17 — Customer Zero and Company Lifecycle OS
Status: Canonical proof model; acceptance evidence pending per journey
Rule
Customer Zero is production proof, not a privileged shortcut. It uses the same
Clerk, Gateway, account/tenant, Nango, connector binding, schema, Pipeline,
Spine, Projection Engine, Governance, Hermes, sync, and repair paths as every
customer.
The canonical tenant is iw-customer-zero.
Customer Zero is an operating tenant plus an isolated production-shaped
environment. It is not a separate Product, a single special application or a
shared test tenant. It has dedicated credentials, data, queues, caches, search,
evidence and audit boundaries.
Four-flow lifecycle
| Flow | Customer Zero material | Boundary |
|---|---|---|
| A | IntegrateWise operational entities, relationships, events and lifecycle state | Deterministic Normalizer prepares governed candidates. |
| B | Internal messages, meetings, documents, attachments and evidence | Raw bytes remain in R2; extracted meaning retains lineage. |
| C | Twin sessions, model output, plans, proposals, agent outcomes and memory candidates | Triage routes to Promotion Queue and required human approval; no direct truth write. |
| D | Internal identity, tenant, workspace, membership, role, consent, connector, capability and policy bindings | Establishes the authority envelope for A/B/C. |
Operational D1/KV state expires or rebuilds according to policy. Age and
lifecycle closure never promote truth. Governed Spine Writers commit approved
canonical state to the dedicated Customer Zero Neon Fortress.
Required journey
- Clean user signs in through Clerk.
- Gateway resolves active organisation, account, and tenant.
- User opens Integration Manager.
- User installs a launch connector through Nango.
- Gateway persists the complete server-owned binding.
- Initial load and normalisation run.
- Pipeline promotes Connection, Connector, Schema, SyncJob, and TimelineEvent.
- Integration Manager reads the resulting projection.
- Incremental sync or webhook updates the Workbench.
- A deliberate mismatch makes the connection stale.
- Stale state is excluded everywhere.
- Authenticated repair returns the binding to operational.
- Governance and Hermes execute one approved action.
- Outcome is re-ingested, reconciled, and projected.
Golden connector set
Use a small production-ready set:
- GitHub for installation identity, repositories, webhooks, and incremental sync;
- Slack or one collaboration provider for workspace identity and events;
- one CRM or customer system for schema depth, pagination, and sync.
Catalog presence is not acceptance.
Evidence pack
Capture deployment and commit IDs, verified principal and organisation
references, account and tenant, binding and schema IDs, opaque authorisation
reference, provider workspace, Spine Connection, SyncJobs, counts, webhook,
projection, approval, execution receipt, stale/repair proof, correlation IDs, and
timestamps. Exclude secrets and unnecessary personal data.
Company lifecycle
Customer Zero work follows:
Sense → Frame → Decide → Build → Verify → Release → Operate → Learn → Adjust
Work advances when state-specific evidence and exit criteria exist, not because
activity was recorded.
Only reviewed code, schema, configuration and policy artifacts may move from
Customer Zero validation into Customer Production. Customer Zero data, memory
and evidence never do.