Journey result: Citation drift resolution — V1 Web PWA

Walked: 2026-05-29 by Claude against commit bf12b0f7d8; that pass established the first route and endpoint smoke evidence.
Reconciled: 2026-07-18 against the current journey, operator surfaces, provenance harness, resolution stores, audit routes, and browser suite. This was a source reconciliation, not a fresh runtime walk.
Verdict: partial — deep automation proves the current operator seam from a seeded drift incident through provenance inspection, per-source classification, audited terminal decision, and shared incident resolution. It does not drive the upstream Sophia change detector or the downstream re-render, publication, retraction-notice, and takedown cascade.
Primary spec: apps/oshun/web/e2e/citation-drift-resolution.spec.ts.

Result at a glance#

Evidence lane	Current result	Authority limit
Drift incident	Seeded `INC-2041` appears in `/operator/admin` with severity, summary, three sources, and link	Fixture start; no live Sophia revision creates the incident
Provenance verification	Clean, broken, unavailable, empty, and unknown-bundle states plus 16-field detail are covered	Test-harness ledger, not a production tenant replay
Source classification	All three sources post to the real BFF, read back, and emit `drift.source_classified` audits	Starts from seeded source rows
Terminal decision	Recheck, re-render, and retract record receipts; a chosen decision resolves the shared incident	Records intent; does not execute the downstream effect
Incident history and audit	Created-to-resolved history and linked `incident.resolved` evidence are read back	Explicit `incident.created` admin-audit emission is unproved
Customer or artifact outcome	Not produced by the focused suite	No new bundle, edition, notice, cache purge, or takedown

Evidence map#

The automated path begins after drift detection and ends when the operator's decision is durably recorded. The two dashed legs are the product outcomes that remain outside this result.

flowchart LR A[Source revision and Sophia claim diff] -. not driven .-> B[Seeded INC-2041] B --> C[Operator inbox] C --> D[Isis provenance inspector] D --> E{Hash chain} E -->|broken| F[Terminal actions disabled] E -->|clean| G[Classify three drift sources] G --> H[Record recheck, re-render, or retract] H --> I[Resolution receipt and drift audit] I --> J[Shared incident resolved] J -. not driven .-> K[New artifact or customer retraction cascade]

Proven observations#

Operator and provenance path#

/operator/admin exposes the seeded S1 citation-drift incident, its artifact summary, source rows, and the Open provenance handoff to /operator/admin/isis/provenance?inc=INC-2041.
The inspector covers a clean chain, a broken chain with disabled terminal actions, an unavailable ledger, an empty tenant, no bundle selection, and an unknown bundle. The selected bundle view pins the current provenance fields, timestamps, tenant-aware navigation, and generated-artifact inspector.
The clean fixture is built through the canonical in-memory Isis helpers used by durable replay. That makes the hash-chain assertions meaningful while still leaving them fixture-backed.

Durable operator writes#

The browser classifies Sci. Adv., 2025, Nature Cities, May, and Lancet Planetary, Apr through the real source-classification endpoint. Too-short rationales remain blocked; successful writes are read back and matched to drift.source_classified audit rows.
Recheck-immaterial, re-render, and retract decisions post to the real resolution endpoint and return per-operator receipts. The suite verifies the corresponding drift.* audit records.
A chosen retract decision transitions the shared incident from its seeded created state to resolved. The incident readback and incident.resolved audit payload link that state change to the drift resolution.

Guard and failure states#

Anonymous users are redirected before the provenance inspector renders.
A broken ledger prevents re-render or retract controls from being used. This correctly separates an integrity event from an ordinary citation-drift decision.
Missing bundles and unavailable stores render explicit empty or unavailable states instead of fabricating a clean verdict.

Boundaries and gaps#

A seeded incident is not live drift detection. The suite does not run the Sophia source refresh, claim-level diff, materiality threshold, severity selection, or incident creation path.
A recorded re-render is not a regenerated artifact. No generation job is enqueued, no new Isis bundle is appended, and no current citation or policy gate is rerun by this workflow.
A recorded retract is not a customer cascade. The Veritas/Nisaba notice, kept/shared-artifact enumeration, takedown acknowledgement, cache purge, and customer readback are not driven.
Harness provenance is not production-ledger replay. The canonical helpers exercise real verification logic over seeded data; they do not prove a durable production tenant's bundle chain or watermark comparison.
Incident closure is not a complete audit chain. Resolution and incident.resolved evidence are read back, but the focused path does not prove an explicit incident.created row emitted by live detection.
One incident does not establish concurrency policy. Multiple moving sources, incident merge/debounce behavior, duplicate decisions, and stale operator state remain outside the current contract.

Re-run evidence#

The current focused browser suite is:

bash

PW_BROWSER_CHANNEL=chrome pnpm exec playwright test \
  -c apps/oshun/web/playwright.config.ts \
  apps/oshun/web/e2e/citation-drift-resolution.spec.ts \
  --workers=1

It requires the real-development-infrastructure web/BFF harness and the explicit Isis test-harness flag. A green run proves the operator decision seam; it must not be summarized as an end-to-end source-to-customer cascade.

Source trail#

Cross-references#

Open questions#

Which endpoint consumes a recorded drift.re_render decision and returns the resulting generation job, bundle id, publication-gate receipt, and customer edition?
How will retract enumerate every kept/shared surface, require acknowledgements, and prove customer notices and cache invalidation without partial success?
What source-change thresholds map to S1, S2, and S3, and where are their policy versions recorded for later audit?
How are concurrent drift incidents for one artifact merged, locked, or rejected when operators act from stale views?
Should operators be able to rerun hash-chain verification explicitly before deciding, and how will the fresh verdict be bound to the resolution receipt?