{"slug":"internal/business/CONSOLIDATION_2026-05-12","title":"IntegrateWise — 4-Day Consolidation Report","section":"internal","sectionLabel":"Internal","status":"unclassified","type":"document","path":"internal/business/CONSOLIDATION_2026-05-12.mdx","bytes":14610,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n> **Status: HISTORICAL MAY 2026 SNAPSHOT.** MCP counts, D1 paths,\n> auto-approval and live-environment claims below require current evidence and\n> cannot override the frozen architecture.\n\n> Period: May 8–12, 2026  \n> Author: Hermes Agent (Operator)  \n> Status: LIVE ENVIRONMENT — all changes require PR + approval\n\n---\n\n## 1. MCP Servers — CURRENT STATE\n\n**131 MCP tools available** after reload (May 12 07:45 AM session)\n\n| Server                        | Transport             | Status         | Notes                                                  |\n| ----------------------------- | --------------------- | -------------- | ------------------------------------------------------ |\n| `integratewise-mcp-connector` | HTTP (CF Worker)      | ✅ Connected   | 12 tools: kb._, figma._                                |\n| `google-workspace`            | Stdio (npx)           | 🔄 Reconnected | Needs `@dguido/google-workspace-mcp` — verify env vars |\n| `spineDb`                     | Stdio (npx)           | 🔄 Reconnected | `@spineDb/mcp-server-spineDb@latest`                   |\n| `coda`                        | **NEW — Stdio (npx)** | ✅ Added       | `coda-mcp` npm package (fix for HTTP 401)              |\n\n### Coda Fix Applied\n\nPrevious config used `url: https://coda.io/apis/mcp` with Bearer token → always 401 (OAuth2 required). Switched to stdio transport via `coda-mcp` npm package:\n\n```yaml\nmcp_servers:\n  coda:\n    command: npx\n    args: [\"-y\", \"coda-mcp\"]\n    env:\n      CODA_API_KEY: \"your-uuid-key-here\"\n    timeout: 120\n```\n\n---\n\n## 2. Adaptive Spine — HEALTH CHECK\n\n**All 12 workers healthy** (as of CF Wire Status, May 9):\n\n| Service       | Worker Name                 | Health Status | Notes                           |\n| ------------- | --------------------------- | ------------- | ------------------------------- |\n| mcp-connector | integratewise-mcp-connector | ✅ 200        | v2.0.0-semantic, 12 tools       |\n| act           | integratewise-act           | ✅ 200        |                                 |\n| connector     | integratewise-connector     | ✅ 200        |                                 |\n| gateway       | integratewise-gateway       | ✅ 200        |                                 |\n| think         | integratewise-think         | ✅ 200        | ⚠️ Check config (per AGENTS.md) |\n| knowledge     | integratewise-knowledge     | ✅ 200        |                                 |\n| normalizer    | integratewise-normalizer    | ✅ 200        |                                 |\n| billing       | integratewise-billing       | ✅ 200        |                                 |\n| loader        | integratewise-loader        | ⚠️ 404        | /health not found; uses /       |\n| workflow      | integratewise-bff           | ✅ 200        |                                 |\n| govern        | integratewise-govern        | ✅ 200        |                                 |\n| pipeline      | integratewise-pipeline      | ✅ 200        |                                 |\n\n### ⛔ CF Access — 403 BLOCKED\n\nDirect HTTP to pipeline worker returns 403. Service token in `~/.iw/secrets.env` exists but is NOT whitelisted in CF Access Application Policy. This blocks:\n\n- Continuity scripts (session read/write to Spine)\n- Any external Spine read/write from Hermes\n- Token helper works but HTTP calls fail at CF Access layer\n\n**Fix required:** CF Dashboard → Zero Trust → Access → Applications → `connect-a1b.workers.dev` → Add Service Auth rule.\n\n### ⛔ Wrangler — NOT AUTHENTICATED\n\n- No OAuth session (`wrangler whoami` fails)\n- No `CLOUDFLARE_API_TOKEN` set\n- Can't deploy, can't inspect secrets store\n- **Fix:** `wrangler login` or create API token at dash.cloudflare.com\n\n---\n\n## 3. Governance Layer — FULL AUDIT\n\n### What's Built (all in `services/govern/`)\n\n| Component                         | File                   | Lines | Status      |\n| --------------------------------- | ---------------------- | ----- | ----------- |\n| API Routes                        | `index.ts`             | 630   | ✅ Complete |\n| Types & Schemas                   | `types.ts`             | 136   | ✅ Complete |\n| Policy CRUD + Engine              | `policies.ts`          | 370   | ✅ Complete |\n| Workflow (approve/reject/pending) | `workflow.ts`          | 239   | ✅ Complete |\n| Governance Rules Engine           | `governance-engine.ts` | 483   | ✅ Complete |\n| Audit + HMAC Signatures           | `audit.ts`             | 265   | ✅ Complete |\n\n### Architecture (verified from code)\n\n```\nSignal (Think) → persist action_proposal → actions table (pending_approval)\n     ↓\nGovern: POST /v1/check → policy matching (wildcards + roles + evidence) → allow/deny/auto-approve\n     ↓\nHITL: GET /v1/pending → UI review (PendingApprovalsCard + ApprovalModal)\n     ↓\nAct: POST /v1/approve or /v1/reject → update actions status → signed audit entry\n     ↓\nExecute: Act service verifies approval_token → connector execution → pipeline re-ingestion\n     ↓\nLearn: Think receives outcome feedback → pattern extraction → decision_memory\n```\n\n### Issues Found\n\n1. **Zero policies seeded** — `governance_policies` table exists (migration present) but has no production entries. `canExecute()` returns `allowed: true` for everything.\n2. **Default rules are in-memory only** — PII redaction, credit card masking, PII flagging exist in `defaultRules` array but are NOT persisted to `governance_rules` table.\n3. **No enforcement in production** — approval workflow is structurally complete but ungoverned.\n4. **`SIGNATURE_KEY` unknown** — audit entries use HMAC-SHA256 signing; secret must be in CF secrets store (can't verify without wrangler auth).\n\n### Act Service (`services/act/`) — FULLY IMPLEMENTED ✅\n\n476 lines, complete implementation with:\n\n- Dual path: HITL (`action_id`) + Think (`action_proposal_id`)\n- Mandatory approval token validation\n- Governance double-check via service binding\n- Connector execution with re-ingestion through pipeline\n- Outcome feedback to Think for learning loop\n- Engagement log writes to Spine DB\n- Full audit trail (D1 edge cache)\n\n---\n\n## 4. Think Service (`services/think/`) — 1258 lines\n\n### Capabilities\n\n- **Signals API** — `/v1/signals` — query spine signals by tenant + band\n- **Success Intelligence** — `/v1/success/intelligence` — domain-specific signal routing across 9 routes (renewals, risks, support, usage, technical health, tasks, stakeholders, integrations, AI insights)\n- **Analyze** — `/v1/think/analyze` — on-demand entity analysis via SignalEngine\n- **Accelerators** — 6 endpoints: health-score, churn-prediction, revenue-forecast, pipeline-velocity, nps-analysis, data-quality\n- **Summarize** — `/v1/summarize` — AI-powered session summarization (OpenRouter fallback)\n- **Extract Patterns** — `/v1/extract-patterns` — recurring pattern detection\n- **Decisions** — `/v1/decide` — manual decision recording to D1\n- **Twin 360** — `/v1/twin/360/:entityId` — entity 360 + trigger evaluation\n- **Queue Handler** — processes async events, persists HITL actions to Spine DB\n\n### Python Intelligence (REMOVED — May 27, 2026)\n\n- All `PYTHON_INTELLIGENCE_URL` references removed. `SignalAnalyzer` (TypeScript-native) is the canonical replacement, exported from `@integratewise/types`.\n- **ZERO PYTHON rule fully enforced** — `services/intelligence/src/python-client.ts` deleted. All workers import from `@integratewise/types`.\n\n---\n\n## 5. Workflow Service (`services/workflow/`)\n\n### Live Endpoints Verified\n\n- Workspace initialization, tenant config, knowledge-read-policy, AI context URLs\n- Connector registration, dashboard, projections, readiness\n- HITL queue (Durable Object), signal stream, presence, rooms\n- Python analyze proxy (same legacy concern as Think)\n\n---\n\n## 6. Pipeline Service (`services/pipeline/`)\n\n**CRITICAL: Only service with Spine write credentials.** Merges normalizer (8-stage) + spine-v2 (SSOT reads/writes). Consumes: `PIPELINE_QUEUE`, `KNOWLEDGE_QUEUE`, `ACCELERATOR_QUEUE`, `INTELLIGENCE_QUEUE`, `DLQ_QUEUE`, `SIGNAL_QUEUE`.\n\n---\n\n## 7. Git Status — Uncommitted Changes\n\n### Modified (must commit or stash before deploy)\n\n```\nM  .gitignore\nM  AGENTS.md\nM  apps/web/package.json\nM  packages/webhooks/src/worker.ts\nM  packages/webhooks/wrangler.toml\nM  pnpm-lock.yaml\nM  services/mcp-connector/src/index.ts\nM  services/mcp-connector/wrangler.toml\nM  services/spine-v2/src/index.ts\n```\n\n### Untracked (new files)\n\n```\n?? .envrc\n?? .hermes/\n?? .tool-versions\n?? docs/HERMES_CONTINUITY_CONSTITUTION.md\n?? docs/PARALLEL_CONTINUITY_ORCHESTRATION.md\n?? docs/SECONDARY_MAC_NODE_PLAN.md\n?? docs/design/KIRO_CONTEXT_TRANSFER_LG.md\n?? docs/design/PLATFORM_AND_PRODUCT_PAGE_SPEC.md\n?? docs/design/SITE_CONNECTIVITY_SPEC.md\n?? docs/design/THREE_FLOWS_VISUAL_SPEC.md\n?? docs/operations/CF_WIRE_STATUS.md\n?? docs/product/ADAPTIVE_SYSTEM.md\n?? docs/product/INDUSTRIES_AND_ROLES.md\n?? packages/api/src/knowledge-sync.ts\n?? packages/spineDb/migrations/030_hermes_continuity.sql\n?? scripts/capture-auth-shots.mjs\n?? scripts/capture-drawer-detail.mjs\n?? scripts/capture-home-sections.mjs\n?? scripts/capture-live-site.mjs\n?? scripts/capture-loom.mjs\n?? scripts/capture-twin-layer.mjs\n?? scripts/capture-unauth-shots.mjs\n?? scripts/knowledge-write.ts\n?? services/iw-adk-agent/\n?? services/mcp-connector/src/handlers/coda-proxy.ts\n?? services/spine-v2/migrations/\n?? spineDb/migrations/20260510100000_continuity_objects.sql\n```\n\n---\n\n## 8. Cron Jobs\n\n| Job                                | Schedule                           | Status     | Notes                                                                                         |\n| ---------------------------------- | ---------------------------------- | ---------- | --------------------------------------------------------------------------------------------- |\n| `iw-memory-triage` (85b6b37d)      | 9:00 AM IST daily (`0 9 * * *`)    | ✅ Running | Script mode, no agent. Last run OK (May 12 06:10)                                             |\n| `IW Daily Ops Briefing` (e78cb491) | 10:30 AM IST daily (`30 10 * * *`) | ✅ Running | Claude Sonnet 4.6 via Copilot. Delivers to Telegram `@IWHermesOpsBot` (`telegram:5753113905`) |\n\n---\n\n## 9. Prioritized Action List\n\n### 🟢 RESOLVED (May 12)\n\n| #   | Action                                                           | Owner                 | Status   |\n| --- | ---------------------------------------------------------------- | --------------------- | -------- |\n| 1   | CF Access: whitelist service token for `connect-a1b.workers.dev` | Nirmal (CF dashboard) | ✅ Fixed |\n| 2   | Wrangler auth: `wrangler login` or API token                     | Nirmal                | ✅ Fixed |\n\n### 🟡 HIGH\n\n| #   | Action                                                                                                 | Owner                     | Blocker                                   |\n| --- | ------------------------------------------------------------------------------------------------------ | ------------------------- | ----------------------------------------- |\n| 3   | Coda MCP config — verify `coda-mcp` npm package works                                                  | Hermes                    | Already added to config, needs validation |\n| 4   | Deploy updated services (mcp-connector, spine-v2, webhooks)                                            | Needs wrangler auth first | Uncommitted changes                       |\n| 5   | Seed governance policies in production DB                                                              | Needs wrangler auth first | Zero policies configured                  |\n| 6   | Fix `gateway.integratewise.ai` DNS CNAME                                                               | Nirmal / DNS              | Custom domain not resolving               |\n| 7   | **Add GitHub Copilot provider** — run `hermes auth add copilot` OAuth flow                             | Nirmal                    | OAuth device code needed                  |\n| 8   | **Add OpenCode provider** — signup at opencode.ai, set `OPENCODE_ZEN_API_KEY` or `OPENCODE_GO_API_KEY` | Nirmal                    | Account + API key needed                  |\n\n### 🟠 MEDIUM\n\n| #   | Action                                                                      | Owner         | Blocker                                                           |\n| --- | --------------------------------------------------------------------------- | ------------- | ----------------------------------------------------------------- |\n| 7   | Update daily briefing cron → deliver to Telegram `@IWHermesOpsBot` chat     | Hermes        | Cron working but target wrong                                     |\n| 8   | Verify `services/iw-adk-agent/` — intent and implementation                 | Dev team      | Empty/unfinished                                                  |\n| 9   | Replace `PYTHON_INTELLIGENCE_URL` fallbacks with TS                         | Dev team      | ✅ DONE — `SignalAnalyzer` in `@integratewise/types`, zero Python |\n| 10  | Verify HITL UI components (PendingApprovalsCard, ApprovalModal) implemented | Frontend team | Architecture docs say wired, code unverified                      |\n| 11  | Commit/stash git changes before any deploy                                  | Dev           | Dirty working tree                                                |\n\n### 🔵 LOW\n\n| #   | Action                                               | Owner  |\n| --- | ---------------------------------------------------- | ------ |\n| 12  | Add `elias` MCP server (if needed)                   | Hermes |\n| 13  | Review `loader` service 404 on /health               | Dev    |\n| 14  | Document continuity scripts usage in ACTIVITY_LOG.md | Hermes |\n\n---\n\n## 10. Key Decisions (from conversations)\n\n1. **Model selection:** Claude Sonnet 4.6 confirmed as active model via Copilot provider (changed from Kimi, Mimo)\n2. **Coda integration:** stdio via `coda-mcp` npm package (not HTTP endpoint — OAuth2 blocker)\n3. **Hermes role:** Orchestrator ONLY — never executor. HITL mandatory for production/financial actions\n4. **Spine truth:** CF Adaptive Spine = canonical. Firestore = monitoring mirror. Never write to Firestore as truth.\n5. **Language:** ZERO Python. TypeScript only across all services, scripts, and automation.\n\n---\n\n_Generated: May 12, 2026 — next update on action completion_\n"}