chore: project audit — simplify to orchestration core + skills + MCP

[medomar]

Why

OpenBridge has grown from an AI-agent bridge into a broad platform. A code audit shows ~22% of src (~21K LOC) and roughly half of the 35 runtime dependencies serve features outside the core mission — and one whole subsystem (integrations/) reinvents MCP, which core already supports. This audit refocuses the project, shrinks the security/maintenance surface, and makes the codebase legible for contributors — without losing capability (relocated, not deleted).

Mission anchor

OpenBridge orchestrates the AI agents installed locally on a machine, gives them governed access to a configured workspace, and lets them collaborate toward the user's goals — extending itself with skills on demand and improving its own code under a human-approval gate.

Capability surface = 3 extension points: Agents · Skills · MCP servers.
Decision rule: if something in core duplicates an agent, a skill, or an MCP server → it doesn't belong in core.

Current state (measured)

Area	LOC	Verdict
master/ 35.9k · core/ 23.1k · memory/ 7.7k · connectors/ 7.2k · discovery/+providers/ 1.2k · types/+cli/ 5.4k	~80k	KEEP — core engine
integrations/	7.1k	REPLACE with MCP — 9 bespoke adapters (stripe/google*/pg/dropbox/email/openapi), 0 MCP references
intelligence/	11.5k	SPLIT — doc-processing → MCP/skill; DocType engine → decision below
workflows/	3.1k	SIMPLIFY — duplicates Master orchestration + node-cron
_archived/	2.9k	DELETE (preserved in git history)
orchestrator/	0.9k	ARCHIVE (experimental, superseded)

Proposed actions

1. integrations/ → MCP. Replace adapters with MCP server configs (Stripe, Google Drive/Sheets/Calendar, Postgres, Dropbox, Gmail, OpenAPI MCP servers all exist). Removes ~8 deps (stripe, googleapis, pg, dropbox, nodemailer, imap, mailparser, swagger-parser). Keep only a tiny generic inbound webhook→trigger (MCP is outbound-only) if event triggering is wanted.
2. intelligence/ document-processing → MCP server or skill pack (drops pdf-parse, mammoth, tesseract.js, pdfmake, xml2js, file-type).
3. DocType engine → see decision below.
4. workflows/ → thin "scheduled/triggered agent run" on node-cron; drop the typed-step DSL.
5. Delete _archived/; archive orchestrator/.

Decisions (open — confirm before extraction)

• DocType engine — spin out to its own repo (recommended: preserves shipped work, keeps OpenBridge focused) vs remove outright
• workflows/ — keep thin scheduler + cut the DSL (recommended) vs cut entirely
• Connectors — keep all 5 in core vs move WhatsApp/Telegram/Discord to optional plugins (can defer)

Plan (safe, incremental — per CLAUDE.md: draft PRs, branch from develop)

1. Inventory & agreement (this issue) — confirm verdicts. No code deleted yet.
2. One draft PR per extraction (integrations→MCP, doc-processing→skill, DocType spin-out, workflows trim, dead-code delete) — each independently reviewable and revertible.
3. Update docs/ROADMAP.md + README to the focused mission.

Definition of done

• Non-core subsystems removed from core (extracted / spun-out / deleted).
• Runtime deps reduced from 35 → target ~20.
• External services reachable via MCP, not bespoke adapters.
• Bridge core (connectors → router → master → agents → memory) unchanged in behavior; tests green.
• Mission documented in one paragraph in README/ROADMAP.

Non-goals / risks

• Non-goal: changing the bridge core or breaking the agent/worker flow.
• Risk: extraction churn touches many files — mitigate with small, independent draft PRs.
• Risk: losing a capability someone relies on — mitigate by relocating (skill / MCP / spun-out repo), not deleting.