docs(publisher-services): specify the BE-02 distribution platform model

CHANGELOG.md

@@ -6,6 +6,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 ### Added
+  - [788](https://github.com/thoth-pub/thoth/pull/788) - `BE-02-SPEC`: reconcile the bounded BE-02 distribution-platform model specification against repository-authoritative `ADR-0007` and the merged request-scoped non-cached DataLoader foundation; replace the obsolete N+1 architecture escalation with the first-production-consumer loader-first contract (request-local non-cached loader, explicit `200`/`10`, `try_load`, total fail-closed batches, set-based Diesel inside `spawn_blocking`, and real-SQL `250 -> [200, 50] -> 2 statements` evidence), while preserving the approved 17-value distribution-platform inventory, assignment lifecycle, linked OAPEN/DOAB normalization, migration, public GraphQL API and rollback decisions. Documentation/control only - no runtime, Cargo, GraphQL implementation, schema implementation, migration implementation, workflow or infrastructure change; no implementation branch; no deployment or production action; no BE-03, BE-04, MIG-01, dissemination, Metrics, mutation-guard or PR #799 action. BE-02 implementation remains **NOT AUTHORIZED** pending fresh independent exact-head specification review, CTO specification approval, merge/repository authority and then separate fresh-base implementation authorization.
   - [802](https://github.com/thoth-pub/thoth/pull/802) - `THOTH-GQL-DATALOADER-01`: implement the `ADR-0007` B0 request-scoped GraphQL **DataLoader foundation** and retire the superseded `ADR-0006` A2 batching machinery. Adds the pinned `dataloader 0.18.0` dependency (default features off, Tokio runtime support on) and a direct `tokio` (`rt`) dependency to `thoth-api`; a request-local, **non-cached** loader bundle (`RequestLoaders`) owned directly by the real GraphQL `Context` and dropped with it, with explicit `200` max-batch-size / `10` yield-count construction, `try_load`-only load API, total fail-closed batch functions, set-based Diesel (`eq_any`) behind a `tokio::task::spawn_blocking` boundary with no connection across `.await`, and a safe cloneable non-serde batch-error projection preserving each field family's current GraphQL error convention. Migrates the general GraphQL unit-test execution path from `juniper::execute_sync` to async Juniper through one bounded central bridge with explicit nested-runtime misuse failure. Removes the unused `ADR-0006` A2 infrastructure (`GraphqlBatchStore`/batching store, look-ahead prefetch, response-scope shim, A2 fixtures and A2-specific tests) and decouples loader availability from mutation-guard mode (`MutationGuardMode::store_available()` removed; `Context` construction no longer takes a guard mode), rehosting the guard/query-path/baseline/directive/duplicate-mutation regression evidence onto A2-independent fixtures. **Adopts no production GraphQL child field; changes no public SDL; performs no database or data migration; changes no guard mode (production remains `OFF`); activates no `OBSERVE`/`ENFORCE`; implements no `BE-02` or Thoth Metrics adoption; deploys nothing.** The pinned-Juniper duplicate top-level mutation execution finding remains a live, separately controlled concern and is **not** fixed by this change
   - [801](https://github.com/thoth-pub/thoth/pull/801) - `THOTH-GQL-DATALOADER-SPEC-01`: propose the `THOTH-GQL-DATALOADER-01` implementation specification for the `ADR-0007` B0 request-scoped GraphQL **DataLoader foundation** and `ADR-0006` A2 retirement (`docs/engineering/ai-delivery/tasks/THOTH-GQL-DATALOADER-01.md`). **Specification and control record only — no runtime, Cargo, GraphQL, schema, migration, workflow or infrastructure change, no implementation, and no implementation branch created.** The proposed specification carries the approved `ADR-0007` architecture into a bounded implementable task: request-local non-cached `dataloader 0.18.x` loaders owned by the real GraphQL `Context`, async Juniper as the supported test/resolver execution model with one bounded central test bridge replacing `execute_sync`, explicit `200`/`10` batching configuration, `try_load`-only load API with total fail-closed batch functions, set-based Diesel behind a `tokio::task::spawn_blocking` boundary with no connection across `.await`, a safe non-panicking shareable batch-error representation (the spike's serde round-trip clone is prohibited as production plumbing), retirement of the unused A2 `GraphqlBatchStore`/prefetch/scope infrastructure, decoupling of batching availability from mutation-guard mode, and rehosting of the guard/duplicate-mutation regression evidence onto A2-independent fixtures. The foundation adopts **no** production GraphQL field and must keep production SDL byte-identical. Status is `APPROVED`: after independent exact-head review (`CHANGES REQUIRED`), bounded remediation of the three review findings (`query_path` preservation split, `mutation_guard.rs` boundary/`store_available()` removal, explicit observability/operations disposition) and fresh review of the corrected content, the CTO granted **specification approval only** on 2026-08-11 at exact PR head `bb4f57e0d446270b4c404879ef61b5e229e90bbf`; `THOTH-GQL-DATALOADER-01` implementation remains **NOT AUTHORIZED** — implementation authorization is a distinct later CTO decision after the approved specification is repository-authoritative on `develop`; `BE-02` and Thoth Metrics adoption, `OBSERVE`/`ENFORCE` activation, and PR [799](https://github.com/thoth-pub/thoth/pull/799)/`OPS-03` all remain outside scope and unauthorized.
   - [798](https://github.com/thoth-pub/thoth/pull/798) - `THOTH-GQL-OPS-03-SPEC`: finalize the `THOTH-GQL-OPS-03` effective-mode **fleet-verification** specification as an approval candidate, reconciled against the post-`THOTH-GQL-OPS-02` repository state and resolving its one outstanding architecture decision. **Specification and control only — no runtime, GraphQL, schema, migration, workflow or infrastructure change, no implementation, and no branch created for the implementation task.** The specification's mandatory section 3.2 **information-disclosure boundary is now selected**: the effective-mode verification signal must be available only through an **orchestration/administrative-plane or equivalent out-of-band per-instance mechanism**, a **public unauthenticated effective-mode surface is REJECTED**, the public GraphQL schema stays unchanged, and the mechanism may disclose only the process's actual effective `MutationGuardMode` plus the **minimum runtime identity** needed to correlate one observation to one orchestrator-enumerated instance — never a secret, credential, environment-variable value, deployment configuration, publisher, user or request data, or unnecessary topology metadata. The reason is recorded rather than assumed: the mode describes server-side **request-acceptance policy** and therefore carries reconnaissance value, no public caller needs it, and a public surface cannot address an individual replica behind the shared load balancer, so it would buy the disclosure without buying the capability; the alternatives considered — a public route or `ApiConfig` field, a public GraphQL field, and an authenticated public surface — are each recorded with their disposition, and reopening the decision is reserved to the CTO rather than available to the implementing task. **The pre-`THOTH-GQL-OPS-02` premise is corrected throughout:** the specification no longer describes the image-default `init` path as ignoring `THOTH_GRAPHQL_MUTATION_GUARD_MODE`, because `THOTH-GQL-OPS-02` merged and closed capability gap 1 in-repository. The **silent-adoption failure class survives that fix and is now stated generically** — configured intent is not proof of process-effective mode — with capability gap 2 recorded as the one still open: no mechanism proves the effective mode of every serving process. Acceptance criteria were **strengthened, never weakened**: complete fleet enumeration is now *required* rather than merely supported, incomplete coverage must **fail closed** with `UNKNOWN` kept structurally distinct from `OFF` (new AC-22), a negative test must prove **no public unauthenticated caller** can obtain the mode from any existing route (new AC-11.1), the disclosed correlation identity must be justified field by field (new AC-23), the silent-adoption test must construct the divergence deliberately rather than depend on the closed `init` defect, and the merged `THOTH-GQL-OPS-02` behaviour must be regression-pinned in both build profiles. Dependencies are reconciled to current truth — `ADR-0006` repository-authoritative, `THOTH-GQL-BATCH-01`, `THOTH-GQL-OPS-01` and now `THOTH-GQL-OPS-02` merged — and a fresh exact `develop` base plus separate explicit CTO implementation authorization remain required. **This is an approval candidate, not an approval:** the specification stays `Status: DRAFT` with `Implementation: NOT AUTHORIZED`, the reserved implementation branch `feature/shared-architecture/graphql-guard-mode-fleet-verification` is **absent** and must remain so until implementation is authorized, and approving the specification decides only the specification and its section 3.2 boundary. **CG-13 remains OPEN**, the `ADR-0006` runtime-operations gate remains **NOT SATISFIED**, the mode-transition runbook remains **PROVISIONAL**, `OBSERVE`, `ENFORCE` and `BE-02` runtime remain **NOT AUTHORIZED**, `THOTH-GQL-OPS-04` remains unimplemented, control limitation CL-1 on implementing-agent access to secret-bearing production configuration is unchanged and unclosed, and no deployment, configuration, mode transition or protected-source read occurred