World-Model Projection Drift Control Room

A projected read model is a copy that can drift from its source and quietly read as truth, so this component checks public drift rows still trace back and refuses to let a copy speak for its source. A projected read model is a copy. A dashboard row, a generated structured source record, a route card, or a public runtime result record can stay useful for navigation long after it has stopped matching the source it was copied from. When that happens quietly, the copy starts to read as truth. This component checks that public drift rows still trace back to the source they describe, and it refuses to let a copy speak for its source.

Recomputing drift instead of trusting declarations

The runtime recomputes drift rows from a public result record rather than trusting the supplied file, diffs each against a real source-state artifact, and writes metadata-only records. The runtime is src/microcosm_core/organs/world_model_projection_drift_control_room.py. It takes a small bundle of public JSON inputs, recomputes the drift rows from a public runtime result record rather than trusting the supplied file, diffs each row against a real source-state artifact, and writes metadata-only result records. Every record carries paths, hashes, counts, and verdicts. None of them carries a private body.

Source-linked guards for each drift row

A pass means each named drift row is guarded by a source, target, repair route, validation reference, and fact-authority record and was witnessed, not that any source was repaired or made authoritative. A pass here means the named public drift rows are guarded: each names its source, its target, a repair route, a validation reference, and a fact-authority record, and each was witnessed in the runtime result record. It does not mean any source was repaired, mutated, or made authoritative.

Purpose

Drift between a world model and projection

The failure mode is drift between a world model and its projection, where trusting the result record as source lets a stale or edited row pass a shape check while matching nothing real. The failure mode is drift between a world model and its projection. The reducer world_model.py and the /api/drift endpoint in main.py produce a live view. A public result record then projects that view for readers. If the result record is trusted as the source, a stale or edited row can pass a shape check while no longer matching anything real.

Recompute, never trust the supplied file

Rather than a shape check, _build_result recomputes rows from the result record, treats the supplied file as an expected snapshot only, and blocks any row it cannot re-derive from source. A shape check alone fails here, so the design does not do one. The supplied drift_rows.json is never treated as input. _build_result recomputes the rows from the public runtime result record, then treats the supplied file only as an expected snapshot whose role is recorded as expected_snapshot_not_source_authority. If the snapshot disagrees with the recomputed rows, that is staleness, not fact. Each recomputed row is then diffed against a real source-state artifact. A row that cannot be re-derived from source, or whose guard reference or derivation path has changed, moves the verdict to blocked.

A repair route stays a label

A named repair route stays a label, and _row_policy_findings rejects any row authorising live repair, source-file changes, doctrine changes, or launch, so a row names a fix but cannot act. The same limit holds the other way. A row may name a repair route, but the route stays a label. _row_policy_findings rejects any row that authorises live repair, source-file changes, automatic doctrine changes, or launch. A row here can say what is wrong and where to go next. It cannot act, and it cannot stand in for its source.

How it works

Two entry points over _build_result

run validates the fixture with negative cases and run_drift_control_bundle validates the exported bundle without them, both flowing through _build_result into _write_receipts. run validates the accepted fixture with negative cases included. run_drift_control_bundle validates the exported public bundle without them. Both call _build_result, which runs the stages below in order and then hands the payload to _write_receipts.

_build_result gates the overall status

_build_result passes only when every stage and the secret scan pass with no findings, and the accepted fixture yields eight witnessed drift rows with all authority counts at zero. _build_result collects the findings from every stage. The overall status is PASS only when there are drift rows, no findings, the recomputed rows are metadata-only, all forbidden booleans are false, the runtime witness, recompute, snapshot, source-ref, source-state, source-module, and geometry stages all pass, and the secret-exclusion scan passes. Anything else is blocked. The accepted fixture produces eight drift rows, all eight witnessed in the runtime result record, with source_authority_claim_count, live_repair_authorized_count, source_mutation_authorized_count, and automatic_doctrine_promotion_count at zero.

_write_receipts normalises and pins authority

_write_receipts writes four records with host-temporary paths normalised away and body_in_receipt, release_authorized, and AUTHORITY_CEILING pinned on every one. _write_receipts then writes the result record, a board, a validation record, and a fixture_acceptance record. Paths are normalised so host-temporary paths never surface. Every record sets body_in_receipt and release_authorized to false and repeats AUTHORITY_CEILING.

flowchart TD Result record["Public runtime result record public_projection_drift_control_lens.json"] Recompute["Recompute rows selected_pattern_ids + result record drift_rows"] Snapshot["Supplied drift_rows.json expected snapshot, source-linked only"] SourceDiff["Source-state diff pattern ledger + view-quality action map"] Geometry["Geometry grade copied view_quality_census.py"] Witness["Runtime witness every row appears in the result record"] Policy["Per-row policy gate refs, fact-authority, forbidden booleans"] Records["metadata-only records result, board, validation, fixture_acceptance"] Result record --> Recompute Recompute --> Snapshot Recompute --> SourceDiff Recompute --> Geometry Recompute --> Witness Recompute --> Policy Snapshot --> Records SourceDiff --> Records Geometry --> Records Witness --> Records Policy --> Records

Four copied source bodies in the bundle

The exported bundle copies four public source bodies, the reducer, the /api/drift endpoint, the action-map builder, and its test, so a reader inspects the implementation without private state. The exported bundle copies four public source bodies so a reader can inspect the implementation without receiving private state: the world-model reducer system/server/world_model.py, the /api/drift endpoint in system/server/main.py, the action-map builder tools/meta/observability/view_quality_census.py, and its regression test system/server/tests/test_view_quality_census.py. The bodies live in the bundle. The records carry only their paths, hashes, and verdicts.

Negative cases

Nine negative inputs the run requires

run loads nine named negative inputs defined in EXPECTED_NEGATIVE_CASES and requires each to produce its rejection code, blocking the run if any expected code is missing. run loads nine named negative inputs and requires each to produce its expected rejection code, defined in EXPECTED_NEGATIVE_CASES. A missing expected code blocks the run.

The nine cases and added source-drift cases

The nine cases each map a malformed or overclaiming row to a stable code, and the source-drift stages add cases where a coherent row still loses authority if its source evidence changes. The nine cases are: drift_row_without_source_ref to DRIFT_SOURCE_REF_REQUIRED; repair_route_without_validation_ref to DRIFT_VALIDATION_REF_REQUIRED; drift_row_without_fact_authority to DRIFT_FACT_AUTHORITY_REQUIRED; projection_claiming_source_authority to DRIFT_SOURCE_AUTHORITY_FORBIDDEN; live_repair_action_authorized to DRIFT_LIVE_REPAIR_FORBIDDEN; private_runtime_data_export to DRIFT_PRIVATE_RUNTIME_EXPORT_FORBIDDEN; provider_payload_export to DRIFT_PROVIDER_PAYLOAD_FORBIDDEN; automatic_doctrine_promotion to DRIFT_AUTOMATIC_DOCTRINE_PROMOTION_FORBIDDEN; and release_from_drift_projection to DRIFT_RELEASE_AUTHORITY_FORBIDDEN. The source-drift stages add further cases for unwitnessed rows, stale supplied snapshots, missing source-ledger rows, mutated view-quality summaries, and internally consistent but unsupported source references. A row can be internally coherent and still lose authority if its source evidence, guard, or derivation path changes.

Prior Art Grounding

Concept-drift monitoring as signal

It borrows the model-monitoring and concept-drift idea of a growing predicted-versus-observed gap as an operational signal, yielding fixture-bound monitoring evidence, source-linked only. This component watches a projection for drift between what the model expects and what the runtime reports. It draws on the model-monitoring and concept-drift literature, which treats a growing gap between predicted and observed behaviour as an operational signal. The borrowed shape is drift-as-signal over metadata-only records. The result is fixture-bound monitoring evidence, source-linked only or whole-system correctness.

Validation Result record Path

Focused runtime validation:

PYTHONPATH=src ./repo-pytest \
  tests/test_world_model_projection_drift_control_room.py -q

Paper-module corpus validation:

cd microcosm-substrate
PYTHONPATH=src ../repo-python scripts/build_doctrine_projection.py --check-paper-module-corpus

Paper-module index validation from the repo root:

./repo-python tools/meta/factory/build_paper_module_index.py --check

What a pass means here

A pass means a fixture run produced the described records and rejected every named negative case. A pass means the component ran over the public fixture, produced the records described here, and rejected every named negative case.