10 — Customer Zero MCP Pool UI

Status: Restricted Customer Zero operator handoff

Scope

This is an internal operational projection for authorized IntegrateWise
Customer Zero/Platform operators. It is not the public MCP product surface and
is not automatically available to customer-production tenants.

Required views

• registered servers/tools and version;
• health, latency, failure rate and last probe;
• tenant/user allowlists and deny reasons;
• resolver route and fallback state;
• authorization binding and credential-reference health;
• invocation/audit trace with redacted arguments;
• quarantine, disable and version-promotion controls.

The internal pool may contain 55 registered capabilities. The published IW
Spine Tools MCP remains exactly 19 semantic tools. The UI must always label
which boundary is being viewed.

Control rules

• Reads require Customer Zero operator RBAC.
• Any route/policy/version mutation creates a governance proposal.
• Credential material is never rendered.
• Invocation replay uses a new trace and idempotency context.
• Disabled or unhealthy tools cannot be advertised as available capabilities.

Environment rule

Development, Customer Zero and Customer Production registries, credentials,
queues, operational state and audit streams are isolated. Configuration may be
promoted as a versioned artifact; runtime data and memory never move between
them.