docs: specify THOTH-DB-CTRL-01 Diesel generation control

[ja573]

Programme and task

• Programme: Shared Repository Controls
• Specification task: THOTH-DB-CTRL-01-SPEC
• Output implementation task: THOTH-DB-CTRL-01
• Risk: HIGH
• Base: develop@35e4dc20864ae4896dccc2b20cbcdbe3fb733db8
• Head: a4db430cb3c80fc6c1fd4100821c643129e87d5f
• State: draft; fresh independent cross-model review and fresh explicit CTO authorization are required before ready or merge

Commits and exact scope

1. bfee1ca8356ac191521e112f835bf3a4af0993d3 — docs: specify THOTH-DB-CTRL-01 Diesel control — 4 paths
2. 3f0affd0e375975dd18ea895219ab77477b41325 — docs: report THOTH-DB-CTRL-01 specification — 1 path
3. 9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628 — docs: correct THOTH-DB-CTRL-01 target safety — 2 paths
4. a4db430cb3c80fc6c1fd4100821c643129e87d5f — docs: make THOTH-DB-CTRL-01 probe compile-valid — 2 paths

Exact five paths:

• CHANGELOG.md
• docs/engineering/ai-delivery/tasks/THOTH-DB-CTRL-01.md
• docs/engineering/ai-delivery/implementation-reports/THOTH-DB-CTRL-01-SPEC-implementation-report.md
• docs/engineering/repository-map/control-gaps.md
• docs/engineering/repository-map/repositories/thoth.md

Review remediations

Safe-target remediation

The exact-head review of 3f0affd0e375975dd18ea895219ab77477b41325 returned CHANGES REQUIRED with one P1: the safe-target rule incorrectly required PostgreSQL's server-side accepted address to be loopback. The bounded remediation distinguishes the loopback client endpoint from server-side network evidence, requires inet_server_addr(), inet_server_port(), inet_client_addr(), and inet_client_port() to be recorded and classified, and ties any accepted private bridge address to verified local Docker or run_migrations GitHub Actions provenance.

Only the task specification and implementation report changed in the remediation commit. No discovery experiment was rerun, and no runtime, workflow, migration, schema, database, or production state changed.

Compile-valid probe remediation

The exact-head review of 9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628 confirmed the safe-target correction and returned one new P1: the future schema-only publisher.thoth_db_ctrl_probe column would change the row shape loaded into the nine-field positional Publisher model and therefore could not satisfy the required focused compile-success gate.

The future acceptance probe is now a standalone disposable table, public.thoth_db_ctrl_probe(probe_id uuid PRIMARY KEY, probe_value text), with exactly five explicit manifest effects: table, two columns, primary key, and allow-table membership. It creates no join and has no consuming application model. The equivalent schema-only table and allow-table candidate passed cargo check -q -p thoth-api --features backend with exit 0 and no output in a detached temporary worktree; that worktree and its artifacts were removed. The future synchronizer must still prove exact manifest equality, deterministic generation, table removal, and byte-identical baseline restoration.

Only the task specification and implementation report changed in this remediation commit. No runtime, workflow, migration, production schema/database, deployment, release, or activation state changed.

Objective

Create the repository-authoritative, implementation-ready specification for a safe, repeatable Diesel migration and schema-generation procedure. This is documentation and discovery only; it does not implement the control.

Investigation findings

• Canonical commands run from the repository root: make migration, cargo run migrate --database-url "$DATABASE_URL", and disposable-only cargo run migrate --revert --database-url "$DATABASE_URL".
• Diesel resolves print_schema.file relative to the configuration file. Root file = "src/schema.rs" therefore does not target canonical thoth-api/src/schema.rs.
• Current root diesel.toml fails parsing because four commas are missing. A temporary commas-only repair still applies imports and model types as derives, so it is semantically invalid.
• The repository locks Diesel 2.3.10; isolated PostgreSQL-only CLI 2.3.10 generated 28,132-byte outputs twice with byte-identical cmp result.
• Canonical schema is 28,603 bytes. Normalized raw/canonical diff: 382 insertions and 455 deletions.
• Raw output does not preserve the canonical work_abstract/work_title aliases, title identifier handling, supplemental MarkupFormat, maintained Timestamptz mappings, model-compatible column order, or unchanged formatting.
• A full text patch recreated the clean baseline but failed at hunk 16 after one controlled column addition.
• A reduced semantic patch admitted exactly that column, but its temporary candidate failed cargo check -p thoth-api --features backend with 86 errors: missing supplemental type, alias/join mismatch, and pervasive Diesel CompatibleType ordering failures.
• The publisher-column experiment remains historical rejection evidence only. The future compile-success acceptance probe is the standalone table described above.

Database safety evidence

A unique disposable postgres:17 container exposed its client endpoint only on 127.0.0.1:55432, with database thoth_ctrl_01_spec and user thoth_ctrl. It had no host/repository mount and used one anonymous Docker volume. No production, staging, shared-development, or public database was contacted; no production credential was used.

The discovery proved a loopback client endpoint and task-created disposable-container provenance. It did not record PostgreSQL's server-side accepted address or the server/client connection ports, so it does not claim that inet_server_addr() was loopback. The corrected implementation specification requires those values to be queried and ties any private container-network address to verified Docker or GitHub Actions provenance.

Migration results:

• empty: 0 migrations, 0 application tables, 0 enums;
• full apply: exit 0, 4 migrations, 55 tables, 21 enums;
• full-chain revert: exit 0, 0 migrations, 0 application tables, 0 enums;
• full reapply: exit 0, 4 migrations, 55 tables, 21 enums.

The container, both disposable databases, anonymous volume, detached worktree, generated artifacts, and isolated CLI were deleted. Container and volume lookups confirmed absence.

Selected implementation approach

Retain root diesel.toml and canonical thoth-api/src/schema.rs; correct the root-relative path and derive list; pin exact CLI 2.3.10; add explicit convention control data; and add a fail-closed structural synchronizer that:

• requires a loopback client endpoint and a local disposable or ephemeral CI target;
• records and classifies PostgreSQL server/client connection addresses and ports;
• ties any private server address to exact task-created Docker or approved run_migrations GitHub Actions provenance;
• captures raw Diesel output in a private temporary file;
• accounts explicitly for aliases, supplemental types, type overrides, and model-compatible order;
• preserves unchanged canonical bytes;
• accepts only an exact, task-local expected-change manifest;
• uses the compile-valid standalone table for the controlled expected-diff probe, with explicit table, column, primary-key, and allow-table entries;
• rejects missing, extra, conflicting, nondeterministic, uncompilable, or unrelated output;
• atomically writes only thoth-api/src/schema.rs;
• runs identically through local Make targets and migration CI.

The exact future command contracts are defined in the specification. Clean check must be byte-identical and repeated generation deterministic. A controlled disposable probe must produce only its declared isolated diff, and removal must restore the clean baseline.

Rejected alternatives

• Direct raw regeneration: rejected by the 837-line normalized diff and 86-error compile failure.
• Full Diesel patch file: rejected because a one-column change made it fail to apply.
• Reduced patch: rejected because it still lost compiled ordering and supplemental-type semantics.
• Manual post-processing: rejected because it cannot prove deterministic no-op or exact bounded change.
• Crate-local config or schema relocation: unnecessary and outside scope.
• Diesel upgrade/downgrade: does not solve model-specific conventions and needs separate approval.

Validation

• Complete-range git diff --check: exit 0, no output.
• Cumulative paths: exactly 5.
• Commits: exactly 4.
• Commit path scopes: 4 / 1 / 2 / 2.
• Required-placeholder scan: exit 1 with no matches, therefore 0 unresolved placeholders.
• Worktree: clean.
• Complete five-path classifier: {"docs_only":"true","run_build":"false","run_docker":"false","run_migrations":"false"}.

Remaining gates and no-effect statement

THOTH-DB-CTRL-01 implementation is not started or authorized. BE-01 remains BLOCKED; no BE-01 or control implementation branch exists. CG-12 remains unresolved and closes only after the separate implementation passes acceptance evidence, independent review, and explicitly authorized merge. CG-13 remains open.

This PR has no production migration, schema/data, runtime, API, deployment, release, or activation effect. Do not mark it ready, approve it, or merge it without fresh independent review and fresh explicit CTO authorization. Merging this specification will not authorize implementation.

[ja573]

Immutable exact-head evidence — THOTH-DB-CTRL-01-SPEC

This top-level evidence comment is immutable. If correction is required, a separate superseding comment must be posted; this comment will not be edited.

Exact repository state

• PR: docs: specify THOTH-DB-CTRL-01 Diesel generation control #775, open, draft, unmerged
• Base: develop@35e4dc20864ae4896dccc2b20cbcdbe3fb733db8
• Head: feature/repository-controls/thoth-db-ctrl-01-spec@3f0affd0e375975dd18ea895219ab77477b41325
• Commits: exactly 2
• Changed paths: exactly 5
• Commit path scopes: 4 / 1
• Unresolved review threads at evidence capture: 0

Ordered commits:

1. bfee1ca8356ac191521e112f835bf3a4af0993d3 — docs: specify THOTH-DB-CTRL-01 Diesel control — 4 paths
2. 3f0affd0e375975dd18ea895219ab77477b41325 — docs: report THOTH-DB-CTRL-01 specification — 1 path

Exact paths:

1. CHANGELOG.md
2. docs/engineering/ai-delivery/implementation-reports/THOTH-DB-CTRL-01-SPEC-implementation-report.md
3. docs/engineering/ai-delivery/tasks/THOTH-DB-CTRL-01.md
4. docs/engineering/repository-map/control-gaps.md
5. docs/engineering/repository-map/repositories/thoth.md

Local investigation commands and concise results

Tool versions:

rustc 1.97.0 (2d8144b78 2026-07-07)
cargo 1.97.0 (c980f4866 2026-06-30)
Docker client/server 29.6.2
Docker Compose v5.3.1
installed Diesel CLI 2.2.4
repository and isolated Diesel CLI 2.3.10

Exact isolated CLI install:

cargo install diesel_cli \
  --version '2.3.10' \
  --root /private/tmp/thoth-db-ctrl-diesel-cli-2.3.10 \
  --no-default-features \
  --features postgres \
  --locked

Result: exit 0; exact PostgreSQL-only CLI 2.3.10; no global, user-toolchain, or repository configuration changed.

Migration commands from repository root, with the disposable URL supplied through the task-local environment variable:

cargo run migrate --database-url "$THOTH_DB_CTRL_DATABASE_URL"
cargo run migrate --revert --database-url "$THOTH_DB_CTRL_DATABASE_URL"
cargo run migrate --database-url "$THOTH_DB_CTRL_DATABASE_URL"

Results:

initial empty: 0 migrations, 0 application tables, 0 enums
full apply: exit 0, 4 migrations, 55 tables, 21 enums
full-chain revert: exit 0, 0 migrations, 0 application tables, 0 enums
full reapply: exit 0, 4 migrations, 55 tables, 21 enums
migration versions: 20250000, 20260417, 20260429, 20260504

Current config parse command:

/private/tmp/thoth-db-ctrl-diesel-cli-2.3.10/bin/diesel \
  print-schema \
  --database-url "$THOTH_DB_CTRL_DATABASE_URL" \
  --config-file /Users/ja573/thoth/diesel.toml

Result: non-zero: TOML parse error at line 20, column 3: missing comma between array elements, expected ','.

A valid copied config with file = "src/schema.rs" plus explicit --config-file caused diesel migration run to write beneath the config directory, proving print_schema.file is config-relative and current root config does not target canonical thoth-api/src/schema.rs.

Baseline generation commands used exact CLI 2.3.10, the disposable URL, a minimal valid temporary config, and two different temporary output files:

/private/tmp/thoth-db-ctrl-diesel-cli-2.3.10/bin/diesel \
  print-schema \
  --database-url "$THOTH_DB_CTRL_DATABASE_URL" \
  --config-file "$THOTH_DB_CTRL_MINIMAL_CONFIG" \
  > /private/tmp/thoth-db-ctrl-01-spec-artifacts/schema-2.3.10-first.rs

/private/tmp/thoth-db-ctrl-diesel-cli-2.3.10/bin/diesel \
  print-schema \
  --database-url "$THOTH_DB_CTRL_DATABASE_URL" \
  --config-file "$THOTH_DB_CTRL_MINIMAL_CONFIG" \
  > /private/tmp/thoth-db-ctrl-01-spec-artifacts/schema-2.3.10-second.rs

Results:

first: exit 0, 28,132 bytes
second: exit 0, 28,132 bytes
cmp first second: exit 0, byte-identical
committed schema: 28,603 bytes
normalized raw/committed diff: 382 insertions, 455 deletions
CLI 2.2.4 versus 2.3.10: 2 insertions, 1 deletion
repository worktree after experiments: clean

Differences were fully classified: config/path error; CLI-version sensitivity; formatting and macro qualification; invalid custom-type derive configuration; and maintained canonical conventions (work_abstract, work_title, physical title aliasing, supplemental MarkupFormat, legacy Timestamptz mappings, and model-compatible column order). No unexplained difference remained.

A full raw-to-canonical patch recreated the baseline but failed at hunk 16 after controlled disposable publisher.thoth_db_ctrl_probe text addition. A reduced patch admitted exactly thoth_db_ctrl_probe -> Nullable<Text>, but this temporary-worktree command:

cargo check -p thoth-api --features backend

returned exit 101 with 86 errors: missing supplemental MarkupFormat, an alias/join mismatch, and pervasive Diesel CompatibleType field-order failures. This rejects direct raw regeneration, full patch, and reduced patch as safe controls.

Disposable target and cleanup proof

host: 127.0.0.1, loopback only
port: 55432
database: thoth_ctrl_01_spec
user: thoth_ctrl
container: thoth_db_ctrl_01_spec_20260729
image/server: postgres:17 / PostgreSQL 17.4 Debian
host or repository mounts: none
storage: one anonymous Docker volume
connection source: explicit task-local environment variable
production/staging/shared/public access: none

The credential and full URL are intentionally omitted. The container had AutoRemove=true; it, its secondary path-test database, anonymous volume, detached worktree, generated artifacts, and isolated CLI were deleted. Post-cleanup container lookup was empty; anonymous-volume inspect returned no such volume.

Selected approach and rejected alternatives

Selected: retain root diesel.toml and canonical thoth-api/src/schema.rs; correct the path and derive list; pin exact CLI 2.3.10; enumerate current aliases, supplemental types, type overrides, and model-compatible ordering as explicit control data; and add a fail-closed structural synchronizer. It must prove a disposable target, capture raw output privately, preserve unchanged canonical bytes, accept only an exact task-local expected-change manifest, compile the candidate, reject unrelated changes, and atomically write only the canonical schema. Local and CI checks use the same procedure.

Rejected:

• raw regeneration — 837 normalized diff lines and 86 compile errors;
• full patch — failed on one controlled addition;
• reduced patch — lost ordering and supplemental semantics;
• manual post-processing — cannot prove deterministic no-op or exact expected diff;
• crate-local config or schema relocation — unnecessary and outside scope;
• Diesel version change — cannot infer repository model conventions and needs separate approval.

Complete-range validation

git diff --check 35e4dc20864ae4896dccc2b20cbcdbe3fb733db8...HEAD: exit 0, empty
git diff --name-only: exactly the five listed paths
git log: exactly the two ordered commits above
git show scopes: 4 paths / 1 path
required placeholder scan: exit 1 with no matches, therefore 0 unresolved placeholders
git status --short: empty
implementation and BE-01 branch checks: absent locally and remotely

Complete five-path classifier:

{"docs_only":"true","run_build":"false","run_docker":"false","run_migrations":"false"}

Exact-head pull-request CI

Every run is pull_request, attempt 1, completed successfully at exact head 3f0affd0e375975dd18ea895219ab77477b41325.

• build-test-and-check — run 30487382674
  • classify — job 90696360479 — success
  • build — job 90696393692 — skipped — steps null
  • test — job 90696393996 — skipped — steps null
  • format_check — job 90696394106 — skipped — steps null
  • lint — job 90696394127 — skipped — steps null
• run-migrations — run 30487382657
  • classify — job 90696360519 — success
  • run_migrations — job 90696385407 — skipped — steps null
• publish-to-dockerhub — run 30487382669
  • classify — job 90696360524 — success
  • build_and_push_staging_docker_image — job 90696403864 — skipped — steps null
• check-changelog — run 30487382676
  • check-changelog — job 90696360448 — success

All required skipped job step arrays are absent (null). No workflow was manually dispatched.

State and effect assessment

PR state: OPEN, DRAFT, UNMERGED
unresolved review threads: 0
production migration: NO
production schema/data effect: NONE
runtime/API effect: NONE
deployment/release/activation: NONE
BE-01: BLOCKED and not implemented
THOTH-DB-CTRL-01 implementation: not started or authorized
CG-12: unresolved until separately approved implementation merges with acceptance evidence
CG-13: open

No evidence-only third commit will be created. Fresh independent cross-model review is mandatory. Fresh explicit CTO authorization is required before this specification PR may be marked ready or merged. Merging this specification will not authorize THOTH-DB-CTRL-01 implementation.

[ja573]

Superseding immutable exact-head evidence — THOTH-DB-CTRL-01-SPEC

This comment supersedes the original immutable evidence comment at #775 (comment) for the new exact head. The original comment was not edited.

Exact repository and pull-request state

• PR: docs: specify THOTH-DB-CTRL-01 Diesel generation control #775, open, draft, unmerged, mergeable
• Base: develop@35e4dc20864ae4896dccc2b20cbcdbe3fb733db8
• Head: feature/repository-controls/thoth-db-ctrl-01-spec@9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628
• Live develop: 35e4dc20864ae4896dccc2b20cbcdbe3fb733db8
• Commits: exactly 3
• Changed paths: exactly 5
• Commit path scopes: 4 / 1 / 2
• Review submissions: 0
• Review threads: 0
• feature/repository-controls/thoth-db-ctrl-01: absent
• feature/publisher-services/be-01: absent

Ordered commits:

1. bfee1ca8356ac191521e112f835bf3a4af0993d3 — docs: specify THOTH-DB-CTRL-01 Diesel control — 4 paths
2. 3f0affd0e375975dd18ea895219ab77477b41325 — docs: report THOTH-DB-CTRL-01 specification — 1 path
3. 9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628 — docs: correct THOTH-DB-CTRL-01 target safety — 2 paths

Exact cumulative paths:

1. CHANGELOG.md
2. docs/engineering/ai-delivery/implementation-reports/THOTH-DB-CTRL-01-SPEC-implementation-report.md
3. docs/engineering/ai-delivery/tasks/THOTH-DB-CTRL-01.md
4. docs/engineering/repository-map/control-gaps.md
5. docs/engineering/repository-map/repositories/thoth.md

The remediation commit changes only the implementation report and task specification.

P1 correction

The review of 3f0affd0e375975dd18ea895219ab77477b41325 returned CHANGES REQUIRED because the specification required PostgreSQL's server-side accepted address to be loopback. That rule is incompatible with a loopback-published Docker or GitHub Actions service whose PostgreSQL process accepts the connection on a private bridge address.

The corrected contract now requires:

• the parsed client-facing database endpoint to be localhost, 127.0.0.1, or ::1;
• THOTH_DIESEL_CONFIRM_DATABASE to match the parsed name and current_database();
• inet_server_addr(), inet_server_port(), inet_client_addr(), and inet_client_port() to be queried and recorded;
• the server-side address to be loopback or a provenance-verified private container-network address;
• public, externally routable, null, unexplained, and unverified server addresses to fail closed;
• local mode to verify the exact task-created container identity, loopback port mapping, container network address, database/user identity, no host/repository bind mount, anonymous disposable storage, and cleanup;
• CI mode to verify GITHUB_ACTIONS=true, repository thoth-pub/thoth, workflow .github/workflows/run_migrations.yml, job run_migrations, endpoint localhost:5432, database/user thoth, and the private service-container address.

The implementation report now states exactly what discovery proved:

client endpoint: loopback
database: task-created disposable Docker container
server-side accepted address and server/client ports: not recorded

No claim is made that inet_server_addr() was loopback. No discovery experiment was rerun.

Complete-range local validation

git diff --check 35e4dc20864ae4896dccc2b20cbcdbe3fb733db8...HEAD: exit 0, empty
git diff --name-only: exactly the five cumulative paths above
git diff --name-only 3f0affd0e375975dd18ea895219ab77477b41325...HEAD: exactly the two remediation paths
git log: exactly the three ordered commits above
commit path scopes: 4 / 1 / 2
relative Markdown links: all targets exist
required placeholder scan: no matches
git status --short: empty

Complete five-path classifier:

{"docs_only":"true","run_build":"false","run_docker":"false","run_migrations":"false"}

Exact-head pull-request CI

Every run is pull_request, attempt 1, completed successfully at exact head 9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628.

• build-test-and-check — run 30488617102
  • classify — job 90700552266 — success
  • build — job 90700585805 — skipped — steps empty
  • test — job 90700585502 — skipped — steps empty
  • lint — job 90700585588 — skipped — steps empty
  • format_check — job 90700586692 — skipped — steps empty
• check-changelog — run 30488617105
  • check-changelog — job 90700551992 — success
• run-migrations — run 30488617070
  • classify — job 90700551769 — success
  • run_migrations — job 90700587805 — skipped — steps empty
• publish-to-dockerhub — run 30488617790
  • classify — job 90700554470 — success
  • build_and_push_staging_docker_image — job 90700611152 — skipped — steps empty

No workflow was manually dispatched.

State and effect assessment

production migration: NO
production schema/data effect: NONE
runtime/API effect: NONE
deployment/release/activation: NONE
THOTH-DB-CTRL-01 implementation: BLOCKED and not authorized
BE-01 implementation: BLOCKED on THOTH-DB-CTRL-01
CG-12: unresolved
CG-13: open

The PR body is updated for this exact head. The PR remains draft. This remediation does not supply independent approval or CTO authorization.

Required next gates:

1. fresh independent review of exact head 9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628;
2. fresh explicit CTO authorization;
3. only then, a separately authorized ready transition.

Do not mark PR #775 ready or merge it on this evidence alone.

[ja573]

Superseding immutable exact-head evidence — THOTH-DB-CTRL-01-SPEC

This comment supersedes the prior exact-head evidence at #775 (comment) for the new head. Neither earlier immutable evidence comment was edited.

Exact repository and pull-request state

• PR: docs: specify THOTH-DB-CTRL-01 Diesel generation control #775, open, draft, unmerged, mergeable
• Base: develop@35e4dc20864ae4896dccc2b20cbcdbe3fb733db8
• Head: feature/repository-controls/thoth-db-ctrl-01-spec@a4db430cb3c80fc6c1fd4100821c643129e87d5f
• Live develop: 35e4dc20864ae4896dccc2b20cbcdbe3fb733db8
• Commits: exactly 4
• Changed paths: exactly 5
• Commit path scopes: 4 / 1 / 2 / 2
• Review submissions: 0
• Review threads: 0
• feature/repository-controls/thoth-db-ctrl-01: absent
• feature/publisher-services/be-01: absent

Ordered commits:

1. bfee1ca8356ac191521e112f835bf3a4af0993d3 — docs: specify THOTH-DB-CTRL-01 Diesel control — 4 paths
2. 3f0affd0e375975dd18ea895219ab77477b41325 — docs: report THOTH-DB-CTRL-01 specification — 1 path
3. 9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628 — docs: correct THOTH-DB-CTRL-01 target safety — 2 paths
4. a4db430cb3c80fc6c1fd4100821c643129e87d5f — docs: make THOTH-DB-CTRL-01 probe compile-valid — 2 paths

Exact cumulative paths:

1. CHANGELOG.md
2. docs/engineering/ai-delivery/implementation-reports/THOTH-DB-CTRL-01-SPEC-implementation-report.md
3. docs/engineering/ai-delivery/tasks/THOTH-DB-CTRL-01.md
4. docs/engineering/repository-map/control-gaps.md
5. docs/engineering/repository-map/repositories/thoth.md

The latest remediation commit changes only the implementation report and task specification.

P1 correction: compile-valid controlled probe

The review of 9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628 confirmed the prior safe-target remediation and returned one new P1: a generated publisher.thoth_db_ctrl_probe column would extend the complete Diesel publisher row from nine to ten columns while the positional Publisher model remained at nine fields. Requiring that schema-only candidate to compile successfully was contradictory.

The historical publisher-column experiment remains truthful rejection evidence for the raw and patch approaches. It is no longer the future compile-success acceptance probe.

The corrected future probe creates only:

CREATE TABLE public.thoth_db_ctrl_probe (
    probe_id uuid PRIMARY KEY,
    probe_value text
);

Its expected manifest is exactly:

version = 1
add = [
  "allow-table:public.thoth_db_ctrl_probe",
  "column:public.thoth_db_ctrl_probe.probe_id",
  "column:public.thoth_db_ctrl_probe.probe_value",
  "primary-key:public.thoth_db_ctrl_probe",
  "table:public.thoth_db_ctrl_probe",
]
remove = []
change = []

The grammar now includes allow-table:<schema>.<table>. A new table must declare the table, every column, primary key, every generated join, and allow-table membership explicitly; no structural effect may be hidden or inferred by another entry. This probe creates no join and has no consuming Rust model.

Required acceptance sequence:

1. generate the five-entry standalone-table candidate;
2. repeat generation byte-identically;
3. compile the schema-only candidate without an application-model fixture;
4. drop the disposable table;
5. use an empty manifest and restore the byte-identical clean baseline.

Focused compile validation

The repository claim was checked directly:

• Publisher has nine positional Diesel Queryable fields;
• the list query loads the complete publisher table into Publisher;
• by_zitadel_ids also loads the complete table into Publisher.

A detached temporary worktree at 9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628 received only the equivalent standalone Diesel table! block and allow_tables_to_appear_in_same_query! membership in its temporary schema. Command:

cargo check -q -p thoth-api --features backend

Result: exit 0 with no output. No model fixture was added. The temporary schema candidate was not committed; the detached worktree and its build artifacts were removed.

This proves the chosen schema-only candidate is compile-valid. The future synchronizer must still prove exact manifest equality, deterministic rendering, table removal, and byte-identical restoration.

Complete-range local validation

git diff --check 35e4dc20864ae4896dccc2b20cbcdbe3fb733db8...HEAD: exit 0, empty
git diff --name-only: exactly the five cumulative paths above
git diff --name-only 9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628...HEAD: exactly the two remediation paths
git log: exactly the four ordered commits above
commit path scopes: 4 / 1 / 2 / 2
relative Markdown links: all targets exist
required placeholder scan: no matches
git status --short: empty

Complete five-path classifier:

{"docs_only":"true","run_build":"false","run_docker":"false","run_migrations":"false"}

Exact-head pull-request CI

Every run is pull_request, attempt 1, completed successfully at exact head a4db430cb3c80fc6c1fd4100821c643129e87d5f.

• build-test-and-check — run 30490365116
  • classify — job 90706435765 — success
  • build — job 90706488770 — skipped — steps empty
  • test — job 90706488679 — skipped — steps empty
  • lint — job 90706488966 — skipped — steps empty
  • format_check — job 90706489033 — skipped — steps empty
• check-changelog — run 30490364882
  • check-changelog — job 90706435126 — success
• run-migrations — run 30490365033
  • classify — job 90706435322 — success
  • run_migrations — job 90706472728 — skipped — steps empty
• publish-to-dockerhub — run 30490365442
  • classify — job 90706436911 — success
  • build_and_push_staging_docker_image — job 90706470423 — skipped — steps empty

No workflow was manually dispatched.

State and effect assessment

production migration: NO
production schema/data effect: NONE
runtime/API effect: NONE
workflow-file effect: NONE
deployment/release/activation: NONE
THOTH-DB-CTRL-01 implementation: BLOCKED and not authorized
BE-01 implementation: BLOCKED on THOTH-DB-CTRL-01
CG-12: unresolved
CG-13: open

The prior safe-target correction remains intact and was explicitly confirmed by the latest review. The PR body is updated for this exact head. The PR remains draft. This remediation does not supply independent approval or CTO authorization.

Required next gates:

1. fresh independent review of exact head a4db430cb3c80fc6c1fd4100821c643129e87d5f;
2. fresh explicit CTO authorization;
3. only then, a separately authorized ready transition.

Do not mark PR #775 ready or merge it on this evidence alone.

[ja573]

Reviewed exact head:

a4db430cb3c80fc6c1fd4100821c643129e87d5f

Against exact base:

35e4dc20864ae4896dccc2b20cbcdbe3fb733db8

PR #775 is open, draft, mergeable and unmerged, with four commits and five cumulative changed paths.

Independence attestation: this was a fresh, read-only review. I did not modify repository files, commits, branches, PR metadata, comments, reviews, threads, checks or operational state.

Findings

P0: none
P1: none
P2: none

Standalone acceptance probe

The previous compile-validity P1 is fully resolved.

The controlled acceptance probe is now a standalone disposable table:

CREATE TABLE public.thoth_db_ctrl_probe (
    probe_id uuid PRIMARY KEY,
    probe_value text
);

Its expected manifest explicitly contains exactly five independently checked structural effects:

allow-table:public.thoth_db_ctrl_probe
column:public.thoth_db_ctrl_probe.probe_id
column:public.thoth_db_ctrl_probe.probe_value
primary-key:public.thoth_db_ctrl_probe
table:public.thoth_db_ctrl_probe

The specification requires exact manifest equality and prohibits the table, its columns, primary key or allow_tables_to_appear_in_same_query! membership from being inferred or hidden by another entry. The table has no consuming Rust model and must generate no join.

The required success contract is now internally consistent:

• generation must produce exactly those five additions;
• repeated generation must be deterministic;
• the schema-only candidate must compile without an application-model fixture;
• dropping the table and using an empty manifest must restore the byte-identical baseline.

The acceptance criteria and test plan consistently require the same five-entry delta, no join, successful backend compilation, deterministic repetition, removal and clean restoration.

Compile evidence

The implementation report records a detached-worktree validation using only the equivalent standalone Diesel table block and allow-table membership:

cargo check -q -p thoth-api --features backend

The recorded result was exit 0 with no output. The temporary candidate was not committed, and the worktree and build artifacts were removed. The report correctly limits this evidence: it proves that the chosen schema-only candidate is compile-valid, while the future implementation must still prove actual synchronizer output, manifest equality, deterministic generation, removal and baseline restoration.

The underlying reasoning is sound: unlike the rejected publisher-column probe, the standalone table does not alter the row shape of an existing positional Queryable model.

Safe-target contract

The earlier networking P1 remains correctly resolved.

The specification:

• requires the client-facing URL endpoint to be loopback;
• independently inspects PostgreSQL server and client addresses and ports;
• allows a private server address only with verified Docker or GitHub Actions provenance;
• rejects public, unexplained, null or unverified server addresses;
• ties local execution to the exact task-created disposable container;
• ties CI execution to the approved repository, workflow and job;
• prohibits production, shared-development and ambiguous targets.

No regression was introduced by the probe correction.

Commit and scope boundaries

The corrected head is exactly one commit beyond:

9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628

The fourth commit is:

a4db430cb3c80fc6c1fd4100821c643129e87d5f
docs: make THOTH-DB-CTRL-01 probe compile-valid

It changes exactly:

docs/engineering/ai-delivery/tasks/THOTH-DB-CTRL-01.md
docs/engineering/ai-delivery/implementation-reports/THOTH-DB-CTRL-01-SPEC-implementation-report.md

The cumulative branch remains exactly four commits ahead of the unchanged base, with five paths and commit scopes:

4 / 1 / 2 / 2

The ordered commits are:

bfee1ca8356ac191521e112f835bf3a4af0993d3
docs: specify THOTH-DB-CTRL-01 Diesel control

3f0affd0e375975dd18ea895219ab77477b41325
docs: report THOTH-DB-CTRL-01 specification

9247cc5e4dbc82a5f4ecc381f8b8b5084c9bc628
docs: correct THOTH-DB-CTRL-01 target safety

a4db430cb3c80fc6c1fd4100821c643129e87d5f
docs: make THOTH-DB-CTRL-01 probe compile-valid

The cumulative paths remain:

CHANGELOG.md
docs/engineering/ai-delivery/implementation-reports/THOTH-DB-CTRL-01-SPEC-implementation-report.md
docs/engineering/ai-delivery/tasks/THOTH-DB-CTRL-01.md
docs/engineering/repository-map/control-gaps.md
docs/engineering/repository-map/repositories/thoth.md

The superseding immutable evidence comment 5123304253 records the exact base/head, ordered commits, five-path scope, 4 / 1 / 2 / 2 commit scopes, validation, compile evidence, exact-head CI and remaining gates.

Live develop remains exactly at the reviewed base.

Review state

Live review queries returned:

Review submissions: 0
Review threads: 0
Unresolved review threads: 0
Current CHANGES_REQUESTED reviews: 0

The specification remains draft and does not represent implementation approval.

Exact-head CI

All four pull-request workflows completed successfully against exact head a4db430cb3c80fc6c1fd4100821c643129e87d5f.

build-test-and-check:
  classify: success
  test: skipped
  build: skipped
  lint: skipped
  format_check: skipped

Every skipped job has an absent step array.

run-migrations:
  classify: success
  run_migrations: skipped

publish-to-dockerhub:
  classify: success
  build_and_push_staging_docker_image: skipped

check-changelog:
  success

Effects and control state

Production migration effect: none
Database/schema effect: none
Runtime/API effect: none
Workflow-file effect: none
Deployment/release effect: none
Production or secret access: none
THOTH-DB-CTRL-01 implementation: not started
BE-01 implementation: not started

The control records correctly retain:

CG-12: SPECIFICATION DRAFTED - IMPLEMENTATION NOT STARTED
CG-12 resolution: pending separate implementation
CG-13: OPEN
BE-01 implementation: BLOCKED
BE-01 implementation branch: NOT AUTHORIZED

Decision

APPROVED

This approval is bound exclusively to:

Base: 35e4dc20864ae4896dccc2b20cbcdbe3fb733db8
Head: a4db430cb3c80fc6c1fd4100821c643129e87d5f

It approves the THOTH-DB-CTRL-01-SPEC documentation and discovery PR only.

It does not authorize:

• creation of feature/repository-controls/thoth-db-ctrl-01;
• implementation of the Diesel synchronizer;
• changes to diesel.toml, the Makefile, workflows or schema;
• BE-01 implementation;
• migration execution outside disposable test environments;
• deployment, release or production access.

Required next gates:

1. post this exact-head approval as a new top-level PR comment;
2. obtain fresh explicit CTO authorization bound to this exact base and head;
3. mark PR docs: specify THOTH-DB-CTRL-01 Diesel generation control #775 ready only after that authorization;
4. require a fresh post-ready automated review against the unchanged head;
5. merge with an expected-head guard only if SHA, scope, CI, evidence and review gates remain clean;
6. keep implementation unauthorized after this specification merges;
7. separately scope and authorize the HIGH-risk THOTH-DB-CTRL-01 implementation task.