The end-to-end integration path is not released
The complete integration described here is planned and not callable. Local development components exist, yet there is no hosted customer environment or released cross-provider contract behind this page.
- Current evidence: Repository code exposes development endpoints for workspaces, reveal-once hashed API keys, connected-account records, commands, events, webhook endpoints, and Google auth intents. A partial TypeScript SDK and static console exercise part of that local control plane.
- Target contract: A server creates a tenant-scoped integration context and keeps each customer identifier opaque and immutable; An end user authorizes a provider through a bounded connection flow, after which reads, writes, and events carry the resulting account identifier; Common resources remain stable while provider extensions preserve behavior that cannot be normalized honestly
- Known limits: The current Compose topology is a single-host development package without production ingress, KMS, backups, high availability, or operated service evidence; Provider routes have different release states, and adding a shared account record does not make an unreleased provider method usable
- Release gates: Publish a versioned REST contract, scoped authorization model, lifecycle policy, and executable examples for every released method; Complete production tenancy, secret custody, monitoring, backup restoration, and incident-response evidence; Qualify each provider separately through policy review, sandbox faults, and consented real-account conformance