feat(hub): kvb-hub review hub with passkey-signed approvals

The kvb-hub is a local review hub in a container bound to 127.0.0.1: one page, JSON APIs and an MCP endpoint for the operator's inbox, asks, decisions, staged-commit reviews, the radio stream, the agent graph, the worktree tree, push-to-talk and read-aloud radio (Piper, whisper.cpp) and an optional LLM command line. The hub is only a relay. The host executors in hub/client (the runner user service, the PermissionRequest hook and the approval CLI the commit skills call) verify a WebAuthn passkey signature against keys pinned outside every sandbox, refuse replays and fail closed. scripts/hub.sh with make hub-install, hub-check, hub-pin, hub-runner and hub-hook installs and checks the hub; hub-hook writes ~/.claude/settings.json after a backup. make watch-check shows a stuck watch hook. The new kvb-git-diff skill and the commit skills route reviews through the hub; the test_hub_* suites replace test_hub.py.

Security review (kvb-think-criticize, three skeptics) fixed four holes: signed rules auto-approved chained shell commands; the client and LLM openers followed redirects, the LLM one with its bearer key; the worktree scan ran git fsmonitor and filter commands from agent-writable repos; compose set no memory, pids or health limits. Documented until core requirement 093, on the operator's word: the hub page is trusted while signing and pinning, local processes can forge the unsigned operator actions, and the container reads the host /tmp. Committed on the operator's word despite the gate: the passkey path is not yet verified live.

Accepted MEDUSA false positives (137 findings on 115 lines, rows in security-accepted.jsonl): EXA002 x17, MEDUSA-MM-SCAN-058 x12, B603 x8, MEDUSA-FTSC-SCAN-089 x7, MEDUSA-PRIV-SCAN-762 x6, AIC-EXFIL-005 x5, EXA006 x5, MEDUSA-FTSCAN-231 x5, WEB-SSRF x5, MEDUSA-INF-SCAN-2057 x3, RH005 x3, TC001 x3, LO002 x2, MEDUSA-AEXP-SCAN-096 x2, MEDUSA-CGS-SCAN-028 x2, MEDUSA-INF-SCAN-1350 x2, MEDUSA-INF-SCAN-2369 x2, MEDUSA-INF-SCAN-2440 x2, MEDUSA-INF-SCAN-2638 x2, MLSC-SERIAL-002 x2, PL002 x2, PQC005 x2, SAST-PATH-001 x2, TC004 x2, TC005 x2, TC006 x2, TC007 x2, AA-146, EXA007, FINE-050, GB-ENCODE-001, GB-ENCODE-003, MEDUSA-CGS-SCAN-029, MEDUSA-CGS-SCAN-103, MEDUSA-DP-SCAN-1034, MEDUSA-DP-SCAN-1916, MEDUSA-DP-SCAN-954, MEDUSA-EXF26-TOOL-004, MEDUSA-FT-TRIGGER-005, MEDUSA-INF-SCAN-2206, MEDUSA-INF-SCAN-2457, MEDUSA-INF-WEB-003, MEDUSA-INFRA-SCAN-030, MEDUSA-MP-SCAN-1135, MEDUSA-RLHF-POISON-002, MEDUSA-RT-SCAN-006, MM-ENCODE-001, MP-124, PQC001, PQC002, PQC006, RP001, TC009, TC010, WEB-FLASK-004.

🎯 Fix: 80 %
💥 Break: 4 %
💸 Cost: 129 %
⏱️ Time: –
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 60
🚦 Gate: ⛔ fix 80 % < 90; cost 129 % > 100: ask the operator before the commit

```
/home/kevinveenbirkenbach/Repositories/github.com/kevinveenbirkenbach/skills/.worktrees/feature/kvb-hub
```

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_hub_tree.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+import json
+import unittest
+
+from hub_case import HubCase
+from hub_support import PAGE
+
+
+class TestHubTree(HubCase):
+    def test_tree_lists_repos_branches_and_worktrees(self):
+        origin = self.outside / "origin.git"
+        self.git(self.outside, "init", "--quiet", "--bare", "--initial-branch=main", str(origin))
+        repo = self.repos / "github.com" / "me" / "demo"
+        repo.mkdir(parents=True)
+        self.git(repo, "init", "--quiet", "--initial-branch=main")
+        (repo / "a.txt").write_text("a", encoding="utf-8")
+        self.git(repo, "add", "a.txt")
+        self.git(repo, "commit", "--quiet", "-m", "a")
+        self.git(repo, "remote", "add", "origin", str(origin))
+        self.git(repo, "push", "--quiet", "-u", "origin", "main")
+        (repo / "b.txt").write_text("b", encoding="utf-8")
+        self.git(repo, "add", "b.txt")
+        self.git(repo, "commit", "--quiet", "-m", "b")
+        feature = self.worktrees / "github.com" / "me" / "demo" / "feature"
+        self.git(repo, "worktree", "add", "--quiet", "-b", "feature", str(feature))
+        (feature / "dirty.txt").write_text("x", encoding="utf-8")
+        other = self.outside / "elsewhere"
+        other.mkdir()
+        self.git(other, "init", "--quiet", "--initial-branch=main")
+        (other / "c.txt").write_text("c", encoding="utf-8")
+        self.git(other, "add", "c.txt")
+        self.git(other, "commit", "--quiet", "-m", "c")
+        lone = self.worktrees / "x" / "y" / "lone"
+        self.git(other, "worktree", "add", "--quiet", "-b", "lone", str(lone))
+        feature, repo, other, lone = (path.resolve() for path in (feature, repo, other, lone))
+        self.write_council({"rasci.json": {"work/feature": {"title": "F", "status": "running", "worker": "Skills session", "workdir": str(feature)}}})
+        self.tool("review_request", {**self.arguments("feat: tree", "", self.page("tree.html", PAGE)), "worktree": str(feature), "branch": "feature"})
+        status, _, body = self.get("/api/tree")
+        self.assertEqual(status, 200, body)
+        data = json.loads(body)
+        repos = {entry["name"]: entry for entry in data["repos"]}
+        self.assertEqual(set(repos), {"github.com/me/demo", str(other)})
+        demo = {entry["name"]: entry for entry in repos["github.com/me/demo"]["branches"]}
+        self.assertEqual((demo["main"]["upstream"], demo["main"]["ahead"], demo["main"]["behind"]), ("origin/main", 1, 0))
+        trees = [(tree["path"], tree["dirty"], tree["workers"], tree["review"]) for tree in demo["main"]["worktrees"] + demo["feature"]["worktrees"]]
+        self.assertEqual(trees, [(str(repo), False, [], None), (str(feature), True, ["Skills"], {"status": "pending", "gate": "pass", "title": "feat: tree"})])
+        self.assertEqual([tree["path"] for tree in {entry["name"]: entry for entry in repos[str(other)]["branches"]}["lone"]["worktrees"]], [str(lone)])
+        self.assertEqual(json.loads(self.get("/api/tree")[2])["scanned"], data["scanned"])
+
+    def test_tree_runs_no_command_a_repo_config_names(self):
+        marker = self.outside / "ran"
+        trap, filtered = (self.repos / "github.com" / "me" / name for name in ("trap", "filtered"))
+        for repo in (trap, filtered):
+            repo.mkdir(parents=True)
+            self.git(repo, "init", "--quiet", "--initial-branch=main")
+            (repo / "a.txt").write_text("a", encoding="utf-8")
+            self.git(repo, "add", "a.txt")
+            self.git(repo, "commit", "--quiet", "-m", "a")
+        self.git(trap, "config", "core.fsmonitor", f"touch {marker}")
+        self.git(filtered, "config", "filter.x.clean", f"touch {marker}")
+        (filtered / ".gitattributes").write_text("* filter=x\n", encoding="utf-8")
+        (filtered / "a.txt").write_text("b", encoding="utf-8")
+        status, _, body = self.get("/api/tree")
+        self.assertEqual(status, 200, body)
+        dirty = {entry["name"]: entry["branches"][0]["worktrees"][0]["dirty"] for entry in json.loads(body)["repos"]}
+        self.assertEqual(dirty, {"github.com/me/trap": False, "github.com/me/filtered": None})
+        self.assertFalse(marker.exists())
+
+
+if __name__ == "__main__":
+    unittest.main()