Day-0 Guide
General enterprise visibility, with access to the enterprise's general document spaces. No HR or payroll compartment access.Viewing as Enterprise Reader
Chapter 07 of 13DAY-0

A synthetic enterprise can look believable and still be wrong

A polished UI can hide bad data.

An invoice can look realistic while accounting does not reconcile.

A canonical entity can look correct while having no source lineage.

A reset can appear to work while quietly duplicating events.

Metrolane treats validation and provenance as part of the product.

Understand

Trust needs more than realistic-looking records

Four ideas matter. Together they answer:

ProvenanceWhere did this fact come from?
AccessWho may see it?
Validation / reconciliationDoes the estate obey its own rules?
ReproducibilityCan we reproduce the same reference state?

Provenance

A canonical fact should not appear from nowhere.

The enterprise should be able to explain:

source recordmappingcontributionsurvivorship where relevantcanonical result
See it in Metrolane

Trace an invoice

CINV-2026-000001

The Data Journey can show:

ERP Customer Invoice

Connector / extraction

Raw record

MAP-INV-ERP-CUSTOMER

Canonical Invoice

Field lineage

with an additional AR contribution where applicable.

Access

Enterprise knowledge is not necessarily visible to every reader.

Metrolane's public Explorer uses demo personas to demonstrate those semantics.

Example:

DOC-000070Offer Letter — Devika IyerHR_CONFIDENTIAL

An Enterprise Reader should not receive the same visible result as an HR Business Partner.

The public View as control demonstrates enterprise-read visibility. It is not real end-user authentication or a production security boundary.

Validation and reconciliation

A synthetic enterprise can fail in subtle ways.

Examples:

journal does not balanceAP control does not match subledgersource reference points to nothingcanonical row lacks lineagereset duplicates eventsscenario no longer standsgenerated manifest driftsDay-0 changes unexpectedly

Metrolane uses tests and gates to catch those kinds of errors.

Reproducibility

A frozen reference is useful only if we can rebuild it predictably.

Metrolane's final Day-0 verification compared independent clean rebuilds of the same frozen definition.

537 / 537 tablesno business-row differences
74 / 74 canonical identitiessame canonical keys
19 / 19 determinism testsPASS

The Explorer also binds every deployment to an explicit Day-0 reference and build identity.

Important distinction

Same Day-0 does not require same visual deployment

You can change:

spacingtypographycomponent layoutresponsive behavior

and deploy a new site while preserving the same underlying Day-0 fingerprint.

This separates enterprise reference identity from application/design deployment identity.

The short Day-0 fingerprint is useful, but it does not cover the complete estate. The stable reference is the explicit Day-0 export/reference identity, with repository, scenario and compiler metadata bound alongside it.

Go deeper
Trust is distributed across layers

There is no single trusted = true flag.

Trust comes from boundaries working together:

source-system rulescommands / handlersintegration linksconnector resultsmapping rulesresolutionsurvivorshiplineagescenario verificationaccess policybuild validationreproducible outputs

This is why the Explorer must not silently repair missing upstream facts in presentation code.

If a canonical field is wrong, the authority should be fixed upstream and the build regenerated.

Chapter takeaway

  • Believability is not enough.
  • Provenance explains facts.
  • Access controls visibility.
  • Validation catches internal contradictions.
  • Reproducibility proves the reference estate can be recreated.
  • Trust is an architectural property, not a UI label.