[TheGreatAxios]

Agent tool packages now address stock Interchange tenant routes with the workflow run's own bearer credential, instead of Workbench-specific /api/workflow-* mirrors. CL-8159.

How the run bearer reaches a stock route

Two pieces, both Workbench-owned — no vendored file changed.

Addressing. The hub's signed deploy frame is a HarnessConfig carrying tenantId and principalId. The sidecar now threads both into the workflow child's substrate config as WORKFLOW_TENANT_ID / WORKFLOW_PRINCIPAL_ID (arktype-validated, required, no fallback) and exposes them on the step env beside the existing definitionId, so a tool package can fill the :tenantId segment every stock tenant route carries. The on-disk deployment record carries the pair too, at schema version 2, so a boot-time restore reseeds it; a version-1 record fails the parse and is redeployed rather than restored into a child whose tools cannot name their tenant.

Authorization. @intx/hub-api already resolves a sidecar bearer plus run address into principal + tenant (workflow-run-deploy-auth), but mounts it only on /api/tenants/:tenantId/workflows/deployments. apps/hub now wraps the built app and mounts that same middleware on /api/tenants/:tenantId/*, ahead of the stock resolveTenant — an outer wrap because createApp() has already registered its own middleware by the time it returns. A request with no bearer credential is untouched; the :tenantId segment is never trusted, since the middleware sets the tenant from the authenticated run alone.

Mapping

Tool	Was	Now
list_principals	GET /api/workflow-access/principals	GET /api/tenants/:t/principals, all pages
list_grants	GET /api/workflow-access/grants	GET /api/tenants/:t/grants, all pages
grant_access	POST /api/workflow-access/grants (multi-action)	ceiling check, then one POST /api/tenants/:t/grants per action
revoke_access	DELETE /api/workflow-access/grants/:id	GET the grant, ceiling check, DELETE /api/tenants/:t/grants/:id
list_connections	GET /api/workflow-connections/connections	GET /api/tenants/:t/providers + /credentials, paired with the build's own connector registry
request_connection	in-process + the same listing	in-process; the connected check uses the stock listing

The delegation ceiling stock POST /grants does not have moves into the tool: it reads the caller's own grants in the caller's own tenant and evaluates each requested resource/action pair with @intx/authz's own evaluateGrants, refusing anything outside the caller's reach before any write. Grants are not inherited across the tenant ancestor tree, so a parent tenant's grant is never read as authority in a child. Credentials and providers are read through the stock routes as-is, with no own-tenant filter added.

Dropped

• mcp_list_servers is not dropped, but list_connections no longer reports MCP-connected servers. MCP servers are not a stock Interchange concept, so /api/workflow-connections survives only as the mcp:<slug> registry @corbits/mcp-tools resolves a server URL through — GET /connections is deleted. Deleting the whole mount would have broken every @corbits/mcp-tools operation, not just the listing. CL-8164 retires it with the rest of MCP server configuration. A curated preset is still offered as a card and counts as connected when a credential exists under its own id.
• @corbits/access-tools no longer exports ./routes; packages/access-tools/src/routes.ts and its two test suites are deleted, as is the ConnectionSummary export from @corbits/connections.

Not in this PR

Two of the four mounts need work that does not fit a route swap, each filed as its own issue under CL-8155:

• CL-8170 — catalog-tools. createWorkflowCatalogRoutes resolves a model chain per request from ResolvedOffering rows, modelPricing rows, and the bench model policy. Stock /offerings returns a different shape, there is no stock pricing route, and the bench model policy (the overCeiling flag) has no stock route at all. That last one needs a ruling: a route, or an accepted loss.
• CL-8171 — workflow-authoring-tools. deploy maps cleanly onto stock POST /workflows/deployments and is ready to do, but readSource / author / republish read and write git trees whose only stock equivalent is git smart-HTTP on the asset repo, which the sandbox would have to speak. Deleting the mount before that works would delete three operations outright, so both halves land together.

Upstream asks

• Server-side grant ceiling (recorded on CL-7575). Two fidelity gaps against the tool-side check: role-derived grants are invisible to the stock principal-filtered listing, and the read-then-write is not atomic.
• Ancestor-aware credential listing. Stock GET /providers includes ancestor tenants; stock GET /credentials does not, so a credential held only by a parent tenant reads as not connected.

https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG

[linear-code]

CL-8159