptor?.authKind).toBe("oauth-code");
+    expect(descriptor?.credentialPlugin).toBe("http");
+    expect(descriptor?.oauth).toBeDefined();
+    expect(descriptor?.oauth?.clientId?.({ gmailClientId: "client-1" })).toBe(
+      "client-1",
+    );
+    expect(
+      descriptor?.oauth?.clientSecret?.({ gmailClientSecret: "secret-1" }),
+    ).toBe("secret-1");
+    expect(descriptor?.oauth?.clientId?.({})).toBeUndefined();
+  });
+
+  test("asks Google for offline access and the gmail scope with PKCE", () => {
+    const descriptor = CONNECTOR_REGISTRY["gmail"];
+    const url = descriptor?.oauth?.buildAuthorizeUrl({
+      callbackUrl: "https://bench.example.com/callback",
+      state: "state-1",
+      codeChallenge: "challenge-1",
+      clientId: "client-1",
+    });
+    if (url === undefined) throw new Error("no authorize url");
+    expect(url.origin).toBe("https://accounts.google.com");
+    expect(url.searchParams.get("client_id")).toBe("client-1");
+    expect(url.searchParams.get("redirect_uri")).toBe(
+      "https://bench.example.com/callback",
+    );
+    expect(url.searchParams.get("response_type")).toBe("code");
+    expect(url.searchParams.get("scope")).toContain("gmail");
+    expect(url.searchParams.get("state")).toBe("state-1");
+    expect(url.searchParams.get("access_type")).toBe("offline");
+    expect(url.searchParams.get("code_challenge")).toBe("challenge-1");
+    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
+  });
+});
+
+describe("MCP_PRESETS", () => {
+  test("lists only verified zero-configuration remote MCP servers", () => {
+    const slugs = MCP_PRESETS.map((preset) => preset.slug).sort();
+    expect(slugs).toEqual(
+      [
+        "attio",
+        "canva",
+        "exa",
+        "github-mcp",
+        "granola",
+        "linear",
+        "notion",
+        "posthog",
+        "railway",
+        "sentry",
+        "sumble",
+      ].sort(),
+    );
+    for (const preset of MCP_PRESETS) {
+      expect(() => new URL(preset.url)).not.toThrow();
+      expect(preset.url.startsWith("https://")).toBe(true);
+    }
+  });
+
+  test("Exa is keyless, GitHub MCP is token, every other preset uses OAuth", () => {
+    expect(mcpPresetBySlug(MCP_PRESETS, "exa")?.connectionMode).toBe("keyless");
+    expect(mcpPresetBySlug(MCP_PRESETS, "github-mcp")?.connectionMode).toBe(
+      "token",
+    );
+    for (const preset of MCP_PRESETS) {
+      if (preset.slug === "exa" || preset.slug === "github-mcp") continue;
+      expect(preset.connectionMode).toBe("oauth");
+    }
+  });
+
+  test("GitHub MCP is a token preset that never shadows the github connector", () => {
+    const preset = mcpPresetBySlug(MCP_PRESETS, "github-mcp");
+    expect(preset?.displayName).toBe("GitHub MCP");
+    expect(preset?.url).toBe("https://api.githubcopilot.com/mcp/");
+    // GitHub's MCP server accepts a personal access token as a bearer but
+    // offers no dynamic client registration, so OAuth can't complete here.
+    expect(preset?.connectionMode).toBe("token");
+    expect(preset?.docsUrl).toBe("https://github.com/settings/tokens");
+    expect(preset?.tokenSteps?.length).toBeGreaterThanOrEqual(2);
+    // The native `github` REST connector (PAT/OAuth-App) stays its own
+    // card: no nativeConnectorId hides it, and neither "github" the slug
+    // nor "GitHub" the display name resolves to this preset.
+    expect(preset?.nativeConnectorId).toBeUndefined();
+    expect(CONNECTOR_REGISTRY["github"]).toBeDefined();
+    expect(mcpPresetByName(MCP_PRESETS, "github")).toBeUndefined();
+    expect(mcpPresetByName(MCP_PRESETS, "GitHub")).toBeUndefined();
+    expect(mcpPresetByName(MCP_PRESETS, "github mcp")?.slug).toBe("github-mcp");
+  });
+
+  test("uses Sumble's OAuth MCP host, not its product-page URL", () => {
+    expect(mcpPresetBySlug(MCP_PRESETS, "sumble")?.url).toBe(
+      "https://mcp.sumble.com/",
+    );
+    expect(mcpPresetBySlug(MCP_PRESETS, "sumble")?.connectionMode).toBe(
+      "oauth",
+    );
+  });
+
+  test("keeps every verified endpoint exact", () => {
+    expect(
+      Object.fromEntries(
+        MCP_PRESETS.map((preset) => [preset.slug, preset.url]),
+      ),
+    ).toEqual({
+      granola: "https://mcp.granola.ai/mcp",
+      exa: "https://mcp.exa.ai/mcp",
+      "github-mcp": "https://api.githubcopilot.com/mcp/",
+      linear: "https://mcp.linear.app/mcp",
+      notion: "https://mcp.notion.com/mcp",
+      sentry: "https://mcp.sentry.dev/mcp",
+      attio: "https://mcp.attio.com/mcp",
+      railway: "https://mcp.railway.com",
+      posthog: "https://mcp.posthog.com/mcp",
+      sumble: "https://mcp.sumble.com/",
+      canva: "https://mcp.canva.com/mcp",
+    });
+  });
+
+  test("every preset's nativeConnectorId names a real registry entry", () => {
+    for (const preset of MCP_PRESETS) {
+      if (preset.nativeConnectorId === undefined) continue;
+      expect(CONNECTOR_REGISTRY[preset.nativeConnectorId]).toBeDefined();
+    }
+  });
+
+  test("MCP_PRESET_CONNECTOR_IDS matches the presets' native ids", () => {
+    expect(new Set(MCP_PRESET_CONNECTOR_IDS)).toEqual(
+      new Set(["granola", "exa", "linear"]),
+    );
+  });
+
+  test("mcpPresetByName resolves by slug or display name, case-insensitively", () => {
+    expect(mcpPresetByName(MCP_PRESETS, "Exa")?.slug).toBe("exa");
+    expect(mcpPresetByName(MCP_PRESETS, "EXA")?.slug).toBe("exa");
+    expect(mcpPresetByName(MCP_PRESETS, "granola")?.slug).toBe("granola");
+    expect(mcpPresetByName(MCP_PRESETS, "nope")).toBeUndefined();
+  });
+
+  test("mcpPresetBySlug returns undefined for an unknown slug", () => {
+    expect(mcpPresetBySlug(MCP_PRESETS, "not-a-preset")).toBeUndefined();
+  });
+
+  test("Canva is a DCR-verified OAuth preset with no simple-icons mark yet", () => {
+    expect(mcpPresetBySlug(MCP_PRESETS, "canva")?.connectionMode).toBe("oauth");
+    expect(mcpPresetBySlug(MCP_PRESETS, "canva")?.icon).toBeUndefined();
+  });
+
+  test("Canva lists the 16 live PRM OAuth scopes; other presets omit oauthScopes", () => {
+    expect(mcpPresetBySlug(MCP_PRESETS, "canva")?.oauthScopes).toEqual([
+      "profile:read",
+      "design:meta:read",
+      "design:content:write",
+      "design:content:read",
+      "folder:read",
+      "folder:write",
+      "brandtemplate:content:read",
+      "brandtemplate:meta:read",
+      "brandtemplate:content:write",
+      "comment:write",
+      "comment:read",
+      "asset:read",
+      "asset:write",
+      "brandkit:read",
+      "help:answers:read",
+      "help:answers:write",
+    ]);
+    for (const preset of MCP_PRESETS) {
+      if (preset.slug === "canva") continue;
+      expect("oauthScopes" in preset).toBe(false);
+    }
+  });
+});
diff --git a/packages/connections/src/registry.ts b/packages/connections/src/registry.ts
index 0c0ffe4761..051bcf6615 100644
--- a/packages/connections/src/registry.ts
+++ b/packages/connections/src/registry.ts
@@ -1,13 +1,18 @@
-// The browser-safe half of the Connections surface: the connector
-// descriptor shape and the generic helpers a caller needs to work with a
-// registry built from it. This package no longer bakes in any concrete
-// connector set — CL-7384 moved every actual descriptor (GitHub, Gmail,
-// Hugging Face, OpenRouter, the inference providers, ...) out to
-// `templates/connectors.ts`, the product-data package a build supplies.
-// A caller builds its own registry with `createConnectorRegistry` and
-// passes it into every route factory that needs one — never a default
-// baked in here, which would be exactly the fallback this package's
-// callers are told never to leave lying around.
+// The connector registry: the descriptor shape, the generic helpers a
+// caller needs to work with a registry built from it, and Workbench's
+// product-supplied connector set — every api-key connector this build
+// actually ships (inference providers plus tool-credential connectors).
+// CL-8156 folded the concrete set back in here from
+// `templates/connectors.ts` (CL-7384 had split it out) now that
+// `@workbench/templates` no longer exists to own it: a caller (the hub,
+// the web app) imports `CONNECTOR_REGISTRY` from this module and passes
+// it into the route factories that need one.
+//
+// The eight non-OAuth inference providers come straight from
+// `PROVIDER_TEST_CONFIG` — the one source of provider metadata,
+// re-exported here rather than duplicated. OpenRouter and Hugging Face
+// are the two OAuth inference providers, wired below through the same
+// `oauth` config shape `oauth-routes.ts` reads.
 export {
   missingCredentialDetail,
   parseMissingCredentialDetail,
@@ -20,12 +25,81 @@ export type {
   OAuthExchangeResult,
 } from "./descriptor";
 import type { ConnectorDescriptor } from "./descriptor";
+import {
+  OLLAMA_PLACEHOLDER_SECRET,
+  PROVIDER_TEST_CONFIG,
+  testProviderCredential,
+  type SupportedCredentialProvider,
+} from "./credential-test";
+import {
+  exchangeCodeForToken,
+  HUGGINGFACE_AUTHORIZE_URL,
+  HUGGINGFACE_SCOPE,
+} from "./huggingface-connect";
+import {
+  exchangeCodeForGoogleToken,
+  GMAIL_SCOPE,
+  GOOGLE_AUTHORIZE_URL,
+} from "./gmail-connect";
+// simple-icons ships one brand per named export, tree-shaken by any bundler
+// that respects its `sideEffects: false` — importing only the brands this
+// registry actually has a listing for pulls in only those icons' data, not
+// the whole ~3000-brand package (CC0-1.0 licensed — see the package's own
+// LICENSE — so redistributing these marks needs no separate clearance).
+// Granola and ScrapeCreators have no simple-icons listing (CL-6215's
+// plugins-directory rebuild); OpenAI, xAI, Groq, and Opencode Zen have none
+// either (CL-6258's connections logos) — those descriptors carry no `icon`,
+// so a caller renders their monochrome initial tile instead. Exa publishes
+// its own mark in its official brand kit, used below. Google's mark
+// here is Gemini's, not the generic Google "G" — the model brand a person
+// actually recognizes from connecting an AI provider, matching
+// models.dev's own convention for this row.
+import {
+  siAnthropic,
+  siDeepseek,
+  siGithub,
+  siGmail,
+  siGooglegemini,
+  siHuggingface,
+  siLinear,
+  siMistralai,
+  siOllama,
+  siOpenrouter,
+} from "simple-icons";
+import {
+  CODEX_AUTHORIZE_EXTRA_PARAMS,
+  CODEX_AUTHORIZE_URL,
+  CODEX_CLIENT_ID,
+  CODEX_REDIRECT_URI,
+  CODEX_SCOPES,
+  CODEX_TOKEN_URL,
+} from "@corbits/codex-provider/constants";
+import {
+  XAI_AUTHORIZE_URL,
+  XAI_CLIENT_ID,
+  XAI_REDIRECT_URI,
+  XAI_SCOPES,
+  XAI_TOKEN_URL,
+} from "@corbits/xai-provider/constants";
+import { exchangeCodeForKey, OPENROUTER_AUTH_URL } from "./openrouter-connect";
+import {
+  exchangeCodeForGithubToken,
+  GITHUB_AUTHORIZE_URL,
+} from "./github-connect";
+import {
+  testExaCredential,
+  testGitHubCredential,
+  testGranolaCredential,
+  testLinearCredential,
+  testManusCredential,
+  testScrapeCreatorsCredential,
+} from "./probes";
 
 export type ConnectorRegistry = Readonly<Record<string, ConnectorDescriptor>>;
 
 /** Identity function with a name — lets a caller building its own
- * connector set (e.g. `templates/connectors.ts`) get `ConnectorRegistry`'s
- * type checking on the literal without importing the type by hand. */
+ * connector set get `ConnectorRegistry`'s type checking on the literal
+ * without importing the type by hand. */
 export function createConnectorRegistry(
   connectors: Readonly<Record<string, ConnectorDescriptor>>,
 ): ConnectorRegistry {
@@ -37,3 +111,597 @@ export function connectorDescriptors(
 ): readonly ConnectorDescriptor[] {
   return Object.values(registry);
 }
+
+// Decodes the ChatGPT account id out of a Codex id_token (a JWT payload
+// claim), mirroring `@corbits/codex-provider`'s `accountIdFromIdToken`
+// without pulling that package (and its oauth-core dependency graph) into
+// this browser-shipped registry. Undefined on any malformed input — the
+// account id is a label, never a gate.
+function chatgptAccountIdFromIdToken(idToken: string): string | undefined {
+  const payload = idToken.split(".")[1];
+  if (payload === undefined) return undefined;
+  let claims: Record<string, unknown>;
+  try {
+    const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
+    claims = JSON.parse(
+      atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "=")),
+    ) as Record<string, unknown>;
+  } catch {
+    // report-error-ignore: a malformed id_token payload degrades to "no
+    // account id", never an incident.
+    return undefined;
+  }
+  if (typeof claims.chatgpt_account_id === "string") {
+    return claims.chatgpt_account_id;
+  }
+  const auth: unknown = claims["https://api.openai.com/auth"];
+  if (
+    typeof auth === "object" &&
+    auth !== null &&
+    "chatgpt_account_id" in auth
+  ) {
+    const nested = auth.chatgpt_account_id;
+    if (typeof nested === "string") return nested;
+  }
+  return undefined;
+}
+
+const INFERENCE_PROVIDER_DOCS_URL: Readonly<
+  Record<SupportedCredentialProvider, string>
+> = {
+  anthropic: "https://console.anthropic.com/settings/keys",
+  openai: "https://platform.openai.com/api-keys",
+  "google-genai": "https://aistudio.google.com/apikey",
+  xai: "https://console.x.ai",
+  "xai-oauth": "https://x.ai",
+  codex: "https://developers.openai.com/codex",
+  "opencode-zen": "https://opencode.ai/zen",
+  groq: "https://console.groq.com/keys",
+  deepseek: "https://platform.deepseek.com/api_keys",
+  mistral: "https://console.mistral.ai/api-keys",
+  openrouter: "https://openrouter.ai",
+  huggingface: "https://huggingface.co/settings/tokens",
+  ollama: "https://ollama.com",
+};
+
+// Ollama's onboarding URL field default — the local-machine origin
+// Ollama listens on out of the box, before anyone points it at a
+// tailscale-tunneled or otherwise remote instance.
+const OLLAMA_DEFAULT_URL = "http://localhost:11434";
+
+const EXA_ICON = {
+  path: "M150.5 14.1064C150.5 14.3356 150.421 14.5579 150.277 14.736L88.4766 91 150.277 167.264C150.421 167.442 150.5 167.664 150.5 167.894V181C150.5 181.552 150.052 182 149.5 182H1C0.44772 182 0 181.552 0 181V0.999995C0 0.44771 0.447715 0 1 0H149.5C150.052 0 150.5 0.447715 150.5 1V14.1064ZM30.4059 162.719H121.728L76.0664 106.326 30.4059 162.719ZM19.2949 100.261V145.787L56.1572 100.261H19.2949ZM19.2949 80.9801H55.5434L19.2949 36.2121V80.9801ZM76.0664 75.6731L121.728 19.281H30.4059L76.0664 75.6731Z",
+  hex: "0143D9",
+  viewBox: "0 0 151 182",
+} as const;
+
+// Every inference provider with a simple-icons listing. OpenAI, xAI, Groq,
+// and Opencode Zen have none as of simple-icons' current release; those
+// four fall through to the monochrome initial tile every iconless
+// descriptor already gets.
+const INFERENCE_PROVIDER_ICONS: Partial<
+  Record<
+    SupportedCredentialProvider,
+    { readonly path: string; readonly hex: string }
+  >
+> = {
+  anthropic: { path: siAnthropic.path, hex: siAnthropic.hex },
+  "google-genai": { path: siGooglegemini.path, hex: siGooglegemini.hex },
+  deepseek: { path: siDeepseek.path, hex: siDeepseek.hex },
+  mistral: { path: siMistralai.path, hex: siMistralai.hex },
+  ollama: { path: siOllama.path, hex: siOllama.hex },
+  openrouter: { path: siOpenrouter.path, hex: siOpenrouter.hex },
+  huggingface: { path: siHuggingface.path, hex: siHuggingface.hex },
+};
+
+function inferenceProviderDescriptors(): Record<string, ConnectorDescriptor> {
+  const entries: Record<string, ConnectorDescriptor> = {};
+  for (const [id, config] of Object.entries(PROVIDER_TEST_CONFIG)) {
+    if (id === "openrouter" || id === "huggingface") continue;
+    if (id === "codex" || id === "xai-oauth") continue;
+    const providerId = id as SupportedCredentialProvider;
+    // Ollama collects a URL, not a secret — it has no auth layer at all
+    // (see `credential-test.ts`'s own `ollama` config entry). Every
+    // other connector's single form field is a real key, probed and
+    // stored as-is.
+    const icon = INFERENCE_PROVIDER_ICONS[providerId];
+    entries[id] =
+      providerId === "ollama"
+        ? {
+            id,
+            displayName: config.displayName,
+            authKind: "api-key",
+            credentialPlugin: "http",
+            docsUrl: INFERENCE_PROVIDER_DOCS_URL[providerId],
+            feedsTools: [],
+            credentialInputKind: "url",
+            credentialPlaceholder: OLLAMA_DEFAULT_URL,
+            probe: (baseURL) =>
+              testProviderCredential({
+                provider: providerId,
+                apiKey: OLLAMA_PLACEHOLDER_SECRET,
+                baseURL,
+              }),
+            ...(icon !== undefined ? { icon } : {}),
+          }
+        : {
+            id,
+            displayName: config.displayName,
+            authKind: "api-key",
+            credentialPlugin: "http",
+            docsUrl: INFERENCE_PROVIDER_DOCS_URL[providerId],
+            feedsTools: [],
+            probe: (apiKey) =>
+              testProviderCredential({ provider: providerId, apiKey }),
+            ...(icon !== undefined ? { icon } : {}),
+          };
+  }
+  entries["openrouter"] = {
+    id: "openrouter",
+    displayName: PROVIDER_TEST_CONFIG.openrouter.displayName,
+    authKind: "oauth-pkce",
+    credentialPlugin: "http",
+    docsUrl: INFERENCE_PROVIDER_DOCS_URL.openrouter,
+    feedsTools: [],
+    icon: { path: siOpenrouter.path, hex: siOpenrouter.hex },
+    oauth: {
+      authorizeUrl: OPENROUTER_AUTH_URL,
+      usesPKCE: true,
+      // OpenRouter round-trips its state purely via the connect cookie;
+      // it never echoes `state` back as a callback query param.
+      echoesState: false,
+      deploysDefaultWorkflows: true,
+      buildAuthorizeUrl: ({ callbackUrl, codeChallenge }) => {
+        const url = new URL(OPENROUTER_AUTH_URL);
+        url.searchParams.set("callback_url", callbackUrl);
+        if (codeChallenge !== undefined) {
+          url.searchParams.set("code_challenge", codeChallenge);
+        }
+        url.searchParams.set("code_challenge_method", "S256");
+        return url;
+      },
+      exchange: async ({ code, codeVerifier }) => {
+        const result = await exchangeCodeForKey({
+          code,
+          codeVerifier: codeVerifier ?? "",
+        });
+        return result.ok ? { ok: true, apiKey: result.key } : result;
+      },
+    },
+  };
+  entries["huggingface"] = {
+    id: "huggingface",
+    displayName: PROVIDER_TEST_CONFIG.huggingface.displayName,
+    authKind: "oauth-pkce",
+    credentialPlugin: "http",
+    docsUrl: INFERENCE_PROVIDER_DOCS_URL.huggingface,
+    feedsTools: [],
+    icon: { path: siHuggingface.path, hex: siHuggingface.hex },
+    oauth: {
+      authorizeUrl: HUGGINGFACE_AUTHORIZE_URL,
+      usesPKCE: true,
+      // HF echoes `state` back in the callback query — the belt-and-
+      // suspenders check `oauth-routes.ts` runs before consulting the
+      // state store at all.
+      echoesState: true,
+      deploysDefaultWorkflows: true,
+      // No client secret (a public app); the flow is disabled with a
+      // `not_configured` outcome when this key is absent from the env
+      // bag rather than round-tripping a doomed request.
+      clientId: (env) => env["huggingfaceClientId"],
+      buildAuthorizeUrl: ({ callbackUrl, state, codeChallenge, clientId }) => {
+        const url = new URL(HUGGINGFACE_AUTHORIZE_URL);
+        if (clientId !== undefined) url.searchParams.set("client_id", clientId);
+        url.searchParams.set("redirect_uri", callbackUrl);
+        url.searchParams.set("scope", HUGGINGFACE_SCOPE);
+        url.searchParams.set("state", state);
+        if (codeChallenge !== undefined) {
+          url.searchParams.set("code_challenge", codeChallenge);
+        }
+        url.searchParams.set("code_challenge_method", "S256");
+        return url;
+      },
+      exchange: async ({ code, codeVerifier, redirectUri, clientId }) => {
+        if (clientId === undefined) {
+          return {
+            ok: false,
+            message: "huggingface connect is not configured",
+          };
+        }
+        const result = await exchangeCodeForToken({
+          code,
+          codeVerifier: codeVerifier ?? "",
+          redirectUri,
+          clientId,
+        });
+        if (!result.ok) return result;
+        return result.expiresAt !== undefined
+          ? {
+              ok: true,
+              apiKey: result.accessToken,
+              expiresAt: result.expiresAt,
+            }
+          : { ok: true, apiKey: result.accessToken };
+      },
+    },
+  };
+  // The two loopback OAuth providers (CL-7510). Their authorization
+  // servers only accept the fixed `http://localhost:<port>` redirect URI
+  // the provider's own CLI registers (`authKind: "oauth-loopback"`), so
+  // `buildAuthorizeUrl` ignores the hub callback URL the generic
+  // mechanics would pass and pins the provider's own redirect instead.
+  // Every endpoint, client id, and scope list come from the provider
+  // packages' own constants subpath (browser-safe, pure data — the
+  // exchange closures stay plain `fetch` so the registry can ship in the
+  // web bundle), so the descriptor can never drift from the values the
+  // adapter's own refresh path uses.
+  entries["codex"] = {
+    id: "codex",
+    displayName: PROVIDER_TEST_CONFIG.codex.displayName,
+    authKind: "oauth-loopback",
+    credentialPlugin: "http",
+    docsUrl: INFERENCE_PROVIDER_DOCS_URL.codex,
+    feedsTools: [],
+    oauth: {
+      authorizeUrl: CODEX_AUTHORIZE_URL,
+      usesPKCE: true,
+      echoesState: true,
+      deploysDefaultWorkflows: true,
+      clientId: () => CODEX_CLIENT_ID,
+      buildAuthorizeUrl: ({ state, codeChallenge, clientId }) => {
+        const url = new URL(CODEX_AUTHORIZE_URL);
+        url.searchParams.set("client_id", clientId ?? CODEX_CLIENT_ID);
+        url.searchParams.set("redirect_uri", CODEX_REDIRECT_URI);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("scope", CODEX_SCOPES.join(" "));
+        url.searchParams.set("state", state);
+        if (codeChallenge !== undefined) {
+          url.searchParams.set("code_challenge", codeChallenge);
+        }
+        url.searchParams.set("code_challenge_method", "S256");
+        for (const [name, value] of Object.entries(
+          CODEX_AUTHORIZE_EXTRA_PARAMS,
+        )) {
+          url.searchParams.set(name, value);
+        }
+        return url;
+      },
+      exchange: async ({ code, codeVerifier }) => {
+        try {
+          const response = await fetch(CODEX_TOKEN_URL, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            signal: AbortSignal.timeout(15_000),
+            body: new URLSearchParams({
+              grant_type: "authorization_code",
+              code,
+              code_verifier: codeVerifier ?? "",
+              client_id: CODEX_CLIENT_ID,
+              redirect_uri: CODEX_REDIRECT_URI,
+            }).toString(),
+          });
+          if (!response.ok) {
+            return {
+              ok: false,
+              message: `Codex rejected the login (status ${response.status})`,
+            };
+          }
+          const tokens = (await response.json()) as {
+            access_token?: unknown;
+            refresh_token?: unknown;
+            expires_in?: unknown;
+            id_token?: unknown;
+          };
+          if (typeof tokens.access_token !== "string") {
+            return { ok: false, message: "Codex returned no access token" };
+          }
+          const accountId =
+            typeof tokens.id_token === "string"
+              ? chatgptAccountIdFromIdToken(tokens.id_token)
+              : undefined;
+          return {
+            ok: true,
+            apiKey: tokens.access_token,
+            ...(typeof tokens.refresh_token === "string"
+              ? { refreshToken: tokens.refresh_token }
+              : {}),
+            ...(typeof tokens.expires_in === "number"
+              ? {
+                  expiresAt: new Date(
+                    Date.now() + tokens.expires_in * 1000,
+                  ).toISOString(),
+                }
+              : {}),
+            ...(accountId !== undefined ? { accountId } : {}),
+          };
+        } catch (cause) {
+          // report-error-ignore: a failed Codex exchange is surfaced to
+          // the caller in the returned message, never an incident.
+          return {
+            ok: false,
+            message: `Codex token exchange failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+          };
+        }
+      },
+    },
+  };
+  entries["xai-oauth"] = {
+    id: "xai-oauth",
+    displayName: PROVIDER_TEST_CONFIG["xai-oauth"].displayName,
+    authKind: "oauth-loopback",
+    credentialPlugin: "http",
+    docsUrl: INFERENCE_PROVIDER_DOCS_URL["xai-oauth"],
+    feedsTools: [],
+    oauth: {
+      authorizeUrl: XAI_AUTHORIZE_URL,
+      usesPKCE: true,
+      echoesState: true,
+      deploysDefaultWorkflows: true,
+      clientId: () => XAI_CLIENT_ID,
+      buildAuthorizeUrl: ({ state, codeChallenge, clientId }) => {
+        const url = new URL(XAI_AUTHORIZE_URL);
+        url.searchParams.set("client_id", clientId ?? XAI_CLIENT_ID);
+        url.searchParams.set("redirect_uri", XAI_REDIRECT_URI);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("scope", XAI_SCOPES.join(" "));
+        url.searchParams.set("state", state);
+        if (codeChallenge !== undefined) {
+          url.searchParams.set("code_challenge", codeChallenge);
+        }
+        url.searchParams.set("code_challenge_method", "S256");
+        return url;
+      },
+      exchange: async ({ code, codeVerifier }) => {
+        try {
+          const response = await fetch(XAI_TOKEN_URL, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            signal: AbortSignal.timeout(15_000),
+            body: new URLSearchParams({
+              grant_type: "authorization_code",
+              code,
+              code_verifier: codeVerifier ?? "",
+              client_id: XAI_CLIENT_ID,
+              redirect_uri: XAI_REDIRECT_URI,
+            }).toString(),
+          });
+          if (!response.ok) {
+            return {
+              ok: false,
+              message: `xAI rejected the login (status ${response.status})`,
+            };
+          }
+          const tokens = (await response.json()) as {
+            access_token?: unknown;
+            refresh_token?: unknown;
+            expires_in?: unknown;
+          };
+          if (typeof tokens.access_token !== "string") {
+            return { ok: false, message: "xAI returned no access token" };
+          }
+          return {
+            ok: true,
+            apiKey: tokens.access_token,
+            ...(typeof tokens.refresh_token === "string"
+              ? { refreshToken: tokens.refresh_token }
+              : {}),
+            ...(typeof tokens.expires_in === "number"
+              ? {
+                  expiresAt: new Date(
+                    Date.now() + tokens.expires_in * 1000,
+                  ).toISOString(),
+                }
+              : {}),
+          };
+        } catch (cause) {
+          // report-error-ignore: a failed xAI exchange is surfaced to
+          // the caller in the returned message, never an incident.
+          return {
+            ok: false,
+            message: `xAI token exchange failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+          };
+        }
+      },
+    },
+  };
+  return entries;
+}
+
+export const CONNECTOR_REGISTRY: ConnectorRegistry = createConnectorRegistry({
+  ...inferenceProviderDescriptors(),
+  granola: {
+    id: "granola",
+    credentialPlugin: "http",
+    displayName: "Granola",
+    authKind: "api-key",
+    docsUrl: "https://www.granola.ai",
+    feedsTools: ["@corbits/granola-tools"],
+    probe: (apiKey) => testGranolaCredential(apiKey),
+    description: "Pull meeting notes and transcripts into your agents.",
+  },
+  manus: {
+    id: "manus",
+    credentialPlugin: "http-x-manus-api-key",
+    displayName: "Manus",
+    authKind: "api-key",
+    docsUrl: "https://open.manus.ai/docs/v2/introduction",
+    feedsTools: ["@corbits/manus-tools"],
+    probe: (apiKey) => testManusCredential(apiKey),
+    description:
+      "Have Manus run tasks and produce files — including slide decks.",
+  },
+  exa: {
+    id: "exa",
+    // Exa authenticates via an `x-api-key` header, not `authorization` —
+    // the `http` (Bearer) plugin doesn't fit; see the `http-x-api-key`
+    // provider in `@corbits/credential-providers`.
+    credentialPlugin: "http-x-api-key",
+    displayName: "Exa",
+    authKind: "api-key",
+    docsUrl: "https://exa.ai",
+    feedsTools: ["@corbits/web-search-tools"],
+    probe: (apiKey) => testExaCredential(apiKey),
+    description: "Neural web search built for agents.",
+    icon: EXA_ICON,
+  },
+  scrapecreators: {
+    id: "scrapecreators",
+    // ScrapeCreators, same as Exa, authenticates via `x-api-key`.
+    credentialPlugin: "http-x-api-key",
+    displayName: "ScrapeCreators",
+    authKind: "api-key",
+    docsUrl: "https://scrapecreators.com",
+    feedsTools: ["@corbits/reddit-tools"],
+    probe: (apiKey) => testScrapeCreatorsCredential(apiKey),
+    description: "Read Reddit threads and comments.",
+  },
+  linear: {
+    id: "linear",
+    credentialPlugin: "http-raw-authorization",
+    displayName: "Linear",
+    authKind: "api-key",
+    docsUrl: "https://linear.app/settings/api",
+    feedsTools: ["@corbits/linear-tools"],
+    probe: (apiKey) => testLinearCredential(apiKey),
+    description: "Read and write issues, projects, and comments.",
+    icon: { path: siLinear.path, hex: siLinear.hex },
+  },
+  gmail: {
+    id: "gmail",
+    displayName: "Gmail",
+    // Pure hosted-app OAuth — there is no Gmail equivalent of a PAT
+    // to paste, so unlike `github` below this connector has no
+    // api-key arm: unconfigured (`GMAIL_CLIENT_ID`/`GMAIL_CLIENT_SECRET`
+    // unset) means the card renders "not configured", never a dead
+    // paste form. The exchanged access token expires in about an
+    // hour; the refresh token rides `OAuthExchangeResult.refreshToken`
+    // into the credential row's `refreshSecret` so a refresh sweep
+    // can keep the connection alive.
+    authKind: "oauth-code",
+    credentialPlugin: "http",
+    docsUrl: "https://developers.google.com/gmail/api",
+    feedsTools: [],
+    description: "Read, draft, and send email — sending waits for your ok.",
+    icon: { path: siGmail.path, hex: siGmail.hex },
+    oauth: {
+      authorizeUrl: GOOGLE_AUTHORIZE_URL,
+      usesPKCE: true,
+      echoesState: true,
+      deploysDefaultWorkflows: false,
+      clientId: (env) => env["gmailClientId"],
+      clientSecret: (env) => env["gmailClientSecret"],
+      buildAuthorizeUrl: ({ callbackUrl, state, codeChallenge, clientId }) => {
+        const url = new URL(GOOGLE_AUTHORIZE_URL);
+        if (clientId !== undefined) url.searchParams.set("client_id", clientId);
+        url.searchParams.set("redirect_uri", callbackUrl);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("scope", GMAIL_SCOPE);
+        url.searchParams.set("state", state);
+        // `offline` + forced consent is what makes Google issue a
+        // refresh token at all — without both, a re-connect silently
+        // returns only another one-hour access token.
+        url.searchParams.set("access_type", "offline");
+        url.searchParams.set("prompt", "consent");
+        if (codeChallenge !== undefined) {
+          url.searchParams.set("code_challenge", codeChallenge);
+          url.searchParams.set("code_challenge_method", "S256");
+        }
+        return url;
+      },
+      exchange: async ({
+        code,
+        codeVerifier,
+        redirectUri,
+        clientId,
+        clientSecret,
+      }) => {
+        if (clientId === undefined || clientSecret === undefined) {
+          return {
+            ok: false,
+            message: "gmail connect is not configured",
+          };
+        }
+        return exchangeCodeForGoogleToken({
+          code,
+          ...(codeVerifier !== undefined ? { codeVerifier } : {}),
+          redirectUri,
+          clientId,
+          clientSecret,
+        });
+      },
+    },
+  },
+  github: {
+    id: "github",
+    // GitHub's REST API accepts a fine-grained PAT — or a GitHub OAuth
+    // App user token, which is the same Bearer shape — as a Bearer
+    // token. Absent entirely, github-tools degrades to a lower
+    // unauthenticated rate limit rather than "not connected" — see its
+    // tool.ts. `authKind` stays "api-key" (the PAT paste form is
+    // always available, CL-6386's guaranteed fallback); the `oauth`
+    // config below is this connector's one exception to "oauth fields
+    // are oauth-pkce/oauth-code only" — a caller checks
+    // `GET /oauth-configured`'s `github` entry to decide whether to
+    // offer the one-click app connect ahead of the paste form, never
+    // the other way around, so an unconfigured deploy never dead-ends.
+    credentialPlugin: "http",
+    displayName: "GitHub",
+    authKind: "api-key",
+    docsUrl: "https://github.com/settings/tokens",
+    feedsTools: ["@corbits/github-tools"],
+    probe: (apiKey, opts) =>
+      testGitHubCredential(apiKey, undefined, opts?.baseUrl),
+    description: "Read repos, issues, and pull requests.",
+    icon: { path: siGithub.path, hex: siGithub.hex },
+    oauth: {
+      authorizeUrl: GITHUB_AUTHORIZE_URL,
+      usesPKCE: false,
+      echoesState: true,
+      deploysDefaultWorkflows: false,
+      clientId: (env) => env["githubAppClientId"],
+      clientSecret: (env) => env["githubAppClientSecret"],
+      buildAuthorizeUrl: ({ callbackUrl, state, clientId }) => {
+        const url = new URL(GITHUB_AUTHORIZE_URL);
+        if (clientId !== undefined) url.searchParams.set("client_id", clientId);
+        url.searchParams.set("redirect_uri", callbackUrl);
+        url.searchParams.set("scope", "repo");
+        url.searchParams.set("state", state);
+        return url;
+      },
+      exchange: async ({ code, redirectUri, clientId, clientSecret }) => {
+        if (clientId === undefined || clientSecret === undefined) {
+          return {
+            ok: false,
+            message: "github app connect is not configured",
+          };
+        }
+        const result = await exchangeCodeForGithubToken({
+          code,
+          redirectUri,
+          clientId,
+          clientSecret,
+        });
+        return result.ok ? { ok: true, apiKey: result.key } : result;
+      },
+    },
+  },
+  "granola-webhook": {
+    id: "granola-webhook",
+    // No credential-provider plugin mediates this connector's secret —
+    // it is minted and encrypted entirely inside
+    // `@corbits/webhook-triggers` (see `management-routes.ts`), never
+    // stored as a Credential row. `credentialPlugin` still has to name
+    // something (`ConnectorDescriptor` requires it uniformly); `http`
+    // is inert here, kept only so registry-wide invariants (every
+    // non-bearer connector reads `http`) hold without a special case.
+    credentialPlugin: "http",
+    displayName: "Granola inbound webhook",
+    authKind: "webhook-secret",
+    docsUrl: "https://www.granola.ai",
+    // The direction is inverted from the `granola` api-key connector
+    // above: this issues a signed inbound address for Granola to call,
+    // feeding nothing — a routine's webhook trigger binding, not a
+    // tool package's credential handle.
+    feedsTools: [],
+  },
+});

From 625b9979e9cb081ce2acf28e514e26bda1a8f6e6 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Thu, 17 Sep 2026 10:23:59 -0700
Subject: [PATCH 2/8] feat(hub)!: rename template-blocks deploy route to
 catalog-blocks

The on-demand workflow-deploy route under apps/hub/src/templates/ was
never actually workbench-template-specific (CL-7073 generalized it to
any workflows/* package) -- the routines page's "Available" section
drives it independently of workbench templates. Rename the module and
its mount out of the deleted templates/ naming: createTemplateBlockRoutes
-> createCatalogBlockRoutes, POST /template-blocks/:assetName/deploy ->
POST /catalog-blocks/:assetName/deploy.

Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
---
 .../block-workflows.ts                        |  2 +-
 .../catalog-block-routes.test.ts}             | 16 ++++-----
 .../catalog-block-routes.ts}                  | 35 +++++++++++--------
 .../catalog-blocks.test.ts                    |  2 +-
 .../catalog-blocks.ts                         | 22 ++++++------
 apps/hub/src/index.ts                         | 28 +++++++--------
 6 files changed, 54 insertions(+), 51 deletions(-)
 rename apps/hub/src/{templates => catalog-blocks}/block-workflows.ts (97%)
 rename apps/hub/src/{templates/template-block-routes.test.ts => catalog-blocks/catalog-block-routes.test.ts} (94%)
 rename apps/hub/src/{templates/template-block-routes.ts => catalog-blocks/catalog-block-routes.ts} (69%)
 rename apps/hub/src/{templates => catalog-blocks}/catalog-blocks.test.ts (97%)
 rename apps/hub/src/{templates => catalog-blocks}/catalog-blocks.ts (93%)

diff --git a/apps/hub/src/templates/block-workflows.ts b/apps/hub/src/catalog-blocks/block-workflows.ts
similarity index 97%
rename from apps/hub/src/templates/block-workflows.ts
rename to apps/hub/src/catalog-blocks/block-workflows.ts
index 743437c255..e72625f7ac 100644
--- a/apps/hub/src/templates/block-workflows.ts
+++ b/apps/hub/src/catalog-blocks/block-workflows.ts
@@ -17,7 +17,7 @@
 //
 // Server-only, on purpose: each `buildJson` closure pulls in its
 // workflow package (e.g. `@corbits/granola-call-workflow`) and with it
-// `@intx/agent`/`@intx/workflow`. Only `./template-block-routes.ts`
+// `@intx/agent`/`@intx/workflow`. Only `./catalog-block-routes.ts`
 // (mounted in `apps/hub`) imports this; it is deliberately not
 // re-exported from the package root.
 import { deployableCatalogBlock } from "./catalog-blocks";
diff --git a/apps/hub/src/templates/template-block-routes.test.ts b/apps/hub/src/catalog-blocks/catalog-block-routes.test.ts
similarity index 94%
rename from apps/hub/src/templates/template-block-routes.test.ts
rename to apps/hub/src/catalog-blocks/catalog-block-routes.test.ts
index 3eb9a160c7..4f5127a22b 100644
--- a/apps/hub/src/templates/template-block-routes.test.ts
+++ b/apps/hub/src/catalog-blocks/catalog-block-routes.test.ts
@@ -1,4 +1,4 @@
-// Exercises `createTemplateBlockRoutes`' HTTP surface through the real
+// Exercises `createCatalogBlockRoutes`' HTTP surface through the real
 // `buildBlockWorkflowSource` builder, mounted the same way
 // `./connect-github-routes.test.ts` mounts its routes: a bare `Hono`
 // with a tenant-injecting middleware, every port a plain fake.
@@ -20,9 +20,9 @@ import type { RequireGrant, TenantEnv } from "@intx/hub-api";
 import { makeErrorEnvelope } from "@corbits/error-sink";
 
 import {
-  createTemplateBlockRoutes,
-  type TemplateBlockRoutesDeps,
-} from "./template-block-routes";
+  createCatalogBlockRoutes,
+  type CatalogBlockRoutesDeps,
+} from "./catalog-block-routes";
 
 const TENANT = {
   id: "tnt_1",
@@ -62,12 +62,12 @@ function mountAs(routes: Hono<TenantEnv>): Hono<TenantEnv> {
 }
 
 type DeployedSource = Parameters<
-  TemplateBlockRoutesDeps["deployWorkflowSource"]
+  CatalogBlockRoutesDeps["deployWorkflowSource"]
 >[0];
 
-function buildApp(overrides: Partial<TemplateBlockRoutesDeps> = {}) {
+function buildApp(overrides: Partial<CatalogBlockRoutesDeps> = {}) {
   const deployed: DeployedSource[] = [];
-  const deps: TemplateBlockRoutesDeps = {
+  const deps: CatalogBlockRoutesDeps = {
     requireGrant: allowAll,
     log: () => {},
     inferencePreferences: async () => [
@@ -79,7 +79,7 @@ function buildApp(overrides: Partial<TemplateBlockRoutesDeps> = {}) {
     },
     ...overrides,
   };
-  return { app: mountAs(createTemplateBlockRoutes(deps)), deployed };
+  return { app: mountAs(createCatalogBlockRoutes(deps)), deployed };
 }
 
 describe("POST /:assetName/deploy", () => {
diff --git a/apps/hub/src/templates/template-block-routes.ts b/apps/hub/src/catalog-blocks/catalog-block-routes.ts
similarity index 69%
rename from apps/hub/src/templates/template-block-routes.ts
rename to apps/hub/src/catalog-blocks/catalog-block-routes.ts
index ca32c3d726..42f2837536 100644
--- a/apps/hub/src/templates/template-block-routes.ts
+++ b/apps/hub/src/catalog-blocks/catalog-block-routes.ts
@@ -1,12 +1,14 @@
-// The instantiate path's block-workflow deploy surface (CL-6405):
-// `instantiateWorkbenchTemplate`'s `deployBlockWorkflow` port binds to
-// `POST /:assetName/deploy` here, the way its `createParticipantAgent`
-// port binds to `POST /agent-definitions`. Mounted per-tenant inside
-// the platform's native tenant middleware, mirroring
-// `./connect-github-routes.ts`: every side effect a host needs — the
-// tenant's default inference preferences, and the actual source-form
-// asset write + `workflow_definition` projection — arrives as an
-// injected port, so `apps/hub` is the only place drizzle and the
+// The on-demand catalog-workflow deploy surface (CL-6405, generalized by
+// CL-7073 to any catalog entry — CL-8156 dropped the "template" naming
+// once workbench template picking was deleted): `POST /:assetName/deploy`
+// deploys a `workflows/<name>` package's block as a real `workflow`-kind
+// asset on the requesting tenant, the same surface the "Available"
+// catalog-workflows section (`apps/web`'s routines page) drives.
+// Mounted per-tenant inside the platform's native tenant middleware,
+// mirroring `./connect-github-routes.ts`: every side effect a host needs
+// — the tenant's default inference preferences, and the actual
+// source-form asset write + `workflow_definition` projection — arrives
+// as an injected port, so `apps/hub` is the only place drizzle and the
 // `AssetService` are touched and this stays testable with plain fakes.
 import { Hono } from "hono";
 import type { RequireGrant, TenantEnv } from "@intx/hub-api";
@@ -18,9 +20,9 @@ import {
 } from "./block-workflows";
 
 const DEPLOY_FAILED_MESSAGE =
-  "Couldn't set up this template's workflow. Try again in a moment.";
+  "Couldn't set up this workflow. Try again in a moment.";
 
-export type TemplateBlockRoutesDeps = {
+export type CatalogBlockRoutesDeps = {
   requireGrant: RequireGrant;
   /** Where a failure's real cause goes — the same CL-6360 idiom
    * `./connect-github-routes.ts` documents: the client sees one honest
@@ -48,8 +50,8 @@ export type TemplateBlockRoutesDeps = {
   }): Promise<{ readonly id: string; readonly created: boolean }>;
 };
 
-export function createTemplateBlockRoutes(
-  deps: TemplateBlockRoutesDeps,
+export function createCatalogBlockRoutes(
+  deps: CatalogBlockRoutesDeps,
 ): Hono<TenantEnv> {
   const app = new Hono<TenantEnv>();
 
@@ -69,7 +71,7 @@ export function createTemplateBlockRoutes(
         return c.json(
           makeErrorEnvelope({
             code: "not_found",
-            userMessage: `"${assetName}" isn't a deployable template workflow.`,
+            userMessage: `"${assetName}" isn't a deployable catalog workflow.`,
           }),
           404,
         );
@@ -88,9 +90,12 @@ export function createTemplateBlockRoutes(
           result.created ? 201 : 200,
         );
       } catch (cause) {
+        // report-error-ignore: the client sees one honest userMessage
+        // below; the real cause goes to deps.log, the same CL-6360 idiom
+        // `./connect-github-routes.ts` documents.
         const message = cause instanceof Error ? cause.message : String(cause);
         deps.log(
-          `template-blocks: deploying "${assetName}" failed for tenant ${tenant.id}: ${message}`,
+          `catalog-blocks: deploying "${assetName}" failed for tenant ${tenant.id}: ${message}`,
         );
         return c.json(
           makeErrorEnvelope({
diff --git a/apps/hub/src/templates/catalog-blocks.test.ts b/apps/hub/src/catalog-blocks/catalog-blocks.test.ts
similarity index 97%
rename from apps/hub/src/templates/catalog-blocks.test.ts
rename to apps/hub/src/catalog-blocks/catalog-blocks.test.ts
index 8df70a615d..b98064333b 100644
--- a/apps/hub/src/templates/catalog-blocks.test.ts
+++ b/apps/hub/src/catalog-blocks/catalog-blocks.test.ts
@@ -1,5 +1,5 @@
 // Pins the hub's native catalog-block adapter (`./catalog-blocks`): the
-// deployable set served by `POST /template-blocks/:assetName/deploy`,
+// deployable set served by `POST /catalog-blocks/:assetName/deploy`,
 // rendered from the `workflows/*` builder packages against
 // `@corbits/workflows` catalog metadata — with zero import from
 // `@workbench/onboarding`.
diff --git a/apps/hub/src/templates/catalog-blocks.ts b/apps/hub/src/catalog-blocks/catalog-blocks.ts
similarity index 93%
rename from apps/hub/src/templates/catalog-blocks.ts
rename to apps/hub/src/catalog-blocks/catalog-blocks.ts
index 19fba4c2f9..1aca86bdc8 100644
--- a/apps/hub/src/templates/catalog-blocks.ts
+++ b/apps/hub/src/catalog-blocks/catalog-blocks.ts
@@ -1,5 +1,5 @@
 // The hub's native catalog-block adapter (CL-8113, hub-zero T2): the
-// deployable set `POST /template-blocks/:assetName/deploy` serves,
+// deployable set `POST /catalog-blocks/:assetName/deploy` serves,
 // composed directly from the `workflows/*` builder packages against
 // `@corbits/workflows` catalog metadata — the same composition
 // `@workbench/onboarding`'s `CATALOG_WORKFLOWS` table wraps, with zero
@@ -9,18 +9,16 @@
 // same as any name outside the catalog entirely.
 //
 // Display names come from the native `WORKFLOW_CATALOG` entry
-// (`@corbits/workflows`, which the legacy template package re-exports its
-// own catalog mirror from), so the labels served here
-// and the catalog's can never drift apart silently. Turn timeouts match
-// the seed table's per-workflow budgets one-for-one: a research turn
-// fans out and writes long-form, a call-transcript pass runs past the
-// shortest catalog steps, everything else runs the conversational
-// default.
+// (`@corbits/workflows`), so the labels served here and the catalog's
+// can never drift apart silently. Turn timeouts match the seed table's
+// per-workflow budgets one-for-one: a research turn fans out and writes
+// long-form, a call-transcript pass runs past the shortest catalog
+// steps, everything else runs the conversational default.
 //
 // Server-only, on purpose: each `buildJson` closure pulls in its
 // workflow package (e.g. `@corbits/granola-call-workflow`) and with it
 // `@intx/agent`/`@intx/workflow`. Only `./block-workflows.ts`
-// (mounted in `apps/hub` through `./template-block-routes.ts`) imports
+// (mounted in `apps/hub` through `./catalog-block-routes.ts`) imports
 // this; it is deliberately not re-exported from the package root.
 import { workflowCatalogEntry } from "@corbits/workflows";
 import {
@@ -103,7 +101,7 @@ export type CatalogBlock = {
   /**
    * Renders the definition's JSON given the tenant's mail domain and the
    * ordered provider/model preferences to deploy against. Takes the bare
-   * preference list so this same function serves the template-block
+   * preference list so this same function serves the catalog-block
    * route's in-process deploy path, which only ever has the tenant's
    * real inference preferences on hand.
    */
@@ -118,7 +116,7 @@ function catalogDisplayName(assetName: string): string {
 }
 
 /**
- * Workflows a tenant can deploy on demand through the template-block
+ * Workflows a tenant can deploy on demand through the catalog-block
  * route: every native catalog entry with a source package under
  * `workflows/<name>`, minus `assistant` (seeded already) and
  * `heartbeat` (test-only). Nothing here reaches a bench until
@@ -293,7 +291,7 @@ export const CATALOG_BLOCK_ASSET_NAMES: readonly string[] = CATALOG_BLOCKS.map(
 );
 
 /**
- * The deployable-through-the-template-block-route entry for one asset
+ * The deployable-through-the-catalog-block-route entry for one asset
  * name, or `undefined` if none exists. `CATALOG_BLOCKS` is the one
  * source of truth for "has a source package under `workflows/<name>`
  * and can be deployed on demand".
diff --git a/apps/hub/src/index.ts b/apps/hub/src/index.ts
index 41a6be3cce..83d03efe59 100644
--- a/apps/hub/src/index.ts
+++ b/apps/hub/src/index.ts
@@ -150,7 +150,6 @@ import {
   createWebhookTriggerRoutes,
   launchWebhookTrigger,
 } from "@corbits/webhook-triggers";
-import { createTemplateBlockRoutes } from "./templates/template-block-routes";
 import {
   createWorkflowDetailRoute,
   createScheduledWorkflowRoutes,
@@ -225,6 +224,7 @@ import {
   DEFAULT_RETURN_PATH_ALLOWLIST,
   listMcpServerConnections,
 } from "@corbits/connections";
+import { createCatalogBlockRoutes } from "./catalog-blocks/catalog-block-routes";
 import type { ServiceConnectedHook } from "@corbits/connections";
 import { CONNECTOR_REGISTRY, MCP_PRESETS } from "./native-connector-registry";
 import {
@@ -2128,16 +2128,16 @@ export async function createHub(config: HubConfig) {
       providerHealth: providerHealthStore,
     }),
   );
-  // Template block workflows (CL-6405, cut over to native deploy in
-  // CL-7364): the instantiate path's `deployBlockWorkflow` port lands
-  // here — the same source-form materialization pattern (asset +
-  // `@corbits/workflows`'s `./source` tree) applied to a template's referenced
-  // block definition (`code-review` today), now deployed through the
-  // same `workflowDeployer` the agent-authored deploy path above uses
-  // rather than a hub-local inert freeze.
+  // On-demand catalog workflow deploy (CL-6405, generalized by CL-7073):
+  // the "Available" catalog-workflows section (`apps/web`'s routines
+  // page) drives this to add any `workflows/*` package on demand, the
+  // same source-form materialization pattern (asset +
+  // `@corbits/workflows`'s `./source` tree) applied through the same
+  // `workflowDeployer` the agent-authored deploy path above uses rather
+  // than a hub-local inert freeze.
   app.route(
-    `${TENANT_PREFIX}/template-blocks`,
-    createTemplateBlockRoutes({
+    `${TENANT_PREFIX}/catalog-blocks`,
+    createCatalogBlockRoutes({
       requireGrant: createRequireGrant({
         grantStore: chatGrantStore,
         conditionRegistry: chatConditionRegistry,
@@ -2196,16 +2196,16 @@ export async function createHub(config: HubConfig) {
           principal: { kind: "hub" },
           tree: {
             files: renderWorkflowSourceTree({
-              packageName: `@workbench-template/${assetName}`,
+              packageName: `@workbench-catalog-block/${assetName}`,
               workflowJson,
             }),
-            message: `Deploy template block ${assetName}`,
+            message: `Deploy catalog block ${assetName}`,
           },
         });
 
-        // Native deploy, not a hub-local inert freeze (CL-7364): the same
+        // Native deploy, not a hub-local inert freeze: the same
         // `workflowDeployer` the agent-authored deploy path above drives,
-        // so a template block's definition goes through the real
+        // so a catalog block's definition goes through the real
         // bundle → sidecar probe → capability walk → gate → freeze
         // pipeline instead of a hub-side shortcut.
         const result = await workflowDeployer.deploy({

From 67929db2c3594c280b087dae30774b48e312e6b5 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Thu, 17 Sep 2026 10:24:04 -0700
Subject: [PATCH 3/8] feat(artifacts-hub)!: delete the dead template-library
 module

createTemplateLibraryRoutes/seedTemplateLibrary were never mounted in
apps/hub and had no remaining caller outside this package once
CL-8156 deletes workbench template picking -- dead code, not a
migration.

Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
---
 packages/artifacts-hub/src/index.ts           |  16 -
 .../src/template-library.test.ts              | 650 ------------------
 .../artifacts-hub/src/template-library.ts     | 509 --------------
 3 files changed, 1175 deletions(-)
 delete mode 100644 packages/artifacts-hub/src/template-library.test.ts
 delete mode 100644 packages/artifacts-hub/src/template-library.ts

diff --git a/packages/artifacts-hub/src/index.ts b/packages/artifacts-hub/src/index.ts
index 2bcd61ecc6..b6bc1678dc 100644
--- a/packages/artifacts-hub/src/index.ts
+++ b/packages/artifacts-hub/src/index.ts
@@ -9,22 +9,6 @@ export {
   type ArtifactUploadInput,
   type CreateArtifactRoutesDeps,
 } from "./routes";
-export {
-  WORKBENCH_TEMPLATE_ARTIFACT_KIND,
-  createTemplateLibraryDbStore,
-  createTemplateLibraryRoutes,
-  createTemplateLibrarySeeder,
-  createUnavailableTemplateLibraryRoutes,
-  seedTemplateLibrary,
-  type CreateTemplateLibraryRoutesDeps,
-  type CreateTemplateLibrarySeederArgs,
-  type SeedTemplateLibraryArgs,
-  type TemplateLibraryEngine,
-  type TemplateLibraryEntry,
-  type TemplateLibrarySeeder,
-  type TemplateLibraryStore,
-  type TemplateSeedOutcome,
-} from "./template-library";
 export {
   createWorkflowRunAuthenticator,
   type ResolvedWorkflowRunScope,
diff --git a/packages/artifacts-hub/src/template-library.test.ts b/packages/artifacts-hub/src/template-library.test.ts
deleted file mode 100644
index a634c2782b..0000000000
--- a/packages/artifacts-hub/src/template-library.test.ts
+++ /dev/null
@@ -1,650 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import type { RequireGrant } from "@intx/hub-api";
-import { Hono } from "hono";
-
-import {
-  WORKBENCH_TEMPLATE_ARTIFACT_KIND,
-  createTemplateLibraryDbStore,
-  createTemplateLibraryRoutes,
-  createTemplateLibrarySeeder,
-  createUnavailableTemplateLibraryRoutes,
-  seedTemplateLibrary,
-  type TemplateLibraryEngine,
-  type TemplateLibrarySeeder,
-  type TemplateLibraryStore,
-} from "./template-library";
-
-const TENANT = { id: "tenant_a" };
-const SCOPE = { tenantId: TENANT.id, principalId: "prin_admin" };
-
-const allowAll: RequireGrant = () => async (_c, next) => {
-  await next();
-};
-
-type StoredRow = {
-  id: string;
-  tenantId: string;
-  kind: string;
-  title: string;
-  content: string;
-  version: number;
-  archivedAt: Date | null;
-  source: Record<string, unknown> | null;
-};
-
-/** In-memory stand-in for the artifacts engine, shaped like the calls
- * `seedTemplateLibrary` makes. */
-function memoryEngine(): {
-  engine: TemplateLibraryEngine;
-  rows: StoredRow[];
-  userEdit: (title: string, content: string) => void;
-  userArchive: (title: string) => void;
-} {
-  const rows: StoredRow[] = [];
-  let nextId = 1;
-  const engine = {
-    async createArtifact(
-      _tx: unknown,
-      args: {
-        scope: { tenantId: string };
-        kind: string;
-        title: string;
-        content: string;
-        source: Record<string, unknown>;
-      },
-    ) {
-      const row: StoredRow = {
-        id: `art_${nextId++}`,
-        tenantId: args.scope.tenantId,
-        kind: args.kind,
-        title: args.title,
-        content: args.content,
-        version: 1,
-        archivedAt: null,
-        source: args.source,
-      };
-      rows.push(row);
-      return row;
-    },
-    async findArtifactByTitle(
-      _db: unknown,
-      tenantId: string,
-      title: string,
-      kind?: string,
-    ) {
-      const row = rows.find(
-        (r) =>
-          r.tenantId === tenantId &&
-          r.title === title &&
-          r.kind === kind &&
-          r.archivedAt === null,
-      );
-      return row ? { artifactId: row.id, version: row.version } : null;
-    },
-    async getArtifact(_db: unknown, artifactId: string) {
-      return rows.find((r) => r.id === artifactId) ?? null;
-    },
-    async writeArtifactVersion(
-      _db: unknown,
-      args: { artifactId: string; content?: string },
-    ) {
-      const row = rows.find((r) => r.id === args.artifactId);
-      if (!row || row.archivedAt !== null) throw new Error("not found");
-      if (args.content !== undefined) row.content = args.content;
-      row.version += 1;
-      return { artifactId: row.id, version: row.version, title: row.title };
-    },
-    async listArtifacts(
-      _db: unknown,
-      tenantId: string,
-      filters: { kind?: string },
-    ) {
-      return {
-        rows: rows.filter(
-          (r) =>
-            r.tenantId === tenantId &&
-            r.kind === filters.kind &&
-            r.archivedAt === null,
-        ),
-        nextCursor: null,
-      };
-    },
-    async listSeedRows(_db: unknown, tenantId: string, kind: string) {
-      return rows.filter(
-        (r) =>
-          r.tenantId === tenantId &&
-          r.kind === kind &&
-          r.source?.origin === "template-library-seed",
-      );
-    },
-    async updateArtifactSource(
-      _db: unknown,
-      artifactId: string,
-      source: Record<string, unknown>,
-    ) {
-      const row = rows.find((r) => r.id === artifactId);
-      if (!row) throw new Error("not found");
-      row.source = source;
-    },
-    async setArtifactArchivedById(
-      _db: unknown,
-      artifactId: string,
-      archived: boolean,
-    ) {
-      const row = rows.find((r) => r.id === artifactId);
-      if (!row) throw new Error("not found");
-      row.archivedAt = archived ? (row.archivedAt ?? new Date()) : null;
-    },
-  } as unknown as TemplateLibraryEngine;
-  const userEdit = (title: string, content: string) => {
-    const row = rows.find((r) => r.title === title);
-    if (!row) throw new Error(`no row titled ${title}`);
-    row.content = content;
-    row.version += 1;
-  };
-  const userArchive = (title: string) => {
-    const row = rows.find((r) => r.title === title);
-    if (!row) throw new Error(`no row titled ${title}`);
-    row.archivedAt = new Date();
-  };
-  return { engine, rows, userEdit, userArchive };
-}
-
-const fakeDb = {
-  transaction: async <T>(fn: (tx: unknown) => Promise<T>) => fn({}),
-} as unknown as Parameters<typeof seedTemplateLibrary>[0]["db"];
-
-const CODE_REVIEW_ENTRY = {
-  id: "code-review",
-  content: '{"id":"code-review"}',
-};
-const GTM_ENTRY = { id: "gtm", content: '{"id":"gtm"}' };
-const ENTRIES = [CODE_REVIEW_ENTRY, GTM_ENTRY];
-
-describe("seedTemplateLibrary", () => {
-  test("seeds each template once under the workbench-template kind", async () => {
-    const { engine, rows } = memoryEngine();
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    expect(outcomes.map((o) => o.outcome)).toEqual(["created", "created"]);
-    expect(rows).toHaveLength(2);
-    expect(rows.every((r) => r.kind === WORKBENCH_TEMPLATE_ARTIFACT_KIND)).toBe(
-      true,
-    );
-  });
-
-  test("a second boot leaves exactly one entry per template, untouched", async () => {
-    const { engine, rows } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    const second = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    expect(second.map((o) => o.outcome)).toEqual(["unchanged", "unchanged"]);
-    expect(rows).toHaveLength(2);
-    expect(rows.every((r) => r.version === 1)).toBe(true);
-  });
-
-  test("a changed shipped manifest revises the existing row, never duplicates it", async () => {
-    const { engine, rows } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [{ id: "code-review", content: '{"id":"code-review","v":2}' }],
-      engine,
-    });
-    expect(outcomes).toContainEqual({ id: "code-review", outcome: "revised" });
-    expect(rows).toHaveLength(2);
-    const revised = rows.find((r) => r.title === "code-review");
-    expect(revised?.version).toBe(2);
-    expect(revised?.content).toBe('{"id":"code-review","v":2}');
-  });
-
-  test("a user-edited template is never clobbered by a moved manifest", async () => {
-    const { engine, rows, userEdit } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    userEdit("code-review", '{"id":"code-review","mine":true}');
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [
-        { id: "code-review", content: '{"id":"code-review","v":2}' },
-        { id: "gtm", content: '{"id":"gtm"}' },
-      ],
-      engine,
-    });
-    expect(outcomes).toContainEqual({ id: "code-review", outcome: "kept" });
-    const edited = rows.find((r) => r.title === "code-review");
-    expect(edited?.content).toBe('{"id":"code-review","mine":true}');
-  });
-
-  test("a manifest change after an untouched earlier revision still converges", async () => {
-    const { engine, rows } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [
-        { id: "code-review", content: '{"id":"code-review","v":2}' },
-        GTM_ENTRY,
-      ],
-      engine,
-    });
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [
-        { id: "code-review", content: '{"id":"code-review","v":3}' },
-        GTM_ENTRY,
-      ],
-      engine,
-    });
-    expect(outcomes).toContainEqual({ id: "code-review", outcome: "revised" });
-    expect(rows.find((r) => r.title === "code-review")?.content).toBe(
-      '{"id":"code-review","v":3}',
-    );
-  });
-
-  test("a template dropped from the manifest is retired (archived), not deleted", async () => {
-    const { engine, rows } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [GTM_ENTRY],
-      engine,
-    });
-    expect(outcomes).toContainEqual({ id: "code-review", outcome: "retired" });
-    const retired = rows.find((r) => r.title === "code-review");
-    expect(retired?.archivedAt).not.toBeNull();
-    expect(rows).toHaveLength(2);
-  });
-
-  test("a user-edited template dropped from the manifest is kept visible", async () => {
-    const { engine, rows, userEdit } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    userEdit("code-review", '{"id":"code-review","mine":true}');
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [GTM_ENTRY],
-      engine,
-    });
-    expect(outcomes).toContainEqual({ id: "code-review", outcome: "kept" });
-    expect(rows.find((r) => r.title === "code-review")?.archivedAt).toBeNull();
-  });
-
-  test("a retired template re-added to the manifest is restored to the current content", async () => {
-    const { engine, rows } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [GTM_ENTRY],
-      engine,
-    });
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [
-        { id: "code-review", content: '{"id":"code-review","v":2}' },
-        GTM_ENTRY,
-      ],
-      engine,
-    });
-    expect(outcomes).toContainEqual({ id: "code-review", outcome: "restored" });
-    const restored = rows.find((r) => r.title === "code-review");
-    expect(restored?.archivedAt).toBeNull();
-    expect(restored?.content).toBe('{"id":"code-review","v":2}');
-    expect(rows).toHaveLength(2);
-  });
-
-  test("a template the user archived themselves stays archived", async () => {
-    const { engine, rows, userArchive } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    userArchive("code-review");
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    expect(outcomes).toContainEqual({ id: "code-review", outcome: "kept" });
-    expect(
-      rows.find((r) => r.title === "code-review")?.archivedAt,
-    ).not.toBeNull();
-  });
-
-  test("a legacy seeded row without a seed marker adopts one when content matches", async () => {
-    const { engine, rows } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    for (const row of rows) {
-      row.source = { origin: "template-library-seed", templateId: row.title };
-    }
-    const adopt = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    expect(adopt.map((o) => o.outcome)).toEqual(["unchanged", "unchanged"]);
-    const moved = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [
-        { id: "code-review", content: '{"id":"code-review","v":2}' },
-        GTM_ENTRY,
-      ],
-      engine,
-    });
-    expect(moved).toContainEqual({ id: "code-review", outcome: "revised" });
-  });
-
-  test("a legacy seeded row whose content differs without a marker is preserved", async () => {
-    const { engine, rows } = memoryEngine();
-    await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: ENTRIES,
-      engine,
-    });
-    for (const row of rows) {
-      row.source = { origin: "template-library-seed", templateId: row.title };
-    }
-    const edited = rows.find((r) => r.title === "code-review");
-    if (!edited) throw new Error("row missing");
-    edited.content = '{"id":"code-review","mine":true}';
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [
-        { id: "code-review", content: '{"id":"code-review","v":2}' },
-        GTM_ENTRY,
-      ],
-      engine,
-    });
-    expect(outcomes).toContainEqual({ id: "code-review", outcome: "kept" });
-    expect(edited.content).toBe('{"id":"code-review","mine":true}');
-  });
-
-  test("a user-created artifact sharing a template's title is never touched or duplicated", async () => {
-    const { engine, rows } = memoryEngine();
-    rows.push({
-      id: "art_user",
-      tenantId: TENANT.id,
-      kind: WORKBENCH_TEMPLATE_ARTIFACT_KIND,
-      title: "code-review",
-      content: '{"mine":true}',
-      version: 1,
-      archivedAt: null,
-      source: { origin: "member" },
-    });
-    const outcomes = await seedTemplateLibrary({
-      db: fakeDb,
-      scope: SCOPE,
-      entries: [CODE_REVIEW_ENTRY],
-      engine,
-    });
-    expect(outcomes).toEqual([{ id: "code-review", outcome: "kept" }]);
-    expect(rows).toHaveLength(1);
-    expect(rows[0]?.content).toBe('{"mine":true}');
-  });
-});
-
-const OTHER_TENANT = { id: "tenant_b" };
-
-describe("createTemplateLibrarySeeder", () => {
-  test("seeds a tenant the first time it is asked, and not again after", async () => {
-    let passes = 0;
-    const seeder = createTemplateLibrarySeeder({
-      db: fakeDb,
-      entries: ENTRIES,
-      seed: async (args) => {
-        passes += 1;
-        return seedTemplateLibrary(args);
-      },
-      engine: memoryEngine().engine,
-    });
-
-    await seeder.ensureSeeded(SCOPE);
-    await seeder.ensureSeeded(SCOPE);
-    expect(passes).toBe(1);
-  });
-
-  test("concurrent first reads share one seed pass", async () => {
-    let passes = 0;
-    const seeder = createTemplateLibrarySeeder({
-      db: fakeDb,
-      entries: ENTRIES,
-      seed: async (args) => {
-        passes += 1;
-        await new Promise((resolve) => setTimeout(resolve, 5));
-        return seedTemplateLibrary(args);
-      },
-      engine: memoryEngine().engine,
-    });
-
-    await Promise.all([seeder.ensureSeeded(SCOPE), seeder.ensureSeeded(SCOPE)]);
-    expect(passes).toBe(1);
-  });
-
-  test("a failed pass never latches: the next read retries instead of giving up", async () => {
-    let passes = 0;
-    const seeder = createTemplateLibrarySeeder({
-      db: fakeDb,
-      entries: ENTRIES,
-      seed: async (args) => {
-        passes += 1;
-        if (passes === 1) throw new Error("database is booting");
-        return seedTemplateLibrary(args);
-      },
-      engine: memoryEngine().engine,
-    });
-
-    await expect(seeder.ensureSeeded(SCOPE)).rejects.toThrow(
-      "database is booting",
-    );
-    await seeder.ensureSeeded(SCOPE);
-    expect(passes).toBe(2);
-  });
-
-  test("each tenant converges on its own first read — no operator bench involved", async () => {
-    const seededTenants: string[] = [];
-    const seeder = createTemplateLibrarySeeder({
-      db: fakeDb,
-      entries: ENTRIES,
-      seed: async (args) => {
-        seededTenants.push(args.scope.tenantId);
-        return seedTemplateLibrary(args);
-      },
-      engine: memoryEngine().engine,
-    });
-
-    await seeder.ensureSeeded(SCOPE);
-    await seeder.ensureSeeded({
-      tenantId: OTHER_TENANT.id,
-      principalId: "prin_b",
-    });
-    expect(seededTenants).toEqual([TENANT.id, OTHER_TENANT.id]);
-  });
-});
-
-type TestEnv = {
-  Variables: { tenant: { id: string }; principal: { id: string } };
-};
-
-function mountRoutes(
-  store: TemplateLibraryStore,
-  seeder: TemplateLibrarySeeder,
-): Hono<TestEnv> {
-  const app = new Hono<TestEnv>();
-  app.use("*", async (c, next) => {
-    c.set("tenant", TENANT);
-    c.set("principal", { id: SCOPE.principalId });
-    await next();
-  });
-  app.route(
-    "/library/templates",
-    createTemplateLibraryRoutes({
-      store,
-      seeder,
-      requireGrant: allowAll,
-      log: () => {},
-    }),
-  );
-  return app;
-}
-
-const noopSeeder: TemplateLibrarySeeder = { ensureSeeded: async () => {} };
-
-const fakeStore: TemplateLibraryStore = {
-  async list(tenantId) {
-    return tenantId === TENANT.id ? ENTRIES : [];
-  },
-  async get(tenantId, templateId) {
-    if (tenantId !== TENANT.id) return null;
-    return ENTRIES.find((e) => e.id === templateId) ?? null;
-  },
-};
-
-/** The bench the owner actually hit: a tenant nothing ever seeded, on a
- * hub that never resolved an operator bench. Reads go through the real
- * store over the same memory engine the seeder writes into, so a served
- * template proves the read itself converged the shelf. */
-function mountUnseededTenant(): Hono<TestEnv> {
-  const { engine } = memoryEngine();
-  return mountRoutes(
-    createTemplateLibraryDbStore(fakeDb, engine),
-    createTemplateLibrarySeeder({ db: fakeDb, entries: ENTRIES, engine }),
-  );
-}
-
-describe("template library routes", () => {
-  test("lists the seeded entries", async () => {
-    const res = await mountRoutes(fakeStore, noopSeeder).request(
-      "/library/templates",
-    );
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ data: ENTRIES });
-  });
-
-  test("fetches one template by id", async () => {
-    const res = await mountRoutes(fakeStore, noopSeeder).request(
-      "/library/templates/code-review",
-    );
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual(CODE_REVIEW_ENTRY);
-  });
-
-  test("404s an id the library does not hold", async () => {
-    const res = await mountRoutes(fakeStore, noopSeeder).request(
-      "/library/templates/standup",
-    );
-    expect(res.status).toBe(404);
-  });
-
-  test("a never-seeded tenant's first list read seeds the shelf and serves it", async () => {
-    const res = await mountUnseededTenant().request("/library/templates");
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual({ data: ENTRIES });
-  });
-
-  test("a never-seeded tenant's first template read serves the template instead of 404ing", async () => {
-    const res = await mountUnseededTenant().request(
-      "/library/templates/code-review",
-    );
-    expect(res.status).toBe(200);
-    expect(await res.json()).toEqual(CODE_REVIEW_ENTRY);
-  });
-
-  test("a seed the read could not run answers 503, never a 404 that reads as 'no such template'", async () => {
-    const failing: TemplateLibrarySeeder = {
-      ensureSeeded: async () => {
-        throw new Error("artifacts database unreachable");
-      },
-    };
-    const app = mountRoutes(fakeStore, failing);
-
-    const list = await app.request("/library/templates");
-    expect(list.status).toBe(503);
-    const one = await app.request("/library/templates/code-review");
-    expect(one.status).toBe(503);
-    const body = (await one.json()) as { error: { code: string } };
-    expect(body.error.code).toBe("unavailable");
-  });
-});
-
-describe("createUnavailableTemplateLibraryRoutes", () => {
-  test("both routes answer 503 instead of the mount silently not existing", async () => {
-    const app = new Hono<TestEnv>();
-    app.use("*", async (c, next) => {
-      c.set("tenant", TENANT);
-      c.set("principal", { id: SCOPE.principalId });
-      await next();
-    });
-    app.route(
-      "/library/templates",
-      createUnavailableTemplateLibraryRoutes(allowAll),
-    );
-
-    const list = await app.request("/library/templates");
-    expect(list.status).toBe(503);
-    const listBody = (await list.json()) as { error: { code: string } };
-    expect(listBody.error.code).toBe("unavailable");
-
-    const one = await app.request("/library/templates/starter");
-    expect(one.status).toBe(503);
-  });
-});
diff --git a/packages/artifacts-hub/src/template-library.ts b/packages/artifacts-hub/src/template-library.ts
deleted file mode 100644
index f0be43df78..0000000000
--- a/packages/artifacts-hub/src/template-library.ts
+++ /dev/null
@@ -1,509 +0,0 @@
-/**
- * The bench library's workbench-template shelf (CL-6344): seeding the
- * shipped template manifests in as versioned artifact rows, and the
- * tenant-scoped read routes a create flow instantiates from.
- *
- * What triggers a seed (CL-6458): the read itself. Every bench that can
- * read the shelf owns one — the rows are tenant-scoped artifacts, so
- * "the tenant being read" is the only honest owner, and a bench created
- * long after the hub booted converges the first time its picker opens.
- * There is no window to miss and no bench to wait for.
- *
- * Reconciliation semantics (CL-6400): every boot converges the shelf
- * to the shipped manifests without ever fighting a member. The seed
- * records the hash of the content it last wrote in the artifact's
- * `source` (`seededContentHash`), so a re-seed can tell "the shipped
- * manifest moved" (head content still matches the marker — revise)
- * from "a member edited this" (head content diverged — keep). A
- * template dropped from the manifests is archived (`source.retired`)
- * when still seed-owned, and unarchived + converged when re-added; a
- * member's own archive (no `retired` flag) is respected and never
- * undone. Rows from before the marker existed adopt one when their
- * content still matches the shipped manifest, and are otherwise
- * preserved — ambiguity never clobbers.
- *
- * The engine calls are injected the same way `apps/hub`'s
- * `artifacts-mount.ts` injects its engine seam, so seeding logic is
- * testable without a live Postgres.
- */
-import {
-  artifact,
-  createArtifact,
-  findArtifactByTitle,
-  getArtifact,
-  listArtifacts,
-  writeArtifactVersion,
-  type ArtifactDb,
-} from "@corbits/artifacts";
-import { sha256 } from "@intx/crypto";
-import type { RequireGrant, TenantEnv } from "@intx/hub-api";
-import { hexEncode } from "@intx/types";
-import { and, eq, sql } from "drizzle-orm";
-import { Hono } from "hono";
-import { makeErrorEnvelope } from "@corbits/error-sink";
-
-export const WORKBENCH_TEMPLATE_ARTIFACT_KIND = "workbench-template";
-
-/** One shelf entry to seed: the template's stable id and its serialized
- * manifest. Kept as plain strings so this package never depends on
- * `@workbench/templates` — the manifest vocabulary stays there. */
-export type TemplateLibraryEntry = {
-  readonly id: string;
-  readonly content: string;
-};
-
-export type TemplateSeedOutcome = {
-  readonly id: string;
-  readonly outcome:
-    "created" | "unchanged" | "revised" | "kept" | "retired" | "restored";
-};
-
-export type SeededTemplateRow = {
-  readonly id: string;
-  readonly title: string;
-  readonly content: string;
-  readonly archivedAt: Date | null;
-  readonly source: Record<string, unknown> | null;
-};
-
-export type TemplateLibraryEngine = {
-  createArtifact: typeof createArtifact;
-  findArtifactByTitle: typeof findArtifactByTitle;
-  getArtifact: typeof getArtifact;
-  writeArtifactVersion: typeof writeArtifactVersion;
-  listArtifacts: typeof listArtifacts;
-  listSeedRows: (
-    db: ArtifactDb,
-    tenantId: string,
-    kind: string,
-  ) => Promise<readonly SeededTemplateRow[]>;
-  updateArtifactSource: (
-    db: ArtifactDb,
-    artifactId: string,
-    source: Record<string, unknown>,
-  ) => Promise<void>;
-  setArtifactArchivedById: (
-    db: ArtifactDb,
-    artifactId: string,
-    archived: boolean,
-  ) => Promise<void>;
-};
-
-const SEED_ORIGIN = "template-library-seed";
-
-async function contentHash(content: string): Promise<string> {
-  return hexEncode(await sha256(content));
-}
-
-const productionEngine: TemplateLibraryEngine = {
-  createArtifact,
-  findArtifactByTitle,
-  getArtifact,
-  writeArtifactVersion,
-  listArtifacts,
-  async listSeedRows(db, tenantId, kind) {
-    const rows = await db
-      .select({
-        id: artifact.id,
-        title: artifact.title,
-        content: artifact.content,
-        archivedAt: artifact.archivedAt,
-        source: artifact.source,
-      })
-      .from(artifact)
-      .where(
-        and(
-          eq(artifact.tenantId, tenantId),
-          eq(artifact.kind, kind),
-          sql`${artifact.source}->>'origin' = ${SEED_ORIGIN}`,
-        ),
-      );
-    return rows.map((row) => ({
-      id: row.id,
-      title: row.title,
-      content: row.content,
-      archivedAt: row.archivedAt,
-      source: isRecord(row.source) ? row.source : null,
-    }));
-  },
-  async updateArtifactSource(db, artifactId, source) {
-    await db
-      .update(artifact)
-      .set({ source })
-      .where(eq(artifact.id, artifactId));
-  },
-  async setArtifactArchivedById(db, artifactId, archived) {
-    await db
-      .update(artifact)
-      .set({ archivedAt: archived ? new Date() : null })
-      .where(eq(artifact.id, artifactId));
-  },
-};
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-export type SeedTemplateLibraryArgs = {
-  db: ArtifactDb;
-  scope: { tenantId: string; principalId: string };
-  entries: readonly TemplateLibraryEntry[];
-  engine?: TemplateLibraryEngine;
-};
-
-function templateIdOf(row: SeededTemplateRow): string {
-  const templateId = row.source?.templateId;
-  return typeof templateId === "string" ? templateId : row.title;
-}
-
-function seedMarkerOf(row: SeededTemplateRow): string | undefined {
-  const marker = row.source?.seededContentHash;
-  return typeof marker === "string" ? marker : undefined;
-}
-
-function seedRetiredFlagOf(row: SeededTemplateRow): boolean {
-  return row.source?.retired === true;
-}
-
-function seedSource(templateId: string, contentHash: string) {
-  return {
-    origin: SEED_ORIGIN,
-    templateId,
-    seededContentHash: contentHash,
-  };
-}
-
-async function reconcileEntry(
-  args: SeedTemplateLibraryArgs,
-  engine: TemplateLibraryEngine,
-  entry: TemplateLibraryEntry,
-  row: SeededTemplateRow | undefined,
-): Promise<TemplateSeedOutcome["outcome"]> {
-  const shippedHash = await contentHash(entry.content);
-  if (row === undefined) {
-    const titleClash = await engine.findArtifactByTitle(
-      args.db,
-      args.scope.tenantId,
-      entry.id,
-      WORKBENCH_TEMPLATE_ARTIFACT_KIND,
-    );
-    if (titleClash !== null) {
-      return "kept";
-    }
-    await args.db.transaction(async (tx) => {
-      await engine.createArtifact(tx, {
-        scope: args.scope,
-        ownerPrincipalId: null,
-        kind: WORKBENCH_TEMPLATE_ARTIFACT_KIND,
-        title: entry.id,
-        content: entry.content,
-        source: seedSource(entry.id, shippedHash),
-      });
-    });
-    return "created";
-  }
-
-  const wasSeedRetired = row.archivedAt !== null && seedRetiredFlagOf(row);
-  if (row.archivedAt !== null && !wasSeedRetired) {
-    return "kept";
-  }
-
-  const headHash = await contentHash(row.content);
-  const marker = seedMarkerOf(row);
-  const seedOwnsHead = marker === headHash;
-
-  if (row.content === entry.content) {
-    if (wasSeedRetired) {
-      await engine.setArtifactArchivedById(args.db, row.id, false);
-    }
-    if (marker !== shippedHash || wasSeedRetired) {
-      await engine.updateArtifactSource(
-        args.db,
-        row.id,
-        seedSource(entry.id, shippedHash),
-      );
-    }
-    return wasSeedRetired ? "restored" : "unchanged";
-  }
-
-  if (!seedOwnsHead) {
-    return "kept";
-  }
-
-  if (wasSeedRetired) {
-    await engine.setArtifactArchivedById(args.db, row.id, false);
-  }
-  await engine.writeArtifactVersion(args.db, {
-    scope: args.scope,
-    artifactId: row.id,
-    content: entry.content,
-  });
-  await engine.updateArtifactSource(
-    args.db,
-    row.id,
-    seedSource(entry.id, shippedHash),
-  );
-  return wasSeedRetired ? "restored" : "revised";
-}
-
-async function retireOrphan(
-  args: SeedTemplateLibraryArgs,
-  engine: TemplateLibraryEngine,
-  row: SeededTemplateRow,
-): Promise<TemplateSeedOutcome["outcome"]> {
-  if (row.archivedAt !== null) {
-    return seedRetiredFlagOf(row) ? "retired" : "kept";
-  }
-  const marker = seedMarkerOf(row);
-  const seedOwnsHead = marker === (await contentHash(row.content));
-  if (!seedOwnsHead) {
-    return "kept";
-  }
-  await engine.updateArtifactSource(args.db, row.id, {
-    origin: SEED_ORIGIN,
-    templateId: templateIdOf(row),
-    seededContentHash: marker,
-    retired: true,
-  });
-  await engine.setArtifactArchivedById(args.db, row.id, true);
-  return "retired";
-}
-
-export async function seedTemplateLibrary(
-  args: SeedTemplateLibraryArgs,
-): Promise<readonly TemplateSeedOutcome[]> {
-  const engine = args.engine ?? productionEngine;
-  const seedRows = await engine.listSeedRows(
-    args.db,
-    args.scope.tenantId,
-    WORKBENCH_TEMPLATE_ARTIFACT_KIND,
-  );
-  const rowsByTemplateId = new Map(
-    seedRows.map((row) => [templateIdOf(row), row]),
-  );
-  const shippedIds = new Set(args.entries.map((entry) => entry.id));
-
-  const outcomes: TemplateSeedOutcome[] = [];
-  for (const entry of args.entries) {
-    const outcome = await reconcileEntry(
-      args,
-      engine,
-      entry,
-      rowsByTemplateId.get(entry.id),
-    );
-    outcomes.push({ id: entry.id, outcome });
-  }
-  for (const row of seedRows) {
-    const templateId = templateIdOf(row);
-    if (shippedIds.has(templateId)) continue;
-    const outcome = await retireOrphan(args, engine, row);
-    outcomes.push({ id: templateId, outcome });
-  }
-  return outcomes;
-}
-
-/** Minimal read port the routes need — production wraps the engine db. */
-export type TemplateLibraryStore = {
-  list(tenantId: string): Promise<readonly TemplateLibraryEntry[]>;
-  get(
-    tenantId: string,
-    templateId: string,
-  ): Promise<TemplateLibraryEntry | null>;
-};
-
-export function createTemplateLibraryDbStore(
-  db: ArtifactDb,
-  engine: TemplateLibraryEngine = productionEngine,
-): TemplateLibraryStore {
-  return {
-    async list(tenantId) {
-      const page = await engine.listArtifacts(db, tenantId, {
-        kind: WORKBENCH_TEMPLATE_ARTIFACT_KIND,
-      });
-      const entries: TemplateLibraryEntry[] = [];
-      for (const row of page.rows) {
-        const full = await engine.getArtifact(db, row.id);
-        if (full === null) continue;
-        entries.push({ id: full.title, content: full.content });
-      }
-      return entries;
-    },
-    async get(tenantId, templateId) {
-      const found = await engine.findArtifactByTitle(
-        db,
-        tenantId,
-        templateId,
-        WORKBENCH_TEMPLATE_ARTIFACT_KIND,
-      );
-      if (found === null) return null;
-      const row = await engine.getArtifact(db, found.artifactId);
-      if (row === null || row.tenantId !== tenantId) return null;
-      return { id: row.title, content: row.content };
-    },
-  };
-}
-
-/**
- * What makes a tenant's shelf match the shipped manifests before it is
- * read (CL-6458). Seeding is triggered by the read itself rather than by
- * a boot-time window: a bench created after the hub booted converges the
- * first time anyone opens the picker, in any boot order, with no
- * operator bench in the picture.
- */
-export type TemplateLibrarySeeder = {
-  ensureSeeded(scope: { tenantId: string; principalId: string }): Promise<void>;
-};
-
-export type CreateTemplateLibrarySeederArgs = {
-  db: ArtifactDb;
-  entries: readonly TemplateLibraryEntry[];
-  engine?: TemplateLibraryEngine;
-  seed?: typeof seedTemplateLibrary;
-  log?: (line: string) => void;
-};
-
-/**
- * One reconciliation pass per tenant per process: concurrent first reads
- * share a pass, a converged tenant costs nothing on later reads, and a
- * failed pass is not remembered, so the next read retries it. Nothing
- * here is a cache of the shelf's contents — `seedTemplateLibrary` is
- * itself convergent (CL-6400), so a redeploy carrying changed manifests
- * reconciles on the new process's first read.
- */
-export function createTemplateLibrarySeeder(
-  args: CreateTemplateLibrarySeederArgs,
-): TemplateLibrarySeeder {
-  const seed = args.seed ?? seedTemplateLibrary;
-  const log = args.log ?? ((): void => undefined);
-  const converged = new Set<string>();
-  const inFlight = new Map<string, Promise<void>>();
-
-  async function runPass(scope: {
-    tenantId: string;
-    principalId: string;
-  }): Promise<void> {
-    const outcomes =
-      args.engine === undefined
-        ? await seed({ db: args.db, scope, entries: args.entries })
-        : await seed({
-            db: args.db,
-            scope,
-            entries: args.entries,
-            engine: args.engine,
-          });
-    for (const outcome of outcomes) {
-      log(
-        `template library ${scope.tenantId}: "${outcome.id}" ${outcome.outcome}`,
-      );
-    }
-    converged.add(scope.tenantId);
-  }
-
-  return {
-    async ensureSeeded(scope) {
-      if (args.entries.length === 0 || converged.has(scope.tenantId)) return;
-      const running = inFlight.get(scope.tenantId);
-      if (running !== undefined) return running;
-      const pass = runPass(scope).finally(() => {
-        inFlight.delete(scope.tenantId);
-      });
-      inFlight.set(scope.tenantId, pass);
-      return pass;
-    },
-  };
-}
-
-export type CreateTemplateLibraryRoutesDeps = {
-  store: TemplateLibraryStore;
-  seeder: TemplateLibrarySeeder;
-  requireGrant: RequireGrant;
-  /** Where a failed reconciliation's real cause goes; the client sees
-   * one honest "unavailable", never a 404 that reads as "no such
-   * template". */
-  log: (line: string) => void;
-};
-
-/** `GET /` lists every seeded template entry; `GET /:templateId` fetches
- * one. Both converge the tenant's shelf before reading it. Content
- * travels as the seeded string — the client parses it with
- * `@workbench/templates`'s manifest schema at its own boundary. */
-export function createTemplateLibraryRoutes(
-  deps: CreateTemplateLibraryRoutesDeps,
-): Hono<TenantEnv> {
-  const app = new Hono<TenantEnv>();
-
-  async function converge(
-    tenantId: string,
-    principalId: string,
-  ): Promise<Response | null> {
-    try {
-      await deps.seeder.ensureSeeded({ tenantId, principalId });
-      return null;
-    } catch (cause) {
-      deps.log(
-        `template library seed failed for ${tenantId}: ${cause instanceof Error ? cause.message : String(cause)}`,
-      );
-      return Response.json(
-        makeErrorEnvelope({
-          code: "unavailable",
-          userMessage: "The template library isn't ready yet",
-        }),
-        { status: 503 },
-      );
-    }
-  }
-
-  app.get("/", deps.requireGrant("asset:*", "read"), async (c) => {
-    const tenant = c.get("tenant");
-    const failed = await converge(tenant.id, c.get("principal").id);
-    if (failed !== null) return failed;
-    const entries = await deps.store.list(tenant.id);
-    return c.json({ data: entries });
-  });
-
-  app.get("/:templateId", deps.requireGrant("asset:*", "read"), async (c) => {
-    const tenant = c.get("tenant");
-    const failed = await converge(tenant.id, c.get("principal").id);
-    if (failed !== null) return failed;
-    const entry = await deps.store.get(tenant.id, c.req.param("templateId"));
-    if (entry === null) {
-      return c.json(
-        makeErrorEnvelope({
-          code: "not_found",
-          userMessage: "Unknown template",
-        }),
-        404,
-      );
-    }
-    return c.json(entry);
-  });
-
-  return app;
-}
-
-/**
- * Honest degraded surface when the artifacts plane is not mounted — the
- * template library lives in the artifacts engine's db, so it is exactly
- * as unavailable as `createUnavailableArtifactRoutes`' routes. Every
- * route answers 503; without this mount the paths 404 and a client
- * cannot tell "not configured" from "template not seeded".
- */
-export function createUnavailableTemplateLibraryRoutes(
-  requireGrant: RequireGrant,
-): Hono<TenantEnv> {
-  const app = new Hono<TenantEnv>();
-  const unavailable = (c: {
-    json: (body: unknown, status: 503) => Response | Promise<Response>;
-  }) =>
-    c.json(
-      makeErrorEnvelope({
-        code: "unavailable",
-        userMessage: "Artifacts plane is not configured on this hub",
-      }),
-      503,
-    );
-
-  app.get("/", requireGrant("asset:*", "read"), unavailable);
-  app.get("/:templateId", requireGrant("asset:*", "read"), unavailable);
-  return app;
-}

From 489bc9a17a6dbef59e0e2cdf84077bdcc519b92e Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Thu, 17 Sep 2026 10:24:09 -0700
Subject: [PATCH 4/8] feat(evals)!: delete the install-template eval capability

The install-template step, its Target.installTemplate capability, and
the github-pr-review-factory case that drove it all rode the
workbench-template instantiation path CL-8156 deletes. Deleted rather
than ported: the underlying code-review reviewer roster and workflow
still deploy natively (agent-directory create + the catalog-blocks
route), just never through a "kind of workbench" bundle.

Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
---
 packages/evals/package.json                   |   1 -
 .../src/cases/github-pr-review-factory.ts     | 164 -----------------
 packages/evals/src/cases/index.ts             |   3 -
 packages/evals/src/index.ts                   |   2 +-
 packages/evals/src/runner.test.ts             |  64 -------
 packages/evals/src/runner.ts                  |   9 -
 packages/evals/src/targets/real-target.ts     | 168 ------------------
 packages/evals/src/targets/world-snapshot.ts  |   2 +-
 packages/evals/src/types.ts                   |  21 +--
 9 files changed, 3 insertions(+), 431 deletions(-)
 delete mode 100644 packages/evals/src/cases/github-pr-review-factory.ts

diff --git a/packages/evals/package.json b/packages/evals/package.json
index c5f0b1972d..1425855d82 100644
--- a/packages/evals/package.json
+++ b/packages/evals/package.json
@@ -18,7 +18,6 @@
     "@corbits/error-sink": "workspace:*",
     "@corbits/migration-runner": "workspace:*",
     "@corbits/webhook-triggers": "workspace:*",
-    "@workbench/templates": "workspace:*",
     "@intx/agent": "workspace:*",
     "@intx/db": "workspace:*",
     "@intx/hub-api": "workspace:*",
diff --git a/packages/evals/src/cases/github-pr-review-factory.ts b/packages/evals/src/cases/github-pr-review-factory.ts
deleted file mode 100644
index 88a3a5360b..0000000000
--- a/packages/evals/src/cases/github-pr-review-factory.ts
+++ /dev/null
@@ -1,164 +0,0 @@
-// CL-6322 §8.2 case: "connect this GitHub organization and put every
-// PR through an automated review with greybeard, cto, and critique,
-// plus suggested fixes." Rewritten (CL-6340) against the product that
-// actually shipped, not the chat-driven flow the case was first
-// scripted around:
-//
-//   - The reviewer roster is `@corbits/code-review`'s three lenses
-//     (architecture / correctness / release-risk), installed as agent
-//     definitions when the code-review template is instantiated from
-//     the seeded bench library (CL-6344/#140) — never `create_agent`
-//     × 3 in chat. The human's "greybeard, cto, critique" ask maps
-//     onto those lenses; the handles below are the shipped ones.
-//   - Per-repo grants and the per-repo `webhook_trigger` rows are
-//     minted at repo selection by the connect card's start-reviewing
-//     step (CL-6345/#142) — never a chat-driven `routine_create`.
-//   - On a PR event, ONE aggregated comment-only review is posted by
-//     the workflow run via `github_post_pr_review` (CL-6340/#62),
-//     free under the per-repo grant, with the reviewer lenses named
-//     in the body for audit attribution. A merge-class action still
-//     parks behind explicit human approval —
-//     `outwardGitHubActionsRespectGrantBoundary` grades both halves
-//     of that owner ruling together.
-//
-// Step 2 drives the real install (CL-6404: the `install-template` step
-// rides #140's seeded-library instantiation route-for-route) and step
-// 4 fires the real ingress route (`fire-webhook`). What still narrates
-// instead of acting is the GitHub side: the `/complete` PAT prove and
-// start-reviewing's repo listing hit real GitHub until CL-6403's
-// baseUrl seam lands — README.md's scoreboard names those precisely.
-// The scorers grade the world snapshot, so they go green the moment
-// that seam falls — no scorer rewrite needed then.
-//
-// Pass 1 (this case) stops at "review posted" — outcome-ingest
-// (GitHub state flowing back into memory so agents improve) is case
-// two and out of scope here.
-import { defineEval } from "../define-eval.ts";
-import {
-  agentDefinitionsHaveToolGrants,
-  approvalGated,
-  githubConnectedViaConnectionsLayer,
-  judge,
-  noBuildBeforeAnswers,
-  outwardGitHubActionsRespectGrantBoundary,
-  reviewCommentsAttributable,
-  routineCreatedOnlyAfterOk,
-  suggestedFixesStructurallyValid,
-  triggerIsWebhookPerPr,
-  wholeRunInspectable,
-} from "../scorers/scorers.ts";
-import {
-  GITHUB_MERGE_PULL_REQUEST_TOOL,
-  ROUTINE_CREATE_TOOL,
-} from "../scorers/tool-names.ts";
-
-const TARGET_REPO = "abklabs/workbench";
-
-// The shipped reviewer roster (`@corbits/code-review`'s
-// CODE_REVIEW_REVIEWERS): what "greybeard, cto, and critique" actually
-// installs. Handles are what the agent-directory create path stores;
-// display names are what `aggregateReview` renders into the posted
-// review body — the attribution markers the grant-boundary scorer
-// checks for.
-const REVIEWER_HANDLES = [
-  "architecture-reviewer",
-  "correctness-reviewer",
-  "release-risk-reviewer",
-] as const;
-const REVIEWER_DISPLAY_NAMES = [
-  "Architecture reviewer",
-  "Correctness reviewer",
-  "Release-risk reviewer",
-] as const;
-
-export const githubPrReviewFactoryEval = defineEval({
-  name: "github-pr-review-factory",
-  description:
-    "'connect this GitHub organization and put every PR through an " +
-    "automated review with greybeard, cto, and critique, plus " +
-    "suggested fixes' -> GitHub connected via the connections layer -> " +
-    "code-review template instantiated from the seeded library (three " +
-    "reviewer lenses + the github-pinned code-review workflow) -> " +
-    "per-repo grant and webhook trigger minted at repo selection -> on " +
-    "a fake pull_request.opened, one aggregated attributable review " +
-    "with suggestion fences posted free under the grant, while any " +
-    "merge-class action still parks -> whole run inspectable.",
-  steps: [
-    {
-      human:
-        "connect this GitHub organization and put every PR through an " +
-        "automated review with greybeard, cto, and critique, plus " +
-        "suggested fixes",
-      expect: [
-        noBuildBeforeAnswers(1),
-        judge(
-          "The reply asks only what only the human knows before building " +
-            "anything — which org/repos, and whether a GitHub connection " +
-            "already exists — never a plan-approval step (per AGENTS.md " +
-            "'interview for inputs, rip on construction, gate only at the " +
-            "boundary').",
-        ),
-      ],
-    },
-    {
-      // The real install (CL-6404): the harness drives #140's
-      // seeded-library instantiation — manifest read, workbench mint,
-      // participant creation — through the same routes the picker's
-      // "Create workbench" uses. Remaining red half:
-      // `githubConnectedViaConnectionsLayer` needs the Plugins
-      // `/:connectorId/complete` PAT prove, which still hits real
-      // GitHub (CL-6403's baseUrl-seam lane).
-      kind: "install-template",
-      templateId: "code-review",
-      expect: [
-        githubConnectedViaConnectionsLayer(),
-        agentDefinitionsHaveToolGrants(REVIEWER_HANDLES),
-      ],
-    },
-    {
-      human: `looks good — review ${TARGET_REPO}, wire it up`,
-      expect: [
-        // The shipped trigger wiring is start-reviewing's per-repo
-        // webhook_trigger mint, not a chat-driven routine_create — so
-        // routine_create must never fire here, and when it somehow
-        // does, only after the OK.
-        routineCreatedOnlyAfterOk(2),
-        approvalGated([ROUTINE_CREATE_TOOL]),
-        triggerIsWebhookPerPr(),
-        judge(
-          "The reply confirms GitHub is connected, names the three " +
-            "reviewer lenses, and confirms every PR on the selected repo " +
-            "now triggers a review — warm, direct, no wizard checklist.",
-        ),
-      ],
-    },
-    {
-      // The harness fires a fake `pull_request.opened` delivery through
-      // the REAL ingress route against whatever enabled webhook_trigger
-      // start-reviewing minted (CL-6404's `fireWebhook`). While
-      // start-reviewing itself stays blocked on the GitHub REST seam
-      // (CL-6403), no trigger exists and the step honestly records that
-      // miss, keeping these scorers red rather than crashing the run.
-      kind: "fire-webhook",
-      payload: {
-        action: "opened",
-        repository: { full_name: TARGET_REPO },
-        pull_request: {
-          number: 101,
-          html_url: `https://github.com/${TARGET_REPO}/pull/101`,
-          head: { sha: "f0e1d2c3b4a5968778695a4b3c2d1e0f12345678" },
-        },
-      },
-      expect: [
-        reviewCommentsAttributable(REVIEWER_HANDLES),
-        suggestedFixesStructurallyValid(),
-        outwardGitHubActionsRespectGrantBoundary(
-          TARGET_REPO,
-          GITHUB_MERGE_PULL_REQUEST_TOOL,
-          REVIEWER_DISPLAY_NAMES,
-        ),
-        wholeRunInspectable(),
-      ],
-    },
-  ],
-});
diff --git a/packages/evals/src/cases/index.ts b/packages/evals/src/cases/index.ts
index 71ee85ae81..945bb4ee71 100644
--- a/packages/evals/src/cases/index.ts
+++ b/packages/evals/src/cases/index.ts
@@ -1,17 +1,14 @@
 import { aiDailyResearchEval } from "./ai-daily-research.ts";
 import { docsOnSdkChangeEval } from "./docs-on-sdk-change.ts";
 import { exaTopicDigestEval } from "./exa-topic-digest.ts";
-import { githubPrReviewFactoryEval } from "./github-pr-review-factory.ts";
 import type { EvalDefinition } from "../types.ts";
 
 export { aiDailyResearchEval } from "./ai-daily-research.ts";
 export { docsOnSdkChangeEval } from "./docs-on-sdk-change.ts";
 export { exaTopicDigestEval } from "./exa-topic-digest.ts";
-export { githubPrReviewFactoryEval } from "./github-pr-review-factory.ts";
 
 export const ALL_EVALS: readonly EvalDefinition[] = [
   aiDailyResearchEval,
   docsOnSdkChangeEval,
   exaTopicDigestEval,
-  githubPrReviewFactoryEval,
 ];
diff --git a/packages/evals/src/index.ts b/packages/evals/src/index.ts
index e6dca8b43f..872811fcc6 100644
--- a/packages/evals/src/index.ts
+++ b/packages/evals/src/index.ts
@@ -63,7 +63,7 @@ export {
   ALL_EVALS,
   aiDailyResearchEval,
   docsOnSdkChangeEval,
-  githubPrReviewFactoryEval,
+  exaTopicDigestEval,
 } from "./cases/index.ts";
 export type { EvalRunRecord, EvalRunStore } from "./store/store.ts";
 export { createPostgresEvalRunStore } from "./store/pg-store.ts";
diff --git a/packages/evals/src/runner.test.ts b/packages/evals/src/runner.test.ts
index 4a93dd9d7c..d562135f73 100644
--- a/packages/evals/src/runner.test.ts
+++ b/packages/evals/src/runner.test.ts
@@ -241,70 +241,6 @@ test("runMatrix still closes the target when a run throws", async () => {
   expect(closed).toBe(true);
 });
 
-test("runEval drives an install-template step through the target's installTemplate", async () => {
-  const evalDef = defineEval({
-    name: "install",
-    description: "test",
-    steps: [
-      {
-        kind: "install-template",
-        templateId: "code-review",
-        expect: [
-          (ctx) => {
-            expect(ctx.transcript[ctx.turnIndex]?.replyText).toContain(
-              "installed",
-            );
-            return pass("installed");
-          },
-        ],
-      },
-    ],
-  });
-  const installed: string[] = [];
-  const target: Target = {
-    configName: "cfg",
-    async sendTurn() {
-      throw new Error("install-template must never ride sendTurn");
-    },
-    async installTemplate(templateId) {
-      installed.push(templateId);
-      return {
-        human: `(harness) install template "${templateId}"`,
-        replyText: `template "${templateId}" installed`,
-        toolCalls: [],
-      };
-    },
-    async close() {},
-  };
-
-  const result = await runEval(evalDef, target);
-  expect(installed).toEqual(["code-review"]);
-  expect(result.steps[0]?.scorerReports[0]).toMatchObject({
-    name: "installed",
-    pass: true,
-  });
-});
-
-test("runEval fails loudly when an install-template step meets a target without the capability", async () => {
-  const evalDef = defineEval({
-    name: "install-missing",
-    description: "test",
-    steps: [
-      { kind: "install-template", templateId: "code-review", expect: [] },
-    ],
-  });
-  const target: Target = {
-    configName: "cfg",
-    async sendTurn(human) {
-      return { human, replyText: "unreachable", toolCalls: [] };
-    },
-    async close() {},
-  };
-  await expect(runEval(evalDef, target)).rejects.toThrow(
-    "no installTemplate capability",
-  );
-});
-
 test("runEval fires a fire-webhook step against the snapshot's enabled trigger", async () => {
   const evalDef = defineEval({
     name: "fire",
diff --git a/packages/evals/src/runner.ts b/packages/evals/src/runner.ts
index 68502cd8d3..8e663beff2 100644
--- a/packages/evals/src/runner.ts
+++ b/packages/evals/src/runner.ts
@@ -34,15 +34,6 @@ async function playStep(
   if (step.kind === "persona") {
     return runPersonaStep(step, target, personaCall);
   }
-  if (step.kind === "install-template") {
-    if (target.installTemplate === undefined) {
-      throw new Error(
-        `runEval: step installs template "${step.templateId}" but target ` +
-          `"${target.configName}" has no installTemplate capability`,
-      );
-    }
-    return [await target.installTemplate(step.templateId)];
-  }
   if (step.kind === "fire-webhook") {
     if (target.fireWebhook === undefined) {
       throw new Error(
diff --git a/packages/evals/src/targets/real-target.ts b/packages/evals/src/targets/real-target.ts
index 06c929bf7e..61fd0811da 100644
--- a/packages/evals/src/targets/real-target.ts
+++ b/packages/evals/src/targets/real-target.ts
@@ -26,11 +26,6 @@ import { createGitWorkflowPusher } from "./git-workflow-push";
 import { createHubAPI, type ApiCall } from "@corbits/hub-api-client";
 import { getLogger } from "@intx/log";
 import { completeCredentialSetup } from "@workbench/onboarding";
-import {
-  instantiateWorkbenchTemplate,
-  parseWorkbenchDefinition,
-  templateSettingsPatch,
-} from "@workbench/templates";
 import {
   signPayload,
   WEBHOOK_SIGNATURE_HEADER,
@@ -674,168 +669,6 @@ export async function bootMyraTarget(
       ];
     }
 
-    // The REAL install path (#140): the exact surfaces
-    // `apps/web/src/instant-agent-create.ts`'s
-    // `createWorkbenchFromTemplate` drives — seeded-library definition
-    // read, workbench mint, `instantiateWorkbenchTemplate` over
-    // HTTP-bound ports — never an eval-only instantiation mechanism.
-    // The library read is also what seeds this scratch tenant's shelf
-    // (CL-6458), so a passing install proves convergence on first read.
-    async function installTemplate(templateId: string): Promise<Turn> {
-      const entryRes = await api(
-        hub.baseUrl,
-        "GET",
-        `/api/tenants/${seeded.tenantId}/library/templates/${templateId}`,
-        undefined,
-        cookies,
-      );
-      expectStatus(`fetch seeded template "${templateId}"`, entryRes, 200);
-      const definition = parseWorkbenchDefinition(
-        stringField(entryRes.data, "content", `template "${templateId}"`),
-      );
-
-      // Hostless, exactly as the web create flow mints it: a template
-      // room has no `definitionId` and nobody is hosted in it.
-      const createBody: Record<string, unknown> = {
-        kind: "workbench",
-        name: definition.title,
-      };
-      const createRes = await api(
-        hub.baseUrl,
-        "POST",
-        `/api/tenants/${seeded.tenantId}/chat/workbenches`,
-        createBody,
-        cookies,
-      );
-      expectStatus(`create workbench from "${templateId}"`, createRes, 201);
-      const workbenchId = stringField(
-        createRes.data,
-        "id",
-        `create workbench from "${templateId}"`,
-      );
-
-      const result = await instantiateWorkbenchTemplate(definition, {
-        async listAgentHandles() {
-          const res = await api(
-            hub.baseUrl,
-            "GET",
-            `/api/tenants/${seeded.tenantId}/workflows/definitions?limit=100`,
-            undefined,
-            cookies,
-          );
-          expectStatus("list agent definitions", res, 200);
-          const rows = arrayField(
-            res.data,
-            "data",
-            "list agent definitions",
-          ) as { name: string; id: string }[];
-          return rows.map((row) => ({ handle: row.name, id: row.id }));
-        },
-        async createParticipantAgent(request) {
-          const res = await api(
-            hub.baseUrl,
-            "POST",
-            `/api/tenants/${seeded.tenantId}/agent-definitions`,
-            request,
-            cookies,
-          );
-          if (res.status !== 200 && res.status !== 201) {
-            throw new Error(
-              `create participant agent "${request.handle}" returned ` +
-                `${String(res.status)}: ${JSON.stringify(res.data)}`,
-            );
-          }
-          return {
-            id: stringField(res.data, "id", `created "${request.handle}"`),
-          };
-        },
-        async inviteParticipantAgent(id) {
-          const res = await api(
-            hub.baseUrl,
-            "POST",
-            `/api/tenants/${seeded.tenantId}/chat/workbenches/${workbenchId}/invite`,
-            { definitionId: id },
-            cookies,
-          );
-          if (res.status !== 200 && res.status !== 201) {
-            throw new Error(
-              `invite participant agent "${id}" returned ` +
-                `${String(res.status)}: ${JSON.stringify(res.data)}`,
-            );
-          }
-        },
-        async deployBlockWorkflow(block) {
-          const res = await api(
-            hub.baseUrl,
-            "POST",
-            `/api/tenants/${seeded.tenantId}/template-blocks/${block.assetName}/deploy`,
-            undefined,
-            cookies,
-          );
-          if (res.status !== 200 && res.status !== 201) {
-            throw new Error(
-              `deploy template block "${block.assetName}" returned ` +
-                `${String(res.status)}: ${JSON.stringify(res.data)}`,
-            );
-          }
-          return { created: res.status === 201 };
-        },
-        async recordPendingConnections(pendingConnections) {
-          const res = await api(
-            hub.baseUrl,
-            "PATCH",
-            `/api/tenants/${seeded.tenantId}/chat/workbenches/${workbenchId}/settings`,
-            templateSettingsPatch(definition.id, pendingConnections),
-            cookies,
-          );
-          expectStatus("record pending connections", res, 200);
-        },
-        async beginOnboarding(steps) {
-          for (const step of steps) {
-            if (step.kind !== "connect-plugin") continue;
-            const res = await api(
-              hub.baseUrl,
-              "POST",
-              `/api/tenants/${seeded.tenantId}/chat/workbenches/${workbenchId}/onboarding`,
-              {
-                kind: "connect-github",
-                requiredForTemplate: definition.title,
-                promise: definition.promise,
-                steps: steps.map(({ title, why }) => ({ title, why })),
-              },
-              cookies,
-            );
-            expectStatus("post the onboarding walkthrough card", res, 201);
-          }
-        },
-      });
-
-      // Hub-zero T3 (CL-8114): the hub's workbench-scoped GitHub
-      // state/start-reviewing routes are deleted with no native
-      // equivalent yet, so this harness no longer drives the card's
-      // repo-pick walkthrough — the per-repo grant and
-      // `webhook_trigger` rows the fire-webhook step needs now come
-      // from a connections follow-up. The install honestly reports
-      // zero started triggers until then.
-      const startedTriggerCount = 0;
-      if (definition.plugins.required.includes("github")) {
-        // TODO(connections-follow-up): rebind the repo-pick walkthrough
-        // to the native tenant-scoped repo-review setup once it exists.
-      }
-
-      return {
-        human: `(harness) install template "${templateId}"`,
-        replyText:
-          `template "${templateId}" installed into workbench ${workbenchId}: ` +
-          `created [${result.createdHandles.join(", ")}], ` +
-          `skipped [${result.skippedHandles.join(", ")}], ` +
-          `deployed blocks [${result.deployedBlockAssetNames.join(", ")}], ` +
-          `pending connections [${result.pendingConnections.join(", ")}], ` +
-          `webhook triggers started: ${String(startedTriggerCount)}`,
-        toolCalls: [],
-      };
-    }
-
     // Fires a trigger through the REAL ingress route
     // (`POST /api/webhooks/:triggerId`), HMAC-signed the way any
     // external sender signs. The signing secret is read off the
@@ -902,7 +735,6 @@ export async function bootMyraTarget(
     return {
       configName: config.name,
       sendTurn,
-      installTemplate,
       fireWebhook,
       close: closeAll,
       ...(captureWorldSnapshot === undefined
diff --git a/packages/evals/src/targets/world-snapshot.ts b/packages/evals/src/targets/world-snapshot.ts
index feee7c4fd4..0263bf4069 100644
--- a/packages/evals/src/targets/world-snapshot.ts
+++ b/packages/evals/src/targets/world-snapshot.ts
@@ -31,7 +31,7 @@ import {
   connectorDescriptors,
   listMcpServerConnections,
 } from "@corbits/connections";
-import { CONNECTOR_REGISTRY } from "@workbench/templates/connectors";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 
 import type { FakeReceipt, WorldSnapshot } from "../types.ts";
 
diff --git a/packages/evals/src/types.ts b/packages/evals/src/types.ts
index e83cd35cdf..6a9659900b 100644
--- a/packages/evals/src/types.ts
+++ b/packages/evals/src/types.ts
@@ -145,17 +145,6 @@ export interface PersonaEvalStep {
   readonly expect: readonly Scorer[];
 }
 
-/** A harness step that installs a workbench template through the real
- * install path (#140's seeded-library instantiation): fetch the seeded
- * manifest, mint the workbench, create the participant agent
- * definitions, record pending connections — never a chat narration of
- * the install. Requires a `Target` with `installTemplate`. */
-export interface InstallTemplateEvalStep {
-  readonly kind: "install-template";
-  readonly templateId: string;
-  readonly expect: readonly Scorer[];
-}
-
 /** A harness step that fires the tenant's enabled `webhook_trigger`
  * through the real ingress route (`POST /api/webhooks/:triggerId`,
  * HMAC-signed) with `payload` as the delivery body. Requires a `Target`
@@ -169,11 +158,7 @@ export interface FireWebhookEvalStep {
   readonly expect: readonly Scorer[];
 }
 
-export type EvalStep =
-  | ScriptedEvalStep
-  | PersonaEvalStep
-  | InstallTemplateEvalStep
-  | FireWebhookEvalStep;
+export type EvalStep = ScriptedEvalStep | PersonaEvalStep | FireWebhookEvalStep;
 
 export interface EvalDefinition {
   readonly name: string;
@@ -208,10 +193,6 @@ export interface Target {
   readonly configName: string;
   sendTurn(human: string): Promise<Turn>;
   snapshotWorld?(): Promise<WorldSnapshot>;
-  /** Installs a seeded workbench template through the real install
-   * surfaces (library read → workbench mint → participant creation);
-   * the returned `Turn` records what the install actually did. */
-  installTemplate?(templateId: string): Promise<Turn>;
   /** Fires one webhook trigger through the real ingress route with a
    * properly signed delivery; the returned `Turn` records the
    * accepted launch (`instanceId`). */

From 9c5f3e9008e9c4307e3ba54a0c8f68c9299f2efa Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Thu, 17 Sep 2026 10:24:20 -0700
Subject: [PATCH 5/8] feat(web)!: delete workbench template picking; a new
 workbench is a plain tenant + Myra

Deletes the template-picker feature entirely: workbench-templates.ts,
workbench-templates-api.ts, the prefab card grid and library read in
new-workbench-picker.tsx, and createWorkbenchFromTemplate's
instantiation path in instant-agent-create.ts (now just createWorkbench:
mint a blank room, optionally invite selected agents, send an opening
message). The picker keeps its prompt box, agent picker, and empty-
channel button -- the readiness gate (Myra must be deployed before a
room can invite anyone) is unchanged.

@corbits/chat-ui's Jimmy quick-create row now builds its create-agent
request straight off @corbits/jimmy-agent/metadata instead of through
the deleted @workbench/templates barrel.

Every other @workbench/templates import (WORKFLOW_CATALOG,
CONNECTOR_REGISTRY, MCP_PRESETS, ...) is repointed at its native home:
@corbits/workflows/catalog and @corbits/connections/{registry,mcp-presets}.

Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
---
 apps/web/package.json                         |    1 -
 apps/web/src/client-bootstrap.ts              |    2 +-
 apps/web/src/connect-service-actions.ts       |    7 +-
 apps/web/src/instant-agent-create.test.ts     |  532 +-------
 apps/web/src/instant-agent-create.ts          |  238 +---
 apps/web/src/myra-workbench.ts                |    2 +-
 .../src/pages/new-workbench-picker.test.ts    |  111 --
 apps/web/src/pages/new-workbench-picker.tsx   |  205 +--
 apps/web/src/pages/plugins-page.tsx           |    6 +-
 apps/web/src/pages/routines-page.tsx          |    4 +-
 apps/web/src/routines-api.ts                  |   20 +
 apps/web/src/shell/provider-health-banner.tsx |    2 +-
 apps/web/src/workbench-templates-api.ts       |  115 --
 apps/web/src/workbench-templates.ts           |   40 -
 apps/web/test/create-agent-panel.test.tsx     |    4 +-
 apps/web/test/new-workbench-picker.test.tsx   | 1110 -----------------
 .../test/routines-available-section.test.tsx  |   10 +-
 packages/chat-ui/package.json                 |    2 +-
 packages/chat-ui/src/api.ts                   |   30 +-
 19 files changed, 179 insertions(+), 2262 deletions(-)
 delete mode 100644 apps/web/src/pages/new-workbench-picker.test.ts
 delete mode 100644 apps/web/src/workbench-templates-api.ts
 delete mode 100644 apps/web/src/workbench-templates.ts
 delete mode 100644 apps/web/test/new-workbench-picker.test.tsx

diff --git a/apps/web/package.json b/apps/web/package.json
index 805d5f1864..0869ad3c47 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -46,7 +46,6 @@
     "@radix-ui/react-slot": "^1.2.3",
     "@tanstack/react-query": "catalog:",
     "@corbits/connections": "workspace:*",
-    "@workbench/templates": "workspace:*",
     "arktype": "catalog:",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
diff --git a/apps/web/src/client-bootstrap.ts b/apps/web/src/client-bootstrap.ts
index b720863b85..bd575cfdb6 100644
--- a/apps/web/src/client-bootstrap.ts
+++ b/apps/web/src/client-bootstrap.ts
@@ -11,7 +11,7 @@
 // config — this module never guesses them. When stock Interchange lacks a
 // capability the result carries the typed gap instead of throwing.
 
-import { WORKFLOW_CATALOG } from "@workbench/templates";
+import { WORKFLOW_CATALOG } from "@corbits/workflows/catalog";
 
 import type { ClientLogger } from "@corbits/client-log";
 
diff --git a/apps/web/src/connect-service-actions.ts b/apps/web/src/connect-service-actions.ts
index d4f1369847..27edc03141 100644
--- a/apps/web/src/connect-service-actions.ts
+++ b/apps/web/src/connect-service-actions.ts
@@ -31,11 +31,8 @@ import {
   listMcpPresets,
   McpServersApiError,
 } from "@corbits/plugins-ui";
-import { mcpPresetBySlug } from "@corbits/connections/mcp-presets";
-import {
-  CONNECTOR_REGISTRY,
-  MCP_PRESETS,
-} from "@workbench/templates/connectors";
+import { mcpPresetBySlug, MCP_PRESETS } from "@corbits/connections/mcp-presets";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 
 function bareConnectorId(connectorId: string): string {
   return connectorId.startsWith("mcp:")
diff --git a/apps/web/src/instant-agent-create.test.ts b/apps/web/src/instant-agent-create.test.ts
index 0b8918d65f..afb690f471 100644
--- a/apps/web/src/instant-agent-create.test.ts
+++ b/apps/web/src/instant-agent-create.test.ts
@@ -1,14 +1,11 @@
-import { afterEach, describe, expect, spyOn, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import { QueryClient } from "@tanstack/react-query";
-import {
-  CODE_REVIEW_TEMPLATE,
-  serializeWorkbenchDefinition,
-} from "@workbench/templates";
 
 import {
-  createWorkbenchFromTemplate,
+  createWorkbench,
   NEW_WORKBENCH_TITLE,
   WorkbenchPostCreateError,
+  WorkbenchPreconditionError,
 } from "./instant-agent-create";
 
 function newQueryClient(): QueryClient {
@@ -17,7 +14,7 @@ function newQueryClient(): QueryClient {
   });
 }
 
-describe("createWorkbenchFromTemplate", () => {
+describe("createWorkbench", () => {
   const realFetch = globalThis.fetch;
 
   afterEach(() => {
@@ -54,11 +51,7 @@ describe("createWorkbenchFromTemplate", () => {
     skills: [] as readonly string[],
   };
 
-  // The picker's "Create workbench" is clickable more than once per
-  // session (a second visit, a second row) — each click must mint its
-  // own, genuinely distinct workbench, never reopen or alias the last
-  // one it created.
-  test("picking the same row twice in a row mints two distinct workbenches, not one reused", async () => {
+  test("mints two distinct workbenches on two calls, never reusing one", async () => {
     let nextId = 0;
     const navigated: string[] = [];
     const calls = stubFetch((path) => {
@@ -78,15 +71,13 @@ describe("createWorkbenchFromTemplate", () => {
       throw new Error(`unexpected fetch: ${path}`);
     });
 
-    await createWorkbenchFromTemplate(
+    await createWorkbench(
       "tnt_1",
-      "blank",
       (to) => navigated.push(to),
       newQueryClient(),
     );
-    await createWorkbenchFromTemplate(
+    await createWorkbench(
       "tnt_1",
-      "blank",
       (to) => navigated.push(to),
       newQueryClient(),
     );
@@ -97,354 +88,33 @@ describe("createWorkbenchFromTemplate", () => {
     expect(createCalls).toHaveLength(2);
     expect(navigated).toEqual(["/w/chan-1", "/w/chan-2"]);
     expect(navigated[0]).not.toBe(navigated[1]);
-
-    // Blank ("Just start talking") has no template to name the bench
-    // after, so it keeps the generic title rather than something
-    // invented.
     const body = JSON.parse(String(createCalls[0]?.init?.body));
     expect(body.name).toBe(NEW_WORKBENCH_TITLE);
-  });
-
-  // CL-6982: the + / picker create path mints a `kind: "workbench"`
-  // channel, never a Myra DM clone (`kind: "chat"` + `definitionId`).
-  test("blank create POSTs kind=workbench with no definitionId and invites nobody (CL-6982)", async () => {
-    const calls = stubFetch((path) => {
-      if (path.includes("/workflows/definitions")) {
-        return json({ data: [assistantDefinitionWire], nextCursor: null });
-      }
-      if (path.endsWith("/chat/workbenches")) {
-        return json({
-          id: "chan-1",
-          title: NEW_WORKBENCH_TITLE,
-          kind: "workbench",
-          pinned: true,
-          participants: [],
-        });
-      }
-      throw new Error(`unexpected fetch: ${path}`);
-    });
-
-    await createWorkbenchFromTemplate(
-      "tnt_1",
-      "blank",
-      () => undefined,
-      newQueryClient(),
-    );
-
-    const createCall = calls.find((call) =>
-      call.path.endsWith("/chat/workbenches"),
-    );
-    const body = JSON.parse(String(createCall?.init?.body)) as {
-      readonly kind?: string;
-      readonly definitionId?: string;
-      readonly reuseExisting?: boolean;
-      readonly name?: string;
-    };
     expect(body.kind).toBe("workbench");
     expect(body.definitionId).toBeUndefined();
-    expect(body.reuseExisting).toBeUndefined();
-    expect(body.name).toBe(NEW_WORKBENCH_TITLE);
-    expect(calls.some((call) => call.path.includes("/invite"))).toBe(false);
-  });
-
-  test("a blank intent carries selected agents in its pre-invite message", async () => {
-    const calls = stubFetch((path) => {
-      if (path.includes("/workflows/definitions")) {
-        return json({ data: [assistantDefinitionWire], nextCursor: null });
-      }
-      if (path.endsWith("/chat/workbenches")) {
-        return json({
-          id: "chan-1",
-          title: NEW_WORKBENCH_TITLE,
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-        });
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/messages")) {
-        return json({ id: "msg-1", createdAt: "2026-01-01T00:00:00.000Z" });
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/settings")) {
-        return json({
-          id: "chan-1",
-          title: "Research our next partner",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-          settings: {},
-          contextWindow: { value: 0, source: "inherit" },
-        });
-      }
-      throw new Error(`unexpected fetch: ${path}`);
-    });
-
-    await createWorkbenchFromTemplate(
-      "tnt_1",
-      "blank",
-      () => undefined,
-      newQueryClient(),
-      "Research our next partner",
-      ["def-scout", "def-scout", "def-quill"],
-    );
-
-    const createCallIndex = calls.findIndex((call) =>
-      call.path.endsWith("/chat/workbenches"),
-    );
-    const messageCallIndex = calls.findIndex((call) =>
-      call.path.endsWith("/chat/workbenches/chan-1/messages"),
-    );
-    const messageCall = calls[messageCallIndex];
-    expect(createCallIndex).toBeLessThan(messageCallIndex);
-    expect(JSON.parse(String(messageCall?.init?.body))).toEqual({
-      parts: [{ kind: "text", text: "Research our next partner" }],
-      invite: [
-        { kind: "agent", definitionId: "def-scout" },
-        { kind: "agent", definitionId: "def-quill" },
-      ],
-    });
-    expect(calls.some((call) => call.path.endsWith("/invite"))).toBe(false);
-  });
-
-  test("opens the new room while its sidebar refresh is still in flight", async () => {
-    const navigated: string[] = [];
-    let finishRefresh: (() => void) | undefined;
-    const refresh = new Promise<void>((resolve) => {
-      finishRefresh = resolve;
-    });
-    const queryClient = newQueryClient();
-    const invalidate = spyOn(
-      queryClient,
-      "invalidateQueries",
-    ).mockImplementation(() => refresh);
-    stubFetch((path) => {
-      if (path.includes("/workflows/definitions")) {
-        return json({ data: [assistantDefinitionWire], nextCursor: null });
-      }
-      if (path.endsWith("/chat/workbenches")) {
-        return json({
-          id: "chan-ready-now",
-          title: NEW_WORKBENCH_TITLE,
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-        });
-      }
-      if (path.endsWith("/chat/workbenches/chan-ready-now/messages")) {
-        return json({ id: "msg-1", createdAt: "2026-01-01T00:00:00.000Z" });
-      }
-      if (path.endsWith("/chat/workbenches/chan-ready-now/settings")) {
-        return json({
-          id: "chan-ready-now",
-          title: "Ship the release",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-          settings: {},
-          contextWindow: { value: 0, source: "inherit" },
-        });
-      }
-      throw new Error(`unexpected fetch: ${path}`);
-    });
-
-    try {
-      const completed = await Promise.race([
-        createWorkbenchFromTemplate(
-          "tnt_1",
-          "blank",
-          (to) => navigated.push(to),
-          queryClient,
-          "Ship the release",
-          ["def-assistant"],
-        ).then(() => "completed"),
-        new Promise<"timed out">((resolve) => {
-          setTimeout(() => resolve("timed out"), 50);
-        }),
-      ]);
-
-      expect(completed).toBe("completed");
-      expect(navigated).toEqual(["/w/chan-ready-now"]);
-    } finally {
-      finishRefresh?.();
-      invalidate.mockRestore();
-    }
   });
 
-  test("an opening-message failure leaves a minted blank workbench recoverable", async () => {
-    const navigated: string[] = [];
+  test("fails with WorkbenchPreconditionError when Myra isn't deployed yet", async () => {
     stubFetch((path) => {
       if (path.includes("/workflows/definitions")) {
-        return json({ data: [assistantDefinitionWire], nextCursor: null });
-      }
-      if (path.endsWith("/chat/workbenches")) {
-        return json({
-          id: "chan-recoverable",
-          title: NEW_WORKBENCH_TITLE,
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-        });
-      }
-      if (path.endsWith("/chat/workbenches/chan-recoverable/messages")) {
-        return json({ error: "agent launch failed" }, 409);
+        return json({ data: [], nextCursor: null });
       }
       throw new Error(`unexpected fetch: ${path}`);
     });
 
     let cause: unknown;
     try {
-      await createWorkbenchFromTemplate(
-        "tnt_1",
-        "blank",
-        (to) => navigated.push(to),
-        newQueryClient(),
-        "Research our next partner",
-        ["def-scout"],
-      );
+      await createWorkbench("tnt_1", () => undefined, newQueryClient());
     } catch (error) {
       cause = error;
     }
-
-    expect(cause).toBeInstanceOf(WorkbenchPostCreateError);
-    if (!(cause instanceof WorkbenchPostCreateError)) {
-      throw new Error("expected a recoverable post-create error");
-    }
-    expect(cause.workbenchId).toBe("chan-recoverable");
-    expect(cause.stage).toBe("opening-message");
-    expect(navigated).toEqual([]);
-  });
-
-  test("picking the code-review definition names the bench after it and invites exactly its three reviewers", async () => {
-    const navigated: string[] = [];
-    let nextReviewerId = 0;
-    const calls = stubFetch((path) => {
-      if (path.includes("/workflows/definitions")) {
-        return json({ data: [assistantDefinitionWire], nextCursor: null });
-      }
-      if (path.endsWith("/library/templates/code-review")) {
-        return json({
-          id: "code-review",
-          content: serializeWorkbenchDefinition(CODE_REVIEW_TEMPLATE),
-        });
-      }
-      if (path.endsWith("/chat/workbenches")) {
-        return json({
-          id: "chan-1",
-          title: "Code review",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-        });
-      }
-      if (path.endsWith("/template-blocks/code-review/deploy")) {
-        return json({ id: "def-code-review-block", created: true });
-      }
-      if (path.endsWith("/agent-definitions")) {
-        nextReviewerId += 1;
-        return json({
-          ...assistantDefinitionWire,
-          id: `def-reviewer-${nextReviewerId}`,
-        });
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/onboarding")) {
-        return json({ id: "msg-onboarding" }, 201);
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/invite")) {
-        return json({ address: "agent:invited", definitionId: "def-reviewer" });
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/settings")) {
-        return json({
-          id: "chan-1",
-          title: "Code review",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-          settings: {},
-          contextWindow: { value: 0, source: "inherit" },
-        });
-      }
-      throw new Error(`unexpected fetch: ${path}`);
-    });
-
-    const queryClient = newQueryClient();
-    // Seed the cache the way a person browsing before creating this
-    // workbench would have: a `workbenches` list fetched before any of
-    // the reviewer roster below was invited.
-    const staleQueryKey = ["tenant", "tnt_1", "workbenches", "chat"] as const;
-    queryClient.setQueryData(staleQueryKey, { items: [] });
-
-    await createWorkbenchFromTemplate(
-      "tnt_1",
-      "code-review",
-      (to) => navigated.push(to),
-      queryClient,
-    );
-
-    const createCall = calls.find((call) =>
-      call.path.endsWith("/chat/workbenches"),
-    );
-    const createBody = JSON.parse(String(createCall?.init?.body));
-    expect(createBody.name).toBe(CODE_REVIEW_TEMPLATE.title);
-
-    const createAgentCalls = calls.filter((call) =>
-      call.path.endsWith("/agent-definitions"),
-    );
-    expect(createAgentCalls).toHaveLength(CODE_REVIEW_TEMPLATE.agents.length);
-
-    const inviteCalls = calls.filter((call) =>
-      call.path.endsWith("/chat/workbenches/chan-1/invite"),
-    );
-    const invitedIds = inviteCalls.map(
-      (call) => JSON.parse(String(call.init?.body)).definitionId,
-    );
-    const createdIds = createAgentCalls.map(
-      (_, index) => `def-reviewer-${index + 1}`,
+    expect(cause).toBeInstanceOf(WorkbenchPreconditionError);
+    expect((cause as WorkbenchPreconditionError).kind).toBe(
+      "setup-agent-missing",
     );
-    expect(invitedIds.sort()).toEqual([...createdIds].sort());
-    expect(invitedIds).not.toContain("def-assistant");
-
-    const settingsBody = JSON.parse(
-      String(
-        calls.find((call) =>
-          call.path.endsWith("/chat/workbenches/chan-1/settings"),
-        )?.init?.body,
-      ),
-    );
-    expect(settingsBody).toEqual({
-      "template/id": "code-review",
-      "template/pendingConnections": ["github"],
-    });
-
-    const onboardingCall = calls.find((call) =>
-      call.path.endsWith("/chat/workbenches/chan-1/onboarding"),
-    );
-    expect(JSON.parse(String(onboardingCall?.init?.body))).toEqual({
-      kind: "connect-github",
-      requiredForTemplate: "Code review",
-      promise: CODE_REVIEW_TEMPLATE.promise,
-      steps: CODE_REVIEW_TEMPLATE.onboardingSteps.map(({ title, why }) => ({
-        title,
-        why,
-      })),
-    });
-
-    const createBodyParsed = JSON.parse(String(createCall?.init?.body));
-    expect(createBodyParsed.kind).toBe("workbench");
-    expect(createBodyParsed.definitionId).toBeUndefined();
-    expect(navigated).toEqual(["/w/chan-1"]);
-
-    // CL-6594: a room this function navigates to must never carry a
-    // `workbenches` cache captured before its own reviewer roster
-    // finished being invited — that staleness is what left an invited
-    // agent with no name, no avatar, and no `@mention` in the room the
-    // owner reported it from.
-    expect(queryClient.getQueryState(staleQueryKey)?.isInvalidated).toBe(true);
   });
 
-  // CL-6656: the prompt-box path mints a blank "New Workbench" and used to
-  // leave that placeholder in the sidebar forever. With a known first
-  // message, create renames via the same `chat/name` settings PATCH the
-  // sidebar rename uses.
-  test("blank create with a first message renames off New Workbench via chat/name", async () => {
+  test("a first message renames the room off New Workbench via chat/name", async () => {
     const navigated: string[] = [];
     const calls = stubFetch((path) => {
       if (path.includes("/workflows/definitions")) {
@@ -481,9 +151,8 @@ describe("createWorkbenchFromTemplate", () => {
       throw new Error(`unexpected fetch: ${path}`);
     });
 
-    await createWorkbenchFromTemplate(
+    await createWorkbench(
       "tnt_1",
-      "blank",
       (to) => navigated.push(to),
       newQueryClient(),
       "Plan the Q3 launch",
@@ -492,174 +161,49 @@ describe("createWorkbenchFromTemplate", () => {
     const settingsCall = calls.find((call) =>
       call.path.endsWith("/chat/workbenches/chan-adhoc/settings"),
     );
-    expect(settingsCall).toBeDefined();
     expect(JSON.parse(String(settingsCall?.init?.body))).toEqual({
       "chat/name": "Plan the Q3 launch",
     });
     expect(navigated).toEqual(["/w/chan-adhoc"]);
   });
 
-  test("prefab create with a first message does not overwrite the template title", async () => {
-    const calls = stubFetch((path) => {
-      if (path.includes("/workflows/definitions")) {
-        return json({ data: [assistantDefinitionWire], nextCursor: null });
-      }
-      if (path.endsWith("/library/templates/code-review")) {
-        return json({
-          id: "code-review",
-          content: serializeWorkbenchDefinition(CODE_REVIEW_TEMPLATE),
-        });
-      }
-      if (path.endsWith("/chat/workbenches")) {
-        return json({
-          id: "chan-1",
-          title: "Code review",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-        });
-      }
-      if (path.endsWith("/template-blocks/code-review/deploy")) {
-        return json({ id: "def-code-review-block", created: true });
-      }
-      if (path.endsWith("/agent-definitions")) {
-        return json({ ...assistantDefinitionWire, id: "def-reviewer-1" });
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/onboarding")) {
-        return json({ id: "msg-onboarding" }, 201);
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/invite")) {
-        return json({
-          address: "agent:invited",
-          definitionId: "def-reviewer-1",
-        });
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/settings")) {
-        return json({
-          id: "chan-1",
-          title: "Code review",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-          settings: {},
-          contextWindow: { value: 0, source: "inherit" },
-        });
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/messages")) {
-        return json({
-          id: "msg-1",
-          createdAt: "2026-01-01T00:00:00.000Z",
-          sender: { name: "Sawyer", address: "principal-1" },
-          parts: [{ kind: "text", text: "Review the auth PR" }],
-        });
-      }
-      throw new Error(`unexpected fetch: ${path}`);
-    });
-
-    await createWorkbenchFromTemplate(
-      "tnt_1",
-      "code-review",
-      () => {},
-      newQueryClient(),
-      "Review the auth PR",
-    );
-
-    const settingsBodies = calls
-      .filter((call) => call.path.endsWith("/chat/workbenches/chan-1/settings"))
-      .map((call) => JSON.parse(String(call.init?.body)));
-    expect(
-      settingsBodies.some(
-        (body) =>
-          typeof body === "object" &&
-          body !== null &&
-          "chat/name" in body &&
-          body["chat/name"] === "Review the auth PR",
-      ),
-    ).toBe(false);
-  });
-
-  // GitHub already connected is not a different create path: the in-room
-  // card reads live connected state and flips itself to repo pick, so the
-  // create flow posts the same walkthrough card and never picks repos or
-  // starts reviewing on the person's behalf.
-  test("with GitHub already connected, create posts the same walkthrough and never starts reviewing itself", async () => {
-    const calls = stubFetch((path) => {
+  test("an opening-message failure leaves a minted workbench recoverable", async () => {
+    stubFetch((path) => {
       if (path.includes("/workflows/definitions")) {
         return json({ data: [assistantDefinitionWire], nextCursor: null });
       }
-      if (path.endsWith("/library/templates/code-review")) {
-        return json({
-          id: "code-review",
-          content: serializeWorkbenchDefinition(CODE_REVIEW_TEMPLATE),
-        });
-      }
       if (path.endsWith("/chat/workbenches")) {
         return json({
-          id: "chan-1",
-          title: "Code review",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-        });
-      }
-      if (path.endsWith("/template-blocks/code-review/deploy")) {
-        return json({ id: "def-code-review-block", created: true });
-      }
-      if (path.endsWith("/agent-definitions")) {
-        return json({ ...assistantDefinitionWire, id: "def-reviewer-1" });
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/onboarding")) {
-        return json({ id: "msg-onboarding" }, 201);
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/invite")) {
-        return json({ address: "agent:invited", definitionId: "def-reviewer" });
-      }
-      if (path.endsWith("/chat/workbenches/chan-1/settings")) {
-        return json({
-          id: "chan-1",
-          title: "Code review",
+          id: "chan-recoverable",
+          title: NEW_WORKBENCH_TITLE,
           kind: "workbench",
           pinned: false,
           participants: [],
-          settings: {},
-          contextWindow: { value: 0, source: "inherit" },
         });
       }
-      if (path.includes("/credentials/resolve/")) {
-        return json({
-          id: "cred_github",
-          tenantId: "tnt_1",
-          name: "GitHub",
-          status: "active",
-        });
+      if (path.endsWith("/chat/workbenches/chan-recoverable/messages")) {
+        return json({ error: "agent launch failed" }, 409);
       }
       throw new Error(`unexpected fetch: ${path}`);
     });
 
-    await createWorkbenchFromTemplate(
-      "tnt_1",
-      "code-review",
-      () => undefined,
-      newQueryClient(),
-    );
+    let cause: unknown;
+    try {
+      await createWorkbench(
+        "tnt_1",
+        () => undefined,
+        newQueryClient(),
+        "Research our next partner",
+      );
+    } catch (error) {
+      cause = error;
+    }
 
-    const onboardingCall = calls.find((call) =>
-      call.path.endsWith("/chat/workbenches/chan-1/onboarding"),
-    );
-    expect(JSON.parse(String(onboardingCall?.init?.body))).toEqual({
-      kind: "connect-github",
-      requiredForTemplate: "Code review",
-      promise: CODE_REVIEW_TEMPLATE.promise,
-      steps: CODE_REVIEW_TEMPLATE.onboardingSteps.map(({ title, why }) => ({
-        title,
-        why,
-      })),
-    });
-    expect(calls.some((call) => call.path.includes("/github/state"))).toBe(
-      false,
-    );
-    expect(
-      calls.some((call) => call.path.includes("/github/start-reviewing")),
-    ).toBe(false);
+    expect(cause).toBeInstanceOf(WorkbenchPostCreateError);
+    if (!(cause instanceof WorkbenchPostCreateError)) {
+      throw new Error("expected a recoverable post-create error");
+    }
+    expect(cause.workbenchId).toBe("chan-recoverable");
+    expect(cause.stage).toBe("opening-message");
   });
 });
diff --git a/apps/web/src/instant-agent-create.ts b/apps/web/src/instant-agent-create.ts
index 9bd20e5018..416da7eef8 100644
--- a/apps/web/src/instant-agent-create.ts
+++ b/apps/web/src/instant-agent-create.ts
@@ -1,39 +1,27 @@
 // Every "create a workbench" affordance — the sidebar's "+", the command
 // palette's "New workbench", and the zero-workbench land-hop on `/` —
-// opens the template picker (`pages/new-workbench-picker.tsx`) and calls
-// `createWorkbenchFromTemplate` below once a row is chosen. Blank `+`
-// mints an empty `kind: "workbench"` channel (no host, no definitionId).
-// A named workbench definition mints that same empty channel, then
-// instantiates what the definition describes — its agents, its block
-// workflows, its pending plugins — and runs the definition's own
-// onboarding walkthrough in the room. Explicitly defining a brand-new
+// opens the picker (`pages/new-workbench-picker.tsx`) and calls
+// `createWorkbench` below once a person hits Create. CL-8156 deleted
+// workbench template picking (`@workbench/templates`): a new workbench is
+// a plain tenant + Myra now (CL-8154's converge path deploys Myra), so
+// this mints an empty `kind: "workbench"` channel — no host, no
+// definitionId — and, when the prompt box supplied an opening message,
+// sends it and renames the room off it. Explicitly defining a brand-new
 // agent, with its own name/purpose/model/skills chosen up front, stays
 // `CreateAgentPanel`'s job (Settings → Agents), unchanged.
 
 import type { QueryClient } from "@tanstack/react-query";
 import {
-  createWorkbench,
+  createWorkbench as createWorkbenchChannel,
   inviteAgent,
   partsForSend,
   patchWorkbenchSettings,
-  postWorkbenchOnboardingStep,
   sendMessage,
   workbenchesQueryKeyPrefix,
 } from "@corbits/chat-ui";
-import {
-  instantiateWorkbenchTemplate,
-  templateSettingsPatch,
-  type WorkbenchDefinition,
-  type WorkbenchOnboardingStep,
-} from "@workbench/templates";
 import { reportError } from "@corbits/error-sink";
 
-import {
-  deployWorkbenchTemplateBlock,
-  fetchWorkbenchTemplateManifest,
-} from "./workbench-templates-api";
-
-import { createAgentDefinition, listAgentDefinitions } from "./agents-api";
+import { listAgentDefinitions } from "./agents-api";
 import {
   autoNameFromFirstMessage,
   NEW_WORKBENCH_TITLE,
@@ -41,8 +29,6 @@ import {
 import { findMyraDefinition } from "./myra-workbench";
 import { workbenchPath } from "./workbench-path";
 
-import type { WorkbenchTemplateId } from "./workbench-templates";
-
 export { NEW_WORKBENCH_TITLE };
 
 export function refreshWorkbenchLists(
@@ -64,30 +50,18 @@ export function refreshWorkbenchLists(
 }
 
 /**
- * Marks the two precondition failures below as intentionally
- * user-facing: their `message` is authored copy, never a raw request
- * path or schema summary, so a caller can show it verbatim. Every
- * other throw on this path (`ApiQueryError`, `ChatApiError`, or a
- * plain `Error` from a package that hasn't opted in) must go through
- * that error type's own describer instead — allow-listing safe
- * throws, rather than denylisting unsafe ones, so a new error type
- * added later fails safe (masked) instead of leaking by default.
- *
- * `kind` lets a caller tell "the setup agent isn't deployed yet" apart
- * from "this template genuinely doesn't exist here" without parsing
- * `message` text: the first is very often a still-provisioning bench
- * (CL-6457's background deploy hasn't finished, or never started
- * without a credential) — `createWorkbenchFromTemplate` throws it only
- * after its own native definitions read found no setup agent, so that
- * read already is the readiness check and the caller can dead-end
- * honestly; the second never resolves itself and should surface as-is.
+ * Marks the bench-not-ready precondition below as intentionally
+ * user-facing: its `message` is authored copy, never a raw request path
+ * or schema summary, so a caller can show it verbatim. Every other throw
+ * on this path (`ApiQueryError`, `ChatApiError`, or a plain `Error` from a
+ * package that hasn't opted in) must go through that error type's own
+ * describer instead — allow-listing safe throws, rather than denylisting
+ * unsafe ones, so a new error type added later fails safe (masked)
+ * instead of leaking by default.
  */
 export class WorkbenchPreconditionError extends Error {
-  readonly kind: "setup-agent-missing" | "template-unavailable";
-  constructor(
-    message: string,
-    kind: "setup-agent-missing" | "template-unavailable",
-  ) {
+  readonly kind: "setup-agent-missing";
+  constructor(message: string, kind: "setup-agent-missing") {
     super(message);
     this.kind = kind;
   }
@@ -113,152 +87,49 @@ const SETUP_AGENT_MISSING_MESSAGE =
   "Your workbench is still finishing setup. Try again in a moment.";
 
 /**
- * Raises the walkthrough's first card in the room. Only a
- * `connect-plugin github` step has an in-room card today; the steps
- * after it (`pick-github-repos`, `start-webhook-trigger`) are driven by
- * that same card as the person works through it, so they need no client
- * action here. The whole ordered walkthrough rides along in the card's
- * body, so its step rail renders the definition's own copy.
- */
-async function postOnboardingWalkthrough(
-  tenantId: string,
-  workbenchId: string,
-  definition: WorkbenchDefinition,
-  steps: readonly WorkbenchOnboardingStep[],
-): Promise<void> {
-  const labels = steps.map(({ title, why }) => ({ title, why }));
-  for (const step of steps) {
-    if (step.kind !== "connect-plugin") continue;
-    if (step.connectorId !== "github") {
-      throw new Error(
-        `workbench template "${definition.id}" asks to connect ` +
-          `"${step.connectorId}", which has no in-room onboarding card yet`,
-      );
-    }
-    await postWorkbenchOnboardingStep(tenantId, workbenchId, {
-      kind: "connect-github",
-      requiredForTemplate: definition.title,
-      promise: definition.promise,
-      steps: labels,
-    });
-  }
-}
-
-/**
- * The template picker's "Create workbench" action: mints an empty
- * `kind: "workbench"` channel with no host and no `definitionId`, then
- * instantiates the picked definition into it — its agents (existing
- * principals invited after mint, new ones created first), its block
- * workflows, its pending plugins — and posts the first step of the
- * definition's onboarding walkthrough as a card in the room. Talking to
- * an agent is clicking that agent (find-or-reopen its one DM); this
- * function is the create verb for a room.
+ * The picker's "Create workbench" action: mints an empty `kind:
+ * "workbench"` channel with no host and no `definitionId`. Talking to an
+ * agent is clicking that agent (find-or-reopen its one DM); this function
+ * is the create verb for a room.
  *
- * The bench has to be past setup — its default assistant definition
- * deployed — before a room can invite anyone into it, so a bench that
- * isn't fails with `WorkbenchPreconditionError` rather than minting a
- * room nobody can join. That definition is the readiness gate only: no
- * definition names it as a host, and none invites it. A template id
- * with no definition (`blank`, "Just start talking") mints a plain
- * untagged channel under the generic `NEW_WORKBENCH_TITLE`.
+ * The bench has to be past setup — its default Myra definition deployed —
+ * before a room can invite anyone into it, so a bench that isn't fails
+ * with `WorkbenchPreconditionError` rather than minting a room nobody can
+ * join.
  *
- * `queryClient` invalidates the workbenches list once every agent the
- * definition names has been invited — `ChatWorkspace`'s own
- * in-room "Invite agent" dialog does the same
- * (`workbenchesQueryKeyPrefix`, `chat-workspace.tsx`'s
- * `refreshWorkbenchLists`) so the room the invite landed in never
- * shows a participant it already has data for as if it never joined.
- * Without this, the room this function `navigate`s to can start life
- * holding a `workbenches` query cached from before the last invite
- * resolved.
+ * `queryClient` invalidates the workbenches list once every selected
+ * agent has been invited — `ChatWorkspace`'s own in-room "Invite agent"
+ * dialog does the same (`workbenchesQueryKeyPrefix`,
+ * `chat-workspace.tsx`'s `refreshWorkbenchLists`) so the room the invite
+ * landed in never shows a participant it already has data for as if it
+ * never joined. Without this, the room this function `navigate`s to can
+ * start life holding a `workbenches` query cached from before the last
+ * invite resolved.
  *
  * `firstMessage`, when given (the picker's prompt box), is sent as the
- * signed-in person's own opening message once the room and the
- * definition's agents exist, so it lands after the onboarding card
- * rather than racing it. For a blank / ad-hoc mint that same text also
- * renames the room off `NEW_WORKBENCH_TITLE` via
- * `patchWorkbenchSettings` (`chat/name`), matching the sidebar rename
- * path; prefab titles are left alone.
+ * signed-in person's own opening message once the room exists, and
+ * renames the room off `NEW_WORKBENCH_TITLE` via `patchWorkbenchSettings`
+ * (`chat/name`), matching the sidebar rename path.
  */
-export async function createWorkbenchFromTemplate(
+export async function createWorkbench(
   tenantId: string,
-  templateId: WorkbenchTemplateId,
   navigate: (to: string) => void,
   queryClient: QueryClient,
   firstMessage?: string,
   selectedAgentDefinitionIds: readonly string[] = [],
 ): Promise<void> {
-  if (templateId !== "blank" && selectedAgentDefinitionIds.length > 0) {
-    throw new Error("Only a new blank workbench can select agents directly.");
-  }
   const definitions = await listAgentDefinitions(tenantId);
-  const setupTemplate = findMyraDefinition(definitions);
-  if (setupTemplate === undefined) {
+  if (findMyraDefinition(definitions) === undefined) {
     throw new WorkbenchPreconditionError(
       SETUP_AGENT_MISSING_MESSAGE,
       "setup-agent-missing",
     );
   }
-  // The definition comes from the bench library, never from a
-  // hardcoded catalog import; reading it is what seeds the shelf.
-  // `blank` is the one id with no definition by design; any
-  // other id resolving to nothing means this build ships no such
-  // template — fail loud rather than mint a workbench missing its
-  // agents. The picker only offers ids the library listed, so this is
-  // the race-loser's message, not the everyday path.
-  const definition =
-    templateId === "blank"
-      ? undefined
-      : ((await fetchWorkbenchTemplateManifest(tenantId, templateId)) ??
-        undefined);
-  if (templateId !== "blank" && definition === undefined) {
-    throw new WorkbenchPreconditionError(
-      `A ${templateId} workbench isn't available here yet.`,
-      "template-unavailable",
-    );
-  }
-  const workbench = await createWorkbench(tenantId, {
+  const workbench = await createWorkbenchChannel(tenantId, {
     kind: "workbench",
-    name: definition?.title ?? NEW_WORKBENCH_TITLE,
+    name: NEW_WORKBENCH_TITLE,
   });
 
-  if (definition !== undefined) {
-    await instantiateWorkbenchTemplate(definition, {
-      async listAgentHandles() {
-        const current = await listAgentDefinitions(tenantId);
-        return current.map((definition) => ({
-          handle: definition.name,
-          id: definition.id,
-        }));
-      },
-      async createParticipantAgent(request) {
-        const created = await createAgentDefinition(tenantId, request);
-        return { id: created.id };
-      },
-      async deployBlockWorkflow(block) {
-        return deployWorkbenchTemplateBlock(tenantId, block.assetName);
-      },
-      async inviteParticipantAgent(id) {
-        await inviteAgent(tenantId, workbench.id, id);
-      },
-      async recordPendingConnections(pendingConnections) {
-        await patchWorkbenchSettings(
-          tenantId,
-          workbench.id,
-          templateSettingsPatch(definition.id, pendingConnections),
-        );
-      },
-      async beginOnboarding(steps) {
-        await postOnboardingWalkthrough(
-          tenantId,
-          workbench.id,
-          definition,
-          steps,
-        );
-      },
-    });
-  }
-
   if (firstMessage !== undefined && firstMessage.trim() !== "") {
     const selectedAgentInvites = [...new Set(selectedAgentDefinitionIds)].map(
       (definitionId) => ({ kind: "agent" as const, definitionId }),
@@ -275,19 +146,15 @@ export async function createWorkbenchFromTemplate(
         },
       );
     } catch (cause) {
-      if (templateId === "blank") {
-        throw new WorkbenchPostCreateError(
-          workbench.id,
-          "opening-message",
-          cause,
-        );
-      }
-      throw cause;
+      throw new WorkbenchPostCreateError(
+        workbench.id,
+        "opening-message",
+        cause,
+      );
     }
     // Blank / ad-hoc mints stay "New Workbench" until named. When the
     // prompt box already supplied the opening message, rename via the same
-    // `chat/name` settings PATCH the sidebar rename uses — prefab titles
-    // (`definition?.title`) are left alone by `autoNameFromFirstMessage`.
+    // `chat/name` settings PATCH the sidebar rename uses.
     const autoTitle = autoNameFromFirstMessage(workbench.title, firstMessage);
     if (autoTitle !== undefined) {
       try {
@@ -295,13 +162,14 @@ export async function createWorkbenchFromTemplate(
           "chat/name": autoTitle,
         });
       } catch (cause) {
-        if (templateId === "blank") {
-          throw new WorkbenchPostCreateError(workbench.id, "rename", cause);
-        }
-        throw cause;
+        throw new WorkbenchPostCreateError(workbench.id, "rename", cause);
       }
       refreshWorkbenchLists(queryClient, tenantId, workbench.id);
     }
+  } else if (selectedAgentDefinitionIds.length > 0) {
+    for (const definitionId of new Set(selectedAgentDefinitionIds)) {
+      await inviteAgent(tenantId, workbench.id, definitionId);
+    }
   }
 
   refreshWorkbenchLists(queryClient, tenantId, workbench.id);
diff --git a/apps/web/src/myra-workbench.ts b/apps/web/src/myra-workbench.ts
index 4f54a59ca6..c3fd26e3ca 100644
--- a/apps/web/src/myra-workbench.ts
+++ b/apps/web/src/myra-workbench.ts
@@ -7,7 +7,7 @@ import {
   createDefaultAgentWorkbench,
   findDefinitionByAssetName,
 } from "@corbits/chat-ui";
-import { WORKFLOW_CATALOG } from "@workbench/templates";
+import { WORKFLOW_CATALOG } from "@corbits/workflows/catalog";
 
 import { listAgentDefinitions, type AgentDefinition } from "./agents-api";
 
diff --git a/apps/web/src/pages/new-workbench-picker.test.ts b/apps/web/src/pages/new-workbench-picker.test.ts
deleted file mode 100644
index 5217c1374d..0000000000
--- a/apps/web/src/pages/new-workbench-picker.test.ts
+++ /dev/null
@@ -1,111 +0,0 @@
-// CL-6495: the create-workbench catch used to discard whatever
-// `createWorkbenchFromTemplate` threw behind a fixed "try again" toast —
-// honest for a transient failure, a lie for a precondition this bench
-// doesn't meet (no setup agent, an unavailable template). These pin the
-// wording `describeWorkbenchCreateFailure` picks for each shape of cause.
-//
-// The check is an allow-list (only `WorkbenchPreconditionError` is shown
-// verbatim), not a denylist of `ApiQueryError` — a plain `Error` from
-// anywhere else on the path (`listPluginsForTenant`, `instantiateWorkbenchTemplate`,
-// or any future throw) must fall to the generic message rather than leak
-// a raw request path or schema summary into the toast.
-
-import { describe, expect, test } from "bun:test";
-import { ApiQueryError } from "@corbits/api-query";
-import { ChatApiError } from "@corbits/chat-ui";
-
-import { describeWorkbenchCreateFailure } from "./new-workbench-picker";
-import {
-  WorkbenchPostCreateError,
-  WorkbenchPreconditionError,
-} from "../instant-agent-create";
-
-const GENERIC = "Something went wrong creating this workbench. Try again.";
-
-describe("describeWorkbenchCreateFailure", () => {
-  test("a recoverable post-create failure gives the person its support reference", () => {
-    expect(
-      describeWorkbenchCreateFailure(
-        new WorkbenchPostCreateError(
-          "chan_1",
-          "opening-message",
-          new Error("agent launch failed"),
-        ),
-        "ref_1",
-      ),
-    ).toBe(
-      "Workbench created, but we couldn't send the opening message or add the selected agent. Try again from the room. Reference: ref_1",
-    );
-  });
-
-  test("a WorkbenchPreconditionError (no setup agent, unavailable template) is shown verbatim", () => {
-    expect(
-      describeWorkbenchCreateFailure(
-        new WorkbenchPreconditionError(
-          "A code-review workbench isn't available here yet.",
-          "template-unavailable",
-        ),
-      ),
-    ).toBe("A code-review workbench isn't available here yet.");
-  });
-
-  test("a plain Error carrying internal detail is masked, not shown verbatim", () => {
-    // The exact shape `listPluginsForTenant`/`instantiateWorkbenchTemplate`
-    // throw: a message embedding a raw status code or schema summary.
-    expect(
-      describeWorkbenchCreateFailure(
-        new Error(
-          "Unexpected response shape resolving GitHub: must be an object",
-        ),
-      ),
-    ).toBe(GENERIC);
-  });
-
-  test("an ApiQueryError runs through describeApiError so the status drives the wording", () => {
-    expect(describeWorkbenchCreateFailure(new ApiQueryError("boom", 404))).toBe(
-      "This isn't here anymore.",
-    );
-    expect(describeWorkbenchCreateFailure(new ApiQueryError("boom", 401))).toBe(
-      "You don't have access to this.",
-    );
-  });
-
-  test("an ApiQueryError never leaks its raw message (path, status text) into the toast", () => {
-    expect(
-      describeWorkbenchCreateFailure(
-        new ApiQueryError(
-          "The server answered 500.",
-          500,
-          "/api/tenants/tnt_1/template-blocks/code-review/deploy",
-        ),
-      ),
-    ).not.toContain("/api/tenants");
-  });
-
-  test("a ChatApiError — createWorkbench, patchWorkbenchSettings, and the GitHub-connect steps all throw this — runs through describeChatError", () => {
-    expect(describeWorkbenchCreateFailure(new ChatApiError("boom", 401))).toBe(
-      "You're signed out. Sign in again to continue.",
-    );
-    expect(describeWorkbenchCreateFailure(new ChatApiError("boom", 403))).toBe(
-      "You don't have access to this.",
-    );
-    expect(describeWorkbenchCreateFailure(new ChatApiError("boom", 500))).toBe(
-      "Something went wrong on our end. Try again in a moment.",
-    );
-  });
-
-  test("a ChatApiError never leaks its raw message (it always embeds the request path)", () => {
-    expect(
-      describeWorkbenchCreateFailure(
-        new ChatApiError(
-          "The server answered 500 for /api/tenants/tnt_1/chat/workbenches.",
-          500,
-        ),
-      ),
-    ).not.toContain("/api/tenants");
-  });
-
-  test("a non-Error cause falls back to the same generic, honest message", () => {
-    expect(describeWorkbenchCreateFailure("boom")).toBe(GENERIC);
-  });
-});
diff --git a/apps/web/src/pages/new-workbench-picker.tsx b/apps/web/src/pages/new-workbench-picker.tsx
index 406dd6be9d..79cd6f61ed 100644
--- a/apps/web/src/pages/new-workbench-picker.tsx
+++ b/apps/web/src/pages/new-workbench-picker.tsx
@@ -1,21 +1,11 @@
-// CL-6628: flips the picker's hierarchy from "choose a kind, then create"
-// to "say what you want, or choose a shortcut" — a prompt box is the
-// primary act, with the prefab rows (still CL-6342/CL-6344's real
-// instantiation paths) demoted to one-click shortcuts underneath. Typing
-// a goal and hitting Enter creates a blank room and hands that text to
-// `createWorkbenchFromTemplate` as `firstMessage`, so Myra's first read of
-// the room is the person's actual intent rather than a kind label. A
-// prefab click still creates immediately — no radio-then-Create
-// second step anywhere on this screen.
+// CL-8156: workbench template picking is gone — a new workbench is a
+// plain tenant + Myra (CL-8154's converge path deploys Myra behind the
+// scenes). This screen is just the prompt box: say what you want and hit
+// Enter, or open an empty channel and add people/agents as you go.
 
 import { Button, toast } from "@corbits/react-ui";
 import { useDismissablePopover } from "@corbits/react-ui/hooks/use-dismissable-popover";
-import {
-  ChatCircle,
-  GitPullRequest,
-  MagnifyingGlass,
-  PaperPlaneRight,
-} from "@corbits/icons";
+import { PaperPlaneRight } from "@corbits/icons";
 import {
   ChatApiError,
   CHAT_STRINGS,
@@ -29,12 +19,10 @@ import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { ApiQueryError, describeApiError } from "@corbits/api-query";
 import { reportError } from "@corbits/error-sink";
 
-import { useAPIQuery } from "../api";
 import { CreateAgentPanel } from "./create-agent-panel";
-import { TemplateLibraryPage } from "../workbench-templates-api";
 import { useBench } from "../bench-context";
 import {
-  createWorkbenchFromTemplate,
+  createWorkbench,
   refreshWorkbenchLists,
   WorkbenchPostCreateError,
   WorkbenchPreconditionError,
@@ -42,24 +30,18 @@ import {
 import { useNavigate } from "../navigation";
 import { StageTopBar } from "../shell/stage-top-bar";
 import { workbenchPath } from "../workbench-path";
-import {
-  WORKBENCH_TEMPLATES,
-  type WorkbenchTemplateId,
-} from "../workbench-templates";
 
 const GENERIC_CREATE_FAILURE =
   "Something went wrong creating this workbench. Try again.";
 
 /**
  * Allow-lists what's safe to show verbatim, rather than denylisting
- * what to hide — a new error type `createWorkbenchFromTemplate`'s path
- * starts throwing later lands here unrecognized and falls to the
- * generic message, not into the toast raw. Only
- * `WorkbenchPreconditionError` carries authored, always-safe copy
- * ("try again" is a lie for a missing template, so its own message
- * says so instead); `ApiQueryError` and `ChatApiError` both embed raw
- * request paths and schema summaries in `.message` and must go through
- * their own describer, never shown directly.
+ * what to hide — a new error type `createWorkbench`'s path starts
+ * throwing later lands here unrecognized and falls to the generic
+ * message, not into the toast raw. Only `WorkbenchPreconditionError`
+ * carries authored, always-safe copy; `ApiQueryError` and `ChatApiError`
+ * both embed raw request paths and schema summaries in `.message` and
+ * must go through their own describer, never shown directly.
  */
 export function describeWorkbenchCreateFailure(
   cause: unknown,
@@ -82,16 +64,6 @@ export function describeWorkbenchCreateFailure(
   return GENERIC_CREATE_FAILURE;
 }
 
-const CARD_ICON: Record<WorkbenchTemplateId, typeof GitPullRequest> = {
-  "code-review": GitPullRequest,
-  "due-diligence": MagnifyingGlass,
-  blank: ChatCircle,
-};
-
-/** The one kind that needs no manifest: an empty room is always
- * something this bench can set up. */
-const BLANK_TEMPLATE_ID: WorkbenchTemplateId = "blank";
-
 const PROMPT_PLACEHOLDER = "What do you want your Workbench to do?";
 const AGENT_LISTBOX_ID = "new-workbench-agent-listbox";
 
@@ -118,12 +90,6 @@ export function NewWorkbenchPickerRoute() {
       currentTenantIdRef.current = null;
     };
   }, [selectedTenantId]);
-  const library = useAPIQuery(
-    selectedTenantId === null
-      ? ""
-      : `/api/tenants/${selectedTenantId}/library/templates`,
-    TemplateLibraryPage,
-  );
   const [prompt, setPrompt] = useState("");
   const [selectedAgentDefinitionIds, setSelectedAgentDefinitionIds] = useState<
     readonly string[]
@@ -133,13 +99,11 @@ export function NewWorkbenchPickerRoute() {
   const [agentQuery, setAgentQuery] = useState("");
   const [activeAgentIndex, setActiveAgentIndex] = useState(0);
   const [creating, setCreating] = useState(false);
-  // Set only when `createWorkbenchFromTemplate` hit the missing-setup-agent
+  // Set only when `createWorkbench` hit the missing-setup-agent
   // precondition — thrown only after its own native definitions read found
   // no setup agent, so that read is the readiness check, never a guess
-  // from the error alone. (That precondition is distinct from
-  // template-unavailable, which is what a template-that-will-never-exist
-  // looks like.) Distinct from `creating`'s loader: this is a dead end
-  // until setup finishes, not a request in flight.
+  // from the error alone. Distinct from `creating`'s loader: this is a
+  // dead end until setup finishes, not a request in flight.
   const [stillSettingUp, setStillSettingUp] = useState(false);
   const promptRef = useRef<HTMLTextAreaElement | null>(null);
   const {
@@ -165,18 +129,14 @@ export function NewWorkbenchPickerRoute() {
   // dead end and a plain toast-and-retry) replays the exact same request
   // rather than silently falling back to blank.
   const lastAttemptRef = useRef<{
-    readonly templateId: WorkbenchTemplateId;
     readonly firstMessage: string | undefined;
     readonly selectedIds: readonly string[];
   } | null>(null);
 
-  // The prompt box only exists in the DOM once the library read settles
-  // and neither dead-end state is showing — an unconditional mount-time
-  // effect would fire while that branch renders `WorkbenchLoadingState`
-  // instead, before `promptRef` has anything to focus. Re-running on
-  // `showingPrompt` catches the moment the textarea actually mounts.
-  const showingPrompt =
-    !stillSettingUp && !creating && library.kind !== "loading";
+  // The prompt box only exists in the DOM once neither dead-end state is
+  // showing — an unconditional mount-time effect would fire while a dead
+  // end renders instead, before `promptRef` has anything to focus.
+  const showingPrompt = !stillSettingUp && !creating;
   useEffect(() => {
     if (showingPrompt) promptRef.current?.focus();
   }, [showingPrompt]);
@@ -200,21 +160,6 @@ export function NewWorkbenchPickerRoute() {
     });
   }, [invitableAgents.data]);
 
-  // What this bench's library can actually serve (CL-6458). A kind whose
-  // manifest the library doesn't hold is shown as not set up rather than
-  // offered and then dead-ended on a 404 at create time.
-  const servedTemplateIds =
-    library.kind === "ready"
-      ? new Set(library.data.data.map((entry) => entry.id))
-      : new Set<string>();
-  const offeredTemplates = WORKBENCH_TEMPLATES.filter(
-    (template) =>
-      template.id !== BLANK_TEMPLATE_ID && servedTemplateIds.has(template.id),
-  );
-  const unavailableTemplates = WORKBENCH_TEMPLATES.filter(
-    (template) =>
-      template.id !== BLANK_TEMPLATE_ID && !offeredTemplates.includes(template),
-  );
   const filteredAgents = (invitableAgents.data ?? []).filter((agent) => {
     const query = agentQuery.trim().toLocaleLowerCase();
     return (
@@ -228,18 +173,16 @@ export function NewWorkbenchPickerRoute() {
   );
 
   async function handleCreate(
-    templateId: WorkbenchTemplateId,
     firstMessage?: string,
     selectedIds: readonly string[] = [],
   ) {
     if (selectedTenantId === null || creating) return;
-    lastAttemptRef.current = { templateId, firstMessage, selectedIds };
+    lastAttemptRef.current = { firstMessage, selectedIds };
     setCreating(true);
     setStillSettingUp(false);
     try {
-      await createWorkbenchFromTemplate(
+      await createWorkbench(
         selectedTenantId,
-        templateId,
         navigate,
         queryClient,
         firstMessage,
@@ -258,15 +201,6 @@ export function NewWorkbenchPickerRoute() {
         toast(describeWorkbenchCreateFailure(cause, refId));
         return;
       }
-      // The missing-setup-agent precondition is thrown only after a
-      // successful native definitions read found no setup agent
-      // (CL-6457's background drain still running, or never started
-      // without a credential) — that read IS the readiness check, so no
-      // second round-trip is needed before showing the retryable
-      // still-setting-up state. (CL-8112 T1 cut the deleted
-      // `/api/onboarding/provisioning-status` re-check here.)
-      // TODO(CL-8112-T6/T7): read native readiness here once T6/T7
-      // builds it, if the panel needs more than the definition's absence.
       if (
         cause instanceof WorkbenchPreconditionError &&
         cause.kind === "setup-agent-missing"
@@ -289,17 +223,13 @@ export function NewWorkbenchPickerRoute() {
   function retryLastAttempt() {
     const attempt = lastAttemptRef.current;
     if (attempt === null) return;
-    void handleCreate(
-      attempt.templateId,
-      attempt.firstMessage,
-      attempt.selectedIds,
-    );
+    void handleCreate(attempt.firstMessage, attempt.selectedIds);
   }
 
   function handlePromptSubmit() {
     const trimmed = prompt.trim();
     if (trimmed === "") return;
-    void handleCreate(BLANK_TEMPLATE_ID, trimmed, selectedAgentDefinitionIds);
+    void handleCreate(trimmed, selectedAgentDefinitionIds);
   }
 
   function toggleAgent(definitionId: string) {
@@ -351,22 +281,19 @@ export function NewWorkbenchPickerRoute() {
           </div>
         ) : creating ? (
           // `delayMs={0}`: we already know this is a genuine wait the
-          // instant the person hits Enter or clicks a card, so the default
-          // "hold back briefly in case it resolves fast" delay only bought
-          // a blank pane here (CL-6623 finding #3) — show the loader
-          // outright instead of leaving a gap before it mounts.
+          // instant the person hits Enter, so the default "hold back
+          // briefly in case it resolves fast" delay only bought a blank
+          // pane here (CL-6623 finding #3) — show the loader outright
+          // instead of leaving a gap before it mounts.
           <WorkbenchLoadingState
             delayMs={0}
             title="Setting up your workbench…"
           />
-        ) : library.kind === "loading" ? (
-          <WorkbenchLoadingState title="Seeing what you can set up here…" />
         ) : (
           <>
             <h3>What do you want your Workbench to do?</h3>
             <p className="new-workbench-picker-sub">
-              Tell it what you're trying to get done, or pick one below. Takes
-              about ten seconds.
+              Tell it what you're trying to get done. Takes about ten seconds.
             </p>
 
             <form
@@ -583,85 +510,11 @@ export function NewWorkbenchPickerRoute() {
               </div>
             </form>
 
-            {library.kind === "error" ? (
-              <p className="new-workbench-picker-sub" role="status">
-                Couldn't load what this bench can set up, so only a plain room
-                is on offer right now.{" "}
-                <Button
-                  type="button"
-                  variant="ghost"
-                  size="sm"
-                  onClick={() => library.retry()}
-                >
-                  Try again
-                </Button>
-              </p>
-            ) : null}
-
-            <div className="new-workbench-template-heading">
-              <span>Or start from a template</span>
-              <span>Agents are already in the room. One click opens it.</span>
-            </div>
-            <div className="new-workbench-prefab-grid">
-              {offeredTemplates.map((template) => {
-                const Icon = CARD_ICON[template.id];
-                return (
-                  <button
-                    key={template.id}
-                    type="button"
-                    className="new-workbench-prefab-card"
-                    disabled={creating || selectedTenantId === null}
-                    onClick={() => void handleCreate(template.id)}
-                  >
-                    <span
-                      className="new-workbench-pick-glyph"
-                      aria-hidden="true"
-                    >
-                      <Icon size={16} strokeWidth={1.8} />
-                    </span>
-                    <span className="new-workbench-pick-text">
-                      <span className="new-workbench-pick-title">
-                        {template.title}
-                      </span>
-                      <span className="new-workbench-pick-promise">
-                        {template.promise}
-                      </span>
-                    </span>
-                  </button>
-                );
-              })}
-
-              {unavailableTemplates.map((template) => {
-                const Icon = CARD_ICON[template.id];
-                return (
-                  <span
-                    key={template.id}
-                    className="new-workbench-prefab-card"
-                    aria-disabled="true"
-                  >
-                    <span
-                      className="new-workbench-pick-glyph"
-                      aria-hidden="true"
-                    >
-                      <Icon size={16} strokeWidth={1.8} />
-                    </span>
-                    <span className="new-workbench-pick-text">
-                      <span className="new-workbench-pick-title">
-                        {template.title}
-                      </span>
-                      <span className="new-workbench-pick-promise">
-                        Not set up on this bench yet.
-                      </span>
-                    </span>
-                  </span>
-                );
-              })}
-            </div>
             <button
               type="button"
               className="new-workbench-empty-channel"
               disabled={creating || selectedTenantId === null}
-              onClick={() => void handleCreate(BLANK_TEMPLATE_ID)}
+              onClick={() => void handleCreate()}
             >
               Or <span>just open an empty channel</span> — nobody is in it yet,
               add people and agents as you go.
diff --git a/apps/web/src/pages/plugins-page.tsx b/apps/web/src/pages/plugins-page.tsx
index 9f1deea4b8..158d5207d0 100644
--- a/apps/web/src/pages/plugins-page.tsx
+++ b/apps/web/src/pages/plugins-page.tsx
@@ -24,10 +24,8 @@ import {
 } from "@corbits/plugins-ui";
 import type { ResolvedPlugin } from "@corbits/connections/plugins";
 import { listPluginsForTenant } from "@corbits/connections/plugins";
-import {
-  CONNECTOR_REGISTRY,
-  MCP_PRESETS,
-} from "@workbench/templates/connectors";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
+import { MCP_PRESETS } from "@corbits/connections/mcp-presets";
 import { Plus, SquaresFour, Warning } from "@corbits/icons";
 import { useCallback, useEffect, useRef, useState } from "react";
 
diff --git a/apps/web/src/pages/routines-page.tsx b/apps/web/src/pages/routines-page.tsx
index 7f15d4948c..a30ec3244e 100644
--- a/apps/web/src/pages/routines-page.tsx
+++ b/apps/web/src/pages/routines-page.tsx
@@ -32,10 +32,10 @@ import { routineDetailPath } from "../global-routines";
 import { useBench } from "../bench-context";
 import { tenantKeys } from "../query-client";
 import {
+  deployCatalogBlock,
   listAvailableCatalogWorkflows,
   type AvailableCatalogWorkflow,
 } from "../routines-api";
-import { deployWorkbenchTemplateBlock } from "../workbench-templates-api";
 import { Link } from "../navigation";
 import { PLUGINS_PATH_PREFIX } from "../path-ids";
 import { StageTopBar } from "../shell/stage-top-bar";
@@ -71,7 +71,7 @@ export function AvailableCatalogWorkflowsSection({
   async function handleAdd(entry: AvailableCatalogWorkflow) {
     setPendingAssetName(entry.assetName);
     try {
-      await deployWorkbenchTemplateBlock(tenantId, entry.assetName);
+      await deployCatalogBlock(tenantId, entry.assetName);
       await queryClient.invalidateQueries({
         queryKey: tenantKeys.availableCatalogWorkflows(tenantId),
       });
diff --git a/apps/web/src/routines-api.ts b/apps/web/src/routines-api.ts
index b4a1ed82a9..e19f517196 100644
--- a/apps/web/src/routines-api.ts
+++ b/apps/web/src/routines-api.ts
@@ -116,6 +116,26 @@ export function listAvailableCatalogWorkflows(
   ).then((page) => page.items);
 }
 
+const CatalogBlockDeployResponse = type({
+  id: "string > 0",
+  created: "boolean",
+});
+
+/** Deploys one catalog workflow on demand through the hub's
+ * `POST /catalog-blocks/:assetName/deploy` — the "Available" section's
+ * add action. `created: false` means the tenant already carried a
+ * deployed definition under this asset name. */
+export function deployCatalogBlock(
+  tenantId: string,
+  assetName: string,
+): Promise<{ readonly created: boolean }> {
+  return request(
+    `/api/tenants/${tenantId}/catalog-blocks/${assetName}/deploy`,
+    CatalogBlockDeployResponse,
+    { method: "POST" },
+  ).then((body) => ({ created: body.created }));
+}
+
 export function scheduledWorkflowRunPath(
   tenantId: string,
   definitionId: string,
diff --git a/apps/web/src/shell/provider-health-banner.tsx b/apps/web/src/shell/provider-health-banner.tsx
index 9b476afe93..a46512d24f 100644
--- a/apps/web/src/shell/provider-health-banner.tsx
+++ b/apps/web/src/shell/provider-health-banner.tsx
@@ -16,7 +16,7 @@
 import { Button } from "@corbits/react-ui";
 import { connectorDescriptors } from "@corbits/connections/registry";
 import type { ClassifiedInferenceFailureCategory } from "@corbits/connections/provider-health";
-import { CONNECTOR_REGISTRY } from "@workbench/templates/connectors";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 import { Warning, X } from "@corbits/icons";
 import { useEffect, useState } from "react";
 
diff --git a/apps/web/src/workbench-templates-api.ts b/apps/web/src/workbench-templates-api.ts
deleted file mode 100644
index 23c9264711..0000000000
--- a/apps/web/src/workbench-templates-api.ts
+++ /dev/null
@@ -1,115 +0,0 @@
-// Reads a workbench template's manifest from the bench library (CL-6344)
-// — `instant-agent-create.ts` instantiates from this seeded row, never
-// from a hardcoded `@workbench/templates` import. The read itself
-// is what converges the shelf (CL-6458), so these routes answer for a
-// bench of any age. The wire shape is the library's `{id, content}`
-// entry; the content string re-enters through the catalog's own
-// `WorkbenchDefinition` schema, so a corrupt or stale library row fails
-// loud here rather than half-instantiating a workbench.
-
-import { type } from "arktype";
-import {
-  parseWorkbenchDefinition,
-  type WorkbenchDefinition,
-} from "@workbench/templates";
-import { ApiQueryError } from "@corbits/api-query";
-import { parseErrorEnvelope } from "@corbits/error-sink";
-
-const TemplateLibraryEntry = type({ id: "string > 0", content: "string > 0" });
-
-/** What the picker offers rows from: the ids this bench's library can
- * actually serve, so a kind is never offered and then dead-ended on a
- * missing manifest at create time. */
-export const TemplateLibraryPage = type({ data: TemplateLibraryEntry.array() });
-
-const TemplateBlockDeployResponse = type({
-  id: "string > 0",
-  created: "boolean",
-});
-
-/**
- * Deploys one of a manifest's referenced block workflows through the
- * hub's source-form deploy (`POST /template-blocks/:assetName/deploy`,
- * CL-6405) — `instantiateWorkbenchTemplate`'s `deployBlockWorkflow`
- * port. `created: false` means the tenant already carried a deployed
- * definition under this asset name (a retried or second instantiation).
- */
-export async function deployWorkbenchTemplateBlock(
-  tenantId: string,
-  assetName: string,
-): Promise<{ readonly created: boolean }> {
-  const path = `/api/tenants/${tenantId}/template-blocks/${assetName}/deploy`;
-  let response: Response;
-  try {
-    response = await fetch(path, {
-      method: "POST",
-      headers: { accept: "application/json" },
-    });
-  } catch (cause) {
-    throw new ApiQueryError(
-      cause instanceof Error ? cause.message : String(cause),
-      undefined,
-      path,
-    );
-  }
-  const json: unknown = await response.json().catch(() => undefined);
-  if (!response.ok) {
-    const envelope = parseErrorEnvelope(json);
-    throw new ApiQueryError(
-      envelope?.error.userMessage ?? `The server answered ${response.status}.`,
-      response.status,
-      path,
-      envelope?.error.refId,
-    );
-  }
-  const parsed = TemplateBlockDeployResponse(json);
-  if (parsed instanceof type.errors) {
-    throw new ApiQueryError(
-      `Couldn't set that up — the answer didn't look right: ${parsed.summary}`,
-      undefined,
-      path,
-    );
-  }
-  return { created: parsed.created };
-}
-
-/**
- * The seeded manifest for `templateId`, or null when the library has no
- * such entry (a bench whose boot seed hasn't run yet — the caller
- * decides whether that's fatal for the template being created).
- */
-export async function fetchWorkbenchTemplateManifest(
-  tenantId: string,
-  templateId: string,
-): Promise<WorkbenchDefinition | null> {
-  const path = `/api/tenants/${tenantId}/library/templates/${templateId}`;
-  let response: Response;
-  try {
-    response = await fetch(path, { headers: { accept: "application/json" } });
-  } catch (cause) {
-    throw new ApiQueryError(
-      cause instanceof Error ? cause.message : String(cause),
-      undefined,
-      path,
-    );
-  }
-  if (response.status === 404) return null;
-  if (!response.ok) {
-    throw new ApiQueryError(
-      `The server answered ${response.status}.`,
-      response.status,
-      path,
-    );
-  }
-  const entry = TemplateLibraryEntry(
-    await response.json().catch(() => undefined),
-  );
-  if (entry instanceof type.errors) {
-    throw new ApiQueryError(
-      `Unexpected template entry shape: ${entry.summary}`,
-      undefined,
-      path,
-    );
-  }
-  return parseWorkbenchDefinition(entry.content);
-}
diff --git a/apps/web/src/workbench-templates.ts b/apps/web/src/workbench-templates.ts
deleted file mode 100644
index ab3a45499e..0000000000
--- a/apps/web/src/workbench-templates.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-// The picker's prefab catalog: one entry per one-click shortcut card
-// (CL-6628). `code-review` and `blank` are pinned to the approved mock
-// (CL-6342) verbatim; `due-diligence` mirrors the backend's
-// `DUE_DILIGENCE_TEMPLATE` (`@workbench/templates`, CL-6499) — it and
-// every other id here are still gated by what this bench's library
-// actually serves before either is offered as a live card (see
-// `NewWorkbenchPickerRoute`'s `servedTemplateIds`). See
-// `pages/new-workbench-picker.tsx` for the card rendering and
-// `instant-agent-create.ts`'s `createWorkbenchFromTemplate` for what
-// picking one — or typing a goal into the prompt box above them —
-// actually does today.
-
-export type WorkbenchTemplateId = "code-review" | "due-diligence" | "blank";
-
-export type WorkbenchTemplate = {
-  readonly id: WorkbenchTemplateId;
-  readonly title: string;
-  readonly promise: string;
-};
-
-export const WORKBENCH_TEMPLATES: readonly WorkbenchTemplate[] = [
-  {
-    id: "code-review",
-    title: "Code review",
-    promise:
-      "Three reviewers read every pull request and post what they'd change.",
-  },
-  {
-    id: "due-diligence",
-    title: "Due Diligence",
-    promise:
-      "Scout checks a company, deal, or vendor against the web and what your team already knows, and saves what it finds so you can pick it up later.",
-  },
-  {
-    id: "blank",
-    title: "Just start talking",
-    promise:
-      "An empty channel. Nobody is hosted. Invite people and agents as you go.",
-  },
-];
diff --git a/apps/web/test/create-agent-panel.test.tsx b/apps/web/test/create-agent-panel.test.tsx
index 5f0ad27a8f..ea48095722 100644
--- a/apps/web/test/create-agent-panel.test.tsx
+++ b/apps/web/test/create-agent-panel.test.tsx
@@ -441,12 +441,12 @@ describe("agent creation entry points", () => {
     expect(commandPaletteActionsSource).toContain('from "./routes"');
   });
 
-  test("the template picker mints through instant-agent-create.ts's createWorkbenchFromTemplate", () => {
+  test("the new-workbench picker mints through instant-agent-create.ts's createWorkbench", () => {
     const pickerSource = readFileSync(
       new URL("../src/pages/new-workbench-picker.tsx", import.meta.url),
       "utf8",
     );
     expect(pickerSource).toContain('from "../instant-agent-create"');
-    expect(pickerSource).toContain("createWorkbenchFromTemplate");
+    expect(pickerSource).toContain("createWorkbench");
   });
 });
diff --git a/apps/web/test/new-workbench-picker.test.tsx b/apps/web/test/new-workbench-picker.test.tsx
deleted file mode 100644
index 1b280bd752..0000000000
--- a/apps/web/test/new-workbench-picker.test.tsx
+++ /dev/null
@@ -1,1110 +0,0 @@
-// CL-6628 flips the picker's hierarchy: a prompt box is the primary act,
-// with the prefab cards (still real template instantiation, CL-6342/
-// CL-6344) demoted to one-click shortcuts underneath — no radio-then-
-// Create two-step. These pin: the prompt box is what's on screen and
-// autofocused, submitting it creates a blank workbench and delivers the
-// typed text as the person's own first message, and a prefab card click
-// still instantiates its template exactly like the old "Create workbench"
-// button did.
-
-import { afterEach, describe, expect, spyOn, test } from "bun:test";
-import {
-  CODE_REVIEW_TEMPLATE,
-  DUE_DILIGENCE_TEMPLATE,
-  serializeWorkbenchDefinition,
-} from "@workbench/templates";
-import { act } from "react";
-import { createRoot, type Root } from "react-dom/client";
-
-import { BenchProvider } from "../src/bench-context";
-import { NavigationProvider } from "../src/navigation";
-import { NewWorkbenchPickerRoute } from "../src/pages/new-workbench-picker";
-import {
-  createTestQueryClient,
-  TestQueryProvider,
-} from "./test-query-provider";
-
-const realFetch = globalThis.fetch;
-
-afterEach(() => {
-  globalThis.fetch = realFetch;
-});
-
-function json(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "content-type": "application/json" },
-  });
-}
-
-const MEMBERSHIP = {
-  data: [
-    {
-      principalId: "prn_1",
-      tenantId: "tnt_1",
-      tenantName: "Corbits Bench",
-      tenantSlug: "corbits-bench",
-      kind: "user",
-      status: "active",
-      roles: [],
-    },
-  ],
-  nextCursor: null,
-};
-
-type RecordedCall = { readonly path: string; readonly init?: RequestInit };
-
-function stubFetch(
-  extra: (path: string, init?: RequestInit) => Response | undefined,
-): RecordedCall[] {
-  const calls: RecordedCall[] = [];
-  globalThis.fetch = ((input: RequestInfo | URL, init?: RequestInit) => {
-    const path = typeof input === "string" ? input : String(input);
-    calls.push(init === undefined ? { path } : { path, init });
-    if (path.includes("/api/me/principals")) {
-      return Promise.resolve(json(MEMBERSHIP));
-    }
-    // The bench library the first read converges (CL-6458) — what the
-    // picker offers cards from and the create flow instantiates from,
-    // never a hardcoded import.
-    if (path.endsWith("/library/templates")) {
-      return Promise.resolve(
-        json({
-          data: [
-            {
-              id: "code-review",
-              content: serializeWorkbenchDefinition(CODE_REVIEW_TEMPLATE),
-            },
-          ],
-        }),
-      );
-    }
-    if (path.endsWith("/library/templates/code-review")) {
-      return Promise.resolve(
-        json({
-          id: "code-review",
-          content: serializeWorkbenchDefinition(CODE_REVIEW_TEMPLATE),
-        }),
-      );
-    }
-    if (path.endsWith("/chat/invitable-definitions")) {
-      return Promise.resolve(
-        json({
-          items: [
-            { id: "wfd_scout", name: "scout", description: "Scout" },
-            { id: "wfd_quill", name: "quill", description: "Quill" },
-          ],
-        }),
-      );
-    }
-    const response = extra(path, init);
-    if (response !== undefined) return Promise.resolve(response);
-    throw new Error(`unexpected fetch: ${path}`);
-  }) as typeof fetch;
-  return calls;
-}
-
-let container: HTMLDivElement | null = null;
-let root: Root | null = null;
-
-afterEach(() => {
-  if (root !== null) {
-    act(() => root?.unmount());
-    root = null;
-  }
-  if (container !== null) {
-    container.remove();
-    container = null;
-  }
-});
-
-const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
-const settle = () => act(() => sleep(10));
-
-async function renderPicker(
-  navigate: (to: string) => void = () => undefined,
-  queryClient = createTestQueryClient(),
-): Promise<void> {
-  container = document.createElement("div");
-  document.body.appendChild(container);
-  root = createRoot(container);
-  await act(async () => {
-    root?.render(
-      <TestQueryProvider client={queryClient}>
-        <NavigationProvider navigate={navigate}>
-          <BenchProvider>
-            <NewWorkbenchPickerRoute />
-          </BenchProvider>
-        </NavigationProvider>
-      </TestQueryProvider>,
-    );
-  });
-  for (let i = 0; i < 20; i++) {
-    await settle();
-    if (container.querySelector(".new-workbench-prompt-input") !== null) break;
-  }
-}
-
-function promptInput(): HTMLTextAreaElement | null {
-  return container?.querySelector(".new-workbench-prompt-input") ?? null;
-}
-
-// Setting `.value` directly on a React-controlled element doesn't trip
-// its value tracker, so a plain `input` event dispatched right after is a
-// no-op — the same native-setter workaround `form-block.test.tsx` and
-// `connect-github-block.test.tsx` use for the same reason.
-function typeIntoPrompt(value: string): void {
-  const input = promptInput();
-  if (input === null) return;
-  const setter = Object.getOwnPropertyDescriptor(
-    window.HTMLTextAreaElement.prototype,
-    "value",
-  )?.set;
-  setter?.call(input, value);
-  input.dispatchEvent(new Event("input", { bubbles: true }));
-}
-
-/** Only the clickable (offered) cards — a template the library can't
- * serve renders as a disabled `<span>` with the same class, never a
- * `<button>`, so this selector alone tells offered apart from
- * unavailable. */
-function prefabCards(): HTMLButtonElement[] {
-  return Array.from(
-    container?.querySelectorAll<HTMLButtonElement>(
-      "button.new-workbench-prefab-card",
-    ) ?? [],
-  );
-}
-
-/** The standard fixture for a create that mints against `blank` (no
- * manifest, no participants, no settings patch) — shared by every test
- * exercising the prompt box's blank-plus-first-message path. */
-function stubBlankCreate(
-  onSendMessage?: (body: {
-    readonly parts: readonly { kind: string }[];
-    readonly invite?: readonly {
-      readonly kind: string;
-      readonly definitionId: string;
-    }[];
-  }) => void,
-  messageResponse?: Response,
-): RecordedCall[] {
-  return stubFetch((path, init) => {
-    if (path.includes("/workflows/definitions")) {
-      return json({
-        data: [
-          {
-            id: "wfd_assistant",
-            tenantId: "tnt_1",
-            name: "assistant",
-            currentVersion: "1",
-            status: "deployed",
-            createdAt: "2026-01-01T00:00:00.000Z",
-            updatedAt: "2026-01-01T00:00:00.000Z",
-          },
-        ],
-        nextCursor: null,
-      });
-    }
-    if (path.endsWith("/chat/workbenches") && init?.method === "POST") {
-      return json({
-        id: "chan_new",
-        title: "New Workbench",
-        kind: "workbench",
-        pinned: false,
-        participants: [],
-      });
-    }
-    if (
-      path.endsWith("/chat/workbenches/chan_new/messages") &&
-      init?.method === "POST"
-    ) {
-      const body = JSON.parse(String(init.body)) as {
-        parts: readonly { kind: string }[];
-        invite?: readonly {
-          readonly kind: string;
-          readonly definitionId: string;
-        }[];
-      };
-      onSendMessage?.(body);
-      return (
-        messageResponse ??
-        json({ id: "msg_1", createdAt: "2026-01-01T00:00:00.000Z" })
-      );
-    }
-    if (
-      path.endsWith("/chat/workbenches/chan_new/settings") &&
-      init?.method === "PATCH"
-    ) {
-      return json({
-        id: "chan_new",
-        title: "Get our onboarding docs into shape",
-        kind: "workbench",
-        pinned: false,
-        participants: [],
-        settings: {},
-        contextWindow: { value: 0, source: "inherit" },
-      });
-    }
-    return undefined;
-  });
-}
-
-describe("NewWorkbenchPickerRoute", () => {
-  test("the prompt box is on screen, autofocused, with its placeholder", async () => {
-    stubFetch(() => undefined);
-    await renderPicker();
-
-    const input = promptInput();
-    expect(input).not.toBeNull();
-    expect(input?.placeholder).toBe("What do you want your Workbench to do?");
-    expect(document.activeElement).toBe(input);
-  });
-
-  test("the template rows render below the prompt box, with an explicit empty channel", async () => {
-    stubFetch(() => undefined);
-    await renderPicker();
-
-    expect(container?.querySelector('[role="radiogroup"]')).toBeNull();
-    expect(container?.querySelector('[role="radio"]')).toBeNull();
-
-    const cards = prefabCards();
-    expect(cards.length).toBe(1);
-    expect(container?.textContent).toContain("Code review");
-    expect(container?.textContent).toContain("just open an empty channel");
-  });
-
-  // The library seeds every shipped template (`createTemplateLibrarySeeder`),
-  // so a bench whose library serves due-diligence too offers it as a real
-  // card, not just an entry in the static catalog with nothing to back it.
-  test("due-diligence is offered as a card once the library serves it", async () => {
-    globalThis.fetch = ((input: RequestInfo | URL) => {
-      const path = typeof input === "string" ? input : String(input);
-      if (path.includes("/api/me/principals")) {
-        return Promise.resolve(json(MEMBERSHIP));
-      }
-      if (path.endsWith("/library/templates")) {
-        return Promise.resolve(
-          json({
-            data: [
-              {
-                id: "code-review",
-                content: serializeWorkbenchDefinition(CODE_REVIEW_TEMPLATE),
-              },
-              {
-                id: "due-diligence",
-                content: serializeWorkbenchDefinition(DUE_DILIGENCE_TEMPLATE),
-              },
-            ],
-          }),
-        );
-      }
-      throw new Error(`unexpected fetch: ${path}`);
-    }) as typeof fetch;
-    await renderPicker();
-
-    const cards = prefabCards();
-    expect(cards.length).toBe(2);
-    const dueDiligence = cards.find((card) =>
-      card.textContent?.includes("Due Diligence"),
-    );
-    expect(dueDiligence).not.toBeUndefined();
-    expect(dueDiligence?.textContent).toContain(
-      "Scout checks a company, deal, or vendor",
-    );
-  });
-
-  // CL-6458: the picker offers what the bench's library can actually
-  // serve. A kind the library has no manifest for is shown as not set up
-  // — never offered and then dead-ended on a 404 at create time.
-  test("a kind this bench's library cannot serve is not offered as a live card", async () => {
-    globalThis.fetch = ((input: RequestInfo | URL) => {
-      const path = typeof input === "string" ? input : String(input);
-      if (path.includes("/api/me/principals")) {
-        return Promise.resolve(json(MEMBERSHIP));
-      }
-      if (path.endsWith("/library/templates")) {
-        return Promise.resolve(json({ data: [] }));
-      }
-      throw new Error(`unexpected fetch: ${path}`);
-    }) as typeof fetch;
-    await renderPicker();
-
-    const cards = prefabCards();
-    expect(cards.length).toBe(0);
-    expect(container?.textContent).toContain("Code review");
-    expect(container?.textContent).toContain("Not set up on this bench yet");
-  });
-
-  test("when the library can't be read, the screen says so instead of offering a dead end", async () => {
-    globalThis.fetch = ((input: RequestInfo | URL) => {
-      const path = typeof input === "string" ? input : String(input);
-      if (path.includes("/api/me/principals")) {
-        return Promise.resolve(json(MEMBERSHIP));
-      }
-      if (path.endsWith("/library/templates")) {
-        return Promise.resolve(json({ error: "boom" }, 503));
-      }
-      throw new Error(`unexpected fetch: ${path}`);
-    }) as typeof fetch;
-    await renderPicker();
-
-    expect(container?.textContent).toContain(
-      "Couldn't load what this bench can set up",
-    );
-    expect(prefabCards().length).toBe(0);
-  });
-
-  test("typing a goal and hitting Enter creates a blank workbench and delivers the goal as the first message", async () => {
-    let sentParts: readonly { kind: string; text?: string }[] = [];
-    const calls = stubBlankCreate((body) => {
-      sentParts = body.parts as typeof sentParts;
-    });
-    const navigated: string[] = [];
-    await renderPicker((to) => navigated.push(to));
-
-    await act(async () => {
-      typeIntoPrompt("Get our onboarding docs into shape");
-    });
-    await act(async () => {
-      promptInput()?.dispatchEvent(
-        new KeyboardEvent("keydown", { key: "Enter", bubbles: true }),
-      );
-    });
-    for (let i = 0; i < 20; i++) {
-      await settle();
-      if (navigated.length > 0) break;
-    }
-
-    expect(navigated).toEqual(["/w/chan_new"]);
-
-    const createWorkbenchCall = calls.find(
-      (call) =>
-        call.path.endsWith("/chat/workbenches") && call.init?.method === "POST",
-    );
-    expect(JSON.parse(String(createWorkbenchCall?.init?.body))).toMatchObject({
-      kind: "workbench",
-    });
-    expect(
-      JSON.parse(String(createWorkbenchCall?.init?.body)).definitionId,
-    ).toBeUndefined();
-
-    const sendMessageCall = calls.find((call) =>
-      call.path.endsWith("/chat/workbenches/chan_new/messages"),
-    );
-    expect(sendMessageCall).not.toBeUndefined();
-    expect(sentParts).toEqual([
-      { kind: "text", text: "Get our onboarding docs into shape" },
-    ]);
-  });
-
-  test("a failed opening message still opens the blank workbench", async () => {
-    stubBlankCreate(undefined, json({ error: "agent launch failed" }, 409));
-    const navigated: string[] = [];
-    await renderPicker((to) => navigated.push(to));
-
-    await act(async () => {
-      typeIntoPrompt("Research our next partner");
-    });
-    await act(async () => {
-      promptInput()?.dispatchEvent(
-        new KeyboardEvent("keydown", { key: "Enter", bubbles: true }),
-      );
-    });
-    for (let i = 0; i < 20; i++) {
-      await settle();
-      if (navigated.length > 0) break;
-    }
-
-    expect(navigated).toEqual(["/w/chan_new"]);
-  });
-
-  test("a failed sidebar refresh does not block opening a recoverable workbench", async () => {
-    stubBlankCreate(undefined, json({ error: "agent launch failed" }, 409));
-    const queryClient = createTestQueryClient();
-    const invalidate = spyOn(
-      queryClient,
-      "invalidateQueries",
-    ).mockRejectedValue(new Error("sidebar refresh failed"));
-    const navigated: string[] = [];
-    try {
-      await renderPicker((to) => navigated.push(to), queryClient);
-
-      await act(async () => {
-        typeIntoPrompt("Research our next partner");
-      });
-      await act(async () => {
-        promptInput()?.dispatchEvent(
-          new KeyboardEvent("keydown", { key: "Enter", bubbles: true }),
-        );
-      });
-      for (let i = 0; i < 20; i++) {
-        await settle();
-        if (navigated.length > 0) break;
-      }
-
-      expect(navigated).toEqual(["/w/chan_new"]);
-    } finally {
-      invalidate.mockRestore();
-    }
-  });
-
-  test("a selected agent is pre-invited with the opening message", async () => {
-    let sentInvite:
-      | readonly { readonly kind: string; readonly definitionId: string }[]
-      | undefined;
-    const calls = stubBlankCreate((body) => {
-      sentInvite = body.invite;
-    });
-    const navigated: string[] = [];
-    await renderPicker((to) => navigated.push(to));
-
-    for (let i = 0; i < 20; i++) {
-      await settle();
-      if (container?.textContent?.includes("+ Add agent")) break;
-    }
-    const addAgent = Array.from(
-      container?.querySelectorAll<HTMLButtonElement>("button") ?? [],
-    ).find((button) => button.textContent === "+ Add agent");
-    await act(async () => {
-      addAgent?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-    });
-    const scout = document.querySelector<HTMLButtonElement>(
-      '[role="option"]#new-workbench-agent-wfd_scout',
-    );
-    await act(async () => {
-      scout?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-      typeIntoPrompt("Research our next partner");
-    });
-    await act(async () => {
-      promptInput()?.dispatchEvent(
-        new KeyboardEvent("keydown", { key: "Enter", bubbles: true }),
-      );
-    });
-    for (let i = 0; i < 20; i++) {
-      await settle();
-      if (navigated.length > 0) break;
-    }
-
-    expect(sentInvite).toEqual([{ kind: "agent", definitionId: "wfd_scout" }]);
-    expect(calls.some((call) => call.path.endsWith("/invite"))).toBe(false);
-    expect(navigated).toEqual(["/w/chan_new"]);
-  });
-
-  test.each(["Research Buddy", "", null])(
-    "creating an agent with description %j preserves the draft and selects it by name",
-    async (description) => {
-      stubFetch((path) => {
-        if (path.includes("/catalog/models"))
-          return json({ data: [], nextCursor: null });
-        if (path.endsWith("/skills")) return json({ skills: [] });
-        if (path.endsWith("/agent-definitions/draft")) {
-          return json({ draft: { systemPrompt: "Research carefully." } });
-        }
-        if (path.endsWith("/agent-definitions")) {
-          return json(
-            {
-              id: "wfd_new",
-              tenantId: "tnt_1",
-              name: "research-buddy",
-              description,
-              currentVersion: "1",
-              status: "deployed",
-              createdAt: "2026-09-08T00:00:00.000Z",
-              updatedAt: "2026-09-08T00:00:00.000Z",
-              skills: [],
-            },
-            201,
-          );
-        }
-        return undefined;
-      });
-      await renderPicker();
-      await settle();
-      await act(async () => typeIntoPrompt("Research our next partner"));
-      const button = (label: string) =>
-        [...document.querySelectorAll("button")].find(
-          (element) => element.textContent === label,
-        );
-      await act(async () => button("+ Add agent")?.click());
-      expect(button("+ Create agent")).toBeDefined();
-      await act(async () => button("+ Create agent")?.click());
-      await settle();
-      expect(document.querySelector(".new-workbench-agent-popover")).toBeNull();
-      expect(document.querySelector('[role="dialog"]')?.textContent).toContain(
-        "New agent",
-      );
-      const name = document.getElementById("create-agent-name");
-      const setter = Object.getOwnPropertyDescriptor(
-        window.HTMLInputElement.prototype,
-        "value",
-      )?.set;
-      if (!(name instanceof HTMLInputElement) || setter === undefined) {
-        throw new Error("Agent name input is missing");
-      }
-      await act(async () => {
-        setter.call(name, "Research Buddy");
-        name.dispatchEvent(new Event("input", { bubbles: true }));
-      });
-      await act(async () => button("Get started")?.click());
-      await settle();
-      expect(document.querySelector('[role="dialog"]') === null).toBe(true);
-      expect(promptInput()?.value).toBe("Research our next partner");
-      expect(
-        document.querySelector(".new-workbench-agent-chip")?.textContent,
-      ).toContain("Research Buddy");
-    },
-  );
-
-  test("a late agent creation cannot invite an agent from the previous tenant", async () => {
-    let sentInvite: unknown;
-    const calls = stubBlankCreate((body) => {
-      sentInvite = body.invite;
-    });
-    const baseFetch = globalThis.fetch;
-    const pending = Promise.withResolvers<Response>();
-    let creationStarted = false;
-    globalThis.fetch = ((input: RequestInfo | URL, init?: RequestInit) => {
-      const path = String(input);
-      if (path.includes("/catalog/models"))
-        return Promise.resolve(json({ data: [], nextCursor: null }));
-      if (path.endsWith("/skills"))
-        return Promise.resolve(json({ skills: [] }));
-      if (path.endsWith("/agent-definitions/draft"))
-        return Promise.resolve(
-          json({ draft: { systemPrompt: "Research carefully." } }),
-        );
-      if (path.endsWith("/agent-definitions")) {
-        creationStarted = true;
-        return pending.promise;
-      }
-      return baseFetch(input, init);
-    }) as typeof fetch;
-    const queryClient = createTestQueryClient();
-    const navigated: string[] = [];
-    await renderPicker((to) => navigated.push(to), queryClient);
-    const button = (label: string) =>
-      [...document.querySelectorAll("button")].find(
-        (element) => element.textContent === label,
-      );
-    await act(async () => button("+ Add agent")?.click());
-    await act(async () => button("+ Create agent")?.click());
-    await settle();
-    const name = document.getElementById("create-agent-name");
-    const setter = Object.getOwnPropertyDescriptor(
-      window.HTMLInputElement.prototype,
-      "value",
-    )?.set;
-    if (!(name instanceof HTMLInputElement) || setter === undefined)
-      throw new Error("Agent name input is missing");
-    await act(async () => {
-      setter.call(name, "Research Buddy");
-      name.dispatchEvent(new Event("input", { bubbles: true }));
-    });
-    await act(async () => button("Get started")?.click());
-    expect(creationStarted).toBe(true);
-    await act(async () => {
-      queryClient.setQueryData(["me", "principals"], {
-        data: [
-          {
-            ...MEMBERSHIP.data[0],
-            tenantId: "tnt_2",
-            tenantName: "Second Bench",
-          },
-        ],
-        nextCursor: null,
-      });
-    });
-    await settle();
-    await settle();
-    expect(document.querySelector('[role="dialog"]')).toBeNull();
-    expect(
-      calls.some((call) =>
-        call.path.includes("/tenants/tnt_2/chat/invitable-definitions"),
-      ),
-    ).toBe(true);
-    await act(async () =>
-      pending.resolve(
-        json(
-          {
-            id: "wfd_new",
-            tenantId: "tnt_1",
-            name: "research-buddy",
-            description: null,
-            currentVersion: "1",
-            status: "deployed",
-            createdAt: "2026-09-08T00:00:00.000Z",
-            updatedAt: "2026-09-08T00:00:00.000Z",
-            skills: [],
-          },
-          201,
-        ),
-      ),
-    );
-    await settle();
-    await act(async () => typeIntoPrompt("Research our next partner"));
-    await act(async () =>
-      promptInput()?.dispatchEvent(
-        new KeyboardEvent("keydown", { key: "Enter", bubbles: true }),
-      ),
-    );
-    for (let i = 0; i < 20 && navigated.length === 0; i++) await settle();
-    expect(navigated).toEqual(["/w/chan_new"]);
-    expect(sentInvite).toBeUndefined();
-  });
-
-  test("empty descriptions from the agent list display the agent name", async () => {
-    stubFetch(() => undefined);
-    const queryClient = createTestQueryClient();
-    await renderPicker(undefined, queryClient);
-    await act(async () =>
-      queryClient.setQueryData(
-        ["tenant", "tnt_1", "invitable-definitions"],
-        [{ id: "wfd_empty", name: "research-buddy", description: "" }],
-      ),
-    );
-    await settle();
-    const add = [...document.querySelectorAll("button")].find(
-      (button) => button.textContent === "+ Add agent",
-    );
-    await act(async () => add?.click());
-    expect(
-      document.getElementById("new-workbench-agent-wfd_empty")?.textContent,
-    ).toContain("Research Buddy");
-  });
-
-  test("an empty agent list still offers creation and cancel preserves the draft", async () => {
-    stubFetch((path) => {
-      if (path.includes("/catalog/models"))
-        return json({ data: [], nextCursor: null });
-      if (path.endsWith("/skills")) return json({ skills: [] });
-      return undefined;
-    });
-    const queryClient = createTestQueryClient();
-    await renderPicker(undefined, queryClient);
-    await act(async () => {
-      queryClient.setQueryData(
-        ["tenant", "tnt_1", "invitable-definitions"],
-        [],
-      );
-      typeIntoPrompt("Keep this draft");
-    });
-    const button = (label: string) =>
-      [...document.querySelectorAll("button")].find(
-        (element) => element.textContent === label,
-      );
-    await act(async () => button("+ Add agent")?.click());
-    expect(
-      document.querySelector(".new-workbench-agent-empty")?.textContent,
-    ).toContain("No agents are available yet.");
-    expect(button("+ Create agent")).toBeDefined();
-    await act(async () => button("+ Create agent")?.click());
-    await settle();
-    expect(document.querySelector('[role="dialog"]')).not.toBeNull();
-    const cancel = [
-      ...document.querySelectorAll<HTMLButtonElement>('[role="dialog"] button'),
-    ].find((element) => element.textContent === "Cancel");
-    expect(cancel?.disabled).toBe(false);
-    await act(async () => cancel?.click());
-    await settle();
-    expect(document.querySelector('[role="dialog"]') === null).toBe(true);
-    expect(promptInput()?.value).toBe("Keep this draft");
-    expect(document.querySelector(".new-workbench-agent-chip")).toBeNull();
-  });
-
-  test("Enter on a no-match agent search does not create a workbench", async () => {
-    const calls = stubBlankCreate(
-      undefined,
-      json({ error: "agent launch failed" }, 409),
-    );
-    const navigated: string[] = [];
-    await renderPicker((to) => navigated.push(to));
-    typeIntoPrompt("Research our next partner");
-
-    for (let i = 0; i < 20; i++) {
-      await settle();
-      if (container?.textContent?.includes("+ Add agent")) break;
-    }
-    const addAgent = Array.from(
-      container?.querySelectorAll<HTMLButtonElement>("button") ?? [],
-    ).find((button) => button.textContent === "+ Add agent");
-    await act(async () => {
-      addAgent?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-    });
-    const search = document.querySelector<HTMLInputElement>(
-      'input[role="combobox"]',
-    );
-    const setter = Object.getOwnPropertyDescriptor(
-      window.HTMLInputElement.prototype,
-      "value",
-    )?.set;
-    await act(async () => {
-      setter?.call(search, "zzz-no-match");
-      search?.dispatchEvent(new Event("input", { bubbles: true }));
-    });
-    await act(async () => {
-      // Synthetic keydown does not run the browser's implicit-submission
-      // default action, so the defect shows as a missing cancellation:
-      // pre-fix, a no-match Enter left the event uncancelled and the real
-      // browser submitted the form.
-      const event = new KeyboardEvent("keydown", {
-        key: "Enter",
-        bubbles: true,
-        cancelable: true,
-      });
-      search?.dispatchEvent(event);
-      expect(event.defaultPrevented).toBe(true);
-    });
-    await settle();
-
-    expect(document.querySelector(".new-workbench-agent-empty")).not.toBeNull();
-    expect(
-      calls.some(
-        (call) =>
-          call.path.endsWith("/chat/workbenches") &&
-          call.init?.method === "POST",
-      ),
-    ).toBe(false);
-    expect(navigated).toEqual([]);
-  });
-
-  test("Escape closes the agent picker and returns focus to its trigger", async () => {
-    stubFetch(() => undefined);
-    await renderPicker();
-
-    for (let i = 0; i < 20; i++) {
-      await settle();
-      if (container?.textContent?.includes("+ Add agent")) break;
-    }
-    const addAgent = Array.from(
-      container?.querySelectorAll<HTMLButtonElement>("button") ?? [],
-    ).find((button) => button.textContent === "+ Add agent");
-    await act(async () => {
-      addAgent?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-    });
-    const search = document.querySelector<HTMLInputElement>(
-      'input[role="combobox"]',
-    );
-    await act(async () => {
-      search?.dispatchEvent(
-        new KeyboardEvent("keydown", { key: "Escape", bubbles: true }),
-      );
-    });
-    await settle();
-
-    expect(document.querySelector(".new-workbench-agent-popover")).toBeNull();
-    expect(document.activeElement).toBe(addAgent ?? null);
-  });
-
-  test("Shift+Enter does not submit — the prompt box stays open for a new line", async () => {
-    stubFetch(() => undefined);
-    await renderPicker();
-
-    await act(async () => {
-      typeIntoPrompt("line one");
-    });
-    await act(async () => {
-      promptInput()?.dispatchEvent(
-        new KeyboardEvent("keydown", {
-          key: "Enter",
-          shiftKey: true,
-          bubbles: true,
-        }),
-      );
-    });
-    await settle();
-
-    expect(container?.querySelector(".chat-workbench-loading")).toBeNull();
-    expect(promptInput()?.value).toBe("line one");
-  });
-
-  test("submitting an empty prompt does nothing", async () => {
-    stubFetch(() => undefined);
-    const navigated: string[] = [];
-    await renderPicker((to) => navigated.push(to));
-
-    await act(async () => {
-      promptInput()?.dispatchEvent(
-        new KeyboardEvent("keydown", { key: "Enter", bubbles: true }),
-      );
-    });
-    await settle();
-
-    expect(navigated).toEqual([]);
-  });
-
-  // CL-6510: a bench whose default agents haven't finished deploying yet
-  // (CL-6457's background drain still running, or never started without a
-  // credential) must never dead-end the person on the raw internal
-  // precondition message — the picker checks readiness first and shows an
-  // honest, retryable "still setting up" state instead.
-  test("when the setup agent isn't deployed yet, creating shows an honest still-setting-up state, not the raw precondition error", async () => {
-    stubFetch((path) => {
-      if (path.includes("/workflows/definitions")) {
-        return json({ data: [], nextCursor: null });
-      }
-      // CL-8112 T1: no `/api/onboarding/*` request anywhere on this
-      // path — the empty native definition alone drives the retry panel.
-      return undefined;
-    });
-    await renderPicker();
-
-    const justTalk = container?.querySelector<HTMLButtonElement>(
-      ".new-workbench-empty-channel",
-    );
-    await act(async () => {
-      justTalk?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-    });
-    for (let i = 0; i < 20; i++) {
-      await settle();
-      if (container?.textContent?.includes("Still setting up")) break;
-    }
-
-    expect(container?.textContent).toContain("Still setting up your workbench");
-    expect(container?.textContent).not.toContain(
-      "No default setup agent found",
-    );
-  });
-
-  test("clicking the Code review card mints a workbench from the template, then navigates in", async () => {
-    const createdAgentHandles: string[] = [];
-    const calls = stubFetch((path, init) => {
-      if (path.includes("/workflows/definitions")) {
-        return json({
-          data: [
-            {
-              id: "wfd_assistant",
-              tenantId: "tnt_1",
-              name: "assistant",
-              currentVersion: "1",
-              status: "deployed",
-              createdAt: "2026-01-01T00:00:00.000Z",
-              updatedAt: "2026-01-01T00:00:00.000Z",
-            },
-          ],
-          nextCursor: null,
-        });
-      }
-      if (path.endsWith("/chat/workbenches") && init?.method === "POST") {
-        return json({
-          id: "chan_new",
-          title: "New Workbench",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-        });
-      }
-      if (
-        path.endsWith("/template-blocks/code-review/deploy") &&
-        init?.method === "POST"
-      ) {
-        return json({ id: "wfd_code_review", created: true }, 201);
-      }
-      if (path.endsWith("/agent-definitions") && init?.method === "POST") {
-        const body = JSON.parse(String(init.body)) as { handle: string };
-        createdAgentHandles.push(body.handle);
-        return json({
-          id: `wfd_${body.handle}`,
-          tenantId: "tnt_1",
-          name: body.handle,
-          currentVersion: "1",
-          status: "deployed",
-          createdAt: "2026-01-01T00:00:00.000Z",
-          updatedAt: "2026-01-01T00:00:00.000Z",
-          skills: [],
-        });
-      }
-      if (
-        path.endsWith("/chat/workbenches/chan_new/invite") &&
-        init?.method === "POST"
-      ) {
-        const body = JSON.parse(String(init.body)) as {
-          definitionId: string;
-        };
-        return json({
-          address: `${body.definitionId}@chan_new`,
-          definitionId: body.definitionId,
-        });
-      }
-      if (
-        path.endsWith("/chat/workbenches/chan_new/onboarding") &&
-        init?.method === "POST"
-      ) {
-        return json({ id: "msg_onboarding" }, 201);
-      }
-      if (path.endsWith("/chat/workbenches/chan_new/settings")) {
-        return json({
-          id: "chan_new",
-          title: "New Workbench",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-          settings: {
-            "template/id": "code-review",
-            "template/pendingConnections": ["github"],
-          },
-          contextWindow: { value: 0, source: "inherit" },
-        });
-      }
-      return undefined;
-    });
-
-    const navigated: string[] = [];
-    await renderPicker((to) => navigated.push(to));
-
-    const codeReview = prefabCards().find((card) =>
-      card.textContent?.includes("Code review"),
-    );
-    await act(async () => {
-      codeReview?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-    });
-    for (let i = 0; i < 20; i++) {
-      await settle();
-      if (navigated.length > 0) break;
-    }
-
-    expect(navigated).toEqual(["/w/chan_new"]);
-
-    const createWorkbenchCall = calls.find(
-      (call) =>
-        call.path.endsWith("/chat/workbenches") && call.init?.method === "POST",
-    );
-    expect(JSON.parse(String(createWorkbenchCall?.init?.body))).toMatchObject({
-      kind: "workbench",
-    });
-    expect(
-      JSON.parse(String(createWorkbenchCall?.init?.body)).definitionId,
-    ).toBeUndefined();
-
-    expect(createdAgentHandles).toEqual([
-      "correctness-reviewer",
-      "architecture-reviewer",
-      "release-risk-reviewer",
-    ]);
-
-    // CL-6405: instantiation also deploys the manifest's referenced
-    // code-review block workflow, not just the reviewer roster.
-    const blockDeploy = calls.find(
-      (call) =>
-        call.path.endsWith("/template-blocks/code-review/deploy") &&
-        call.init?.method === "POST",
-    );
-    expect(blockDeploy).not.toBeUndefined();
-
-    const settingsPatch = calls.find((call) =>
-      call.path.endsWith("/chat/workbenches/chan_new/settings"),
-    );
-    expect(JSON.parse(String(settingsPatch?.init?.body))).toEqual({
-      "template/id": "code-review",
-      "template/pendingConnections": ["github"],
-    });
-  });
-
-  // The in-room card is the one walkthrough: /new never opens a repo
-  // dialog of its own, connected or not.
-  test("clicking the Code review card opens no repo dialog — the walkthrough card owns repo pick", async () => {
-    stubFetch((path, init) => {
-      if (path.includes("/workflows/definitions")) {
-        return json({
-          data: [
-            {
-              id: "wfd_assistant",
-              tenantId: "tnt_1",
-              name: "assistant",
-              currentVersion: "1",
-              status: "deployed",
-              createdAt: "2026-01-01T00:00:00.000Z",
-              updatedAt: "2026-01-01T00:00:00.000Z",
-            },
-          ],
-          nextCursor: null,
-        });
-      }
-      if (path.endsWith("/chat/workbenches") && init?.method === "POST") {
-        return json({
-          id: "chan_new",
-          title: "New Workbench",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-        });
-      }
-      if (
-        path.endsWith("/template-blocks/code-review/deploy") &&
-        init?.method === "POST"
-      ) {
-        return json({ id: "wfd_code_review", created: true }, 201);
-      }
-      if (path.endsWith("/agent-definitions") && init?.method === "POST") {
-        const body = JSON.parse(String(init.body)) as { handle: string };
-        return json({
-          id: `wfd_${body.handle}`,
-          tenantId: "tnt_1",
-          name: body.handle,
-          currentVersion: "1",
-          status: "deployed",
-          createdAt: "2026-01-01T00:00:00.000Z",
-          updatedAt: "2026-01-01T00:00:00.000Z",
-          skills: [],
-        });
-      }
-      if (
-        path.endsWith("/chat/workbenches/chan_new/invite") &&
-        init?.method === "POST"
-      ) {
-        const body = JSON.parse(String(init.body)) as {
-          definitionId: string;
-        };
-        return json({
-          address: `${body.definitionId}@chan_new`,
-          definitionId: body.definitionId,
-        });
-      }
-      if (
-        path.endsWith("/chat/workbenches/chan_new/onboarding") &&
-        init?.method === "POST"
-      ) {
-        return json({ id: "msg_onboarding" }, 201);
-      }
-      if (path.endsWith("/chat/workbenches/chan_new/settings")) {
-        return json({
-          id: "chan_new",
-          title: "New Workbench",
-          kind: "workbench",
-          pinned: false,
-          participants: [],
-          settings: {
-            "template/id": "code-review",
-            "template/pendingConnections": ["github"],
-          },
-          contextWindow: { value: 0, source: "inherit" },
-        });
-      }
-      return undefined;
-    });
-
-    const navigated: string[] = [];
-    await renderPicker((to) => navigated.push(to));
-
-    const codeReview = prefabCards().find((card) =>
-      card.textContent?.includes("Code review"),
-    );
-    await act(async () => {
-      codeReview?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
-    });
-    for (let i = 0; i < 20; i++) {
-      await settle();
-      if (navigated.length > 0) break;
-    }
-
-    expect(navigated).toEqual(["/w/chan_new"]);
-    expect(document.body.textContent).not.toContain(
-      "Choose repos this workbench can work on",
-    );
-    expect(
-      Array.from(document.querySelectorAll("button")).some((button) =>
-        button.textContent?.startsWith("Start reviewing"),
-      ),
-    ).toBe(false);
-  });
-});
diff --git a/apps/web/test/routines-available-section.test.tsx b/apps/web/test/routines-available-section.test.tsx
index 18cbe107f6..215ef992bd 100644
--- a/apps/web/test/routines-available-section.test.tsx
+++ b/apps/web/test/routines-available-section.test.tsx
@@ -1,8 +1,8 @@
 // Screen-level proof for the Routines page's "Available" section
 // (CL-7073): lists catalog workflows the bench hasn't added yet, Add
-// posts through the existing template-blocks deploy route, and a
-// missing required connection disables Add with a reason instead of
-// letting the request fail.
+// posts through the catalog-blocks deploy route, and a missing required
+// connection disables Add with a reason instead of letting the request
+// fail.
 
 import { describe, expect, test } from "bun:test";
 import { act, createElement } from "react";
@@ -124,7 +124,7 @@ describe("AvailableCatalogWorkflowsSection", () => {
     }
   });
 
-  test("Add posts to the template-blocks deploy route and the entry disappears from Available", async () => {
+  test("Add posts to the catalog-blocks deploy route and the entry disappears from Available", async () => {
     let available = [echo];
     let deployCalls = 0;
     const { container, root } = await render((async (
@@ -135,7 +135,7 @@ describe("AvailableCatalogWorkflowsSection", () => {
       if (url.includes("/workflows/available")) {
         return jsonResponse({ items: available });
       }
-      if (url.includes("/template-blocks/echo/deploy")) {
+      if (url.includes("/catalog-blocks/echo/deploy")) {
         deployCalls += 1;
         expect(init?.method).toBe("POST");
         available = [];
diff --git a/packages/chat-ui/package.json b/packages/chat-ui/package.json
index 3f4c8d689a..faac02a3e3 100644
--- a/packages/chat-ui/package.json
+++ b/packages/chat-ui/package.json
@@ -33,7 +33,7 @@
     "@corbits/react-ui": "github:corbitsdev/react-ui#3b122812a307ccb35be31386f7696020c5a84635",
     "@tanstack/react-query": "catalog:",
     "@corbits/connections": "workspace:*",
-    "@workbench/templates": "workspace:*",
+    "@corbits/jimmy-agent": "workspace:*",
     "arktype": "catalog:",
     "@corbits/icons": "workspace:*",
     "react": "^19.2.0",
diff --git a/packages/chat-ui/src/api.ts b/packages/chat-ui/src/api.ts
index a4d21d6c0b..8953eff599 100644
--- a/packages/chat-ui/src/api.ts
+++ b/packages/chat-ui/src/api.ts
@@ -17,7 +17,13 @@ import type { ParticipantRecord } from "./wire/participants";
 import type { WorkbenchOnboardingStep } from "./wire/blocks";
 import { UnauthenticatedError } from "@corbits/api-query";
 import { InferenceSettingsApiError } from "@corbits/inference-settings";
-import { jimmyAgentRequest } from "@workbench/templates";
+import {
+  JIMMY_AGENT_ID,
+  JIMMY_DESCRIPTION,
+  JIMMY_DISPLAY_NAME,
+  JIMMY_SYSTEM_PROMPT,
+  JIMMY_TOOL_PACKAGE_PINS,
+} from "@corbits/jimmy-agent/metadata";
 import { CHAT_STRINGS } from "./strings";
 
 export {
@@ -757,13 +763,21 @@ export function postWorkbenchOnboardingStep(
   );
 }
 
-// Jimmy's own request shape, the same `@workbench/templates` object a
-// workbench template's participant create used to resolve — CL-6499 removed
-// Jimmy's template (he is not a "kind of workbench"), so this dialog's own
-// "Add Jimmy" quick-create row (see `invite-agent-dialog.tsx`) is his only
-// create path left. `jimmyAgentRequest()` is pure data (no tool bodies, no
-// server-only imports), safe to call from browser code.
-export const JIMMY_QUICK_CREATE = jimmyAgentRequest();
+// Jimmy's own create-agent request shape — CL-6499 removed his workbench
+// template (he is not a "kind of workbench"), so this dialog's own "Add
+// Jimmy" quick-create row (see `invite-agent-dialog.tsx`) is his only
+// create path left. Built straight off his own package's metadata
+// (pure data, no tool bodies, no server-only imports — safe to reference
+// from browser code) rather than an `AgentDefinition` builder: Jimmy has
+// no handle or display name of his own outside this shape. `JIMMY_AGENT_ID`
+// ("jimmy") is both his id and the handle a person types to reach him.
+export const JIMMY_QUICK_CREATE = {
+  name: JIMMY_DISPLAY_NAME,
+  handle: JIMMY_AGENT_ID,
+  description: JIMMY_DESCRIPTION,
+  systemPrompt: JIMMY_SYSTEM_PROMPT,
+  toolPackagePins: JIMMY_TOOL_PACKAGE_PINS.map((pin) => pin.name),
+};
 
 const CreatedAgentDefinition = type({ id: "string" });
 

From 740b7275aea37a3ffcf9997b5cb2205ea65bec5b Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Thu, 17 Sep 2026 10:24:34 -0700
Subject: [PATCH 6/8] feat!: delete templates/ (@workbench/templates)

Deletes the workspace: the three shipped WorkbenchDefinition bundles
(code-review, gtm, due-diligence), instantiate.ts, settings.ts (already
a re-export of @corbits/connections/template-settings),
participant-agent-requests.ts, and connectors.ts (moved to
@corbits/connections in the prior commit).

Every remaining importer (agent-directory, connections-tools,
connections, onboarding, plugins-ui, settings-ui, workflows,
workflows/assistant) is repointed at the native homes this data always
belonged to: @corbits/workflows/catalog for WORKFLOW_CATALOG and its
helpers, @corbits/connections/{registry,mcp-presets} for
CONNECTOR_REGISTRY/MCP_PRESETS. connections-tools bumps its version
(0.0.9 -> 0.0.10) for the comment-only src/ touch; the browser
walkthrough script's create-workbench flow drives the trimmed picker
(no prefab grid). report-error-baseline.txt regenerated: the two
stale entries under the deleted templates/ and template-library.ts
paths are gone.

Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
---
 package.json                                  |   2 -
 packages/agent-directory/package.json         |   1 -
 packages/agent-directory/src/client.ts        |   2 +-
 .../src/resolve-myra-definition-id.ts         |   2 +-
 packages/agent-directory/src/validation.ts    |   9 +-
 .../src/visible-definitions.ts                |   2 +-
 .../src/workflow-create-routes.ts             |   2 +-
 packages/connections-tools/package.json       |   2 +-
 packages/connections-tools/src/tool.test.ts   |   7 +-
 packages/connections-tools/src/tool.ts        |   3 +-
 packages/connections/src/routes.ts            |   6 +-
 packages/onboarding/package.json              |   1 -
 .../onboarding/src/complete-credential.ts     |   2 +-
 packages/onboarding/src/routes.ts             |   2 +-
 packages/onboarding/src/tenant-seed.ts        |   2 +-
 packages/plugins-ui/package.json              |   1 -
 packages/plugins-ui/src/mcp-preset-cards.tsx  |   6 +-
 .../plugins-ui/src/mcp-servers-section.tsx    |   2 +-
 .../plugins-ui/src/plugin-connect-panel.tsx   |   2 +-
 packages/plugins-ui/src/plugins-gallery.tsx   |   2 +-
 .../plugins-ui/test/mcp-preset-cards.test.tsx |   2 +-
 packages/plugins-ui/test/plugin-meta.test.ts  |   6 +-
 .../plugins-ui/test/plugins-gallery.test.tsx  |   2 +-
 packages/settings-ui/package.json             |   2 +-
 .../src/connections-pinned-by.test.ts         |   2 +-
 .../settings-ui/src/connections-section.tsx   |   8 +-
 packages/workflows/package.json               |   1 -
 packages/workflows/src/catalog.test.ts        |   6 +-
 scripts/checks/report-error-baseline.txt      |   2 -
 scripts/e2e/browser/walkthrough.ts            |  33 +-
 templates/LICENSE                             | 176 ----
 templates/README.md                           |  16 -
 templates/code-review/index.ts                |  74 --
 templates/connectors.test.ts                  | 466 ----------
 templates/connectors.ts                       | 826 ------------------
 templates/due-diligence/index.ts              |  40 -
 templates/gtm/index.ts                        |  97 --
 templates/index.ts                            | 472 ----------
 templates/instantiate.test.ts                 | 288 ------
 templates/instantiate.ts                      | 203 -----
 templates/package.json                        |  33 -
 templates/participant-agent-requests.ts       |  49 --
 templates/schema.test.ts                      | 305 -------
 templates/settings.test.ts                    |  16 -
 templates/settings.ts                         |  12 -
 templates/tsconfig.json                       |   8 -
 workflows/assistant/package.json              |   1 -
 workflows/assistant/src/prompt.ts             |   2 +-
 .../test/manager-tools-scenario.test.ts       |   6 +-
 49 files changed, 45 insertions(+), 3167 deletions(-)
 delete mode 100644 templates/LICENSE
 delete mode 100644 templates/README.md
 delete mode 100644 templates/code-review/index.ts
 delete mode 100644 templates/connectors.test.ts
 delete mode 100644 templates/connectors.ts
 delete mode 100644 templates/due-diligence/index.ts
 delete mode 100644 templates/gtm/index.ts
 delete mode 100644 templates/index.ts
 delete mode 100644 templates/instantiate.test.ts
 delete mode 100644 templates/instantiate.ts
 delete mode 100644 templates/package.json
 delete mode 100644 templates/participant-agent-requests.ts
 delete mode 100644 templates/schema.test.ts
 delete mode 100644 templates/settings.test.ts
 delete mode 100644 templates/settings.ts
 delete mode 100644 templates/tsconfig.json

diff --git a/package.json b/package.json
index 1af14c30f6..81dbd48dc5 100644
--- a/package.json
+++ b/package.json
@@ -6,7 +6,6 @@
   "workspaces": [
     "apps/*",
     "packages/*",
-    "templates",
     "tools/*",
     "vendor/intx/*",
     "workflows/*"
@@ -41,7 +40,6 @@
     "@intx/crypto": "workspace:*",
     "@intx/log": "workspace:*",
     "@corbits/connections": "workspace:*",
-    "@workbench/templates": "workspace:*",
     "@eslint/js": "^10.0.0",
     "@intx/mime": "0.3.0",
     "@intx/types": "0.3.0",
diff --git a/packages/agent-directory/package.json b/packages/agent-directory/package.json
index 7c0a70a8a3..cbfce8661c 100644
--- a/packages/agent-directory/package.json
+++ b/packages/agent-directory/package.json
@@ -21,7 +21,6 @@
     "@corbits/error-sink": "workspace:*",
     "@corbits/skills": "workspace:*",
     "@corbits/tool-registry-publish": "workspace:*",
-    "@workbench/templates": "workspace:*",
     "@corbits/workflows": "workspace:*",
     "@intx/agent": "workspace:*",
     "@intx/db": "workspace:*",
diff --git a/packages/agent-directory/src/client.ts b/packages/agent-directory/src/client.ts
index fa70971de9..4f087bf541 100644
--- a/packages/agent-directory/src/client.ts
+++ b/packages/agent-directory/src/client.ts
@@ -15,7 +15,7 @@ import {
   withDisplayNames,
   type WithDisplayName,
 } from "@corbits/chat/display-name";
-import { isConversationalWorkflowName } from "@workbench/templates";
+import { isConversationalWorkflowName } from "@corbits/workflows/catalog";
 
 // `deriveDisplayName`/`humanizeSlug` (CL-6413) live in `@corbits/chat`
 // itself, not here: this package already depends on `@corbits/chat` (for
diff --git a/packages/agent-directory/src/resolve-myra-definition-id.ts b/packages/agent-directory/src/resolve-myra-definition-id.ts
index cd9ceb7dad..2c793645ee 100644
--- a/packages/agent-directory/src/resolve-myra-definition-id.ts
+++ b/packages/agent-directory/src/resolve-myra-definition-id.ts
@@ -7,7 +7,7 @@
 import { and, eq } from "drizzle-orm";
 import type { DB } from "@intx/db";
 import { workflowDefinition } from "@intx/db/schema";
-import { WORKFLOW_CATALOG } from "@workbench/templates";
+import { WORKFLOW_CATALOG } from "@corbits/workflows/catalog";
 
 /** Myra's asset name in the seeded workflow catalog — the same lookup
  * `apps/web/src/myra-workbench.ts` does client-side, mirrored here for
diff --git a/packages/agent-directory/src/validation.ts b/packages/agent-directory/src/validation.ts
index 3571f11090..7c50806395 100644
--- a/packages/agent-directory/src/validation.ts
+++ b/packages/agent-directory/src/validation.ts
@@ -67,11 +67,10 @@ export const CreateAgentDefinitionInput = type({
   // `toolPackagePins` names tool packages by name only (no version — the
   // core resolves each to `*`, matching `./workflow-create-routes.ts`'s
   // own handling of the same field). Absent for a person hand-authoring
-  // an agent through a form, which has no affordance for typing one; the
-  // one caller that supplies it is `@workbench/templates`'s
-  // `instantiateWorkbenchTemplate`, installing a template participant
-  // (Scout, Jimmy) whose tools ship as pinned packages rather than
-  // inline capabilities.
+  // an agent through a form, which has no affordance for typing one;
+  // callers that supply it install an agent whose tools ship as pinned
+  // packages rather than inline capabilities (a native `workflows/*`
+  // agent-directory create, Scout, Jimmy).
   "toolPackagePins?": ToolPackagePinArray,
 });
 export type CreateAgentDefinitionInput =
diff --git a/packages/agent-directory/src/visible-definitions.ts b/packages/agent-directory/src/visible-definitions.ts
index 08c01996cd..b9443bf26c 100644
--- a/packages/agent-directory/src/visible-definitions.ts
+++ b/packages/agent-directory/src/visible-definitions.ts
@@ -11,7 +11,7 @@ import { and, eq } from "drizzle-orm";
 import type { DB } from "@intx/db";
 import { getAncestorChain, schema } from "@intx/db";
 import { isWorkbenchHostDefinitionName } from "@corbits/chat/workbench-host-naming";
-import { isConversationalWorkflowName } from "@workbench/templates";
+import { isConversationalWorkflowName } from "@corbits/workflows/catalog";
 import { deriveDisplayName } from "./client";
 
 export type VisibleAgentDefinition = {
diff --git a/packages/agent-directory/src/workflow-create-routes.ts b/packages/agent-directory/src/workflow-create-routes.ts
index a260967e1c..b7352c7527 100644
--- a/packages/agent-directory/src/workflow-create-routes.ts
+++ b/packages/agent-directory/src/workflow-create-routes.ts
@@ -41,7 +41,7 @@ import type { AssetService } from "@intx/hub-sessions";
 
 import { skillNameSchema } from "@corbits/skills";
 import { isWorkbenchHostDefinitionName } from "@corbits/chat/workbench-host-naming";
-import { isAutomatableWorkflowName } from "@workbench/templates";
+import { isAutomatableWorkflowName } from "@corbits/workflows/catalog";
 
 import {
   createAgentDefinitionCore,
diff --git a/packages/connections-tools/package.json b/packages/connections-tools/package.json
index 6599c951d5..3fb396a529 100644
--- a/packages/connections-tools/package.json
+++ b/packages/connections-tools/package.json
@@ -2,7 +2,7 @@
   "name": "@corbits/connections-tools",
   "private": true,
   "description": "The list_connections and request_connection tools as an @intx/agent tool bundle: an agent sees which third-party connections this workbench already has live and hands the human a deep link to connect one that isn't, reusing the existing connections plane and never inventing new state or completing OAuth itself",
-  "version": "0.0.9",
+  "version": "0.0.10",
   "license": "LGPL-2.1-or-later",
   "type": "module",
   "exports": {
diff --git a/packages/connections-tools/src/tool.test.ts b/packages/connections-tools/src/tool.test.ts
index 5e14ab35d1..c44e6cf47f 100644
--- a/packages/connections-tools/src/tool.test.ts
+++ b/packages/connections-tools/src/tool.test.ts
@@ -11,9 +11,10 @@ import {
 } from "./tool";
 
 // A minimal registry/preset fixture, standing in for whatever connector
-// set the deploying build actually wires (e.g. Workbench's
-// `@workbench/templates`) — this package carries no default of its own,
-// so its tests exercise the lookup logic against a small stand-in.
+// set the deploying build actually wires (e.g. Workbench's own
+// `@corbits/connections/registry` `CONNECTOR_REGISTRY`) — this package
+// carries no default of its own, so its tests exercise the lookup logic
+// against a small stand-in.
 const TEST_CONNECTOR_REGISTRY = createConnectorRegistry({
   github: {
     id: "github",
diff --git a/packages/connections-tools/src/tool.ts b/packages/connections-tools/src/tool.ts
index 2608617beb..f5ae93290b 100644
--- a/packages/connections-tools/src/tool.ts
+++ b/packages/connections-tools/src/tool.ts
@@ -58,7 +58,8 @@ export interface WorkflowConnectionEnv extends BaseEnv {
    * default registry of its own (that would hardcode one product's
    * connector lineup into a bundle any Interchange-backed hub should
    * be able to install), so the caller wiring this env supplies its
-   * own, e.g. Workbench's `@workbench/templates`' `CONNECTOR_REGISTRY`. */
+   * own, e.g. Workbench's `@corbits/connections/registry`'s
+   * `CONNECTOR_REGISTRY`. */
   readonly connectorRegistry: ConnectorRegistry;
   /** Same reasoning as `connectorRegistry`, for curated MCP presets. */
   readonly mcpPresets: readonly McpPreset[];
diff --git a/packages/connections/src/routes.ts b/packages/connections/src/routes.ts
index 9543814eac..3e17918996 100644
--- a/packages/connections/src/routes.ts
+++ b/packages/connections/src/routes.ts
@@ -193,10 +193,8 @@ export type CreateConnectionRoutesDeps = {
   hubUrl: string;
   requireGrant: RequireGrant;
   log: (line: string) => void;
-  /** The connector set this build ships — this package carries none of
-   * its own (CL-7384), so a caller always supplies one (the hub passes
-   * `@workbench/templates/connectors`' `CONNECTOR_REGISTRY`; a test
-   * passes its own stub). */
+  /** The connector set this build ships — this module's own
+   * `CONNECTOR_REGISTRY` for the hub; a test passes its own stub. */
   registry: Readonly<Record<string, ConnectorDescriptor>>;
   /** Test-only override, matching `complete-credential.ts`'s `seedCatalogFn`
    * override pattern — lets `routes.test.ts` stub credential storage
diff --git a/packages/onboarding/package.json b/packages/onboarding/package.json
index f007687d3c..b4b53cdeeb 100644
--- a/packages/onboarding/package.json
+++ b/packages/onboarding/package.json
@@ -41,7 +41,6 @@
     "@corbits/connections": "workspace:*",
     "@corbits/hub-api-client": "workspace:*",
     "@corbits/tool-registry-publish": "workspace:*",
-    "@workbench/templates": "workspace:*",
     "arktype": "catalog:",
     "drizzle-orm": "catalog:",
     "hono": "catalog:",
diff --git a/packages/onboarding/src/complete-credential.ts b/packages/onboarding/src/complete-credential.ts
index b8087a7e9f..8da944cfaa 100644
--- a/packages/onboarding/src/complete-credential.ts
+++ b/packages/onboarding/src/complete-credential.ts
@@ -79,7 +79,7 @@ import {
   persistConnectorCredential,
   type PersistConnectorCredentialFns,
 } from "@corbits/connections/persist-credential";
-import { CONNECTOR_REGISTRY } from "@workbench/templates/connectors";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 import { TENANT_DESIRED_STATE, seededWorkflowNames } from "./desired-state";
 import { personalTenantSlug } from "./provision";
 
diff --git a/packages/onboarding/src/routes.ts b/packages/onboarding/src/routes.ts
index 74ed850707..9d006fec11 100644
--- a/packages/onboarding/src/routes.ts
+++ b/packages/onboarding/src/routes.ts
@@ -61,7 +61,7 @@ import {
   type ConnectorDescriptor,
   type OAuthExchangeResult,
 } from "@corbits/connections";
-import { CONNECTOR_REGISTRY } from "@workbench/templates/connectors";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 import type { PendingSeedStore } from "./pending-seed";
 import { exchangeCodeForKey } from "./openrouter-connect";
 import { exchangeCodeForToken as exchangeHuggingFaceCodeForToken } from "./huggingface-connect";
diff --git a/packages/onboarding/src/tenant-seed.ts b/packages/onboarding/src/tenant-seed.ts
index d4e0a01ecd..6e1d5ab9c2 100644
--- a/packages/onboarding/src/tenant-seed.ts
+++ b/packages/onboarding/src/tenant-seed.ts
@@ -95,7 +95,7 @@ import {
   buildDiligenceBriefWorkflow,
   serializeDiligenceBriefWorkflow,
 } from "@corbits/diligence-brief-workflow";
-import { WORKFLOW_CATALOG } from "@workbench/templates";
+import { WORKFLOW_CATALOG } from "@corbits/workflows/catalog";
 import { type PublishCorbitsToolsRegistryArgs } from "@corbits/tool-registry-publish";
 import { WORKFLOW_SOURCE_ENTRY } from "@corbits/workflows";
 import {
diff --git a/packages/plugins-ui/package.json b/packages/plugins-ui/package.json
index 335e672034..13f586b2d6 100644
--- a/packages/plugins-ui/package.json
+++ b/packages/plugins-ui/package.json
@@ -17,7 +17,6 @@
     "@corbits/react-ui": "github:corbitsdev/react-ui#3b122812a307ccb35be31386f7696020c5a84635",
     "@corbits/settings-ui": "workspace:*",
     "@corbits/connections": "workspace:*",
-    "@workbench/templates": "workspace:*",
     "arktype": "catalog:",
     "@corbits/icons": "workspace:*",
     "react": "^19.2.0",
diff --git a/packages/plugins-ui/src/mcp-preset-cards.tsx b/packages/plugins-ui/src/mcp-preset-cards.tsx
index 1fc582424f..e7384a12ce 100644
--- a/packages/plugins-ui/src/mcp-preset-cards.tsx
+++ b/packages/plugins-ui/src/mcp-preset-cards.tsx
@@ -4,10 +4,8 @@
 
 import { reportError } from "@corbits/error-sink";
 import { Button, toast } from "@corbits/react-ui";
-import {
-  CONNECTOR_REGISTRY,
-  MCP_PRESETS,
-} from "@workbench/templates/connectors";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
+import { MCP_PRESETS } from "@corbits/connections/mcp-presets";
 import { useEffect, useState } from "react";
 
 import {
diff --git a/packages/plugins-ui/src/mcp-servers-section.tsx b/packages/plugins-ui/src/mcp-servers-section.tsx
index 50f5d87050..ac62f871b0 100644
--- a/packages/plugins-ui/src/mcp-servers-section.tsx
+++ b/packages/plugins-ui/src/mcp-servers-section.tsx
@@ -9,7 +9,7 @@
 // advertising a URL/token form as an installation path.
 
 import { ConfirmButton, toast } from "@corbits/react-ui";
-import { MCP_PRESETS } from "@workbench/templates/connectors";
+import { MCP_PRESETS } from "@corbits/connections/mcp-presets";
 import { PuzzlePiece } from "@corbits/icons";
 import { useEffect, useState } from "react";
 
diff --git a/packages/plugins-ui/src/plugin-connect-panel.tsx b/packages/plugins-ui/src/plugin-connect-panel.tsx
index 915085b69a..c1daa20822 100644
--- a/packages/plugins-ui/src/plugin-connect-panel.tsx
+++ b/packages/plugins-ui/src/plugin-connect-panel.tsx
@@ -31,7 +31,7 @@ import {
   fetchOAuthConfigured,
   oauthStartHref,
 } from "@corbits/settings-ui";
-import { CONNECTOR_REGISTRY } from "@workbench/templates/connectors";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 import type { ResolvedPlugin } from "@corbits/connections/plugins";
 import { useEffect, useState } from "react";
 
diff --git a/packages/plugins-ui/src/plugins-gallery.tsx b/packages/plugins-ui/src/plugins-gallery.tsx
index 6e8c6ec57c..ac2428b578 100644
--- a/packages/plugins-ui/src/plugins-gallery.tsx
+++ b/packages/plugins-ui/src/plugins-gallery.tsx
@@ -7,7 +7,7 @@ import type { ResolvedPlugin } from "@corbits/connections/plugins";
 import {
   MCP_PRESETS,
   MCP_PRESET_CONNECTOR_IDS,
-} from "@workbench/templates/connectors";
+} from "@corbits/connections/mcp-presets";
 
 import { McpServersSection } from "./mcp-servers-section";
 import { McpPresetCard, useMcpPresetCatalog } from "./mcp-preset-cards";
diff --git a/packages/plugins-ui/test/mcp-preset-cards.test.tsx b/packages/plugins-ui/test/mcp-preset-cards.test.tsx
index 70a5179396..5b6653bd53 100644
--- a/packages/plugins-ui/test/mcp-preset-cards.test.tsx
+++ b/packages/plugins-ui/test/mcp-preset-cards.test.tsx
@@ -8,7 +8,7 @@ import { act } from "react";
 import { createRoot } from "react-dom/client";
 import type { Root } from "react-dom/client";
 
-import { MCP_PRESETS } from "@workbench/templates/connectors";
+import { MCP_PRESETS } from "@corbits/connections/mcp-presets";
 
 import { McpPresetCard, useMcpPresetCatalog } from "../src/mcp-preset-cards";
 import type { McpPreset } from "../src/mcp-servers-api";
diff --git a/packages/plugins-ui/test/plugin-meta.test.ts b/packages/plugins-ui/test/plugin-meta.test.ts
index c77ce3e20e..59171571a5 100644
--- a/packages/plugins-ui/test/plugin-meta.test.ts
+++ b/packages/plugins-ui/test/plugin-meta.test.ts
@@ -1,10 +1,10 @@
 import { expect, test } from "bun:test";
 import { Stack } from "@corbits/icons";
-import { connectorDescriptors } from "@corbits/connections/registry";
 import {
+  connectorDescriptors,
   CONNECTOR_REGISTRY,
-  MCP_PRESETS,
-} from "@workbench/templates/connectors";
+} from "@corbits/connections/registry";
+import { MCP_PRESETS } from "@corbits/connections/mcp-presets";
 
 import { pluginCategory, pluginIcon, pluginOutcome } from "../src/plugin-meta";
 import { isNativePluginCatalogDescriptor } from "../src/plugins-gallery";
diff --git a/packages/plugins-ui/test/plugins-gallery.test.tsx b/packages/plugins-ui/test/plugins-gallery.test.tsx
index 5eefc3dda9..f9ec53cf4c 100644
--- a/packages/plugins-ui/test/plugins-gallery.test.tsx
+++ b/packages/plugins-ui/test/plugins-gallery.test.tsx
@@ -5,7 +5,7 @@ import type { Root } from "react-dom/client";
 
 import type { ConnectorDescriptor } from "@corbits/connections/registry";
 import type { ResolvedPlugin } from "@corbits/connections/plugins";
-import { MCP_PRESETS } from "@workbench/templates/connectors";
+import { MCP_PRESETS } from "@corbits/connections/mcp-presets";
 
 import { PluginsGallery } from "../src/plugins-gallery";
 import type { SkillCardData } from "../src/skill-card";
diff --git a/packages/settings-ui/package.json b/packages/settings-ui/package.json
index 82220db1ac..a11aeb91f4 100644
--- a/packages/settings-ui/package.json
+++ b/packages/settings-ui/package.json
@@ -23,9 +23,9 @@
     "@corbits/error-sink": "workspace:*",
     "@corbits/inference-settings": "workspace:*",
     "@corbits/react-ui": "github:corbitsdev/react-ui#3b122812a307ccb35be31386f7696020c5a84635",
-    "@workbench/templates": "workspace:*",
     "@intx/types": "workspace:*",
     "@corbits/connections": "workspace:*",
+    "@corbits/workflows": "workspace:*",
     "arktype": "catalog:",
     "@corbits/icons": "workspace:*",
     "react": "^19.2.0",
diff --git a/packages/settings-ui/src/connections-pinned-by.test.ts b/packages/settings-ui/src/connections-pinned-by.test.ts
index 964fca1b83..1e5a1bd0ee 100644
--- a/packages/settings-ui/src/connections-pinned-by.test.ts
+++ b/packages/settings-ui/src/connections-pinned-by.test.ts
@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
-import { WORKFLOW_CATALOG } from "@workbench/templates";
+import { WORKFLOW_CATALOG } from "@corbits/workflows/catalog";
 
 import { CONNECTOR_PINNED_WORKFLOWS } from "./connections-pinned-by";
 
diff --git a/packages/settings-ui/src/connections-section.tsx b/packages/settings-ui/src/connections-section.tsx
index 9dd06bc0f6..16ecbf97c6 100644
--- a/packages/settings-ui/src/connections-section.tsx
+++ b/packages/settings-ui/src/connections-section.tsx
@@ -22,13 +22,11 @@ import {
 } from "@corbits/react-ui";
 import {
   connectorDescriptors,
+  CONNECTOR_REGISTRY,
   type ConnectorDescriptor,
 } from "@corbits/connections/registry";
-import { workflowDisplayName } from "@workbench/templates";
-import {
-  CONNECTOR_REGISTRY,
-  MCP_PRESET_CONNECTOR_IDS,
-} from "@workbench/templates/connectors";
+import { MCP_PRESET_CONNECTOR_IDS } from "@corbits/connections/mcp-presets";
+import { workflowDisplayName } from "@corbits/workflows/catalog";
 import {
   buildEffectiveInferenceRows,
   computeGlobalRoutePatches,
diff --git a/packages/workflows/package.json b/packages/workflows/package.json
index 89be8ee910..0a024a69a0 100644
--- a/packages/workflows/package.json
+++ b/packages/workflows/package.json
@@ -32,7 +32,6 @@
   "devDependencies": {
     "@types/bun": "catalog:",
     "@corbits/connections": "workspace:*",
-    "@workbench/templates": "workspace:*",
     "typescript": "catalog:"
   }
 }
diff --git a/packages/workflows/src/catalog.test.ts b/packages/workflows/src/catalog.test.ts
index 724b93f2b4..eab4edc01e 100644
--- a/packages/workflows/src/catalog.test.ts
+++ b/packages/workflows/src/catalog.test.ts
@@ -1,10 +1,8 @@
 import { type } from "arktype";
 import { describe, expect, test } from "bun:test";
 
-import {
-  CONNECTOR_REGISTRY,
-  MCP_PRESETS,
-} from "@workbench/templates/connectors";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
+import { MCP_PRESETS } from "@corbits/connections/mcp-presets";
 
 import {
   deliveryWorkbenchRequiredForWorkflowName,
diff --git a/scripts/checks/report-error-baseline.txt b/scripts/checks/report-error-baseline.txt
index 4065892977..a000afd775 100644
--- a/scripts/checks/report-error-baseline.txt
+++ b/scripts/checks/report-error-baseline.txt
@@ -25,7 +25,6 @@ apps/hub/src/index.ts	1	email = undefined;
 apps/hub/src/index.ts	1	sidecarAllocationLog.error`Sidecar allocation reconciliation failed: ${error instanceof Error ? error.message : String(error)}`;
 apps/hub/src/mail-redelivery.ts	1	log.warn`could not wake ${recipient} ahead of redelivery: ${
 apps/hub/src/shutdown.ts	1	return { kind: "failed", error };
-apps/hub/src/templates/template-block-routes.ts	1	const message = cause instanceof Error ? cause.message : String(cause);
 apps/sidecar/src/atomic-write.ts	1	logger.warn`parent-dir fsync failed for ${path}; durability is degraded but the file is renamed and fsynced — ${err instanceof Error ? err.message : String(err)}`;
 apps/sidecar/src/concurrency.ts	1	failures.push({ item, error });
 apps/sidecar/src/conversation-state.ts	1	logger.warn`connector route for ${opts.agentKey} could not parse the inbound sender; leaving the thread unadvanced: ${cause instanceof Error ? cause.message : String(cause)}`;
@@ -92,7 +91,6 @@ packages/agent-lifecycle/src/index.ts	1	log.error`lifecycle sweep failed to unde
 packages/approvals/src/allowance.ts	1	deps.log(
 packages/approvals/src/allowance.ts	1	return { outcome: "park", reason: "classification_failed" };
 packages/artifacts-hub/src/routes.ts	1	return c.json(
-packages/artifacts-hub/src/template-library.ts	1	deps.log(
 packages/artifacts-hub/src/workflow-routes.ts	1	return c.json(
 packages/artifacts-hub/src/workflow-routes.ts	2	return c.json(
 packages/capability-tools/src/tool.ts	1	if (err instanceof CapabilityOutOfInventoryError) {
diff --git a/scripts/e2e/browser/walkthrough.ts b/scripts/e2e/browser/walkthrough.ts
index 54bdd0dabe..c4d5c98bd9 100644
--- a/scripts/e2e/browser/walkthrough.ts
+++ b/scripts/e2e/browser/walkthrough.ts
@@ -438,15 +438,12 @@ async function closeCreateAgentDrawer(page: Page): Promise<void> {
 
 // --- the walkthrough -----------------------------------------------------
 
-/** The picker card that mints a plain empty channel (`workbench-templates.ts`). */
-const BLANK_TEMPLATE_TITLE = "Just start talking";
-
 /**
  * Drives the one creation flow a person actually walks: the sidebar's "+"
- * opens `/new` (prompt-primary picker). Clicking a prefab card mints
- * immediately — no kind radiogroup, no second "Create workbench" step.
- * Waits for the URL to land on a fresh `/w/:id` distinct from wherever
- * the click started.
+ * opens `/new` (prompt-primary picker, CL-8156 — a plain tenant + Myra,
+ * no template cards). Clicking the empty-channel button mints
+ * immediately. Waits for the URL to land on a fresh `/w/:id` distinct
+ * from wherever the click started.
  */
 async function createMyraChat(page: Page): Promise<void> {
   const before = await page.evaluate(() => window.location.pathname);
@@ -457,27 +454,7 @@ async function createMyraChat(page: Page): Promise<void> {
   let landed = false;
   for (let attempt = 0; attempt < 3 && !landed; attempt += 1) {
     await clickStable(page, 'button[aria-label="New workbench"]');
-    await page.waitForSelector(".new-workbench-prefab-grid", {
-      timeout: 15_000,
-    });
-    const picked = await page.evaluate((title: string) => {
-      const rows = Array.from(
-        document.querySelectorAll<HTMLButtonElement>(
-          "button.new-workbench-prefab-card",
-        ),
-      );
-      const row = rows.find((candidate) =>
-        (candidate.textContent ?? "").includes(title),
-      );
-      if (row === undefined) return false;
-      row.click();
-      return true;
-    }, BLANK_TEMPLATE_TITLE);
-    if (!picked) {
-      throw new Error(
-        `the new-workbench picker offered no "${BLANK_TEMPLATE_TITLE}" card`,
-      );
-    }
+    await clickStable(page, "button.new-workbench-empty-channel");
     landed = await page
       .waitForFunction(
         (previous: string) => {
diff --git a/templates/LICENSE b/templates/LICENSE
deleted file mode 100644
index c6487f4fdf..0000000000
--- a/templates/LICENSE
+++ /dev/null
@@ -1,176 +0,0 @@
-GNU LESSER GENERAL PUBLIC LICENSE
-
-Version 2.1, February 1999
-
-Copyright (C) 1991, 1999 Free Software Foundation, Inc.
-51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
-
-Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
-
-[This is the first released version of the Lesser GPL.  It also counts as the successor of the GNU Library Public License, version 2, hence the version number 2.1.]
-
-Preamble
-
-The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public Licenses are intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users.
-
-This license, the Lesser General Public License, applies to some specially designated software packages--typically libraries--of the Free Software Foundation and other authors who decide to use it. You can use it too, but we suggest you first think carefully about whether this license or the ordinary General Public License is the better strategy to use in any particular case, based on the explanations below.
-
-When we speak of free software, we are referring to freedom of use, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish); that you receive source code or can get it if you want it; that you can change the software and use pieces of it in new free programs; and that you are informed that you can do these things.
-
-To protect your rights, we need to make restrictions that forbid distributors to deny you these rights or to ask you to surrender these rights. These restrictions translate to certain responsibilities for you if you distribute copies of the library or if you modify it.
-
-For example, if you distribute copies of the library, whether gratis or for a fee, you must give the recipients all the rights that we gave you. You must make sure that they, too, receive or can get the source code. If you link other code with the library, you must provide complete object files to the recipients, so that they can relink them with the library after making changes to the library and recompiling it. And you must show them these terms so they know their rights.
-
-We protect your rights with a two-step method: (1) we copyright the library, and (2) we offer you this license, which gives you legal permission to copy, distribute and/or modify the library.
-
-To protect each distributor, we want to make it very clear that there is no warranty for the free library. Also, if the library is modified by someone else and passed on, the recipients should know that what they have is not the original version, so that the original author's reputation will not be affected by problems that might be introduced by others.
-
-Finally, software patents pose a constant threat to the existence of any free program. We wish to make sure that a company cannot effectively restrict the users of a free program by obtaining a restrictive license from a patent holder. Therefore, we insist that any patent license obtained for a version of the library must be consistent with the full freedom of use specified in this license.
-
-Most GNU software, including some libraries, is covered by the ordinary GNU General Public License. This license, the GNU Lesser General Public License, applies to certain designated libraries, and is quite different from the ordinary General Public License. We use this license for certain libraries in order to permit linking those libraries into non-free programs.
-
-When a program is linked with a library, whether statically or using a shared library, the combination of the two is legally speaking a combined work, a derivative of the original library. The ordinary General Public License therefore permits such linking only if the entire combination fits its criteria of freedom. The Lesser General Public License permits more lax criteria for linking other code with the library.
-
-We call this license the "Lesser" General Public License because it does Less to protect the user's freedom than the ordinary General Public License. It also provides other free software developers Less of an advantage over competing non-free programs. These disadvantages are the reason we use the ordinary General Public License for many libraries. However, the Lesser license provides advantages in certain special circumstances.
-
-For example, on rare occasions, there may be a special need to encourage the widest possible use of a certain library, so that it becomes a de-facto standard. To achieve this, non-free programs must be allowed to use the library. A more frequent case is that a free library does the same job as widely used non-free libraries. In this case, there is little to gain by limiting the free library to free software only, so we use the Lesser General Public License.
-
-In other cases, permission to use a particular library in non-free programs enables a greater number of people to use a large body of free software. For example, permission to use the GNU C Library in non-free programs enables many more people to use the whole GNU operating system, as well as its variant, the GNU/Linux operating system.
-
-Although the Lesser General Public License is Less protective of the users' freedom, it does ensure that the user of a program that is linked with the Library has the freedom and the wherewithal to run that program using a modified version of the Library.
-
-The precise terms and conditions for copying, distribution and modification follow. Pay close attention to the difference between a "work based on the library" and a "work that uses the library". The former contains code derived from the library, whereas the latter must be combined with the library in order to run.
-
-GNU LESSER GENERAL PUBLIC LICENSE
-TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-0. This License Agreement applies to any software library or other program which contains a notice placed by the copyright holder or other authorized party saying it may be distributed under the terms of this Lesser General Public License (also called "this License"). Each licensee is addressed as "you".
-
-A "library" means a collection of software functions and/or data prepared so as to be conveniently linked with application programs (which use some of those functions and data) to form executables.
-
-The "Library", below, refers to any such software library or work which has been distributed under these terms. A "work based on the Library" means either the Library or any derivative work under copyright law: that is to say, a work containing the Library or a portion of it, either verbatim or with modifications and/or translated straightforwardly into another language. (Hereinafter, translation is included without limitation in the term "modification".)
-
-"Source code" for a work means the preferred form of the work for making modifications to it. For a library, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the library.
-
-Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running a program using the Library is not restricted, and output from such a program is covered only if its contents constitute a work based on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does.
-
-1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and distribute a copy of this License along with the Library.
-
-You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.
-
-2. You may modify your copy or copies of the Library or any portion of it, thus forming a work based on the Library, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:
-
-     a) The modified work must itself be a software library.
-
-     b) You must cause the files modified to carry prominent notices stating that you changed the files and the date of any change.
-
-     c) You must cause the whole of the work to be licensed at no charge to all third parties under the terms of this License.
-
-     d) If a facility in the modified Library refers to a function or a table of data to be supplied by an application program that uses the facility, other than as an argument passed when the facility is invoked, then you must make a good faith effort to ensure that, in the event an application does not supply such function or table, the facility still operates, and performs whatever part of its purpose remains meaningful.
-
-(For example, a function in a library to compute square roots has a purpose that is entirely well-defined independent of the application. Therefore, Subsection 2d requires that any application-supplied function or table used by this function must be optional: if the application does not supply it, the square root function must still compute square roots.)
-
-These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Library, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Library, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.
-
-Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Library.
-
-In addition, mere aggregation of another work not based on the Library with the Library (or with a work based on the Library) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.
-
-3. You may opt to apply the terms of the ordinary GNU General Public License instead of this License to a given copy of the Library. To do this, you must alter all the notices that refer to this License, so that they refer to the ordinary GNU General Public License, version 2, instead of to this License. (If a newer version than version 2 of the ordinary GNU General Public License has appeared, then you can specify that version instead if you wish.) Do not make any other change in these notices.
-
-Once this change is made in a given copy, it is irreversible for that copy, so the ordinary GNU General Public License applies to all subsequent copies and derivative works made from that copy.
-
-This option is useful when you wish to copy part of the code of the Library into a program that is not a library.
-
-4. You may copy and distribute the Library (or a portion or derivative of it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange.
-
-If distribution of object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place satisfies the requirement to distribute the source code, even though third parties are not compelled to copy the source along with the object code.
-
-5. A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License.
-
-However, linking a "work that uses the Library" with the Library creates an executable that is a derivative of the Library (because it contains portions of the Library), rather than a "work that uses the library". The executable is therefore covered by this License. Section 6 states terms for distribution of such executables.
-
-When a "work that uses the Library" uses material from a header file that is part of the Library, the object code for the work may be a derivative work of the Library even though the source code is not. Whether this is true is especially significant if the work can be linked without the Library, or if the work is itself a library. The threshold for this to be true is not precisely defined by law.
-
-If such an object file uses only numerical parameters, data structure layouts and accessors, and small macros and small inline functions (ten lines or less in length), then the use of the object file is unrestricted, regardless of whether it is legally a derivative work. (Executables containing this object code plus portions of the Library will still fall under Section 6.)
-
-Otherwise, if the work is a derivative of the Library, you may distribute the object code for the work under the terms of Section 6. Any executables containing that work also fall under Section 6, whether or not they are linked directly with the Library itself.
-
-6. As an exception to the Sections above, you may also combine or link a "work that uses the Library" with the Library to produce a work containing portions of the Library, and distribute that work under terms of your choice, provided that the terms permit modification of the work for the customer's own use and reverse engineering for debugging such modifications.
-
-You must give prominent notice with each copy of the work that the Library is used in it and that the Library and its use are covered by this License. You must supply a copy of this License. If the work during execution displays copyright notices, you must include the copyright notice for the Library among them, as well as a reference directing the user to the copy of this License. Also, you must do one of these things:
-
-     a) Accompany the work with the complete corresponding machine-readable source code for the Library including whatever changes were used in the work (which must be distributed under Sections 1 and 2 above); and, if the work is an executable linked with the Library, with the complete machine-readable "work that uses the Library", as object code and/or source code, so that the user can modify the Library and then relink to produce a modified executable containing the modified Library. (It is understood that the user who changes the contents of definitions files in the Library will not necessarily be able to recompile the application to use the modified definitions.)
-
-     b) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (1) uses at run time a copy of the library already present on the user's computer system, rather than copying library functions into the executable, and (2) will operate properly with a modified version of the library, if the user installs one, as long as the modified version is interface-compatible with the version that the work was made with.
-
-     c) Accompany the work with a written offer, valid for at least three years, to give the same user the materials specified in Subsection 6a, above, for a charge no more than the cost of performing this distribution.
-
-     d) If distribution of the work is made by offering access to copy from a designated place, offer equivalent access to copy the above specified materials from the same place.
-
-     e) Verify that the user has already received a copy of these materials or that you have already sent this user a copy.
-
-For an executable, the required form of the "work that uses the Library" must include any data and utility programs needed for reproducing the executable from it. However, as a special exception, the materials to be distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.
-
-It may happen that this requirement contradicts the license restrictions of other proprietary libraries that do not normally accompany the operating system. Such a contradiction means you cannot use both them and the Library together in an executable that you distribute.
-
-7. You may place library facilities that are a work based on the Library side-by-side in a single library together with other library facilities not covered by this License, and distribute such a combined library, provided that the separate distribution of the work based on the Library and of the other library facilities is otherwise permitted, and provided that you do these two things:
-
-     a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities. This must be distributed under the terms of the Sections above.
-
-     b) Give prominent notice with the combined library of the fact that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work.
-
-8. You may not copy, modify, sublicense, link with, or distribute the Library except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense, link with, or distribute the Library is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.
-
-9. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Library or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Library (or any work based on the Library), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Library or works based on it.
-
-10. Each time you redistribute the Library (or any work based on the Library), the recipient automatically receives a license from the original licensor to copy, distribute, link with or modify the Library subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties with this License.
-
-11. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Library at all. For example, if a patent license would not permit royalty-free redistribution of the Library by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Library.
-
-If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply, and the section as a whole is intended to apply in other circumstances.
-
-It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.
-
-This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.
-
-12. If the distribution and/or use of the Library is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Library under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.
-
-13. The Free Software Foundation may publish revised and/or new versions of the Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Library does not specify a license version number, you may choose any version ever published by the Free Software Foundation.
-
-14. If you wish to incorporate parts of the Library into other free programs whose distribution conditions are incompatible with these, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.
-
-NO WARRANTY
-
-15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-END OF TERMS AND CONDITIONS
-
-How to Apply These Terms to Your New Libraries
-
-If you develop a new library, and you want it to be of the greatest possible use to the public, we recommend making it free software that everyone can redistribute and change. You can do so by permitting redistribution under these terms (or, alternatively, under the terms of the ordinary General Public License).
-
-To apply these terms, attach the following notices to the library. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found.
-
-     one line to give the library's name and an idea of what it does.
-     Copyright (C) year  name of author
-
-     This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2.1 of the License, or (at your option) any later version.
-
-     This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
-
-     You should have received a copy of the GNU Lesser General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA Also add information on how to contact you by electronic and paper mail.
-
-You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the library, if necessary. Here is a sample; alter the names:
-
-Yoyodyne, Inc., hereby disclaims all copyright interest in
-the library `Frob' (a library for tweaking knobs) written
-by James Random Hacker.
-
-signature of Ty Coon, 1 April 1990
-Ty Coon, President of Vice
-That's all there is to it!
diff --git a/templates/README.md b/templates/README.md
deleted file mode 100644
index fea840dd70..0000000000
--- a/templates/README.md
+++ /dev/null
@@ -1,16 +0,0 @@
-# Workbench templates
-
-Each subdirectory is one shipped `WorkbenchDefinition`: the agents,
-routines, webhook triggers, plugins, and onboarding walkthrough a
-"pick a kind of workbench" row creates. `index.ts` is the single
-description both `apps/web`'s picker and `./instantiate.ts` read — the
-schema, the assembled `WORKBENCH_TEMPLATES` list, and the
-parse/serialize helpers a bench-library row round-trips through.
-
-- `gtm/` — the go-to-market workbench (CL-6349)
-- `code-review/` — three reviewer lenses over every pull request
-- `due-diligence/` — Scout plus Myra for research and follow-up
-
-`./instantiate.ts` resolves a definition against a bench over injected
-ports; `./settings.ts` is the `template/*` settings vocabulary a room
-persists about the template it was minted from.
diff --git a/templates/code-review/index.ts b/templates/code-review/index.ts
deleted file mode 100644
index a8a75ded92..0000000000
--- a/templates/code-review/index.ts
+++ /dev/null
@@ -1,74 +0,0 @@
-// The code-review definition: three reviewer lenses over every pull
-// request. Its blocks install the one `code-review` workflow; the
-// reviewer roster itself is `@corbits/code-review`'s own
-// `CODE_REVIEW_REVIEWERS` — mirrored into `agents` here rather than
-// duplicated, so a reviewer's handle, name, and one-line role can never
-// drift between the package that runs the review and the definition
-// that describes it.
-import type { WorkbenchDefinition } from "../index";
-// Imported from the package's own `./reviewers` subpath, never its root
-// (`@corbits/code-review`) — the root barrel also re-exports the review
-// run and GitHub client, which pull in `@corbits/github-tools` and
-// `@intx/agent`'s full provider surface. `reviewers.ts` itself has no
-// imports at all, so this subpath keeps every consumer of this
-// definition (this package's whole point) off that much heavier graph.
-import { CODE_REVIEW_REVIEWERS } from "@corbits/code-review/reviewers";
-
-export const CODE_REVIEW_TEMPLATE: WorkbenchDefinition = {
-  id: "code-review",
-  title: "Code review",
-  promise:
-    "Three reviewers read every pull request and post what they'd change.",
-  blocks: [{ assetName: "code-review", version: "0.0.1" }],
-  // GitHub is the one thing this template cannot work without: no
-  // repository, no diff to read and nowhere to post the review.
-  plugins: { required: ["github"], optional: [] },
-  tools: ["@corbits/github-tools"],
-  routines: [],
-  webhookTriggers: [
-    {
-      key: "pull-request-opened",
-      blockAssetName: "code-review",
-      label: "Review new pull requests",
-      why: "A review is worth most posted while the pull request is still open for comment, so this fires the moment GitHub says one exists rather than waiting on a clock.",
-      triggerFieldKey: "pullRequestUrl",
-    },
-  ],
-  agents: [
-    ...CODE_REVIEW_REVIEWERS.map((reviewer) => ({
-      handle: reviewer.handle,
-      displayName: reviewer.displayName,
-      blockAssetName: "code-review",
-      role: reviewer.description,
-    })),
-  ],
-  openInputs: [
-    {
-      key: "repos",
-      label: "Which repositories?",
-      placeholder: "corbitsdev/workbench",
-      help: "The GitHub repositories to watch. Every new pull request there gets reviewed.",
-      required: true,
-      appliesToWebhookTrigger: "pull-request-opened",
-    },
-  ],
-  onboardingSteps: [
-    {
-      kind: "connect-plugin",
-      connectorId: "github",
-      title: "Connect GitHub",
-      why: "Create a token scoped to the repositories you want reviewed — that is what the reviewers will be able to read.",
-    },
-    {
-      kind: "pick-github-repos",
-      title: "Choose what gets reviewed",
-      why: "Of the repositories your token reaches, these are the ones a new pull request starts a review in.",
-    },
-    {
-      kind: "start-webhook-trigger",
-      webhookTriggerKey: "pull-request-opened",
-      title: "Start reviewing",
-      why: "From now on, every new pull request in those repositories gets a review.",
-    },
-  ],
-};
diff --git a/templates/connectors.test.ts b/templates/connectors.test.ts
deleted file mode 100644
index de99a37b93..0000000000
--- a/templates/connectors.test.ts
+++ /dev/null
@@ -1,466 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { CODEX_SCOPES } from "@corbits/codex-provider/constants";
-import { connectorDescriptors } from "@corbits/connections/registry";
-import {
-  mcpPresetByName,
-  mcpPresetBySlug,
-} from "@corbits/connections/mcp-presets";
-import {
-  CONNECTOR_REGISTRY,
-  MCP_PRESET_CONNECTOR_IDS,
-  MCP_PRESETS,
-} from "./connectors";
-
-describe("CONNECTOR_REGISTRY", () => {
-  test("every entry has an id, displayName, and docsUrl", () => {
-    for (const descriptor of Object.values(CONNECTOR_REGISTRY)) {
-      expect(descriptor.id.length).toBeGreaterThan(0);
-      expect(descriptor.displayName.length).toBeGreaterThan(0);
-      expect(descriptor.docsUrl.length).toBeGreaterThan(0);
-    }
-  });
-
-  test("every api-key entry has a probe", () => {
-    for (const descriptor of Object.values(CONNECTOR_REGISTRY)) {
-      if (descriptor.authKind !== "api-key") continue;
-      expect(descriptor.probe).toBeDefined();
-    }
-  });
-
-  // `github` is the one deliberate exception (CL-6386): it stays
-  // `authKind: "api-key"` (the PAT paste form is always available) but
-  // also carries an `oauth` config a caller checks `GET
-  // /oauth-configured` before offering, ahead of the paste form, as a
-  // hosted one-click connect. Every other api-key connector still names
-  // no `oauth` at all.
-  test("only github carries an oauth config alongside api-key", () => {
-    for (const descriptor of Object.values(CONNECTOR_REGISTRY)) {
-      if (descriptor.authKind !== "api-key") continue;
-      if (descriptor.id === "github") {
-        expect(descriptor.oauth).toBeDefined();
-        continue;
-      }
-      expect(descriptor.oauth).toBeUndefined();
-    }
-  });
-
-  // CL-6258: every provider row in Settings > Connections needs a logo
-  // tile -- a simple-icons mark where one exists, a monochrome initial
-  // tile (rendered from `displayName` alone) where it doesn't.
-  test("every inference provider with a simple-icons listing carries a hex-keyed icon", () => {
-    for (const id of [
-      "anthropic",
-      "google-genai",
-      "deepseek",
-      "mistral",
-      "ollama",
-      "openrouter",
-      "huggingface",
-    ]) {
-      const descriptor = CONNECTOR_REGISTRY[id];
-      expect(descriptor?.icon?.path.length).toBeGreaterThan(0);
-      expect(descriptor?.icon?.hex).toMatch(/^[0-9A-F]{6}$/i);
-    }
-  });
-
-  test("providers with no simple-icons listing fall back to no icon (initial tile)", () => {
-    for (const id of ["openai", "xai", "groq", "opencode-zen"]) {
-      expect(CONNECTOR_REGISTRY[id]?.icon).toBeUndefined();
-    }
-  });
-
-  test("includes OpenRouter and Hugging Face as oauth-pkce connectors, no probe", () => {
-    for (const id of ["openrouter", "huggingface"]) {
-      const descriptor = CONNECTOR_REGISTRY[id];
-      expect(descriptor?.authKind).toBe("oauth-pkce");
-      expect(descriptor?.probe).toBeUndefined();
-      expect(descriptor?.oauth).toBeDefined();
-      expect(descriptor?.oauth?.usesPKCE).toBe(true);
-      expect(descriptor?.oauth?.deploysDefaultWorkflows).toBe(true);
-      expect(descriptor?.feedsTools).toEqual([]);
-    }
-  });
-
-  test("only Hugging Face requires a configured client id", () => {
-    expect(CONNECTOR_REGISTRY["openrouter"]?.oauth?.clientId).toBeUndefined();
-    expect(
-      CONNECTOR_REGISTRY["huggingface"]?.oauth?.clientId?.({}),
-    ).toBeUndefined();
-    expect(
-      CONNECTOR_REGISTRY["huggingface"]?.oauth?.clientId?.({
-        huggingfaceClientId: "hf_1",
-      }),
-    ).toBe("hf_1");
-  });
-
-  test("only Hugging Face echoes state back in its callback query", () => {
-    expect(CONNECTOR_REGISTRY["openrouter"]?.oauth?.echoesState).toBe(false);
-    expect(CONNECTOR_REGISTRY["huggingface"]?.oauth?.echoesState).toBe(true);
-  });
-
-  test("includes the eight non-OAuth inference providers", () => {
-    for (const id of [
-      "anthropic",
-      "openai",
-      "google-genai",
-      "xai",
-      "opencode-zen",
-      "groq",
-      "deepseek",
-      "mistral",
-    ]) {
-      expect(CONNECTOR_REGISTRY[id]).toBeDefined();
-      expect(CONNECTOR_REGISTRY[id]?.feedsTools).toEqual([]);
-    }
-  });
-
-  test("ollama collects a URL, not a key, and needs no probed secret to reach reachability", () => {
-    const descriptor = CONNECTOR_REGISTRY["ollama"];
-    expect(descriptor?.authKind).toBe("api-key");
-    expect(descriptor?.credentialInputKind).toBe("url");
-    expect(descriptor?.credentialPlaceholder).toBe("http://localhost:11434");
-    expect(descriptor?.probe).toBeDefined();
-    expect(descriptor?.feedsTools).toEqual([]);
-  });
-
-  test("includes Codex and xai-oauth as oauth-loopback connectors, no probe", () => {
-    for (const id of ["codex", "xai-oauth"]) {
-      const descriptor = CONNECTOR_REGISTRY[id];
-      expect(descriptor?.authKind).toBe("oauth-loopback");
-      expect(descriptor?.probe).toBeUndefined();
-      expect(descriptor?.oauth).toBeDefined();
-      expect(descriptor?.oauth?.usesPKCE).toBe(true);
-      expect(descriptor?.oauth?.deploysDefaultWorkflows).toBe(true);
-      expect(descriptor?.feedsTools).toEqual([]);
-      // The OAuth client ids are the provider CLIs' public identifiers.
-      expect(descriptor?.oauth?.clientId?.({})).toBeDefined();
-    }
-  });
-
-  test("pins each loopback provider to its own fixed redirect URI", () => {
-    const codexUrl = CONNECTOR_REGISTRY["codex"]?.oauth?.buildAuthorizeUrl({
-      callbackUrl: "https://bench.example.com/ignored",
-      state: "s",
-      codeChallenge: "c",
-      clientId: "app_1",
-    });
-    expect(codexUrl?.origin).toBe("https://auth.openai.com");
-    expect(codexUrl?.searchParams.get("redirect_uri")).toBe(
-      "http://localhost:1455/auth/callback",
-    );
-    expect(codexUrl?.searchParams.get("originator")).toBe("codex_cli_rs");
-    // Pinned against the upstream Codex CLI's scope grant — the
-    // api.connectors.* scopes are what let the backend serve connector
-    // tools to this client, and the authorization server issues them only
-    // to the Codex client id. Asserted against the exported constant so
-    // the descriptor cannot drift from the adapter's refresh path.
-    expect(codexUrl?.searchParams.get("scope")?.split(" ")).toEqual(
-      CODEX_SCOPES,
-    );
-
-    const xaiUrl = CONNECTOR_REGISTRY["xai-oauth"]?.oauth?.buildAuthorizeUrl({
-      callbackUrl: "https://bench.example.com/ignored",
-      state: "s",
-      codeChallenge: "c",
-      clientId: "client_1",
-    });
-    expect(xaiUrl?.origin).toBe("https://auth.x.ai");
-    expect(xaiUrl?.searchParams.get("redirect_uri")).toBe(
-      "http://127.0.0.1:1456/callback",
-    );
-    expect(xaiUrl?.searchParams.get("scope")).toContain("grok-cli:access");
-  });
-
-  test("exchanges a loopback code for tokens against the provider's own token endpoint", async () => {
-    const originalFetch = globalThis.fetch;
-    const requestedURLs: string[] = [];
-    globalThis.fetch = (async (input: RequestInfo | URL) => {
-      const url = String(input);
-      requestedURLs.push(url);
-      return new Response(
-        JSON.stringify({
-          access_token: "at_1",
-          refresh_token: "rt_1",
-          expires_in: 3600,
-        }),
-        { status: 200 },
-      );
-    }) as typeof fetch;
-    try {
-      const result = await CONNECTOR_REGISTRY["codex"]?.oauth?.exchange({
-        code: "abc",
-        codeVerifier: "ver",
-        redirectUri: "http://localhost:1455/auth/callback",
-        clientId: "app_1",
-      });
-      expect(result).toMatchObject({
-        ok: true,
-        apiKey: "at_1",
-        refreshToken: "rt_1",
-      });
-      expect(requestedURLs).toEqual(["https://auth.openai.com/oauth/token"]);
-      expect(requestedURLs[0]).toContain("auth.openai.com");
-    } finally {
-      globalThis.fetch = originalFetch;
-    }
-  });
-
-  test("reports a failed loopback exchange without throwing", async () => {
-    const originalFetch = globalThis.fetch;
-    globalThis.fetch = (async () =>
-      new Response("nope", { status: 400 })) as typeof fetch;
-    try {
-      const result = await CONNECTOR_REGISTRY["xai-oauth"]?.oauth?.exchange({
-        code: "abc",
-        codeVerifier: "ver",
-        redirectUri: "http://127.0.0.1:1456/callback",
-        clientId: "client_1",
-      });
-      expect(result?.ok).toBe(false);
-    } finally {
-      globalThis.fetch = originalFetch;
-    }
-  });
-
-  test("includes the tool connectors with the right feedsTools", () => {
-    expect(CONNECTOR_REGISTRY["granola"]?.feedsTools).toEqual([
-      "@corbits/granola-tools",
-    ]);
-    expect(CONNECTOR_REGISTRY["manus"]?.feedsTools).toEqual([
-      "@corbits/manus-tools",
-    ]);
-    expect(CONNECTOR_REGISTRY["manus"]?.credentialPlugin).toBe(
-      "http-x-manus-api-key",
-    );
-    expect(CONNECTOR_REGISTRY["manus"]?.authKind).toBe("api-key");
-    expect(CONNECTOR_REGISTRY["manus"]?.icon).toBeUndefined();
-    expect(CONNECTOR_REGISTRY["exa"]?.feedsTools).toEqual([
-      "@corbits/web-search-tools",
-    ]);
-    expect(CONNECTOR_REGISTRY["scrapecreators"]?.feedsTools).toEqual([
-      "@corbits/reddit-tools",
-    ]);
-    expect(CONNECTOR_REGISTRY["scrapecreators"]?.displayName).toBe(
-      "ScrapeCreators",
-    );
-    expect(CONNECTOR_REGISTRY["linear"]?.feedsTools).toEqual([
-      "@corbits/linear-tools",
-    ]);
-    expect(CONNECTOR_REGISTRY["github"]?.feedsTools).toEqual([
-      "@corbits/github-tools",
-    ]);
-  });
-});
-
-describe("granola-webhook", () => {
-  test("is a webhook-secret connector with no probe, no oauth, and no feedsTools", () => {
-    const descriptor = CONNECTOR_REGISTRY["granola-webhook"];
-    expect(descriptor?.authKind).toBe("webhook-secret");
-    expect(descriptor?.probe).toBeUndefined();
-    expect(descriptor?.oauth).toBeUndefined();
-    expect(descriptor?.feedsTools).toEqual([]);
-    expect(descriptor?.credentialPlugin).toBe("http");
-  });
-});
-
-describe("connectorDescriptors", () => {
-  test("returns every registry entry", () => {
-    expect(connectorDescriptors(CONNECTOR_REGISTRY).length).toBe(
-      Object.keys(CONNECTOR_REGISTRY).length,
-    );
-  });
-
-  test("each connector mediates through the header plugin its API actually expects", () => {
-    expect(CONNECTOR_REGISTRY["linear"]?.credentialPlugin).toBe(
-      "http-raw-authorization",
-    );
-    expect(CONNECTOR_REGISTRY["exa"]?.credentialPlugin).toBe("http-x-api-key");
-    expect(CONNECTOR_REGISTRY["scrapecreators"]?.credentialPlugin).toBe(
-      "http-x-api-key",
-    );
-    expect(CONNECTOR_REGISTRY["manus"]?.credentialPlugin).toBe(
-      "http-x-manus-api-key",
-    );
-    const nonBearer = new Set(["linear", "exa", "scrapecreators", "manus"]);
-    for (const [id, descriptor] of Object.entries(CONNECTOR_REGISTRY)) {
-      if (nonBearer.has(id)) continue;
-      expect(descriptor.credentialPlugin).toBe("http");
-    }
-  });
-});
-
-describe("gmail connector", () => {
-  test("is a pure oauth-code connector with a hosted-app env pair", () => {
-    const descriptor = CONNECTOR_REGISTRY["gmail"];
-    expect(descriptor?.authKind).toBe("oauth-code");
-    expect(descriptor?.credentialPlugin).toBe("http");
-    expect(descriptor?.oauth).toBeDefined();
-    expect(descriptor?.oauth?.clientId?.({ gmailClientId: "client-1" })).toBe(
-      "client-1",
-    );
-    expect(
-      descriptor?.oauth?.clientSecret?.({ gmailClientSecret: "secret-1" }),
-    ).toBe("secret-1");
-    expect(descriptor?.oauth?.clientId?.({})).toBeUndefined();
-  });
-
-  test("asks Google for offline access and the gmail scope with PKCE", () => {
-    const descriptor = CONNECTOR_REGISTRY["gmail"];
-    const url = descriptor?.oauth?.buildAuthorizeUrl({
-      callbackUrl: "https://bench.example.com/callback",
-      state: "state-1",
-      codeChallenge: "challenge-1",
-      clientId: "client-1",
-    });
-    if (url === undefined) throw new Error("no authorize url");
-    expect(url.origin).toBe("https://accounts.google.com");
-    expect(url.searchParams.get("client_id")).toBe("client-1");
-    expect(url.searchParams.get("redirect_uri")).toBe(
-      "https://bench.example.com/callback",
-    );
-    expect(url.searchParams.get("response_type")).toBe("code");
-    expect(url.searchParams.get("scope")).toContain("gmail");
-    expect(url.searchParams.get("state")).toBe("state-1");
-    expect(url.searchParams.get("access_type")).toBe("offline");
-    expect(url.searchParams.get("code_challenge")).toBe("challenge-1");
-    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
-  });
-});
-
-describe("MCP_PRESETS", () => {
-  test("lists only verified zero-configuration remote MCP servers", () => {
-    const slugs = MCP_PRESETS.map((preset) => preset.slug).sort();
-    expect(slugs).toEqual(
-      [
-        "attio",
-        "canva",
-        "exa",
-        "github-mcp",
-        "granola",
-        "linear",
-        "notion",
-        "posthog",
-        "railway",
-        "sentry",
-        "sumble",
-      ].sort(),
-    );
-    for (const preset of MCP_PRESETS) {
-      expect(() => new URL(preset.url)).not.toThrow();
-      expect(preset.url.startsWith("https://")).toBe(true);
-    }
-  });
-
-  test("Exa is keyless, GitHub MCP is token, every other preset uses OAuth", () => {
-    expect(mcpPresetBySlug(MCP_PRESETS, "exa")?.connectionMode).toBe("keyless");
-    expect(mcpPresetBySlug(MCP_PRESETS, "github-mcp")?.connectionMode).toBe(
-      "token",
-    );
-    for (const preset of MCP_PRESETS) {
-      if (preset.slug === "exa" || preset.slug === "github-mcp") continue;
-      expect(preset.connectionMode).toBe("oauth");
-    }
-  });
-
-  test("GitHub MCP is a token preset that never shadows the github connector", () => {
-    const preset = mcpPresetBySlug(MCP_PRESETS, "github-mcp");
-    expect(preset?.displayName).toBe("GitHub MCP");
-    expect(preset?.url).toBe("https://api.githubcopilot.com/mcp/");
-    // GitHub's MCP server accepts a personal access token as a bearer but
-    // offers no dynamic client registration, so OAuth can't complete here.
-    expect(preset?.connectionMode).toBe("token");
-    expect(preset?.docsUrl).toBe("https://github.com/settings/tokens");
-    expect(preset?.tokenSteps?.length).toBeGreaterThanOrEqual(2);
-    // The native `github` REST connector (PAT/OAuth-App) stays its own
-    // card: no nativeConnectorId hides it, and neither "github" the slug
-    // nor "GitHub" the display name resolves to this preset.
-    expect(preset?.nativeConnectorId).toBeUndefined();
-    expect(CONNECTOR_REGISTRY["github"]).toBeDefined();
-    expect(mcpPresetByName(MCP_PRESETS, "github")).toBeUndefined();
-    expect(mcpPresetByName(MCP_PRESETS, "GitHub")).toBeUndefined();
-    expect(mcpPresetByName(MCP_PRESETS, "github mcp")?.slug).toBe("github-mcp");
-  });
-
-  test("uses Sumble's OAuth MCP host, not its product-page URL", () => {
-    expect(mcpPresetBySlug(MCP_PRESETS, "sumble")?.url).toBe(
-      "https://mcp.sumble.com/",
-    );
-    expect(mcpPresetBySlug(MCP_PRESETS, "sumble")?.connectionMode).toBe(
-      "oauth",
-    );
-  });
-
-  test("keeps every verified endpoint exact", () => {
-    expect(
-      Object.fromEntries(
-        MCP_PRESETS.map((preset) => [preset.slug, preset.url]),
-      ),
-    ).toEqual({
-      granola: "https://mcp.granola.ai/mcp",
-      exa: "https://mcp.exa.ai/mcp",
-      "github-mcp": "https://api.githubcopilot.com/mcp/",
-      linear: "https://mcp.linear.app/mcp",
-      notion: "https://mcp.notion.com/mcp",
-      sentry: "https://mcp.sentry.dev/mcp",
-      attio: "https://mcp.attio.com/mcp",
-      railway: "https://mcp.railway.com",
-      posthog: "https://mcp.posthog.com/mcp",
-      sumble: "https://mcp.sumble.com/",
-      canva: "https://mcp.canva.com/mcp",
-    });
-  });
-
-  test("every preset's nativeConnectorId names a real registry entry", () => {
-    for (const preset of MCP_PRESETS) {
-      if (preset.nativeConnectorId === undefined) continue;
-      expect(CONNECTOR_REGISTRY[preset.nativeConnectorId]).toBeDefined();
-    }
-  });
-
-  test("MCP_PRESET_CONNECTOR_IDS matches the presets' native ids", () => {
-    expect(new Set(MCP_PRESET_CONNECTOR_IDS)).toEqual(
-      new Set(["granola", "exa", "linear"]),
-    );
-  });
-
-  test("mcpPresetByName resolves by slug or display name, case-insensitively", () => {
-    expect(mcpPresetByName(MCP_PRESETS, "Exa")?.slug).toBe("exa");
-    expect(mcpPresetByName(MCP_PRESETS, "EXA")?.slug).toBe("exa");
-    expect(mcpPresetByName(MCP_PRESETS, "granola")?.slug).toBe("granola");
-    expect(mcpPresetByName(MCP_PRESETS, "nope")).toBeUndefined();
-  });
-
-  test("mcpPresetBySlug returns undefined for an unknown slug", () => {
-    expect(mcpPresetBySlug(MCP_PRESETS, "not-a-preset")).toBeUndefined();
-  });
-
-  test("Canva is a DCR-verified OAuth preset with no simple-icons mark yet", () => {
-    expect(mcpPresetBySlug(MCP_PRESETS, "canva")?.connectionMode).toBe("oauth");
-    expect(mcpPresetBySlug(MCP_PRESETS, "canva")?.icon).toBeUndefined();
-  });
-
-  test("Canva lists the 16 live PRM OAuth scopes; other presets omit oauthScopes", () => {
-    expect(mcpPresetBySlug(MCP_PRESETS, "canva")?.oauthScopes).toEqual([
-      "profile:read",
-      "design:meta:read",
-      "design:content:write",
-      "design:content:read",
-      "folder:read",
-      "folder:write",
-      "brandtemplate:content:read",
-      "brandtemplate:meta:read",
-      "brandtemplate:content:write",
-      "comment:write",
-      "comment:read",
-      "asset:read",
-      "asset:write",
-      "brandkit:read",
-      "help:answers:read",
-      "help:answers:write",
-    ]);
-    for (const preset of MCP_PRESETS) {
-      if (preset.slug === "canva") continue;
-      expect("oauthScopes" in preset).toBe(false);
-    }
-  });
-});
diff --git a/templates/connectors.ts b/templates/connectors.ts
deleted file mode 100644
index b9c5ed59b2..0000000000
--- a/templates/connectors.ts
+++ /dev/null
@@ -1,826 +0,0 @@
-// Workbench's product-supplied connector set (CL-7384): every api-key
-// connector and curated MCP preset this build actually ships, built from
-// `@corbits/connections`' generic descriptor shape and route factories.
-// `@corbits/connections` itself carries no default connector set — that
-// would be exactly the kind of fallback this repo's ground rules
-// forbid — so a caller (the hub, the web app) imports `CONNECTOR_REGISTRY`
-// and `MCP_PRESETS` from here and passes them into the route factories
-// that need one.
-//
-// The eight non-OAuth inference providers come straight from
-// `PROVIDER_TEST_CONFIG` — the one source of provider metadata,
-// re-exported here rather than duplicated. OpenRouter and Hugging Face
-// are the two OAuth inference providers, wired below through the same
-// `oauth` config shape `@corbits/connections`' `oauth-routes.ts` reads.
-import {
-  OLLAMA_PLACEHOLDER_SECRET,
-  PROVIDER_TEST_CONFIG,
-  testProviderCredential,
-  type SupportedCredentialProvider,
-} from "@corbits/connections/credential-test";
-import {
-  createConnectorRegistry,
-  type ConnectorDescriptor,
-  type ConnectorRegistry,
-} from "@corbits/connections/registry";
-import type { McpPreset } from "@corbits/connections/mcp-presets";
-import { mcpPresetConnectorIds } from "@corbits/connections/mcp-presets";
-import {
-  exchangeCodeForToken,
-  HUGGINGFACE_AUTHORIZE_URL,
-  HUGGINGFACE_SCOPE,
-} from "@corbits/connections/huggingface-connect";
-import {
-  exchangeCodeForGoogleToken,
-  GMAIL_SCOPE,
-  GOOGLE_AUTHORIZE_URL,
-} from "@corbits/connections/gmail-connect";
-
-// Decodes the ChatGPT account id out of a Codex id_token (a JWT payload
-// claim), mirroring `@corbits/codex-provider`'s `accountIdFromIdToken`
-// without pulling that package (and its oauth-core dependency graph) into
-// this browser-shipped registry. Undefined on any malformed input — the
-// account id is a label, never a gate.
-function chatgptAccountIdFromIdToken(idToken: string): string | undefined {
-  const payload = idToken.split(".")[1];
-  if (payload === undefined) return undefined;
-  let claims: Record<string, unknown>;
-  try {
-    const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
-    claims = JSON.parse(
-      atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "=")),
-    ) as Record<string, unknown>;
-  } catch {
-    return undefined;
-  }
-  if (typeof claims.chatgpt_account_id === "string") {
-    return claims.chatgpt_account_id;
-  }
-  const auth: unknown = claims["https://api.openai.com/auth"];
-  if (
-    typeof auth === "object" &&
-    auth !== null &&
-    "chatgpt_account_id" in auth
-  ) {
-    const nested = auth.chatgpt_account_id;
-    if (typeof nested === "string") return nested;
-  }
-  return undefined;
-}
-// simple-icons ships one brand per named export, tree-shaken by any bundler
-// that respects its `sideEffects: false` — importing only the brands this
-// registry actually has a listing for pulls in only those icons' data, not
-// the whole ~3000-brand package (CC0-1.0 licensed — see the package's own
-// LICENSE — so redistributing these marks needs no separate clearance).
-// Granola and ScrapeCreators have no simple-icons listing (CL-6215's
-// plugins-directory rebuild); OpenAI, xAI, Groq, and Opencode Zen have none
-// either (CL-6258's connections logos) — those descriptors carry no `icon`,
-// so a caller renders their monochrome initial tile instead. Exa publishes
-// its own mark in its official brand kit, used below. Google's mark
-// here is Gemini's, not the generic Google "G" — the model brand a person
-// actually recognizes from connecting an AI provider, matching
-// models.dev's own convention for this row.
-import {
-  siAnthropic,
-  siDeepseek,
-  siGithub,
-  siGmail,
-  siGooglegemini,
-  siHuggingface,
-  siLinear,
-  siMistralai,
-  siNotion,
-  siOllama,
-  siOpenrouter,
-  siPosthog,
-  siRailway,
-  siSentry,
-} from "simple-icons";
-import {
-  CODEX_AUTHORIZE_EXTRA_PARAMS,
-  CODEX_AUTHORIZE_URL,
-  CODEX_CLIENT_ID,
-  CODEX_REDIRECT_URI,
-  CODEX_SCOPES,
-  CODEX_TOKEN_URL,
-} from "@corbits/codex-provider/constants";
-import {
-  XAI_AUTHORIZE_URL,
-  XAI_CLIENT_ID,
-  XAI_REDIRECT_URI,
-  XAI_SCOPES,
-  XAI_TOKEN_URL,
-} from "@corbits/xai-provider/constants";
-import {
-  exchangeCodeForKey,
-  OPENROUTER_AUTH_URL,
-} from "@corbits/connections/openrouter-connect";
-import {
-  exchangeCodeForGithubToken,
-  GITHUB_AUTHORIZE_URL,
-} from "@corbits/connections/github-connect";
-import {
-  testExaCredential,
-  testGitHubCredential,
-  testGranolaCredential,
-  testLinearCredential,
-  testManusCredential,
-  testScrapeCreatorsCredential,
-} from "@corbits/connections/probes";
-
-const INFERENCE_PROVIDER_DOCS_URL: Readonly<
-  Record<SupportedCredentialProvider, string>
-> = {
-  anthropic: "https://console.anthropic.com/settings/keys",
-  openai: "https://platform.openai.com/api-keys",
-  "google-genai": "https://aistudio.google.com/apikey",
-  xai: "https://console.x.ai",
-  "xai-oauth": "https://x.ai",
-  codex: "https://developers.openai.com/codex",
-  "opencode-zen": "https://opencode.ai/zen",
-  groq: "https://console.groq.com/keys",
-  deepseek: "https://platform.deepseek.com/api_keys",
-  mistral: "https://console.mistral.ai/api-keys",
-  openrouter: "https://openrouter.ai",
-  huggingface: "https://huggingface.co/settings/tokens",
-  ollama: "https://ollama.com",
-};
-
-// Ollama's onboarding URL field default — the local-machine origin
-// Ollama listens on out of the box, before anyone points it at a
-// tailscale-tunneled or otherwise remote instance.
-const OLLAMA_DEFAULT_URL = "http://localhost:11434";
-
-const EXA_ICON = {
-  path: "M150.5 14.1064C150.5 14.3356 150.421 14.5579 150.277 14.736L88.4766 91 150.277 167.264C150.421 167.442 150.5 167.664 150.5 167.894V181C150.5 181.552 150.052 182 149.5 182H1C0.44772 182 0 181.552 0 181V0.999995C0 0.44771 0.447715 0 1 0H149.5C150.052 0 150.5 0.447715 150.5 1V14.1064ZM30.4059 162.719H121.728L76.0664 106.326 30.4059 162.719ZM19.2949 100.261V145.787L56.1572 100.261H19.2949ZM19.2949 80.9801H55.5434L19.2949 36.2121V80.9801ZM76.0664 75.6731L121.728 19.281H30.4059L76.0664 75.6731Z",
-  hex: "0143D9",
-  viewBox: "0 0 151 182",
-} as const;
-
-// Every inference provider with a simple-icons listing. OpenAI, xAI, Groq,
-// and Opencode Zen have none as of simple-icons' current release; those
-// four fall through to the monochrome initial tile every iconless
-// descriptor already gets.
-const INFERENCE_PROVIDER_ICONS: Partial<
-  Record<
-    SupportedCredentialProvider,
-    { readonly path: string; readonly hex: string }
-  >
-> = {
-  anthropic: { path: siAnthropic.path, hex: siAnthropic.hex },
-  "google-genai": { path: siGooglegemini.path, hex: siGooglegemini.hex },
-  deepseek: { path: siDeepseek.path, hex: siDeepseek.hex },
-  mistral: { path: siMistralai.path, hex: siMistralai.hex },
-  ollama: { path: siOllama.path, hex: siOllama.hex },
-  openrouter: { path: siOpenrouter.path, hex: siOpenrouter.hex },
-  huggingface: { path: siHuggingface.path, hex: siHuggingface.hex },
-};
-
-function inferenceProviderDescriptors(): Record<string, ConnectorDescriptor> {
-  const entries: Record<string, ConnectorDescriptor> = {};
-  for (const [id, config] of Object.entries(PROVIDER_TEST_CONFIG)) {
-    if (id === "openrouter" || id === "huggingface") continue;
-    if (id === "codex" || id === "xai-oauth") continue;
-    const providerId = id as SupportedCredentialProvider;
-    // Ollama collects a URL, not a secret — it has no auth layer at all
-    // (see `credential-test.ts`'s own `ollama` config entry). Every
-    // other connector's single form field is a real key, probed and
-    // stored as-is.
-    const icon = INFERENCE_PROVIDER_ICONS[providerId];
-    entries[id] =
-      providerId === "ollama"
-        ? {
-            id,
-            displayName: config.displayName,
-            authKind: "api-key",
-            credentialPlugin: "http",
-            docsUrl: INFERENCE_PROVIDER_DOCS_URL[providerId],
-            feedsTools: [],
-            credentialInputKind: "url",
-            credentialPlaceholder: OLLAMA_DEFAULT_URL,
-            probe: (baseURL) =>
-              testProviderCredential({
-                provider: providerId,
-                apiKey: OLLAMA_PLACEHOLDER_SECRET,
-                baseURL,
-              }),
-            ...(icon !== undefined ? { icon } : {}),
-          }
-        : {
-            id,
-            displayName: config.displayName,
-            authKind: "api-key",
-            credentialPlugin: "http",
-            docsUrl: INFERENCE_PROVIDER_DOCS_URL[providerId],
-            feedsTools: [],
-            probe: (apiKey) =>
-              testProviderCredential({ provider: providerId, apiKey }),
-            ...(icon !== undefined ? { icon } : {}),
-          };
-  }
-  entries["openrouter"] = {
-    id: "openrouter",
-    displayName: PROVIDER_TEST_CONFIG.openrouter.displayName,
-    authKind: "oauth-pkce",
-    credentialPlugin: "http",
-    docsUrl: INFERENCE_PROVIDER_DOCS_URL.openrouter,
-    feedsTools: [],
-    icon: { path: siOpenrouter.path, hex: siOpenrouter.hex },
-    oauth: {
-      authorizeUrl: OPENROUTER_AUTH_URL,
-      usesPKCE: true,
-      // OpenRouter round-trips its state purely via the connect cookie;
-      // it never echoes `state` back as a callback query param.
-      echoesState: false,
-      deploysDefaultWorkflows: true,
-      buildAuthorizeUrl: ({ callbackUrl, codeChallenge }) => {
-        const url = new URL(OPENROUTER_AUTH_URL);
-        url.searchParams.set("callback_url", callbackUrl);
-        if (codeChallenge !== undefined) {
-          url.searchParams.set("code_challenge", codeChallenge);
-        }
-        url.searchParams.set("code_challenge_method", "S256");
-        return url;
-      },
-      exchange: async ({ code, codeVerifier }) => {
-        const result = await exchangeCodeForKey({
-          code,
-          codeVerifier: codeVerifier ?? "",
-        });
-        return result.ok ? { ok: true, apiKey: result.key } : result;
-      },
-    },
-  };
-  entries["huggingface"] = {
-    id: "huggingface",
-    displayName: PROVIDER_TEST_CONFIG.huggingface.displayName,
-    authKind: "oauth-pkce",
-    credentialPlugin: "http",
-    docsUrl: INFERENCE_PROVIDER_DOCS_URL.huggingface,
-    feedsTools: [],
-    icon: { path: siHuggingface.path, hex: siHuggingface.hex },
-    oauth: {
-      authorizeUrl: HUGGINGFACE_AUTHORIZE_URL,
-      usesPKCE: true,
-      // HF echoes `state` back in the callback query — the belt-and-
-      // suspenders check `oauth-routes.ts` runs before consulting the
-      // state store at all.
-      echoesState: true,
-      deploysDefaultWorkflows: true,
-      // No client secret (a public app); the flow is disabled with a
-      // `not_configured` outcome when this key is absent from the env
-      // bag rather than round-tripping a doomed request.
-      clientId: (env) => env["huggingfaceClientId"],
-      buildAuthorizeUrl: ({ callbackUrl, state, codeChallenge, clientId }) => {
-        const url = new URL(HUGGINGFACE_AUTHORIZE_URL);
-        if (clientId !== undefined) url.searchParams.set("client_id", clientId);
-        url.searchParams.set("redirect_uri", callbackUrl);
-        url.searchParams.set("scope", HUGGINGFACE_SCOPE);
-        url.searchParams.set("state", state);
-        if (codeChallenge !== undefined) {
-          url.searchParams.set("code_challenge", codeChallenge);
-        }
-        url.searchParams.set("code_challenge_method", "S256");
-        return url;
-      },
-      exchange: async ({ code, codeVerifier, redirectUri, clientId }) => {
-        if (clientId === undefined) {
-          return {
-            ok: false,
-            message: "huggingface connect is not configured",
-          };
-        }
-        const result = await exchangeCodeForToken({
-          code,
-          codeVerifier: codeVerifier ?? "",
-          redirectUri,
-          clientId,
-        });
-        if (!result.ok) return result;
-        return result.expiresAt !== undefined
-          ? {
-              ok: true,
-              apiKey: result.accessToken,
-              expiresAt: result.expiresAt,
-            }
-          : { ok: true, apiKey: result.accessToken };
-      },
-    },
-  };
-  // The two loopback OAuth providers (CL-7510). Their authorization
-  // servers only accept the fixed `http://localhost:<port>` redirect URI
-  // the provider's own CLI registers (`authKind: "oauth-loopback"`), so
-  // `buildAuthorizeUrl` ignores the hub callback URL the generic
-  // mechanics would pass and pins the provider's own redirect instead.
-  // Every endpoint, client id, and scope list come from the provider
-  // packages' own constants subpath (browser-safe, pure data — the
-  // exchange closures stay plain `fetch` so the registry can ship in the
-  // web bundle), so the descriptor can never drift from the values the
-  // adapter's own refresh path uses.
-  entries["codex"] = {
-    id: "codex",
-    displayName: PROVIDER_TEST_CONFIG.codex.displayName,
-    authKind: "oauth-loopback",
-    credentialPlugin: "http",
-    docsUrl: INFERENCE_PROVIDER_DOCS_URL.codex,
-    feedsTools: [],
-    oauth: {
-      authorizeUrl: CODEX_AUTHORIZE_URL,
-      usesPKCE: true,
-      echoesState: true,
-      deploysDefaultWorkflows: true,
-      clientId: () => CODEX_CLIENT_ID,
-      buildAuthorizeUrl: ({ state, codeChallenge, clientId }) => {
-        const url = new URL(CODEX_AUTHORIZE_URL);
-        url.searchParams.set("client_id", clientId ?? CODEX_CLIENT_ID);
-        url.searchParams.set("redirect_uri", CODEX_REDIRECT_URI);
-        url.searchParams.set("response_type", "code");
-        url.searchParams.set("scope", CODEX_SCOPES.join(" "));
-        url.searchParams.set("state", state);
-        if (codeChallenge !== undefined) {
-          url.searchParams.set("code_challenge", codeChallenge);
-        }
-        url.searchParams.set("code_challenge_method", "S256");
-        for (const [name, value] of Object.entries(
-          CODEX_AUTHORIZE_EXTRA_PARAMS,
-        )) {
-          url.searchParams.set(name, value);
-        }
-        return url;
-      },
-      exchange: async ({ code, codeVerifier }) => {
-        try {
-          const response = await fetch(CODEX_TOKEN_URL, {
-            method: "POST",
-            headers: { "content-type": "application/x-www-form-urlencoded" },
-            signal: AbortSignal.timeout(15_000),
-            body: new URLSearchParams({
-              grant_type: "authorization_code",
-              code,
-              code_verifier: codeVerifier ?? "",
-              client_id: CODEX_CLIENT_ID,
-              redirect_uri: CODEX_REDIRECT_URI,
-            }).toString(),
-          });
-          if (!response.ok) {
-            return {
-              ok: false,
-              message: `Codex rejected the login (status ${response.status})`,
-            };
-          }
-          const tokens = (await response.json()) as {
-            access_token?: unknown;
-            refresh_token?: unknown;
-            expires_in?: unknown;
-            id_token?: unknown;
-          };
-          if (typeof tokens.access_token !== "string") {
-            return { ok: false, message: "Codex returned no access token" };
-          }
-          const accountId =
-            typeof tokens.id_token === "string"
-              ? chatgptAccountIdFromIdToken(tokens.id_token)
-              : undefined;
-          return {
-            ok: true,
-            apiKey: tokens.access_token,
-            ...(typeof tokens.refresh_token === "string"
-              ? { refreshToken: tokens.refresh_token }
-              : {}),
-            ...(typeof tokens.expires_in === "number"
-              ? {
-                  expiresAt: new Date(
-                    Date.now() + tokens.expires_in * 1000,
-                  ).toISOString(),
-                }
-              : {}),
-            ...(accountId !== undefined ? { accountId } : {}),
-          };
-        } catch (cause) {
-          return {
-            ok: false,
-            message: `Codex token exchange failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-          };
-        }
-      },
-    },
-  };
-  entries["xai-oauth"] = {
-    id: "xai-oauth",
-    displayName: PROVIDER_TEST_CONFIG["xai-oauth"].displayName,
-    authKind: "oauth-loopback",
-    credentialPlugin: "http",
-    docsUrl: INFERENCE_PROVIDER_DOCS_URL["xai-oauth"],
-    feedsTools: [],
-    oauth: {
-      authorizeUrl: XAI_AUTHORIZE_URL,
-      usesPKCE: true,
-      echoesState: true,
-      deploysDefaultWorkflows: true,
-      clientId: () => XAI_CLIENT_ID,
-      buildAuthorizeUrl: ({ state, codeChallenge, clientId }) => {
-        const url = new URL(XAI_AUTHORIZE_URL);
-        url.searchParams.set("client_id", clientId ?? XAI_CLIENT_ID);
-        url.searchParams.set("redirect_uri", XAI_REDIRECT_URI);
-        url.searchParams.set("response_type", "code");
-        url.searchParams.set("scope", XAI_SCOPES.join(" "));
-        url.searchParams.set("state", state);
-        if (codeChallenge !== undefined) {
-          url.searchParams.set("code_challenge", codeChallenge);
-        }
-        url.searchParams.set("code_challenge_method", "S256");
-        return url;
-      },
-      exchange: async ({ code, codeVerifier }) => {
-        try {
-          const response = await fetch(XAI_TOKEN_URL, {
-            method: "POST",
-            headers: { "content-type": "application/x-www-form-urlencoded" },
-            signal: AbortSignal.timeout(15_000),
-            body: new URLSearchParams({
-              grant_type: "authorization_code",
-              code,
-              code_verifier: codeVerifier ?? "",
-              client_id: XAI_CLIENT_ID,
-              redirect_uri: XAI_REDIRECT_URI,
-            }).toString(),
-          });
-          if (!response.ok) {
-            return {
-              ok: false,
-              message: `xAI rejected the login (status ${response.status})`,
-            };
-          }
-          const tokens = (await response.json()) as {
-            access_token?: unknown;
-            refresh_token?: unknown;
-            expires_in?: unknown;
-          };
-          if (typeof tokens.access_token !== "string") {
-            return { ok: false, message: "xAI returned no access token" };
-          }
-          return {
-            ok: true,
-            apiKey: tokens.access_token,
-            ...(typeof tokens.refresh_token === "string"
-              ? { refreshToken: tokens.refresh_token }
-              : {}),
-            ...(typeof tokens.expires_in === "number"
-              ? {
-                  expiresAt: new Date(
-                    Date.now() + tokens.expires_in * 1000,
-                  ).toISOString(),
-                }
-              : {}),
-          };
-        } catch (cause) {
-          return {
-            ok: false,
-            message: `xAI token exchange failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-          };
-        }
-      },
-    },
-  };
-  return entries;
-}
-
-export const CONNECTOR_REGISTRY: ConnectorRegistry = createConnectorRegistry({
-  ...inferenceProviderDescriptors(),
-  granola: {
-    id: "granola",
-    credentialPlugin: "http",
-    displayName: "Granola",
-    authKind: "api-key",
-    docsUrl: "https://www.granola.ai",
-    feedsTools: ["@corbits/granola-tools"],
-    probe: (apiKey) => testGranolaCredential(apiKey),
-    description: "Pull meeting notes and transcripts into your agents.",
-  },
-  manus: {
-    id: "manus",
-    credentialPlugin: "http-x-manus-api-key",
-    displayName: "Manus",
-    authKind: "api-key",
-    docsUrl: "https://open.manus.ai/docs/v2/introduction",
-    feedsTools: ["@corbits/manus-tools"],
-    probe: (apiKey) => testManusCredential(apiKey),
-    description:
-      "Have Manus run tasks and produce files — including slide decks.",
-  },
-  exa: {
-    id: "exa",
-    // Exa authenticates via an `x-api-key` header, not `authorization` —
-    // the `http` (Bearer) plugin doesn't fit; see the `http-x-api-key`
-    // provider in `@corbits/credential-providers`.
-    credentialPlugin: "http-x-api-key",
-    displayName: "Exa",
-    authKind: "api-key",
-    docsUrl: "https://exa.ai",
-    feedsTools: ["@corbits/web-search-tools"],
-    probe: (apiKey) => testExaCredential(apiKey),
-    description: "Neural web search built for agents.",
-    icon: EXA_ICON,
-  },
-  scrapecreators: {
-    id: "scrapecreators",
-    // ScrapeCreators, same as Exa, authenticates via `x-api-key`.
-    credentialPlugin: "http-x-api-key",
-    displayName: "ScrapeCreators",
-    authKind: "api-key",
-    docsUrl: "https://scrapecreators.com",
-    feedsTools: ["@corbits/reddit-tools"],
-    probe: (apiKey) => testScrapeCreatorsCredential(apiKey),
-    description: "Read Reddit threads and comments.",
-  },
-  linear: {
-    id: "linear",
-    credentialPlugin: "http-raw-authorization",
-    displayName: "Linear",
-    authKind: "api-key",
-    docsUrl: "https://linear.app/settings/api",
-    feedsTools: ["@corbits/linear-tools"],
-    probe: (apiKey) => testLinearCredential(apiKey),
-    description: "Read and write issues, projects, and comments.",
-    icon: { path: siLinear.path, hex: siLinear.hex },
-  },
-  gmail: {
-    id: "gmail",
-    displayName: "Gmail",
-    // Pure hosted-app OAuth — there is no Gmail equivalent of a PAT
-    // to paste, so unlike `github` below this connector has no
-    // api-key arm: unconfigured (`GMAIL_CLIENT_ID`/`GMAIL_CLIENT_SECRET`
-    // unset) means the card renders "not configured", never a dead
-    // paste form. The exchanged access token expires in about an
-    // hour; the refresh token rides `OAuthExchangeResult.refreshToken`
-    // into the credential row's `refreshSecret` so a refresh sweep
-    // can keep the connection alive.
-    authKind: "oauth-code",
-    credentialPlugin: "http",
-    docsUrl: "https://developers.google.com/gmail/api",
-    feedsTools: [],
-    description: "Read, draft, and send email — sending waits for your ok.",
-    icon: { path: siGmail.path, hex: siGmail.hex },
-    oauth: {
-      authorizeUrl: GOOGLE_AUTHORIZE_URL,
-      usesPKCE: true,
-      echoesState: true,
-      deploysDefaultWorkflows: false,
-      clientId: (env) => env["gmailClientId"],
-      clientSecret: (env) => env["gmailClientSecret"],
-      buildAuthorizeUrl: ({ callbackUrl, state, codeChallenge, clientId }) => {
-        const url = new URL(GOOGLE_AUTHORIZE_URL);
-        if (clientId !== undefined) url.searchParams.set("client_id", clientId);
-        url.searchParams.set("redirect_uri", callbackUrl);
-        url.searchParams.set("response_type", "code");
-        url.searchParams.set("scope", GMAIL_SCOPE);
-        url.searchParams.set("state", state);
-        // `offline` + forced consent is what makes Google issue a
-        // refresh token at all — without both, a re-connect silently
-        // returns only another one-hour access token.
-        url.searchParams.set("access_type", "offline");
-        url.searchParams.set("prompt", "consent");
-        if (codeChallenge !== undefined) {
-          url.searchParams.set("code_challenge", codeChallenge);
-          url.searchParams.set("code_challenge_method", "S256");
-        }
-        return url;
-      },
-      exchange: async ({
-        code,
-        codeVerifier,
-        redirectUri,
-        clientId,
-        clientSecret,
-      }) => {
-        if (clientId === undefined || clientSecret === undefined) {
-          return {
-            ok: false,
-            message: "gmail connect is not configured",
-          };
-        }
-        return exchangeCodeForGoogleToken({
-          code,
-          ...(codeVerifier !== undefined ? { codeVerifier } : {}),
-          redirectUri,
-          clientId,
-          clientSecret,
-        });
-      },
-    },
-  },
-  github: {
-    id: "github",
-    // GitHub's REST API accepts a fine-grained PAT — or a GitHub OAuth
-    // App user token, which is the same Bearer shape — as a Bearer
-    // token. Absent entirely, github-tools degrades to a lower
-    // unauthenticated rate limit rather than "not connected" — see its
-    // tool.ts. `authKind` stays "api-key" (the PAT paste form is
-    // always available, CL-6386's guaranteed fallback); the `oauth`
-    // config below is this connector's one exception to "oauth fields
-    // are oauth-pkce/oauth-code only" — a caller checks
-    // `GET /oauth-configured`'s `github` entry to decide whether to
-    // offer the one-click app connect ahead of the paste form, never
-    // the other way around, so an unconfigured deploy never dead-ends.
-    credentialPlugin: "http",
-    displayName: "GitHub",
-    authKind: "api-key",
-    docsUrl: "https://github.com/settings/tokens",
-    feedsTools: ["@corbits/github-tools"],
-    probe: (apiKey, opts) =>
-      testGitHubCredential(apiKey, undefined, opts?.baseUrl),
-    description: "Read repos, issues, and pull requests.",
-    icon: { path: siGithub.path, hex: siGithub.hex },
-    oauth: {
-      authorizeUrl: GITHUB_AUTHORIZE_URL,
-      usesPKCE: false,
-      echoesState: true,
-      deploysDefaultWorkflows: false,
-      clientId: (env) => env["githubAppClientId"],
-      clientSecret: (env) => env["githubAppClientSecret"],
-      buildAuthorizeUrl: ({ callbackUrl, state, clientId }) => {
-        const url = new URL(GITHUB_AUTHORIZE_URL);
-        if (clientId !== undefined) url.searchParams.set("client_id", clientId);
-        url.searchParams.set("redirect_uri", callbackUrl);
-        url.searchParams.set("scope", "repo");
-        url.searchParams.set("state", state);
-        return url;
-      },
-      exchange: async ({ code, redirectUri, clientId, clientSecret }) => {
-        if (clientId === undefined || clientSecret === undefined) {
-          return {
-            ok: false,
-            message: "github app connect is not configured",
-          };
-        }
-        const result = await exchangeCodeForGithubToken({
-          code,
-          redirectUri,
-          clientId,
-          clientSecret,
-        });
-        return result.ok ? { ok: true, apiKey: result.key } : result;
-      },
-    },
-  },
-  "granola-webhook": {
-    id: "granola-webhook",
-    // No credential-provider plugin mediates this connector's secret —
-    // it is minted and encrypted entirely inside
-    // `@corbits/webhook-triggers` (see `management-routes.ts`), never
-    // stored as a Credential row. `credentialPlugin` still has to name
-    // something (`ConnectorDescriptor` requires it uniformly); `http`
-    // is inert here, kept only so registry-wide invariants (every
-    // non-bearer connector reads `http`) hold without a special case.
-    credentialPlugin: "http",
-    displayName: "Granola inbound webhook",
-    authKind: "webhook-secret",
-    docsUrl: "https://www.granola.ai",
-    // The direction is inverted from the `granola` api-key connector
-    // above: this issues a signed inbound address for Granola to call,
-    // feeding nothing — a routine's webhook trigger binding, not a
-    // tool package's credential handle.
-    feedsTools: [],
-  },
-});
-
-/**
- * Curated remote MCP servers that Workbench can connect without asking a
- * person for a URL, API key, client id, or client secret. OAuth entries have
- * been verified to advertise OAuth discovery, PKCE, and dynamic client
- * registration; keyless entries can be probed and stored immediately; token
- * entries accept a pasted access token as the bearer (GitHub's MCP server
- * does OAuth only for clients pre-registered with GitHub — it offers no
- * dynamic client registration — so its connect here is the token walk).
- */
-export const MCP_PRESETS: readonly McpPreset[] = [
-  {
-    slug: "granola",
-    displayName: "Granola",
-    description: "Search meeting notes, transcripts, and action items.",
-    url: "https://mcp.granola.ai/mcp",
-    connectionMode: "oauth",
-    docsUrl: "https://docs.granola.ai/help-center/sharing/integrations/mcp",
-    nativeConnectorId: "granola",
-  },
-  {
-    slug: "exa",
-    displayName: "Exa",
-    description: "Search and research the live web.",
-    url: "https://mcp.exa.ai/mcp",
-    connectionMode: "keyless",
-    docsUrl: "https://docs.exa.ai/reference/exa-mcp",
-    nativeConnectorId: "exa",
-  },
-  {
-    slug: "linear",
-    displayName: "Linear",
-    description: "Read and update issues, projects, and comments.",
-    url: "https://mcp.linear.app/mcp",
-    connectionMode: "oauth",
-    docsUrl: "https://linear.app/docs/mcp",
-    nativeConnectorId: "linear",
-  },
-  {
-    // Deliberately NOT slug "github" and NOT nativeConnectorId "github":
-    // the native GitHub connector (PAT/OAuth-App feeding
-    // @corbits/github-tools) stays its own card, and preset lookups by
-    // "github" must keep resolving to it, never here.
-    slug: "github-mcp",
-    displayName: "GitHub MCP",
-    description: "Search code, work with issues and pull requests.",
-    url: "https://api.githubcopilot.com/mcp/",
-    connectionMode: "token",
-    docsUrl: "https://github.com/settings/tokens",
-    icon: { path: siGithub.path, hex: siGithub.hex },
-    tokenSteps: [
-      "Open github.com/settings/tokens and generate a new token.",
-      "Give it the repo scope — that lets agents read code, issues, and pull requests.",
-      "Paste it below. It's stored encrypted, only your agents use it, and you can disconnect any time.",
-    ],
-  },
-  {
-    slug: "notion",
-    displayName: "Notion",
-    description: "Search and update pages, databases, and workspace content.",
-    url: "https://mcp.notion.com/mcp",
-    connectionMode: "oauth",
-    docsUrl: "https://developers.notion.com/guides/mcp/get-started-with-mcp",
-    icon: { path: siNotion.path, hex: siNotion.hex },
-  },
-  {
-    slug: "sentry",
-    displayName: "Sentry",
-    description: "Investigate errors, traces, releases, and projects.",
-    url: "https://mcp.sentry.dev/mcp",
-    connectionMode: "oauth",
-    docsUrl: "https://mcp.sentry.dev/",
-    icon: { path: siSentry.path, hex: siSentry.hex },
-  },
-  {
-    slug: "attio",
-    displayName: "Attio",
-    description: "Work with CRM records, lists, notes, and tasks.",
-    url: "https://mcp.attio.com/mcp",
-    connectionMode: "oauth",
-    docsUrl: "https://docs.attio.com/mcp/overview",
-  },
-  {
-    slug: "railway",
-    displayName: "Railway",
-    description: "Inspect and manage projects, services, and deployments.",
-    url: "https://mcp.railway.com",
-    connectionMode: "oauth",
-    docsUrl: "https://docs.railway.com/ai/mcp-server",
-    icon: { path: siRailway.path, hex: siRailway.hex },
-  },
-  {
-    slug: "posthog",
-    displayName: "PostHog",
-    description: "Explore product analytics, errors, flags, and experiments.",
-    url: "https://mcp.posthog.com/mcp",
-    connectionMode: "oauth",
-    docsUrl: "https://posthog.com/docs/model-context-protocol",
-    icon: { path: siPosthog.path, hex: siPosthog.hex },
-  },
-  {
-    slug: "sumble",
-    displayName: "Sumble",
-    description: "Research accounts, people, technologies, and buying signals.",
-    url: "https://mcp.sumble.com/",
-    connectionMode: "oauth",
-    docsUrl: "https://sumble.com/guides/account-research",
-  },
-  {
-    // No simple-icons listing for Canva (CL-6647) — same gap as Granola
-    // and Sumble above, so this card falls back to the initial-letter
-    // tile rather than risk a hand-traced or doctored mark.
-    slug: "canva",
-    displayName: "Canva",
-    description: "Design decks, docs, and graphics.",
-    url: "https://mcp.canva.com/mcp",
-    connectionMode: "oauth",
-    docsUrl: "https://www.canva.dev/docs/mcp/",
-    oauthScopes: [
-      "profile:read",
-      "design:meta:read",
-      "design:content:write",
-      "design:content:read",
-      "folder:read",
-      "folder:write",
-      "brandtemplate:content:read",
-      "brandtemplate:meta:read",
-      "brandtemplate:content:write",
-      "comment:write",
-      "comment:read",
-      "asset:read",
-      "asset:write",
-      "brandkit:read",
-      "help:answers:read",
-      "help:answers:write",
-    ],
-  },
-];
-
-export const MCP_PRESET_CONNECTOR_IDS: readonly string[] =
-  mcpPresetConnectorIds(MCP_PRESETS);
diff --git a/templates/due-diligence/index.ts b/templates/due-diligence/index.ts
deleted file mode 100644
index 87e8f56902..0000000000
--- a/templates/due-diligence/index.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-// The due-diligence template (CL-6499): Scout for the web/firm-memory
-// research and Myra to talk through what it found. Scout is a
-// standalone chat agent, not a lens over a block workflow — it has no
-// cron, no webhook, nothing to schedule — so it carries no
-// `blockAssetName` and this template's `blocks` list stays empty.
-// Exa (Scout's web-research tool) resolves through the keyless MCP
-// preset, so nothing here blocks the create on a connection.
-import type { WorkbenchDefinition } from "../index";
-import {
-  SCOUT_AGENT_HANDLE,
-  SCOUT_AGENT_DISPLAY_NAME,
-  SCOUT_AGENT_DESCRIPTION,
-  SCOUT_TOOL_PACKAGE_PINS,
-} from "@corbits/scout-agent/definition";
-
-export const DUE_DILIGENCE_TEMPLATE: WorkbenchDefinition = {
-  id: "due-diligence",
-  title: "Due Diligence",
-  promise:
-    "Scout checks a company, deal, or vendor against the web and what your team already knows, and saves what it finds so you can pick it up later.",
-  blocks: [],
-  plugins: { required: [], optional: ["exa"] },
-  tools: SCOUT_TOOL_PACKAGE_PINS.map((pin) => pin.name),
-  routines: [],
-  webhookTriggers: [],
-  agents: [
-    {
-      handle: "myra",
-      displayName: "Myra",
-      role: "Talks through what Scout found and helps you decide what to do with it.",
-    },
-    {
-      handle: SCOUT_AGENT_HANDLE,
-      displayName: SCOUT_AGENT_DISPLAY_NAME,
-      role: SCOUT_AGENT_DESCRIPTION,
-    },
-  ],
-  openInputs: [],
-  onboardingSteps: [],
-};
diff --git a/templates/gtm/index.ts b/templates/gtm/index.ts
deleted file mode 100644
index 4d5c1fe06f..0000000000
--- a/templates/gtm/index.ts
+++ /dev/null
@@ -1,97 +0,0 @@
-// The GTM template (CL-6349): the go-to-market workbench, ported from the
-// OG gtm-workbench's four v1 workflows.
-//
-// The call backbone (granola-call discovering new calls, process-granola-call
-// writing each one up) is what makes the workbench useful on day one, so it
-// is the routine that runs on a clock without anyone asking. The web watch
-// runs on its own weekly clock. The CRM agent and the collateral drafter are
-// on-demand: both start from a specific thing a person points at.
-import type { WorkbenchDefinition } from "../index";
-
-export const GTM_TEMPLATE: WorkbenchDefinition = {
-  id: "gtm",
-  title: "Go to market",
-  promise:
-    "Your calls get written up, your CRM tasks get worked, and the web gets watched — you approve anything that leaves the room.",
-  blocks: [
-    { assetName: "granola-call", version: "0.0.1" },
-    { assetName: "process-granola-call", version: "0.0.1" },
-    { assetName: "attio-task-agent", version: "0.0.1" },
-    { assetName: "exa-topic-watch", version: "0.0.1" },
-    { assetName: "pain-point-collateral", version: "0.0.1" },
-  ],
-  // Attio and Exa are hard requirements: the CRM agent has nothing to
-  // work without Attio, and the web watch has nothing to read without
-  // Exa. Granola is what the call backbone runs on — the create flow
-  // offers it up front, but a workbench with the CRM agent and the web
-  // watch alone is still a real workbench, so it never blocks the create.
-  plugins: { required: ["attio", "exa"], optional: ["granola"] },
-  tools: [],
-  webhookTriggers: [],
-  routines: [
-    {
-      key: "call-discovery",
-      blockAssetName: "granola-call",
-      label: "Check for new calls",
-      cron: "*/30 9-18 * * 1-5",
-      why: "Notes are worth most right after the call, so this looks for new ones through the working day rather than once overnight.",
-    },
-    {
-      key: "topic-watch",
-      blockAssetName: "exa-topic-watch",
-      label: "Watch the web",
-      cron: "0 8 * * 1",
-      why: "One digest at the start of the week, so a quiet week reads as quiet instead of as five empty runs.",
-    },
-  ],
-  agents: [
-    {
-      handle: "crm",
-      displayName: "CRM task agent",
-      blockAssetName: "attio-task-agent",
-      role: "Point it at a CRM task and it works the task — reading first, drafting second, and asking before it writes anything back.",
-    },
-    {
-      handle: "collateral",
-      displayName: "Pain-point collateral",
-      blockAssetName: "pain-point-collateral",
-      role: "Give it a call transcript and it drafts a piece aimed at the pain point the customer actually named.",
-    },
-  ],
-  openInputs: [
-    {
-      key: "topic",
-      label: "What should we watch?",
-      placeholder: "AI coding agents for go-to-market",
-      help: "One topic, as specific as you can make it. The weekly digest covers this and nothing else.",
-      required: true,
-      appliesToRoutine: "topic-watch",
-    },
-  ],
-  // GTM is not offered by the picker yet, and both its instantiation
-  // paths say so out loud rather than half-creating a workbench:
-  // `instantiateWorkbenchTemplate` throws because its agents are lenses
-  // over deployed workflow definitions with no agent-directory create
-  // request, and the web `beginOnboarding` binding throws because
-  // neither Attio nor Exa has an in-room onboarding card.
-  onboardingSteps: [
-    {
-      kind: "connect-plugin",
-      connectorId: "attio",
-      title: "Connect Attio",
-      why: "The CRM agent reads and works your tasks in Attio — without it there is nothing to work.",
-    },
-    {
-      kind: "connect-plugin",
-      connectorId: "exa",
-      title: "Connect Exa",
-      why: "The weekly web watch reads the open web through Exa.",
-    },
-    {
-      kind: "connect-plugin",
-      connectorId: "granola",
-      title: "Connect Granola",
-      why: "Connect it and every new call gets written up on its own; skip it and the rest of the workbench still works.",
-    },
-  ],
-};
diff --git a/templates/index.ts b/templates/index.ts
deleted file mode 100644
index b9970aa6f5..0000000000
--- a/templates/index.ts
+++ /dev/null
@@ -1,472 +0,0 @@
-// Workbench definitions: the single description of what "pick a kind of
-// workbench" actually creates — its default agents, routines, tools,
-// plugins, and the ordered onboarding walkthrough a person works
-// through once the room exists.
-//
-// `@corbits/workflows/catalog`'s `WORKFLOW_CATALOG` describes ONE
-// workflow at a time — what it does, what it needs connected, what its
-// trigger carries. A definition is the layer above: a named workbench
-// worth having, assembled out of several of those workflows. The three
-// shipped definitions (one per subdirectory here) are the bench
-// library's templates; a *template* is a shipped definition, not a
-// second kind of thing.
-//
-// Everything here is pure data. Creating a workbench from a definition
-// is a host concern (`apps/web`'s picker starts the flow, `./instantiate`
-// resolves it); this module is the single description both the picker
-// and the creator read, so neither hand-types an asset name, a cron, a
-// connector id, or a step of onboarding copy.
-//
-// Blocks are referenced by asset name AND version. A definition names
-// the exact `workflows/<name>/package.json` version it was designed
-// against, so bumping a workflow is a deliberate edit here rather than
-// a silent change in what it creates.
-
-import { type } from "arktype";
-
-/** One workflow a template installs, pinned to the version it was
- * designed against. `assetName` matches a `WORKFLOW_CATALOG` entry. */
-export const WorkbenchTemplateBlock = type({
-  assetName: "string > 0",
-  version: "/^[0-9]+\\.[0-9]+\\.[0-9]+$/",
-});
-export type WorkbenchTemplateBlock = typeof WorkbenchTemplateBlock.infer;
-
-/**
- * One routine a template creates on install. `cron` is a 5-field
- * expression in the grammar `@corbits/workflows` schedule/cron speaks —
- * the authority on whether one is valid and when it fires; the shape
- * check here only catches a malformed literal at module load.
- */
-export const WorkbenchTemplateRoutine = type({
-  /** Stable key an open input can point at. Unique within a template. */
-  key: "/^[a-z][a-z0-9-]*$/",
-  /** Which block runs on this schedule. */
-  blockAssetName: "string > 0",
-  /** What the person sees this routine called. */
-  label: "string > 0",
-  cron: "/^\\S+ \\S+ \\S+ \\S+ \\S+$/",
-  /** One honest line: why this runs on a clock at all. */
-  why: "string > 0",
-});
-export type WorkbenchTemplateRoutine = typeof WorkbenchTemplateRoutine.infer;
-
-/**
- * One agent a person can address in the created workbench. `handle` is
- * what they type to reach it. `blockAssetName` names the workflow behind
- * it when the agent is a lens over one of the definition's own blocks
- * (the code-review reviewers); it is absent for an agent that is a
- * standalone chat agent installed straight through the agent-directory
- * create path (Scout, Jimmy) with no block of its own to reference.
- */
-export const WorkbenchDefinitionAgent = type({
-  handle: "/^[a-z][a-z0-9-]*$/",
-  displayName: "string > 0",
-  "blockAssetName?": "string > 0",
-  /** One honest line: what this agent is for. */
-  role: "string > 0",
-});
-export type WorkbenchDefinitionAgent = typeof WorkbenchDefinitionAgent.infer;
-
-/**
- * One workflow a template fires from an inbound webhook rather than a
- * clock — the PR-review trigger a code-review template needs, as opposed
- * to `WorkbenchTemplateRoutine`'s cron-scheduled kind. `triggerFieldKey`
- * names the block's own `WorkflowCatalogEntry.triggerFields` entry the
- * webhook payload fills — see `@corbits/workflows/catalog`'s
- * `WorkflowTriggerField`. Creating the live `webhook_trigger` row itself
- * (`@corbits/webhook-triggers`) needs a repo to scope it to, which only
- * exists once the person has answered the template's own open input for
- * it — this is the spec a create flow resolves against that answer, not
- * the row.
- */
-export const WorkbenchTemplateWebhookTrigger = type({
-  /** Stable key an open input can point at. Unique within a template. */
-  key: "/^[a-z][a-z0-9-]*$/",
-  /** Which block this webhook launches a run of. */
-  blockAssetName: "string > 0",
-  /** What the person sees this trigger called. */
-  label: "string > 0",
-  /** One honest line: why this fires on a webhook instead of a clock. */
-  why: "string > 0",
-  triggerFieldKey: "/^[a-zA-Z][a-zA-Z0-9]*$/",
-});
-export type WorkbenchTemplateWebhookTrigger =
-  typeof WorkbenchTemplateWebhookTrigger.infer;
-
-/**
- * One answer the template cannot supply for the person — the questions
- * the create flow asks before anything runs. Exactly one of
- * `appliesToRoutine` / `appliesToWebhookTrigger` names the trigger this
- * input's answer feeds: a cron-scheduled routine, or a webhook trigger
- * spec.
- */
-export const WorkbenchTemplateOpenInput = type({
-  key: "/^[a-zA-Z][a-zA-Z0-9]*$/",
-  label: "string > 0",
-  "placeholder?": "string",
-  help: "string > 0",
-  required: "boolean",
-  "appliesToRoutine?": "/^[a-z][a-z0-9-]*$/",
-  "appliesToWebhookTrigger?": "/^[a-z][a-z0-9-]*$/",
-});
-export type WorkbenchTemplateOpenInput =
-  typeof WorkbenchTemplateOpenInput.infer;
-
-/**
- * One step in a definition's onboarding walkthrough, in the order a
- * person works through it. This is the *definition-level* step — the
- * full ordered walkthrough a template describes. `@corbits/chat`'s own
- * `WorkbenchOnboardingStep` is the narrower wire-level body a host
- * posts into a room to raise one card; the two are different types and
- * neither is derived from the other.
- */
-export const WorkbenchOnboardingStep = type({
-  kind: "'connect-plugin'",
-  connectorId: "string > 0",
-  title: "string > 0",
-  why: "string > 0",
-})
-  .or({ kind: "'pick-github-repos'", title: "string > 0", why: "string > 0" })
-  .or({
-    kind: "'start-webhook-trigger'",
-    webhookTriggerKey: "/^[a-z][a-z0-9-]*$/",
-    title: "string > 0",
-    why: "string > 0",
-  });
-export type WorkbenchOnboardingStep = typeof WorkbenchOnboardingStep.infer;
-
-/**
- * The full definition, as parsed back off a trust boundary — the bench
- * library row a hub seeded (see `@corbits/artifacts-hub`'s template
- * library) travels over HTTP before a picker instantiates from it, so
- * it re-enters through this schema, never through `as`.
- */
-export const WorkbenchDefinitionSchema = type({
-  id: "/^[a-z][a-z0-9-]*$/",
-  title: "string > 0",
-  promise: "string > 0",
-  blocks: WorkbenchTemplateBlock.array(),
-  plugins: { required: "string[]", optional: "string[]" },
-  tools: "string[]",
-  routines: WorkbenchTemplateRoutine.array(),
-  webhookTriggers: WorkbenchTemplateWebhookTrigger.array(),
-  agents: WorkbenchDefinitionAgent.array(),
-  openInputs: WorkbenchTemplateOpenInput.array(),
-  onboardingSteps: WorkbenchOnboardingStep.array(),
-});
-
-export type WorkbenchDefinition = {
-  readonly id: string;
-  /** What the picker row calls it. */
-  readonly title: string;
-  /** The picker row's one-line promise, in the reader's language. */
-  readonly promise: string;
-  readonly blocks: readonly WorkbenchTemplateBlock[];
-  /**
-   * Connector ids (see `@corbits/connections`' `CONNECTOR_REGISTRY` and
-   * `MCP_PRESETS`): `required` is what this definition cannot work
-   * without, in the order the walkthrough asks for them; `optional`
-   * makes it better and never gates the create.
-   */
-  readonly plugins: {
-    readonly required: readonly string[];
-    readonly optional: readonly string[];
-  };
-  /** Tool-package names this definition's agents need — package names
-   * only, never `{name, version}` pins: the pinned version lives with
-   * the agent package that owns the tool. */
-  readonly tools: readonly string[];
-  readonly routines: readonly WorkbenchTemplateRoutine[];
-  /** Webhook-fired triggers this definition installs — empty for a
-   * clock-only definition like GTM. */
-  readonly webhookTriggers: readonly WorkbenchTemplateWebhookTrigger[];
-  readonly agents: readonly WorkbenchDefinitionAgent[];
-  readonly openInputs: readonly WorkbenchTemplateOpenInput[];
-  /** The ordered walkthrough a freshly created workbench runs — connect
-   * the plugin, pick what it works on, start the trigger. */
-  readonly onboardingSteps: readonly WorkbenchOnboardingStep[];
-};
-
-export { GTM_TEMPLATE } from "./gtm";
-export { CODE_REVIEW_TEMPLATE } from "./code-review";
-export { DUE_DILIGENCE_TEMPLATE } from "./due-diligence";
-export {
-  instantiateWorkbenchTemplate,
-  type ParticipantAgentRequest,
-  type WorkbenchTemplateInstantiationPorts,
-  type WorkbenchTemplateInstantiationResult,
-} from "./instantiate";
-export {
-  jimmyAgentRequest,
-  scoutAgentRequest,
-} from "./participant-agent-requests";
-export {
-  TemplateReposSettingsPatch,
-  TemplateSettingsPatch,
-  templateReposSettingsPatch,
-  templateSettingsPatch,
-} from "./settings";
-export {
-  WorkflowTriggerField,
-  WORKFLOW_CATALOG,
-  isAutomatableWorkflowName,
-  isConversationalWorkflowName,
-  deliveryWorkbenchRequiredForWorkflowName,
-  workflowCatalogEntry,
-  workflowDisplayName,
-  validateTriggerFieldsAtCreate,
-  type WorkflowCatalogEntry,
-  type TriggerFieldsValidation,
-} from "@corbits/workflows/catalog";
-
-import { GTM_TEMPLATE } from "./gtm";
-import { CODE_REVIEW_TEMPLATE } from "./code-review";
-import { DUE_DILIGENCE_TEMPLATE } from "./due-diligence";
-
-export const WORKBENCH_TEMPLATES: readonly WorkbenchDefinition[] = [
-  GTM_TEMPLATE,
-  CODE_REVIEW_TEMPLATE,
-  DUE_DILIGENCE_TEMPLATE,
-];
-
-const templateById = new Map(
-  WORKBENCH_TEMPLATES.map((template) => [template.id, template]),
-);
-
-export function workbenchTemplate(id: string): WorkbenchDefinition | undefined {
-  return templateById.get(id);
-}
-
-/**
- * Every asset name a definition names — its blocks, and the block behind
- * each routine and agent. A caller checking a definition against
- * `WORKFLOW_CATALOG` walks this rather than three separate arrays.
- */
-export function templateBlockAssetNames(
-  definition: WorkbenchDefinition,
-): readonly string[] {
-  return definition.blocks.map((block) => block.assetName);
-}
-
-/** The shipped definitions as bench-library seed entries — the ONE
- * serialization every seeder uses (`apps/hub`'s boot seed and the eval
- * harness's scratch-hub seed), so the two can never drift. */
-export function workbenchTemplateLibraryEntries(): readonly {
-  readonly id: string;
-  readonly content: string;
-}[] {
-  return WORKBENCH_TEMPLATES.map((template) => ({
-    id: template.id,
-    content: serializeWorkbenchDefinition(template),
-  }));
-}
-
-export function serializeWorkbenchDefinition(
-  definition: WorkbenchDefinition,
-): string {
-  return JSON.stringify(definition, null, 2);
-}
-
-/**
- * Parses a seeded library row's content back into a definition, running
- * the same cross-reference checks module load runs on the shipped
- * constants. Throws on anything malformed — an unreadable library row
- * is a seeding defect to surface, never a shape to limp past.
- */
-export function parseWorkbenchDefinition(data: unknown): WorkbenchDefinition {
-  const raw = typeof data === "string" ? JSON.parse(data) : data;
-  const parsed = WorkbenchDefinitionSchema(raw);
-  if (parsed instanceof type.errors) {
-    throw new Error(`workbench definition failed to parse: ${parsed.summary}`);
-  }
-  assertValid(parsed);
-  return parsed;
-}
-
-function assertValid(definition: WorkbenchDefinition): void {
-  const blockNames = new Set(templateBlockAssetNames(definition));
-  const parsedBlocks = WorkbenchTemplateBlock.array()(definition.blocks);
-  if (parsedBlocks instanceof type.errors) {
-    throw new Error(
-      `workbench definition "${definition.id}" has an invalid blocks shape: ${parsedBlocks.summary}`,
-    );
-  }
-  const parsedRoutines = WorkbenchTemplateRoutine.array()(definition.routines);
-  if (parsedRoutines instanceof type.errors) {
-    throw new Error(
-      `workbench definition "${definition.id}" has an invalid routines shape: ${parsedRoutines.summary}`,
-    );
-  }
-  const parsedAgents = WorkbenchDefinitionAgent.array()(definition.agents);
-  if (parsedAgents instanceof type.errors) {
-    throw new Error(
-      `workbench definition "${definition.id}" has an invalid agents shape: ${parsedAgents.summary}`,
-    );
-  }
-  const parsedInputs = WorkbenchTemplateOpenInput.array()(
-    definition.openInputs,
-  );
-  if (parsedInputs instanceof type.errors) {
-    throw new Error(
-      `workbench definition "${definition.id}" has an invalid openInputs shape: ${parsedInputs.summary}`,
-    );
-  }
-  const parsedWebhookTriggers = WorkbenchTemplateWebhookTrigger.array()(
-    definition.webhookTriggers,
-  );
-  if (parsedWebhookTriggers instanceof type.errors) {
-    throw new Error(
-      `workbench definition "${definition.id}" has an invalid webhookTriggers shape: ${parsedWebhookTriggers.summary}`,
-    );
-  }
-  const parsedSteps = WorkbenchOnboardingStep.array()(
-    definition.onboardingSteps,
-  );
-  if (parsedSteps instanceof type.errors) {
-    throw new Error(
-      `workbench definition "${definition.id}" has an invalid onboardingSteps shape: ${parsedSteps.summary}`,
-    );
-  }
-  if (new Set(definition.tools).size !== definition.tools.length) {
-    throw new Error(
-      `workbench definition "${definition.id}" names the same tool package more than once`,
-    );
-  }
-  const routineKeys = new Set(
-    definition.routines.map((routine) => routine.key),
-  );
-  for (const routine of definition.routines) {
-    if (!blockNames.has(routine.blockAssetName)) {
-      throw new Error(
-        `workbench definition "${definition.id}" routine "${routine.key}" runs "${routine.blockAssetName}", which the definition does not install`,
-      );
-    }
-  }
-  const webhookTriggerKeys = new Set(
-    definition.webhookTriggers.map((trigger) => trigger.key),
-  );
-  for (const trigger of definition.webhookTriggers) {
-    if (!blockNames.has(trigger.blockAssetName)) {
-      throw new Error(
-        `workbench definition "${definition.id}" webhook trigger "${trigger.key}" fires "${trigger.blockAssetName}", which the definition does not install`,
-      );
-    }
-  }
-  for (const agent of definition.agents) {
-    if (
-      agent.blockAssetName !== undefined &&
-      !blockNames.has(agent.blockAssetName)
-    ) {
-      throw new Error(
-        `workbench definition "${definition.id}" agent "${agent.handle}" is backed by "${agent.blockAssetName}", which the definition does not install`,
-      );
-    }
-  }
-  for (const input of definition.openInputs) {
-    const appliesToCount =
-      Number(input.appliesToRoutine !== undefined) +
-      Number(input.appliesToWebhookTrigger !== undefined);
-    if (appliesToCount !== 1) {
-      throw new Error(
-        `workbench definition "${definition.id}" input "${input.key}" must apply to exactly one of a routine or a webhook trigger`,
-      );
-    }
-    if (
-      input.appliesToRoutine !== undefined &&
-      !routineKeys.has(input.appliesToRoutine)
-    ) {
-      throw new Error(
-        `workbench definition "${definition.id}" input "${input.key}" applies to routine "${input.appliesToRoutine}", which the definition does not create`,
-      );
-    }
-    if (
-      input.appliesToWebhookTrigger !== undefined &&
-      !webhookTriggerKeys.has(input.appliesToWebhookTrigger)
-    ) {
-      throw new Error(
-        `workbench definition "${definition.id}" input "${input.key}" applies to webhook trigger "${input.appliesToWebhookTrigger}", which the definition does not create`,
-      );
-    }
-  }
-  assertOnboardingWalkthrough(definition);
-}
-
-/**
- * The walkthrough is ordered, so its checks are ordered too: a step can
- * only ask for something an earlier step made possible, and a required
- * plugin with no step to connect it is a definition that promises setup
- * it never asks for.
- */
-function assertOnboardingWalkthrough(definition: WorkbenchDefinition): void {
-  const declaredPlugins = new Set([
-    ...definition.plugins.required,
-    ...definition.plugins.optional,
-  ]);
-  const connectedSoFar = new Set<string>();
-  const startedTriggerKeys = new Set<string>();
-  let pickedRepos = false;
-
-  for (const step of definition.onboardingSteps) {
-    if (step.kind === "connect-plugin") {
-      if (!declaredPlugins.has(step.connectorId)) {
-        throw new Error(
-          `workbench definition "${definition.id}" onboarding connects "${step.connectorId}", which is not one of its plugins`,
-        );
-      }
-      connectedSoFar.add(step.connectorId);
-      continue;
-    }
-    if (step.kind === "pick-github-repos") {
-      if (!connectedSoFar.has("github")) {
-        throw new Error(
-          `workbench definition "${definition.id}" asks for repos before its onboarding connects "github"`,
-        );
-      }
-      pickedRepos = true;
-      continue;
-    }
-    if (!webhookTriggerKeyExists(definition, step.webhookTriggerKey)) {
-      throw new Error(
-        `workbench definition "${definition.id}" onboarding starts webhook trigger "${step.webhookTriggerKey}", which the definition does not create`,
-      );
-    }
-    if (startedTriggerKeys.has(step.webhookTriggerKey)) {
-      throw new Error(
-        `workbench definition "${definition.id}" onboarding starts webhook trigger "${step.webhookTriggerKey}" more than once`,
-      );
-    }
-    if (!pickedRepos) {
-      throw new Error(
-        `workbench definition "${definition.id}" starts webhook trigger "${step.webhookTriggerKey}" before its onboarding picks repos`,
-      );
-    }
-    startedTriggerKeys.add(step.webhookTriggerKey);
-  }
-
-  for (const connectorId of definition.plugins.required) {
-    if (!connectedSoFar.has(connectorId)) {
-      throw new Error(
-        `workbench definition "${definition.id}" requires plugin "${connectorId}" but its onboarding never asks anyone to connect it`,
-      );
-    }
-  }
-  for (const trigger of definition.webhookTriggers) {
-    if (!startedTriggerKeys.has(trigger.key)) {
-      throw new Error(
-        `workbench definition "${definition.id}" webhook trigger "${trigger.key}" is never started by an onboarding step`,
-      );
-    }
-  }
-}
-
-function webhookTriggerKeyExists(
-  definition: WorkbenchDefinition,
-  key: string,
-): boolean {
-  return definition.webhookTriggers.some((trigger) => trigger.key === key);
-}
-
-for (const definition of WORKBENCH_TEMPLATES) {
-  assertValid(definition);
-}
diff --git a/templates/instantiate.test.ts b/templates/instantiate.test.ts
deleted file mode 100644
index 45f084f6fb..0000000000
--- a/templates/instantiate.test.ts
+++ /dev/null
@@ -1,288 +0,0 @@
-import { expect, test } from "bun:test";
-import { CODE_REVIEW_REVIEWERS } from "@corbits/code-review/reviewers";
-
-import {
-  CODE_REVIEW_TEMPLATE,
-  DUE_DILIGENCE_TEMPLATE,
-  GTM_TEMPLATE,
-  type WorkbenchOnboardingStep,
-} from "./index";
-import {
-  instantiateWorkbenchTemplate,
-  type WorkbenchTemplateInstantiationPorts,
-} from "./instantiate";
-
-function fakePorts(
-  existingHandles: readonly string[] = [],
-  alreadyDeployedBlocks: readonly string[] = [],
-): WorkbenchTemplateInstantiationPorts & {
-  readonly created: string[];
-  readonly invited: string[];
-  readonly recordedConnections: (readonly string[])[];
-  readonly deployedBlocks: string[];
-  readonly calls: string[];
-  readonly onboardingSteps: (readonly WorkbenchOnboardingStep[])[];
-} {
-  const created: string[] = [];
-  const invited: string[] = [];
-  const recordedConnections: (readonly string[])[] = [];
-  const deployedBlocks: string[] = [];
-  const calls: string[] = [];
-  const onboardingSteps: (readonly WorkbenchOnboardingStep[])[] = [];
-  return {
-    created,
-    invited,
-    recordedConnections,
-    deployedBlocks,
-    calls,
-    onboardingSteps,
-    async listAgentHandles() {
-      return existingHandles.map((handle) => ({ handle, id: `def-${handle}` }));
-    },
-    async createParticipantAgent(request) {
-      created.push(request.handle);
-      return { id: `def-${request.handle}` };
-    },
-    async deployBlockWorkflow(block) {
-      deployedBlocks.push(block.assetName);
-      return { created: !alreadyDeployedBlocks.includes(block.assetName) };
-    },
-    async inviteParticipantAgent(id) {
-      invited.push(id);
-      calls.push(`invite:${id}`);
-    },
-    async recordPendingConnections(pendingConnections) {
-      recordedConnections.push(pendingConnections);
-      calls.push("recordPendingConnections");
-    },
-    async beginOnboarding(steps) {
-      onboardingSteps.push(steps);
-      calls.push("beginOnboarding");
-    },
-  };
-}
-
-test("instantiating the code-review definition creates the three reviewer definitions, never Myra", () => {
-  const ports = fakePorts();
-  return instantiateWorkbenchTemplate(CODE_REVIEW_TEMPLATE, ports).then(
-    (result) => {
-      expect(result.createdHandles).toEqual(
-        CODE_REVIEW_REVIEWERS.map((reviewer) => reviewer.handle),
-      );
-      expect(ports.created).toEqual(
-        CODE_REVIEW_REVIEWERS.map((reviewer) => reviewer.handle),
-      );
-      expect(ports.created).not.toContain("myra");
-      expect(result.skippedHandles).toEqual([]);
-    },
-  );
-});
-
-test("instantiating the code-review template records its required connections as pending", async () => {
-  const ports = fakePorts();
-  const result = await instantiateWorkbenchTemplate(
-    CODE_REVIEW_TEMPLATE,
-    ports,
-  );
-  expect(result.pendingConnections).toEqual(["github"]);
-  expect(ports.recordedConnections).toEqual([["github"]]);
-});
-
-test("instantiating the code-review template skips a reviewer that already exists", async () => {
-  const ports = fakePorts(["architecture-reviewer"]);
-  const result = await instantiateWorkbenchTemplate(
-    CODE_REVIEW_TEMPLATE,
-    ports,
-  );
-  expect(result.skippedHandles).toEqual(["architecture-reviewer"]);
-  expect(result.createdHandles).toEqual([
-    "correctness-reviewer",
-    "release-risk-reviewer",
-  ]);
-  expect(ports.created).not.toContain("architecture-reviewer");
-});
-
-// A reviewer whose agent-directory definition already exists (a second
-// workbench from the same template) still has to become a participant
-// of THIS new room — an existing definition is not an existing
-// invitation, so skipping the create must never skip the invite too.
-test("instantiating the code-review definition invites every reviewer into the room, created or skipped alike", async () => {
-  const ports = fakePorts(["architecture-reviewer"]);
-  const result = await instantiateWorkbenchTemplate(
-    CODE_REVIEW_TEMPLATE,
-    ports,
-  );
-  expect(result.invitedHandles).toEqual(
-    CODE_REVIEW_REVIEWERS.map((reviewer) => reviewer.handle),
-  );
-  expect(ports.invited).toEqual(
-    expect.arrayContaining([
-      "def-architecture-reviewer",
-      "def-correctness-reviewer",
-      "def-release-risk-reviewer",
-    ]),
-  );
-  expect(ports.invited).toHaveLength(3);
-});
-
-test("the code-review definition never invites or creates Myra — nobody hosts a template room", async () => {
-  const ports = fakePorts(["assistant"]);
-  const result = await instantiateWorkbenchTemplate(
-    CODE_REVIEW_TEMPLATE,
-    ports,
-  );
-  expect(ports.invited).not.toContain("def-assistant");
-  expect(ports.created).not.toContain("myra");
-  expect(ports.created).not.toContain("assistant");
-  expect(result.invitedHandles).not.toContain("myra");
-});
-
-test("the due-diligence definition still invites an existing assistant as Myra", async () => {
-  const ports = fakePorts(["assistant"]);
-  const result = await instantiateWorkbenchTemplate(
-    DUE_DILIGENCE_TEMPLATE,
-    ports,
-  );
-  expect(ports.invited).toContain("def-assistant");
-  expect(ports.created).not.toContain("myra");
-  expect(result.invitedHandles).toEqual(["myra", "scout"]);
-});
-
-test("instantiating the code-review definition begins its walkthrough, in definition order, once everything else is in place", async () => {
-  const ports = fakePorts();
-  const result = await instantiateWorkbenchTemplate(
-    CODE_REVIEW_TEMPLATE,
-    ports,
-  );
-  expect(ports.onboardingSteps).toEqual([CODE_REVIEW_TEMPLATE.onboardingSteps]);
-  expect(result.onboardingSteps).toEqual(CODE_REVIEW_TEMPLATE.onboardingSteps);
-  expect(ports.calls.at(-1)).toBe("beginOnboarding");
-  expect(ports.calls.at(-2)).toBe("recordPendingConnections");
-  expect(ports.calls.filter((call) => call.startsWith("invite:"))).toHaveLength(
-    3,
-  );
-});
-
-test("a definition with no onboarding steps never begins a walkthrough", async () => {
-  const ports = fakePorts();
-  const result = await instantiateWorkbenchTemplate(
-    DUE_DILIGENCE_TEMPLATE,
-    ports,
-  );
-  expect(ports.onboardingSteps).toEqual([]);
-  expect(ports.calls).not.toContain("beginOnboarding");
-  expect(result.onboardingSteps).toEqual([]);
-});
-
-test("instantiating the code-review template deploys its referenced code-review block workflow", async () => {
-  const ports = fakePorts();
-  const result = await instantiateWorkbenchTemplate(
-    CODE_REVIEW_TEMPLATE,
-    ports,
-  );
-  expect(ports.deployedBlocks).toEqual(["code-review"]);
-  expect(result.deployedBlockAssetNames).toEqual(["code-review"]);
-  expect(result.skippedBlockAssetNames).toEqual([]);
-});
-
-test("a block workflow the tenant already deployed is reported as skipped, never re-deployed", async () => {
-  const ports = fakePorts([], ["code-review"]);
-  const result = await instantiateWorkbenchTemplate(
-    CODE_REVIEW_TEMPLATE,
-    ports,
-  );
-  expect(result.deployedBlockAssetNames).toEqual([]);
-  expect(result.skippedBlockAssetNames).toEqual(["code-review"]);
-});
-
-test("instantiating a definition with an agent outside the reviewer roster throws rather than silently skipping it", () => {
-  return expect(
-    instantiateWorkbenchTemplate(GTM_TEMPLATE, fakePorts()),
-  ).rejects.toThrow(/has no known create-agent request/);
-});
-
-test("instantiating the due-diligence template creates Scout, never Myra, with no credential connected", async () => {
-  const ports = fakePorts();
-  const result = await instantiateWorkbenchTemplate(
-    DUE_DILIGENCE_TEMPLATE,
-    ports,
-  );
-  expect(result.createdHandles).toEqual(["scout"]);
-  expect(ports.created).toEqual(["scout"]);
-  expect(ports.created).not.toContain("myra");
-  expect(result.skippedHandles).toEqual([]);
-  // No block to deploy and nothing required up front: seeding never
-  // fails for want of a connected credential (Exa's MCP preset is
-  // keyless, and this template requires nothing at all).
-  expect(ports.deployedBlocks).toEqual([]);
-  expect(result.pendingConnections).toEqual([]);
-});
-
-test("instantiating the due-diligence template twice never creates Scout a second time", async () => {
-  const first = fakePorts();
-  await instantiateWorkbenchTemplate(DUE_DILIGENCE_TEMPLATE, first);
-  const second = fakePorts(["scout"]);
-  const result = await instantiateWorkbenchTemplate(
-    DUE_DILIGENCE_TEMPLATE,
-    second,
-  );
-  expect(result.createdHandles).toEqual([]);
-  expect(result.skippedHandles).toEqual(["scout"]);
-  expect(second.created).toEqual([]);
-});
-
-test("Scout's create request carries its tool package pins", async () => {
-  const requests: { handle: string; toolPackagePins?: readonly string[] }[] =
-    [];
-  const ports: WorkbenchTemplateInstantiationPorts = {
-    async listAgentHandles() {
-      return [];
-    },
-    async createParticipantAgent(request) {
-      requests.push(request);
-      return { id: `def-${request.handle}` };
-    },
-    async deployBlockWorkflow() {
-      return { created: true };
-    },
-    async inviteParticipantAgent() {
-      /* noop */
-    },
-    async recordPendingConnections() {
-      /* noop */
-    },
-    async beginOnboarding() {
-      /* noop */
-    },
-  };
-  await instantiateWorkbenchTemplate(DUE_DILIGENCE_TEMPLATE, ports);
-  const scout = requests.find((request) => request.handle === "scout");
-  expect(scout?.toolPackagePins).toEqual(
-    expect.arrayContaining([
-      "@corbits/memory-tools",
-      "@corbits/web-search-tools",
-      "@corbits/scout-agent",
-    ]),
-  );
-});
-
-// No shipped definition names Jimmy (he is not a "kind of workbench");
-// `@corbits/chat-ui`'s "Add Jimmy" quick-create row calls
-// `jimmyAgentRequest()` directly instead of going through one. This
-// proves `instantiateWorkbenchTemplate`'s request map still resolves his
-// handle, so a future template naming him works with no new plumbing.
-test("a definition naming Jimmy's handle still resolves and creates him", async () => {
-  const definitionNamingJimmy = {
-    ...DUE_DILIGENCE_TEMPLATE,
-    agents: [
-      { handle: "jimmy", displayName: "Jimmy", role: "Replies with a GIF." },
-    ],
-  };
-  const ports = fakePorts();
-  const result = await instantiateWorkbenchTemplate(
-    definitionNamingJimmy,
-    ports,
-  );
-  expect(result.createdHandles).toEqual(["jimmy"]);
-  expect(ports.created).toEqual(["jimmy"]);
-});
diff --git a/templates/instantiate.ts b/templates/instantiate.ts
deleted file mode 100644
index a46b748a7d..0000000000
--- a/templates/instantiate.ts
+++ /dev/null
@@ -1,203 +0,0 @@
-// Turns a picked workbench definition into the state a freshly minted
-// workbench needs: the agent definitions that don't already exist, the
-// block workflows behind them, the still-pending plugin list the room
-// persists, and the definition's ordered onboarding walkthrough handed
-// to whatever surface runs it. Pure orchestration over injected ports —
-// no HTTP, no store — so a host (today, `apps/web`'s
-// `instant-agent-create.ts`) can bind the ports to its own REST clients
-// and this stays testable with plain fakes.
-//
-// This resolves a definition whose non-Myra agents are backed by either
-// `@corbits/code-review`'s reviewer roster (`CODE_REVIEW_TEMPLATE`) or a
-// standalone chat agent this catalog installs the same way — Scout, for
-// `DUE_DILIGENCE_TEMPLATE` (see `./participant-agent-requests.ts`).
-// Jimmy resolves through the identical `ParticipantAgentRequest` shape
-// (`jimmyAgentRequest()`), but no shipped definition names his handle
-// today — he is not a "kind of workbench"; `@corbits/chat-ui`'s "Add
-// Jimmy" quick-create row calls `jimmyAgentRequest()` directly instead.
-// Kept registered here too so a future definition naming his handle
-// resolves without new plumbing.
-//
-// A definition like `GTM_TEMPLATE`, whose agents are backed by their own
-// deployed workflow definitions rather than an agent-directory create
-// request, needs its own resolution path — calling this function against
-// such a definition throws rather than silently doing nothing.
-import {
-  codeReviewAgentRequests,
-  type CodeReviewAgentRequest,
-} from "@corbits/code-review/agent-requests";
-import {
-  jimmyAgentRequest,
-  scoutAgentRequest,
-} from "./participant-agent-requests";
-
-import type {
-  WorkbenchDefinition,
-  WorkbenchOnboardingStep,
-  WorkbenchTemplateBlock,
-} from "./index";
-
-/** The agent-directory create-request shape every agent resolves
- * to: `CodeReviewAgentRequest`'s own fields, plus the tool-package pins
- * a tool-calling agent (Scout, Jimmy) needs and a pure-text
- * reviewer does not. */
-export type ParticipantAgentRequest = CodeReviewAgentRequest & {
-  readonly toolPackagePins?: readonly string[];
-};
-
-export interface WorkbenchTemplateInstantiationPorts {
-  /** Every agent definition already deployed in the bench, as
-   * `{handle, id}` pairs. Doubles as the idempotency check (re-running
-   * instantiation — a retried create, a second workbench from the same
-   * template — never double-creates a reviewer) and as the id source
-   * for `inviteParticipantAgent` below: an agent definition the tenant
-   * already has is not yet a member of a freshly minted room, so
-   * its id still has to reach the invite call even when this function
-   * skips creating it. */
-  listAgentHandles(): Promise<
-    readonly { readonly handle: string; readonly id: string }[]
-  >;
-  /** The agent-directory create path (`POST /agent-definitions`), or a
-   * fake of it in tests. */
-  createParticipantAgent(
-    request: ParticipantAgentRequest,
-  ): Promise<{ readonly id: string }>;
-  /** Deploys one of the definition's referenced block workflows through
-   * the same source-form deploy the agent definitions use
-   * (`POST /template-blocks/:assetName/deploy` — see
-   * `./template-block-routes.ts`), or a fake of it in tests. `created`
-   * is `false` when the tenant already carries a deployed definition
-   * under this asset name, so a retried instantiation never
-   * double-deploys. */
-  deployBlockWorkflow(
-    block: WorkbenchTemplateBlock,
-  ): Promise<{ readonly created: boolean }>;
-  /** Adds one agent definition to the newly created
-   * workbench's room (`POST /workbenches/:id/invite` —
-   * `@corbits/chat-ui`'s `inviteAgent`), or a fake of it in tests. This
-   * is what makes a definition's roster actually present in the room
-   * rather than merely registered in the agent directory. Called for
-   * Myra too: she is an existing principal invited after mint, not
-   * the room's host `definitionId`. */
-  inviteParticipantAgent(id: string): Promise<void>;
-  /** Persists the room's still-needed connections — the workbench
-   * settings `template/pendingConnections` key today; see
-   * `apps/web/src/instant-agent-create.ts`. */
-  recordPendingConnections(
-    pendingConnections: readonly string[],
-  ): Promise<void>;
-  /** Runs the definition's onboarding walkthrough in the freshly minted
-   * room — `apps/web` posts the first step's card through
-   * `postWorkbenchOnboardingStep`. Called last, and only when the
-   * definition has steps at all. */
-  beginOnboarding(steps: readonly WorkbenchOnboardingStep[]): Promise<void>;
-}
-
-export interface WorkbenchTemplateInstantiationResult {
-  readonly createdHandles: readonly string[];
-  readonly skippedHandles: readonly string[];
-  /** Every non-Myra agent handle actually added to the room —
-   * `createdHandles` and `skippedHandles` combined, in definition order.
-   * A caller proving the roster a definition promises is really present
-   * checks this, not just that the definitions exist. */
-  readonly invitedHandles: readonly string[];
-  /** Block workflows `deployBlockWorkflow` actually deployed on this
-   * run, by asset name; a block the tenant already carried lands in
-   * `skippedBlockAssetNames` instead. */
-  readonly deployedBlockAssetNames: readonly string[];
-  readonly skippedBlockAssetNames: readonly string[];
-  readonly pendingConnections: readonly string[];
-  /** The ordered walkthrough handed to `beginOnboarding` — empty for a
-   * definition with no onboarding at all. */
-  readonly onboardingSteps: readonly WorkbenchOnboardingStep[];
-}
-
-/**
- * Resolves `definition` against the bench: creates the agent
- * definitions that don't already exist (Myra is never re-created — she
- * is the bench's seeded default setup agent, reused as-is and invited
- * into the new channel), records the definition's required plugins as
- * still pending, and then begins its onboarding walkthrough. Never
- * registers a live webhook trigger itself: that is what the
- * walkthrough's own start-reviewing step does, once the person has
- * picked repos.
- */
-export async function instantiateWorkbenchTemplate(
-  definition: WorkbenchDefinition,
-  ports: WorkbenchTemplateInstantiationPorts,
-): Promise<WorkbenchTemplateInstantiationResult> {
-  const existingIdsByHandle = new Map(
-    (await ports.listAgentHandles()).map((agent) => [agent.handle, agent.id]),
-  );
-  const assistantId = existingIdsByHandle.get("assistant");
-  if (assistantId !== undefined && !existingIdsByHandle.has("myra")) {
-    existingIdsByHandle.set("myra", assistantId);
-  }
-  const requestsByHandle = new Map<string, ParticipantAgentRequest>(
-    [
-      ...codeReviewAgentRequests(),
-      scoutAgentRequest(),
-      jimmyAgentRequest(),
-    ].map((request) => [request.handle, request]),
-  );
-
-  // The definition's referenced block workflows deploy first: an agent
-  // is a lens over a block, and the connect card's
-  // start-reviewing step resolves the deployed block definition by
-  // name, so a bench must never end up with reviewers but no
-  // `code-review` workflow behind them.
-  const deployedBlockAssetNames: string[] = [];
-  const skippedBlockAssetNames: string[] = [];
-  for (const block of definition.blocks) {
-    const outcome = await ports.deployBlockWorkflow(block);
-    (outcome.created ? deployedBlockAssetNames : skippedBlockAssetNames).push(
-      block.assetName,
-    );
-  }
-
-  const createdHandles: string[] = [];
-  const skippedHandles: string[] = [];
-  const invitedHandles: string[] = [];
-  for (const agent of definition.agents) {
-    const existingId = existingIdsByHandle.get(agent.handle);
-    let agentId: string;
-    if (existingId !== undefined) {
-      skippedHandles.push(agent.handle);
-      agentId = existingId;
-    } else if (agent.handle === "myra") {
-      // Seeded principal (`name: "assistant"`), never minted from a
-      // definition's roster. The create path already gates on
-      // `findMyraDefinition`; skip rather than throw.
-      continue;
-    } else {
-      const request = requestsByHandle.get(agent.handle);
-      if (request === undefined) {
-        throw new Error(
-          `workbench definition "${definition.id}" agent "${agent.handle}" ` +
-            "has no known create-agent request to instantiate it from",
-        );
-      }
-      const created = await ports.createParticipantAgent(request);
-      createdHandles.push(agent.handle);
-      agentId = created.id;
-    }
-    await ports.inviteParticipantAgent(agentId);
-    invitedHandles.push(agent.handle);
-  }
-
-  await ports.recordPendingConnections(definition.plugins.required);
-
-  if (definition.onboardingSteps.length > 0) {
-    await ports.beginOnboarding(definition.onboardingSteps);
-  }
-
-  return {
-    createdHandles,
-    skippedHandles,
-    invitedHandles,
-    deployedBlockAssetNames,
-    skippedBlockAssetNames,
-    pendingConnections: definition.plugins.required,
-    onboardingSteps: definition.onboardingSteps,
-  };
-}
diff --git a/templates/package.json b/templates/package.json
deleted file mode 100644
index cc034cc6a5..0000000000
--- a/templates/package.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "name": "@workbench/templates",
-  "private": true,
-  "description": "Workbench templates: the shipped WorkbenchDefinition data (one directory per template, peer of workflows/) plus the pure logic that instantiates one against a bench over injected ports",
-  "version": "0.0.1",
-  "license": "LGPL-2.1-or-later",
-  "type": "module",
-  "exports": {
-    ".": "./index.ts",
-    "./connectors": "./connectors.ts",
-    "./instantiate": "./instantiate.ts",
-    "./settings": "./settings.ts"
-  },
-  "scripts": {
-    "typecheck": "tsc --noEmit",
-    "test": "bun test"
-  },
-  "dependencies": {
-    "@corbits/code-review": "workspace:*",
-    "@corbits/connections": "workspace:*",
-    "@corbits/codex-provider": "workspace:*",
-    "@corbits/jimmy-agent": "workspace:*",
-    "@corbits/scout-agent": "workspace:*",
-    "@corbits/workflows": "workspace:*",
-    "@corbits/xai-provider": "workspace:*",
-    "arktype": "catalog:",
-    "simple-icons": "^16.28.0"
-  },
-  "devDependencies": {
-    "@types/bun": "catalog:",
-    "typescript": "catalog:"
-  }
-}
diff --git a/templates/participant-agent-requests.ts b/templates/participant-agent-requests.ts
deleted file mode 100644
index 367f54bb69..0000000000
--- a/templates/participant-agent-requests.ts
+++ /dev/null
@@ -1,49 +0,0 @@
-// Request-shaped views of this catalog's two standalone chat-agent
-// participants (Scout, Jimmy), in the shape `./instantiate.ts`'s
-// `createParticipantAgent` port takes — the same shape
-// `@corbits/code-review/agent-requests`' `codeReviewAgentRequests`
-// establishes for the reviewer roster, extended with `toolPackagePins`
-// since neither Scout nor Jimmy is a pure-text agent. Built here, from
-// each package's own exported definition, rather than inside
-// `packages/scout-agent`/`packages/jimmy-agent` themselves: this
-// package already owns "what a template participant needs to become an
-// agent-directory create request" (it owns `codeReviewAgentRequests`'
-// caller), so the mapping belongs beside it, not duplicated into every
-// agent package that wants to be installable this way.
-import { SCOUT_AGENT_DEFINITION } from "@corbits/scout-agent/definition";
-import {
-  JIMMY_AGENT_ID,
-  JIMMY_DESCRIPTION,
-  JIMMY_DISPLAY_NAME,
-  JIMMY_SYSTEM_PROMPT,
-  JIMMY_TOOL_PACKAGE_PINS,
-} from "@corbits/jimmy-agent/metadata";
-
-import type { ParticipantAgentRequest } from "./instantiate";
-
-export function scoutAgentRequest(): ParticipantAgentRequest {
-  return {
-    name: SCOUT_AGENT_DEFINITION.displayName,
-    handle: SCOUT_AGENT_DEFINITION.handle,
-    description: SCOUT_AGENT_DEFINITION.description,
-    systemPrompt: SCOUT_AGENT_DEFINITION.systemPrompt,
-    toolPackagePins: SCOUT_AGENT_DEFINITION.toolPackagePins.map(
-      (pin) => pin.name,
-    ),
-  };
-}
-
-/** Jimmy's own package exports an `@intx/agent`-native `AgentDefinition`
- * builder (`buildJimmyAgent`), not the `{handle, displayName, ...}`
- * plain-data shape the agent-directory create path takes — it has no
- * handle or display name of its own at all. `JIMMY_AGENT_ID` ("jimmy")
- * is both his id and the handle a person types to reach him. */
-export function jimmyAgentRequest(): ParticipantAgentRequest {
-  return {
-    name: JIMMY_DISPLAY_NAME,
-    handle: JIMMY_AGENT_ID,
-    description: JIMMY_DESCRIPTION,
-    systemPrompt: JIMMY_SYSTEM_PROMPT,
-    toolPackagePins: JIMMY_TOOL_PACKAGE_PINS.map((pin) => pin.name),
-  };
-}
diff --git a/templates/schema.test.ts b/templates/schema.test.ts
deleted file mode 100644
index f5dd02ce5d..0000000000
--- a/templates/schema.test.ts
+++ /dev/null
@@ -1,305 +0,0 @@
-import { expect, test } from "bun:test";
-import { CONNECTOR_REGISTRY, MCP_PRESETS } from "./connectors";
-import { SCOUT_TOOL_PACKAGE_PINS } from "@corbits/scout-agent/definition";
-
-import {
-  CODE_REVIEW_TEMPLATE,
-  DUE_DILIGENCE_TEMPLATE,
-  GTM_TEMPLATE,
-  WORKBENCH_TEMPLATES,
-  WORKFLOW_CATALOG,
-  templateBlockAssetNames,
-  workbenchTemplate,
-  parseWorkbenchDefinition,
-  serializeWorkbenchDefinition,
-  workflowCatalogEntry,
-} from "./index";
-
-test("every template's blocks are real catalog workflows", () => {
-  const known = new Set(WORKFLOW_CATALOG.map((entry) => entry.assetName));
-  for (const template of WORKBENCH_TEMPLATES) {
-    for (const assetName of templateBlockAssetNames(template)) {
-      expect(known).toContain(assetName);
-    }
-  }
-});
-
-test("every connector a template names is a real connector or MCP preset", () => {
-  const known = new Set([
-    ...Object.keys(CONNECTOR_REGISTRY),
-    ...MCP_PRESETS.map((preset) => preset.slug),
-  ]);
-  for (const template of WORKBENCH_TEMPLATES) {
-    for (const connector of [
-      ...template.plugins.required,
-      ...template.plugins.optional,
-    ]) {
-      expect(known).toContain(connector);
-    }
-  }
-});
-
-test("a template never both requires and merely offers the same connector", () => {
-  for (const template of WORKBENCH_TEMPLATES) {
-    const required = new Set(template.plugins.required);
-    for (const optional of template.plugins.optional) {
-      expect(required).not.toContain(optional);
-    }
-  }
-});
-
-test("only automatable blocks get put on a schedule", () => {
-  for (const template of WORKBENCH_TEMPLATES) {
-    for (const routine of template.routines) {
-      expect(workflowCatalogEntry(routine.blockAssetName)?.automatable).toBe(
-        true,
-      );
-    }
-  }
-});
-
-test("the GTM template installs the four ported v1 workflows plus the call write-up backbone", () => {
-  expect(workbenchTemplate("gtm")).toBe(GTM_TEMPLATE);
-  expect(templateBlockAssetNames(GTM_TEMPLATE)).toEqual([
-    "granola-call",
-    "process-granola-call",
-    "attio-task-agent",
-    "exa-topic-watch",
-    "pain-point-collateral",
-  ]);
-});
-
-test("the GTM template blocks the create on the two connectors nothing works without", () => {
-  expect(GTM_TEMPLATE.plugins.required).toEqual(["attio", "exa"]);
-  expect(GTM_TEMPLATE.plugins.optional).toEqual(["granola"]);
-});
-
-test("the GTM template schedules call discovery and the web watch, and nothing else", () => {
-  expect(GTM_TEMPLATE.routines.map((routine) => routine.key)).toEqual([
-    "call-discovery",
-    "topic-watch",
-  ]);
-  expect(
-    GTM_TEMPLATE.routines.map((routine) => routine.blockAssetName),
-  ).toEqual(["granola-call", "exa-topic-watch"]);
-});
-
-test("the watch's one open input reaches the routine that needs it", () => {
-  expect(GTM_TEMPLATE.openInputs).toHaveLength(1);
-  const [topic] = GTM_TEMPLATE.openInputs;
-  expect(topic?.key).toBe("topic");
-  expect(topic?.required).toBe(true);
-  expect(topic?.appliesToRoutine).toBe("topic-watch");
-});
-
-test("every routine-scoped open input names a field the block's own trigger contract carries", () => {
-  for (const template of WORKBENCH_TEMPLATES) {
-    for (const input of template.openInputs) {
-      if (input.appliesToRoutine === undefined) continue;
-      const routine = template.routines.find(
-        (candidate) => candidate.key === input.appliesToRoutine,
-      );
-      const fields =
-        workflowCatalogEntry(routine?.blockAssetName ?? "")?.triggerFields ??
-        [];
-      expect(fields.map((field) => field.key)).toContain(input.key);
-    }
-  }
-});
-
-test("every webhook-trigger-scoped open input names a real webhook trigger", () => {
-  for (const template of WORKBENCH_TEMPLATES) {
-    for (const input of template.openInputs) {
-      if (input.appliesToWebhookTrigger === undefined) continue;
-      const trigger = template.webhookTriggers.find(
-        (candidate) => candidate.key === input.appliesToWebhookTrigger,
-      );
-      expect(trigger).toBeDefined();
-    }
-  }
-});
-
-test("every webhook trigger's field names a field the block's own trigger contract carries", () => {
-  for (const template of WORKBENCH_TEMPLATES) {
-    for (const trigger of template.webhookTriggers) {
-      const fields =
-        workflowCatalogEntry(trigger.blockAssetName)?.triggerFields ?? [];
-      expect(fields.map((field) => field.key)).toContain(
-        trigger.triggerFieldKey,
-      );
-    }
-  }
-});
-
-test("the code-review template installs the code-review workflow and requires github", () => {
-  expect(workbenchTemplate("code-review")).toBe(CODE_REVIEW_TEMPLATE);
-  expect(templateBlockAssetNames(CODE_REVIEW_TEMPLATE)).toEqual([
-    "code-review",
-  ]);
-  expect(CODE_REVIEW_TEMPLATE.plugins.required).toEqual(["github"]);
-});
-
-test("the code-review template fires from a pull-request webhook, not a clock", () => {
-  expect(CODE_REVIEW_TEMPLATE.routines).toEqual([]);
-  expect(CODE_REVIEW_TEMPLATE.webhookTriggers).toHaveLength(1);
-  const [trigger] = CODE_REVIEW_TEMPLATE.webhookTriggers;
-  expect(trigger?.key).toBe("pull-request-opened");
-  expect(trigger?.blockAssetName).toBe("code-review");
-  expect(trigger?.triggerFieldKey).toBe("pullRequestUrl");
-});
-
-test("the code-review definition's agents are the three reviewers and nobody else", () => {
-  expect(CODE_REVIEW_TEMPLATE.agents.map((agent) => agent.handle)).toEqual([
-    "correctness-reviewer",
-    "architecture-reviewer",
-    "release-risk-reviewer",
-  ]);
-});
-
-test("the code-review definition names the GitHub tool package its reviewers need", () => {
-  expect(CODE_REVIEW_TEMPLATE.tools).toEqual(["@corbits/github-tools"]);
-});
-
-test("the code-review walkthrough is connect GitHub, pick repos, start reviewing — in that order", () => {
-  expect(CODE_REVIEW_TEMPLATE.onboardingSteps.map((step) => step.kind)).toEqual(
-    ["connect-plugin", "pick-github-repos", "start-webhook-trigger"],
-  );
-  for (const step of CODE_REVIEW_TEMPLATE.onboardingSteps) {
-    expect(step.title.length).toBeGreaterThan(0);
-    expect(step.why.length).toBeGreaterThan(0);
-  }
-});
-
-test("agents are addressable by a distinct handle", () => {
-  for (const template of WORKBENCH_TEMPLATES) {
-    const handles = template.agents.map((agent) => agent.handle);
-    expect(new Set(handles).size).toBe(handles.length);
-  }
-});
-
-test("a definition never names the same tool package twice", () => {
-  for (const template of WORKBENCH_TEMPLATES) {
-    expect(new Set(template.tools).size).toBe(template.tools.length);
-  }
-});
-
-test("the due-diligence definition's agents are Myra and Scout, neither backed by a block", () => {
-  expect(workbenchTemplate("due-diligence")).toBe(DUE_DILIGENCE_TEMPLATE);
-  expect(DUE_DILIGENCE_TEMPLATE.agents.map((agent) => agent.handle)).toEqual([
-    "myra",
-    "scout",
-  ]);
-  expect(templateBlockAssetNames(DUE_DILIGENCE_TEMPLATE)).toEqual([]);
-  for (const agent of DUE_DILIGENCE_TEMPLATE.agents) {
-    expect(agent.blockAssetName).toBeUndefined();
-  }
-});
-
-test("the due-diligence definition names Scout's tool packages and needs no walkthrough", () => {
-  expect(DUE_DILIGENCE_TEMPLATE.tools).toEqual(
-    SCOUT_TOOL_PACKAGE_PINS.map((pin) => pin.name),
-  );
-  expect(DUE_DILIGENCE_TEMPLATE.onboardingSteps).toEqual([]);
-});
-
-test("the due-diligence template blocks the create on nothing — Exa is offered, never required", () => {
-  expect(DUE_DILIGENCE_TEMPLATE.plugins.required).toEqual([]);
-  expect(DUE_DILIGENCE_TEMPLATE.plugins.optional).toEqual(["exa"]);
-});
-
-test("Jimmy is not a workbench template — the picker offers no such kind of workbench", () => {
-  expect(workbenchTemplate("default-teammates")).toBeUndefined();
-  for (const template of WORKBENCH_TEMPLATES) {
-    expect(template.agents.some((agent) => agent.handle === "jimmy")).toBe(
-      false,
-    );
-  }
-});
-
-test("every shipped definition survives the seed round trip verbatim", () => {
-  for (const template of WORKBENCH_TEMPLATES) {
-    const parsed = parseWorkbenchDefinition(
-      serializeWorkbenchDefinition(template),
-    );
-    expect(parsed).toEqual(template);
-  }
-});
-
-test("a malformed library row fails to parse instead of half-loading", () => {
-  expect(() => parseWorkbenchDefinition('{"id":"code-review"}')).toThrow(
-    /failed to parse/,
-  );
-  const firstRoutine = GTM_TEMPLATE.routines[0];
-  if (!firstRoutine) throw new Error("GTM_TEMPLATE has no routines");
-  const orphanRoutine = {
-    ...GTM_TEMPLATE,
-    routines: [{ ...firstRoutine, blockAssetName: "not-installed" }],
-  };
-  expect(() =>
-    parseWorkbenchDefinition(serializeWorkbenchDefinition(orphanRoutine)),
-  ).toThrow(/does not install/);
-});
-
-test("a required plugin with no step to connect it fails loud, naming the plugin", () => {
-  const unaskedPlugin = {
-    ...DUE_DILIGENCE_TEMPLATE,
-    plugins: { required: ["exa"], optional: [] },
-  };
-  expect(() =>
-    parseWorkbenchDefinition(serializeWorkbenchDefinition(unaskedPlugin)),
-  ).toThrow(/requires plugin "exa" but its onboarding never asks/);
-});
-
-test("a walkthrough step naming a connector outside the definition's plugins fails loud", () => {
-  const strayConnector = {
-    ...DUE_DILIGENCE_TEMPLATE,
-    onboardingSteps: [
-      {
-        kind: "connect-plugin" as const,
-        connectorId: "attio",
-        title: "Connect Attio",
-        why: "Nothing here reads Attio.",
-      },
-    ],
-  };
-  expect(() =>
-    parseWorkbenchDefinition(serializeWorkbenchDefinition(strayConnector)),
-  ).toThrow(/connects "attio", which is not one of its plugins/);
-});
-
-test("a start-webhook-trigger step naming an unknown trigger fails loud", () => {
-  const unknownTrigger = {
-    ...CODE_REVIEW_TEMPLATE,
-    onboardingSteps: [
-      ...CODE_REVIEW_TEMPLATE.onboardingSteps.slice(0, 2),
-      {
-        kind: "start-webhook-trigger" as const,
-        webhookTriggerKey: "issue-opened",
-        title: "Start reviewing",
-        why: "Nothing fires on issues.",
-      },
-    ],
-  };
-  expect(() =>
-    parseWorkbenchDefinition(serializeWorkbenchDefinition(unknownTrigger)),
-  ).toThrow(/"issue-opened", which the definition does not create/);
-});
-
-test("picking repos before GitHub is connected fails loud — the walkthrough is ordered", () => {
-  const outOfOrder = {
-    ...CODE_REVIEW_TEMPLATE,
-    onboardingSteps: [
-      {
-        kind: "pick-github-repos" as const,
-        title: "Pick your repos",
-        why: "Only the repositories you choose get reviewed.",
-      },
-      ...CODE_REVIEW_TEMPLATE.onboardingSteps.filter(
-        (step) => step.kind !== "pick-github-repos",
-      ),
-    ],
-  };
-  expect(() =>
-    parseWorkbenchDefinition(serializeWorkbenchDefinition(outOfOrder)),
-  ).toThrow(/asks for repos before its onboarding connects "github"/);
-});
diff --git a/templates/settings.test.ts b/templates/settings.test.ts
deleted file mode 100644
index a5c7694233..0000000000
--- a/templates/settings.test.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { expect, test } from "bun:test";
-
-import { templateSettingsPatch } from "./settings";
-
-test("builds a valid template/* settings patch", () => {
-  expect(templateSettingsPatch("code-review", ["github"])).toEqual({
-    "template/id": "code-review",
-    "template/pendingConnections": ["github"],
-  });
-});
-
-test("rejects an empty template id", () => {
-  expect(() => templateSettingsPatch("", ["github"])).toThrow(
-    /invalid template settings patch/,
-  );
-});
diff --git a/templates/settings.ts b/templates/settings.ts
deleted file mode 100644
index e438442c52..0000000000
--- a/templates/settings.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-// Re-exported from `@corbits/connections` — the `template/*` settings
-// vocabulary is generic (an arktype schema plus a builder), not
-// product-specific data, so it lives with the connections package that
-// actually consumes it (`connect-github-routes.ts`'s repo-review
-// settling). Kept here too so nothing that already imports
-// `@workbench/templates/settings` has to change.
-export {
-  TemplateReposSettingsPatch,
-  TemplateSettingsPatch,
-  templateReposSettingsPatch,
-  templateSettingsPatch,
-} from "@corbits/connections/template-settings";
diff --git a/templates/tsconfig.json b/templates/tsconfig.json
deleted file mode 100644
index 8b1da8f02c..0000000000
--- a/templates/tsconfig.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-  "extends": "../tsconfig.base.json",
-  "include": ["**/*.ts"],
-  "compilerOptions": {
-    "types": ["bun"],
-    "noEmit": true
-  }
-}
diff --git a/workflows/assistant/package.json b/workflows/assistant/package.json
index 0394902d56..084b3193f6 100644
--- a/workflows/assistant/package.json
+++ b/workflows/assistant/package.json
@@ -48,7 +48,6 @@
     "@corbits/connections": "workspace:*",
     "@corbits/connections-tools": "workspace:*",
     "@corbits/interaction-tools": "workspace:*",
-    "@workbench/templates": "workspace:*",
     "@types/bun": "catalog:",
     "typescript": "catalog:"
   }
diff --git a/workflows/assistant/src/prompt.ts b/workflows/assistant/src/prompt.ts
index ebfa1d2cd7..b739e4a5ff 100644
--- a/workflows/assistant/src/prompt.ts
+++ b/workflows/assistant/src/prompt.ts
@@ -33,7 +33,7 @@ export const ASSISTANT_TOOL_PACKAGE_PINS: readonly ToolPackagePin[] = [
   { name: "@corbits/memory-tools", version: "0.0.4" },
   { name: "@corbits/capability-tools", version: "0.0.6" },
   { name: "@corbits/agent-directory-tools", version: "0.0.6" },
-  { name: "@corbits/connections-tools", version: "0.0.9" },
+  { name: "@corbits/connections-tools", version: "0.0.10" },
   { name: "@corbits/catalog-tools", version: "0.0.6" },
   { name: "@corbits/skills-tools", version: "0.0.7" },
   { name: "@corbits/mcp-tools", version: "0.0.11" },
diff --git a/workflows/assistant/test/manager-tools-scenario.test.ts b/workflows/assistant/test/manager-tools-scenario.test.ts
index ae2ad0b8dd..2f5d2b5f1f 100644
--- a/workflows/assistant/test/manager-tools-scenario.test.ts
+++ b/workflows/assistant/test/manager-tools-scenario.test.ts
@@ -43,10 +43,8 @@ import {
 // takes one through its env, so any Interchange-backed hub can install
 // it with its own connector lineup) — this scenario plays back against
 // Workbench's actual shipped set, so it wires in the real thing.
-import {
-  CONNECTOR_REGISTRY,
-  MCP_PRESETS,
-} from "@workbench/templates/connectors";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
+import { MCP_PRESETS } from "@corbits/connections/mcp-presets";
 import {
   agentDirectoryTools,
   CREATE_AGENT_TOOL,

From a3c27d9cbf61cd1c060db29c9356a0fee4cc22eb Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Thu, 17 Sep 2026 10:24:41 -0700
Subject: [PATCH 7/8] Update docs: drop @workbench/templates mentions

Comment-only cleanup in code-review/README.md, workflows/README.md, and
chat-ui's connect-github-actions.ts left over from the templates/
deletion.

Claude-Session: https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG
---
 packages/chat-ui/src/blocks/connect-github-actions.ts | 6 +++---
 packages/code-review/README.md                        | 6 +++---
 workflows/README.md                                   | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/packages/chat-ui/src/blocks/connect-github-actions.ts b/packages/chat-ui/src/blocks/connect-github-actions.ts
index 0f81335387..ed80b38bda 100644
--- a/packages/chat-ui/src/blocks/connect-github-actions.ts
+++ b/packages/chat-ui/src/blocks/connect-github-actions.ts
@@ -40,7 +40,7 @@ export type ConnectGithubActions = {
    * `startReviewing`, `skip`) change something, re-reading
    * `getConnectState`. A credential completed elsewhere (the Plugins
    * page, another tab) settles this connector's entry on
-   * `@workbench/templates`'s `template/pendingConnections`
+   * `@corbits/connections/template-settings`'s `template/pendingConnections`
    * (CL-6463's `settleConnectedService`) and publishes `chat.settings`;
    * ChatWorkspace parses that event and calls `notifySettingsChanged`
    * so a card already mounted flips without remounting (CL-6476).
@@ -87,8 +87,8 @@ export type ConnectGithubActions = {
     { readonly ok: true } | { readonly ok: false; readonly message: string }
   >;
   /** Mints a grant and a live webhook trigger per repo id, then
-   * records the selection — `@workbench/templates`'s
-   * `startReviewingRepos`, called through the host's own binding. */
+   * records the selection through the host's own `startReviewingRepos`
+   * binding. */
   readonly startReviewing: (
     repoIds: readonly string[],
   ) => Promise<{ readonly startedTriggerCount: number }>;
diff --git a/packages/code-review/README.md b/packages/code-review/README.md
index ceac49359b..ee38141cff 100644
--- a/packages/code-review/README.md
+++ b/packages/code-review/README.md
@@ -56,9 +56,9 @@ subpaths (`@corbits/code-review/reviewers`,
 `@corbits/code-review/agent-requests`), separate from the package root.
 Both files have zero imports of their own; the root also re-exports the
 review run and GitHub client, which pull in `@corbits/github-tools` and
-`@intx/agent`'s full provider surface. `@workbench/templates`'s
-`CODE_REVIEW_TEMPLATE` (CL-6344) imports the roster through these
-subpaths for exactly that reason — see its own module doc.
+`@intx/agent`'s full provider surface. A caller installing the reviewer
+roster into an agent-directory (`codeReviewAgentRequests`) imports it
+through these subpaths for exactly that reason.
 
 ## The run
 
diff --git a/workflows/README.md b/workflows/README.md
index cc3a03845b..2203e9311e 100644
--- a/workflows/README.md
+++ b/workflows/README.md
@@ -2,8 +2,8 @@
 
 Each subdirectory is a deployable workflow package: an Interchange
 `defineWorkflow` plus a `corbits.workflow` block in its `package.json`
-(`assetName`, `displayName`, `automatable`). `@workbench/templates`'s
-`WORKFLOW_CATALOG` (`templates/catalog.ts`) reads that block straight off
+(`assetName`, `displayName`, `automatable`). `@corbits/workflows/catalog`'s
+`WORKFLOW_CATALOG` reads that block straight off
 each `package.json` at build time — via a static JSON import, not a
 runtime file read, so it stays importable from the browser bundle — and
 layers on the fields with no npm-visible home of their own (`whatItDoes`,

From e1570168628542bf9bdf37afab88483583de6dc7 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Thu, 17 Sep 2026 10:34:34 -0700
Subject: [PATCH 8/8] fix(hub): drop dead scheduler imports left over from
 rebase onto main

---
 apps/hub/src/index.ts |  3 ---
 bun.lock              | 41 +++++------------------------------------
 2 files changed, 5 insertions(+), 39 deletions(-)

diff --git a/apps/hub/src/index.ts b/apps/hub/src/index.ts
index 83d03efe59..c47c5fa904 100644
--- a/apps/hub/src/index.ts
+++ b/apps/hub/src/index.ts
@@ -78,9 +78,6 @@ import {
   isWorkbenchHostDefinitionName,
   listConnectedProviders,
   listDefaultInferencePreferences,
-  localPartOf,
-  parseParticipants,
-  postRoomMessage,
   startWorkflowCommand,
   settleConnectedService,
   createCryptoProviderCache,
diff --git a/bun.lock b/bun.lock
index f6c0eaef04..e476fe6b64 100644
--- a/bun.lock
+++ b/bun.lock
@@ -24,7 +24,6 @@
         "@intx/types": "0.3.0",
         "@types/bun": "1.3.14",
         "@typescript/native-preview": "7.0.0-dev.20260707.2",
-        "@workbench/templates": "workspace:*",
         "eslint": "^10.8.0",
         "jiti": "^2.7.0",
         "prettier": "^3.6.2",
@@ -180,7 +179,6 @@
         "@radix-ui/react-dialog": "^1.1.15",
         "@radix-ui/react-slot": "^1.2.3",
         "@tanstack/react-query": "catalog:",
-        "@workbench/templates": "workspace:*",
         "arktype": "catalog:",
         "react": "^19.2.0",
         "react-dom": "^19.2.0",
@@ -243,7 +241,6 @@
         "@intx/types": "workspace:*",
         "@intx/workflow": "workspace:*",
         "@intx/workflow-deploy": "workspace:*",
-        "@workbench/templates": "workspace:*",
         "arktype": "catalog:",
         "drizzle-orm": "catalog:",
         "hono": "catalog:",
@@ -494,10 +491,10 @@
         "@corbits/error-sink": "workspace:*",
         "@corbits/icons": "workspace:*",
         "@corbits/inference-settings": "workspace:*",
+        "@corbits/jimmy-agent": "workspace:*",
         "@corbits/presence": "workspace:*",
         "@corbits/react-ui": "github:corbitsdev/react-ui#3b122812a307ccb35be31386f7696020c5a84635",
         "@tanstack/react-query": "catalog:",
-        "@workbench/templates": "workspace:*",
         "arktype": "catalog:",
         "react": "^19.2.0",
         "react-dom": "^19.2.0",
@@ -590,6 +587,7 @@
       "version": "0.0.1",
       "dependencies": {
         "@corbits/code-review": "workspace:*",
+        "@corbits/codex-provider": "workspace:*",
         "@corbits/credential-providers": "workspace:*",
         "@corbits/error-sink": "workspace:*",
         "@corbits/github-tools": "workspace:*",
@@ -599,6 +597,7 @@
         "@corbits/mcp-tools": "workspace:*",
         "@corbits/oauth-core": "github:corbitsdev/corbits-oauth-core#v0.1.1",
         "@corbits/workflows": "workspace:*",
+        "@corbits/xai-provider": "workspace:*",
         "@intx/crypto": "0.3.0",
         "@intx/db": "workspace:*",
         "@intx/hub-api": "workspace:*",
@@ -618,7 +617,7 @@
     },
     "packages/connections-tools": {
       "name": "@corbits/connections-tools",
-      "version": "0.0.9",
+      "version": "0.0.10",
       "dependencies": {
         "@corbits/connections": "workspace:*",
         "@intx/agent": "workspace:*",
@@ -719,7 +718,6 @@
         "@intx/workflow": "workspace:*",
         "@modelcontextprotocol/sdk": "catalog:",
         "@workbench/onboarding": "workspace:*",
-        "@workbench/templates": "workspace:*",
         "arktype": "catalog:",
         "drizzle-orm": "catalog:",
         "hono": "catalog:",
@@ -1085,7 +1083,6 @@
         "@intx/hub-api": "workspace:*",
         "@intx/hub-common": "workspace:*",
         "@intx/types": "workspace:*",
-        "@workbench/templates": "workspace:*",
         "arktype": "catalog:",
         "drizzle-orm": "catalog:",
         "hono": "catalog:",
@@ -1105,7 +1102,6 @@
         "@corbits/icons": "workspace:*",
         "@corbits/react-ui": "github:corbitsdev/react-ui#3b122812a307ccb35be31386f7696020c5a84635",
         "@corbits/settings-ui": "workspace:*",
-        "@workbench/templates": "workspace:*",
         "arktype": "catalog:",
         "react": "^19.2.0",
         "react-dom": "^19.2.0",
@@ -1217,8 +1213,8 @@
         "@corbits/icons": "workspace:*",
         "@corbits/inference-settings": "workspace:*",
         "@corbits/react-ui": "github:corbitsdev/react-ui#3b122812a307ccb35be31386f7696020c5a84635",
+        "@corbits/workflows": "workspace:*",
         "@intx/types": "workspace:*",
-        "@workbench/templates": "workspace:*",
         "arktype": "catalog:",
         "react": "^19.2.0",
         "react-dom": "^19.2.0",
@@ -1422,7 +1418,6 @@
       "devDependencies": {
         "@corbits/connections": "workspace:*",
         "@types/bun": "catalog:",
-        "@workbench/templates": "workspace:*",
         "typescript": "catalog:",
       },
     },
@@ -1441,25 +1436,6 @@
         "typescript": "catalog:",
       },
     },
-    "templates": {
-      "name": "@workbench/templates",
-      "version": "0.0.1",
-      "dependencies": {
-        "@corbits/code-review": "workspace:*",
-        "@corbits/codex-provider": "workspace:*",
-        "@corbits/connections": "workspace:*",
-        "@corbits/jimmy-agent": "workspace:*",
-        "@corbits/scout-agent": "workspace:*",
-        "@corbits/workflows": "workspace:*",
-        "@corbits/xai-provider": "workspace:*",
-        "arktype": "catalog:",
-        "simple-icons": "^16.28.0",
-      },
-      "devDependencies": {
-        "@types/bun": "catalog:",
-        "typescript": "catalog:",
-      },
-    },
     "vendor/intx/agent": {
       "name": "@intx/agent",
       "version": "0.3.0",
@@ -1732,7 +1708,6 @@
         "@corbits/connections-tools": "workspace:*",
         "@corbits/interaction-tools": "workspace:*",
         "@types/bun": "catalog:",
-        "@workbench/templates": "workspace:*",
         "typescript": "catalog:",
       },
       "peerDependencies": {
@@ -2684,8 +2659,6 @@
 
     "@workbench/sidecar": ["@workbench/sidecar@workspace:apps/sidecar"],
 
-    "@workbench/templates": ["@workbench/templates@workspace:templates"],
-
     "@workbench/web": ["@workbench/web@workspace:apps/web"],
 
     "@workflow/serde": ["@workflow/serde@4.1.0-beta.2", "", {}, "sha512-8kkeoQKLDaKXefjV5dbhBj2aErfKp1Mc4pb6tj8144cF+Em5SPbyMbyLCHp+BVrFfFVCBluCtMx+jjvaFVZGww=="],
@@ -3502,8 +3475,6 @@
 
     "@babel/helper-compilation-targets/semver": ["semver@6.3.1", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA=="],
 
-    "@corbits/inbox/@corbits/mailbox": ["@corbits/mailbox@github:corbitsdev/corbits-mailbox#118a2cd", { "dependencies": { "@hono/standard-validator": "0.2.3", "@standard-community/standard-json": "0.3.5", "@standard-community/standard-openapi": "0.2.9", "arktype": "2.1.29", "hono-openapi": "1.3.1" }, "peerDependencies": { "@intx/log": "^0.2.2", "@intx/mime": "^0.2.2", "@intx/types": "^0.2.2", "drizzle-orm": "^0.45.2", "hono": "^4.12.0", "postgres": "^3.4.0" } }, "corbitsdev-corbits-mailbox-118a2cd", "sha512-jVRl6/IH34JBPVUz7mqWyBm1w7uJxvYAI27gjw7zL1dFO4L+D0E5q/8b+mpwKMNOKKlGXU6UF5pdHnY8ilYx8g=="],
-
     "@corbits/mailbox/hono-openapi": ["hono-openapi@1.3.1", "", { "peerDependencies": { "@hono/standard-validator": "^0.2.0", "@standard-community/standard-json": "^0.3.5", "@standard-community/standard-openapi": "^0.2.9", "@types/json-schema": "^7.0.15", "hono": "^4.11.2", "openapi-types": "^12.1.3" }, "optionalPeers": ["@hono/standard-validator", "hono"] }, "sha512-NLVeVkhKZ3drmQNEIPac8HX8Y54uf1hJAgIM/7MfDsaeVVmB+QILWQxx5x3R3NvRHgedcbEbOCGY2uR7WQYyMw=="],
 
     "@corbits/memory-hub/@corbits/memory": ["@corbits/memory@github:corbitsdev/corbits-memory#9e6f213", { "dependencies": { "@intx/agent": "0.2.2", "@intx/authz": "0.2.2", "@intx/hub-api": "0.2.2", "@intx/log": "0.2.2", "@intx/workflow": "0.2.2", "arktype": "^2.1.29", "drizzle-orm": "^0.45.1", "hono": "^4.9.0", "hono-openapi": "^1.3.1", "postgres": "^3.4.7" } }, "corbitsdev-corbits-memory-9e6f213", "sha512-utnM4ZT2zmslcPXYWAAqxlDNLcpGsXFiTOtj8h7+OXnhCP0Eaw8yl25+yCTyHpvt3jcdeG4h5uFsSj7ou0BZCA=="],
@@ -3582,8 +3553,6 @@
 
     "@babel/helper-compilation-targets/lru-cache/yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="],
 
-    "@corbits/inbox/@corbits/mailbox/hono-openapi": ["hono-openapi@1.3.1", "", { "peerDependencies": { "@hono/standard-validator": "^0.2.0", "@standard-community/standard-json": "^0.3.5", "@standard-community/standard-openapi": "^0.2.9", "@types/json-schema": "^7.0.15", "hono": "^4.11.2", "openapi-types": "^12.1.3" }, "optionalPeers": ["@hono/standard-validator", "hono"] }, "sha512-NLVeVkhKZ3drmQNEIPac8HX8Y54uf1hJAgIM/7MfDsaeVVmB+QILWQxx5x3R3NvRHgedcbEbOCGY2uR7WQYyMw=="],
-
     "@esbuild-kit/core-utils/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.18.20", "", { "os": "android", "cpu": "arm" }, "sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw=="],
 
     "@esbuild-kit/core-utils/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.18.20", "", { "os": "android", "cpu": "arm64" }, "sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ=="],