BE-03-CLOSEOUT-01: reconcile BE-03 post-merge control state

[ja573]

Implements the approved BE-03-CLOSEOUT-01 specification against the exact CTO-authorized develop base b51bcc0905ac17fc0c142b2002b11fec711331a3 (the merge commit of specification PR #812).

Risk: LOW — documentation and control correction only.

Carries a second, additive review-remediation commit, docs(publisher-services): clarify closeout evidence record, which corrects the overly absolute ADR-0005 evidence wording (see ADR-0005 compliance below), replaces the prose link-check description in implementation report section 9 with the exact reproducible command and its fresh result, and clarifies report section 5.1. The first commit was not amended, rebased, squashed or force-pushed; the push was a fast-forward. No classification, no other file and no scope changed. The branch diff remains the same bounded eight-file set.

Carries a third, additive commit, docs(publisher-services): clarify closeout acceptance evidence, which applies an explicit CTO clarification of one overbroad acceptance criterion in this task's own approved specification (see Acceptance criterion clarification below). It touches BE-03-CLOSEOUT-01.md and the implementation report only. The two earlier commits were not amended, rebased, squashed or force-pushed; the push was again a fast-forward, and the branch diff remains the same bounded eight-file set.

What this corrects

Active control documents still described BE-03 as an unmerged draft awaiting fresh independent review and CTO merge authorization, still asserted BE-03 IMPLEMENTATION NOT AUTHORIZED, still forbade the feature/publisher-services/be-03 branch, and still listed BE-03 as an unsatisfied blocking dependency of BE-04, MIG-01, APP-01 and APP-02.

Durable outcome:

• BE-03 — CLOSED - INACTIVE FOUNDATION. Repository integration only.
• BE-04 — BE-03 dependency satisfied; still BLOCKED and NOT STARTED, unspecified and unauthorized. No distribution_job, distribution_job_target, distribution_job_attempt, automatic back-catalogue onboarding, fabricated job status or dissemination exists.
• MIG-01 — BE-03 dependency satisfied; still CRITICAL and BLOCKED by its audit, backfill, dry-run and CG-13 prerequisites. No production migration or backfill authorized.
• APP-01 — BE-03 backend-contract dependency satisfied for the configuration-only surface; APP-01 itself still BLOCKED by BR-APP-01 or an explicit CTO exception, the CG-11 CI closure work, exact-SHA contract pinning and its own approved specification. Job/attempt/failure/pending-onboarding UI still requires BE-04.
• APP-02 — BE-03 dependency satisfied only; still blocked on BE-04 and APP-01, and not represented as ready.

Deployment, environment and production migration execution, package commercial backfill, assignment creation/backfill, durable job creation, dissemination, distribution activation, OBSERVE/ENFORCE, workflow changes or dispatch and production access all remain NOT AUTHORIZED.

Control notes for the reviewer

• decisions.md §3a. The self-resolving ADR-0005 authority-condition construction is preserved verbatim — the Decision state: line, the two-part condition, the "without requiring a separate lifecycle-status edit" rule, the rationale against a mutable APPROVED token, and the deliberate "decision candidate" phrasing. PROPOSED was not mechanically replaced. Exactly one sentence was corrected under explicit CTO control ruling: the present-tense assertion that APP-01 "remains blocked on BE-03 exposing the approved protected API". Applying it required no architectural change. Full reasoning in section 5.2 of the implementation report.
• BE-03.md. Only the three authorized lifecycle-boundary sites changed (Status, header implementation-authorization block, section 23). No requirement, invariant, architecture, API contract, authorization matrix, migration decision, acceptance criterion, test obligation, operational consequence or BE-04 transaction seam was altered.
• ADR-0005 compliance. No active control correction in this PR copies GitHub lifecycle metadata — a review, approval or merge-authorization identifier, a merge commit SHA, a merge timestamp or a draft/ready state — merely to restate terminal review, authorization or merge state, which is the transcription ADR-0005 §4.1 items 6 and 10 prohibit. This is distinct from the exact SHAs the PR legitimately records: BE-03-CLOSEOUT-01.md §18 records b51bcc09 as the exact CTO-authorized implementation base, and implementation report §1.2 records that SHA, its identity as PR BE-03-CLOSEOUT-01-SPEC: specify the BE-03 post-merge control correction #812's merge commit, and PR feat(publisher-services): implement BE-03 protected service configuration #809's merge commit 3ba4452c as ancestry evidence. Those are execution evidence the repository controls require to prove implementation authorization, preflight and ancestry — not post-merge lifecycle transcription. Every corrected sentence is durable: merging this PR falsifies none of them, so this closeout does not create the next one.
• Acceptance criterion clarification (CTO-approved). Section 9 of BE-03-CLOSEOUT-01.md carried the criterion "no review, approval or merge identifier, merge SHA or merge timestamp is newly transcribed into a repository file". Read literally that is overbroad: it forbids any newly recorded merge SHA regardless of purpose, and so forbids the exact-base and preflight/ancestry evidence the same specification (§18), root AGENTS.md §14 and ADR-0005's purpose-based prohibition all require — it made the document fail its own test. The CTO explicitly clarified it. The criterion now reads: "no active control correction copies a review, approval or merge-authorization identifier, merge SHA, merge timestamp, draft/ready state or equivalent GitHub lifecycle metadata merely to restate terminal review, authorization or merge state; exact SHAs recorded as the authorized implementation base or as required preflight/ancestry evidence are permitted execution evidence under repository controls". This is a control clarification only — no architecture, runtime scope, BE-03/BE-04/APP-01 boundary, ADR-0005 text, migration policy or downstream authorization changed, and no downstream task was started, specified or authorized. The implementation required no change: it already drew exactly this distinction (see ADR-0005 compliance above, written before the clarification). Exactly one checklist item was replaced; the surrounding acceptance criteria, §18's authorized-base evidence, Annex A, the authority condition, scope, non-goals and architecture are unchanged. Full record in implementation report section 5.3.
• Historical evidence preserved. The BE-02, BE-02-CLOSEOUT-01, BE-03, BE-03-SPEC and BE-03-CLOSEOUT-01-SPEC implementation reports are byte-identical to the base, including every migration-path reference later renamed by PR Forward-integrate v1.6.3 hotfix from master into develop #811. No migration was renamed or modified and PR Forward-integrate v1.6.3 hotfix from master into develop #811 was not repaired.
• Deferred, not fixed here. docs/publisher-services/README.md section 5 item 7 still claims no DistributionPlatform enum exists. Materially false, but residual BE-02 control debt, recorded as deferred work rather than folded into this task.

Validation

git diff --check                                    -> no whitespace error
git diff --name-only <base>..HEAD                   -> docs/ + CHANGELOG.md only
git diff --name-only <base>..HEAD | grep -E \
  '^(thoth-api|thoth-api-server|thoth-client|\
     thoth-errors|thoth-export-server|\.github|Cargo\.)'  -> no output
relative markdown link resolution (exact command in
  implementation report section 9)                  -> files: 8
                                                       relative links checked: 100
                                                       broken: 0
post-edit classified BE-03 re-run                   -> no active control asserts
                                                       BE-03 unmerged/in review/
                                                       NOT AUTHORIZED
CHANGELOG.md                                        -> one entry, no duplicate heading

Re-run at the current head after the acceptance-clarification commit. The link check is recorded in implementation report section 9 as an exact reproducible command rather than a prose description; it resolves every relative markdown link target in the changed files against the filesystem, excluding absolute targets and same-document anchors, which are not filesystem-resolvable.

Documentation-only change: the full Rust workspace gate has no changed input and was not run, per root AGENTS.md section 8. GitHub CI is the live authority for CI.

Evidence: BE-03-CLOSEOUT-01-implementation-report.md, including the complete four-way classified stale-state result.

Status

Draft, pending fresh independent exact-head review and separate CTO merge authorization. The implementing agent does not approve its own work.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.