Canonadr

ADR-2026-09-04-06 — External systems remain authoritative; IntegrateWise connectors are projections

Status: ACCEPTED — 2026-09-04 (founder direction: "we connect the already-connected"; Auth-Ecosystem entry model; host-aware continuity spec §10)

Context

An integration product's default failure mode is becoming another stale integration: copying
credentials, duplicating connections, and snapshotting data that silently diverges from reality.
The business's tools are already connected — to hosts, to each other, to SaaS ecosystems.

Decision

  • Source systems remain authoritative for their own operational transactions. The Spine is
    the governed cross-system business context — it connects their meaning; it does not replace
    them.
  • IntegrateWise connectors are projections of already-owned connections (host-owned or
    Integration-Manager-owned): per-workload projections (workbench read, loader sync, Twin search,
    approved write) carrying scopes, approval requirements, retention, classification, rate limits
    and revocation state — never copied credentials, never wider permissions than the host allows.
  • Host-first access: confirmed host-native capabilities are preferred for reads and
    policy-approved writes; IntegrateWise connectors are the managed completion for gaps;
    connection duplication is avoided unless policy explicitly requires it (ConnectionBinding maps
    host connection ↔ canonical principal ↔ optional IW integration).
  • The Connector Marketplace first discovers eligible tenant connections and offers connection
    reuse    ; shared catalog metadata never means shared credentials or shared customer data.
  • Staleness is governed, never silent: sync state, freshness validation at hydration, visible
    freshness degradation on revocation, and reconciliation of every material outcome.

Alternatives considered

  • Build first-class connectors for everything — rejected: credential sprawl, N×M integration
    growth, and a second connection estate to maintain.
  • Treat the Spine as the system of record for operational transactions — rejected: creates the
    stale-copy failure mode and breaks source continuity.

Consequences

Connector work is judged by projection hygiene (scopes, revocation, freshness), not by coverage
alone. Revocation must visibly degrade freshness and disable route-dependent capabilities without
destroying organizational history (register G-21).