Consolidation Handoff Ledger — 2026-08-13

Objective

Safely consolidate the fetched v2.2 baseline with valuable local IntegrateWise work using a cherry-pick-led integration branch. Preservation precedes integration. Public marketing remains separate from the authenticated Workbench and must not expose Brand Store, Book of Records, or Org Memory as public solution routes.

Direct-main state

• Canonical local project checkout: /Users/nirmal/Github/integratewise-v22-integration
• main: 4a71e2c53b46a64fb69a246090e86f111b50dc82, based on fetched v2.2 and containing 15 local consolidation commits.
• Upstream fetched baseline: origin/main = 9aa0be03aa2e27e2e8453754b243125f885879fe
• The canonical local main is clean and 15 commits ahead of origin/main. The former direct checkout at /Users/nirmal/Github/integratewise-live now deliberately uses recovery/main-pre-v22-consolidation-20260813 at bcc32af33; it is retained as a recovery reference, not the active project folder.

Safety references

All refs below are under refs/safety/20260813-pre-cherrypick/:

Reference suffix	Commit	Meaning
direct-main-head, direct-main-orig-head	bcc32af33	Local same-day main tip before the aborted merge.
incoming-v22-merge-head	9aa0be03a	Fetched v2.2 incoming tip.
recovery-e521-gtm-docs-20260813	52a7caecf	Preserved GTM/release documentation.
recovery-21a4-v22-doc-consolidation-20260813	b10fcd8f0	Preserved v2.2 architecture-consolidation draft.
recovery-3f4d-host-routing-20260813	2f1ffccd2	Preserved host-routing/Gateway CORS work.
recovery-port-vila-projection-runtime-20260813	bab8f6439	Preserved projection-runtime/marketing worktree changes.
recovery-v22-reconciliation-20260813	dd3a506be	Reconciliation defaults.
codex-end-state-projection-runtime	bdf1a2f08	End-state donor branch tip.
codex-entry-host-grammar-fail-closed-cors	0848408f0	Earlier published host/CORS donor tip.
codex-main-landing-20260811	5a1bfdbc3	Projection-runtime donor tip.
codex-phase2-workbench-extraction	1405f6a56	Revert/donor reference.
supermemory-update*, review-pasted-files	retained refs	Recent marketing/docs donor tips.

Worktrees audited and preservation result

Location	Initial state	Result	Classification
direct main	3 local commits; broad merge started then aborted	preserved by main and safety refs	baseline only
.codex/worktrees/e521/integratewise-live	2 modified docs + GTM doc	committed 52a7caecf	docs donor; taxonomy review needed
.codex/worktrees/21a4/integratewise-live	24 modified architecture docs	committed b10fcd8f0	canonical-doc donor; high authority overlap
.codex/worktrees/3f4d/integratewise-live	3 modified + 6 untracked host/CORS sources	committed 2f1ffccd2	runtime-safety donor
workspaces/.../port-vila	29 projection/marketing/test changes	committed bab8f6439; formatting normalized two files	donor; deletes need review
Github/integratewise-live-end-state	clean branch, 46 ahead/4 behind its upstream	branch tip retained	donor, not automatically mergeable
.codex/worktrees/422f and b22c	stale Gitfile points to missing Kimi checkout metadata	physical directories retained; no alteration	orphaned checkout; requires separate file-level recovery before cleanup
nested apps/marketing-sites	clean separate Git repository	no action	independent clean repository

No staged dirty worktree contained secret-named or generated-file candidates. The old orphaned directories have not been modified or deleted.

Active integration branch and cherry-pick ledger

• Worktree: /Users/nirmal/Github/integratewise-v22-integration
• Branch: integration/v22-cherrypick-20260813
• Base: origin/main / v2.2 9aa0be03a

Order	Source	Destination	Disposition	Validation
1	dd3a506be	caed83271	Applied reconciliation/defaults record.	git diff --check; commit hook.
2	2f1ffccd2	2e348b0fa	Applied host grammar, non-forgeable hint headers, shared parser, fail-closed CORS. Three overlapping v2.2 files resolved in favor of the safety implementation; all nonconflicting v2.2 remains.	git diff --check; commit hook. Focused runtime tests pending.
deferred	2187bc915	none	Cherry-pick aborted after 15 authority-sensitive conflicts across marketing, docs, navigation, contracts.	Must be split into focused groups; no content lost.

Decisions and unresolved items

The reconciliation record is V2_2_RECONCILIATION_AND_INTEGRATION_RECORD_2026-08-13.md.

• Adopt v2.2's capability-first Workbench and lifecycle-aware projection model.
• Retain Spine-first truth, tenant/policy gates, credential isolation, Governance, approval/action separation, and outcome reconciliation.
• Capability declarations are not proof of executable provider actions until eligibility, handler, receipt, and reconciliation are evidenced.
• The current priority-by-priority state and next test order are maintained in CAPABILITY_EXECUTION_EVIDENCE_MATRIX_2026-08-13.md.
• Founder decisions remain required for external SpineWorkspace brand/domain authority, final documentation precedence/filename, and alias-to-URL policy for v2.2 domain names.

Conversation-consolidation record

This is the verified, task-relevant continuation record for the Spine Workspace Priority Plan. It intentionally excludes raw conversation material and unverified claims.

Product doctrine and non-negotiable boundaries

• There is one authenticated Workbench with contextual role/department/lifecycle projections, not independent truth-owning applications. Hostnames may request a projection but never establish tenant, user, role, workspace, or credential authority. Evidence: imported packages/workbench-config/src/entry-hosts.ts, apps/web/lib/entry-context.ts, apps/web/proxy.ts, and services/gateway/src/cors.ts in 2e348b0fa.
• The canonical Spine/business context remains governed operational truth; bounded cache/memory/projections are reconstructable or subordinate. Credentials remain host/vault owned and must not be replicated into frontend projections. Evidence: local INTEGRATEWISE_ARCHITECTURE.md, incoming v2.2 architecture, and V2_2_RECONCILIATION_AND_INTEGRATION_RECORD_2026-08-13.md.
• Silent Twin is a contextual, governed inline product capability. It may reason, draft, and propose but has no autonomous authority, self-approval ability, provider credential ownership, or direct canonical-write permission. Evidence: v2.2 §§7–9 and reconciliation D-05.
• Governance separates proposal, approval, action, audit/evidence, and reconciliation. Consequential external mutations default to approval-required. Evidence: incoming EXECUTION_MODE_TOOL_CAPABILITIES.md; not all declared handlers are runtime-proven.

Marketing public/internal taxonomy and visual/content work

• Marketing is public and separate from Workbench/platform control. Public host landings are marketing projections only. Brand Store, Book of Records, and Org Memory are internal-only and must never become public marketing solution routes. Source-only product decision confirmed in the plan; preserve it during route reconciliation.
• Local same-day marketing work is committed in 2187bc915, fae942fb9, and bcc32af33; it covers subdomain-specific public landing routing, evidence-led positioning, public/internal taxonomy, and marketing visual/content refinement. Those commits remain preserved at direct main and safety refs, but their broad cherry-pick is deferred because it conflicts with v2.2 marketing/docs/navigation authority.
• Marketing tests previously reported passing for the local package (12/12); lint passed with pre-existing image warnings. These are historical validation reports, not re-run evidence for the v2.2 integration branch.

Bounded Spine/MCP/capability proof and non-claims

• v2.2 makes Tool Capabilities first-class in normative architecture and adds declarative domain capability inventories under packages/workbenches.
• The evidence standard is deliberately stricter: a declaration does not prove a live provider action. It requires context/eligibility, schema/connector binding, Governance and scoped approval where required, bounded handler, receipt/audit, and reconciliation. Evidence: reconciliation record Capability evidence rule and direct source search of declared Sales bindings found declarations but no matching runtime handlers.
• The prior three-flow/Spine/MCP work should be described as bounded, repository-verified contract/runtime evidence only where its tests and code are cited. It must not be inflated into a claim of autonomous execution or universal provider connectivity.

v2.2 comparison and integration posture

• v2.2 adds a formal documentation canon, Product Package model, shared frontend contract, lifecycle-aware execution model, and 18 declarative Workbench domain definitions. It preserves key safety concepts but conflicts with local naming, documentation precedence, host aliases, and public marketing routes.
• Adopt compatible capability-first Workbench improvements while retaining Spine-first context, tenant/policy boundaries, credential isolation, Governance, reconciliation, and public/internal taxonomy. Evidence: V2_2_RECONCILIATION_AND_INTEGRATION_RECORD_2026-08-13.md.

Preservation, Git, and deployment status

• Recovery commits and safety refs are listed above; direct main is clean at bcc32af33, with the earlier broad merge intentionally aborted after references were created. All experimental work occurs only on integration/v22-cherrypick-20260813.
• End-state projection runtime is a retained donor branch (bdf1a2f08), not automatically mergeable; its dirty companion was preserved as bab8f6439.
• Deployment: no deployment, DNS, remote setting, or production mutation was performed in this consolidation phase. Earlier topology notes exist in local documentation, but provider ownership/status must be re-verified before any deployment action.

Founder decisions still open

1. Whether SpineWorkspace is the public brand/primary domain or an IntegrateWise category/runtime term.
2. The final single documentation authority index and canonical filename policy.
3. The compatibility/URL policy for v2.2 aliases including founderops, businessops, productengineering, and orgmemory.
4. Whether to selectively revive the authority-sensitive local marketing/docs commit 2187bc915 after a route-by-route review.

Exact next safe action

Complete the integration-worktree dependency installation and run focused host grammar/CORS, projection, marketing-taxonomy, and capability-contract tests. A first focused attempt (pnpm --filter @integratewise/web test -- lib/entry-context.test.ts) was environment-blocked because this new worktree has no node_modules and vitest was not found; it did not execute a test suite or indicate a source failure. Review CROSS_SURFACE_RECONCILIATION_GATE_2026-08-13.md, then provide the integrated branch for founder review before merging it normally into main. Do not revive the broad merge.

Do not do

• Do not merge or force-push main.
• Do not reset, rebase published history, delete worktrees, prune refs, or delete the orphaned 422f/b22c directories.
• Do not describe a declared Tool Capability as live without handler-to-reconciliation evidence.
• Do not make host-derived tenant/user/role authority or forward credentials from a Host-derived destination.
• Do not expose Brand Store, Book of Records, or Org Memory as public marketing solution routes.