---
title: Tech debt
summary: Known gaps, risks, and follow-up work for this proxy.
status: draft
owner: SAIF.Core documentation
last_reviewed: 2026-09-24
---

# Tech debt

| ID | Severity | Finding | Evidence | Suggested remediation |
| --- | --- | --- | --- | --- |
| TD-CRS-01 | High | Polling-duplex binding is incomplete: the WSDL policy requires `netdx:Duplex MultipleMessagesPerPoll`, but the generated `customBinding` in `app.config` contains no polling-duplex binding element. A desktop .NET client built from this configuration would lack the duplex-polling behavior the service requires; polling duplex is a Silverlight client-side binding element that full .NET Framework does not ship | `service.wsdl:6`; `app.config:38-41` | If a caller is ever introduced against the polling-duplex endpoint, add the missing binding element or switch to the `wsDualHttpBinding` endpoint instead |
| TD-CRS-02 | Medium | Ambiguous configuration: two endpoints (`PollingDuplexHttpBinding_IAgentStateService`, `WSDualHttpBinding_IAgentStateService`) share the same contract with no endpoint name a caller must supply; `IClientAccessPolicy` has no endpoint at all, and no binding or port is declared for it in the WSDL | `app.config:71-72`; `service.wsdl:48-139` | Consolidate to one endpoint per intended use case, or document why two coexist; add an `IClientAccessPolicy` endpoint if that contract is ever needed |
| TD-CRS-03 | Medium | Dead generated proxy: the duplex service reference (`Reference.cs`, 2 WSDL files, 6 XSD files, 1 `.datasource` file) is compiled and shipped in `SAIF.Services.Web.Proxies.dll` with no in-repo consumer, and no type implements the required `IAgentStateServiceCallback` callback contract | `Services/SAIF.Services.Web.Proxies/Service References/CallRexState/` | Remove the service reference if no consumer is planned, or document the intended external consumer and its callback implementation |
| TD-CRS-04 | Low | Timeouts declared only on the `wsDualHttpBinding` endpoint; the `customBinding` (polling duplex) endpoint uses WCF defaults if it were ever used | `app.config:38-41,44-48` | Set explicit timeouts on both bindings before any caller is introduced |
| SEC-CRS-01 | High | Both configured endpoints use plain HTTP with no authentication and no message security (`wsDualHttpBinding` sets `security mode="None"`; the custom binding declares no security element at all). Unlike the sibling `CallRex` endpoints, no service identity (`userPrincipalName`) is declared either | `app.config:38-41,47,71-72` | Require TLS transport and an authentication mechanism before any caller is introduced |
| SEC-CRS-02 | Medium | The feed exchanges user GUIDs (`requestingUserId`) and real-time agent activity state (`RealtimeUserState`), which is potentially personnel activity data, over an unauthenticated, unencrypted channel if ever used | `Silverlight.xsd:9,56`; `app.config:38-41,47,71-72` | Treat as sensitive personnel data; apply the same transport/authentication remediation as SEC-CRS-01 before use |

## Runtime applicability gap

A class library's `app.config` is not read at run time by a consuming host*. A host would need to copy this `<client>` block into its own configuration file — no host in this repository does so, so the two configured endpoints documented here are inert unless and until a consumer performs that step.

## Related documentation
- [Client index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Contract](contract.md)
- [Operation map](operation-map.md)
- [Client reference](reference.md)
- [Consumption](consumption.md)
- [Dependencies](dependencies.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- `Services/SAIF.Services.Web.Proxies/app.config`
- `Services/SAIF.Services.Web.Proxies/Service References/CallRexState/service.wsdl`
- `Services/SAIF.Services.Web.Proxies/Service References/CallRexState/Silverlight.xsd`
- `Services/SAIF.Services.Web.Proxies/SAIF.Services.Web.Proxies.csproj`