docs: record RP authorization remediation evidence

[seonghobae]

Summary

• update ADR-0008 with the current pg-erd-cloud PR #855 Keyverse organization profile and NewsDOM PR #595 fail-closed/security head
• record project-member RBAC plus deployment-level single-tenant org ABAC for pg-erd-cloud
• explicitly retain the shared multi-tenant schema gap and the production identity gaps for naruon, clearfolio, contextual-orchestrator, and NewsDOM
• add active-PR traceability entries and exact regression-test evidence

Verification

• uv run pytest ../../tests/test_documentation_contract.py -q (5 passed)
• uv run ruff check app tests tools
• uv run interrogate . (100%)
• uv run python -m compileall -q app tests tools
• git diff --check

Normal merge/auto-merge only; no self-approval or Admin merge.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 44 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2e1f9562-f7f7-45a7-ac76-a4757d851d73

📥 Commits

Reviewing files that changed from the base of the PR and between 571df2a and 887e93a.

📒 Files selected for processing (2)

• docs/TRACEABILITY.md
• docs/adr/0008-keyverse-rp-authorization-boundary.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review exact current head 887e93a. Verify ADR-0008/TRACEABILITY consistency, active-PR maturity, and that no app is incorrectly claimed authorization-ready. Do not mutate or merge.

[seonghobae]

@opencode-agent review

Please submit an independent review for exact current head 887e93a. Do not mutate or merge.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== checked-out commit =='
git rev-parse HEAD
git status --short
echo '== PR diff files =='
git diff --name-status HEAD^ HEAD
echo '== candidate documentation files =='
fd -HI '^(ADR-0008|TRACEABILITY)(\..*)?$' . || true
echo '== references to the required apps, PRs, and authorization state =='
rg -n -i -C 3 \
  'ADR-0008|TRACEABILITY|pg-erd-cloud|NewsDOM|naruon|clearfolio|contextual-orchestrator|authorization-ready|authorization ready|PR #?(855|595)|#(855|595)' \
  . -g '!**/.git/**' -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' || true

echo '== pull request metadata =='
gh pr view 79 --repo ContextualWisdomLab/keyverse \
  --json number,url,state,headRefOid,baseRefName,headRefName,title,body,files \
  --jq '{number,url,state,headRefOid,baseRefName,headRefName,title,body,files:[.files[].path]}'

echo '== linked external pull requests =='
for spec in 'ContextualWisdomLab/pg-erd-cloud 855' 'ContextualWisdomLab/NewsDOM 595'; do
  set -- $spec
  echo "--- $1#$2 ---"
  gh pr view "$2" --repo "$1" \
    --json number,url,state,isDraft,mergedAt,closedAt,headRefOid,title,body,mergeable,reviewDecision,statusCheckRollup \
    --jq '{number,url,state,isDraft,mergedAt,closedAt,headRefOid,title,body,mergeable,reviewDecision,statusCheckRollup:[.statusCheckRollup[]? | {name,conclusion,status}]}'
done

Length of output: 186033

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== exact documentation patch =='
git diff --unified=80 HEAD^ HEAD -- \
  docs/TRACEABILITY.md \
  docs/adr/0008-keyverse-rp-authorization-boundary.md

echo '== ADR-0008 complete review range =='
sed -n '1,180p' docs/adr/0008-keyverse-rp-authorization-boundary.md
echo '== TRACEABILITY complete review range =='
sed -n '1,90p' docs/TRACEABILITY.md

echo '== pg-erd-cloud `#855` changed files and test references =='
gh pr view 855 --repo ContextualWisdomLab/pg-erd-cloud \
  --json files,commits \
  --jq '{files:[.files[].path],commits:[.commits[] | {oid,messageHeadline}]}'
gh pr diff 855 --repo ContextualWisdomLab/pg-erd-cloud --name-only
gh pr diff 855 --repo ContextualWisdomLab/pg-erd-cloud -- \
  2>/dev/null | rg -n -C 3 \
  'OIDC_ORGANIZATION|pgerd_|test_keyverse_organization_claim_is_required_and_exact|organization.*claim|api.?key.*bypass' \
  || true

echo '== locate NewsDOM repository and PR `#595` =='
gh repo list ContextualWisdomLab --limit 300 --json name,nameWithOwner,url \
  --jq '.[] | select(.name | test("newsdom"; "i"))'
gh search prs --owner ContextualWisdomLab --state open --limit 100 \
  --json number,repository,title,url,headRefName,updatedAt \
  --jq '.[] | select(.number == 595 or (.repository.name | test("newsdom"; "i")))'

Length of output: 40235

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== NewsDOM PR `#595` metadata =='
gh pr view 595 --repo ContextualWisdomLab/newsdom-api \
  --json number,url,state,isDraft,mergedAt,closedAt,headRefOid,baseRefName,title,body,mergeable,reviewDecision,statusCheckRollup,files \
  --jq '{
    number,url,state,isDraft,mergedAt,closedAt,headRefOid,baseRefName,title,body,mergeable,reviewDecision,
    files:[.files[].path],
    statusCheckRollup:[.statusCheckRollup[]? | {name,conclusion,status}]
  }'

echo '== NewsDOM PR `#595` authorization and pypdf evidence =='
gh pr diff 595 --repo ContextualWisdomLab/newsdom-api 2>/dev/null | \
  rg -n -C 4 \
  'NEWSDOM_ALLOW_ANONYMOUS|anonymous|default.?deny|bearer|Authorization|pypdf|trivy|def test_|async def test_' \
  || true

echo '== pg-erd-cloud `#855` exact test definitions and enforcement calls =='
gh pr diff 855 --repo ContextualWisdomLab/pg-erd-cloud 2>/dev/null | \
  rg -n -C 5 \
  'async def test_|def test_|pgerd_|OIDC_ORGANIZATION|oidc_organization|issued.?at|iat|audience' \
  || true

echo '== current external PR maturity =='
for spec in \
  'ContextualWisdomLab/pg-erd-cloud 855' \
  'ContextualWisdomLab/newsdom-api 595'; do
  set -- $spec
  echo "--- $1#$2 ---"
  gh pr view "$2" --repo "$1" \
    --json state,isDraft,mergedAt,headRefOid,statusCheckRollup \
    --jq '{state,isDraft,mergedAt,headRefOid,statusCheckRollup:[.statusCheckRollup[]? | select(.status != "COMPLETED" or (.conclusion != "SUCCESS" and .conclusion != "SKIPPED" and .conclusion != "NEUTRAL")) | {name,status,conclusion}]}'
done

Length of output: 21680

---

@seonghobae Reviewed exact head 887e93a14b2a9384c8ceb112c949a6748dd04ef9.

No findings in the requested scope.

• ADR-0008 and docs/TRACEABILITY.md use the same commits for pg-erd-cloud PR #855 and NewsDOM PR #595.
• Both external changes are open PRs. Both remain correctly marked active-PR.
• pg-erd-cloud PR #855 has the documented single-tenant OIDC_ORGANIZATION boundary, exact org enforcement, audience and iat requirements, and API-key bypass denial.
• ADR-0008 retains the shared multi-tenant persistence, tenant-qualified query, composite-constraint, and cross-tenant denial-test gaps.
• NewsDOM PR #595 has default-deny /parse behavior and explicit NEWSDOM_ALLOW_ANONYMOUS=true local opt-in. ADR-0008 correctly retains its lack of a user authorization model.
• naruon, clearfolio, and contextual-orchestrator remain documented as incomplete. No application is claimed authorization-ready.

I did not mutate or merge anything.

_{You are interacting with an AI system.}