{"slug":"internal/architecture/CANONICAL_STATE","title":"Historical Launch-Control Snapshot — Superseded","section":"internal","sectionLabel":"Internal","status":"unclassified","type":"document","path":"internal/architecture/CANONICAL_STATE.mdx","bytes":8990,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n> **Status:** HISTORICAL — retained for June 18, 2026 implementation lineage\n> **Current authority:** [`docs/CANON.md`](CANON.md),\n> [`ARCHITECTURE_LOCK.md`](architecture/ARCHITECTURE_LOCK.md),\n> [`IMPLEMENTATION_CONTRACT_v1.1.md`](architecture/IMPLEMENTATION_CONTRACT_v1.1.md)\n> and\n> [`CONSOLIDATED_PRODUCT_PLATFORM_CONTRACT_v1.2.md`](architecture/CONSOLIDATED_PRODUCT_PLATFORM_CONTRACT_v1.2.md).\n>\n> Do not implement this snapshot's IW Continuity Bridge product name, D1\n> canonical truth, domain partitions, Descope authority, direct D1 execution,\n> layered UI or service-count claims.\n\n# Original Snapshot: Canonical State — IW Continuity Bridge Launch Control\n\n> **Last Updated:** 2026-06-18T21:13:00+05:30  \n> **Status:** Authoritative Active State  \n> **Directive:** This file is the single source of active context. Paste this file into every new agent session to ensure continuity and prevent assumption drift.\n\n**Canonical Reference:** [docs/architecture/CANONICAL_PLATFORM_ARCHITECTURE.md](docs/architecture/CANONICAL_PLATFORM_ARCHITECTURE.md)\n\n> This document is downstream of the Canonical Platform Architecture. When this document contradicts the canonical architecture, the canonical architecture wins.\n\n---\n\n## 1. Authoritative Architecture References\n\nDo not copy-paste or redefine these. Always refer directly to these canonical files:\n\n- **Master End-to-End System Contract:** [FINAL_E2E_SYSTEM.md](file:///Users/nirmal/integratewise-live/docs/FINAL_E2E_SYSTEM.md) (v1.0.0-FINAL, July 2, 2026) — Resolves all conflicting architectural dimensions, locks the 26-service physical topology, and defines closure criteria for all P0/P1 security hardening items.\n- **Ecosystem Master Protocol & Rules:** [AGENTS.md](file:///Users/nirmal/Github/integratewise-live/AGENTS.md) (v3.8.0, June 18, 2026) — Mandates the 24-hour product completion directive (Decision 24) and Cloudflare-only infrastructure (Decision 22).\n- **Product Specifications:** [PRODUCT_ARCHITECTURE.md](file:///Users/nirmal/Github/integratewise-live/docs/architecture/PRODUCT_ARCHITECTURE.md) (v3.7) — Defines the vendor-neutral Handoff contract, Approval Center, two-mode split (CS/ops), and async state machine.\n- **Layers & System Flow:** [USER_SYSTEM_JOURNEY_BLUEPRINT.md](file:///Users/nirmal/Github/integratewise-live/docs/architecture/USER_SYSTEM_JOURNEY_BLUEPRINT.md) (v3.7) — Maps L0–L7 user layers, S1–S12 backend stages, Twin context hydration logic, and the 7-stage Customer Zero verification checklist.\n- **Master Entry Protocol (All Repos):** [Intake/AGENTS.md](file:///Users/nirmal/Github/IntegrateWise - Memory/Intake/AGENTS.md) (v3.8.0, June 18, 2026).\n- **Database Schema (SSOT):** D1 (`integratewise-spine-cache`) + domain partitions (`decide_data`, `build_data`, `grow_data`, `run_data`, `cross_data`).\n\n---\n\n## 2. Changelog of Work Shipped (Since June 18, 2026)\n\n- **2026-06-18 (Timeline Acceleration):** Materialized the 24-hour product completion mandate (Decision 24) in the root [AGENTS.md](file:///Users/nirmal/Github/integratewise-live/AGENTS.md) and memory [Intake/AGENTS.md](file:///Users/nirmal/Github/IntegrateWise - Memory/Intake/AGENTS.md).\n- **2026-06-18 (Doctrine Materialization):** Appended detailed specifications for the L7 → L6 data flow, Twin context hydration grounding, and 7-stage Customer Zero checklist directly to [USER_SYSTEM_JOURNEY_BLUEPRINT.md](file:///Users/nirmal/Github/integratewise-live/docs/architecture/USER_SYSTEM_JOURNEY_BLUEPRINT.md).\n- **2026-06-18 (Dashboard Hang Fix):** Diagnosed D1 query timeouts and resolved the dashboard rendering hangs.\n- **2026-06-18 (CZ E2E Loop Closure):** Validated the full loop: Twin DO generates the Handoff package, L5/L6 workbenches render it, Hermes picks up the package and executes mutations directly on D1 SQLite partitions, writes back status, and updates continuity memory.\n- **2026-06-18 (Connector Bindings Fix):** Resolved mismatch between deployed worker bindings and gateway routing catalog.\n\n---\n\n## 3. Remaining 24-Hour Production Launch Punch List\n\nThese items are pulled from Section 11 of the Product Architecture and the June 18 Deep Excavation Report. They must be fully shipped within 24 hours:\n\n### 3.1 Feature Deliverables & Infrastructure\n\n- [ ] **Approval Center UI (External):** Build and deploy the user interface for external customers to review, approve, and select execution adapters (to be integrated into the main Vite app at `apps/web`).\n- [ ] **Handoff Adapter Pipeline:** Implement the canonical JSON handoff contract exporter (JSON export first, followed by specific Hermes/OpenClaw translation mappings).\n- [ ] **Async Webhooks state machine:** Implement `/api/v1/handoff/outcome` endpoint on the Cloudflare Gateway (`services/gateway` / `services/bff`) to process execution results from external agents.\n- [ ] **Outcome Ingestion & Writeback:** Establish the pipeline to ingest outcome POSTs, validate governance tokens (`x-approval-token`), and record execution memory back to D1 domain partitions.\n- [ ] **S11 Boundary Enforcement:** Write the tenant-level logic flag in S8/S11 boundary to enforce strict separation: Customer Zero (Hermes auto-execute) vs External Tenants (async Handoff only).\n\n### 3.2 Critical Security Violations (P0)\n\n- [ ] **RSA Private Key hardcoded in Source (`services/gateway/src/lib/jwt.ts`):** Remove the fallback `DEFAULT_PRIVATE_JWK` block and load strictly from env `OAUTH_PRIVATE_KEY` secret.\n- [ ] **Exposed database credentials (`services/loader/check-tables.js`):** Remove hardcoded Neon password; read strictly from `process.env.DATABASE_URL`.\n- [ ] **Exposed WebUI password (`scripts/knowledge-write.ts` & `packages/api/src/knowledge-sync.ts`):** Remove hardcoded password; read from `process.env.WEBUI_PASS` or throw.\n- [ ] **Root `.env` secrets committed to git:** Remove `.env` from git tracking index (`git rm --cached .env`) and keep it local (relies on `.env.example`).\n- [ ] **Hardcoded MCP API Key fallback (`services/intelligence/src/twin-orchestrator.ts`):** Remove the plain key string fallback and fail-closed if `env.MCP_API_KEY` is missing.\n- [ ] **Auth Bypass in `iw-agent-runtime` (`services/iw-agent-runtime/src/index.ts`):** Refuse connection and fail-closed if `c.env.JWT_SECRET` is unset and no valid fallback auth is provided.\n- [ ] **Cross-Tenant Data Leak in Intelligence:** Ensure Kanban snapshot and Ops status queries filter strictly by `tenant_id` (`services/intelligence/src/index.ts`).\n- [ ] **Tenant Identity Spoofing:** Update Gateway routing to strip and overwrite inbound `x-tenant-id` / `x-user-id` headers based on JWT verification.\n- [ ] **Tenant Middleware No-Op (`services/tenants/src/index.ts`):** Apply resolved tenant context headers back to the request instead of discarding them.\n- [ ] **Invitation Accept Cross-Tenant Scan:** Query the `tenant_users` table with a specific `tenant_id` filter when accepting invitations.\n- [ ] **Hardcoded service auth fallback:** Remove `\"internal-default\"` fallback in `services/intelligence/src/index.ts`.\n- [ ] **SQL Injection in Continuity & Knowledge:** Refactor `db-shim.ts` and `supabase.ts` to use parameterized queries instead of executing raw unescaped SQL strings.\n\n### 3.3 High Correctness & Architecture Violations (P1)\n\n- [ ] **Migrate Billing Service from Supabase to D1:** Re-route subscription CRUD, entitlement checking, and payment tracking to Cloudflare D1 (Decision 22).\n- [ ] **Gateway Rate Limiting Fail-Open:** Change gateway rate limiter to deny requests if Cloudflare KV fails instead of allowing bypass.\n- [ ] **CORS Open Credential Reflecting:** Stop reflecting arbitrary request origins when credentialed access is enabled in the Gateway.\n- [ ] **MCP gateway JWT verification bypass:** Require Gateway JWT verification for `/tools`, `/invoke`, `/mcp`, and `/sessions` paths.\n- [ ] **Unsigned Webhooks auto-approval:** Add signature validation for webhook providers (WhatsApp, Discord, Notion, etc.) at the Gateway.\n- [ ] **Webhook Replay Protection:** Enforce freshness checks on timestamps in webhook headers (Stripe/GitHub/HubSpot) to prevent replay.\n- [ ] **Timing-Safe Comparison Length Leak:** Fix timing leaks in webhook verification by avoiding early returns on signature length mismatches.\n- [ ] **Nango Signature verification timing leak:** Use `crypto.subtle.timingSafeEqual()` for signature checks.\n- [ ] **HITL Durable Object Tenant Leak:** Avoid using `idFromName(\"global\")` for HITL sessions; scope Durable Object IDs by `tenant_id`.\n- [ ] **Weak Password Hashing:** Replace Gateway simple SHA-256 with pbkdf2 or bcrypt (or a stretched hash with unique per-user salts).\n- [ ] **Type errors in `iw-agent-runtime`:** Fix the 6 compiler errors in `twin-agent.ts` and `index.ts`.\n- [ ] **Remove `@supabase/supabase-js` from Monorepo:** Delete `@supabase/supabase-js` from all package.json files and remove `packages/supabase/` to complete Decision 22.\n"}