{"slug":"canonical/adr/ADR-2026-09-04-12-projection-engine-sole-composer","title":"ADR-2026-09-04-12 — The Projection Engine is the sole composer of the Workbench","section":"canonical","sectionLabel":"Canon","status":"canon","type":"adr","path":"canonical/adr/ADR-2026-09-04-12-projection-engine-sole-composer.md","bytes":2294,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Status:** ACCEPTED — 2026-09-04 (Founder Canon §12; Book of Record projection boundary; Role Workbench grammar)\n\n## Context\n\nIf gateways, BFF routes, UI modules, canvas renderers or agents each compose their own view of\norganizational state, every surface becomes an implicit source of truth: permissions drift,\nfreshness diverges, and the AI and human sides see different realities.\n\n## Decision\n\n- The **Projection Engine is the sole producer of versioned SharedWorkbench contracts.**\n  Gateways, frontend components, connectors and agents request authorized projections; they do\n  not independently compose the Workbench or read physical data stores.\n- Resolution formula: `Role × Department × Industry × Connector Category × Active Context ×\n  Policy` over the Effective Spine.\n- Projection is **dual-sided**: the same engine composes the Human Workbench projection and the\n  AI Workbench context (with the recipient's continuity augmentation), so human and AI share the\n  same business reality without identical representations.\n- **Workbench grammar:** stable shell; a shared section grammar across role workbenches; shared\n  UI primitives each with exactly one backend owner (Governance owns the approval block; the Twin\n  Runtime is restricted to read and propose); views are lenses over canonical data, never\n  separate databases.\n- The UI auto-tuner proposes **versioned projection patches**; it never rewrites components\n  directly. Personal/reversible adaptation may auto-tune; shared/consequential change requires\n  governance.\n- The frontend never reads a store directly; all reads are versioned Platform query/projection\n  contracts; all mutations are governed writers.\n\n## Alternatives considered\n\n- BFF-per-surface composition — rejected: N implicit truth-composers with drifting permissions\n  and freshness.\n- Client-side assembly from canonical tables — rejected: exposes storage shapes, breaks field\n  policy and provenance.\n\n## Consequences\n\nEvery visible element is traceable: frontend → projection → view → entity → field → canonical\ntable → storage layer → source. A projection contract change is versioned; a renderer change is\nnot an architecture change.\n"}