Superseded

Total End-State Contract

Status: SUPERSEDED AS ARCHITECTURE AUTHORITY — reference-only enforcement lineage.
Current authority is INTEGRATEWISE_ARCHITECTURE.md
v2.2. The JSON below may remain useful to a validator only where it is compatible with
the canonical authority and amendment.

The JSON contract is the machine-readable enforcement source. This document
explains its requirements; a later runtime task consumes the JSON contract or
the validator rather than attempting to infer architecture from this prose.

Host and runtime ownership

www.spineworkspace.com, auth.spineworkspace.com, and
platform.spineworkspace.com are separately owned shared surfaces:
apps/marketing, apps/auth, and apps/platform, respectively.

The 18 named operational hosts are all projections rendered by the one
apps/web runtime. A request resolves through:

Browser → Gateway → Projection Engine → Spine

The Gateway derives the allowed context before the Projection Engine composes
the Workbench. Browser code never reads a database, object store, cache,
vector store, or provider directly. Unknown hostnames return an
unconfigured-projection response and fail closed; they never select a different
operational projection.

The Projection Engine composes every operational Workbench from
hostname × role × department × industry × active entity/work × policy × permissions × available capabilities. Common navigation is shared across the
operational hosts, Work navigation comes from the active projection, and
Platform navigation belongs to platform.spineworkspace.com and apps/platform.

apps/web is the single operational projection runtime. It must not recreate a
donor application boundary: copied donor shells, copied donor authentication,
direct database clients, and provider-specific backend assumptions are all
prohibited there. Donor applications are not independently deployed to supply
an operational host.

Boundaries and continuity

Reads are governed reads. Writes are governed writes: intent becomes a
proposal, policy and matching authority determine whether it may be approved,
and an owning integration or host executes only the authorized action. Outcome
receipts reconcile into the Spine.

The governed write path is fixed:

Browser/Twin → governed command → Capability Fabric → owning integration/host
→ reconciliation → Spine

Host-owned credentials and secrets stay inside their owning host. The Spine
network may receive only descriptors, opaque route references, intent, bounded
context, evidence, approval, execution status, and results.

Knowledge is curated knowledge and Memory is bounded continuity memory. Neither
is operational truth, and neither silently becomes the other.

Capability (registered operation), Tool (invocation interface),
Integration (credential-boundary connection), and Action
(governed proposed or authorized effect) are separate contracts.

Supersedes

This contract supersedes:

  • fixed per-role Entity 360 navigation;
  • Twin ONLY reads Entity360;
  • global/sticky four-button controls;
  • role workbook Role domain entity classification;
  • direct browser database/provider reads;
  • independent donor app deployment; and
  • generic fallback to another projection when hostname resolution fails.