{"slug":"architecture/GATEWAY_SERVICE_BINDING_AUDIT","title":"Gateway Service Binding Audit","section":"architecture","sectionLabel":"Architecture","status":"unclassified","type":"document","path":"architecture/GATEWAY_SERVICE_BINDING_AUDIT.mdx","bytes":6865,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Date:** 2026-07-31  \n**Source:** `services/gateway/wrangler.toml` vs `services/gateway/src/index.ts` Env interface\n\n---\n\n## 1. Env Interface vs Actual Bindings\n\n| Binding                    | Required | Dev                                    | Test                          | Prod                          | Status              |\n| -------------------------- | -------- | -------------------------------------- | ----------------------------- | ----------------------------- | ------------------- |\n| `CONNECTOR`                | ✅       | connector                              | connector-test                | connector-prod                | ✅                  |\n| `MCP_CONNECTOR`            | ✅       | mcp-connector                          | mcp-connector-test            | mcp-connector-prod            | ✅                  |\n| `PIPELINE`                 | ✅       | pipeline                               | pipeline-test                 | pipeline-prod                 | ✅                  |\n| `INTELLIGENCE`             | ✅       | intelligence                           | intelligence-test             | intelligence-prod             | ✅                  |\n| `KNOWLEDGE`                | ✅       | knowledge                              | knowledge-test                | knowledge-prod                | ✅                  |\n| `BFF`                      | ✅       | workflow                               | workflow-test                 | workflow-prod                 | ✅                  |\n| `AGENT_RUNTIME`            | ✅       | iw-agent-runtime                       | iw-agent-runtime-test         | iw-agent-runtime              | ⚠️ **PROD = DEV**   |\n| `HUB_CONTROLLER`           | ✅       | hub-controller-api                     | hub-controller-api            | hub-controller-api            | ❌ **SAME ALL ENV** |\n| `ADMIN`                    | ✅       | integratewise-admin                    | integratewise-admin-staging   | integratewise-admin           | ✅                  |\n| `BILLING`                  | ✅       | integratewise-billing                  | integratewise-billing-staging | integratewise-billing         | ✅                  |\n| `TENANTS`                  | ✅       | integratewise-tenants                  | integratewise-tenants-staging | integratewise-tenants         | ✅                  |\n| `CONNECTOR_SYNC`           | opt      | connector-sync                         | connector-sync-test           | connector-sync-prod           | ✅                  |\n| `SPINE`                    | opt      | integratewise-spine                    | integratewise-spine-test      | integratewise-spine-prod      | ✅                  |\n| `MCP_POOL`                 | opt      | integratewise-mcp-pool                 | integratewise-mcp-pool        | integratewise-mcp-pool        | ❌ **SAME ALL ENV** |\n| `MARKETPLACE_INSTALLATION` | opt      | integratewise-marketplace-installation | ...-test                      | ...-prod                      | ✅                  |\n| `WEBHOOK_INGRESS`          | opt      | integratewise-webhook-ingress          | webhook-ingress-test          | integratewise-webhook-ingress | ✅                  |\n| `FOLDER_WATCHER`           | opt      | —                                      | folder-watcher-test           | folder-watcher-prod           | ✅                  |\n\n---\n\n## 2. Services with wrangler.toml but NO Gateway Binding\n\n| Service                        | Has code                 | In ROUTES | Verdict                                      |\n| ------------------------------ | ------------------------ | --------- | -------------------------------------------- |\n| **hermes**                     | ⚠️ Points to dead Worker | ❌        | ❌ UNREACHABLE — stage 11 of frozen sequence |\n| **agent-registry**             | Minimal scaffold         | ❌        | ⚠️ Orphan                                    |\n| **continuity**                 | Session event log        | ❌        | ⚠️ Via mcp-connector chain                   |\n| **loader**                     | Connector data loader    | ❌        | ⚠️ Via connector chain                       |\n| **store**                      | Connector data store     | ❌        | ⚠️ Via connector chain                       |\n| **signals**                    | Signal processing        | ❌        | ⚠️ Orphan                                    |\n| **telemetry**                  | Observability            | ❌        | ⚠️ Orphan                                    |\n| **twin-orchestrator**          | 3,470 LOC                | ❌        | ❌ DEAD CODE — zero consumers                |\n| **integration-management-mcp** | MCP server               | ❌        | ⚠️ Orphan                                    |\n| **provider-management-mcp**    | MCP server               | ❌        | ⚠️ Orphan                                    |\n| **schema-ai**                  | AI schema mgmt           | ❌        | ⚠️ Orphan                                    |\n| **task-management**            | Task CRUD                | ❌        | ⚠️ Orphan                                    |\n| **vercel-mcp**                 | Vercel integration       | ❌        | ⚠️ Orphan                                    |\n\n---\n\n## 3. Isolation Leaks (S3)\n\n| Binding            | Dev → Test → Prod                                                        | Risk                                                       |\n| ------------------ | ------------------------------------------------------------------------ | ---------------------------------------------------------- |\n| **HUB_CONTROLLER** | hub-controller-api = hub-controller-api = hub-controller-api             | ❌ CRITICAL — unauthenticated `/api` catch-all same Worker |\n| **MCP_POOL**       | integratewise-mcp-pool = integratewise-mcp-pool = integratewise-mcp-pool | ❌ HIGH — capability control plane shared                  |\n| **AGENT_RUNTIME**  | iw-agent-runtime → iw-agent-runtime-test → iw-agent-runtime              | ⚠️ MEDIUM — prod = dev                                     |\n\n---\n\n## 4. Priority Fixes\n\n| #   | Fix                                                          | Impact       |\n| --- | ------------------------------------------------------------ | ------------ |\n| 1   | Close HUB_CONTROLLER `/api` bypass OR create per-env Workers | Security     |\n| 2   | Create per-env MCP_POOL Workers                              | Isolation    |\n| 3   | Create iw-agent-runtime-prod                                 | Isolation    |\n| 4   | Wire or retire hermes                                        | Architecture |\n| 5   | Classify 8 orphan services (needed/chain/dead)               | Cleanup      |\n"}