ADR-02 - Supersede distribution platform inventory for Figshare/Cambridge retirement

[ja573]

ADR-02 - Supersede distribution platform inventory for Figshare/Cambridge retirement

Status

SPECIFICATION / ARCHITECTURE DECISION CANDIDATE - AWAITING INDEPENDENT REVIEW AND CTO APPROVAL

Implementation: NOT AUTHORIZED

Current gate: HOLD - independent specification/decision review -> explicit CTO approval of the exact ADR decision -> fresh exact-base documentation implementation authorization -> exact-head source review -> separate merge authorization -> merge to develop.

This task exists because independent review of BE-05 / #840 returned CHANGES REQUIRED in comment 5441494405. The review correctly established that retiring Figshare and Cambridge University Library materially changes the approved, repository-authoritative ADR-0004 decision and therefore cannot be implemented by editing ADR-0004 in place.

No source/file write, branch, commit, push, PR, CI dispatch, provider/runtime/data access, merge, release, deployment or production activation is authorized by this issue creation.

1. Task identity

• Programme: Publisher Services and Distribution Configuration
• Parent programme issue: thoth-pub/thoth#765
• Task ID: ADR-02
• Repository: thoth-pub/thoth
• Programme stage: architecture amendment / destination retirement prerequisite
• Workflow: STANDARD
• Risk: HIGH
• Specification baseline: develop @ a6c8cb2016179db635c4bc86ef366aae190829c2
• Base branch: develop
• PR target: develop
• Proposed task branch after separate implementation authorization: feature/publisher-services/adr-02
• Required repository decision ID: ADR-0010
• Proposed ADR path: docs/engineering/decisions/ADR-0010-distribution-platform-retirement.md
• Exact authorized implementation base: NONE - must be freshly established after decision approval
• Runtime/schema/data/auth/provider effect at this task: NONE
• Blocked consumer: BE-05 / BE-05 - Deprecate Figshare and Cambridge University Library distribution destinations #840
• Downstream consumers after BE-05: thoth-pub/thoth-dissemination#101 (DIS-03) and thoth-pub/thoth-app#157 (APP-04)

Live preflight at issue creation:

• develop = a6c8cb2016179db635c4bc86ef366aae190829c2;
• repository decision files stop at ADR-0009; ADR-0010 is unused;
• no feature/publisher-services/adr-02 ref exists.

These are specification facts only and must be reverified before any branch creation.

2. Authority and reason for a superseding ADR

Repository doctrine in docs/engineering/decisions/README.md states that after approval, material architectural changes require a new ADR that supersedes the old one; only factual clarifications that do not alter the decision may edit an approved ADR in place.

ADR-0004 - Distribution platform inventory is APPROVED AND REPOSITORY-AUTHORITATIVE. Its normative inventory currently records CAMBRIDGE_UNIVERSITY_LIBRARY and FIGSHARE as assignable AutomaticPush destinations, and its rollout section explicitly says a later approved inventory change supersedes ADR-0004 rather than editing history.

The CTO product decision of 2026-08-27 retires both services while retaining their stable historical identities. That changes assignment availability for two existing values and introduces assignment-option visibility as a distinct descriptor concern. It is therefore a material decision and requires a superseding ADR.

The independent BE-05 review record 5441494405 is authoritative review evidence for the defect in the previous specification, but it does not approve this new ADR task or decision.

3. Objective

Record a new repository-wide current decision, ADR-0010, that supersedes ADR-0004 for the DistributionPlatform inventory and descriptor policy while preserving historical enum identities and all unaffected architecture.

The decision must make Figshare and Cambridge University Library retired, non-assignable and hidden from assignment options; preserve JISC_NBK as inactive/non-assignable but visible; retain all 17 stable enum/database identities; preserve historical assignment/location/audit/job evidence; and define the architecture contract that BE-05 may implement only after ADR-0010 is approved and merged into develop.

ADR-02 is documentation/architecture work only. It does not itself change runtime platform behavior.

4. Exact proposed ADR-0010 decision

Independent review and CTO approval of this issue must evaluate the following exact decision. The implementation agent must not invent or widen architecture beyond it.

4.1 Stable inventory

DistributionPlatform remains a closed, exhaustive inventory of exactly the same 17 stable identities, in the same canonical order and with the same serialized/database labels.

No value is deleted, renamed, renumbered, reused or replaced by OTHER/fallback behavior.

4.2 Destination retirement

The current policy becomes:

Platform	Mechanism readiness	Assignment availability	Assignment-option visibility
CAMBRIDGE_UNIVERSITY_LIBRARY	Inactive	NonAssignable	Hidden
FIGSHARE	Inactive	NonAssignable	Hidden
JISC_NBK	Inactive	NonAssignable	Visible
all other current destinations	unchanged from ADR-0004	unchanged from ADR-0004	Visible

Assignment-option visibility is a code-owned domain policy distinct from mechanism readiness and assignment availability. Hidden does not mean deleted or unknown.

Retained adapter/profile names for retired destinations are historical/domain provenance only and do not assert a currently executable service.

4.3 GraphQL assignment-option projection

The stable GraphQL DistributionPlatform enum continues to expose all 17 identities.

The assignment-option projection is intentionally smaller:

• exactly 15 visible distributionPlatformOptions rows;
• omit only CAMBRIDGE_UNIVERSITY_LIBRARY and FIGSHARE;
• retain JISC_NBK with assignable=false;
• preserve canonical relative order;
• executable field/type/enum/nullability shape remains unchanged.

The GraphQL query-field description must truthfully describe a visible assignment-option projection rather than claim to return the complete stable inventory.

4.4 Historical state and reconciliation

Retirement does not delete or rewrite historical platform-assignment rows, service-configuration history, location records, durable-job records or audit evidence.

Retired identities remain parseable and usable for historical reads, reverse lookup and controlled disable/reconciliation paths.

A publisher that still holds a retired enabled assignment must be reconciled before backend activation of the new non-assignable policy. Frontends must not hide unresolved enabled canonical state with a local platform-name denylist.

4.5 Migration/backfill consequence

The closed MIG-01 administrative facade is an additional in-repository consumer of DistributionPlatform::is_assignable(). After the retirement policy is implemented, a historical/future MIG-01 dry-run manifest that requests either retired destination may fail closed as MigrationBackfillManifestInvalid at whole-manifest planning granularity.

This does not reopen or invalidate completed MIG-01 production evidence. MIG-01 is closed, and its 2026-08-25 production reconciliation remains historical authoritative evidence for the state it verified. Re-running a historical manifest after the policy change is not guaranteed to reproduce the earlier facade result and is not an authorized continuation of the closed production operation. Any future need to replay/revalidate such a manifest is fresh controlled work with a fresh specification/evidence gate.

ADR-02 does not change migration_backfill.rs.

4.6 Automatic job creation

This decision does not authorize THOTH_DISTRIBUTION_JOB_CREATION to move from OFF. General durable-job creation remains separately gated by the Publisher Services worker/readiness programme.

4.7 Downstream ordering

The architecture dependency order is:

ADR-0010 approved + merged -> BE-05 source implementation/review/merge -> DIS-03 pins exact merged BE-05 contract -> DIS-03 source review/merge -> separately authorized dissemination runtime retirement -> production assignment/job audit and reconciliation -> backend production activation -> APP-04 integration verification.

No downstream repository may guess the unmerged ADR/BE-05 contract.

5. Supersession semantics

After ADR-0010 is explicitly CTO-approved, faithfully recorded, independently source-reviewed and merged into develop:

• ADR-0010 becomes the current repository-authoritative DistributionPlatform inventory/descriptor decision;
• ADR-0004 becomes SUPERSEDED by ADR-0010;
• ADR-0004 remains immutable historical evidence apart from the minimum status/superseded-by metadata needed to point to ADR-0010; its original decision tables, evidence and approval history must not be rewritten;
• decision-register.md must identify ADR-0010 as current and ADR-0004 as superseded;
• docs/publisher-services/platform-inventory.md becomes the current inventory surface under ADR-0010 and must no longer present the superseded assignability state as current.

ADR-0010 must explicitly carry forward all ADR-0004 decisions/invariants not changed by section 4 above, including the closed 17-value inventory, no fallback, linked OAPEN/DOAB behavior, shared OCLC/Ex Libris feed distinction, conservative update/withdrawal policy, destination-vs-adapter distinction, and historical evidence boundaries. The new ADR must be sufficient as the current normative decision without requiring an implementer to guess which superseded ADR-0004 rules survived.

6. Scope

After independent specification/decision review, explicit CTO approval and a later fresh exact-base implementation authorization, ADR-02 may only:

1. create ADR-0010 with the exact approved decision above and the required retained ADR-0004 invariants;
2. minimally update ADR-0004 status/superseded-by metadata without rewriting its historical decision content;
3. update decision-register.md so ADR-0004 is superseded and ADR-0010 is the current approved decision;
4. update the current Publisher Services platform inventory to the 17-stable / 15-visible-option retirement semantics;
5. add a bounded changelog entry;
6. record implementation evidence in GitHub issue/PR records. No repository implementation-report file is required for ADR-02 unless a later reviewed specification amendment explicitly adds one.

7. Exact candidate write budget

Existing files permitted:

• docs/engineering/decisions/ADR-0004-distribution-platform-inventory.md - status/superseded-by metadata only; no historical decision rewrite
• docs/engineering/decisions/decision-register.md
• docs/publisher-services/platform-inventory.md
• CHANGELOG.md

New files permitted:

• docs/engineering/decisions/ADR-0010-distribution-platform-retirement.md

Deletion/move/rename: NONE

No Rust, SQL, migration, GraphQL, generated client, workflow, auth, provider or downstream-repository file is in scope.

If another path is required to make the decision repository-authoritative, return HOLD and amend the specification before editing it.

8. Non-goals

ADR-02 must not:

• implement BE-05 runtime behavior;
• modify DistributionPlatform Rust code or tests;
• modify GraphQL source or generated schema/client artifacts;
• modify migration_backfill.rs or reopen MIG-01;
• modify thoth-dissemination or thoth-app;
• delete historical rows/evidence;
• inspect or mutate production/provider/runtime state;
• enable distribution-job creation;
• create/dispatch operational workflows;
• merge, release, deploy or activate production behavior as a side effect of ADR recording.

9. Acceptance evidence for ADR implementation

The later ADR-02 source PR must prove:

• ADR-0010 exists at the exact approved path and contains the exact approved retirement decision;
• ADR-0010 restates/carries forward every still-current ADR-0004 invariant needed for a standalone current decision;
• ADR-0004 historical content is unchanged except minimum supersession metadata;
• decision-register.md marks ADR-0004 superseded and ADR-0010 current without stale conflicting authority text;
• platform-inventory.md contains exactly 17 stable identities, CUL/Figshare retired/nonassignable/hidden, JISC inactive/nonassignable/visible, and the 15-option projection rule;
• no runtime/source/schema/migration/API/workflow behavior changes in the PR;
• no historical task/review/implementation evidence is rewritten as though this decision existed earlier;
• relative links resolve;
• git diff --check passes;
• normal repository CI for the exact PR head is reviewed before merge.

10. CI and automatic external side effects

Current Thoth PR workflows can automatically run build/test/classification checks and may publish a staging-pr-* GHCR image on a PR, including when the classifier path fails rather than only when it explicitly selects Docker work.

Therefore any later authorization to open/update the ADR-02 PR must unconditionally acknowledge the possibility of automatic staging-image publication. That side effect is not authorized by this specification candidate.

Manual CI dispatch remains unauthorized.

11. Rollout and rollback

ADR rollout is repository authority only:

1. exact ADR decision receives independent review;
2. CTO explicitly approves the exact decision;
3. a separate implementation authorization binds a fresh develop SHA and exact write budget;
4. the decision is recorded on one bounded task branch/PR;
5. the exact source head receives independent review;
6. HIGH-risk merge requires explicit CTO merge authorization;
7. merge to develop makes ADR-0010 repository-authoritative;
8. only then may BE-05 receive implementation authorization relying on it.

No runtime behavior changes merely because ADR-0010 merges.

Rollback of the architecture decision requires a later approved superseding ADR. Do not restore ADR-0004 as current by silently editing status/index files or rewriting historical evidence.

12. HOLD / STOP

HOLD if:

• this exact issue/decision is not independently reviewed and CTO-approved;
• ADR-0010 becomes occupied by another decision before implementation;
• develop moves after an implementation base is authorized;
• the proposed task branch appears/overlaps before authorization;
• another source path becomes necessary;
• the decision would require an executable GraphQL, migration, auth, job, provider or downstream-source change in ADR-02 itself;
• authoritative repository doctrine conflicts with this supersession route.

STOP if implementation begins:

• rewriting ADR-0004 historical decision content;
• changing Rust/GraphQL/schema/migrations/workflows;
• accessing production/provider state;
• enabling job creation;
• merging/releasing/deploying/activating without the separate applicable gate.

13. Candidate action-authorization matrix

This matrix is specification content only. It is not active authorization.

Action	Candidate authorization after later exact-base implementation approval
repository/GitHub read	YES
edit existing files in exact write budget	YES
create only ADR-0010 file	YES
delete/move/rename	NO
create task branch from exact authorized base	YES
local documentation/static validation	YES
commit	YES
push	YES
open/update draft PR	YES only if authorization explicitly accepts automatic PR CI/GHCR side effect
issue/comment evidence mutation	YES
manual CI dispatch/rerun	NO
provider/runtime/database read or write	NO
migration execution	NO
merge	NO
release/deploy/production activation	NO

14. Current authorization

Authorized by the control-plane step that created this issue:

• live repository/GitHub read inspection;
• creation of this repository-local ADR task/specification;
• bounded issue/comment coordination needed to record the resulting dependency.

Not authorized:

• repository source/file mutation;
• branch creation;
• commit/push;
• PR creation/mutation;
• automatic staging-image publication caused by a new PR;
• CI dispatch/rerun;
• provider/runtime/production/database access;
• migration execution;
• merge/release/deployment/activation.

15. Required independent review

Use a fresh non-preparing reviewer; because this is HIGH risk and controls cross-repository behavior, prefer a different model/model family.

The reviewer must inspect the exact issue decision against live:

• docs/engineering/decisions/README.md;
• ADR-0004;
• decision-register.md;
• current platform-inventory.md;
• BE-05 BE-05 - Deprecate Figshare and Cambridge University Library distribution destinations #840 and independent review 5441494405;
• the is_assignable() consumers relevant to the recorded MIG-01 consequence;
• downstream contract assumptions in DIS-03 Output to CSV #101 and APP-04 Unify docker images with new domain #157.

Decision: APPROVED, CHANGES REQUIRED or BLOCKED.

An APPROVED review is architecture/specification review evidence only. It does not authorize source implementation, PR activity, merge or runtime action.

16. Next action

Obtain an independent specification/architecture review of this exact issue. If approved, obtain explicit CTO approval of the exact ADR-0010 decision. Only after that may a fresh exact-base documentation implementation authorization be considered.

[ja573]

INDEPENDENT SPECIFICATION / ARCHITECTURE REVIEW HANDOFF - ADR-02 / ADR-0010

Review requested. This handoff is not a review decision and authorizes no source implementation.

Review the complete current ADR-02 specification and exact proposed ADR-0010 decision in this issue.

Fresh handoff baseline:

• repository: thoth-pub/thoth
• develop: a6c8cb2016179db635c4bc86ef366aae190829c2
• repository ADR namespace at handoff: ADR-0001 through ADR-0009; ADR-0010 unused
• proposed branch namespace: no feature/publisher-services/adr-02 ref observed at issue creation
• blocked consumer: BE-05 / BE-05 - Deprecate Figshare and Cambridge University Library distribution destinations #840
• BE-05 independent review: comment 5441494405 = CHANGES REQUIRED
• BE-05 control amendment accepting those findings: comment 5441629788
• risk: HIGH; use a fresh reviewer distinct from the preparing control context, preferably a different model/model family

If the ADR-02 issue body is materially edited after this handoff, return HOLD and review the new exact candidate rather than relying on this package.

Required independent inspection

Do not approve from the issue prose alone. Inspect live source/doctrine at the exact baseline and verify at minimum:

1. docs/engineering/decisions/README.md genuinely requires a superseding ADR for this material change and permits only factual in-place clarifications after approval;
2. ADR-0004 is currently approved/repository-authoritative and explicitly says a later inventory change supersedes it rather than rewriting history;
3. ADR-0010 is the correct next unused repository-wide decision number and the proposed path/title do not collide with another live decision;
4. the proposed ADR-0010 decision is complete enough to replace ADR-0004 as current authority while retaining every unchanged normative invariant needed by consumers, rather than leaving ambiguous partial reliance on a superseded ADR;
5. the decision correctly retains exactly 17 stable enum/database identities while adding the separate visible/hidden assignment-option policy, with CUL/Figshare inactive+nonassignable+hidden and JISC inactive+nonassignable+visible;
6. the intended 15-row distributionPlatformOptions projection remains compatible with the unchanged 17-value GraphQL enum and executable field/type/nullability shape;
7. historical assignment/configuration/location/job/audit evidence remains valid and the decision preserves controlled disable/reverse-read behavior needed for reconciliation;
8. the MIG-01 consequence is stated accurately: migration_backfill.rs is a separate is_assignable() consumer using MigrationBackfillManifestInvalid, completed MIG-01 evidence is not invalidated, and any later historical-manifest replay after policy change is fresh controlled work rather than silently guaranteed deterministic replay;
9. the docs-only write budget is sufficient and appropriately bounded: new ADR-0010, minimal ADR-0004 supersession metadata, decision register, current platform inventory and CHANGELOG only;
10. ADR-0004 historical decision tables/evidence are not rewritten under the new task;
11. the proposed sequencing is correct: ADR-0010 must be independently approved, explicitly CTO-approved, faithfully recorded, exact-head reviewed and merged into develop before BE-05 implementation can rely on it;
12. PR mutation is correctly kept behind a later authorization that unconditionally accepts the possibility of automatic staging GHCR publication;
13. no runtime/schema/migration/GraphQL/auth/provider/downstream-repository source change is hidden inside ADR-02.

Required decision record

Post a new comment on #842 using exactly one decision:

• APPROVED - the exact ADR-02 specification and proposed ADR-0010 architecture are acceptable as written;
• CHANGES REQUIRED - list every blocking correction/evidence gap with source/spec references;
• BLOCKED - identify the authority/dependency/environment condition preventing safe approval.

Record:

• reviewer context/model;
• exact develop SHA reviewed;
• whether the issue body still matched this handoff candidate when review began;
• exact source/doctrine inspected for any blocking finding.

An APPROVED review is specification/architecture-review evidence only. It does not authorize creating ADR-0010 source, editing ADR-0004/register/inventory, branch creation, commit, push, PR mutation, CI/GHCR publication, merge, runtime/provider/data access, deployment or activation. Explicit CTO decision approval and a later fresh exact-base implementation authorization remain separate gates.

[ja573]

INDEPENDENT SPECIFICATION / ARCHITECTURE REVIEW - ADR-02 / ADR-0010

Decision: CHANGES REQUIRED

Reviewer context

• Reviewer: independent specification/architecture-review agent instance, distinct from the preparing control context
• Model: Claude Opus 5 (claude-opus-5), Anthropic; Claude Code CLI harness
• Prior related review by this same reviewer instance: BE-05 independent review 5441494405. This review was conducted afresh against live source and doctrine; no BE-05 conclusion was carried over unverified.
• Scope: review only. No file edit, branch, commit, push, PR, CI dispatch, provider/runtime/production access, merge, deploy or activation was performed. All inspection was read-only (local clones + GitHub API).
• Review date: 2026-08-27

Baseline verified

• Repository: thoth-pub/thoth; develop re-verified live as a6c8cb2016179db635c4bc86ef366aae190829c2 - matches the handoff baseline exactly.
• Issue body still matched the handoff candidate: #842 lastEditedAt is null (never edited since creation at 2026-08-27T15:46:47Z); updatedAt 15:48:03Z is the handoff comment itself. No HOLD for body drift.
• ADR namespace re-verified at baseline: decision files run ADR-0001 … ADR-0009; ADR-0010 is unused, no ADR-0010 file, no competing issue/PR claiming it, and no feature/publisher-services/adr-02 ref on origin.
• Also inspected: docs/engineering/decisions/README.md, full ADR-0004, decision-register.md, docs/publisher-services/platform-inventory.md, docs/publisher-services/README.md, docs/publisher-services/decisions.md, docs/engineering/repository-map/control-gaps.md, thoth-api/src/model/publisher_distribution_platform/{mod.rs,crud.rs}, thoth-api/src/model/publisher_service_configuration/{crud.rs,migration_backfill.rs}, .github/workflows/docker_build_and_push_to_dockerhub.yml, .github/scripts/classify_ci_changes.py, BE-05 #840 + amendment 5441629788, MIG-01 #828, DIS-03 thoth-dissemination#101, APP-04 thoth-app#157.

The supersession route itself is correct. docs/engineering/decisions/README.md ("Amendments") requires a new superseding ADR for material architectural change after approval and permits in-place editing only for factual clarifications that do not alter the decision; ADR-0004 is APPROVED AND REPOSITORY-AUTHORITATIVE and its §10 states that a later approved inventory change "supersedes this ADR explicitly rather than editing history"; ADR-0004 §4.1 records CAMBRIDGE_UNIVERSITY_LIBRARY and FIGSHARE as assignable, and §8 invariant 6 makes availability an ADR-level invariant, so the retirement is unambiguously material. ADR-02 §2 is accurate and ADR-0010 is the doctrinally correct instrument. What blocks approval is completeness and boundedness of the recording, not the route.

---

Blocking findings

F1 - The carry-forward requirement is unverifiable and omits normative ADR-0004 content that live consumers depend on

§5 requires ADR-0010 to "explicitly carry forward all ADR-0004 decisions/invariants not changed by section 4 above, including the closed 17-value inventory, no fallback, linked OAPEN/DOAB behavior, shared OCLC/Ex Libris feed distinction, conservative update/withdrawal policy, destination-vs-adapter distinction, and historical evidence boundaries." §9's corresponding acceptance test is "carries forward every still-current ADR-0004 invariant needed for a standalone current decision" - a subjective standard no reviewer can fail objectively.

Measured against ADR-0004's actual normative content at a6c8cb20, the illustrative list omits, and §9 cannot detect the loss of:

• §4.2 alias/legacy-name resolution (17-row table; "All aliases resolve to stable codes; no alias is a separate value", plus the explicit rulings that ProQuest is not an enum value and that Ebook Central / Ex Libris / Serial Solutions are not aliases of one another). This is a closed-inventory guarantee, not decoration.
• §4.4 duplicate-prevention requirements 1-6 - only partially implied by "linked OAPEN/DOAB" and "shared feed".
• §4.6 the Thoth-managed source-file invariant, headed "Binding architecture, recorded here and implemented later", and restated as §8 invariant 7. No illustrative item covers it, and platform-inventory.md:108 currently cites "ADR-0004 section 4.6" as its authority.
• §4.7 ownership/configuration authority and its fail-closed mismatch rule, and §8 invariant 9 (fail-closed configuration; empty assignments never broaden processing).
• §4.8 the ten recorded exclusions - the content that makes ADR-0004's "closed and exhaustive" claim verifiable at all ("every active channel … maps to exactly one value above or to an explicit exclusion in section 4.8"). platform-inventory.md:132 cites "ADR-0004 section 4.8".
• §5 the BE-02 descriptor contract table, which carries per-value back-catalogue / update / withdrawal expectations not reducible to §4.5 - notably Crossref update supported while every other push destination is disabled.
• §6 the future dissemination mapping, explicitly "architecture evidence for later DIS-01 work". This is the anchor DIS-03 relies on: thoth-dissemination#101 §17 states it "supersedes those two mappings prospectively". Superseding ADR-0004 without carrying or repointing §6 leaves DIS-03's architecture evidence inside a superseded document.

The converse problem is unaddressed too: some ADR-0004 content is dated evidence, not standing decision - §4.9 ("As of 2026-08-06 the CTO confirms there are no known current manual-only … destinations") and §4.10 known defects (ProQuest EPUB-fallback defect; CUL writeback under LocationPlatform 'OTHER'). Copying these forward verbatim into a 2026-08-27 decision would misstate their currency; dropping them silently loses recorded defects. §5 gives no disposition rule, so the implementer must guess - which is precisely the "ambiguous partial reliance on a superseded ADR" this review was asked to prevent.

Required correction: require ADR-0010 to contain an explicit, section-by-section disposition of ADR-0004 §§4.1-4.10, 5, 6 and 8, each marked carried forward (restated in full) / changed by §4 / retained as historical evidence only, and rewrite §9's acceptance test to check that table rather than a subjective sufficiency standard. Also require platform-inventory.md's "ADR-0004 section 4.2 / 4.6 / 4.8" cross-references (lines 87, 108, 132) to be repointed at the corresponding ADR-0010 sections.

F2 - The write budget omits two ACTIVE surfaces that will keep asserting ADR-0004 as current authority, and no task owns them

Two live, non-historical control surfaces state ADR-0004's authority as current programme state:

• docs/publisher-services/README.md:3 - the programme Status line: "… ADR-0004 AND FINAL PLATFORM INVENTORY APPROVED AND REPOSITORY-AUTHORITATIVE …", repeated at :90 (ADR-0004 APPROVED AND REPOSITORY-AUTHORITATIVE / FINAL DISTRIBUTION-PLATFORM INVENTORY APPROVED AND REPOSITORY-AUTHORITATIVE) inside a current-state block.
• docs/publisher-services/decisions.md - header Status: ACTIVE SUMMARY, "This file summarizes decisions. The approved technical design and approved ADRs remain authoritative." Lines 153-158 record the final inventory as current with "17 values; no OTHER; JISC_NBK included but inactive and non-assignable; 10 recorded exclusions". After ADR-0010 there are three non-assignable destinations and two hidden, so this active summary becomes materially wrong.

Neither path is in ADR-02 §7. BE-05's amended write budget (comment 5441629788) explicitly removes all documentation except CHANGELOG.md and hands ADR-0004 / register / inventory to #842 - so after both tasks complete, no task owns these two files. §7's escape hatch ("If another path is required to make the decision repository-authoritative, return HOLD") most likely will not even fire, because repository authority comes from the ADR + register + merge; the realistic outcome is a silent contradiction between the register and two ACTIVE programme surfaces. This is the same defect class ADR-02 was created to fix in BE-05.

For completeness, I checked the other ADR-0004 referents and they correctly need no change: docs/engineering/repository-map/control-gaps.md:154-190 is explicitly dated closure evidence ("State as of 2026-08-07", "CG-07 is RESOLVED as of 2026-08-07"); adr-01-evidence-matrix.md, rollout-plan.md:91 and task-status.md:76 are historical/evidence records; ADR-0005:42 cites ADR-0004 only as a historical shape example.

Required correction: either add both paths to §7, or name the explicit bounded follow-up task that owns them and state whether BE-05's reliance on ADR-0010 is gated behind it. Decide it in the specification rather than leaving it to discovery.

F3 - Rewriting platform-inventory.md would attach an existing approval attestation to content it never approved

docs/publisher-services/platform-inventory.md is in the write budget, and §5 requires it to become "the current inventory surface under ADR-0010 [which] must no longer present the superseded assignability state as current". But its header is a content approval bound to an exact head:

Status: FINAL INVENTORY APPROVED AND REPOSITORY-AUTHORITATIVE
Approved content head: `44e6f821535fbee56c830dd6eda237fc6d06fbfd`
Independent review: `4881233664` (`APPROVED`)
CTO approval: `4881279067`
Approval date: 2026-08-07

and §1 reinforces it: "The approved inventory is exactly that reviewed content: 17 included destinations, 10 recorded exclusions … JISC_NBK included but inactive and non-assignable …", with "The approval is a content approval bound to that exact head."

Rewriting the body to the retirement semantics while leaving that header asserts CTO approval and independent review at head 44e6f821 for content that head never contained. §5 protects ADR-0004's historical integrity explicitly but is silent on the inventory's, and §9's acceptance list checks the inventory's content (17 stable / retired / hidden / 15-option rule) without checking its provenance metadata.

Required correction: require the inventory to separate its ADR-01/ADR-0004 approval provenance (recorded as historical) from its current state under ADR-0010, carrying the new content's own review/approval identity, and add that check to §9.

---

Non-blocking observations

1. §9 does not require ADR-0010 to satisfy the doctrinal ADR structure. docs/engineering/decisions/README.md ("Required content") requires every ADR to identify decision owner; affected programmes and repositories; context and decision drivers; options considered; exact decision; invariants; implementation impact; migration, rollout and rollback effects; validation evidence; approval state. §4 supplies the exact decision and §5 the invariant carry-forward, but §9's acceptance list omits doctrinal conformity, and §4's instruction that the agent "must not invent or widen architecture beyond it" could be read as discouraging the missing sections. Add conformity to §9 explicitly.
2. Proposed ADR title/path understates the artifact. ADR-0010-distribution-platform-retirement describes the change, but after supersession ADR-0010 is the current inventory and descriptor-policy decision - which decision-register.md must present as such. Consider a title covering inventory + retirement so the register does not read as though the inventory decision has no current owner.
3. §10's GHCR statement is accurate, and can be made proportionate. Verified: docker_build_and_push_to_dockerhub.yml triggers on: pull_request, logs into GHCR, push: true, tag prefix staging-pr-, and its job condition always() && !cancelled() && (needs.classify.result != 'success' || needs.classify.outputs.run_docker == 'true') does publish on classifier failure. Additionally, every path in ADR-02's §7 budget is a documentation path under classify_ci_changes.py:75 (is_documentation_path = CHANGELOG.md or docs/), so a successful classification yields docs_only=True, run_docker=False (:102-108) and publishes nothing. Keeping the acknowledgement unconditional is right; recording that the residual risk is confined to classifier failure/cancellation would let the later authorization be proportionate.
4. DIS-03's own record still starts the chain at BE-05. thoth-dissemination#101 gate text and §18 order begin at BE-05 and do not name ADR-0010. Transitively safe, since BE-05 cannot merge without it, and ADR-02 §4.7 states the correct full chain - but DIS-03's control record should pick up the ADR-0010 prefix when it is next amended. Not an ADR-02 defect.
5. §6 item 6 (no implementation-report file) diverges from the most recent ADR-creating precedent. CTRL-BRANCH-NAMESPACE-01 (commit 6acbf2fe, PR CTRL-BRANCH-NAMESPACE-01: correct programme-integration branch namespace #838) committed ADR-0009, the decision-register.md update and a repository implementation-report file in one PR. ADR-02's choice of GitHub-ledger evidence is legitimate under ADR-0005, and is consistent with BE-05's amended §21 - just note the divergence deliberately rather than by omission.

---

Verified as specified (source-backed)

Against the handoff's thirteen required checks, at a6c8cb20:

1. Doctrine requires a superseding ADR - decisions/README.md "Amendments" verbatim; only factual clarifications may edit in place. ✅
2. ADR-0004 is approved/authoritative and self-declares supersession - header APPROVED AND REPOSITORY-AUTHORITATIVE, Superseded by: None; §10 "it supersedes this ADR explicitly rather than editing history"; §8 invariant 1 "until a later approved ADR changes them". ✅
3. ADR-0010 is the correct next unused number; no collision - files stop at ADR-0009; ADR-NNNN-short-title.md convention matched; no branch, file or competing issue/PR claims it. ✅
4. Completeness as standalone authority - ⚠️ see F1.
5. 17 stable identities + separate visibility policy - DistributionPlatform::ALL is [DistributionPlatform; 17] (mod.rs:456); CUL and Figshare descriptors are currently Assignable, Active (mod.rs:319-328, :339-348), JISC is NonAssignable, Inactive (mod.rs:415-424). AssignmentAvailability and MechanismReadiness already exist as internal, deliberately non-GraphQL vocabularies (mod.rs:186-206), so adding visibility as a third code-owned axis - with CUL/Figshare hidden and JISC visible - is consistent with the existing model and with §4.2's table. ✅
6. 15-row projection against an unchanged 17-value enum - DistributionPlatformOption::all() (mod.rs:543-549) maps over ALL, so a descriptor filter preserves canonical relative order; omitting indices 4 and 6 leaves 15; enum values, field name, list return type and nullability are untouched, and the only description at issue is graphql/query.rs:619. There is no pinned SDL artifact and no full-SDL snapshot test in this repository - the guards are structural (graphql/sdl_support.rs, graphql/distribution_platform_tests.rs:426-475). ✅
7. Historical state and reconciliation preserved - §4.4 matches the code: enable/enable_on reject before any write (publisher_distribution_platform/crud.rs:94, :129), the coordinator validates the whole normalized desired set before the first lifecycle call (publisher_service_configuration/crud.rs:118-127), while disable/disable_on carry no assignability check and retain rows - so a retired assignment stays removable, and publishersByDistributionPlatform keeps the reverse-read path. §4.4's ban on a frontend name denylist matches APP-04 (thoth-app#157), which is a zero-source-change verification task. ✅
8. MIG-01 consequence stated accurately - migration_backfill.rs:1110 is indeed a separate is_assignable() consumer raising ThothError::MigrationBackfillManifestInvalid, and it sits inside build_plan, so it aborts whole-manifest planning for both dry-run and apply and cannot cause a partial write. #828 is CLOSED with its 2026-08-25 production evidence recorded (5412605297, 5412808243, 5412856863). §4.5's framing - completed evidence not invalidated, replay not guaranteed deterministic, any replay is fresh controlled work, migration_backfill.rs unchanged - is correct and is the right disposition. ✅
9. Docs-only budget - correctly docs-only and correctly excludes all Rust/SQL/GraphQL/workflow paths; ⚠️ incomplete, see F2 and F3.
10. ADR-0004 historical content protected - §5, §7 ("status/superseded-by metadata only; no historical decision rewrite"), §8 and §12 STOP are mutually consistent and sufficient for ADR-0004 itself. ✅
11. Sequencing - §11's eight-step rollout (independent review → CTO approval → fresh exact-base authorization → bounded branch/PR → exact-head review → HIGH-risk merge authorization → merge → only then BE-05 authorization) is correct and matches BE-05's amended gate in 5441629788, which explicitly removes ADR-0004/register/inventory from BE-05 and requires BE-05 to consume the exact merged ADR-0010 identity. ✅
12. PR mutation behind an unconditional GHCR acknowledgement - §10 and §13 keep PR mutation conditional on a later authorization that accepts the automatic publication possibility, and §10's classifier-failure wording is accurate. ✅ (see observation 3)
13. No hidden runtime change - §7 admits no Rust, SQL, migration, GraphQL, generated-client, workflow, auth, provider or downstream-repository path, and §8 forbids them explicitly. Nothing in §4 requires source change to record the decision. ✅

---

Disposition

CHANGES REQUIRED. The architectural judgement is right: superseding ADR-0004 with ADR-0010 is the doctrinally correct instrument, the retirement semantics are consistent with the code at the reviewed baseline, the 17-stable / 15-visible split is implementable without touching the executable GraphQL contract, the historical and reconciliation guarantees hold, the MIG-01 consequence is stated honestly, and the ordering and CI acknowledgements are correct.

What blocks approval is that the recording is not yet bounded tightly enough to guarantee the outcome it promises: ADR-0010's carry-forward obligation is unverifiable and demonstrably under-enumerated (F1), the write budget leaves two ACTIVE surfaces asserting superseded authority with no owner (F2), and rewriting the inventory in place would carry an approval attestation onto content it never covered (F3). All three are specification-text corrections; none requires re-deciding the architecture.

Re-review after amendment should be bounded to §5, §7 and §9.

This decision is specification/architecture-review evidence only. It does not authorize creating ADR-0010 source, editing ADR-0004 / the register / the inventory, branch creation, commit, push, PR mutation, CI or GHCR publication, merge, runtime/provider/data access, deployment or activation. Explicit CTO decision approval and a later fresh exact-base implementation authorization remain separate gates.

[ja573]

ADR-02 SPECIFICATION AMENDMENT AFTER INDEPENDENT REVIEW - CHANGES REQUIRED ACCEPTED

Decision type: CONTROL SPECIFICATION AMENDMENT - NOT ARCHITECTURE APPROVAL AND NOT IMPLEMENTATION AUTHORIZATION.

Independent review 5441864735 returned CHANGES REQUIRED against develop @ a6c8cb2016179db635c4bc86ef366aae190829c2. The three blocking recording defects have been rechecked against the same live baseline and are accepted.

This comment is the authoritative bounded amendment to the current ADR-02 candidate. It replaces only §§5, 7 and 9 of the #842 issue body with the text below. Every other section of the issue body remains unchanged and continues to apply. In particular, the architecture decision in §4 is unchanged.

Current gate after this amendment: HOLD - bounded independent re-review of amended §§5/7/9 -> explicit CTO approval of the exact ADR-0010 decision -> later fresh exact-base documentation implementation authorization.

No source/file write, branch, commit, push, PR mutation, CI/GHCR action, provider/runtime/data access, migration, merge, release, deployment or activation is authorized by this amendment.

---

Replacement §5 - Supersession semantics

After ADR-0010 is explicitly CTO-approved, faithfully recorded, independently source-reviewed and merged into develop:

• ADR-0010 becomes the current repository-authoritative DistributionPlatform inventory/descriptor decision;
• ADR-0004 becomes SUPERSEDED by ADR-0010;
• ADR-0004 remains immutable historical evidence apart from the minimum status/superseded-by metadata needed to point to ADR-0010; its original decision tables, evidence and approval history must not be rewritten;
• decision-register.md must identify ADR-0010 as current and ADR-0004 as superseded;
• docs/publisher-services/platform-inventory.md becomes the current inventory surface under ADR-0010 and must no longer present the superseded assignability state as current;
• the two active Publisher Services summary surfaces identified in review 5441864735 must be reconciled in the same bounded ADR-02 change so they do not continue to assert ADR-0004 as current authority.

5.1 Mandatory ADR-0004 section-by-section disposition

ADR-0010 must be a standalone current decision. It must contain an explicit disposition table covering every item below. No listed section may be silently omitted, and the implementing agent may not decide disposition ad hoc.

ADR-0004 section	Required ADR-0010 disposition
§4.1 Final exhaustive inventory	CHANGED BY ADR-0010 §§4.1-4.2 AND RESTATED IN FULL. Restate the complete 17-row stable inventory in canonical order. CUL and Figshare become inactive + non-assignable + hidden; JISC remains inactive + non-assignable + visible; all other current descriptor outcomes remain unchanged. No value is deleted/renamed/reused and no fallback is introduced.
§4.2 Aliases and legacy names	CARRIED FORWARD - RESTATED IN FULL. Preserve the complete alias/legacy-name mapping and the rulings that aliases are not separate enum values, ProQuest is not a vendor-umbrella enum value, and Ebook Central / Ex Libris / Serial Solutions are not aliases of one another.
§4.3 Linked groups and shared adapters/feeds	CARRIED FORWARD - RESTATED IN FULL WITH RETIREMENT QUALIFICATION. Preserve OAPEN/DOAB linkage, OCLC/Ex Libris shared-feed semantics, inactive JISC identity and destination-vs-adapter distinction. Any retained CUL/Figshare adapter/profile identity must be labelled historical/domain provenance and must not imply a currently supported executable service.
§4.4 Duplicate-prevention requirements	CARRIED FORWARD - RESTATED IN FULL. Preserve all six requirements, including no duplicate OAPEN/DOAB delivery, one OCLC KBART feed, no jobs for pull/manual destinations, inactive-destination no-job behaviour, MIG-01 no-job backfill, and empty-assignment fail-safe semantics.
§4.5 Conservative initial update and withdrawal policy	CARRIED FORWARD - RESTATED IN FULL. Preserve Crossref DOI redeposit as supported, automatic updates disabled for every other automatic-push destination absent later approval, pull-feed/manual semantics, and no automatic withdrawals. Retirement does not broaden update/withdrawal support.
§4.6 Thoth-managed source-file invariant	CARRIED FORWARD - RESTATED IN FULL. Automatic push dissemination may use only eligible Thoth-managed publication files/locations and must fail closed when none exists; enforcement remains separate HIGH-risk work unless independently delivered elsewhere.
§4.7 Ownership and configuration authority	CARRIED FORWARD - RESTATED IN FULL. Preserve Statement-of-Work entitlement authority, Thoth runtime desired-state authority, temporary operational mirrors, accountable/responsible roles and fail-closed mismatch semantics.
§4.8 Excluded candidates	CARRIED FORWARD - RESTATED IN FULL. Preserve all ten explicit exclusions and their individual reasons. Exclusions do not delete existing export-registry or LocationPlatform identities.
§4.9 Manual destinations	HISTORICAL EVIDENCE ONLY. Preserve the 2026-08-06 statement in ADR-0004 as dated evidence. ADR-0010 may reference it as historical evidence but must not copy it forward as a fresh 2026-08-27 current-state assertion unless separately reverified and approved.
§4.10 Known defects	HISTORICAL EVIDENCE ONLY. Preserve the recorded defect/current-behaviour evidence in ADR-0004. ADR-0010 must not silently relabel those dated observations as current evidence; any current claim requires fresh verification. Retirement does not erase the historical record.
§5 BE-02 descriptor contract	CHANGED BY ADR-0010 §4 AND RESTATED IN FULL. Restate the complete 17-value descriptor contract with assignment-option visibility as a third explicit code-owned axis. CUL/Figshare are inactive + non-assignable + hidden; JISC is inactive + non-assignable + visible; every other descriptor field remains unchanged, including Crossref update support and all back-catalogue/update/withdrawal expectations.
§6 Future dissemination mapping	CHANGED FOR THE RETIREMENT TARGET AND RESTATED IN FULL. Restate a complete 17-value architecture mapping. CUL/Figshare retain stable historical identities but their executable dissemination routes are the routes DIS-03 is required to retire. The ADR must distinguish this target architecture from pre-DIS-03 runtime until dissemination retirement is production-effective. All unaffected mappings carry forward; JISC remains explicitly inactive.
§8 Invariants	CHANGED BY ADR-0010 §4 AND RESTATED AS THE COMPLETE CURRENT INVARIANT SET. Carry forward the unchanged closed-inventory/no-fallback, destination-vs-adapter, OAPEN/DOAB, OCLC/Ex Libris, source-file, conservative update/withdrawal and fail-closed invariants; replace the old availability invariant with the approved CUL/Figshare retired-hidden policy plus JISC visible/non-assignable policy.

For every CARRIED FORWARD item, ADR-0010 must preserve the normative meaning rather than merely link to the superseded ADR. For every HISTORICAL EVIDENCE ONLY item, ADR-0004 remains the source of that dated evidence and ADR-0010 must not imply that it was freshly verified.

docs/publisher-services/platform-inventory.md currently cross-references ADR-0004 §§4.2, 4.6 and 4.8. When it becomes the ADR-0010 current inventory surface, those current-authority cross-references must be repointed to the corresponding ADR-0010 sections; historical ADR-0004 provenance links may remain where explicitly labelled historical.

5.2 Platform-inventory approval provenance

docs/publisher-services/platform-inventory.md must separate historical ADR-01/ADR-0004 approval provenance from the new current state.

The existing approval facts bound to exact head 44e6f821535fbee56c830dd6eda237fc6d06fbfd, independent review 4881233664, CTO approval 4881279067, approval date 2026-08-07 and PR #783 remain valid only for the historical ADR-01/ADR-0004 inventory content. They must be retained as a clearly labelled historical provenance block and must not be presented as approval of the retirement semantics.

The new current-state block must instead identify ADR-0010 / ADR-02 as the governing decision and cite the exact independent specification/architecture approval record and exact CTO decision-approval record that authorize the retirement semantics before implementation begins. Repository authority for the recorded source still arises only after the separately reviewed/authorized ADR-02 source is merged to develop; exact source-head review and merge evidence remain in the GitHub issue/PR ledger and must not be pre-invented in the document.

The inventory must never claim that head 44e6f821... contained or approved CUL/Figshare retirement or assignment-option hiding.

---

Replacement §7 - Exact candidate write budget

Existing files permitted:

• docs/engineering/decisions/ADR-0004-distribution-platform-inventory.md - status/superseded-by metadata only; no historical decision rewrite
• docs/engineering/decisions/decision-register.md
• docs/publisher-services/platform-inventory.md
• docs/publisher-services/README.md - only current programme-status/current-decision authority references necessary to replace ADR-0004/final-inventory-as-current with the ADR-0010 state; preserve historical lifecycle evidence and do not perform unrelated status cleanup
• docs/publisher-services/decisions.md - only the ACTIVE distribution-platform summary/current-authority wording necessary to distinguish historical ADR-01/ADR-0004 approval from the ADR-0010 retirement state; preserve historical approval records and do not rewrite unrelated decisions
• CHANGELOG.md

New files permitted:

• docs/engineering/decisions/ADR-0010-distribution-platform-retirement.md

Deletion/move/rename: NONE

These two newly added active-summary paths are in ADR-02 scope solely for the §5 supersession/authority reconciliation. They are not permission for general Publisher Services documentation cleanup.

No Rust, SQL, migration, GraphQL, generated client, workflow, auth, provider or downstream-repository file is in scope.

If another path is required, return HOLD and amend the specification before editing it.

---

Replacement §9 - Acceptance evidence for ADR implementation

The later ADR-02 source PR must prove all of the following:

ADR-0010 completeness and doctrine

• ADR-0010 exists at the exact approved path and contains the exact approved retirement decision from §4;
• ADR-0010 contains the §5.1 disposition table covering ADR-0004 §§4.1-4.10, 5, 6 and 8 with no omitted item;
• every CARRIED FORWARD - RESTATED IN FULL item is actually restated with its normative meaning intact;
• every CHANGED ... AND RESTATED IN FULL item contains the complete current replacement contract rather than a partial delta requiring consumers to guess against superseded ADR-0004;
• ADR-0004 §§4.9 and 4.10 remain dated historical evidence unless separately reverified; ADR-0010 does not silently present them as fresh current-state evidence;
• ADR-0010 satisfies the repository ADR required-content doctrine: decision owner; affected programmes and repositories; context and decision drivers; options considered; exact decision; invariants; implementation impact; migration/data effects; rollout and rollback effects; validation evidence; and approval state;
• the complete current descriptor contract still preserves all unaffected fields, including Crossref update support, while adding the approved visibility dimension;
• the complete dissemination mapping provides a current architecture anchor for DIS-03 and clearly distinguishes retirement target architecture from pre-cutover runtime.

Supersession and active authority surfaces

• ADR-0004 historical content is unchanged except minimum supersession metadata;
• decision-register.md marks ADR-0004 superseded and ADR-0010 current without stale conflicting authority text;
• docs/publisher-services/README.md no longer presents ADR-0004/the 2026-08-07 inventory as the current governing distribution-platform decision, while preserving its historical lifecycle evidence;
• docs/publisher-services/decisions.md no longer presents the old 17-value/one-nonassignable inventory summary as current; it distinguishes the historical ADR-01/ADR-0004 approval from current ADR-0010 retirement semantics without altering unrelated decisions;
• no other active current-authority surface in the exact reviewed scope contradicts ADR-0010.

Current inventory and provenance

• platform-inventory.md contains exactly 17 stable identities and records CUL/Figshare inactive + non-assignable + hidden, JISC inactive + non-assignable + visible, and the 15-visible-option projection rule;
• current-authority cross-references for alias resolution, the Thoth-managed source-file invariant and exclusions point to ADR-0010 rather than superseded ADR-0004;
• the historical ADR-01/ADR-0004 provenance remains explicit and bound only to head 44e6f821535fbee56c830dd6eda237fc6d06fbfd, review 4881233664 and CTO approval 4881279067;
• the new retirement/current-state content cites its own exact independent specification/architecture approval identity and exact CTO decision-approval identity and does not attribute that content to the 2026-08-07 approval head;
• source-head review/merge evidence is recorded in the GitHub issue/PR ledger and is not fabricated prospectively in the inventory.

Scope and validation

• the changed-file set is a subset of the replacement §7 write budget and contains no runtime/source/schema/migration/API/workflow/auth/provider/downstream-repository implementation file;
• no historical task/review/implementation evidence is rewritten as though ADR-0010 existed earlier;
• relative links resolve;
• git diff --check passes;
• normal repository CI for the exact PR head is reviewed before merge;
• automatic staging-image publication remains governed by §10/§13 and the later explicit PR authorization; manual CI dispatch remains unauthorized.

---

Review disposition carried forward

Review 5441864735 explicitly found the supersession route and architecture sound; the amendment above addresses only its F1/F2/F3 recording defects and the related doctrinal acceptance precision. It does not re-decide or widen §4.

Re-review is therefore bounded to replacement §§5, 7 and 9 against the unchanged remainder of the #842 issue body.

[ja573]

BOUNDED INDEPENDENT SPECIFICATION / ARCHITECTURE RE-REVIEW HANDOFF - ADR-02 / ADR-0010

Review requested. This handoff is not a review decision and authorizes no source implementation.

Review the ADR-02 candidate defined by:

1. the unchanged ADR-02 - Supersede distribution platform inventory for Figshare/Cambridge retirement #842 issue body; plus
2. specification amendment comment 5441979755, which replaces only §§5, 7 and 9.

The prior independent review is comment 5441864735 = CHANGES REQUIRED. That review explicitly found the supersession route and retirement architecture sound and bounded re-review to §§5, 7 and 9 after correction.

Fresh handoff baseline:

• repository: thoth-pub/thoth
• develop: a6c8cb2016179db635c4bc86ef366aae190829c2
• original ADR-02 - Supersede distribution platform inventory for Figshare/Cambridge retirement #842 body remains otherwise unchanged
• current amendment: 5441979755
• prior independent review: 5441864735
• blocked consumer: BE-05 / BE-05 - Deprecate Figshare and Cambridge University Library distribution destinations #840
• risk: HIGH

If the #842 body or the replacement amendment is materially edited after this handoff, return HOLD and review the new exact candidate instead.

Re-review scope - only replacement §5, §7 and §9

Verify against live repository doctrine/source that the amendment fully resolves all three blocking findings from 5441864735:

F1 - objectively complete supersession

• replacement §5.1 contains a disposition for every required ADR-0004 section: §§4.1-4.10, 5, 6 and 8;
• each disposition is technically correct as carried forward/restated in full, changed/restated in full, or historical evidence only;
• no normative alias, duplicate-safety, Thoth-managed-source-file, ownership/fail-closed, exclusion, descriptor, update/withdrawal or dissemination-mapping requirement is silently lost;
• §§4.9/4.10 are not incorrectly promoted from dated evidence into fresh current claims;
• the replacement treatment of ADR-0004 §6 gives DIS-03 a current architecture anchor while distinguishing target retirement from pre-cutover runtime;
• current platform-inventory.md cross-references to ADR-0004 §§4.2/4.6/4.8 are explicitly required to move to the corresponding ADR-0010 sections.

F2 - active surfaces have an owner

• replacement §7 correctly adds docs/publisher-services/README.md and docs/publisher-services/decisions.md;
• their edit permissions are narrow enough to reconcile current ADR/inventory authority without opening general programme-document cleanup;
• after ADR-02 implementation no active surface in the reviewed scope is knowingly left asserting ADR-0004/the 2026-08-07 inventory as current authority;
• the exact write budget remains documentation-only and no runtime/downstream source work is smuggled into ADR-02.

F3 - inventory approval provenance is truthful

• replacement §5.2 preserves head 44e6f821535fbee56c830dd6eda237fc6d06fbfd, review 4881233664, CTO approval 4881279067, date 2026-08-07 and PR docs: decide final distribution platform inventory #783 solely as historical ADR-01/ADR-0004 content provenance;
• the amendment prevents those records from being presented as approval of the retirement semantics;
• new current-state content must cite its own exact independent specification/architecture approval identity and CTO decision-approval identity;
• future exact source-head review/merge evidence stays in GitHub and is not fabricated before it exists.

Replacement §9 acceptance quality

Also verify that §9 now makes the above mechanically reviewable and explicitly requires ADR-0010 to satisfy the repository ADR required-content doctrine: owner, affected programmes/repositories, context/drivers, options, exact decision, invariants, implementation impact, migration/data effects, rollout/rollback, validation evidence and approval state.

Do not reopen §4 or other already-accepted architecture unless the amendment itself creates a contradiction with them. If a new blocking contradiction is discovered, identify it precisely rather than widening review generally.

Required decision record

Post a new comment on #842 using exactly one decision:

• APPROVED - replacement §§5/7/9 resolve the prior blocking findings and the exact amended candidate is acceptable;
• CHANGES REQUIRED - list each remaining blocking correction/evidence gap, restricted to the amended sections or a contradiction they introduce;
• BLOCKED - identify the authority/dependency/environment condition preventing safe approval.

Record:

• reviewer context/model;
• exact develop SHA reviewed;
• confirmation that the candidate reviewed was the unchanged ADR-02 - Supersede distribution platform inventory for Figshare/Cambridge retirement #842 body plus amendment 5441979755;
• exact live source/doctrine inspected for any blocking finding.

An APPROVED decision is specification/architecture-review evidence only. It does not authorize creating ADR-0010 source, editing repository files, branch creation, commit, push, PR mutation, CI/GHCR publication, merge, runtime/provider/data access, deployment or activation. Explicit CTO approval of the exact ADR-0010 decision and a later fresh exact-base implementation authorization remain separate gates.

[ja573]

BOUNDED INDEPENDENT RE-REVIEW - ADR-02 / ADR-0010 (amended §§5, 7, 9)

Decision: APPROVED

Reviewer context

• Reviewer: independent specification/architecture-review agent instance, distinct from the preparing control context; same reviewer instance that issued 5441864735, re-verifying against live source rather than against its own prior notes
• Model: Claude Opus 5 (claude-opus-5), Anthropic; Claude Code CLI harness
• Scope: review only. No file edit, branch, commit, push, PR mutation, CI dispatch, provider/runtime/production access, merge, deploy or activation. All inspection read-only.
• Review date: 2026-08-27

Exact candidate and baseline

• develop re-verified live: a6c8cb2016179db635c4bc86ef366aae190829c2 - matches the handoff baseline.
• Candidate reviewed = the unchanged ADR-02 - Supersede distribution platform inventory for Figshare/Cambridge retirement #842 issue body plus amendment 5441979755. Confirmed: issue lastEditedAt is null (body never edited since creation 15:46:47Z); amendment 5441979755 has created_at == updated_at == 2026-08-27T16:16:56Z (never edited). No HOLD for drift.
• Re-review held to replacement §§5, 7 and 9. §4 and the remaining body were not reopened; the one cross-section point below is reported because the amendment itself creates it, per the handoff's instruction to identify such a case precisely.
• Live source/doctrine inspected this round: docs/engineering/decisions/README.md ("Required content", "Amendments"); full ADR-0004 §§4.1-4.10, 5, 6, 8; docs/publisher-services/platform-inventory.md (header provenance block; cross-reference lines 87, 108, 132); docs/publisher-services/README.md (lines 3, 90, 179-190, 271); docs/publisher-services/decisions.md (header; lines 153-158, 227); docs/publisher-services/task-status.md (header; item 4); docs/engineering/repository-map/control-gaps.md (CG-07); docs/publisher-services/adr-01-evidence-ledger.md; thoth-dissemination#101 §17; BE-05 #840 amendment 5441629788.

---

F1 - RESOLVED

Replacement §5.1 supplies a mandatory disposition table covering all thirteen required items - ADR-0004 §§4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, §5, §6 and §8 - with none omitted and no ad-hoc implementer discretion ("the implementing agent may not decide disposition ad hoc").

Each disposition checked against the live ADR-0004 text and found technically correct:

• §4.1 / §5 / §8 - CHANGED AND RESTATED IN FULL. Correct: these are the sections §4 actually changes, and each requires a complete current contract rather than a delta. The §5 row explicitly preserves "every other descriptor field … including Crossref update support and all back-catalogue/update/withdrawal expectations", which is the exact item my prior review found at risk (ADR-0004 §5 records Crossref update supported while every other push destination is disabled).
• §4.2 - CARRIED FORWARD. Captures the full alias mapping plus the three normative rulings: aliases are not separate enum values, ProQuest is not a vendor-umbrella value, and Ebook Central / Ex Libris / Serial Solutions are not aliases of one another. Matches ADR-0004 §4.2.
• §4.3 - CARRIED FORWARD WITH RETIREMENT QUALIFICATION. Preserves OAPEN/DOAB linkage, OCLC_KBART_PUBLIC shared-feed semantics, the inactive JISC_NBK_MARC_S3 identity and the destination-vs-adapter distinction, and requires retained CUL/Figshare adapter identity to be labelled historical provenance. Consistent with body §4.2's last paragraph and with ADR-0004 §4.3's ruling that SwordV2Uploader/DSpaceUploader reuse is shared implementation, not a shared destination.
• §4.4 - CARRIED FORWARD. All six requirements enumerated and matched one-for-one against ADR-0004 §4.4, including MIG-01 no-job backfill and empty-assignment fail-safe semantics.
• §4.5 - CARRIED FORWARD, with the correct additional guard that "retirement does not broaden update/withdrawal support".
• §4.6 - CARRIED FORWARD. The Thoth-managed source-file invariant, its fail-closed rule and its status as separate HIGH-risk enforcement work are preserved. This was the single largest silent-loss risk in the prior candidate.
• §4.7 - CARRIED FORWARD. SoW entitlement authority, Thoth runtime desired-state authority, temporary operational mirrors, accountable/responsible roles and fail-closed mismatch semantics.
• §4.8 - CARRIED FORWARD. All ten exclusions with individual reasons, plus the ruling that exclusions delete no export-registry or LocationPlatform identity.
• §§4.9 / 4.10 - HISTORICAL EVIDENCE ONLY. Correct and correctly reasoned: ADR-0004 remains the source of the dated 2026-08-06 manual-destinations statement and of the recorded ProQuest EPUB-fallback defect and CUL LocationPlatform 'OTHER' writeback behaviour, and ADR-0010 must not relabel them as freshly verified. No dated evidence is promoted to a current claim.
• §6 - CHANGED FOR THE RETIREMENT TARGET AND RESTATED IN FULL. This is the right resolution: DIS-03 gets a complete 17-value current architecture anchor inside the current ADR, while the row requires the ADR to "distinguish this target architecture from pre-DIS-03 runtime until dissemination retirement is production-effective". That matches thoth-dissemination#101 §17, which supersedes the CUL/Figshare mappings prospectively, and it matches the real runtime constraint that the pinned dissemination contract still fails closed on a missing platform until DIS-03 re-pins.
• §8 - RESTATED AS THE COMPLETE CURRENT INVARIANT SET. Mapped against ADR-0004's nine numbered invariants: 1 and 2 (closed inventory / no fallback), 3 (destination vs adapter), 4 (OAPEN/DOAB), 5 (OCLC/Ex Libris), 7 (source-file), 8 (conservative update/withdrawal) and 9 (fail-closed) are carried; 6 (JISC availability) is the one replaced, and its replacement covers both the CUL/Figshare retired-hidden policy and JISC's retained visible/non-assignable state. JISC's job-free property survives through the §4.4 disposition. No invariant is dropped.

The platform-inventory.md cross-reference requirement is explicit in both §5.1's closing paragraph and §9. Verified live that those cross-references exist and are exactly the three named: line 87 [ADR-0004 section 4.2], line 108 (ADR-0004 section 4.6), line 132 [ADR-0004 section 4.8] - alias resolution, source-file invariant and exclusions respectively.

F2 - RESOLVED

Replacement §7 adds both surfaces my prior review found unowned, with permissions narrow enough to prevent scope creep:

• docs/publisher-services/README.md - "only current programme-status/current-decision authority references necessary to replace ADR-0004/final-inventory-as-current with the ADR-0010 state; preserve historical lifecycle evidence and do not perform unrelated status cleanup". This reaches the live defects at line 3 (programme Status: line) and line 90 (current-state block) while protecting the ADR-01 lifecycle narrative at lines 179-190 and the file index at line 271.
• docs/publisher-services/decisions.md - "only the ACTIVE distribution-platform summary/current-authority wording necessary to distinguish historical ADR-01/ADR-0004 approval from the ADR-0010 retirement state; preserve historical approval records and do not rewrite unrelated decisions". This reaches lines 153-158, whose "17 values; … JISC_NBK included but inactive and non-assignable; 10 recorded exclusions" becomes materially wrong once three destinations are non-assignable and two hidden.

The explicit boundary sentence - "These two newly added active-summary paths are in ADR-02 scope solely for the §5 supersession/authority reconciliation. They are not permission for general Publisher Services documentation cleanup." - is the right guard, and §9 gives each surface its own acceptance bullet plus a catch-all.

The budget remains documentation-only: one new file (ADR-0010-distribution-platform-retirement.md), five existing documentation paths, no deletion/move/rename, and the explicit exclusion of Rust, SQL, migration, GraphQL, generated-client, workflow, auth, provider and downstream-repository files. No runtime or downstream work is smuggled in.

I also re-verified my prior enumeration of the remaining ADR-0004 referents and it still holds - they are head-bound or dated lifecycle/evidence records and are correctly left outside this budget: control-gaps.md CG-07 ("State as of 2026-08-07", "RESOLVED as of 2026-08-07"), adr-01-evidence-matrix.md, adr-01-evidence-ledger.md, rollout-plan.md:91, and task-status.md item 4 (present tense, but bound to content head 44e6f821… and to PR #783 as ADR-01 task-completion state). If the CTO wants belt-and-braces, dating task-status.md item 4's phrasing later would remove any residual present-tense reading; it is not a gap in this candidate.

F3 - RESOLVED

Replacement §5.2 does exactly what was required, and §9 makes it checkable:

• head 44e6f821535fbee56c830dd6eda237fc6d06fbfd, review 4881233664, CTO approval 4881279067, date 2026-08-07 and PR docs: decide final distribution platform inventory #783 are retained as a clearly labelled historical provenance block, valid only for the historical ADR-01/ADR-0004 inventory content;
• they are explicitly barred from being presented as approval of the retirement semantics, with the unambiguous backstop "The inventory must never claim that head 44e6f821... contained or approved CUL/Figshare retirement or assignment-option hiding";
• the new current-state block must cite its own exact independent specification/architecture approval identity and exact CTO decision-approval identity;
• future exact source-head review and merge evidence is required to stay in the GitHub issue/PR ledger and "must not be pre-invented in the document", which is consistent with ADR-0005.

Replacement §9 acceptance quality - sufficient

§9 is now mechanically reviewable rather than subjective: it tests table coverage with no omitted item, tests that each CARRIED FORWARD item is actually restated with normative meaning intact, tests that each CHANGED item is a complete replacement contract "rather than a partial delta requiring consumers to guess against superseded ADR-0004", and gives per-surface bullets for the register, README, decisions summary and inventory provenance.

The doctrinal requirement is present and complete. Checked bullet-by-bullet against docs/engineering/decisions/README.md "Required content": decision owner; affected programmes and repositories; context and decision drivers; options considered; exact decision; invariants; implementation impact; migration/data effects; rollout and rollback effects; validation evidence; approval state. All ten doctrinal items are covered (the amendment splits doctrine's "migration, rollout and rollback effects" into two bullets, which loses nothing).

---

Carry-forward note for the implementation authorization (not a blocking finding)

The amendment replaced §7 but not §6, and unchanged body §6 is a closed list - "ADR-02 may only: 1…6" - whose six actions do not include reconciling docs/publisher-services/README.md and docs/publisher-services/decisions.md. Amended §5 requires that reconciliation and amended §7 permits those two files, so the exact candidate contains a scope-list/write-budget mismatch on precisely the files the F2 correction is about.

This is not blocking, because the binding permission instrument is not §6: unchanged §11 step 3 provides that "a separate implementation authorization binds a fresh develop SHA and exact write budget", and §7 as amended is that budget. To remove the ambiguity before an implementer meets it, the later implementation authorization should restate the amended §7 budget verbatim and note that body §6's action list is extended by amended §5 to include the two active-summary reconciliations. Absent that, an implementer reading §6 literally could either omit the reconciliation or trigger a §12 HOLD ("another source path becomes necessary") over work this candidate already permits.

---

Disposition

APPROVED. Replacement §§5, 7 and 9 fully resolve the three blocking findings of 5441864735. The §5.1 disposition table makes the supersession objectively complete and correctly separates standing decisions from dated evidence; §6's treatment gives DIS-03 a current architecture anchor while distinguishing target architecture from pre-cutover runtime; §7 gives the two active surfaces a narrowly scoped owner without opening general documentation cleanup; §5.2 keeps the 2026-08-07 approval provenance truthful and bound to the content it actually approved; and §9 turns all of it into mechanically checkable acceptance evidence with explicit ADR required-content conformity. The architecture in §4, already found sound at this same baseline, is unchanged and unaffected by the amendment.

This decision is specification/architecture-review evidence only. It does not authorize creating ADR-0010 source, editing ADR-0004, the decision register, the platform inventory or the two programme summary surfaces, branch creation, commit, push, PR mutation, CI or GHCR publication, merge, runtime/provider/data access, deployment or activation. Explicit CTO approval of the exact ADR-0010 decision and a later fresh exact-base implementation authorization - which should carry the note above - remain separate gates, and BE-05 / #840 remains blocked until the exact approved ADR-0010 is merged to develop.

[ja573]

CTO ARCHITECTURE / SPECIFICATION APPROVAL - ADR-02 / ADR-0010

Decision: APPROVED

I approve the exact ADR-0010 architecture/specification for ADR-02 / thoth-pub/thoth#842 defined by:

1. the unchanged ADR-02 - Supersede distribution platform inventory for Figshare/Cambridge retirement #842 issue body; plus
2. specification amendment comment 5441979755, which replaces only §§5, 7 and 9.

Independent specification/architecture approval: comment 5442054660 = APPROVED.

Reviewed and approved baseline: develop @ a6c8cb2016179db635c4bc86ef366aae190829c2.

This is CTO architecture/specification approval only. It does not authorize:

• repository source/file mutation;
• creating ADR-0010 in the repository;
• branch creation;
• commit or push;
• PR creation or mutation;
• automatic PR CI or GHCR staging-image publication;
• manual CI dispatch/rerun;
• provider/runtime/production/database access;
• migration execution;
• merge;
• release, deployment or production activation.

The next gate is a fresh exact-base ADR-02 documentation implementation authorization. Before any such authorization, reverify live develop, the ADR-0010 namespace/path, proposed branch namespace, overlapping work/PR state and the exact amended §7 write budget. The implementation authorization must also carry forward the non-blocking note from review 5442054660: amended §7 is the binding write budget, and unchanged body §6 is extended by amended §5 to include the narrowly scoped reconciliation of docs/publisher-services/README.md and docs/publisher-services/decisions.md.

BE-05 / #840 remains blocked until the exact approved ADR-0010 source is independently reviewed, separately merge-authorized and merged to develop.