fix(contract): Hub 2xx 响应 schema 全覆盖 + legacy planned 路径 superseded-by 标注 + 门禁 fail-closed

[DeliciousBuding]

范围（Harvey P2-3/P2-5/P2-7 收口，round-18）

• P2-3 2xx 缺 schema：16 个 Hub-implemented 200/201/202 响应补齐 content schema，全仓缺口清零。新增 SessionCreate/HubUser/AuthRefreshResponse 组件，复用 Attachment/Message/HubPendingAgentTask/AgentTeam/Resource。sync 200 为 array<Message>（与 handler 返回 []MessageResponse 一致）；pin/recall/edge-ack 等 nil-data 端点为 Resource。
• P2-5 planned 路径 superseded-by 标注：21 个 legacy planned 路径标注现役替代路由（/client/friend-requests*、/client/messages* 旧消息操作、/v1/conversations|auth|users|contacts|groups|devices → /client / /web 对应实现）。
• P2-7 门禁增强：verify-openapi-contract.py 新增 2xx-schema 覆盖 ratchet——Hub-implemented 的 200/201/202 若为 description-only（无 content 无 $ref）即 fail-closed，当前基线为空清单 openapi-schema-baseline.json；204 天然无 body 豁免。

验证（本地已跑）

• python3 scripts/verify/verify-openapi-contract.py ✅（153 implemented routes / 0 schema violations）
• 变异自测：移除 POST /web/agent-teams schema → 立即 FAIL ✅
• go test ./internal/handler/（含 TestOpenAPIDoesNotContainDuplicateMappingKeys）✅
• verify-shared-rest-contract.py / verify-doc-ssot.py / verify-ci-gates.py ✅
• PyYAML 解析 + git diff --check ✅

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: c0486bc6-ec25-4afb-a2a9-10bc8abbd065

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}