#688 Hub129 release and deployment preparation

Software main: 45a7cff26b389bc9e09301bf1729922d9a6ae052 (PR2665).
Formal release run38322287810: build, four gates, preview publication and
registry verification all SUCCESS. npm latest not promoted.
Anonymous public tarball equals the exact-main gated artifact:
1234902 bytes / SHA256
0dc85276a093caf33f55431969d3cc680c0519a8624cdf34c23447d919fa558c.
SHA512 integrity and actual npm URL recorded in provider906/package-lock.json.
Published tools.ts/inbox-caller.ts/scoped-secrets.ts match software main bytes.

Source acceptance: final PR2664 head Actions 30 SQLite + 30 PostgreSQL HTTP,
44 task ACK/write-scope cases and one unchanged metadata ceiling passed;
Hub Provider core and ten required protection checks passed. Broad optional
CI is separate; no assertion that every optional workflow passed.

Production preparation 2026-10-13: current128/PID4014410/PM2 restarts86;
shared base launcher equals Git, PM2 has no runtime/base override. hub.env mode
600 checked by metadata only; no values read or output. Old profile/base and
new consistent SQLite snapshot preserved in owner-only backup storage.
Snapshot739282944B, integrity ok; sessions330/tasks81170. Private new sibling
runtime-v112-preview129 installed100 packages via exact npm ci/ignore-scripts;
old running runtime-v111-preview128 retained. No global package changes.

Offline Docker preflight PASS with actual Bun1.4.0 and the public package:
both integrity checks passed; seven primary tables and six Provider tables
preserved their row counts. Mounts were only offline backup, public tarballs
and the Bun executable, all read-only; network none. No live DB/hub.env/token
mounted, no service/network/model/authentication probe. Build/run <2 minutes.
The existing preflight accepts an explicit version/integrity for this package,
retaining the old126 defaults and all preservation assertions.

Current stage: deployment profile and launcher fixture select112/129 with
explicit111/128 rollback. Actions profile check and normal main merge pending.
Production not yet activated; installed sibling alone is not runtime evidence.
Activation must use main Git profile, atomic install, exact byte comparison,
only pm2 restart commhub-hub (no --update-env), live PID/package/health,
natural heartbeat and appended-error observations. On failure restore the
saved128 profile and only restart Hub; keep both runtimes and original DB.
No schema/dependencies, ports/proxy, vault key, business-node or account changes.
Git does not contain live data, keys, accounts or unconfirmed secret requests.

Actual activation — 2026-10-13 07:42:03+08

PR2666 head1892574a330dd11d1c1330433d494691362eb85b passed ten required
checks and profile Docker38323128765; normal SHA-lock squash merged main
b7993870774ee3477812f16bea74400549f412a2 at07:40:56+08, no bypass/rule
changes. Software main45a7cff26 and deployment mainb79938707 both verified
ancestors before deployment; profile merge tree equals reviewed head.

Installed the exact Gitmain profile atomically, mode700/cmp equal; existing
base equals Git, runtime package/lock equal Git inputs, public/installed343
files equal. Only pm2 restart commhub-hub, no --update-env. Real PID4014410
->427293, parent PM21613, unchanged Bun1.4.0 executable, entry112/129.
health129/secured/330 sessions, SSE118 at07:42:16 and120 at07:44:38;
115 natural heartbeats after activation. PM2 restarts86->87 reflects exactly
this operation, no additional restart observed. hub.env inode/size/mtime
unchanged; values never read. Same stdout/stderr inodes; appended windows
contain129 entry marker and zero vault_master_key_missing/panic/segfault.

Readonly real MCP via this node's existing identity: own get_inbox succeeds;
nonexistent verification alias get_inbox/ack_inbox reject with
inbox_identity_mismatch, no real message/other recipient accessed or ACKed.
The verification alias is absent from sessions. Observed natural task events
since activation:3 delivered,2 started; independent task.ack and terminal
events not observed, not labeled PASS. No model/OAuth, all-runtime, long-term
stability or disaster-recovery assertion. Original128 rollback remains ready.

#688 closed4/4 in CommHub. #1075 independently stays4/5: two natural node
heartbeats persisted node_secrets_capable=1, but actual authorized-user
target names-only metadata readback not executed. No borrowed user token,
real key mutation, business-node restart or automatic pending-write replay.
