<aside> 🧪

State: PROMOTED_PROTOTYPE / EXPERIMENTAL / USE_AND_TEST / VERIFICATION_PENDING

Scope: global-working-memory

Classification: REFINEMENT

Artifact type: existing_capability_extension

Lineage: Canonical State Reconciler · read-only only

</aside>

Hypothesis

Observed drift should not be treated as one undifferentiated failure. Reconciliation needs an explicit desired-state reference, an origin/exception class, an accountable owner, and a bounded reconciliation window so legitimate break-glass changes remain visible without being silently normalized into the new desired state.

Evidence basis

Primary source: AWS, “From clickops to governed IaC: CloudFormation drift detection in practice,” 2026-08-21. Retained mechanism: generated visibility is not control; drift can be legitimate; mature governance adds ownership, reconciliation windows, and explicit accept/revert/escalate handling.

Drift governance envelope

schema: aios_desired_state_drift_governance_v0_1
reconciliation_id:
scope_key:
desired_state_ref:
desired_fingerprint:
observed_state_ref:
observed_fingerprint:
drift_class:
drift_origin: MANUAL | AUTOMATION | BREAK_GLASS | UNKNOWN
exception_state: NONE | DECLARED_BREAK_GLASS | UNDECLARED | UNKNOWN
owner_ref:
observed_at:
reconciliation_deadline:
resolution: ACCEPT_AS_NEW_DESIRED | REVERT | ESCALATE | UNKNOWN
resolution_authorized: false
evidence_pointers: []
write_authorization: NONE

Fixture cases

  1. Undocumented manual change → drift visible, UNDECLARED, resolution not inferred.
  2. Declared break-glass change within reconciliation window → drift remains visible but is not auto-failed.
  3. Automation changed observed state without corresponding desired-state update → classify origin and escalate ownership.
  4. Desired-state source unavailable → UNKNOWN/UNAVAILABLE; never manufacture desired fingerprint.
  5. Generated baseline matches current resources but cannot prove intent → visibility only; control/authority remains unresolved.

Acceptance criteria