---
status: reconciled-partial
coverage_depth: deep
last_reconciled: 2026-07-18
specs:
  - apps/oshun/web/e2e/citation-drift-resolution.spec.ts
source: WALKTHROUGH/journeys/citation-drift-resolution.md
---

# Journey result: Citation drift resolution

- **Walked**: 2026-05-29 by Claude against commit `bf12b0f7d8`; that pass
  established the first route and endpoint smoke evidence.
- **Reconciled**: 2026-07-18 against the current journey, operator surfaces,
  provenance harness, resolution stores, audit routes, and browser suite. This
  was a source reconciliation, not a fresh runtime walk.
- **Verdict**: **partial** — deep automation proves the current operator seam
  from a seeded drift incident through provenance inspection, per-source
  classification, audited terminal decision, and shared incident resolution. It
  does not drive the upstream Sophia change detector or the downstream
  re-render, publication, retraction-notice, and takedown cascade.
- **Primary spec**: `apps/oshun/web/e2e/citation-drift-resolution.spec.ts`.

## Result at a glance

| Evidence lane                | Current result                                                                                  | Authority limit                                              |
| ---------------------------- | ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
| Drift incident               | Seeded `INC-2041` appears in `/operator/admin` with severity, summary, three sources, and link  | Fixture start; no live Sophia revision creates the incident  |
| Provenance verification      | Clean, broken, unavailable, empty, and unknown-bundle states plus 16-field detail are covered   | Test-harness ledger, not a production tenant replay          |
| Source classification        | All three sources post to the real BFF, read back, and emit `drift.source_classified` audits    | Starts from seeded source rows                               |
| Terminal decision            | Recheck, re-render, and retract record receipts; a chosen decision resolves the shared incident | Records intent; does not execute the downstream effect       |
| Incident history and audit   | Created-to-resolved history and linked `incident.resolved` evidence are read back               | Explicit `incident.created` admin-audit emission is unproved |
| Customer or artifact outcome | Not produced by the focused suite                                                               | No new bundle, edition, notice, cache purge, or takedown     |

## Evidence map

The automated path begins after drift detection and ends when the operator's
decision is durably recorded. The two dashed legs are the product outcomes that
remain outside this result.

```mermaid
flowchart LR
    A[Source revision and Sophia claim diff] -. not driven .-> B[Seeded INC-2041]
    B --> C[Operator inbox]
    C --> D[Isis provenance inspector]
    D --> E{Hash chain}
    E -->|broken| F[Terminal actions disabled]
    E -->|clean| G[Classify three drift sources]
    G --> H[Record recheck, re-render, or retract]
    H --> I[Resolution receipt and drift audit]
    I --> J[Shared incident resolved]
    J -. not driven .-> K[New artifact or customer retraction cascade]
```

## Proven observations

### Operator and provenance path

- `/operator/admin` exposes the seeded S1 citation-drift incident, its artifact
  summary, source rows, and the `Open provenance` handoff to
  `/operator/admin/isis/provenance?inc=INC-2041`.
- The inspector covers a clean chain, a broken chain with disabled terminal
  actions, an unavailable ledger, an empty tenant, no bundle selection, and an
  unknown bundle. The selected bundle view pins the current provenance fields,
  timestamps, tenant-aware navigation, and generated-artifact inspector.
- The clean fixture is built through the canonical in-memory Isis helpers used
  by durable replay. That makes the hash-chain assertions meaningful while still
  leaving them fixture-backed.

### Durable operator writes

- The browser classifies `Sci. Adv., 2025`, `Nature Cities, May`, and
  `Lancet Planetary, Apr` through the real source-classification endpoint.
  Too-short rationales remain blocked; successful writes are read back and
  matched to `drift.source_classified` audit rows.
- Recheck-immaterial, re-render, and retract decisions post to the real
  resolution endpoint and return per-operator receipts. The suite verifies the
  corresponding `drift.*` audit records.
- A chosen retract decision transitions the shared incident from its seeded
  created state to resolved. The incident readback and `incident.resolved` audit
  payload link that state change to the drift resolution.

### Guard and failure states

- Anonymous users are redirected before the provenance inspector renders.
- A broken ledger prevents re-render or retract controls from being used. This
  correctly separates an integrity event from an ordinary citation-drift
  decision.
- Missing bundles and unavailable stores render explicit empty or unavailable
  states instead of fabricating a clean verdict.

## Boundaries and gaps

- **A seeded incident is not live drift detection.** The suite does not run the
  Sophia source refresh, claim-level diff, materiality threshold, severity
  selection, or incident creation path.
- **A recorded re-render is not a regenerated artifact.** No generation job is
  enqueued, no new Isis bundle is appended, and no current citation or policy
  gate is rerun by this workflow.
- **A recorded retract is not a customer cascade.** The Veritas/Nisaba notice,
  kept/shared-artifact enumeration, takedown acknowledgement, cache purge, and
  customer readback are not driven.
- **Harness provenance is not production-ledger replay.** The canonical helpers
  exercise real verification logic over seeded data; they do not prove a durable
  production tenant's bundle chain or watermark comparison.
- **Incident closure is not a complete audit chain.** Resolution and
  `incident.resolved` evidence are read back, but the focused path does not
  prove an explicit `incident.created` row emitted by live detection.
- **One incident does not establish concurrency policy.** Multiple moving
  sources, incident merge/debounce behavior, duplicate decisions, and stale
  operator state remain outside the current contract.

## Re-run evidence

The current focused browser suite is:

```bash
PW_BROWSER_CHANNEL=chrome pnpm exec playwright test \
  -c apps/oshun/web/playwright.config.ts \
  apps/oshun/web/e2e/citation-drift-resolution.spec.ts \
  --workers=1
```

It requires the real-development-infrastructure web/BFF harness and the explicit
Isis test-harness flag. A green run proves the operator decision seam; it must
not be summarized as an end-to-end source-to-customer cascade.

## Source trail

- [Source-reconciled journey](../journeys/citation-drift-resolution.md)
- [Focused browser suite](../../apps/oshun/web/e2e/citation-drift-resolution.spec.ts)
- [Citation-drift route](../../apps/oshun/bff/src/routes/admin-citation-drift-resolution.ts)
- [Resolution store](../../apps/oshun/bff/src/admin/citation-drift-resolution-store.ts)
- [Source-classification store](../../apps/oshun/bff/src/admin/citation-drift-source-classification-store.ts)
- [Isis provenance inspector](../../apps/oshun/web/src/components/admin/IsisProvenanceInspector.tsx)
- [Resolution controls](../../apps/oshun/web/src/components/admin/CitationDriftResolutionActions.tsx)

## Cross-references

- [Generic incident-triage journey](../journeys/incident-triage.md)
- [Editorial review and approval result](./editorial-review-approval.md)
- [Operator admin view](../operator/operator-admin.md)
- [Isis provenance view](../operator/operator-admin-isis-provenance.md)
- [Veritas customer-retraction view](../customer/05-veritas/veritas-retraction.md)
- [Journey coverage matrix](../journeys/coverage.md)

## Open questions

- Which endpoint consumes a recorded `drift.re_render` decision and returns the
  resulting generation job, bundle id, publication-gate receipt, and customer
  edition?
- How will retract enumerate every kept/shared surface, require
  acknowledgements, and prove customer notices and cache invalidation without
  partial success?
- What source-change thresholds map to S1, S2, and S3, and where are their
  policy versions recorded for later audit?
- How are concurrent drift incidents for one artifact merged, locked, or
  rejected when operators act from stale views?
- Should operators be able to rerun hash-chain verification explicitly before
  deciding, and how will the fresh verdict be bound to the resolution receipt?