Workflows & Integrations QI Hub

1 · Three tiers, one page per tier. This page is the QI Hub (firm owner) tier of the ADR-053 matrix: it elects, enables, pauses and tunes within declared bounds, and holds the org integrations and their credentials. Platform Ops declares the catalog, the bounds and the mandatory classes and owns the platform rails (KYC, OFAC, bank feed, e-sign of platform instruments) — visible here, never settable here. QI Ops runs what this page permits and has no read path to a credential at any field. The gate is requireOrgAdmin; the platform-admin short-circuit in that gate is a decided-not-built exclusion (SOC2-CC6.1-012), so until it lands the honest statement about the signing secret is "audit-logged", never "only your firm can see it".
2 · Provenance is a resolver output, not a label the UI invents. effective(key) = platform ⊕ org ⊕ user, narrow-only, absence-means-inherit; every resolved value carries its tier. "Set by Open1031" renders when the org row is absent or the class is mandatory; "Set by your firm" when an org_policy_override row exists. The Use Open1031 default link deletes the override row — it does not write the default value back, or provenance would lie. Bounds ("every 2–10 days") are declared by the platform template and rendered from it.
3 · Mandatory is a class, not a disabled toggle. A mandatory row renders the reason in place of the action and has no pause path at any tier below Platform Ops; an unpause of a mandatory class, and any widening of a QI-Ops pause grant, stay on this tier. Row order and category (Automation / AI / Infrastructure / Security) follow docs/VECTR_WORKFLOW_CATALOG.md; product names here map to catalog events — kickoff → exchange.created / kickoff_completed, deadline notices → deadline_45day_warning / deadline_180day_warning, document reminders → document_reminder, signature → document.esign_requested / document_signed, CPA report → report.generate / report_delivery_completed, communications → communication.send_requested, Neela → neela.action_requested / neela.escalation_requested, 8824 → document_8824_generated, extraction → document_extracted, KYC → kyc_passed / kyc_failed, screening → screening.run / ofac_hit, fund approval → the constructive-receipt firewall (FORBIDDEN_FUND_MOVING_*). A workflow whose producer does not run for the firm renders Unavailable for your firm with what does happen instead — never a build term, never a promise.
4 · The CRM setup half lands here; the activity half stays in QI Ops. Per ADR-053 §4.6 the enablement toggle (issue 2705's org_integration_connection writer, capability crm_intake), the signing secret, its rotation and the field mapping move to this page; incoming events, acceptance, retries and the test-event affordance remain in surfaces/qi-crm-sync-settings.html, which should lose its credential and mapping blocks in the follow-up edit. The secret is Open1031's own inbound secret — the one named exception to "the platform holds references only" — stored as a hash, shown in full exactly once, rotated additively with the prior secret valid for 24 hours. There is no Reveal: a hash cannot be revealed, and the earlier surface's Reveal button was a defect. Field mapping is database configuration; only Open1031-default rows may be re-derived.
5 · Credentials are references. Every provider connection on this page renders from credential_reference — { vault, executing_account_ref, connection_ref, fingerprint, masked_hint, expires_at, verified_at } — and no field of that shape may hold a third-party secret. The e-sign, storage and title rows show fingerprint, masked hint, verified and expiry only. Connect flows go through the provider's own sign-in; a password field for a provider anywhere on this page is a rejection.
6 · Tenancy is an election with two preconditions. vectr_tenancy ∈ {shared, byo} is elected here and provisioned by Platform Ops — hence Request a review, not a switch. No org row may carry byo until the outbound fund refusal is hoisted to the pre-provider choke point and the platform-admin exclusion exists (ADR-053 §3). The attestation sentence in the card ("attested by your firm, not enforced by Open1031") is a required disclosure under AGENTS.md § Product UI copy class 3 and is removed by shipping observability, never by editing the copy. A BYO firm whose audit forwarding stops enters the degraded state drawn above with the audit row as the delayed one.
7 · Every state, from the states gallery. Loading is skeleton rows plus the topbar pill — never a spinner. Empty is the CTA card above the hint, never absent; the workflow list is never empty because platform defaults always exist, so empty means "nothing set by your firm and no runs yet". Error keeps the workflows running on last-saved settings and says so; the banner carries the request id and the recovery actions. Degraded is the return leg behind: the facts strip shows the last confirmed check, last-run cells show the last confirmed run, the audit row shows the lag, and deadline notices are called out as unaffected because they are computed from the file, not from this feed.
8 · Every write here is audited. Enable, pause, resume, override, revert, connect, disconnect, secret issue / copy / rotate / end, mapping change, tenancy request and version consent each write an audit_log row with actor, timestamp and IP, forwarded to the audit spine — identically on both tenancy paths. The Change history button opens that filtered log.
9 · Chrome and vocabulary stay on the firm's side. This is a QI Hub page: the rail carries the QI Hub tier accent, "Set by Open1031" is a product-terms provenance, and nothing here names Platform Ops, a dead-letter queue or a cross-tenant count. The same workflow names appear in surfaces/vectr-ops.html from the platform's side. The embed console's rail lists "CRM Intake" under Growth; with this page it folds into Configuration › Workflows & Integrations, and that rail should be updated when the embed console is next touched.
Fully tokenized against ../tokens.css — no raw hex, no inline color outside token references, no new [PROPOSED] token. The --console-rail-tier-* family is shared with the embed console and is listed in designTokens.test.ts the same way. Light and dark are both designed. All firms, people, references, endpoints, secrets and figures are synthetic. Summit QI Services is a fictional firm. Demo date: Fri Sep 4, 2026.