#717 — Hub136 main publication and selected live activation (child#1122)

Source PR2687/main 8c2dcb3a16cbd78581d783e7ae1b2e87b9d82e3b; final head 192e7843983c55f69bf692e1873be98285c4907f; tested merge a60f12171ab8506643c08f31b74d8967501f0b90 has the same full tree. Source Docker38351601576:SQLite24/PostgreSQL24 HTTP regression and8 assertion witnesses PASS. Existing session-token ownership38351601532 and ten required PASS. First CI38351164972 passed SQLite and three witnesses before the atomic mutation setup failed on an ambiguous transaction anchor. The anchor was scoped to the password-change block without weakening production guards or assertions; that run remains failure evidence.

Documented HTTP option revoke_network_tokens=true revokes only the caller’s active scope=full, network-bound named tokens without a node binding, excluding the current token. Default returns credential-free kept_network_tokens metadata; keep_cli_tokens remains independent. Password and revocations commit together. Node credentials, other users and current-session rotation preserve their existing boundaries. CLI/Dashboard controls are separate interfaces; this delivered slice is available through the documented HTTP endpoint. Production user passwords/tokens were not changed as a test.

Formal main38351821700:original source guard/build, all FOUR gates, aggregate, npm publish and registry metadata verification SUCCESS (all7jobs). Metadata version/preview136 visible, stable latest30 unchanged. Independent npm tarball GET returned404 for bare, cache-bypass and encoded URLs at2026-10-13T05:43Z. Preserve that distribution gap in#1123; formal metadata success is not a full npm-byte or installability proof. No staged version is republished.

Reuse the SAME main-gated tarball through the repository’s existing GitHub package distribution pattern. Verify current main ancestry, original authenticated build log/full four gates and exact tag commit BEFORE publication. Tag commhub-server-v0.9.0-preview.136 points to source main 8c2dcb3a16cbd78581d783e7ae1b2e87b9d82e3b; anonymous public download https://github.com/sleep2agi/agent-network/releases/download/commhub-server-v0.9.0-preview.136/sleep2agi-commhub-server-0.9.0-preview.136.tgz equals the original gated tarball byte-for-byte. 1250495 bytes; SHA256 47449d1e6163e4ec7595d3124676ad655845ead7e22d0184777c2dade3dd7e81; sha512-7/tIzkKcoCNKuRnk4P3RlHGt2hy2FRcJftIMDwahw+8t7qEHsvAzyA0PdvXphAACG0oun6qUsuIUy7GpnT7tyQ==. GitHub public package verification, rather than a fabricated npm download, authorizes the managed install.

Prepared profile PR2688/main b51ae1574be397ca618fe2e32eacec164774cf94 passed Docker38352390600/ten required. Download-source PR2690/main 1a5b1a69e07902eef489342ca573fd7851889a55 passed Docker38353109811/ten required. Only the package resolved URL changed to the verified GitHub asset; version/integrity and every transitive entry stayed unchanged. Runtime $HOME/.commhub/runtime-v119-preview136 installs348 package files identical to the public package. Private owner-only consistent VACUUM INTO backup $HOME/.commhub/backups/password717-p136-xsa_nf75/hub-before.db: 745984000 bytes, integrity ok, snapshot counts {"sessions": 331, "tasks": 81752, "nodes": 302, "networks": 7, "requirements": 1123, "api_tokens": 641, "user_inbox": 2733}. Read-only/network-none Docker offline schema preflight with actual Bun1.4.0 PASS; counts preserved. No live DB/credentials/HTTP entrypoint mounted in the probe. Counts describe the snapshot, not a permanent live invariant.

Confirmed 2026-10-13T05:52:53.308633+00:00:only selected commhub-hub PID650734→712535, restart93→94, secured136, actual entry $HOME/.commhub/runtime-v119-preview136/node_modules/@sleep2agi/commhub-server/bin/commhub.ts. Installed profile equals the exact deployment main, original base and environment-file metadata unchanged, no --update-env. Retain $HOME/.commhub/runtime-v118-preview135 for rollback. Business node runtime/thread/model/provider/login settings remain unchanged.

Bounded natural observation 2026-10-13T05:56:14.066146+00:00:same PID/restart, fresh heartbeat110, SSE127, events [{"event_type": "task.replied", "to_status": "replied", "n": 6}, {"event_type": "task.send.delivered", "to_status": "delivered", "n": 3}, {"event_type": "task.started", "to_status": "running", "n": 1}, {"event_type": "task.warning.delivered_stale_30s", "to_status": "delivered", "n": 2}, {"event_type": "task.warning.delivered_stale_60s", "to_status": "delivered", "n": 3}], selected new vault-key/panic/segfault markers0. Earlier five-minute baseline retained above in the local evidence. Windows differ and warning counters remain explicit. This does not establish whole-fleet model execution, long-term stability or complete key recovery.

Recovery authority:deploy/hub/README.md and versioned base/profile/managed lock record startup, ports/proxy, safe environment source, version verification, rollback and private data boundaries. Git reproduces software and inputs; original-value keys and production data require their existing private sources. Complete key recovery remains NOT_COVERED.

Activity rollout remains separate:#1117 CLI173 formal38347806170 registry verification timed out900seconds; npm still404 this round. Official CLI gated download38353145085 reuses its original main064ed34c9eba20f852a32dbe42b98389c3c2ce63/four-gate artifact, expected SHA2565e3a8464afbe06cada0039adce494e2564af73b266a0bfc555db30ce203b4029; Docker contract and publish both SUCCESS; exact tag/main and anonymous public download https://github.com/sleep2agi/agent-network/releases/download/cli-v2.3.0-preview.173/sleep2agi-agent-network-2.3.0-preview.173.tgz verified against the original gated artifact: 2128643 bytes, sha512-YllZd4/6SOLSw6boHKYIOusRUft2Q6t3sheDE1mgkbmBRyh47jywSk3SxJ8p/OEbyjED0YYksBX+Ek35ERdyHw==. This is a usable alternate public entry; it does not republish npm or convert the timed-out original formal run into success. Selected original communication node remains CLI153/Node121, PID384770/384817 and CWD $HOME/comm-niu. W1 restart_only reuses the current supervisor command, so it does not prove139 adoption. Preserve identity/login/model/original vendor thread on a selected normal upgrade; #1113/#1105 remain doing2/3 until actual original-turn139 activity canary passes.

Late npm verification2026-10-13T06:03:47–48Z:Hub136 and CLI173 version metadata, preview tags and complete registry tarballs are now public. Both match their original exact-main gated and GitHub artifacts byte-for-byte, SHA1/SHA256/SRI verified; stable latest30/76 unchanged. Hub136 SHA25647449d1e6163e4ec7595d3124676ad655845ead7e22d0184777c2dade3dd7e81; CLI173 SHA2565e3a8464afbe06cada0039adce494e2564af73b266a0bfc555db30ce203b4029. Original CLI run38347806170 remains FAILURE due its earlier900-second timeout; this is later read-only verification, not a rewritten verdict or repeated npm publish. Npm distribution gap#1123 can close and#1117 publication can close after this Git fact lands. Keep the existing GitHub managed lock and Hub136 activation; original production Node139 activity canary remains OPEN.
