BE-03-CLOSEOUT-01-SPEC: specify the BE-03 post-merge control correction

[ja573]

What this is

This PR specifies BE-03-CLOSEOUT-01. It does not implement the closeout.

BE-03 merged through PR #809, but active committed programme state still describes it as an unmerged draft awaiting a fresh independent review and CTO merge authorization, still asserts that BE-03 implementation is NOT AUTHORIZED and that feature/publisher-services/be-03 must not exist, and still lists BE-03 as an unsatisfied blocking dependency of BE-04, MIG-01, APP-01 and APP-02.

ADR-0005 section 8 requires a bounded post-merge task for exactly that — a committed tracker holding materially incorrect programme state — as distinct from transcribing a merge SHA, a review identifier or an authorization identifier, which section 4.1 item 6 prohibits.

Boundaries

• It specifies BE-03-CLOSEOUT-01; it does not implement the closeout.
• It changes no runtime behaviour. No runtime code, migration, schema.rs, GraphQL contract, generated SDL/client, Cargo file, workflow, deployment or environment configuration is touched.
• No closeout correction is performed in task-status.md, README.md, decisions.md, rollout-plan.md, platform-inventory.md, control-gaps.md or BE-03.md.
• The future BE-03-CLOSEOUT-01 implementation remains separately unauthorized, pending explicit CTO authorization against a freshly verified base.
• BE-04 remains separately unspecified and unauthorized. No distribution_job, distribution_job_target or distribution_job_attempt runtime behaviour, no automatic back-catalogue job creation and no dissemination exists merely because BE-03 merged.
• No production or environment action is authorized: deployment, environment and production migration execution, package commercial backfill, assignment creation/backfill, durable job creation, dissemination, distribution activation, OBSERVE/ENFORCE, workflow changes or dispatch, and production access all remain NOT AUTHORIZED.
• Issues Publisher Services: packages, distribution configuration and controlled rollout #765 and Thoth Metrics: canonical ingestion, Sphinx orchestration and client cutover #766 and PR THOTH-GQL-OPS-03: add effective-mode fleet verification #799 are untouched.

Base

Branched from a4585a8d89166577da5ce6f46ce51ddb134b3f7e, the merge commit of forward-integration PR #811, whose first parent 3ba4452c316399d80cd8d85e7d5e1bd05e252664 is the merge commit of BE-03 implementation PR #809 (head c678bdcec33c2aa01be1f887a85ff851dfe35891).

An earlier authorization named 3ba4452c as the expected head; that attempt stopped BLOCKED without creating a branch or editing a file, and this base was re-authorized after CTO review of PR #811.

Files

• docs/engineering/ai-delivery/tasks/BE-03-CLOSEOUT-01.md (new)
• docs/engineering/ai-delivery/implementation-reports/BE-03-CLOSEOUT-01-SPEC-implementation-report.md (new)
• CHANGELOG.md — one entry under the existing ## [Unreleased] / ### Added

Classified stale-state analysis

Recorded in full in Annex A of the specification.

Classification	Count
ACTIVE STALE STATE - CORRECT	17 statements across 5 files
HISTORICAL RECORD - PRESERVE	3 implementation reports (incl. every migration-path reference) + BE-01/BE-02/ADR-01/THOTH-GQL-* task records + CHANGELOG
CURRENT AND CORRECT - PRESERVE	10 statements, incl. decisions.md §3a in full and the CG-13 activation block
OUT OF SCOPE - PRESERVE	6 items

Three decisions warranting review attention

1. BE-03.md is classified as active stale state, departing from the BE-02-CLOSEOUT-01 precedent that left BE-02.md untouched. Its section 23 and header state that BE-03 implementation is NOT AUTHORIZED and that its branch must not exist — present-tense operative instructions, not implementation-time evidence — and its Status: DRAFT contradicts task-status.md, which records the specification as repository-authoritative through PR #808. The specification confines the correction to lifecycle-boundary prose and forbids altering any approved requirement. The conservative alternative is to leave it untouched.

2. decisions.md §3a is preserved in full, including its Decision state: line and internal "candidate" phrasing. Both halves of its authority condition hold, and the section states its own resolution rule: after both hold it is an approved programme decision "without requiring a separate lifecycle-status edit to this file". A literal APPROVED token would produce the approval-state churn ADR-0005 §4.1(10) prohibits. Only references outside that self-resolving construction are corrected — including the internal contradiction in task-status.md between next-action 10 and the APP-01 row.

3. The PR #811 migration renames are classified as historical evidence, per the CTO ruling:

BE-02: 20260812_v1.7.0 -> 20260811_v1.7.0
BE-03: 20260813_v1.7.0 -> 20260812_v1.7.0

Every repository reference to a pre-rename path sits inside an exact-head report and is preserved. Migration content and the BE-02-then-BE-03 apply order were verified unchanged, so no architecture, ordering or release-safety concern arises. New prose naming the current migration uses 20260812_v1.7.0 and distinguishes it from the implementation-head path.

Recorded but deliberately out of scope

docs/publisher-services/README.md §5 item 7 still asserts "no DistributionPlatform enum exists in code", which BE-02's merge falsified. BE-02-CLOSEOUT-01 carried an acceptance criterion targeting exactly this and corrected the platform-inventory.md and control-gaps.md instances; this one survived. Recorded as residual BE-02 control debt and left to its own bounded task rather than folded in.

Validation

Check	Result
git diff --check	no output, exit 0
Path containment	CHANGELOG.md + 2 new docs/ files only
Negative path proof	no thoth-*, .github/, Cargo.* match (grep exit 1)
Active control docs untouched	docs/publisher-services/, repository-map/, BE-03.md — no diff
Relative link resolution	9/9 resolve
Changelog	one entry under existing ### Added; no duplicate heading

Full workspace gate not run and not required: documentation-only change under root AGENTS.md §8, which reserves it for Rust/domain changes. No file under any workspace member is modified.

---

Draft. Not to be marked ready for review or merged without explicit CTO instruction. The authoring agent does not approve its own specification.

[ja573]

CTO specification approval and merge authorization — 2026-08-14

I approve the BE-03-CLOSEOUT-01 specification content and authorize PR #812 to merge into develop, bound exclusively to exact head:

d952a83206ad846c7a01f70c29fe694bc8cd5561

Scope of approval: the bounded documentation-only BE-03-CLOSEOUT-01 specification at this exact head.

This approval and merge authorization do not authorize BE-03-CLOSEOUT-01 implementation, creation of its implementation branch, BE-04, MIG-01, APP-01/APP-02, deployment, environment or production migration execution, package or assignment backfill, durable job creation, dissemination, distribution activation, OBSERVE/ENFORCE, workflow dispatch, production access, or any action on PR #799.

Any change to the PR head invalidates this exact-head authorization.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.