---
title: OBRetentionService tech debt
summary: CRITICAL and HIGH severity findings for the OBRetentionService proxy and its call sites.
status: draft
owner: ProcessOB3PRetention team
last_reviewed: 2026-10-06
---

# OBRetentionService tech debt

The proxy is a small, single-operation consumer with no resilience configuration at all. No credential is configured, so there is no secret-handling finding. Severities below are assigned by the documentation run from the analysis findings; the analysis recorded candidates without ratings.

## CRITICAL

None recorded. No literal credential or secret exists for this proxy.

## HIGH

| Finding | Component | Impact | Recommended action |
| --- | --- | --- | --- |
| No retry, timeout, or cancellation is configured; the binding sets no timeouts and the call is synchronous with no cancellation token | `OnBaseService`, binding in `ProcessOB3PRetention/App.config` | A transient failure surfaces directly and ends the run at the first failing batch; a hung call is bounded only by the transport default | Set explicit binding timeouts and decide on a retry policy |
| Every call sends a hard-coded placeholder document (`text/plain`, literal Base64 content) | `OnBaseService.ProcessRetention` (`ProcessOB3PRetention/Services/OnBaseService.cs:24`) | The archived document content is fixed test content rather than business data | Confirm with the OnBase owners that placeholder content is the intended contract |
| The generated client is never closed or aborted and a fault is not distinguished from other failures | `OnBaseService` | A faulted channel is neither recovered nor released before process exit | Dispose the client with a close-or-abort pattern and handle communication faults explicitly |
| `throw ex;` discards the original stack trace and only the message is logged | `ThirdPartyRetentionProcessor.Execute` (`ProcessOB3PRetention/ThirdPartyRetentionProcessor.cs:64`) | Failures from the SOAP call lose their origin in logs | Rethrow with `throw;` and log the full exception |
| The `long` result is logged but not validated or persisted, and the archive-then-mark sequence is not atomic | `ThirdPartyRetentionProcessor.Execute` (`ProcessOB3PRetention/ThirdPartyRetentionProcessor.cs:52`) | A failure between the two steps leaves a batch sent but unmarked, so a later run could resend it* | Validate the result and make the sequence idempotent or recoverable |
| The endpoint setting has no fallback, and the `App.config` endpoint address is a superseded QA value | `OnBaseService` constructor, `ProcessOB3PRetention/App.config` | A missing `ProcessOB3PRetention.WSPEndPointUrl` fails during container resolution outside the logged `try`; the `App.config` address can mislead a reader into believing QA is always targeted* | Fail with a clear message on a missing setting and remove or annotate the unused address |

Also recorded below HIGH: the generation snapshots `configuration.svcinfo` and `configuration91.svcinfo` name the binding `BasicHttpBinding_HylandOutBoundContract1` while `ProcessOB3PRetention/App.config` uses the unsuffixed name, so an Update Service Reference could re-insert a second binding and endpoint*. The captured WSDL also carries no capture date.

## Related documentation
- [Client index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Contract](contract.md)
- [Operation map](operation-map.md)
- [Client reference](reference.md)
- [Consumption](consumption.md)
- [Dependencies](dependencies.md)
- [Business rules](business-rules.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- ProcessOB3PRetention/Services/OnBaseService.cs
- ProcessOB3PRetention/ThirdPartyRetentionProcessor.cs
- ProcessOB3PRetention/Program.cs
- ProcessOB3PRetention/App.config
- ProcessOB3PRetention/Connected Services/OBRetentionService/configuration.svcinfo
- ProcessOB3PRetention/Connected Services/OBRetentionService/configuration91.svcinfo
- ProcessOB3PRetention/Connected Services/OBRetentionService/EISClientWithConfig.wsdl
- environmentSettings/settings.yml