Stream 2: Hub integration (konveyor/tackle2-hub)

## Milestone reconciliation (2026-09-16)

This is now the single Hub integration tracker, consolidating the high-level Stream 2 tracker #6. Its original #18–#21 subtasks remain represented here: API type import, resource handlers, run creation, and ACP proxy. #6 is retired; remaining work is tracked here rather than in parallel umbrellas.

Implemented in konveyor/tackle2-hub#1119: CRD imports, resource CRUD, AgentRun/AgentWorkflowRun creation with scoped token minting and env injection, and authenticated ACP WebSocket proxy. API contract updates followed in konveyor/tackle2-hub#1129; run deletion endpoints landed in konveyor/tackle2-hub#1131. The injected application variable is `APP_ID`, not `HUB_APP_ID`; the resource formerly named LLMProvider is now Gateway.

Remaining acceptance work:
- [ ] Resolve the cancel-handler contract: the current Hub API has deletion and ACP transport, but no handler that revokes the token and sets `spec.cancel`. Coordinate with #65; deletion and ACP session cancellation do not fulfill that contract.
- [ ] Verify the original single-writer acceptance requirement end to end across Hub and the harness ACP tee.

Token cleanup after abnormal termination/deletion is separately tracked in #139. The original design and route table below are historical context, not a statement that every listed route exists today. Release scope for the remaining work is still to be decided.

---

Tracking issue for Hub integration work per ADR 0006. Implementation lives in `konveyor/tackle2-hub`.

## Design

Hub follows the established addon pattern (ADR 0006):
- **CRUD endpoints** under `/hub/agent/*` for all agent CRDs via controller-runtime client
- **Fire-and-forget creation** — Hub mints a scoped token, injects `HUB_BASE_URL`, `HUB_APP_ID`, and the token Secret into the CR env/envFrom, creates the CR, walks away
- **Request-driven reads** — `client.Get()` on demand, no informers
- **Cancel handler** — revokes token, sets `spec.cancel` on the CR
- **ACP WebSocket proxy** — separate deliverable; Hub reads ACP key from `status.secretKeyRef`, injects `X-Secret-Key`, proxies to pod:4000/acp; single-writer enforcement required
- **`konveyor.io/managed=true` filtering** on Agent and AgentWorkflow list only

## Route table

| Endpoint | CRD | Operations |
|---|---|---|
| `/hub/agent/agents` | Agent | List, Get, Create, Update, Delete |
| `/hub/agent/skills` | SkillCard | List, Get, Create, Update, Delete |
| `/hub/agent/skillcollections` | SkillCollection | List, Get, Create, Update, Delete |
| `/hub/agent/providers` | LLMProvider | List, Get, Create, Update, Delete |
| `/hub/agent/runs` | AgentRun | List, Get, Create, Cancel |
| `/hub/agent/workflows` | AgentWorkflow | List, Get, Create, Update, Delete |
| `/hub/agent/workflowruns` | AgentWorkflowRun | List, Get, Create, Cancel |
| `/hub/agent/runs/:name/acp` | — | WebSocket proxy to pod ACP endpoint |

## Tasks

- [x] Import CRD types (`konveyor/agentic-controller/api/v1alpha1`)
- [x] CRUD handlers for all agent resources
- [x] AgentRun/AgentWorkflowRun creation with token minting + env injection
- [ ] Cancel handler (token revocation + spec.cancel)
- [x] ACP WebSocket proxy (separate deliverable)
- [x] Token minting endpoint / mechanism for harness auth

## Hub-side progress

Jeff has started foundational work:
- tackle2-hub PR #1107: Refactor shared SCM for use outside of addons
- tackle2-hub PR #1105: Add service accounts

## Supersedes

- ~~#18~~ — Import CRD types (closed, superseded by redesign)
- ~~#19~~ — Curated REST handlers (closed, superseded by redesign)
- ~~#20~~ — AgentRun smart creation (closed, superseded by redesign)
- ~~#21~~ — ACP WebSocket proxy (closed, superseded by redesign)
- #6 — Original Stream 2 tracking issue

## References

- ADR 0006: Hub addon pattern for agent resources
- Enhancement: [konveyor/enhancements#295](https://github.com/konveyor/enhancements/pull/295)
- Ian's contract proposal: #22 (comment)

Start in konveyor/tackle2-hub and compare the current deletion and ACP transport behavior with the cancel-handler contract described here. Coordinate with #65, then verify the single-writer requirement end to end across Hub and the harness ACP tee. Done means the remaining acceptance checks are satisfied; token cleanup in #139 is separate.

Written by the indexing model from the issue text.