CTRL-ADR-PR-FIRST-01: add PR-first staged ADR correction approval

[ja573]

CTRL-ADR-PR-FIRST-01 - PR-first staged approval route for pre-authority ADR corrections

Owning issue: #966
Risk: CRITICAL
Workflow: STANDARD

exact base:
develop @ 8ac771c55937f7a4fe4131b3c21c466f0b4d7abc

exact head:
4cb3be375af61863103da7388e99c848dc97a15c

tree:
050e1e2954b518d62988e31d74a7d9c280b8822c

parent:
8ac771c55937f7a4fe4131b3c21c466f0b4d7abc (single commit, no merge, no force push)

Footprint (exactly three paths)

CHANGELOG.md
docs/engineering/ai-delivery/implementation-reports/CTRL-ADR-PR-FIRST-01-implementation-report.md
docs/engineering/decisions/README.md

What changes

docs/engineering/decisions/README.md gains a second safe route for a material correction to an APPROVED ADR that has never been repository-authoritative:

• Route A - pre-commit exact-final-blob approval is the existing route. Its nine-step sequence is retained byte-for-byte under its own heading. The existing pre-commit exact-final-blob approval route remains supported unchanged.
• Route B - PR-first staged approval: the implementing agent pushes the corrected candidate to a real task branch and draft PR as PROPOSED, without presenting the earlier version's approver/date as approval of the corrected bytes; the CTO records architecture-content approval against the exact candidate blob/head from the PR; only then may exactly one bounded approval-state commit (direct child of the content-approved head) record PROPOSED -> APPROVED, the fresh approver/date and authorized companion metadata; the CTO records exact-final-blob approval of the final ADR blob before merge; fresh independent exact-head review binds to the final PR head; HIGH/CRITICAL merge authorization and the guarded merge remain separate; merge remains separate from implementation, migration, provider/IAM/runtime action, deployment, release and activation.
• The CTO selects and records the route in the correction's task authorization before any correction commit.
• The doctrine records why the Route B approval-state commit is durable decision state (status transition, approver, date, agreeing companion metadata) rather than the transcription of GitHub lifecycle identifiers that ADR-0005 prohibits.
• Material-correction eligibility, the stale-control list, factual-clarification rules, ADR-0013 exact-version reliance/drift rules and the repository-authority condition are unchanged.

CHANGELOG.md: one CTRL-ADR-PR-FIRST-01 entry under [Unreleased] -> Changed; no new heading.

Implementation report: template-structured; records base, branch, footprint, action-use matrix, validation and remaining gates; leaves head/CI/review/merge state to GitHub per ADR-0005.

Validation (exact)

git status --short
-> (empty after commit; before commit: M CHANGELOG.md, A ...CTRL-ADR-PR-FIRST-01-implementation-report.md, M docs/engineering/decisions/README.md)

git diff --check
-> exit 0, no output

git diff --name-only 8ac771c55937f7a4fe4131b3c21c466f0b4d7abc...HEAD
-> CHANGELOG.md
   docs/engineering/ai-delivery/implementation-reports/CTRL-ADR-PR-FIRST-01-implementation-report.md
   docs/engineering/decisions/README.md

Additional checks: Route A nine-step list and the pre-existing closing paragraphs are byte-identical to the base; README lines 1-105 unchanged; [Unreleased] retains exactly one Added, Changed and Fixed heading; internal links resolve; no ADR, workflow, migration, runtime, schema, API, auth or settings path differs from the base.

Automatic side effects

Opening this PR triggers the normal pull_request workflows and the configured automatic Codex/app review. The change set is CHANGELOG.md + docs/** only, so the CI classifier is expected to skip build/test/lint/format/migrations/Docker and run only classify and check-changelog. No manual dispatch or rerun will be performed. No container-registry push, release, tag or external write is expected.

Effects and gates

• No runtime, schema, migration, API, GraphQL, authorization, workflow, provider/IAM, deployment, release or production-activation effect.
• No ADR is modified. THOTH-ASYNC-01-ADR-01: Author ADR-0012 shared async architecture #958 / PR THOTH-ASYNC-01-ADR-01: approve ADR-0012 shared async architecture #960 are not modified and are not reauthorized by this PR.
• No merge is authorized by this PR or its specification. Fresh independent CRITICAL exact-head review and separate CTO merge authorization are required. The implementing agent does not approve, mark merge-ready or merge its own work.

[ja573]

Independent CRITICAL exact-head review - APPROVED

Binding identity:

task: CTRL-ADR-PR-FIRST-01 / #966
PR: #967
base: develop @ 8ac771c55937f7a4fe4131b3c21c466f0b4d7abc
head: 4cb3be375af61863103da7388e99c848dc97a15c
tree: 050e1e2954b518d62988e31d74a7d9c280b8822c
direct parent: 8ac771c55937f7a4fe4131b3c21c466f0b4d7abc
risk: CRITICAL
decision: APPROVED

I independently inspected the actual GitHub source/diff and surrounding repository-authoritative doctrine rather than relying on the implementation handoff.

Verified:

• the head is exactly one direct child of the authorized base and the PR remains OPEN / DRAFT / UNMERGED / CLEAN;
• the cumulative change is exactly the three authorized paths: CHANGELOG.md, the new CTRL-ADR-PR-FIRST-01 implementation report, and docs/engineering/decisions/README.md;
• no ADR, runtime, migration, schema/API, authorization, workflow or settings path changed;
• the README content before the old exact-final-blob section is byte-preserved, and the pre-existing common rules after that section are byte-preserved;
• Route A's nine-step approval sequence is byte-identical to the repository-authoritative pre-commit sequence;
• Route B satisfies #966's staged PR-first requirements: corrected bytes remain PROPOSED until exact candidate content approval; prior approval metadata cannot be represented as approval of corrected bytes; the approval-state commit is bounded/direct-child and may not alter approved architecture content; exact-final-blob approval remains mandatory before merge; fresh independent exact-head review follows the approval-state commit; HIGH/CRITICAL merge authorization remains separate; and merge remains separate from implementation/migration/provider/deployment/release/activation;
• the ADR-0005 rationale is appropriately narrow: the allowed approval-state commit records durable decision state required by the ADR itself and explicitly forbids copying review/approval/merge lifecycle identifiers into repository files;
• material-correction eligibility, repository-authority semantics and ADR-0013 exact-version drift/reliance controls are not weakened;
• the changelog contains one bounded Shared Engineering Control entry;
• all three final blobs have no trailing whitespace and end with a newline.

Automatic CI at this exact head is complete:

check-changelog: success
build-test-and-check classify: success
  build/test/lint/format_check: skipped
run-migrations classify: success
  run_migrations: skipped
publish-to-dockerhub classify: success
  build_and_push_staging_docker_image: skipped

All four workflow runs were first-attempt pull_request runs bound to this exact head. No migration or Docker publication job executed.

Non-blocking observation O-1: the committed implementation report deliberately does not self-pin the commit that contains itself and leaves final-head/final-CI lifecycle facts to GitHub. Although #966's acceptance wording says the report records exact base/head and CI status/effects, this is consistent with ADR-0005, current implementation-report practice, and accepted repository precedent. The exact head and actual CI are present durably in this PR/review record, so I do not treat the self-reference avoidance as an acceptance failure.

No blocking finding identified.

This approval is bound only to exact head 4cb3be375af61863103da7388e99c848dc97a15c. Any source commit invalidates it.

APPROVED does not authorize merge. Separate exact-head CTO merge authorization remains required for this CRITICAL task, and no runtime/provider/migration/deployment/release/production action is authorized.

Note on GitHub review mechanics: the connected GitHub identity is the PR author, so GitHub rejects an APPROVE review event on its own PR. This COMMENT review is therefore the durable independent-control review receipt; the independent reviewer is the cross-model control process, not a second GitHub user identity.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-02T17:36:57.922227Z	4cb3be3	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4cb3be375a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Define a valid retry path for approval-date mismatches

When the exact-final-blob check detects a mismatched approval date, the prescribed retry cannot satisfy Route B: stage 3 allows exactly one approval-state commit directly atop the content-approved head, so another additive commit would be a second, non-direct-child approval-state commit, while replacing the existing commit would require the history rewrite that this section and repository policy prohibit. The procedure should explicitly return to a new PROPOSED candidate and fresh content approval, or define another authorized additive commit graph.

AGENTS.md reference: AGENTS.md:L125-L131

Useful? React with 👍 / 👎.