{"slug":"business/REPOSITORY_BOUNDARY_AUDIT","title":"Repository Boundary Audit","section":"business","sectionLabel":"Business","status":"unclassified","type":"document","path":"business/REPOSITORY_BOUNDARY_AUDIT.mdx","bytes":16943,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Date:** 2026-08-01  \n**Governing spec:** `THREE_REPOSITORY_ARCHITECTURE_SPEC.md`, `IMPLEMENTATION_CONTRACT_v1.1.md`, `ARCHITECTURE_LOCK.md`\n\n---\n\n## Summary\n\nBoth named repositories are significantly over-scoped relative to their canonical channel roles. Neither is ready for integration as a microfrontend zone or a standalone security authority. The integration work must begin with ownership migration, not routing configuration.\n\n---\n\n## iw-spine-network-mcp\n\n### What it actually contains\n\n| Area                       | Files                                                                                            | Finding                                                                                             |\n| -------------------------- | ------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------- |\n| Auth context               | `lib/auth-context.tsx`, `components/core/auth/`                                                  | **Own mock session** — localStorage-backed, independent of Clerk/Gateway                            |\n| Workbench shell            | `components/iw/layouts/workspace-shell.tsx`, `components/iw/views/*`                             | Full second Workbench with 12+ domain views (admin, governance, chat, approvals, brainstorming)     |\n| Projection/command runtime | `components/iw/state/runtime-contracts.ts`, `use-hydrate-projection.ts`, `use-intent-command.ts` | Canonical-quality contracts; these are **Keep / promote to shared package**                         |\n| Onboarding                 | `components/activation/onboarding/*`, `components/iw/onboarding/*`                               | Role-domain onboarding covering 10 roles — **Move** to Platform activation                          |\n| L1 domain views            | `components/l1/*` (account-success, bizops, finance, marketing, etc.)                            | Platform Workbench domain views — **Move** to platform repo                                         |\n| MCP tooling                | None found                                                                                       | **Missing** — the MCP channel itself (19 tools, OAuth resource discovery, MCP transports) is absent |\n| Direct DB/service coupling | None confirmed in surface code; auth context is mock                                             | Coupling risk is low, but resolved identity is also mock                                            |\n| Surface contracts          | `components/iw/config/surface-backend-contracts.ts`, `spine-table-map.ts`                        | Valuable — **Keep / promote**                                                                       |\n\n### Verdict\n\n**This is a Workbench prototype, not an MCP channel.** It contains the right projection/command runtime types and surface contracts but none of the actual MCP channel code (tool definitions, OAuth protected-resource server, MCP transports, tenant-bound access tokens). It should be treated as a migration source for:\n\n- Projection runtime types → `packages/projection-contracts`\n- Surface/table contracts → `packages/platform-sdk`\n- Domain views → `apps/platform/app/(shell)/*`\n- Onboarding flow → Platform activation module\n\nThe mock auth context and second Workbench shell must be retired after migration. No MCP tooling should be built in this repo until the canonical MCP channel role is properly scoped.\n\n### Keep / Move / Retire map\n\n| Path                                                  | Decision           | Destination                                                   |\n| ----------------------------------------------------- | ------------------ | ------------------------------------------------------------- |\n| `components/iw/state/runtime-contracts.ts`            | **Keep → promote** | `packages/projection-contracts`                               |\n| `components/iw/config/surface-backend-contracts.ts`   | **Keep → promote** | `packages/platform-sdk/contracts`                             |\n| `components/iw/config/spine-table-map.ts`             | **Keep → promote** | `packages/platform-sdk/contracts`                             |\n| `components/core/hydration/use-hydrate-projection.ts` | **Keep → promote** | `packages/react-sdk`                                          |\n| `components/core/hydration/use-intent-command.ts`     | **Keep → promote** | `packages/react-sdk`                                          |\n| `components/l1/*` (all domain views)                  | **Move**           | `apps/platform/app/(shell)/`                                  |\n| `components/activation/onboarding/*`                  | **Move**           | Platform activation module                                    |\n| `components/iw/onboarding/*`                          | **Move**           | Platform activation module                                    |\n| `components/iw/views/*`                               | **Move**           | `apps/platform/app/(shell)/`                                  |\n| `components/iw/layouts/workspace-shell.tsx`           | **Move**           | `apps/platform/components/shell/`                             |\n| `lib/auth-context.tsx`                                | **Retire**         | Replace with Clerk + Gateway identity                         |\n| `components/core/auth/auth-provider.tsx`              | **Retire**         | Replace with Clerk provider                                   |\n| `components/core/auth/login-page.tsx`                 | **Retire**         | Clerk-hosted or platform auth flow                            |\n| `app/(auth)/login/page.tsx`                           | **Retire**         | Auth owned by Clerk/Gateway                                   |\n| `components/iw/state/role-context.tsx`                | **Retire**         | Role resolved by Gateway projection                           |\n| `components/iw/state/workspace-store.tsx`             | **Retire**         | Workspace state from Gateway discovery                        |\n| `components/dialogs/*`                                | **Evaluate**       | Keep if MCP-specific; move if Workbench                       |\n| `app/(app)/domains/*`                                 | **Evaluate**       | Move if Workbench domain; scope to MCP fallback               |\n| MCP tools (absent)                                    | **Build**          | After role is scoped: exactly 19 tools, OAuth resource server |\n\n---\n\n## iw-one-auth-ecosystem\n\n### What it actually contains\n\n| Area                    | Files                                                                        | Finding                                                                                |\n| ----------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |\n| Identity                | `app/auth/login/page.tsx`, `app/login/page.tsx`                              | Supabase email/password + demo cookie — **not Clerk**, competes with platform identity |\n| Mock auth               | `lib/mock-auth.ts` (referenced)                                              | Demo credential bypass — **Retire**                                                    |\n| Clerk webhooks          | `app/api/webhooks/clerk/route.ts`                                            | Clerk event receiver — potentially **Keep / move** to platform                         |\n| Connector OAuth         | `app/api/connectors/[provider]/connect/route.ts`, `callback/`, `disconnect/` | Direct provider OAuth execution — **Move** to Connector Runtime in platform            |\n| Connector CRUD          | `app/api/connectors/route.ts`, `[id]/route.ts`                               | Mock in-memory connector list — **Retire** mock, **Move** interface to platform        |\n| AI/LLM                  | `app/api/ai/chat/route.ts`, `brainstorm/*` routes                            | LLM routing and brainstorm analysis — **Move** to platform Hermes/AI layer             |\n| Cron jobs               | `app/api/cron/daily-insights/route.ts`, `hourly-insights/route.ts`           | Background ingestion — **Move** to platform reconciliation/ingestion                   |\n| Provider webhooks       | `app/api/webhooks/{slack,discord,hubspot,asana,health}`                      | Provider event receivers — **Move** to platform Integration Manager                    |\n| Spine entities/timeline | `app/api/spine/entities/route.ts`, `timeline/route.ts`                       | Direct Spine data access — **Move** to platform projection API                         |\n| Twin                    | `app/api/twin/route.ts`                                                      | Digital twin query — **Move** to platform twin service                                 |\n| Data sync               | `app/api/data-sync/route.ts`                                                 | Ingestion pipeline — **Move** to platform reconciliation                               |\n| HubSpot sync            | `app/api/hubspot/sync/route.ts`                                              | Provider-specific sync — **Move** to Connector Runtime                                 |\n| Coda integration        | `app/api/integrations/coda/*`                                                | Provider-specific integration — **Move** to Connector Runtime                          |\n| Docs index/read         | `app/api/docs/*`                                                             | Knowledge indexing — **Move** to platform knowledge service                            |\n| Website tracking        | `app/api/website/track/route.ts`                                             | Analytics — **Move** or **Retire**                                                     |\n| Webhook scheduler       | `app/api/webhook-scheduler/trigger/route.ts`                                 | Scheduling — **Move** to platform                                                      |\n| Platform proxy          | `app/api/platform/[...path]/route.ts`                                        | Catch-all proxy to platform — **Retire** (routing anti-pattern)                        |\n| Full Workbench UI       | `app/app/workbench/*`, `app/deals`, `app/clients`, `app/campaigns`, etc.     | Second full Workbench — **Move** surfaces to platform or **Retire** duplicates         |\n| One Auth trust flow     | Not found                                                                    | **Missing** — the canonical trust grant / consent / connection reuse flow is absent    |\n\n### Verdict\n\n**This is a second standalone platform, not a One Auth trust layer.** It contains Supabase identity competing with Clerk, direct provider OAuth execution that belongs in the Connector Runtime, AI/LLM routing that belongs in Hermes, background ingestion that belongs in platform reconciliation, and a full second Workbench. The canonical One Auth-to-Ecosystem functionality (workspace trust grants, delegated provider access, consent lifecycle, connection reuse) is entirely absent.\n\nMigration priority:\n\n1. **Highest — Move now:** Clerk webhook receiver, provider OAuth flows, provider webhooks, Spine entity/timeline API access\n2. **High — Move after platform APIs exist:** AI/brainstorm, cron ingestion, data sync, twin query\n3. **Medium — Move with Workbench consolidation:** all UI surfaces\n4. **Retire immediately:** mock auth, demo cookie, Supabase identity, platform proxy catch-all, in-memory connector mock\n\n### Keep / Move / Retire map\n\n| Path                                                              | Decision                         | Destination                                       |\n| ----------------------------------------------------------------- | -------------------------------- | ------------------------------------------------- |\n| `app/api/webhooks/clerk/route.ts`                                 | **Move**                         | `apps/platform/app/api/webhooks/clerk/`           |\n| `app/api/connectors/[provider]/connect`, `callback`, `disconnect` | **Move**                         | Platform Connector Runtime                        |\n| `app/api/webhooks/{slack,discord,hubspot,asana}`                  | **Move**                         | Platform Integration Manager                      |\n| `app/api/spine/entities`, `timeline`                              | **Move**                         | Platform Projection API                           |\n| `app/api/twin/route.ts`                                           | **Move**                         | Platform twin service                             |\n| `app/api/ai/chat/route.ts`                                        | **Move**                         | Platform Hermes/AI layer                          |\n| `app/api/brainstorm/*`                                            | **Move**                         | Platform Hermes/AI layer                          |\n| `app/api/cron/*`                                                  | **Move**                         | Platform reconciliation/ingestion                 |\n| `app/api/data-sync/route.ts`                                      | **Move**                         | Platform reconciliation                           |\n| `app/api/hubspot/sync`, `integrations/coda/*`                     | **Move**                         | Connector Runtime                                 |\n| `app/api/docs/*`                                                  | **Move**                         | Platform knowledge service                        |\n| `app/api/webhook-scheduler/trigger`                               | **Move**                         | Platform scheduler                                |\n| `app/api/connectors/route.ts` + `[id]` (mock)                     | **Move interface / Retire mock** | Platform Connector Runtime                        |\n| `app/app/workbench/*`, all UI pages                               | **Move**                         | `apps/platform/app/(shell)/`                      |\n| `app/auth/login/page.tsx`, `app/login/page.tsx`                   | **Retire**                       | Clerk-owned auth                                  |\n| `lib/mock-auth.ts`                                                | **Retire**                       | No mock auth in production path                   |\n| `app/api/platform/[...path]/route.ts` (proxy)                     | **Retire**                       | Anti-pattern; all calls direct via typed SDK      |\n| `app/api/website/track/route.ts`                                  | **Retire or move**               | Analytics service                                 |\n| One Auth trust/consent (absent)                                   | **Build**                        | In `apps/platform` after Clerk+Gateway foundation |\n\n---\n\n## Migration sequence\n\n### Immediate (unblock integration)\n\n1. Extract `runtime-contracts.ts` and `surface-backend-contracts.ts` from `iw-spine-network-mcp` into a new `packages/projection-contracts` workspace package — these are canonical quality and already used by the platform's gateway client.\n2. Move the Clerk webhook handler from `iw-one-auth-ecosystem` into the platform — the platform needs Clerk user events to maintain `users` and `memberships` in Neon.\n3. Move provider OAuth connect/callback/disconnect routes from `iw-one-auth-ecosystem` into the platform Connector Runtime — these routes touch provider credentials and must live behind the credential wall.\n\n### Before building new features\n\n4. Remove Supabase identity and mock auth from both repos — Clerk is the only identity authority.\n5. Remove the second Workbench shells — the platform Workbench is canonical.\n6. Scope `iw-spine-network-mcp` to its MCP channel role only.\n7. Scope `iw-one-auth-ecosystem` to the canonical One Auth trust/consent flow only, or retire it and build that flow in the platform.\n\n### After foundation is stable\n\n8. Build the 19 canonical MCP tools in the MCP channel repo, backed by the Platform SDK.\n9. Build the One Auth trust/consent/reuse lifecycle in the platform.\n10. Connect the platform Workbench `/network` route to Gateway workspace discovery and integration projections.\n\n---\n\n## Gate: do not proceed with Phase 2+ until\n\n- [ ] `packages/projection-contracts` exists and exports `ProjectionEvent`, `WorkbenchCommand`, and cursor types\n- [ ] Platform has a working `GET /api/v1/workspace/discovery` endpoint backed by real Neon data\n- [ ] Clerk webhook handler is in the platform\n- [ ] Provider OAuth flows are in the platform Connector Runtime\n- [ ] Neither repo contains competing Supabase or mock auth\n"}