Requirement #689: source, formal release and selected live Hub activation verified.

Software main 7f12230b7eb064aa56131bbc17fc21c944f9a6d0, source PR2668.
Source head6b7c48072ee2129d69228458754862fcf860a1bf; tested PR merge b3f08a93ed12363ebc9cb8f73472ce9b35421ae8 has the same tree as head and software main. Exact candidate core CI38325758372 passed SQLite36 + PostgreSQL36, all10 required checks passed. Initial central QA trigger omission was corrected before merge; source report retains that history. Denied-operation assertions cover issuance/identity fields, not routine authentication last-used telemetry.

Formal main release38326074270: build, four gates, preview publish, registry and aggregate verdict all SUCCESS. Anonymous public tgz bytes1237375, SHA25691fde58a1c8411a1e4d242faa55fea19fb7a9fa844aaa070c3075bdc98976f80, exactly equals formal gated artifact. Full SHA512/npm URL are pinned in provider906/package-lock.json. latest remainspreview.30; preview is130. Registry gitHead is absent; provenance is established by the formal main workflow and whole-package/source byte comparison.

Deployment main d8537c633dc3573419c1bd1d8b28ea5c394212c1, PR2669/headc591615c5ca278b296fce333e362496b4145133f. Profile Docker CI38326464204 and10 required checks passed. Both software and deployment SHA were verified as current main ancestors; deployment merge tree equals reviewed head. Transitive lock records unchanged, no DB/schema/adapter/dependency changes from129.

Consistent private SQLite backup at2026-10-13T00:13:54Z: integrityok, sessions331/tasks81264. Mode700 backup directory and600 database; old129 profile/base/runtime retained. No backup or credentials uploaded to CI. Docker offline published-package preflight used actual Bun1.4.0, readonly offline backup/tarballs and networknone: integrity and all counts preserved (nodes302/networks7/requirements1101/api_tokens640/user_inbox2646). Provider snapshots11 and writes/applications/logins/configs/bindings0 preserved. This is schema-only, not a production authentication/model/DR test.

Inactive sibling installed via npm ci --ignore-scripts --no-audit --no-fund. All344 package files equal the public artifact; key source files match software main; root manifests/locks equal main deployment inputs. Only the profile from merged main was atomically installed; base launcher and owner-only hub.env values were not changed/read. No --update-env or business-node restart.

Activation requested2026-10-13T00:21:23.030844Z (08:21:23+08). Actual PID459109, parentPM2 1613, Bun1.4.0, real entry runtime-v113-preview130/node_modules/@sleep2agi/commhub-server/bin/commhub.ts. Health130/secured,331 sessions; PM2 restarts87→88 from the manual restart and remained stable. Public/installed package, actual runtime and main profile were verified separately. Own get_inbox succeeded without acknowledging any real message or minting production tokens.

Live observation and final task closure evidence are appended below. No claim of fleet-wide ACK, long-term stability, retrospective credential revocation, actual model/provider access, node-key metadata acceptance or full disaster recovery. Recovery/start/proxy/secret/data/rollback boundaries: deploy/hub/README.md; rollback selects retained runtime-v112-preview129 and profile, without replacing current data blindly.

Final observation 2026-10-13T00:23:55.095596+00:00: PID459109 / restarts88 unchanged, SSE120, fresh heartbeats110; natural events [{"event_type": "task.replied", "to_status": "replied", "n": 4}, {"event_type": "task.send.delivered", "to_status": "delivered", "n": 3}, {"event_type": "task.started", "to_status": "running", "n": 3}, {"event_type": "task.warning.delivered_stale_30s", "to_status": "delivered", "n": 2}, {"event_type": "task.warning.delivered_stale_60s", "to_status": "delivered", "n": 1}]. New vault/panic/segfault errors0. Requirement closed4/4 after these checks. No independent fleet ACK assertion is made.
