Kill hub boot default-tenant ensure

README.md

@@ -69,14 +69,14 @@ value at once), verifies the database in `DATABASE_URL` is reachable and
 actually speaks Postgres, applies any pending platform migrations, builds
 the web UI if it has not been built yet, and starts the hub. The hub
 provisions authenticated sidecars on demand using the configured backend.
-Every required setting lives in `.env.example` with its expected shape, and the administrator account (`HUB_ADMIN_EMAIL` / `HUB_ADMIN_PASSWORD`,
-defaulting to alice@example.com / password123 when unset)
-is seeded so you can sign in immediately.
-
-`bun run dev` seeds that administrator account and ensures the root
-tenant so you can sign in. An empty database is a valid hub: boot does
-not insert agents, tools, workflows, or skills. Product state arrives
-through onboarding and explicit seed callers, not production boot.
+Every required setting lives in `.env.example` with its expected shape.
+`bun run dev` may sign up the local administrator (`HUB_ADMIN_EMAIL` /
+`HUB_ADMIN_PASSWORD`, defaulting to alice@example.com / password123
+when unset) through the same auth HTTP API the UI uses. Hub boot itself
+inserts no users or tenants. An empty database is a valid hub: boot
+does not insert agents, tools, workflows, or skills. Product state
+arrives through onboarding and explicit seed callers, not production
+boot.
 `ANTHROPIC_API_KEY` is the one optional line worth setting before boot —
 with it, the env-key auto-plant puts a real credential on the operator
 bench so the catalog is launchable; without it, inference waits until
@@ -112,10 +112,11 @@ bun run reset
 `bun run reset` drops the platform database schema and removes the hub's
 on-disk asset directory (which also holds provisioned sidecar state).
 Nothing is recreated until the next `bun run dev` — that recreates the
-schema and, once the hub is serving again, ensures the administrator
-account and root tenant so you can sign in. It does not insert agents,
-tools, workflows, or skills. Product state arrives through onboarding
-and explicit seed callers.
+schema. Hub boot itself inserts no users or tenants. Local `bun run
+dev` may then sign up the administrator through the same auth HTTP API
+the UI uses, so you can sign in. It does not insert agents, tools,
+workflows, or skills. Product state arrives through onboarding and
+explicit seed callers.
 
 It refuses to run against anything but a local `DATABASE_URL` (localhost,
 127.0.0.1, or `::1`) — there is no override, since the schema drop is

apps/hub/src/config.ts

@@ -374,10 +374,6 @@ export type HubConfig = {
    * see `ROUTINE_SCHEDULER_POLL_INTERVAL_MS` above. Unset runs the real
    * production cadence (`routine-scheduler.ts`'s own default). */
   readonly routineSchedulerPollIntervalMs?: number;
-  /** Test-only seam to skip the boot-time `ensureDefaultTenant` call so
-   * a suite can exercise the true empty-hub first-signup path (CL-7578).
-   * Never set by `readHubConfig` and never set for a real deployment. */
-  readonly skipEnsureDefaultTenant?: boolean;
   /** Every sidecar-allocation backend registered for exclusive placement,
    * one or more, each addressable by its provisioner id. Never empty: an
    * install that configures nothing registers the `process` backend, so
@@ -623,7 +619,7 @@ export function readHubConfig(
 ): HubConfig {
   if (env.OPERATOR_TENANT_ID !== undefined) {
     throw new Error(
-      "OPERATOR_TENANT_ID is no longer read: the hub ensures the root tenant by slug at boot. " +
+      "OPERATOR_TENANT_ID is no longer read: first signup mints the root tenant by slug. " +
         "Set WORKBENCH_DEFAULT_TENANT to your existing root tenant's slug " +
         '(or remove OPERATOR_TENANT_ID to keep the default slug "workbench"), then restart.',
     );
@@ -650,7 +646,7 @@ export function readHubConfig(
           .map((d) => d.trim())
           .filter((d) => d.length > 0);
 
-  // One deployment fact shared by boot parenting, setup/seed, and the
+  // One deployment fact shared by first-signup genesis, setup/seed, and the
   // env-key auto-plant. WORKBENCH_DEFAULT_TENANT wins; ORG_SLUG is the
   // alias when that is unset.
   const defaultTenantSlug =