Date: 2026-07-31
Source: services/gateway/wrangler.toml vs services/gateway/src/index.ts Env interface
1. Env Interface vs Actual Bindings
| Binding | Required | Dev | Test | Prod | Status |
|---|
CONNECTOR | ✅ | connector | connector-test | connector-prod | ✅ |
MCP_CONNECTOR | ✅ | mcp-connector | mcp-connector-test | mcp-connector-prod | ✅ |
PIPELINE | ✅ | pipeline | pipeline-test | pipeline-prod | ✅ |
INTELLIGENCE | ✅ | intelligence | intelligence-test | intelligence-prod | ✅ |
KNOWLEDGE | ✅ | knowledge | knowledge-test | knowledge-prod | ✅ |
BFF | ✅ | workflow | workflow-test | workflow-prod | ✅ |
AGENT_RUNTIME | ✅ | iw-agent-runtime | iw-agent-runtime-test | iw-agent-runtime | ⚠️ PROD = DEV |
HUB_CONTROLLER | ✅ | hub-controller-api | hub-controller-api | hub-controller-api | ❌ SAME ALL ENV |
ADMIN | ✅ | integratewise-admin | integratewise-admin-staging | integratewise-admin | ✅ |
BILLING | ✅ | integratewise-billing | integratewise-billing-staging | integratewise-billing | ✅ |
TENANTS | ✅ | integratewise-tenants | integratewise-tenants-staging | integratewise-tenants | ✅ |
CONNECTOR_SYNC | opt | connector-sync | connector-sync-test | connector-sync-prod | ✅ |
SPINE | opt | integratewise-spine | integratewise-spine-test | integratewise-spine-prod | ✅ |
MCP_POOL | opt | integratewise-mcp-pool | integratewise-mcp-pool | integratewise-mcp-pool | ❌ SAME ALL ENV |
MARKETPLACE_INSTALLATION | opt | integratewise-marketplace-installation | ...-test | ...-prod | ✅ |
WEBHOOK_INGRESS | opt | integratewise-webhook-ingress | webhook-ingress-test | integratewise-webhook-ingress | ✅ |
FOLDER_WATCHER | opt | — | folder-watcher-test | folder-watcher-prod | ✅ |
2. Services with wrangler.toml but NO Gateway Binding
| Service | Has code | In ROUTES | Verdict |
|---|
| hermes | ⚠️ Points to dead Worker | ❌ | ❌ UNREACHABLE — stage 11 of frozen sequence |
| agent-registry | Minimal scaffold | ❌ | ⚠️ Orphan |
| continuity | Session event log | ❌ | ⚠️ Via mcp-connector chain |
| loader | Connector data loader | ❌ | ⚠️ Via connector chain |
| store | Connector data store | ❌ | ⚠️ Via connector chain |
| signals | Signal processing | ❌ | ⚠️ Orphan |
| telemetry | Observability | ❌ | ⚠️ Orphan |
| twin-orchestrator | 3,470 LOC | ❌ | ❌ DEAD CODE — zero consumers |
| integration-management-mcp | MCP server | ❌ | ⚠️ Orphan |
| provider-management-mcp | MCP server | ❌ | ⚠️ Orphan |
| schema-ai | AI schema mgmt | ❌ | ⚠️ Orphan |
| task-management | Task CRUD | ❌ | ⚠️ Orphan |
| vercel-mcp | Vercel integration | ❌ | ⚠️ Orphan |
3. Isolation Leaks (S3)
| Binding | Dev → Test → Prod | Risk |
|---|
| HUB_CONTROLLER | hub-controller-api = hub-controller-api = hub-controller-api | ❌ CRITICAL — unauthenticated /api catch-all same Worker |
| MCP_POOL | integratewise-mcp-pool = integratewise-mcp-pool = integratewise-mcp-pool | ❌ HIGH — capability control plane shared |
| AGENT_RUNTIME | iw-agent-runtime → iw-agent-runtime-test → iw-agent-runtime | ⚠️ MEDIUM — prod = dev |
4. Priority Fixes
| # | Fix | Impact |
|---|
| 1 | Close HUB_CONTROLLER /api bypass OR create per-env Workers | Security |
| 2 | Create per-env MCP_POOL Workers | Isolation |
| 3 | Create iw-agent-runtime-prod | Isolation |
| 4 | Wire or retire hermes | Architecture |
| 5 | Classify 8 orphan services (needed/chain/dead) | Cleanup |