Neon Law | The external surface — every third party, in one place

The external surface — every third party, in one place

Neon Law Navigator's runtime external surface has these services, in two kinds — platform services (the cloud the stack runs on) and feature vendors (each lights up one capability and stubs out cleanly when unconfigured):

Service	What it gives you	Kind	At boot
Google Cloud	Storage, OIDC, archive	platform	required — provisioned by `navigator ops gcp setup`
Restate Cloud	Durable workflow execution (`workflows-service`)	platform	required — the workflow broker
Vertex AI	The A2A agent-router LLM (Gemini Flash in prod)	platform	optional — `NullRouter` until configured
GitHub	Private per-Project repositories	platform	required in the requested cloud topology
DocuSign	E-signature	feature	CI-harness stub; required in a normal dev deployment and production
Xero	Accounting / billing (`ACCREC` invoices)	feature	`StubBillingProvider` until `XERO_*` is complete
SendGrid	Outbound + inbound email	feature	CI-harness capture; otherwise required

Presenter notes

The full catalog, with env prefixes and the per-environment account rule, is docs/third-party-integrations.md — the table above is the deployer's-eye view of it. Garage is the default open store for local and on-premises installs, while the S3 contract permits any conforming endpoint. The single-node Garage shape in KIND is disposable developer infrastructure, not a production HA topology. Two things worth saying out loud for a copyist:

Non-production boots with the canonical catalog; deployed integrations fail closed. The explicit local CI harness needs none of the feature vendors: it captures email and uses in-process stubs, while Garage, SurrealDB, Rauthy, and Restate run in KIND. Cloud staging and production instead require configured SendGrid and DocuSign accounts at boot. Test-only records stay inside the harness's isolated database schema.
One provider attachment per deployment. Staging attachments point only at sandboxes and production attachments point only at live accounts. A provider tenant may hold several attachments when that is its native model, but credentials, webhooks, senders, data partitions, and smoke evidence remain per deployment. That convention lives in docs/provider-environment-parity.md, docs/third-party-integrations.md, and docs/docusign-esignature.md.

One boundary worth naming: Xero reconciles against the firm's bank (Mercury) inside Xero — Neon Law Navigator never speaks to Mercury. Our only integration edge is the Xero API. That is the shape to copy: integrate the system of record, not everything it in turn connects to.

View all slides Open display