fix: reconcile Visual Hive App assignment and deployment startup

[DavidDiaz0317]

The Visual Hive token broker on dd predates per-Hive secondary-App assignment. The newer generic secondary delivery could send the optional App's private key to a spoke, violating #4059's Hub-held key boundary.

This patch uses the operator-owned SecondaryAppID and existing cluster/App key store for sealed, repository-scoped execution leases. Registered Viz Apps and a custom configured Visual Hive App are excluded from PEM delivery, even for dormant/old spokes. Missing assignment/key stays dormant; provisioning activates without restart; explicit Hub denial clears even an unexpired spoke token. The primary Hive App and lifecycle ownership are preserved. Existing lease/pin schemas and matching explicitly assigned legacy key configuration remain readable.

It also recognizes the packaged Codex 0.146.0 banner and its bounded temporary-home warning for the exact initial prompt echo. The warning itself, subsequent secret output, near matches and unknown versions remain scanned. Previously, the image shipped 0.146.0 while this output boundary recognized only 0.144.1.

Qualification also caught two deployment regressions: the fork-only integrated release workflow referenced removed v2/ paths, and fresh-volume startup normalized only /data/home while leaving shared CLI parents potentially root-owned. The workflow now references actual src/ inputs with a checkout-existence test. Startup restores the already required ownership/group-write initialization. Executing the actual initialization directives in a disposable Linux tree reproduced three denied runtime-UID writes before and zero after the fix. Existing deployment guards remain intact.

Validation on final source 36ab4fb433644eae8e288db16ee43df97ff95094: Linux build, full go test ./..., go vet ./..., relevant Hub/repair/entrypoint race tests, actionlint, eight selected entrypoint/deployment guards, and host Compose validation passed. The immutable source archive ran in check image sha256:234651198ebbc5a6b84b4a8e0acc138d278202bbfa6800444128bc9f26bb3c38 (named UID/GID 1000, six CPUs, 6 GiB, disposable HOME/GOPATH and writable package-local temporary directories; Node, tmux and Python YAML installed). Earlier harness failures are retained in local receipts; no test was disabled or relaxed. Native Codex 0.146.0 offline health passed separately with no network and synthetic auth; executable private temporary storage is required. This is not live model/App or hosted qualification.

Upstream fork CI needs maintainer approval: https://github.com/hivecommons/hive/actions/runs/34909078735 reports action_required, along with related lanes. DCO/PR verification passed; they do not substitute for upstream tests. Approval was requested in the integration tracker.

Migration, rollback and remaining gates: src/docs/visual-hive-qualification-20260914.md. Before rollback to a build that delivers Viz PEMs, clear the secondary assignment and disable the optional spoke feature. No autonomous merges or fleet rollout.

Draft / not merge-ready: dependent Visual Hive release PR DavidDiaz0317/visual-hive#13 must be accepted before updating both immutable VISUAL_HIVE_REF defaults (Dockerfile and integrated release workflow) and rebuilding/revalidating final artifacts. Existing pins are deliberately retained. The Luna benchmark is being revised to use current Hive production behavior, with protocol freeze required before any spending. Native hard token-cap enforcement, 50 task admissions and paired evaluation remain incomplete; no new paid invocation has occurred and no efficacy claim is made.

Free source-context preflight prepared control prompts for all 50 authored defective trees, using the unchanged production collector/prompt helpers, authored issue/path policies and no model tools. Prompt sizes were 112,395–526,535 UTF-8 bytes (median 291,918); these are not API token measurements. Complete native request sizing is another prerequisite for the agreed 32K-input/2K-output limit. This diagnostic admits zero tasks and supplies no repair-success result. New paid spending remains $0.

Maintainer prerequisites are requested at #4030 (comment): fork-CI approval, an agreed owner/name for a newly created disposable qualification repository, real selected-repo App installs/grants, a newly provisioned isolated Hive deployment and runtime configuration, secure Hub assignment/provisioning/access, dd promotion route and production-model hosted test. No current canary exists; August repository references and receipts are historical only. A real entrypoint/Hub/dashboard/controller canary lifecycle run is required before the label “locally qualified for hosted testing”; hosted qualification follows the dd merge.

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment