Phase 2: drift detection

Compares cloud_provisioned.spec (what we asked DO for) against the live
cloud_resources row (what DO actually has). Any divergence becomes an
operator-resolvable drift record.

cloud_drift table: one row per drifted field. status open/accepted/
reverted/stale. Partial unique index keeps at most one OPEN drift per
(resource, field); resolved rows are retained as history.

ArcadiaCloud.Drift context:
- detect_all/0 — sweeps every provisioned resource. Per field in spec,
  resolves the actual value (top-level schema field first, then attrs),
  compares with loose equality (stringified scalars; lists as sets so
  JSON round-trips don't false-positive). Mismatches upsert a cloud_drift
  row + emit a drift_detected event in the resource event log.
- close_stale_drift — an open drift whose field no longer mismatches
  (fixed elsewhere) closes as "stale" on the next sweep.
- accept_drift/2 — the live value becomes the new desired-state: parent
  cloud_provisioned.spec is updated, spec_version bumped, drift closed
  "accepted". Revert (mutating live infra back to spec) is intentionally
  NOT here — it needs a saga and lands with the droplet-resize work.

DriftDetectionWorker — Oban cron at :20 past the hour, offset past the
:15 resource syncs so it compares against fresh inventory.

Provisioning.record_provisioned/3 — populates cloud_provisioned desired-
state (upsert on resource_id, bumps spec_version). Future provisioning
sagas call this; for now it's how drift gets something to detect.

API (platform_admin only):
- GET  /api/v1/drift            — open drift inbox
- POST /api/v1/drift/:id/accept — adopt live value as desired-state

Smoke verified: recorded a droplet's desired spec with a deliberately
wrong size_slug + a correct region; detect_all flagged only size_slug,
wrote the drift_detected event; accept updated the spec to the live
value and closed the drift; re-detect found zero drift.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/arcadia_cloud_web/controllers/drift_controller.ex

@@ -0,0 +1,67 @@
+defmodule ArcadiaCloudWeb.DriftController do
+  @moduledoc """
+  Drift inbox — operator surface for resources whose live state has
+  diverged from the desired-state we provisioned. platform_admin only.
+
+  accept: live value becomes the new desired-state.
+  Revert (mutating live infra back to spec) is deferred — it requires a
+  saga and lands with the droplet-resize work.
+  """
+
+  use ArcadiaCloudWeb, :controller
+
+  alias ArcadiaCloud.Drift
+
+  def index(conn, _params) do
+    with :ok <- require_platform_admin(conn) do
+      drift = Drift.list_open_drift() |> Enum.map(&shape/1)
+      json(conn, %{drift: drift, count: length(drift)})
+    end
+  end
+
+  def accept(conn, %{"id" => id}) do
+    with :ok <- require_platform_admin(conn) do
+      case Drift.get_drift(id) do
+        nil ->
+          conn |> put_status(:not_found) |> json(%{error: "not_found"})
+
+        %{status: "open"} = drift ->
+          actor = conn.assigns.current_identity.email || "operator"
+          {:ok, _} = Drift.accept_drift(drift, actor: actor)
+          json(conn, %{status: "accepted", drift_id: id})
+
+        %{status: status} ->
+          conn
+          |> put_status(:conflict)
+          |> json(%{error: "already_resolved", current_status: status})
+      end
+    end
+  end
+
+  defp require_platform_admin(conn) do
+    identity = conn.assigns.current_identity
+
+    if is_list(identity.roles) and "platform_admin" in identity.roles do
+      :ok
+    else
+      conn
+      |> put_status(:forbidden)
+      |> json(%{error: "platform_admin_required"})
+      |> halt()
+    end
+  end
+
+  defp shape(d) do
+    %{
+      id: d.id,
+      resource_id: d.resource_id,
+      resource_name: d.resource && d.resource.name,
+      resource_kind: d.resource && d.resource.kind,
+      field: d.field,
+      expected: d.expected,
+      actual: d.actual,
+      status: d.status,
+      detected_at: d.detected_at
+    }
+  end
+end