{"slug":"architecture/FRONTEND_TO_CANONICAL_SPINE_MAPPING","title":"Frontend → Operational Spine → Canonical Spine Mapping","section":"architecture","sectionLabel":"Architecture","status":"unclassified","type":"document","path":"architecture/FRONTEND_TO_CANONICAL_SPINE_MAPPING.mdx","bytes":39428,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Date:** 2026-07-31 \n**Purpose:** Every unmapped and unwired path becomes visible. \n**Basis:** Three parallel deep audits of frontend fetches, Gateway routes, and service store access.\n\n---\n\n## 1. The Three Layers\n\n```\n┌─────────────────────────────────────────────────────────────┐\n│ FRONTEND (apps/web) │\n│ apiFetch() → NEXT_PUBLIC_IW_API_URL → Gateway │\n│ GatewayHttpClient → NEXT_PUBLIC_API_BASE_URL → Gateway │\n│ spineClient (Supabase-like) → gateway-adapter → Gateway │\n├─────────────────────────────────────────────────────────────┤\n│ GATEWAY (services/gateway) │\n│ 51-entry ROUTES table → service bindings (Fetcher) │\n│ Direct D1/KV reads for workspace discovery, entities │\n├─────────────────────────────────────────────────────────────┤\n│ SERVICES │\n│ spine · pipeline · knowledge · intelligence · mcp-connector │\n│ continuity · workflow · hermes · mcp-pool · webhook-ingress│\n├─────────────────────────────────────────────────────────────┤\n│ STORES │\n│ D1 (Operational) · Neon (Canonical) · KV · R2 · Queues · DO│\n└─────────────────────────────────────────────────────────────┘\n```\n\n---\n\n## 2. Frontend → Gateway (Complete Route Map)\n\n### 2.1 API Client → Gateway Routes\n\n| Frontend Client | URL Path | Gateway Route | Target Service | Status |\n| --------------- | -------------------------------------------- | ----------------------------------- | ------------------------ | ------------ |\n| `apiFetch()` | `/api/v1/workspace/discovery` | Handled directly | Gateway + Spine | ✅ **WIRED** |\n| `apiFetch()` | `/api/v1/workspace/connectors` | `/api/v1/workspace/*` | BFF (workflow) | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/connectors/catalog` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/connectors/nango-session` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/profile` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/spine-config` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/tenant-products` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/user-roles` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/register-connector` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/initialize-spine` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/projection/{dept}` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/entities` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/metadata` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/csm/*` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/workspace/domain/*` | `/api/v1/workspace/*` | BFF | ✅ WIRED |\n| `apiFetch()` | `/api/v1/pipeline/entities` | `/api/v1/pipeline` | PIPELINE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/pipeline/spine/*` | `/api/v1/pipeline` | PIPELINE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/pipeline/ingest/csv` | `/api/v1/pipeline` | PIPELINE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/pipeline/sync-checkpoints` | `/api/v1/pipeline` | PIPELINE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/pipeline/quarantine` | `/api/v1/pipeline` | PIPELINE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/pipeline/schema-registry` | `/api/v1/pipeline` | PIPELINE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/intelligence/signals` | `/api/v1/intelligence` | INTELLIGENCE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/knowledge/memories` | `/api/v1/knowledge` | KNOWLEDGE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/knowledge/continuity-objects` | `/api/v1/knowledge` | KNOWLEDGE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/governance/proposals` | `/api/v1/cognitive/govern` | INTELLIGENCE | ✅ WIRED |\n| `apiFetch()` | `/api/v1/connectors` | `/api/v1/connectors` | CONNECTOR | ✅ WIRED |\n| `apiFetch()` | `/api/v1/integrations/*` | (in-gateway handler) | Gateway internal | ✅ WIRED |\n| `apiFetch()` | `/api/v1/billing/subscription` | `/api/v1/billing` | INTERNAL_BILLING | ✅ WIRED |\n| `apiFetch()` | `/api/v1/billing/entitlements/*` | `/api/v1/billing` | INTERNAL_BILLING | ✅ WIRED |\n| `apiFetch()` | `/api/v1/subscriptions` | (in-gateway handler) | Gateway internal | ✅ WIRED |\n| `apiFetch()` | `/api/v1/spine-network/*` | `/api/v1/spine-network` | MCP_CONNECTOR | ✅ WIRED |\n| `apiFetch()` | `/api/v1/marketplace/installations/*` | `/api/v1/marketplace/installations` | MARKETPLACE_INSTALLATION | ✅ WIRED |\n| `apiFetch()` | `/api/marketplace/activate` | (Next.js API route) | Frontend internal | ⚠️ **LOCAL** |\n| `AuthManager` | `/api/v1/auth/login` | `/api/v1/auth` | INTERNAL_AUTH | ✅ WIRED |\n| `AuthManager` | `/api/v1/auth/signup` | `/api/v1/auth` | INTERNAL_AUTH | ✅ WIRED |\n| `AuthManager` | `/oauth/token` | `/oauth` | INTERNAL_AUTH | ✅ WIRED |\n| `BillingClient` | `/api/v1/billing/*` | `/api/v1/billing` | INTERNAL_BILLING | ✅ WIRED |\n| `SSEClient` | `/ws`, `/sse`, `/stream` | `/ws`, `/sse`, `/stream` | BFF | ✅ WIRED |\n\n### 2.2 Frontend → Gateway: GAPS\n\n| Gap | Detail | Severity |\n| ---------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ----------------------------------------- |\n| **No `/api/v1/workspace/discovery` in ROUTES table** | Handled by special-case `if` at line 2314, NOT in the ROUTES array | ⚠️ Architectural — works but inconsistent |\n| **`/api/marketplace/activate`** | Next.js API route, not gateway-routed | ⚠️ Local only, not production-ready |\n| **Two API base URLs** | `NEXT_PUBLIC_IW_API_URL` vs `NEXT_PUBLIC_API_BASE_URL` — different clients use different bases | ⚠️ Configuration drift risk |\n| **Direct Spabase URL** | `NEXT_PUBLIC_SPINE_URL` still referenced in spine client | ❌ Legacy — should be removed |\n| **Descope fallback** | `NEXT_PUBLIC_DESCOPE_PROJECT_ID` still active alongside Clerk | ⚠️ Dual auth path (D11) |\n\n---\n\n## 3. Gateway → Service Routing (Complete)\n\n### 3.1 ROUTES Table (51 entries)\n\n| Route Prefix | Target Binding | Worker Name | D1/KV Direct Access | Status |\n| ------------------------------------ | -------------------------- | ----------------------------- | ------------------- | ---------------------- |\n| `/api/v1/auth` | INTERNAL_AUTH | (in-gateway) | — | ✅ |\n| `/api/v1/projections` | INTERNAL_PROJECTIONS | (in-gateway) | — | ✅ |\n| `/api/v1/capabilities/status` | INTERNAL_CAPABILITY_STATUS | (in-gateway) | — | ✅ |\n| `/api/v1/billing` | INTERNAL_BILLING | (in-gateway) | — | ✅ |\n| `/api/v1/tenants` | INTERNAL_TENANTS | (in-gateway) | — | ✅ |\n| `/api/v1/support` | INTERNAL_SUPPORT | (in-gateway) | — | ✅ |\n| `/api/v1/analytics` | BFF | integratewise-workflow | D1 (analytics) | ✅ |\n| `/api/v1/agents` | INTELLIGENCE | integratewise-intelligence | D1 + Neon | ✅ |\n| `/api/v1/workspace` | BFF | integratewise-workflow | D1 (spine-cache) | ✅ |\n| `/api/v1/spine-network` | MCP_CONNECTOR | integratewise-mcp-connector | D1 + Neon | ✅ |\n| `/api/v1/connectors` | CONNECTOR | integratewise-connector | D1 | ✅ |\n| `/api/v1/connector` | CONNECTOR | integratewise-connector | D1 | ✅ |\n| `/api/v1/loader` | CONNECTOR | integratewise-connector | D1 | ✅ |\n| `/api/v1/pipeline` | PIPELINE | integratewise-pipeline | D1 + KV + Queues | ✅ |\n| `/api/v1/spine` | SPINE | integratewise-spine | D1 + Neon | ✅ |\n| `/api/v1/mcp-pool` | MCP_POOL | integratewise-mcp-pool | — | ✅ |\n| `/api/v1/intelligence` | INTELLIGENCE | integratewise-intelligence | D1 + Neon | ✅ |\n| `/api/v1/cognitive/spine` | PIPELINE | integratewise-pipeline | D1 | ✅ |\n| `/api/v1/cognitive/entity360` | PIPELINE | integratewise-pipeline | D1 | ✅ |\n| `/api/v1/entity360` | PIPELINE | integratewise-pipeline | D1 | ✅ |\n| `/api/v1/identity` | PIPELINE | integratewise-pipeline | D1 | ✅ |\n| `/api/v1/cognitive/evidence` | BFF | integratewise-workflow | D1 | ✅ |\n| `/api/v1/cognitive/memories` | KNOWLEDGE | integratewise-knowledge | D1 + R2 + Vectorize | ✅ |\n| `/api/v1/cognitive/signals` | INTELLIGENCE | integratewise-intelligence | D1 | ✅ |\n| `/api/v1/cognitive/think` | INTELLIGENCE | integratewise-intelligence | D1 + Neon | ✅ |\n| `/api/v1/cognitive/act` | INTELLIGENCE | integratewise-intelligence | D1 + Neon | ✅ |\n| `/api/v1/cognitive/govern` | INTELLIGENCE | integratewise-intelligence | D1 + Neon | ✅ |\n| `/api/v1/cognitive/context-to-truth` | INTELLIGENCE | integratewise-intelligence | D1 + Neon | ✅ |\n| `/api/v1/cognitive/hitl` | BFF | integratewise-workflow | D1 | ✅ |\n| `/api/v1/brainstorm` | INTELLIGENCE | integratewise-intelligence | D1 | ✅ |\n| `/api/v1/knowledge` | KNOWLEDGE | integratewise-knowledge | D1 + R2 + Vectorize | ✅ |\n| `/api/v1/cognitive/twin` | AGENT_RUNTIME | iw-agent-runtime | Durable Objects | ✅ |\n| `/api/v1/cognitive/brain` | AGENT_RUNTIME | iw-agent-runtime | Durable Objects | ✅ |\n| `/api/v1/execution-packages` | AGENT_RUNTIME | iw-agent-runtime | Durable Objects | ✅ |\n| `/api/v1/cognitive/insights` | INTELLIGENCE | integratewise-intelligence | D1 | ✅ |\n| `/api/v1/cognitive/audit` | BFF | integratewise-workflow | D1 | ✅ |\n| `/api/v1/cognitive/agents` | INTELLIGENCE | integratewise-intelligence | D1 | ✅ |\n| `/api/v1/cognitive/memory` | KNOWLEDGE | integratewise-knowledge | D1 | ✅ |\n| `/api/v1/cognitive/truth` | KNOWLEDGE | integratewise-knowledge | D1 + Neon | ✅ |\n| `/api/v1/cognitive/projects` | KNOWLEDGE | integratewise-knowledge | D1 | ✅ |\n| `/api/v1/cognitive/status` | KNOWLEDGE | integratewise-knowledge | D1 | ✅ |\n| `/ws`, `/sse`, `/stream` | BFF | integratewise-workflow | — | ✅ |\n| `/admin` | INTERNAL_ADMIN | (in-gateway) | — | ✅ |\n| `/oauth` | INTERNAL_AUTH | (in-gateway) | — | ✅ |\n| `/webhooks/slack-workflow` | WEBHOOK_INGRESS | integratewise-webhook-ingress | — | ✅ |\n| `/webhooks/slack/interactivity` | WEBHOOK_INGRESS | integratewise-webhook-ingress | — | ✅ |\n| `/webhooks/billing` | INTERNAL_BILLING | (in-gateway) | — | ✅ |\n| `/webhooks` | WEBHOOK_INGRESS | integratewise-webhook-ingress | — | ✅ |\n| `/api` | HUB_CONTROLLER | hub-controller-api | D1 | ⚠️ **UNAUTHENTICATED** |\n\n### 3.2 Gateway → Service: GAPS\n\n| Gap | Detail | Severity |\n| ------------------------------------------- | --------------------------------------------------- | ----------------------------- |\n| **`/api` catch-all to HUB_CONTROLLER** | Unauthenticated entry point (S1) | ❌ **SECURITY** |\n| **`/api/v1/spine` not in CORE_SERVICES** | Spine is bound but not in release path | ❌ **DEPLOYMENT** |\n| **15 dangling bindings** | Service names don't match wrangler `name =` | ❌ **BROKEN** |\n| **5 test/prod binding leaks** | HUB_CONTROLLER and MCP_POOL share targets | ❌ **ISOLATION** |\n| **`hermes` unreachable** | Stage 11 of runtime sequence, zero inbound bindings | ❌ **ARCHITECTURE** |\n| **`marketplace-installation` zero inbound** | New service, binding added but not in ROUTES | ⚠️ **WIRED VIA SPECIAL CASE** |\n\n---\n\n## 4. Service → Store Mapping (Operational D1 vs Canonical Neon)\n\n### 4.1 Store Inventory\n\n| Store | Technology | Purpose | Owner |\n| --------------------- | --------------------------------------- | ----------------------------------------------------------------------------- | ---------------------- |\n| **Operational Spine** | D1 (`integratewise-spine-staging/prod`) | Connections, connectors, sync jobs, webhooks, schemas, capabilities, timeline | Spine service |\n| **Spine Cache** | D1 (`integratewise-spine-cache`) | Shared operational cache across all services | Multiple services |\n| **Canonical Spine** | Neon (`FORTRESS_DATABASE_URL`) | Canonical entities, relationships, lineage, promotion, audit | Pipeline (sole writer) |\n| **Analytics** | D1 (`integratewise-analytics`) | Conversion events, performance metrics, daily aggregates | Workflow |\n| **Knowledge** | D1 + R2 + Vectorize | Document chunks, embeddings, memories, search | Knowledge |\n| **Intelligence** | D1 + Neon + Supabase REST | Governance policies, actions, signals, agent decisions | Intelligence |\n| **Agent Runtime** | Durable Objects | Twin conversations, agent working memory | iw-agent-runtime |\n| **Sessions** | KV (`SESSIONS`) | User sessions | Gateway |\n| **Rate Limits** | KV (`RATE_LIMITS`) | API rate limiting | Gateway |\n| **Connector Status** | KV (`CONNECTOR_STATUS`) | Connector health | Gateway |\n| **OAUTH State** | KV (`OAUTH_STATE_KV`) | OAuth flow state | Gateway |\n\n### 4.2 Service → Store: COMPLETE MAP\n\n#### SPINE (Operational + Canonical reads)\n\n| Store | Table | R/W | Status |\n| ---------------- | ------------------------------------------------------------------------------------ | --- | ----------------- |\n| D1 (Operational) | connections, connectors, sync-jobs, webhooks, schemas, capabilities, timeline-events | R/W | ✅ |\n| Neon (Canonical) | product.workbench_overview, product.workbench_definitions | R | ✅ |\n| Neon | spine.activities | R/W | ✅ |\n| Neon | spine.current_entities | R | ✅ |\n| Neon | knowledge.documents | R | ✅ (cross-schema) |\n| Neon | continuity.memories | R | ✅ (cross-schema) |\n| Neon | spine_connector_catalog | R | ⚠️ placeholder |\n| Neon | spine_connector_installations | R | ⚠️ placeholder |\n| Neon | governance_proposals | R | ⚠️ placeholder |\n| Neon | marketplace_packages | R | ⚠️ placeholder |\n| Neon | marketplace_installations | R | ⚠️ placeholder |\n\n#### PIPELINE (Canonical writer)\n\n| Store | Table | R/W | Status |\n| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- | ------------------------ |\n| D1 (CANONICAL_SPINE_DB) | spine_entities, spine_timeline, spine_relationships | R/W | ❌ **PLACEHOLDER DB ID** |\n| D1 (CACHE_DB) | entity_cache, signal_cache, cross_data, decide_data, governance_data, merge_candidates, entity_signatures, agent_memory, signals, approval_queue, audit_log, spine_schema_registry, spine_vault, entities | R/W | ❌ **NO DB BINDING** |\n| Neon | entities, entity_merges, normalization_errors | R | ✅ (via Supabase REST) |\n| KV | entity:{tid}:{source}:{id}, agent:memory:\\* | R/W | ✅ |\n| Queue | pipeline-process, knowledge-ingest, accelerator-trigger, intelligence-events, ops-dlq, signals, memory-promote | Produce/Consume | ✅ |\n\n#### KNOWLEDGE\n\n| Store | Table | R/W | Status |\n| --------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- | ------ |\n| D1 | document_chunks, search_history, consolidated_memories, embeddings, ai_sessions, ai_session_memories, ai_conversations, ai_messages, ai_memories, org_memory, personal_memory, conversational_memory, triage_results, tenant_spine_config | R/W | ✅ |\n| R2 | file blobs | R/W | ✅ |\n| Vectorize | vector index | R/W | ✅ |\n| Queue | knowledge-ingest, memory-consolidation-tasks | Consume/Produce | ✅ |\n| DO | MemoryConsolidator | R/W | ✅ |\n\n#### INTELLIGENCE\n\n| Store | Table | R/W | Status |\n| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- | ------ |\n| D1 | cross_data, governance_data, continuity_loop, agent_decisions, audit_logs, dlq_entries, conversational_memory, personal_memory, signal_rules, situations, action_proposals, decision_memory, decision_patterns, source_reliability, trust_scores, autonomy_overrides, ai_session_memories, document_chunks, ai_sessions, session_entity_links, evidence_refs, signals, spine_metrics, events, artifact_links, emails, drive_files, brainstorm_sessions, brainstorm_insights | R/W | ✅ |\n| Neon | governance_policies, actions | R/W | ✅ |\n| Supabase REST | tenant_spine_config, audit_log, ai_config, decision_memory, rule_effectiveness, drift_events | R/W | ✅ |\n| R2 | memory content | R/W | ✅ |\n| Vectorize | semantic index | R/W | ✅ |\n| Queue | pipeline-process, intelligence-act, ops-dlq, signals, memory-promote | Produce/Consume | ✅ |\n| DO | HandoffTimeoutDO, TriageWorkflow, BulkCleanupSwarm | R/W | ✅ |\n\n#### MCP-CONNECTOR\n\n| Store | Table | R/W | Status |\n| ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | ------ |\n| D1 | users, tenant_spine_config, agent_registry, connector_catalog, context_boundaries, context_exchange_log, active_work_context, agent_communication_log, handoff_packages, handoff_state_log, proposals, oauth_refresh_tokens, oauth_clients, spine_entities, signals, kb_artifacts, kb_topic_policies, spine_events, ai_sessions, ai_session_memories, session_entity_links | R/W | ✅ |\n| KV | MCP_IDEMPOTENCY | R/W | ✅ |\n| Queue | knowledge-ingest, pipeline-process | Produce | ✅ |\n| Neon | auth/v1/jwks | R | ✅ |\n\n---\n\n## 5. THE CRITICAL GAP: Operational → Canonical Tunnel\n\n### 5.1 What's Wired\n\n```\nFrontend → Gateway → Pipeline → D1 (Operational) → ✅ WIRED\nFrontend → Gateway → Spine → D1 (Operational) → ✅ WIRED\nFrontend → Gateway → Spine → Neon (Canonical reads) → ✅ WIRED\nFrontend → Gateway → Knowledge → D1 + R2 + Vectorize → ✅ WIRED\nFrontend → Gateway → Intelligence → D1 + Neon → ✅ WIRED\n```\n\n### 5.2 What's BROKEN\n\n```\nPipeline → CANONICAL_SPINE_DB (Neon) → ❌ PLACEHOLDER DB ID\nPipeline → D1 (entity_cache, etc.) → ❌ NO DB BINDING\nGateway → 15 dangling service bindings → ❌ BROKEN\nGateway → hermes (stage 11) → ❌ UNREACHABLE\nGateway → /api (HUB_CONTROLLER) → ❌ UNAUTHENTICATED\n```\n\n### 5.3 The Canonical Write Path (S0)\n\n```\nINTENDED:\nPipeline promotion → CANONICAL_SPINE_DB (Neon) → canonical entities\n ↓\n Transactional outbox\n ↓\n Async projections → Brain, Search, Vector, Workbench\n\nACTUAL:\nPipeline promotion → CANONICAL_SPINE_DB → ❌ PLACEHOLDER DB ID\n ↓\n console.warn (silent failure)\n ↓\n return { success: true } → ❌ LIES TO CALLER\n```\n\n**This is S0. The highest-value single change in the entire system.**\n\n---\n\n## 6. Unmapped Paths (Frontend calls that have no backend)\n\n| Frontend Call | Gateway Route | Backend | Status |\n| ------------------------------------- | -------------------------- | ----------------------------- | ------------------------------------ |\n| `/api/v1/workspace/connectors` | → BFF (workflow) | Workflow reads D1 | ✅ But workflow not in CORE_SERVICES |\n| `/api/v1/workspace/projection/{dept}` | → BFF | Workflow reads D1 | ✅ But projection logic unclear |\n| `/api/v1/workspace/entities` | → BFF | Workflow reads D1 | ✅ But entity source unclear |\n| `/api/v1/workspace/metadata` | → BFF | Workflow reads D1 | ✅ But metadata freshness unclear |\n| `/api/v1/governance/proposals` | → INTELLIGENCE | Intelligence reads D1 + Neon | ✅ But governance gate not proven |\n| `/api/v1/spine-network/*` | → MCP_CONNECTOR | MCP Connector reads D1 + Neon | ✅ 19 tools implemented |\n| `/api/v1/marketplace/installations/*` | → MARKETPLACE_INSTALLATION | New service, D1 | ✅ But binding not in ROUTES |\n| `/api/marketplace/activate` | → Next.js API route | Frontend local | ⚠️ Not production |\n\n---\n\n## 7. Unwired Paths (Backend exists but frontend doesn't call)\n\n| Backend Endpoint | Service | Purpose | Status |\n| ---------------------------- | ------------- | -------------------- | ------------------------------- |\n| `/api/v1/cognitive/think` | INTELLIGENCE | Twin reasoning | ❌ No frontend consumer |\n| `/api/v1/cognitive/act` | INTELLIGENCE | Action execution | ❌ No frontend consumer |\n| `/api/v1/cognitive/govern` | INTELLIGENCE | Governance decisions | ❌ No frontend consumer |\n| `/api/v1/cognitive/twin` | AGENT_RUNTIME | Twin runtime | ❌ No frontend consumer |\n| `/api/v1/cognitive/brain` | AGENT_RUNTIME | Brain reasoning | ❌ No frontend consumer |\n| `/api/v1/brainstorm` | INTELLIGENCE | Brainstorm sessions | ❌ No frontend consumer |\n| `/api/v1/cognitive/insights` | INTELLIGENCE | AI insights | ❌ No frontend consumer |\n| `/api/v1/cognitive/agents` | INTELLIGENCE | Agent management | ❌ No frontend consumer |\n| `/api/v1/execution-packages` | AGENT_RUNTIME | Execution packages | ❌ No frontend consumer |\n| `/api/v1/mcp-pool` | MCP_POOL | Capability routing | ❌ No frontend consumer |\n| `/api/v1/spine/*` | SPINE | Spine CRUD | ⚠️ Only via spineClient adapter |\n\n---\n\n## 8. Priority Fix Order\n\n| # | Fix | Impact | Effort |\n| ------ | -------------------------------------------- | --------------------------------- | --------------- |\n| **1** | **S0: Make canonical write hard-fail** | Silent data loss → visible error | Small |\n| **2** | **Wire CANONICAL_SPINE_DB** to real Neon | Canonical writes actually persist | Medium |\n| **3** | **Add DB binding to Pipeline wrangler.toml** | 14 D1 tables become accessible | Small |\n| **4** | **Repair 15 dangling bindings** | Services become reachable | Small |\n| **5** | **Close HUB_CONTROLLER bypass** | Security hole closed | Small |\n| **6** | **Wire hermes or formally retire it** | Stage 11 of runtime sequence | Decision needed |\n| **7** | **Add spine to CORE_SERVICES** | Spine included in release path | Small |\n| **8** | **Frontend: consume workspace/discovery** | First canonical read proven | Medium |\n| **9** | **Frontend: wire think/act/govern** | Twin and governance become usable | Large |\n| **10** | **Remove Descope fallback** | Single auth path | Small |\n\n---\n\n**Generated from:** Three parallel deep audits (frontend, gateway, stores) \n**Files produced:** `apps/web/FRONTEND_DATA_FETCH_MAP.md`, `docs/STORE_ACCESS_MAP.md`, this document\n"}