Unclassified
Repository Boundary Audit
Date: 2026-08-01
Governing spec: THREE_REPOSITORY_ARCHITECTURE_SPEC.md, IMPLEMENTATION_CONTRACT_v1.1.md, ARCHITECTURE_LOCK.md
Summary
Both named repositories are significantly over-scoped relative to their canonical channel roles. Neither is ready for integration as a microfrontend zone or a standalone security authority. The integration work must begin with ownership migration, not routing configuration.
iw-spine-network-mcp
What it actually contains
| Area | Files | Finding |
|---|---|---|
| Auth context | lib/auth-context.tsx, components/core/auth/ | Own mock session — localStorage-backed, independent of Clerk/Gateway |
| Workbench shell | components/iw/layouts/workspace-shell.tsx, components/iw/views/* | Full second Workbench with 12+ domain views (admin, governance, chat, approvals, brainstorming) |
| Projection/command runtime | components/iw/state/runtime-contracts.ts, use-hydrate-projection.ts, use-intent-command.ts | Canonical-quality contracts; these are Keep / promote to shared package |
| Onboarding | components/activation/onboarding/*, components/iw/onboarding/* | Role-domain onboarding covering 10 roles — Move to Platform activation |
| L1 domain views | components/l1/* (account-success, bizops, finance, marketing, etc.) | Platform Workbench domain views — Move to platform repo |
| MCP tooling | None found | Missing — the MCP channel itself (19 tools, OAuth resource discovery, MCP transports) is absent |
| Direct DB/service coupling | None confirmed in surface code; auth context is mock | Coupling risk is low, but resolved identity is also mock |
| Surface contracts | components/iw/config/surface-backend-contracts.ts, spine-table-map.ts | Valuable — Keep / promote |
Verdict
This is a Workbench prototype, not an MCP channel. It contains the right projection/command runtime types and surface contracts but none of the actual MCP channel code (tool definitions, OAuth protected-resource server, MCP transports, tenant-bound access tokens). It should be treated as a migration source for:
- Projection runtime types →
packages/projection-contracts - Surface/table contracts →
packages/platform-sdk - Domain views →
apps/platform/app/(shell)/* - Onboarding flow → Platform activation module
The mock auth context and second Workbench shell must be retired after migration. No MCP tooling should be built in this repo until the canonical MCP channel role is properly scoped.
Keep / Move / Retire map
| Path | Decision | Destination |
|---|---|---|
components/iw/state/runtime-contracts.ts | Keep → promote | packages/projection-contracts |
components/iw/config/surface-backend-contracts.ts | Keep → promote | packages/platform-sdk/contracts |
components/iw/config/spine-table-map.ts | Keep → promote | packages/platform-sdk/contracts |
components/core/hydration/use-hydrate-projection.ts | Keep → promote | packages/react-sdk |
components/core/hydration/use-intent-command.ts | Keep → promote | packages/react-sdk |
components/l1/* (all domain views) | Move | apps/platform/app/(shell)/ |
components/activation/onboarding/* | Move | Platform activation module |
components/iw/onboarding/* | Move | Platform activation module |
components/iw/views/* | Move | apps/platform/app/(shell)/ |
components/iw/layouts/workspace-shell.tsx | Move | apps/platform/components/shell/ |
lib/auth-context.tsx | Retire | Replace with Clerk + Gateway identity |
components/core/auth/auth-provider.tsx | Retire | Replace with Clerk provider |
components/core/auth/login-page.tsx | Retire | Clerk-hosted or platform auth flow |
app/(auth)/login/page.tsx | Retire | Auth owned by Clerk/Gateway |
components/iw/state/role-context.tsx | Retire | Role resolved by Gateway projection |
components/iw/state/workspace-store.tsx | Retire | Workspace state from Gateway discovery |
components/dialogs/* | Evaluate | Keep if MCP-specific; move if Workbench |
app/(app)/domains/* | Evaluate | Move if Workbench domain; scope to MCP fallback |
| MCP tools (absent) | Build | After role is scoped: exactly 19 tools, OAuth resource server |
iw-one-auth-ecosystem
What it actually contains
| Area | Files | Finding |
|---|---|---|
| Identity | app/auth/login/page.tsx, app/login/page.tsx | Supabase email/password + demo cookie — not Clerk, competes with platform identity |
| Mock auth | lib/mock-auth.ts (referenced) | Demo credential bypass — Retire |
| Clerk webhooks | app/api/webhooks/clerk/route.ts | Clerk event receiver — potentially Keep / move to platform |
| Connector OAuth | app/api/connectors/[provider]/connect/route.ts, callback/, disconnect/ | Direct provider OAuth execution — Move to Connector Runtime in platform |
| Connector CRUD | app/api/connectors/route.ts, [id]/route.ts | Mock in-memory connector list — Retire mock, Move interface to platform |
| AI/LLM | app/api/ai/chat/route.ts, brainstorm/* routes | LLM routing and brainstorm analysis — Move to platform Hermes/AI layer |
| Cron jobs | app/api/cron/daily-insights/route.ts, hourly-insights/route.ts | Background ingestion — Move to platform reconciliation/ingestion |
| Provider webhooks | app/api/webhooks/{slack,discord,hubspot,asana,health} | Provider event receivers — Move to platform Integration Manager |
| Spine entities/timeline | app/api/spine/entities/route.ts, timeline/route.ts | Direct Spine data access — Move to platform projection API |
| Twin | app/api/twin/route.ts | Digital twin query — Move to platform twin service |
| Data sync | app/api/data-sync/route.ts | Ingestion pipeline — Move to platform reconciliation |
| HubSpot sync | app/api/hubspot/sync/route.ts | Provider-specific sync — Move to Connector Runtime |
| Coda integration | app/api/integrations/coda/* | Provider-specific integration — Move to Connector Runtime |
| Docs index/read | app/api/docs/* | Knowledge indexing — Move to platform knowledge service |
| Website tracking | app/api/website/track/route.ts | Analytics — Move or Retire |
| Webhook scheduler | app/api/webhook-scheduler/trigger/route.ts | Scheduling — Move to platform |
| Platform proxy | app/api/platform/[...path]/route.ts | Catch-all proxy to platform — Retire (routing anti-pattern) |
| Full Workbench UI | app/app/workbench/*, app/deals, app/clients, app/campaigns, etc. | Second full Workbench — Move surfaces to platform or Retire duplicates |
| One Auth trust flow | Not found | Missing — the canonical trust grant / consent / connection reuse flow is absent |
Verdict
This is a second standalone platform, not a One Auth trust layer. It contains Supabase identity competing with Clerk, direct provider OAuth execution that belongs in the Connector Runtime, AI/LLM routing that belongs in Hermes, background ingestion that belongs in platform reconciliation, and a full second Workbench. The canonical One Auth-to-Ecosystem functionality (workspace trust grants, delegated provider access, consent lifecycle, connection reuse) is entirely absent.
Migration priority:
- Highest — Move now: Clerk webhook receiver, provider OAuth flows, provider webhooks, Spine entity/timeline API access
- High — Move after platform APIs exist: AI/brainstorm, cron ingestion, data sync, twin query
- Medium — Move with Workbench consolidation: all UI surfaces
- Retire immediately: mock auth, demo cookie, Supabase identity, platform proxy catch-all, in-memory connector mock
Keep / Move / Retire map
| Path | Decision | Destination |
|---|---|---|
app/api/webhooks/clerk/route.ts | Move | apps/platform/app/api/webhooks/clerk/ |
app/api/connectors/[provider]/connect, callback, disconnect | Move | Platform Connector Runtime |
app/api/webhooks/{slack,discord,hubspot,asana} | Move | Platform Integration Manager |
app/api/spine/entities, timeline | Move | Platform Projection API |
app/api/twin/route.ts | Move | Platform twin service |
app/api/ai/chat/route.ts | Move | Platform Hermes/AI layer |
app/api/brainstorm/* | Move | Platform Hermes/AI layer |
app/api/cron/* | Move | Platform reconciliation/ingestion |
app/api/data-sync/route.ts | Move | Platform reconciliation |
app/api/hubspot/sync, integrations/coda/* | Move | Connector Runtime |
app/api/docs/* | Move | Platform knowledge service |
app/api/webhook-scheduler/trigger | Move | Platform scheduler |
app/api/connectors/route.ts + [id] (mock) | Move interface / Retire mock | Platform Connector Runtime |
app/app/workbench/*, all UI pages | Move | apps/platform/app/(shell)/ |
app/auth/login/page.tsx, app/login/page.tsx | Retire | Clerk-owned auth |
lib/mock-auth.ts | Retire | No mock auth in production path |
app/api/platform/[...path]/route.ts (proxy) | Retire | Anti-pattern; all calls direct via typed SDK |
app/api/website/track/route.ts | Retire or move | Analytics service |
| One Auth trust/consent (absent) | Build | In apps/platform after Clerk+Gateway foundation |
Migration sequence
Immediate (unblock integration)
- Extract
runtime-contracts.tsandsurface-backend-contracts.tsfromiw-spine-network-mcpinto a newpackages/projection-contractsworkspace package — these are canonical quality and already used by the platform's gateway client. - Move the Clerk webhook handler from
iw-one-auth-ecosysteminto the platform — the platform needs Clerk user events to maintainusersandmembershipsin Neon. - Move provider OAuth connect/callback/disconnect routes from
iw-one-auth-ecosysteminto the platform Connector Runtime — these routes touch provider credentials and must live behind the credential wall.
Before building new features
- Remove Supabase identity and mock auth from both repos — Clerk is the only identity authority.
- Remove the second Workbench shells — the platform Workbench is canonical.
- Scope
iw-spine-network-mcpto its MCP channel role only. - Scope
iw-one-auth-ecosystemto the canonical One Auth trust/consent flow only, or retire it and build that flow in the platform.
After foundation is stable
- Build the 19 canonical MCP tools in the MCP channel repo, backed by the Platform SDK.
- Build the One Auth trust/consent/reuse lifecycle in the platform.
- Connect the platform Workbench
/networkroute to Gateway workspace discovery and integration projections.
Gate: do not proceed with Phase 2+ until
-
packages/projection-contractsexists and exportsProjectionEvent,WorkbenchCommand, and cursor types - Platform has a working
GET /api/v1/workspace/discoveryendpoint backed by real Neon data - Clerk webhook handler is in the platform
- Provider OAuth flows are in the platform Connector Runtime
- Neither repo contains competing Supabase or mock auth