feat: add migration export and write fencing

tests/test_api_v2.py

@@ -1,3 +1,6 @@
+from core_hub.config import get_settings
+
+
 CATALOG_ENDPOINTS = [
     "/api/v2/widget-types",
     "/api/v2/event-types",
@@ -37,6 +40,20 @@ def test_protected_api_v2_endpoints_fail_before_business_logic(client):
         assert response.json()["detail"]["code"] == "unauthorized"
 
 
+def test_disabled_write_group_fails_closed(client, monkeypatch):
+    monkeypatch.setenv("CORE_HUB_V2_WRITE_GROUPS", "credentials")
+    get_settings.cache_clear()
+    response = client.post(
+        "/api/v2/hubs",
+        headers=OPERATOR_HEADERS,
+        json={"slug": "blocked", "name": "Blocked"},
+    )
+    get_settings.cache_clear()
+
+    assert response.status_code == 503
+    assert response.json()["detail"]["group"] == "registry"
+
+
 def test_openapi_contains_ops_hub_gate_paths(client):
     payload = client.get("/api/v2/openapi.json").json()
 

tests/test_migration.py

@@ -3,7 +3,7 @@ import json
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import async_sessionmaker
 
-from core_hub.migration import import_bundle, validate_bundle
+from core_hub.migration import export_bundle, import_bundle, validate_bundle
 from core_hub.models import Hub, MigrationRun, Widget
 
 
@@ -114,3 +114,24 @@ async def test_import_bundle_persists_records_and_run_summary(sqlite_engine):
         second = await import_bundle(session, minimal_bundle())
         assert second["counts"]["hubs"]["updated"] == 1
         assert second["counts"]["interactionEvents"]["updated"] == 1
+
+
+async def test_export_bundle_covers_all_source_tables_without_raw_keys(sqlite_engine):
+    sessionmaker = async_sessionmaker(sqlite_engine, expire_on_commit=False)
+    async with sessionmaker() as session:
+        await import_bundle(session, minimal_bundle())
+        bundle = await export_bundle(session, source_revision="source-revision")
+
+    assert set(bundle["records"]) == {
+        "hubs",
+        "hubCapabilityManifests",
+        "apiConsumers",
+        "apiKeys",
+        "widgets",
+        "interactionEvents",
+        "migrationRuns",
+    }
+    assert bundle["sourceRevision"] == "source-revision"
+    assert bundle["bundleSha256"]
+    assert bundle["records"]["apiKeys"][0]["keyHash"] == "a" * 64
+    assert "fullKey" not in json.dumps(bundle)