Unclassified

Codebase Excavation — Folder-by-Folder Trace

Date: 2026-07-30
HEAD: d941a422 — feat: marketplace installation runtime + workspace discovery verified
Method: Independent trace of every folder in the working tree. Not derived from package.json, not derived from route files. Every claim below was resolved against the files and cross-checked against wrangler.toml bindings, workspace globs, git tracking status, and the canonical release script.
Reference authority: CLAUDE.md, AGENTS.md, docs/architecture/ARCHITECTURE_LOCK.md.

Part 0 — Scale

Layer	Folders	Source files (`.ts/.tsx/.js/.jsx/.mjs`, build output excluded)
`apps/`	5	1,006
`services/`	39 (30 with a Worker config, 5 empty, 4 non-Worker)	~450
`packages/`	40	~470
Everything else	14	~156
Total		2,082

Markdown: 787 documents (33 at repo root, 754 under docs/), of which 94 live in docs/architecture/ and 16 of those are declared canonical by AGENTS.md.

Migration SQL: 476 .sql files across 17 independent migration roots.

PART I — GROUND-TRUTH MAP

1. The release surface (what is actually published)

There is exactly one authoritative list, and it lives in scripts/release/deploy-platform.sh:99 (mirrored in .github/workflows/deploy-workers.yml and scripts/release/validate-platform-deployment.sh:64):

pipeline → connector → mcp-connector → connector-sync → knowledge
        → continuity → intelligence → workflow → gateway

Nine Workers. Every other Worker config in the repo is outside the canonical publication path.

validate-platform-deployment.sh enforces exactly one hard isolation invariant: mcp-connector-test / mcp-connector-prod must both exist. No other binding class is checked.

2. `services/` — 39 folders, three populations

2a. Core nine (in the release path)

Folder	Worker name (test / prod)	Entry LOC	Owned responsibility
`pipeline`	`pipeline-test` / `pipeline-prod`	2,041	Normalizer + spine-v2 merged. Self-declared only holder of Spine write credentials. Contains `src/normalizer/` (11 JSON schemas) and `src/spine/` (legacy writer).
`connector`	`connector-test` / `connector-prod`	252	Compatibility router only. Forwards to loader / mcp-connector / store over service bindings. No in-process connector logic.
`mcp-connector`	`mcp-connector-test` / `mcp-connector-prod`	1,319	MCP tool server + the full Descope provider adapter + OAuth authorization server (11 `lib/oauth-*` modules).
`connector-sync`	`connector-sync-test` / `connector-sync-prod`	860	Schema-driven scheduled/on-demand sync for all providers. Reads `tenant_spine_config` as SSOT.
`knowledge`	`knowledge-test` / `knowledge-prod`	2,237	Chunking, embedding, search, synthesis, promotion gate, lineage tracker, IQ hub.
`continuity`	`continuity-test` / `continuity-prod`	1,026	D1 session event log (append-only) + checkpoints + continuity assembler.
`intelligence`	`intelligence-test` / `intelligence-prod`	1,816	think + act + govern + agents + cognitive-brain, merged. 65 files. Holds `src/govern/` (governance engine, policies, proposals) and `src/act/`.
`workflow`	`workflow-test` / `workflow-prod`	2,291	Bound as `BFF`. Views, analytics, stream gateway, HITL Durable Object.
`gateway`	`gateway-test` / `gateway-prod`	2,786	Single entry point. Hand-rolled 51-entry `ROUTES` prefix table + a 1,340-line `fetch` handler.

2b. Worker configs outside the release path (21)

Bound by something at runtime but never published by release:deploy:

Folder	Bound as	Inbound binding refs
`spine`	`SPINE` (gateway)	6
`iw-agent-runtime`	`AGENT_RUNTIME` (gateway)	4
`webhook-ingress`	`WEBHOOK_INGRESS` (gateway)	1
`mcp-pool`	`MCP_POOL` (gateway)	2
`admin` / `billing` / `tenants`	`ADMIN` / `BILLING` / `TENANTS` (gateway)	3 each
`folder-watcher`	`FOLDER_WATCHER` (gateway prod only; commented out in test)	3
`loader` / `store`	reached via `connector`	3 each
`task-management`	reached via `mcp-pool`	1

Zero inbound binding references from any wrangler.toml in the repo — 11 Workers:

agent-registry · hermes · integration-management-mcp · marketplace-installation · provider-management-mcp · schema-ai · signals · telemetry · twin-orchestrator · vercel-mcp · gateway (correctly, it is the edge)

2c. Non-Worker folders (9)

Folder	State
`act`, `govern`, `think`, `normalizer`	Completely empty. Untracked in git. Their real implementations live at `intelligence/src/{act,govern,think}` and `pipeline/src/normalizer`. Working-tree residue from the pre-consolidation decomposition.
`governance-state`	Contains only an empty `src/`. Untracked.
`core-engine`, `huggingface-inference`	Contain only `node_modules/`. Untracked.
`ai-provider-mcp`	Three subfolders (`anthropic`, `openai`, `perplexity`), each containing only `node_modules/` and `.wrangler/`. No source.
`knowledge/server`	Tracked (15 files). A complete Express + `@google-cloud/firestore` + `@google-cloud/storage` app with its own `Dockerfile` and `package.json` (`knowledge-bank-api`), nested inside a Cloudflare Worker service. Not a workspace member (the glob is `services/`, not `services//*`). Never built, never deployed.

3. `packages/` — 40 folders

3a. Live and consumed

Package	Consumers	Role
`types`	99 files	The real shared vocabulary. Canonical entity types, aliases, playbook schema.
`connectors`	18	116 files. ~90 provider modules across 15 category folders + catalog, registry, orchestrator, spine-emitter, resilience.
`connector-contracts`	90	The most widely depended-on contract surface in the repo.
`lib`	23	`src/` (neon, crypto, logging, ai-provider, normalizers) plus a second `capability-fabric/` tree.
`core`	8 (type-only)	Named "Capability Fabric". `apps/web` imports only types from `web-compat` and `workspace-context/types`.
`sdk`	6	Publishable. Gateway-only capability manifest client.
`spine-entities`	5	Entity type definitions consumed by `services/spine`.
`spine-schema`	4	Publishable (`private: false`).
`config`, `workbench-config`, `bootstrap`, `connector-utils`, `adk`, `accelerators`, `gateway-sdk`, `projection-engine`, `provider-base`, `rbac`, `tenancy`, `db`, `auth`	1–7 each	Narrow, single-purpose.

3b. `packages/api` — a Worker hiding in `packages/`

packages/api declares name: "hub-controller-api", ships its own wrangler.toml, its own schema.sql, its own migrations/, and 27 route modules (auth, billing, ai, mcp, spend, cs, goals, insights, analytics, sync, webhooks, knowledge-sync, capability-routes, adk-routes, …).

It is bound by the Gateway as HUB_CONTROLLER in dev, test, and prod — all three pointing at the same unsuffixed worker name.

3c. Zero-consumer packages (committed)

Package	Tracked files	Notes
`ui`	70	Shared component library. No importer anywhere. `apps/web` does not declare it as a dependency.
`design-system`	39	UI primitives + shell components. No importer anywhere.
`contracts`	21	Self-described "Frozen Integration Contracts". No importer anywhere.
`domain-shells`	18	Workbench shells (`sales-revops-workbench`, `account-success-shell` ×3 variants). No `package.json` → not a workspace member.
`knowledge-bank-ui`	19	Standalone React app (`index.html`, `App.tsx`, 8 pages). Pairs with the dead `services/knowledge/server`.
`coda-pack`, `handoff-adapters`, `hermes-spine-memory`, `spine-network`, `adapters`, `analytics`, `webhooks`, `spine-schema-generator`	—	No source importer. `spine-network` ships only `dist/`; its distribution channel is the tarballs in `releases/`.

3d. Local-only residue (untracked — not committed drift)

packages/config-backup-1782830543 and packages/lib-backup-1782830543 are untracked. Correctly excluded by pnpm-workspace.yaml (!packages/*-backup-*). Note that lib-backup contains eight modules absent from live lib: api-client, audit, cache, circuit-breaker, db-gate, error-handling, gateway-sdk, openrouter.

4. `apps/` — 5 folders

App	Source files	State
`web`	796	The product. Next.js 16 App Router.
`marketing`	175	Next.js App Router. 40+ marketing routes.
`portfolio`	24	Next.js. Separate small site.
`mobile`	7	Expo skeleton (`app/`, `lib/`, `app.json`). Effectively a stub.
`desktop`	3	Electron-Vite skeleton. Effectively a stub.

`apps/web/src` interior

Subdir	Files	Notes
`components`	560	Organised as `l1/` (240), `_deprecated/` (98), `ui/` (60), `l2/` (28), `core/` (28), `workbench/` (24), `activation/` (22), `layers/` (6), `l7/` (6), `l4/` (6), …
`lib`	74	Includes three auth managers: `auth-manager.ts`, `active-auth-manager.ts`, `descope-auth-manager.ts`.
`hooks`	42
`app`	41	App Router.
`legacy-pages`	23	13 marketing pages + 4 `work/` pages + Dashboard/LandingPage/AuthCallback. Actively loaded by `app/_components/route-views.tsx` via `dynamic()`.
`contexts`, `content`, `clients`, `types`, `shims`, `api`, `config`	32

App Router surfaces: /workbench/[department]/work/[module], /workspace/[department]/work/[module], /domains/[domain]/[view], /app/[...segments], plus /admin, /administration, /governance, /knowledge, /marketplace, /onboarding/[step], /customer-zero, /settings, and three auth entries (/login, /sign-in, /sign-up) plus /auth/callback and /oauth/callback/[provider].

5. Peripheral folders

Folder	Contents
`contracts/shared-workbench`	3 files: `v1.ts`, `schema.json`, `CHANGELOG.md`. The only versioned cross-surface contract outside `packages/`.
`infrastructure/config`	5 YAML manifests: connector catalog, models, spine-network, MCP tools-registry, ADK.
`infrastructure/secrets/registry.yaml`	Central secret registry. Lists `normalizer` and `store` as `DATABASE_URL` consumers — `normalizer` is an empty folder.
`marketplace`	`index.json` + 2 app manifests (`iw-spine-network`, `iw-continuity-bridge`) + `SPEC.md` / `PUBLISHING.md`.
`configs/root`	Duplicate copies of `vercel.json`, `tsconfig.base.json`, `turbo.json`, `pnpm-workspace.yaml`, plus a `firebase.json` that exists nowhere else.
`configs/templates`	Scaffolding templates for new services/packages.
`scripts`	89 files. 8 distinct deployment scripts predating the canonical `release/` set.
`scripts/release`	The 5 canonical scripts.
`tests`	21 files in 5 unrelated harnesses: `e2e/` (1), `edge/` (1), `functional/` (6), `playwright/` (7 suites + own config), `thesis/` (4).
`migrations`	18 root SQL + `v0-core/` (11) + `supabase-export/` (1).
`sql-migrations`	85 root SQL + `d1/` (11) + `flow-a/` (57) + `restore_usage/` (2).
`supabase/migrations`	2 SQL.
`releases`	67 files. Signed tarballs of `iw-spine-network` (two dated builds × 5 distribution flavours) + one platform tarball + an unpacked Python SDK.
`content-lifecycle-bundle`	7 GTM markdown files (content calendar, LinkedIn, newsletter, landing copy).
`public`	22 brand/SEO assets + `llm.txt`, `context.json`, `.well-known/ai-context.json`.
`.hermes`	234 files. Forensic report, 3 plans, and a `desktop-attachments/` archive of source specs and zips.
`.superpowers`	Brainstorm session HTML artifacts.

PART II — DRIFT AND DUPLICATION ASSESSMENT

Ordered by severity. Every item cites the file that establishes it.

S1 — `hub-controller-api` is a second, unauthenticated entry point sharing one D1 database across all surfaces

Four facts, each independently verifiable:

services/gateway/src/index.ts:1877–1887 — the Gateway explicitly skips its own authentication for every /api/* path that is not /api/v1/*, forwarding to HUB_CONTROLLER. The comment states: "The hub-controller-api handles its own JWT verification (HS256) with its own secret."
services/gateway/src/index.ts:207 — ["/api", "HUB_CONTROLLER"] is the terminal catch-all in the ROUTES table.
packages/api/wrangler.toml — no [env.test], no [env.prod]. One worker, [vars] ENVIRONMENT = "production" hardcoded, one D1 binding: database_name = "hub-controller-db", database_id = "b8aca43f-…".
services/gateway/wrangler.toml:283, 587, 898 — dev, test, and prod all bind service = "hub-controller-api".

Consequences. (a) The "Governance is a hard gate" law and "the Gateway validates JWTs" invariant do not hold for /api/*; a second identity authority with an independent HS256 secret sits behind the single entry point. (b) gateway-test and gateway-prod route to the same Worker against the same D1 database — a direct violation of "Test and prod must never share KV namespaces, Queues, or D1 databases." (c) It carries billing.ts, auth.ts, and capability-routes.ts — money, identity, and capability execution — on that path. (d) No deploy script or workflow references packages/api, so its deployed code is unversioned relative to the release ledger.

S2 — Fifteen dangling service bindings

Cross-referencing every name = declaration against every service = reference across all 30 service wrangler.toml files:

Referenced target	Referenced by	Actual declared name
`pipeline`	mcp-connector, twin-orchestrator, workflow	`integratewise-pipeline`
`mcp-connector`	connector	`integratewise-mcp-connector`
`connector-sync`	gateway	`integratewise-connector-sync`
`webhook-ingress-test`	gateway (test)	`integratewise-webhook-ingress-test`
`integratewise-connector`, `-test`, `-prod`	intelligence, iw-agent-runtime, knowledge, pipeline, twin-orchestrator, connector-sync	`connector` / `connector-test` / `connector-prod`
`integratewise-knowledge`	continuity, hermes, intelligence, iw-agent-runtime, knowledge, pipeline, twin-orchestrator	`knowledge`
`integratewise-intelligence`	knowledge, pipeline	`intelligence`
`integratewise-continuity`	hermes	`continuity`
`integratewise-workflow`	intelligence	`workflow`
`integratewise-bff`	hermes	(nothing — `workflow` is the BFF)
`integratewise-connector-sync-test`	workflow	(nothing)
`integratewise-integration-management-mcp-prod`	mcp-pool	`integratewise-integration-management-mcp`
`hub-controller-api`	gateway ×3	declared only in `packages/api/`

The integratewise-* prefix is the pre-consolidation naming convention. The core nine were renamed to bare names (connector, knowledge, intelligence, workflow, continuity, gateway) and the consumers were never updated. These bindings resolve to nothing at runtime.

S3 — Test/prod binding leakage in the Gateway

Binding	test target	prod target	Problem
`HUB_CONTROLLER`	`hub-controller-api`	`hub-controller-api`	Identical. See S1.
`MCP_POOL`	`integratewise-mcp-pool`	`integratewise-mcp-pool`	Identical. `mcp-pool` declares only `dev` and `prod` envs.
`WEBHOOK_INGRESS`	`webhook-ingress-test` (dangling)	`integratewise-webhook-ingress` (unsuffixed)	`integratewise-webhook-ingress-prod` exists and is unused.
`AGENT_RUNTIME`	`iw-agent-runtime-test`	`iw-agent-runtime` (unsuffixed)	`iw-agent-runtime-prod` exists and is unused.
`ADMIN` / `BILLING` / `TENANTS`	`-staging` workers	unsuffixed workers	Those three services expose only `staging` / `production` envs.

validate-platform-deployment.sh only asserts mcp-connector isolation, so none of this is caught by release:check.

S4 — Environment vocabulary has four dialects

CLAUDE.md: "Deployment surfaces are fixed: local dev, demo test, and live prod. Use --env prod; production is an alias only."

Dialect	Services
`test` + `prod` ✅	agent-registry, connector, connector-sync, continuity, folder-watcher, gateway, intelligence, iw-agent-runtime, knowledge, mcp-connector, pipeline, twin-orchestrator, webhook-ingress, workflow
`dev` + `test` + `prod`	marketplace-installation, provider-management-mcp, schema-ai, spine
`dev` + `prod`	integration-management-mcp, mcp-pool, task-management, vercel-mcp
`staging` + `production` ❌	admin, billing, hermes, loader, store, tenants
`production` only ❌	signals
`staging` only ❌	telemetry

Eight services use the retired staging/production vocabulary. signals and telemetry have no test surface at all.

Additionally, the root wrangler.toml declares [env.production], [env.staging], [env.development] and an invalid [services] table with dotted keys — Wrangler has no such schema. The root wrangler.jsonc declares assets.directory = "services/connector-sync", which is a source directory, not an asset directory. Neither root config is referenced by any release script; both are misleading dead configuration.

Also: .github/workflows/ci-cd.yml is named "CI/CD Pipeline (DISABLED)" but still contains seven direct pnpm exec wrangler deploy invocations, four of them --env production. Dispatch-only and disabled, but it is a live second publication path in the tree, contrary to "The only CI Worker publication path is Release Core Workers."

S5 — Three Capability Fabrics, none of them the live one

Implementation	Modules	Runtime consumers
`packages/core/`	`capability-registry`, `capability-engine`, `capability-context`, `execution-orchestrator`, `governance-engine`, `workflow-router`, `capability-metrics`, `web-compat`	None. `apps/web` imports only `type` declarations from `web-compat` and `workspace-context/types`. No `new CapabilityEngine`, no `createDefaultRegistry`, no `CapabilityRegistryImpl` anywhere outside the package.
`packages/lib/capability-fabric/`	`registry`, `engine`, `orchestrator`, `metrics`, `bootstrap`, `capabilities`, `context`, `types` — a near-exact mirror of the above	One, itself: `context.tsx:36` instantiates `new CapabilityEngine(registry)`. Nothing mounts that provider.
`services/gateway/src/workbench-capabilities.ts` + `internal/capability-execution.ts` + `services/mcp-pool`	resolve → prepare plan → approve	The live path.

Two full engine implementations (~35 files) are committed, mutually redundant, and unreachable. packages/core additionally contains its own governance-engine/ with an approval-queue, duplicating services/intelligence/src/govern/ — which is the deployed one.

S6 — Retired L-layer vocabulary is the frontend's primary organizing principle, and it leaks to users

CLAUDE.md: "Never expose L1, L2, L4, or L7 in user-facing UI. The frontend knows only: Entity, Projection, Capability, Signal, Context, Twin."

apps/web/src/components/l1/ — 240 files, the largest component tree in the repo
l2/ (28), l4/ (6), l7/ (6), layers/ (6)
User-visible leak: apps/web/src/components/l1/domains/product-engineering/releases-view.tsx:141 renders the changelog string "12 L1 domain views + 14 L2 cognitive overlay components" in a product surface.
Dozens of L1/L2 references in comments and section labels (hub-today-view.tsx:142 — "Suggested by IntegrateWise — L2 insight card").
The Gateway also exposes 19 /api/v1/cognitive/* routes. "Cognitive" is not one of the 12 kernel terms.
services/intelligence/src/agents/specialized/twin-orchestrator.ts:22 embeds "CODA L4 & MCP TOOLS… Coda documents are connected L4 projection surfaces" directly in a live LLM system prompt — so the retired vocabulary is inside the Twin's reasoning context, not merely in comments.

S7 — The Workbench is not one surface

CLAUDE.md: "The Workbench is one surface."

Four parallel entry surfaces resolve to Workbench content:

/workbench/[department]/work/[module]
/workspace/[department]/work/[module]
/domains/[domain]/[view]
/app/[...segments]

app/workbench/[department]/page.tsx and app/workspace/[department]/page.tsx are byte-identical except for one string — routeBase={/workbench/${department}} vs /workspace/${department}. Two canonical URL namespaces for the same surface.

Separately, apps/web/src/components/capability-shell/ (capability-dashboard.tsx, capability-shell.tsx), inline-executor/, and proactive-capabilities/ place a capability catalogue and executor inside the Workbench — against "Add capability implementations to the Capability Fabric; do not duplicate tools in the Workbench."

S8 — Two SSOT claims in deployed code

services/pipeline/src/index.ts:6 — "SECURITY: This is the ONLY service with Spine write credentials. No other worker may write to the Spine SSOT."
services/spine/src/index.ts:4 — "Canonical entity CRUD service. Every MCP and service reads/writes through the Spine. This is the platform's single source of truth." — and it holds DATABASE_URL plus a 995-line canonical-store.ts.
services/billing/src/index.ts — "v3.6: D1 is edge cache only. Supabase PostgreSQL is SINGLE SOURCE OF TRUTH."

Three deployed Workers assert three different single sources of truth. Compounding this, services/pipeline/src/spine/ (1,739-line index.ts, plus entity360-assembler, vault, crypto — 2,773 LOC total) is a second Spine implementation, self-documented as "the legacy writer (Supabase tables under 'spine'/'sales'/'cs' schemas)" with "SUPABASE is optional during cutover; callers should prefer the D1 path." Both writers are live in the release path (pipeline is core; spine is bound by the Gateway).

services/spine is bound by the Gateway as SPINE and named canonical by CLAUDE.md — yet it is not in CORE_SERVICES, so release:deploy --service core never publishes it.

S9 — Migration ledger has no single ordering

17 independent migration roots, 476 SQL files:

/migrations · /migrations/v0-core · /migrations/supabase-export · /sql-migrations · /sql-migrations/d1 · /sql-migrations/flow-a · /sql-migrations/restore_usage · /supabase/migrations · services/{intelligence,knowledge,mcp-connector,pipeline,signals,tenants,workflow}/migrations · services/{connector-sync,workflow}/d1_migrations · services/task-management/sql · packages/api/migrations · packages/webhooks/migrations

services/workflow has both migrations/ and d1_migrations/.

Duplicate sequence numbers — ordering is ambiguous:

/migrations: 041 (_app_category_entity_domain_classification vs _work_linked_governance), 042 (_d1_governance_checkpoints vs _real_tenant_rls_and_runtime_scope), 043 (_marketplace_installation_contract vs _tenant_blueprint_hydration_profiles)
/sql-migrations: 007, 008, 020, 025, 026, 027, 042, 060, 081 — nine collisions

S10 — `apps/web` contains a complete second, orphaned application root

CLAUDE.md: "apps/web is a Next.js App Router application with a static export for Cloudflare Pages."

Committed and tracked, but unreachable from the Next build:

apps/web/index.html:53 → <script type="module" src="/src/main.tsx">
src/main.tsx → ReactDOM.createRoot(...) → src/App.tsx → createAppRouter() from src/routes.tsx
vite.config.ts, vite.config.d.ts, vite-plugins/, vite-env.d.ts, and vite still a devDependency

All ten package.json scripts are Next commands. apps/web/vercel.json still declares "framework": "vite" and "outputDirectory": "dist" with an SPA rewrite — stale, though git.deploymentEnabled: false neutralises it.

next.config.mjs also contradicts the deployment rule directly: static export is opt-in (STATIC_EXPORT === "1") and the in-file comment reads "Production: no static export; Vercel runs Next.js server or Cloudflare Workers with Pages Functions." Meanwhile src/app/api/marketplace/ defines five Next Route Handlers (activate, apps, catalog, connections, onboarding-complete), which a static export cannot serve.

Plus src/components/_deprecated/ — 102 tracked files, excluded in tsconfig.json but still in the repo and still in git.

S11 — Retired GCP/Firebase infrastructure still committed

CLAUDE.md: "Do not introduce retired infrastructure."

services/knowledge/server/ — Express + @google-cloud/firestore + @google-cloud/storage + Dockerfile. 15 tracked files. Pairs with the orphaned packages/knowledge-bank-ui (19 tracked files) — together, a complete retired "Knowledge Bank" product.
services/mcp-connector/src/lib/firestore.ts — inside a core release-path Worker.
services/loader/src/lib/firestore.ts
configs/root/firebase.json — a Firebase config existing only in the duplicate config folder.

S12 — Publishability is not gated

CLAUDE.md: "The current publishable packages are @integratewise/sdk and @integratewise/spine-schema; services and implementation packages remain private deployment units."

spine-schema correctly sets private: false and sdk correctly omits it (both are intended to publish). But 16 further packages omit private entirely, which npm treats as publishable:

accelerators · adk · auth · coda-pack · connector-contracts · connector-utils · connectors · contracts · core · db · gateway-sdk · integratewise-mcp-tool-connector · rbac · spine-network · tenancy · webhooks

packages/connectors contains ~90 provider integrations and packages/core contains the governance engine. Nothing in the tree prevents npm publish from a package directory.

S13 — Naming collisions and responsibility overlap

Collision	Detail
`packages/adapters` vs `packages/connectors/src/adapters`	The first holds infrastructure adapters (`r2`, `neon`, `redis`, `blob`, `ai-gateway`); the second holds provider adapters (`freshsales`, `razorpay`). Same word, unrelated responsibilities.
`packages/accelerators` vs `packages/connectors/src/accelerators`	Two "accelerator" concepts: registry/runner/sync-registry vs seven domain packs (`engineering`, `finance`, `hr`, …).
`services/twin-orchestrator` (3,470 LOC, own Worker) vs `intelligence/src/agents/specialized/twin-orchestrator.ts` (268 LOC agent)	Two Twin orchestrators. The Worker has zero inbound bindings.
`contracts/shared-workbench` vs `packages/contracts`	Two contract homes; the package has zero consumers.
`configs/root/*` vs repo root	Duplicate `vercel.json`, `tsconfig.base.json`, `turbo.json`, `pnpm-workspace.yaml`. No script reads `configs/root`.
`apps/marketing/app/platform/` vs `apps/marketing/app/product/`	Overlapping IA: `how-it-works`, `security` in both; `the-adaptive-spine` vs `the-adaptive-workspace`.
`apps/marketing` (175 files) vs `apps/web/src/legacy-pages/marketing/` (13 pages)	Two marketing implementations. The `legacy-pages` set is live, dynamically imported by the product app's `route-views.tsx`.

S14 — Stale workspace and registry entries

pnpm-workspace.yaml includes "packages/connectors/*" — but packages/connectors has no sub-packages, only src/ and memory-repo/. Dead glob.
It also includes "packages/projection-engine" redundantly (already matched by packages/*).
Its exclusions reference apps/web-backup-*, apps/web.old, apps/web-frontend-reference — none of which exist.
infrastructure/secrets/registry.yaml lists normalizer and store as DATABASE_URL consumers; normalizer is an empty folder.
netlify.toml exists solely to unconditionally skip Netlify builds for a site that should be disconnected (documented in the file itself).

S15 — Canonical documentation is itself a sprawl surface

AGENTS.md names 16 documents as canonical. docs/architecture/ holds 94 entries, including CANONICAL_ARCHITECTURE.md and CANONICAL_ARCHITECTURE_V4.md and CANONICAL_PLATFORM_ARCHITECTURE.md and CANONICAL_SPINE_CONVERGED.md and CANONICAL_SPINE_SCHEMA_FOUNDATION.md and CANONICAL_ENTITY_CONSTITUTION.md, plus APP_CATEGORY_ENTITY_DOMAIN_MODEL.md alongside a .txt copy of the same. Thirty-three additional status/summary/audit documents sit at the repo root, several of which (CODEBASE_OVERVIEW.md, CODEBASE_STRUCTURE.md, REPO_STRUCTURE_CLARIFICATION.md, CODEBASE_ISSUES_AND_CONFUSIONS.md, SPEC_VS_CODE_GAP_ANALYSIS.md) describe the same territory as this document.

AGENTS.md and CLAUDE.md both correctly declare precedence — the problem is not conflict resolution, it is that 787 markdown files means "read the canonical set first" costs 16 documents before any code is written.

PART III — WHAT IS ACTUALLY LOAD-BEARING

Stripped of everything unreachable, the live system is:

Browser (apps/web — Next App Router)
  │
  └─► gateway            ROUTES prefix table, 66 entries
        ├─ INTERNAL_*    auth · projections · billing · tenants · admin · support · capability-status
        ├─► pipeline     normalize → canonical write (Spine writer #1)
        ├─► spine        Neon canonical CRUD (Spine writer #2)   ⚠ not in CORE_SERVICES
        ├─► connector    router only ──► loader · store · mcp-connector
        ├─► mcp-connector  MCP tools + Descope OAuth server
        ├─► connector-sync scheduled provider sync
        ├─► knowledge    chunk · embed · search · synthesis · promotion gate
        ├─► intelligence think · act · govern · agents
        ├─► workflow     (BFF) views · analytics · stream · HITL DO
        ├─► iw-agent-runtime  TWIN_AGENT + TENANT_BRAIN DOs        ⚠ not in CORE_SERVICES
        ├─► mcp-pool     capability routing control plane          ⚠ shared test/prod
        └─► hub-controller-api  ⚠ AUTH BYPASSED, shared D1, lives in packages/api
  continuity            session log — in CORE_SERVICES but not Gateway-bound;
                        reached via mcp-connector and twin-orchestrator

Shared code that genuinely carries weight: @integratewise/types (99 consumers), @integratewise/connector-contracts (90), @integratewise/connectors (18), @integratewise/lib (23).

Everything else — 11 unbound Workers, ~14 zero-consumer packages, 2 dead Capability Fabrics, 2 orphaned application roots, a retired GCP product, 102 _deprecated components, 5 abandoned service folders — is inert mass.

PART IV — REMEDIATION, ORDERED BY RATIO OF RISK REMOVED TO EFFORT

Tier 1 — Correctness and security (do first)

Close the hub-controller-api bypass (S1). Either fold packages/api into services/ with proper env.test/env.prod and isolated D1, behind Gateway auth — or delete the ["/api", "HUB_CONTROLLER"] catch-all and the bypass branch. As it stands, test and prod share a production database on an unauthenticated path that carries billing and identity.
Repair the 15 dangling bindings (S2) and the 5 test/prod leaks (S3). Then extend validate-platform-deployment.sh to assert, for every binding class, that no env.test target equals any env.prod target and that every service = reference resolves to a declared name =. This converts S2/S3 into a permanently-caught class of error rather than a one-time cleanup.

Tier 2 — Restore a single truth

Decide the Spine writer (S8). services/pipeline/src/spine/ is self-labelled legacy with Supabase tables. Delete it or promote it, but stop running two writers. Then add spine to CORE_SERVICES — the Gateway already depends on it.
Normalise environment vocabulary (S4). Convert the eight staging/production services to test/prod; give signals and telemetry a test surface. Delete both root wrangler.toml and wrangler.jsonc — neither is valid, neither is used. Delete ci-cd.yml.
Consolidate the migration ledger (S9). One root, one sequence, no duplicate numbers. Per-service migrations/ for Worker-local D1 is defensible; seven overlapping global roots is not.

Tier 3 — Delete inert mass (mechanical, large surface reduction)

packages/{ui,design-system,contracts,domain-shells,knowledge-bank-ui,coda-pack,handoff-adapters,hermes-spine-memory,adapters,analytics,webhooks,spine-schema-generator} — ~200 tracked files, zero consumers.
packages/core or packages/lib/capability-fabric — pick one to delete outright; extract only the types apps/web actually imports into @integratewise/types (S5).
services/knowledge/server, services/{mcp-connector,loader}/src/lib/firestore.ts, configs/root/firebase.json (S11).
apps/web/{index.html,vite.config.ts,vite.config.d.ts,vite-plugins/,src/main.tsx,src/App.tsx,src/routes.tsx} and the vite devDependency; fix apps/web/vercel.json (S10).
apps/web/src/components/_deprecated/ — 102 files (S10).
Empty/untracked service folders: act, govern, think, normalizer, governance-state, core-engine, huggingface-inference, ai-provider-mcp; local packages/*-backup-* (salvage the eight modules unique to lib-backup first, or confirm they are intentionally dropped).
Stale pnpm-workspace.yaml globs and exclusions; configs/root/; netlify.toml after disconnecting the site (S14).

Tier 4 — Vocabulary and surface discipline

Rename the L-layer trees (S6). components/l1 → the projection/domain vocabulary; l2 → signal/insight; l4, l7, layers → their kernel terms. Fix the rendered string in releases-view.tsx:141. Rewrite the L4 passage in the Twin's system prompt — it currently shapes model reasoning. Rename /api/v1/cognitive/* to kernel terms, or document "cognitive" as a sanctioned alias.
Collapse to one Workbench URL namespace (S7). Keep /workbench/…, 301 the other three. Delete app/workspace/.
Retire apps/web/src/legacy-pages/marketing/ in favour of apps/marketing; resolve the platform/* vs product/* overlap inside apps/marketing (S13).
Add "private": true to the 16 unmarked packages; make release:packages:check fail on any non-private package other than sdk and spine-schema (S12).
Prune the canonical doc set (S15). Sixteen canonical documents is a barrier to architectural fidelity, not a guarantee of it. One lock, one implementation contract, one vocabulary reference; everything else moves to docs/archive/.

Tier 5 — Decide the orphans

Eleven Workers have zero inbound bindings: agent-registry, hermes, integration-management-mcp, marketplace-installation, provider-management-mcp, schema-ai, signals, telemetry, twin-orchestrator, vercel-mcp. Each needs an explicit verdict — wire, archive, or delete. hermes is one of the 13 stages of the frozen runtime sequence yet is unreachable and still points at integratewise-bff, a Worker that has never existed. twin-orchestrator is 3,470 lines of the Twin's cognitive layer with no caller.
apps/mobile and apps/desktop are 10 files combined. Either fund them or move them to docs/archive/ so the workspace stops building them.

Appendix — Method and confidence

Every claim above rests on one of five mechanical checks, all reproducible:

find inventory of every folder with build output, node_modules, and release tarballs excluded.
Set difference between all name = declarations and all service = references across the 30 service wrangler.toml files → S2, S3.
grep -rl "@integratewise/<pkg>" across apps/*/src, services/*/src, packages/*/src, excluding the package's own directory → consumer counts, S3c, S5, S12.
git ls-files <path> | wc -l → distinguishes committed drift from local working-tree residue. This is why packages/*-backup-* and the empty service folders are classified as residue rather than drift, and why _deprecated (102), packages/ui (70), and services/knowledge/server (15) are classified as committed.
Direct read of the cited line in the cited file for every quoted string.

Not covered: runtime behaviour, deployed Worker state on Cloudflare (the account may hold Workers absent from this tree, and vice versa), test pass rates, and the substance of the 787 markdown documents beyond their inventory and precedence declarations.