Seed a tenant from its own connected model, not only a hub-owned key - #287
Merged
Conversation
Connecting an Ollama/OpenAI/etc. key through Settings never re-triggers provisioning: a tenant whose only credential is one it connected itself sits with zero deployed workflows forever, because seeding has only ever run off a hub-owned ANTHROPIC_API_KEY. These tests cover the fix ahead of it: the connect route firing a seed-eligible hook once the tenant's resolved catalog is actually usable (never merely because a credential row exists), the pending-seed store round-tripping the connected instance's own base URL, and the existing-provider/no-usable-model/ non-inference-connector cases that must NOT fire it.
A hub-owned ANTHROPIC_API_KEY has never been the only valid seed source in spirit — it was just the only one anything ever triggered from. Connecting a provider through Settings (packages/connections) persisted the credential and seeded its catalog, but nothing ever told the durable pending-seed drain (bench-provisioning.ts) about it, so a self-serve tenant whose only provider is one it connected itself never got Myra or the default workflow set, and /api/onboarding/ provisioning-status polled 200 forever with no way to converge. The connect route now asks the same resolved-catalog question launch itself asks (hasUsableModel, @corbits/inference-settings, PR #280) once a credential is durably stored, and — only when that tenant now has a model with a real offering, never merely because a credential row exists — hands the connecting provider's own key to the same pendingSeedStore + benchProvisioner the onboarding credential step already feeds. That drain is idempotent and restart-safe already, so routing a Settings connect through it needed no new seeding logic, only a new trigger. Also threads a `baseURLOverride` through the pending-seed row end to end (pending-seed.ts, bench-provisioning.ts) so a url-kind connector (Ollama) deploys against the instance a person actually pointed at rather than falling back to a curated default — fixing the same latent gap in onboarding's own credential-step trigger along the way.
TheGreatAxios
force-pushed
the
cl-provision-own-model
branch
from
August 22, 2026 02:26
90fc4d6 to
608be95
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/api/onboarding/provisioning-statuspolls 200 forever and Myra never appears. Reproduced end to end on a fresh account connecting only Ollama.packages/connections/src/routes.ts's/:connectorId/completenow checkshasUsableModel(@corbits/inference-settings, the same resolved-catalog read launch itself uses) after a credential is durably stored, and — only when the tenant now actually has a usable model, never merely because a credential row exists — fires a newonInferenceCredentialUsablehook.apps/hub/src/index.tswires that hook to the samependingSeedStore+benchProvisionerdrain the onboarding credential step already feeds (idempotent, restart-safe, unchanged) — a Settings-connected provider now converges on Myra + the default workflow set exactly like an onboarding-connected one.baseURLOverridethrough the pending-seed row end to end (pending-seed.ts,bench-provisioning.ts) so a url-kind connector (Ollama) deploys against the instance a person actually pointed at rather than a curated default — this gap already existed in onboarding's own credential-step trigger; fixed there too.Why this trigger point
Connect-time is the only point in the system that already holds the plaintext credential (credential rows are write-only after storage) — the provisioning-status poll and sign-in reconcile paths can't build a
ModelSourcethemselves. Routing through the existing drain rather than seeding inline keeps the connect response fast (CL-6457) and reuses proven convergence logic instead of adding a second one.Note for review
packages/inference-settings/src/usable-model.tsis duplicated verbatim from #280 (cl-no-model-honest, still open) rather than stacking on it, to keep this independently mergeable. Expect a trivial same-content conflict on that one file whichever merges second — take either side.Linear: CL-6578
Test plan
bun run typecheckinpackages/connections,packages/onboarding,packages/inference-settings,apps/hubbun testinpackages/connections(40/40),packages/inference-settings(39/39),packages/onboardingnon-DB suites (83/83)bun run check:browser-safe-subpaths,check:licenseseslint+prettier --writeon every changed file