ADR-2026-09-04-09 — Host-first capability routing

Status: ACCEPTED — 2026-09-04 (host-aware continuity runtime spec, frozen decisions; Auth-Ecosystem entry model)

Context

One canonical Workbench deploys into many hosts (ChatGPT, web, Slack, Microsoft, embedded,
desktop, customer-hosted, marketplaces, agent hosts). Each host exposes its own identity,
permissions, tools and data. Naive designs either ignore host capabilities (rebuilding every
integration) or trust host declarations without verification (broken at runtime).

Decision

• Create once, deploy anywhere. Domain logic, Projection Engine logic and canonical schemas
  are built once; hosts are adapters. No host-specific forks.
• Host-first access. Spine-complete context. Policy-governed execution. Canonical
  reconciliation.
• Every request is classified before routing (host-local | entity | continuity | cross-system | governance | write, with completeness expectation and governance flag).
• Capabilities are modeled as HostCapability (availability confirmed | declared | unknown;
  declared is never proof of runtime access) and SpineCapability (freshness: live/synced/ historical; authority: system-of-record/canonical/derived).
• Read precedence: confirmed host-native live → Spine canonical → IW-managed live connector →
  Spine Cache/historical → request-connection → unavailable. The resolver may combine routes per
  provider within one request.
• Write precedence: resolve canonical target + policy → proposal → allowed routes → prefer
  confirmed host-native when policy-approved → else Capability Fabric → receipt → normalize →
  reconcile → rehydrate.
• A ConnectionBinding maps host connection ↔ canonical principal ↔ optional IW integration.
  ChatGPT (or any host) orchestrates its own connected apps; the IntegrateWise MCP never assumes
  access to unrelated host-app connections.

Alternatives considered

• Spine-only routing (always go through IntegrateWise connectors) — rejected: duplicates host
  capabilities, slows first value, recreates the integration estate.
• Host-only routing (no canonical layer) — rejected: no continuity, no cross-system context, no
  governance; the isolated-desert outcome.

Consequences

The capability resolver must maintain confirmed-vs-declared availability with observed-at
timestamps; host capability discovery is part of the Discovery Engine's bootstrap contract;
host-native outcomes enter the same Loader/Normalizer path for reconciliation.