Tech debt

ID	Severity	Finding	Evidence	Suggested remediation
TD-CRS-01	High	Polling-duplex binding is incomplete: the WSDL policy requires netdx:Duplex MultipleMessagesPerPoll, but the generated customBinding in app.config contains no polling-duplex binding element. A desktop .NET client built from this configuration would lack the duplex-polling behavior the service requires; polling duplex is a Silverlight client-side binding element that full .NET Framework does not ship	service.wsdl:6; app.config:38-41	If a caller is ever introduced against the polling-duplex endpoint, add the missing binding element or switch to the wsDualHttpBinding endpoint instead
TD-CRS-02	Medium	Ambiguous configuration: two endpoints (PollingDuplexHttpBinding_IAgentStateService, WSDualHttpBinding_IAgentStateService) share the same contract with no endpoint name a caller must supply; IClientAccessPolicy has no endpoint at all, and no binding or port is declared for it in the WSDL	app.config:71-72; service.wsdl:48-139	Consolidate to one endpoint per intended use case, or document why two coexist; add an IClientAccessPolicy endpoint if that contract is ever needed
TD-CRS-03	Medium	Dead generated proxy: the duplex service reference (Reference.cs, 2 WSDL files, 6 XSD files, 1 .datasource file) is compiled and shipped in SAIF.Services.Web.Proxies.dll with no in-repo consumer, and no type implements the required IAgentStateServiceCallback callback contract	Services/SAIF.Services.Web.Proxies/Service References/CallRexState/	Remove the service reference if no consumer is planned, or document the intended external consumer and its callback implementation
TD-CRS-04	Low	Timeouts declared only on the wsDualHttpBinding endpoint; the customBinding (polling duplex) endpoint uses WCF defaults if it were ever used	app.config:38-41,44-48	Set explicit timeouts on both bindings before any caller is introduced
SEC-CRS-01	High	Both configured endpoints use plain HTTP with no authentication and no message security (wsDualHttpBinding sets security mode="None"; the custom binding declares no security element at all). Unlike the sibling CallRex endpoints, no service identity (userPrincipalName) is declared either	app.config:38-41,47,71-72	Require TLS transport and an authentication mechanism before any caller is introduced
SEC-CRS-02	Medium	The feed exchanges user GUIDs (requestingUserId) and real-time agent activity state (RealtimeUserState), which is potentially personnel activity data, over an unauthenticated, unencrypted channel if ever used	Silverlight.xsd:9,56; app.config:38-41,47,71-72	Treat as sensitive personnel data; apply the same transport/authentication remediation as SEC-CRS-01 before use

Runtime applicability gap

A class library's app.config is not read at run time by a consuming host*. A host would need to copy this <client> block into its own configuration file — no host in this repository does so, so the two configured endpoints documented here are inert unless and until a consumer performs that step.

Related documentation

• Client index
• Overview
• Architecture
• Contract
• Operation map
• Client reference
• Consumption
• Dependencies

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

• Services/SAIF.Services.Web.Proxies/app.config
• Services/SAIF.Services.Web.Proxies/Service References/CallRexState/service.wsdl
• Services/SAIF.Services.Web.Proxies/Service References/CallRexState/Silverlight.xsd
• Services/SAIF.Services.Web.Proxies/SAIF.Services.Web.Proxies.csproj