{"slug":"operations/16-infrastructure-and-deployment-architecture","title":"16 — Infrastructure and Deployment Architecture","section":"operations","sectionLabel":"Operations","status":"unclassified","type":"document","path":"operations/16-infrastructure-and-deployment-architecture.mdx","bytes":3768,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** Approved launch decision; production evidence required\n\n## July 30 ownership\n\n| Concern                       | Owner / runtime                             |\n| ----------------------------- | ------------------------------------------- |\n| Browser identity              | Clerk production                            |\n| Account and tenant resolution | Gateway on Cloudflare                       |\n| Workbench                     | Next.js on Vercel at `app.integratewise.ai` |\n| Provider OAuth                | Nango credential wall                       |\n| Canonical truth               | Neon, written through Pipeline              |\n| Bounded edge state            | D1 and KV                                   |\n| Files and immutable evidence  | R2                                          |\n| Retrieval indexes             | Vectorize / AI Search                       |\n| Public OAuth-protected MCP    | Gateway + MCP Connector                     |\n| Approval and execution        | Governance → Hermes                         |\n\nThis is a hosting correction for the server-rendered Workbench, not a backend\nmigration.\n\n## Runtime path\n\n```text\nBrowser\n→ app.integratewise.ai\n→ Clerk\n→ gateway.integratewise.ai\n→ account / tenant resolution\n→ Integration Manager and platform APIs\n→ Nango / Pipeline / Projection Engine / Governance / Hermes\n→ Neon + bounded Cloudflare state\n```\n\n## Environment progression\n\n```text\nlocal → preview → integration-test → development → staging\n→ customer-zero → marketplace-certification → production\n```\n\nEvery environment has independent secrets, callback URLs, audit, tenant data,\ndeployment version, migration state, rollback target, monitoring, and test-data\npolicy.\n\nThe three governing operating environments are:\n\n| Environment         | Rule                                                                                                                     |\n| ------------------- | ------------------------------------------------------------------------------------------------------------------------ |\n| Development         | Synthetic/test data and isolated Development Neon, D1/KV/R2/queues/search only.                                          |\n| Customer Zero       | Dedicated production-shaped internal tenant resources; never a general test tenant.                                      |\n| Customer Production | Tenant-isolated production resources, with dedicated cells for contractual, residency, scale or regulatory requirements. |\n\nShared stateless Cloudflare Platform Workers are the default compute topology.\nWorkers for Platforms is reserved for customer-supplied or agent-generated code\nthat must be deployed in isolated Workers; ordinary multi-tenant Platform\nservices do not require one Worker per tenant.\n\n## Shared configuration\n\nOne controlled environment registry supplies service bindings and validated\nconfiguration to Cloudflare, Vercel, GitHub Actions, connector OAuth apps, MCP,\nCustomer Zero, and production. Secrets are never copied into shared repository\nfiles, Workbench bundles, or documentation.\n\n## Stop-ship infrastructure defects\n\n- two selectable browser identity authorities;\n- unresolved account or tenant membership;\n- provider tokens outside Nango;\n- UI or Twin direct canonical writes;\n- D1 described or used as business truth;\n- public MCP tool-count drift;\n- unhealthy required endpoints;\n- unreviewed migrations or no rollback target;\n- cross-environment credential reuse;\n- demo fallback masking live failure.\n\n## Vercel note\n\nThe repository's Vercel CLI was observed at `54.18.6`, behind `58.1.0`. Upgrade\nwith `pnpm add -g vercel@latest` before deployment verification.\n"}