Unclassified

Resource Isolation Audit Report

Date: 2026-07-30
Audit Tool: scripts/audit-resource-isolation.ts
Status: 🚨 DEPLOYMENT BLOCKED

Executive Summary

The automated resource isolation guard revealed 468 total violations across the entire platform:

  • 45 Critical: Shared resource IDs between environments (test/prod sharing same resources)
  • 423 Errors: Empty or placeholder resource IDs
  • 0 Warnings: None

This represents a systemic violation of CLAUDE.md's hardest rule: "test and prod must never share KV namespaces, Queues, or D1 databases."

Critical Shared Resource Violations

Shared D1 Databases (6 unique IDs shared)

Database IDShared By ServicesEnvironments
ed1f534a-df1e-4783-8a74-8d6d70d067ffagent-registry, connector, connector-sync, continuity, folder-watcher, gateway, intelligence, iw-agent-runtime, knowledge, loader, mcp-connector, pipeline, spine, telemetry, tenants, twin-orchestrator, workflowdev, test, prod
6a8b5b3c-18c7-4d0e-aa10-20d0b71a1abcspinedev, test, prod
b829f7b0-7889-43d5-ba65-5ff31a2be8d6workflowdev, test, prod
signal-db-prodsignalsdev, test, prod
placeholder-marketplace-installation-dbmarketplace-installationdev, test, prod

Shared KV Namespaces (14 unique IDs shared)

Namespace IDShared By ServicesEnvironments
8f61d841d2574061ac1d547187d72a58gateway, hermes, workflowdev, test, prod
f7a3d773ff2841f7954d3cfeae82594fconnector, connector-sync, gateway, tenants, webhook-ingressdev, test, prod
16510bf2287a45d8b24163ddafd3d302connector, loader, mcp-connectordev, test, prod
18aa20dfeb304f0ba592d9070964dd31iw-agent-runtime, pipeline, twin-orchestratordev, test, prod
747166a3165444d1a9c9c8c54abbd93agateway, pipelinedev, test, prod
e80ee409f5be4bf8a9556c0917c113e2gateway, pipelinedev, test, prod
d610b2da55bf437ba90444f93077e1c6gateway, tenantsdev, test, prod
d546c00b8ee84d0497e4a4b3ac661db8knowledgedev, test, prod
194227e14a9844b896cebe6564af3ec1hermesdev, test, prod
5f0718b2fb7048cf97a077f9787651eebillingdev, test, prod
39608aa63c5340bf953575dec34416edworkflowdev, test, prod

Service-by-Service Violation Summary

ServiceCriticalErrorsTotalStatus
agent-registry167🚨 CRITICAL
billing167🚨 CRITICAL
connector21820🚨 CRITICAL
connector-sync2810🚨 CRITICAL
continuity167🚨 CRITICAL
folder-watcher167🚨 CRITICAL
gateway62733🚨 CRITICAL
hermes268🚨 CRITICAL
intelligence167🚨 CRITICAL
iw-agent-runtime2810🚨 CRITICAL
knowledge21820🚨 CRITICAL
loader268🚨 CRITICAL
marketplace-installation167🚨 CRITICAL
mcp-connector2810🚨 CRITICAL
pipeline32124🚨 CRITICAL
schema-ai01515❌ ERROR
signals134🚨 CRITICAL
spine134🚨 CRITICAL
store066❌ ERROR
task-management066❌ ERROR
telemetry134🚨 CRITICAL
tenants3912🚨 CRITICAL
twin-orchestrator21214🚨 CRITICAL
webhook-ingress134🚨 CRITICAL
workflow41216🚨 CRITICAL

Immediate Action Required

1. Fix Critical Shared Resource Violations

Priority 1: Create isolated D1 databases for each environment

  • Create new D1 databases for test and prod environments
  • Update wrangler.toml files with unique database IDs per environment
  • Migrate data from shared databases to isolated ones

Priority 2: Create isolated KV namespaces for each environment

  • Create new KV namespaces for test and prod environments
  • Update wrangler.toml files with unique namespace IDs per environment
  • Migrate data from shared namespaces to isolated ones

2. Fix Empty/Placeholder Resource IDs

Priority 3: Create missing resources

  • Create all D1 databases referenced but not provisioned
  • Create all KV namespaces referenced but not provisioned
  • Create all Vectorize indexes referenced but not provisioned

Priority 4: Fix placeholder IDs

  • Replace placeholder-marketplace-installation-db with real D1 database ID
  • Replace any other placeholder IDs with real resource IDs

Most Critical Services (by violation count)

  1. gateway (33 violations) - Critical infrastructure, most violations
  2. pipeline (24 violations) - Core pipeline service
  3. connector (20 violations) - Connector management
  4. knowledge (20 violations) - Knowledge management
  5. workflow (16 violations) - Workflow orchestration

Deployment Impact

Current State: 🚨 DEPLOYMENT BLOCKED

  • No deployments to test or prod environments can proceed
  • Existing deployments are using shared resources (major security/data isolation risk)
  • Resource conflicts will cause unpredictable behavior in multi-tenant scenarios

Required Before Any Deployment:

  1. Create all missing isolated resources
  2. Update all wrangler.toml files with correct resource IDs
  3. Run resource isolation audit again
  4. Get zero violations across all services
  5. Perform data migration from shared to isolated resources
  6. Test in development environment first

Root Cause Analysis

This situation represents a systemic process failure:

  1. Missing Resource Provisioning Process: No automated resource creation process
  2. Weak Resource Governance: No pre-deployment validation of resource isolation
  3. Manual Resource Management: Manual wrangler.toml editing without validation
  4. No Resource Inventory: No centralized tracking of resource allocation

Needed Process Improvements:

  1. ✅ Automated resource isolation guard (now exists)
  2. ⏳ Automated resource provisioning script
  3. ⏳ Resource inventory tracking system
  4. ⏳ Pre-deployment resource validation in CI/CD
  5. ⏳ Resource isolation policy enforcement

Next Steps

  1. Immediate: Implement resource provisioning script
  2. Short-term: Fix critical shared resource violations
  3. Medium-term: Implement comprehensive resource governance
  4. Long-term: Automated resource lifecycle management

Generated by: scripts/audit-resource-isolation.ts
Audit Date: 2026-07-30
Status: 🚨 DEPLOYMENT BLOCKED