MET-WP11-B-CLIPPY-01 - Restore unsuppressed Clippy before final Metrics integration

Status: DRAFT / HOLD - proposed Amendments 7A+7B+7C not yet independently approved or CTO-approved. NO IMPLEMENTATION AUTHORIZATION.
Programme/stage: Thoth Metrics, WP11-B / final inactive Thoth API integration CI correction.
Owning repository: thoth-pub/thoth. Owning GitHub issue: #985. Parent programme-integration task: #981. Outer PR: #984.
Task ID: MET-WP11-B-CLIPPY-01. Risk: HIGH (dependency code-generation change within CRITICAL B integration).
Proposed workflow: exceptional one-time post-A2 PROGRAMME_INTEGRATION slice, narrowly qualifying approved Amendment 3 §§13, 17 and Amendment 4 §§8, 16 for exactly one corrective child branch under proposed 7B+7C; subject to fresh independent CRITICAL/HIGH specification review and express CTO specification approval. No source or action authority yet.
Approved parent: #981 original plus Amendments 1-6 (CTO specification approval #981/6126801903).
Current proposal: #981 Amendment 7A comment 6273625367 + corrective Amendment 7B comment 6288115189 + corrective Amendment 7C comment 6288991064, all PROPOSED / UNAPPROVED. Attributed independent A7A/#985 review receipt: #981/6288092549, CHANGES REQUIRED; 7B closed B-1 and R-1 through R-8. Independent cumulative A7A+7B/#985 review published #981/6288979909: CHANGES REQUIRED, new N-1 (blocking) plus N-2 through N-6. Proposed 7C corrects N-1 through N-6, not yet independently re-reviewed. A7A superseded unapproved A7/6272787777 as candidate; A7's 346 authored-Rust-edit premise was independently BLOCKED.
Earlier B integration source approval: #981/6239896043 binds old M only. Earlier conditional B merge authorization: #981/6266565965 superseded for execution by #981/6267244681.
Base source candidate: feature/metrics @ d5451f8516fa18126f6f4969fb3409775408e242, Git tree c15d07c3d48bb84fab6033307369c51de2258506.
Target baseline for outer B: develop @ b44303c214498baf76c9d9a0a7cab374377f9cbe.
Proposed child task branch: feature/metrics--wp11-b-clippy (currently absent); proposed child PR target: feature/metrics at exact M. Branch creation / PR publication not authorized.
External effects: future child PR publication and synchronization push a GHCR staging image; later child merge synchronizes outer #984 and pushes its replacement staging image. These require separately explicit external-side-effect authorizations.

1. Objective and independently verified root cause

Make the natural unsuppressed CI command cargo clippy --all --all-targets --all-features -- -D warnings GREEN before any #984 integration into develop, with the smallest compatible upstream dependency-codegen patch, not a lint waiver.

At M, CI run 38806270979, lint job 116667915795, is FAILED. The primary log has 346 unique clippy::redundant_field_names file/line/column positions, 347 rendered instances, in 36 Rust files (single lint class). All point to named field declarations inside #[derive(diesel::QueryableByName)] types. Diesel's generated pre-patch QueryableByName initializer uses redundant syntax; no authored field: field initializer exists at the CI locations. Earlier #952/6039675059 identified this same derive-origin cause.

At exact M and D, Cargo.lock (same Git blob on both) pins diesel=2.3.10 and diesel_derives=2.3.9. Diesel's ~2.3.0 derive dependency allows a targeted diesel_derives=2.3.10 update. Diesel 2.3.13 release notes identify the upstream QueryableByName Clippy fix; its paired derive crate version 2.3.10 generates shorthand field initialization. A separate reviewer reports unsuppressed Clippy PASS and unchanged generated SDL using this patch in a disposable exact-M worktree. The reported local result is supporting evidence, NOT natural CI acceptance, and the agent issuing this specification has not independently rerun the patched build.

The previous "replace exactly 346 authored field: field sites" spec and A7 write budget are technically invalid, VOID as implementation instructions. No Rust authoring is authorized by this corrected design.

2. Explicit new-source and existing-file WRITE BUDGET (proposed; not authorized yet)

2.1 Existing tracked files permitted to change

Cargo.lock - sole dependency patch: update only the [[package]] name = "diesel_derives" stanza's version = "2.3.9" and pinned registry checksum to 2.3.10 with exact crates.io checksum ecbd51fb6c020672543641167efa4e6417ff7ad76849ed556ace3595e72de03a (original 2.3.9 checksum d1817b7f4279b947fc4cafddec12b0e5f8727141706561ce3ac94a60bddd1cf5). The entire lockfile diff is exactly two modified lines: derive-stanza version and checksum; published derive dependency declarations are unchanged. No other lockfile stanza, package, version, source, edge, checksum, formatting or package addition/deletion may differ from M. Keep diesel = 2.3.10.

Preferred diagnostic method: cargo update -p diesel_derives --precise 2.3.10. This command may also cause heck re-resolution. Such collateral heck 0.5.0 -> 0.4.1 or any other package change is PROHIBITED, even if emitted by Cargo's ordinary resolver. After producing the only permitted derive stanza change, cargo metadata --locked and cargo check --workspace --locked must independently confirm its consistency. If a strict unchanged-other-dependencies lockfile cannot validate, HOLD and return evidence for a new independent scope decision, rather than silently broadening the budget.

Exactly four existing repository doctrine files, only their Thoth-specific current post-A2 programme-flow paragraphs:

• docs/engineering/ai-delivery/branching-and-release-workflow.md
• docs/engineering/repository-map/branch-topology.md
• docs/metrics/README.md
• docs/metrics/task-status.md

Those four edits must continue to say no normal new feature/metrics--<slice> branches after A2; distinguish the original separately authorized develop-refresh recovery from the one-time approved-only CI correction governed by thoth-pub/thoth#981 / thoth-pub/thoth#985; preserve renewed A2 inventory/review/retirement prior to B; and never create a reusable or standing authorization. Durable text must be true before and after B, without transient comment IDs/PR status/anticipated completion or unrelated doctrine rewriting. Proposed 7C §4 supersedes the earlier A7A-only doctrine reference.

CHANGELOG.md: one narrowly bounded entry under the existing [Unreleased] / ### Fixed heading referring to #985, not a future PR number or new feature.

2.2 Only new file permitted

docs/engineering/ai-delivery/implementation-reports/MET-WP11-B-CLIPPY-01-implementation-report.md

Follow the repository-authoritative implementation-report template. No other new file may be tracked; no renames/moves/deletions.

2.3 READ-ONLY / BYTE-IDENTITY inventory (36 former lint-diagnostic Rust paths)

Every following original source file MUST remain byte-identical to the exact M Git blob. Their numbers refer to existing CI diagnostic field declarations, not editable Rust initializers:

• thoth-api/src/graphql/distribution_job_tests.rs (4 locations)
• thoth-api/src/model/distribution_job/crud.rs (2 locations)
• thoth-api/src/model/distribution_job/mod.rs (32 locations)
• thoth-api/src/model/distribution_job/tests.rs (4 locations)
• thoth-api/src/model/metric_coverage/tests.rs (6 locations)
• thoth-api/src/model/metric_coverage_run/crud.rs (2 locations)
• thoth-api/src/model/metric_coverage_run/tests.rs (2 locations)
• thoth-api/src/model/metric_coverage_run/verification.rs (10 locations)
• thoth-api/src/model/metric_dashboard/mod.rs (67 locations)
• thoth-api/src/model/metric_dashboard/tests.rs (8 locations)
• thoth-api/src/model/metric_identifier_quarantine/tests.rs (3 locations)
• thoth-api/src/model/metric_identifier_quarantine_reconciliation/mod.rs (1 locations)
• thoth-api/src/model/metric_identifier_quarantine_reconciliation/tests.rs (1 locations)
• thoth-api/src/model/metric_import/tests.rs (6 locations)
• thoth-api/src/model/metric_import_error/tests.rs (2 locations)
• thoth-api/src/model/metric_ingestion/tests.rs (1 locations)
• thoth-api/src/model/metric_ingestion_lifecycle/mod.rs (12 locations)
• thoth-api/src/model/metric_measure/tests.rs (11 locations)
• thoth-api/src/model/metric_operas_export/tests.rs (9 locations)
• thoth-api/src/model/metric_operas_import/tests.rs (7 locations)
• thoth-api/src/model/metric_operas_mapping/tests.rs (7 locations)
• thoth-api/src/model/metric_platform/tests.rs (7 locations)
• thoth-api/src/model/metric_publisher_platform_approval/tests.rs (4 locations)
• thoth-api/src/model/metric_reconciliation_issue/tests.rs (7 locations)
• thoth-api/src/model/metric_reconciliation_run/tests.rs (7 locations)
• thoth-api/src/model/metric_record/tests.rs (7 locations)
• thoth-api/src/model/metric_record_revision/tests.rs (1 locations)
• thoth-api/src/model/metric_rollup_delta/crud.rs (33 locations)
• thoth-api/src/model/metric_rollup_delta/tests.rs (19 locations)
• thoth-api/src/model/metric_rollup_delta/verification.rs (44 locations)
• thoth-api/src/model/metric_source/tests.rs (3 locations)
• thoth-api/src/model/metric_source_registry_history/tests.rs (1 locations)
• thoth-api/src/model/publisher_distribution_platform/tests.rs (1 locations)
• thoth-api/src/model/publisher_service_configuration/migration_backfill.rs (3 locations)
• thoth-api/src/model/publisher_service_configuration/tests.rs (1 locations)
• thoth-api/src/model/work_relation/tests.rs (11 locations)

Exactly 36 Rust paths / 346 diagnostic positions. Zero .rs paths may be changed, including these. No Cargo.toml, SQL migration, thoth-api/src/schema.rs, generated schema source, Clippy config/suppression, .github workflow/classifier, test fixture, other docs/ADR/AGENTS or other tracked source path may change. No downstream repository writes. If any additional path or dependency change is required, HOLD for fresh specification and permission.

3. Required invariants, contracts, data/auth, operational effects

• The functional Thoth API/GraphQL schema, generated clients, authorization and service-role checks, data/domain model, SQL, migration order, concurrency/idempotency, ingress/export semantics, external job/event interfaces, configurations and UI assumptions must remain unchanged. diesel_derives emits different initializer spelling; this is a code-generation dependency patch, and behavioural equivalence requires actual tests and review rather than an unproven syntax-only declaration.
• Existing 20 Metrics v1.9.0 up/down migration pairs, all previous migrations and thoth-api/src/schema.rs are byte-identical; no production migrations/backfills/read or writes.
• Original v1.8 GraphQL baseline compatibility, pinned Sphinx/dashboard operations and all protected service-role negatives must remain valid; original later Sphinx/dashboard cutover findings remain independently gated (no downstream work under this task).
• SDL generated by thoth-client/build.rs in the original M and corrected candidate must be regenerated in the same toolchain/environment, both byte-identical to each other and original recovered M SDL SHA-256 2681b54ac18296f886451d08f5396c0a9ef8351762f63f7b3f80f319ae505496. The generated asset is ignored/untracked, not a committed file. If M cannot reproduce, HOLD.
• Intended migration requirement: NO. Deployment/pilot/activation: NO. Feature flag/config: unchanged. Post-merge rollout only via separately governed MET-WP11-THOTH-API-01-B: final Metrics programme integration into develop #984 B integration and later C/D/E0/E gates.
• No provider/runtime/credential access and no manual GHCR publication in this task. Local test PostgreSQL/Redis must be disposable, never production-connected.
• develop and master retain the existing derive 2.3.9 pin and are potentially susceptible to the same 1.99.0 Clippy issue wherever affected derives compile; this is latent exposure, not proof of independently reproduced full failures on each branch. Develop's last green docs-only run did not establish current-toolchain full Clippy compatibility. The fix reaches develop only through a later separately authorized MET-WP11-THOTH-API-01-B: final Metrics programme integration into develop #984 true merge; no parallel develop fix while the programme freeze is active. Any master-side hotfix is a separate STANDARD task.

4. Required validation and acceptance checklist

• Proposed A7A+7B+7C and this exact MET-WP11-B-CLIPPY-01 - Restore unsuppressed Clippy before final Metrics integration #985 body independently CRITICAL/HIGH reviewed and expressly CTO specification-approved; all action permissions separately issued; exact M/D and branch namespace verified. Previous A7A+7B reviews were CHANGES REQUIRED, not approval of 7C.
• Exact single diesel_derives version+checksum patch in Cargo.lock, verified registry provenance and no heck or other collateral resolution. Dependency graph consistent under --locked; no other package or source modification.
• All 36 Rust paths have identical Git blob SHAs to exact M; no authored Rust change or lint suppression.
• Four doctrine paragraph edits are narrowly bounded and durable, cite stable thoth-pub/thoth#981 / thoth-pub/thoth#985 authority, and contain no transient PR/comment IDs; changelog issue MET-WP11-B-CLIPPY-01 - Restore unsuppressed Clippy before final Metrics integration #985 entry and single report are the only remaining changed/new paths. These edits do not clear the A2 slice-ref HOLD.
• git diff --check and cargo fmt --all -- --check: PASS.
• cargo metadata --locked, cargo check --workspace --locked, and full cargo test --workspace --locked: PASS with disposable UTF-8 PostgreSQL (prefer PostgreSQL 17, matching natural CI) and Redis; record PostgreSQL version/encoding. Previous pre-implementation local SQL_ASCII experiment was 2,149 passed, 5 failed, 3 ignored, and focused retests cleared the five on UTF-8; that is not full-suite green acceptance.
• Unsuppressed local cargo clippy --all --all-targets --all-features --locked -- -D warnings: PASS, zero lint warnings/errors. Reference rustc 1.99.0 (b940084d7, 2026-09-28), Cargo 1.99.0, Clippy 0.1.99; report actual tools/database. Natural CI uses the unlocked cargo clippy --all --all-targets --all-features -- -D warnings and must separately pass at exact child head. The natural lint job explicitly installs/pins no toolchain: it uses stable Rust preinstalled on ubuntu-latest; record actual runner rustc/Cargo/Clippy from job logs next to local versions. Natural test/build jobs also run unlocked. If natural runner stable advances or another lint emerges, HOLD rather than suppress.
• Full thoth-client/assets/schema.graphql regeneration via workspace-level build on both original-M and candidate, identical toolchain/environment (isolated cargo check -p thoth-client alone is insufficient due to feature unification); byte-identical and equal pinned hash; untracked generated asset; frozen SQL/schema.rs/.github source identities unchanged.
• Natural child PR lint/build/test/format/changelog SUCCESS at exact reviewed head, not merely operator assertions; collect CI job/run IDs and GHCR staging image digests as side effects. Expect run_build=true, run_migrations=false, run_docker=true for child diff (Cargo.lock + docs + changelog/report).
• Independent exact-head HIGH child source review by a model family different from implementer, with no task-level waiver (committed docs/engineering/ai-delivery/risk-classification.md requires cross-model review). Independent reviewer inspects actual diff, generated contract, runtime effects, tests/CI and allowed actions. Implementer never approves own changes.
• Distinct explicit child PR draft-to-ready authorization after exact-head natural CI + independent HIGH review; separate child true-merge authorization and adapted Amendment 6 parent/tree readback; renewed A2 retirement gate; 7C-qualified M2 outer-B source binding, newly bound outer B CI and cumulative independent CRITICAL review before any develop merge.

5. Controlled branch topology, PR/CI/GHCR and renewed A2 sequence

Approved-doctrine reconciliation / B-1: Approved Amendment 3 §13 prohibited post-A2 doctrine-cleanup branches; Amendment 4 §8 prohibited ordinary post-A2 slices except authorized develop-refresh. Proposed 7B #981/6288115189 expressly and narrowly qualifies both for exactly one CI-correction slice (feature/metrics--wp11-b-clippy) carrying the four named bounded doctrine paragraphs, not a new standing exception. The preceding committed paragraphs at M still name develop-refresh as the only exception: under proposed 7C §2 the fully independently reviewed and CTO-approved specification, once approved, is the sole narrow authority for that transient mismatch before the corrective child merges its reviewed doctrine. All unrelated source conflicts still require HOLD. The four doctrine edits undergo independent exact-head HIGH review.

B source binding / N-1: Approved Amendment 3 §17 and Amendment 4 §16 bind B to the programme state established by last authorized develop reconciliation. Proposed 7C #981/6288991064 expressly and narrowly qualifies both clauses for this single exceptional corrective child merge followed by renewed A2 completion. The original post-A M remains the immutable child base and the included D remains frozen; only after authorized TRUE MERGE COMMIT produces M2 and renewed A2 completes may #984 rebind to exact M2 and its reviewed tree. Verify M ancestor of M2; exact D ancestor of both child head and M2; no newly imported develop commit; exact reviewed merge topology/tree; unchanged live develop D and no live slice refs. With M2 substituted, approved Amendment 4 §§17-19, Amendment 5 §3 and B pre-/post-merge controls still apply. Any develop movement requires separate Amendment 4 §§13-15 refresh: this child is not develop reconciliation.

Amendment 3 §12 / renewed A2: The B HOLD while any feature/metrics--* slice remains live ends only after complete renewed exact-list A2 inventory, review, deletion authorization, guarded deletion/readback and completion receipt. Committing the four documentation edits does not clear that HOLD.

Proposed branch: feature/metrics--wp11-b-clippy from exact M, proposed child PR targeting feature/metrics at exact M. The existing outer #984 remains OPEN/DRAFT/HOLD against unchanged D.

Only after a fresh independent review APPROVES proposed A7A+7B+7C/#985 and a separate explicit CTO approval of the exact cumulative specification may subsequent individual permissions be considered. Specification approval alone grants no action authorization:

1. Preflight and source authorization: Reconfirm exact M SHA/tree and D SHA/tree, live refs/PRs, absence of naming collision, existing original A2 receipt, doctrine/CI/GHCR behaviour and the exact six-existing-files/one-new-report write budget. Separately authorize creation of one branch and bounded writes/local disposable validation. Source-write does not authorize commit, push or PR mutation.
2. Commit/push/draft child PR: Independently authorize commits, pushes and child PR creation/synchronization. Account expressly for automatic pull_request build/test/lint/format/changelog and GHCR ghcr.io/thoth-pub/thoth:staging-pr-<childPR> publication on opening and each synchronization; uncontrolled external effect => HOLD.
3. CI, review and PR readiness: Require natural unsuppressed CI SUCCESS on exact child head and independent different-family HIGH exact-head source review without waiver. The child's draft -> ready-for-review transition is a separate PR mutation requiring its own explicit authorization, and only after those acceptance gates are satisfied. Account for any automatic CI/GHCR effects of that transition. It does not authorize a merge.
4. Separately authorized child true merge: Require distinct CTO exact-SHA TRUE MERGE COMMIT authorization into feature/metrics and immediate race checks. The GitHub repository also permits squash/rebase: explicitly select and independently verify true merge. Adapt Amendment 6 §§5-6 to a child with no develop import: reviewed child head descends from exact M; D is ancestor; no newer develop import; exact target M unchanged immediately before merge; expected parents [then-current authorized M, exact reviewed child head]; reviewed final merge-result tree and post-merge two-parent/ancestry/readback evidence. Do not require an inner reconciliation merge that never occurred. No squash/rebase/history rewrite.
5. Child merge side effects: Before child merge recheck delete_branch_on_merge=false; changed auto-deletion settings => HOLD. Child merge advances outer MET-WP11-THOTH-API-01-B: final Metrics programme integration into develop #984 head to M2 and automatically synchronizes the already-open draft PR, triggers its full natural B CI, and replaces external GHCR staging-pr-984 image/digest. Exact-SHA child merge authorization must expressly include those external writes and permit their observation/reconciliation. GHCR image publication is not deployment, migration, release or activation.
6. Renewed A2: Exact-list re-inventory all feature/metrics--* refs, verify original 37 retired refs still absent, independently approve classification/retirement, obtain separate exact-SHA CTO per-ref deletion authorization, perform guarded per-ref deletion/readback, and publish durable renewed A2 completion receipt. No wildcard deletion, no assumption that merge deletes the corrective branch. If any slice ref remains, B HOLD.
7. Historical B PR and draft status: MET-WP11-THOTH-API-01-B: final Metrics programme integration into develop #984 was validly opened after original A2 zero-ref closure. The exceptional new slice suspends present B merge readiness, not its historical creation. Keep MET-WP11-THOTH-API-01-B: final Metrics programme integration into develop #984 DRAFT/HOLD; no close/reopen, ready-for-review transition, source approval or merge before renewed A2. This interpretation of approved original before opening B wording must be expressly accepted within future CTO specification approval.
8. Rebind B solely after renewed A2: Bind MET-WP11-THOTH-API-01-B: final Metrics programme integration into develop #984 to actual post-child M2 SHA/tree against unchanged D; verify original M ancestry, D ancestry, expected parent/tree proof, zero live slice refs, all original/renewed A2 IDs, natural B CI including classified migration workflow, unchanged GraphQL/SQL/authorization/integration invariants, fresh cumulative independent CRITICAL exact-head review and new CTO exact-head/base TRUE MERGE COMMIT authorization. Approved Amendment 4 §§17-19 and Amendment 5 §3 remain in force with M2 substituted. Previous MET-WP11-THOTH-API-01 - Thoth Metrics API integration and inactive-release readiness #981/6239896043 source approval and MET-WP11-THOTH-API-01 - Thoth Metrics API integration and inactive-release readiness #981/6266565965 conditional merge authorization are not reusable. Do not bypass GitHub protections/PR readiness.

The post-A develop coordination freeze remains binding. Any D movement, unexpected branch/CI/GHCR result, source/tree mismatch or unapproved effect => HOLD for separately governed reconstruction/refresh; this one-time Clippy correction never authorizes develop import or repair.

6. Rollout, rollback, recovery and stop conditions

Initial state after child merge: the programme integration branch only is patched; no production deployments, new backend features, data changes or Metrics activation. Rollout and observation belong to future B/C/D/E0/E gates.

Rollback before child merge: leave feature/metrics unmodified and abandon candidate under separate PR/ref permissions. Rollback after child merge: only independently reviewed forward-corrective work under new separate authority, preserving history; no reset/rebase/force-push on the shared integration branch.

HOLD: any M/D movement, namespace collision, expanded Cargo.lock diff, inconsistent --locked dependency graph, new Clippy class, changed toolchain without accepted evidence, SDL baseline mismatch, unexpected GHCR writes, changed branch auto-delete, missing A2 evidence or an unapproved action. STOP: need to alter API/SQL/domain/auth/concurrency/runtime, use a new normal post-A2 slice, violate branch freeze/history-preserving merge order, edit another repo, run non-disposable migrations or touch production/provider credentials. Escalate for reviewed respecification; no unapproved fixes.

7. Granular CURRENT authorization matrix

8. Current gate, reviewer and handoff

CURRENT: PROPOSED A7A+7B+7C/#985 - DRAFT/HOLD, NOT APPROVED. Attributed independent A7A+7B review #981/6288979909 found CHANGES REQUIRED (N-1 blocking). Proposed 7C/#981/6288991064 addresses N-1 through N-6 but has not yet received independent delta re-review. The CTO's authorization to publish three specification-ledger updates is not CTO specification approval or implementation authorization. PR #984 remains DRAFT / MERGE HOLD.

Next: independent reviewer to conduct a narrow delta-focused but authoritative cumulative re-review: read #981 original + approved Amendments 1-6, proposed 7A 6273625367, 7B 6288115189, 7C 6288991064, previous review receipts 6288092549 and 6288979909, current exact #985 body, CI, original/renewed A2 obligations and four committed doctrine paths. Reverify live M/D/PR #984/branch namespace and confirm every N-1 through N-6 correction; issue APPROVED / CHANGES REQUIRED / BLOCKED for specification only with exact baseline. Prior reviews' CHANGES REQUIRED verdicts do not approve the new cumulative specification. Only if APPROVED, separately seek explicit CTO specification approval of A7A+7B+7C and this exact #985 body. An implementation handoff would require subsequent granular authorization for each operation and automatic GHCR/CI effects.

Proposed implementing agent later, subject to separate authorization: Claude (one repository, bounded). Source reviewer later: different model family (e.g. GPT-6), HIGH review on exact implementation commit. CRITICAL B review follows new head after renewed A2. Required implementation report: docs/engineering/ai-delivery/implementation-report-template.md; include exact base/head, commits/paths, Cargo.lock hunk and checksums, cargo graph, tools/test output, SDL hashes, CI, PR and image side effects, deviations/limitations and remaining gates.