feat(hub): publish Projects, Branches and Forks to a Hub with gf publish

[DecisionNerd]

Summary

Provider-neutral Hub publishing and gf publish (#1749).

• Wire contract (graphforge-hub-publish, ADR 0053, docs/reference/hub-publish/v1/ schemas + conformance corpus): capabilities document, publish sessions, resumable data-plane uploads (PUT with Content-Range, HEAD offset), atomic commit (replay check → every object verified → manifest validated → expected-revision precondition → ref advance → receipt), operation lookup for retries, RFC 8628 device flow, stable error codes (auth_denied, entitlement_denied, GF_IDEMPOTENCY_CONFLICT, ref_conflict, unsupported_future, integrity_failure, invalid_input).
• ReferenceHub: in-memory reference implementation of the full publish and read mapping, used by the conformance corpus and the CLI tests.
• gf publish <owner/repo> (--ref <branch> | --version-uuid <uuid>) [--fork-of <owner/repo>] [--operation-uuid <uuid>]: derives the Project package, research Version package, summary, ontology modules and registry-derived lineage client-side with the existing exporter and the same derivation as the Hub fixture generator; the Hub never re-derives semantics. Uploads go directly to Hub-issued data-plane URLs, which are treated as capabilities (the bearer token is sent only to the control plane, and the URLs are never logged). Retries are decided from a semantic intent digest (Version identity plus the committed Project generation the package is exported from) before any export; a new attempt of the same uncommitted intent supersedes its open session, so a rerun after ref_conflict lands on the newer revision. Ref advances carry an expected-revision precondition; a Fork is a new repository identity (create-if-absent) whose lineage carries the origin citation, verified against the origin repository's published lineage.
• Credential: short-lived scoped token from the device flow (or GRAPHFORGE_HUB_PUBLISH_TOKEN for CI), held only in memory; never written to project files, config participants or logs.
• HTTP plumbing shared by gf clone, gf ontology module fetch and gf publish moves to hub_http.rs with clone's network-safety rules unchanged.
• Python and Node reach gf publish through the existing CLI shim; parity cases in tests/contracts/repository-cli-parity.json.

Closes #1749

Acceptance evidence (crates/graphforge-cli/src/hub_publish/tests.rs; real projects, real CLI path over HTTP to ReferenceHub, real gf clone back)

Criterion	Test
Publishing the same Version twice yields one Hub version and the original receipt	publishing_the_same_version_twice_returns_the_original_receipt (byte-equal receipts, one revision, zero data-plane PUTs on rerun; reused operation id with other content → GF_IDEMPOTENCY_CONFLICT)
An interrupted upload resumes, and a corrupt object is refused before the ref moves	interrupted_upload_resumes_from_hub_offset (rerun resumes from the Hub's offset and clones back); corrupt_object_is_refused_before_ref_moves (in-transit and at-rest corruption → integrity_failure, refs unchanged, no receipt)
A published Fork clones back with its origin citation intact	published_fork_clones_back_with_origin_citation

Supporting: publish_token_never_leaves_the_control_plane, stale_expected_revision_is_a_ref_conflict_and_a_rerun_lands_on_top, a_changed_project_publishes_a_new_snapshot_and_conflicts_under_a_reused_operation, an_object_corrupted_at_rest_must_be_uploaded_again, device_flow_waits_are_bounded_whatever_the_hub_advertises, a_slow_but_progressing_upload_succeeds_in_bounded_chunks, device_flow_publishes_after_pending_slow_down_and_approval, denied_device_authorization_is_auth_denied, quota_denial_is_entitlement_denied, upload_urls_are_validated_as_capabilities, repository_cli_parity_cases_match_the_rust_cli; the protocol crate replays every conformance case.

Test plan

• cargo test -p graphforge-cli --lib (112 passed), cargo test -p graphforge-hub-publish
• Mutations of replay, resume offset, commit digest check, Fork origin check, token routing, expected revision and device-flow handling, session supersession, Project identity binding and write bounds each fail their test
• make check, make test-python, make test-node
• CI Gate on PR head

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: CurateLabs/graphforge/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 90b0fb21-3bc2-4e67-bc33-5d8a0bfb7510

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.