Bug Report: Hub /inbound/pull returns sender_id_required after successful hello

Environment

• @evomap/evolver: v1.62.1 (also reproducible in v1.53.2)
• Node.js: v25.6.1
• OS: macOS 26.4 (arm64)
• Hub URL: https://evomap.ai

Bug Description

After the Proxy successfully registers with the Hub via POST /a2a/hello and receives a node_id, all subsequent calls to POST /a2a/inbound/pull fail with HTTP 400 and error sender_id_required.

Steps to Reproduce

1. Start evolver with EVOMAP_PROXY=1, A2A_HUB_URL=https://evomap.ai, valid A2A_NODE_ID and A2A_NODE_SECRET
2. The Proxy calls POST /a2a/hello — succeeds, returns node_id=node_0ca63ed0cfed
3. The Proxy immediately calls POST /a2a/inbound/pull — fails with 400 sender_id_required

Expected Behavior

The Hub should accept the inbound pull request, or provide a clear mechanism for the Proxy to include the correct sender_id.

Actual Behavior

[lifecycle] hello OK, node_id=node_0ca63ed0cfed
[sync] engine started
[Proxy] Started on http://127.0.0.1:19820
[inbound] pull failed: Hub returned 400: {"error":"sender_id_required","correction":{"problem":"This endpoint requires sender_id in the request body. sender_id is only optional on the first /a2a/hello call.","fix":"Include sender_id with the your_node_id value from your hello response. If you have not registered yet, send POST /a2a/hello first (sender_id is optional on first hello -- the Hub will assign your node_id).","doc":"/a2a/skill?topic=hello"}}

Analysis

The Proxy receives node_id from the hello response and uses it in subsequent requests. The Hub's error message says "Include sender_id with the your_node_id value from your hello response" — but the Proxy IS using the assigned node_id. This suggests either:

1. The Hub expects sender_id (not node_id) in the inbound pull request body
2. The Hub's session/state for this node_id is invalid or expired
3. The Proxy should re-register (send hello again with the existing node_id as sender_id)

The same node_id (from the hello response) works fine when used directly by the heartbeat script (POST /a2a/heartbeat with {"node_id":"node_xxx"}), but fails for inbound pull.

Additional Context

• Heartbeat (POST /a2a/heartbeat) works correctly with the same node credentials
• The Hub returns service_degraded status in some heartbeat responses
• This happens on every evolver restart (reliable reproduction)

Questions for EvoMap Team

1. Should POST /a2a/inbound/pull use sender_id or node_id in the request body?
2. Is there a session re-authentication step required between hello and inbound pull?
3. Is the service_degraded Hub status affecting node registration validity?