{"slug":"architecture/TOTAL_END_STATE_CONTRACT","title":"Total End-State Contract","section":"architecture","sectionLabel":"Architecture","status":"superseded","type":"document","path":"architecture/TOTAL_END_STATE_CONTRACT.mdx","bytes":3368,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** SUPERSEDED AS ARCHITECTURE AUTHORITY — reference-only enforcement lineage.\nCurrent authority is [`INTEGRATEWISE_ARCHITECTURE.md`](INTEGRATEWISE_ARCHITECTURE.md)\nv2.2. The JSON below may remain useful to a validator only where it is compatible with\nthe canonical authority and amendment.\n\nThe JSON contract is the machine-readable enforcement source. This document\nexplains its requirements; a later runtime task consumes the JSON contract or\nthe validator rather than attempting to infer architecture from this prose.\n\n## Host and runtime ownership\n\n`www.spineworkspace.com`, `auth.spineworkspace.com`, and\n`platform.spineworkspace.com` are separately owned shared surfaces:\n`apps/marketing`, `apps/auth`, and `apps/platform`, respectively.\n\nThe 18 named operational hosts are all projections rendered by the one\n`apps/web` runtime. A request resolves through:\n\n```text\nBrowser → Gateway → Projection Engine → Spine\n```\n\nThe Gateway derives the allowed context before the Projection Engine composes\nthe Workbench. Browser code never reads a database, object store, cache,\nvector store, or provider directly. Unknown hostnames return an\nunconfigured-projection response and fail closed; they never select a different\noperational projection.\n\nThe Projection Engine composes every operational Workbench from\n`hostname × role × department × industry × active entity/work × policy ×\npermissions × available capabilities`. Common navigation is shared across the\noperational hosts, Work navigation comes from the active projection, and\nPlatform navigation belongs to `platform.spineworkspace.com` and `apps/platform`.\n\n`apps/web` is the single operational projection runtime. It must not recreate a\ndonor application boundary: copied donor shells, copied donor authentication,\ndirect database clients, and provider-specific backend assumptions are all\nprohibited there. Donor applications are not independently deployed to supply\nan operational host.\n\n## Boundaries and continuity\n\nReads are governed reads. Writes are governed writes: intent becomes a\nproposal, policy and matching authority determine whether it may be approved,\nand an owning integration or host executes only the authorized action. Outcome\nreceipts reconcile into the Spine.\n\nThe governed write path is fixed:\n\n```text\nBrowser/Twin → governed command → Capability Fabric → owning integration/host\n→ reconciliation → Spine\n```\n\nHost-owned credentials and secrets stay inside their owning host. The Spine\nnetwork may receive only descriptors, opaque route references, intent, bounded\ncontext, evidence, approval, execution status, and results.\n\nKnowledge is curated knowledge and Memory is bounded continuity memory. Neither\nis operational truth, and neither silently becomes the other.\n\n`Capability` (registered operation), `Tool` (invocation interface),\n`Integration` (credential-boundary connection), and `Action`\n(governed proposed or authorized effect) are separate contracts.\n\n## Supersedes\n\nThis contract supersedes:\n\n- fixed per-role Entity 360 navigation;\n- `Twin ONLY reads Entity360`;\n- global/sticky four-button controls;\n- role workbook `Role domain entity` classification;\n- direct browser database/provider reads;\n- independent donor app deployment; and\n- generic fallback to another projection when hostname resolution fails.\n"}