Canonadr

ADR-2026-09-04-12 — The Projection Engine is the sole composer of the Workbench

Status: ACCEPTED — 2026-09-04 (Founder Canon §12; Book of Record projection boundary; Role Workbench grammar)

Context

If gateways, BFF routes, UI modules, canvas renderers or agents each compose their own view of
organizational state, every surface becomes an implicit source of truth: permissions drift,
freshness diverges, and the AI and human sides see different realities.

Decision

  • The Projection Engine is the sole producer of versioned SharedWorkbench contracts.
    Gateways, frontend components, connectors and agents request authorized projections; they do
    not independently compose the Workbench or read physical data stores.
  • Resolution formula: Role × Department × Industry × Connector Category × Active Context × Policy over the Effective Spine.
  • Projection is dual-sided: the same engine composes the Human Workbench projection and the
    AI Workbench context (with the recipient's continuity augmentation), so human and AI share the
    same business reality without identical representations.
  • Workbench grammar: stable shell; a shared section grammar across role workbenches; shared
    UI primitives each with exactly one backend owner (Governance owns the approval block; the Twin
    Runtime is restricted to read and propose); views are lenses over canonical data, never
    separate databases.
  • The UI auto-tuner proposes versioned projection patches; it never rewrites components
    directly. Personal/reversible adaptation may auto-tune; shared/consequential change requires
    governance.
  • The frontend never reads a store directly; all reads are versioned Platform query/projection
    contracts; all mutations are governed writers.

Alternatives considered

  • BFF-per-surface composition — rejected: N implicit truth-composers with drifting permissions
    and freshness.
  • Client-side assembly from canonical tables — rejected: exposes storage shapes, breaks field
    policy and provenance.

Consequences

Every visible element is traceable: frontend → projection → view → entity → field → canonical
table → storage layer → source. A projection contract change is versioned; a renderer change is
not an architecture change.