[TheGreatAxios]

Summary

Owner ruling (less-is-more): apps/hub/src is deleted down to index.ts +
config.ts, except mailbox-persist.ts (chat-domain, consumed outside
packages/chat too — left for CL-8175) and the two files owned by a
concurrent sweep (native-workflow-routine-launch.ts,
inbox-unsnooze-sweep.ts — already merged out from under this branch by
the time it rebased).

Deleted outright (dead or redundant with stock):

• mcp-credential-bindings.ts — no importer anywhere.
• pinned-package-credential-bindings.ts (+test) — never wired into
  index.ts; chat has its own separate copy.
• grant-conditions.ts — identical to mountHubRoutes's own stock
  default when no conditionRegistry is supplied; index.ts now builds
  the same literal locally instead of importing it.

Deleted, capability regression (see Upstream asks):
hub-error-handler.ts, in-flight-requests.ts + shutdown.ts (shutdown
is now an immediate server.stop(true) + hub.close() + exit, no drain
window), sign-in-rate-limit.ts (sign-in reverts to better-auth's own
IP-keyed limit), launch-caches.ts (perf only), tool-grants.ts
(pinned-package tool grants stubbed to none), turn-part-content-default.ts,
turn-text-snapshot.ts (optional chat port, unwired), mail-redelivery.ts,
credential-material-refresh.ts, grant-allowance.ts,
workflow-run-tenant-auth.ts (withWorkflowRunTenantAuth's tenant-subtree
bearer widening is gone; createWorkflowRunAuthenticator itself is kept,
inlined into index.ts, since stock hub-api's own workflowRunAuthenticator
deploy-mount option and several Corbits packages take this shape directly).

Kept, folded into config.ts: hub-data-dir-git-safety.ts's
assertHubDataDirGitSafety — hub boot would otherwise corrupt this very
work tree (AGENTS.md's documented HUB_DATA_DIR hazard). Called from
createHub() at boot, not from readHubConfig, so tests parsing a config
never trip real filesystem/git IO.

scripts/evals-run.ts's own AssetService construction (previously
routed through apps/hub/src/asset-service-factory.ts) moves to
packages/evals as createEvalAssetService, since @intx/hub-sessions
isn't a resolvable dependency from root-level scripts.

Upstream asks

• No app-level onError hook in @intx/hub-api's createApp/mountHubRoutes.
• No bounded-drain shutdown helper (in-flight tracking + timeout + reported
  cause) in @intx/hub-api or @intx/hub-sessions.
• better-auth's sign-in rate limit has no account-keyed extension point
  (customRules only overrides window/max per path, never the key), so it
  stays IP-keyed and forgeable on a private network.
• No SHA-keyed read cache for the launch path in @intx/hub-sessions (perf only).
• No stock capability walk from a launch's pinned tool packages to tool:
  grants (only inline tool factories get one).
• turn_part.content has no guaranteed DB-level default on every deployment.
• No stock mail-redelivery-after-wake retry for sidecar-router undelivered mail.
• No stock serving-time oauth_token refresh ahead of outbound mail.
• No stock auto-approve gate for a parked signal correlation whose resource
  a standing grant already covers.
• Stock hub-api only bearer-authenticates the single /workflows/deployments
  mount; nothing lets a workflow-run agent reach any other tenant route
  without a session.

Deleted tests (hard cutover, behavior removed with the code)

• apps/hub/src/*.test.ts for every deleted file that had one:
  asset-service-factory, credential-material-refresh,
  hub-data-dir-git-safety, hub-error-handler, in-flight-requests,
  launch-caches, pinned-package-credential-bindings, shutdown,
  sign-in-rate-limit, tool-grants, turn-part-content-default,
  turn-text-snapshot.
• apps/hub/src/hub-zero-t4-registry.test.ts — asserted
  pinned-package-credential-bindings.ts stayed free of a legacy import;
  the file is gone.
• apps/hub/test/mail-redelivery.test.ts, shutdown-drain.test.ts — test
  modules that no longer exist.
• apps/hub/test/git-fixture.ts — shared fixture whose only two consumers
  are both gone.
• apps/hub/test/composition.test.ts's "sign-in rate limiting is keyed on
  the target account" describe block — asserted the deleted account-keyed
  limiter's behavior end to end.
• apps/hub/test/config.test.ts's two signInRateLimit-specific
  assertions.

report-error-baseline.txt regenerated (stale entries for deleted files
removed; 0 new findings).

Remaining in apps/hub/src beyond index.ts/config.ts

mailbox-persist.ts (chat-domain, also consumed by chat-ui and
agent-directory — left for CL-8175), native-connector-registry.ts,
native-workflow-routine-launch.ts, inbox-unsnooze-sweep.ts (owned by a
concurrent sweep — appears already removed on main as of this rebase),
notify-delivery.ts, and their tests — none of these were in this
sweep's target file list. server.ts was not split out: hub boot still
lives in index.ts's own if (import.meta.main) block.

Test plan

• bun run typecheck
• bun run fmt:check / bun run lint
• bun run check:structural (report-error baseline regenerated)
• bun --cwd apps/hub test — non-DB-gated suites pass (66 pass, 0 fail)
• DB-gated hub suites (composition, boot-does-not-seed,
  chat-mount, mailbox-persist, relaunch-sweep-close,
  notify-delivery) could not be verified locally: the shared local
  Postgres is saturated by other concurrently-running agents
  ("sorry, too many clients already"). CI provisions its own Postgres
  and should be unaffected — flagging for the reviewer to confirm CI
  is green on this PR.

[linear-code]

CL-8185