docs: record latest RP review evidence

[seonghobae]

Summary

• update ADR-0008 and TRACEABILITY to the latest newsdom-api PR head
• record the CodeRabbit review follow-up and startup credential-registry evidence

Validation

• git diff --check

Please review exact head cdd9d7c and merge normally when protected checks permit. Do not use Admin merge.

Summary by CodeRabbit

• 문서
  • 권한 경계 및 추적성 문서의 NewsDOM API 커밋 참조를 최신 정보로 갱신했습니다.
  • 시작 시 자격 증명 등록, 인증 예시, 헬스체크 권한 검사 및 401 응답 검증 관련 근거를 보강했습니다.

[seonghobae]

@opencode-agent review

Please independently review exact current head cdd9d7c. Verify ADR-0008 and TRACEABILITY refer to the latest application PR head and do not invent protected-branch completion. Do not mutate or merge.

[seonghobae]

@coderabbitai review

Please review exact current head cdd9d7c for documentation accuracy: latest newsdom-api PR head, review evidence, and active-PR maturity. Do not mutate or merge.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 204d32b1-9173-4299-852f-af743feb3ceb

📥 Commits

Reviewing files that changed from the base of the PR and between e38bb30 and cdd9d7c.

📒 Files selected for processing (2)

• docs/TRACEABILITY.md
• docs/adr/0008-keyverse-rp-authorization-boundary.md

---

📝 Walkthrough

Walkthrough

NewsDOM sidecar anonymous-access boundary의 감사 커밋을 3025be1로 갱신했습니다. 관련 문서에 인증 구성과 healthcheck 및 401 검증 증거를 추가했습니다.

Changes

권한 경계 감사 증거

Layer / File(s)	Summary
감사 문서 증거 갱신 docs/TRACEABILITY.md, docs/adr/0008-keyverse-rp-authorization-boundary.md	NewsDOM 기준 커밋을 f790252에서 3025be1로 갱신했습니다. Startup credential registry, 인증된 예시, healthcheck 실행 권한 검사, 완전한 401 검증 및 관련 테스트 근거를 기록했습니다.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• ContextualWisdomLab/keyverse#75: 동일한 권한 경계 추적 문서의 초기 증거를 추가했습니다.
• ContextualWisdomLab/keyverse#78: 동일한 NewsDOM 인증 경계에 대한 ADR-0008 및 TRACEABILITY 증거를 갱신했습니다.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/adr-rp-auth-final

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Checked-out commit =="
git rev-parse HEAD
git status --short
git diff --check

echo "== PR metadata =="
gh pr view 80 --repo ContextualWisdomLab/keyverse \
  --json number,url,state,isDraft,headRefName,headRefOid,baseRefName,mergeStateStatus,reviewDecision,statusCheckRollup,title

echo "== Locate documentation files =="
fd -i 'ADR-0008|TRACEABILITY' . -t f

echo "== Documentation diff at HEAD =="
git diff --find-renames --unified=80 'cdd9d7c^' 'cdd9d7c' -- \
  ':(glob)**/*ADR-0008*' ':(glob)**/*TRACEABILITY*' || true

echo "== References to newsdom-api, PR heads, review evidence, and protected branches =="
rg -n -i -C 4 \
  'newsdom-api|pull request|PR[[:space:]]*#|head commit|review|CodeRabbit|credential.registry|credential-registry|protected branch|protected-branch|merge' \
  -g '*ADR-0008*' -g '*TRACEABILITY*' .

echo "== Candidate referenced GitHub PR URLs and numbers =="
rg -o -i \
  'https://github\.com/[^[:space:])]+/(pull|pulls)/[0-9]+|[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+#([0-9]+)' \
  -g '*ADR-0008*' -g '*TRACEABILITY*' . | sort -u

Length of output: 20563

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== ADR-0008 location and content at HEAD =="
rg -n -i -C 12 'ADR[- ]?0008|non-fork RP|sidecar anonymous-access|newsdom-api' . || true

echo "== Documentation paths in commit cdd9d7c =="
git ls-tree -r --name-only cdd9d7c | rg -i '(^|/)(adr|traceability)|0008|traceability' || true

echo "== Changed files and commit message =="
git show --no-ext-diff --format=fuller --name-status cdd9d7c
git show --no-ext-diff --format= --unified=80 cdd9d7c -- \
  ':(glob)**/*0008*' ':(glob)**/*[Aa][Dd][Rr]*' ':(glob)**/*TRACEABILITY*' || true

echo "== newsdom-api PR `#595` metadata and current head =="
gh pr view 595 --repo ContextualWisdomLab/newsdom-api \
  --json number,url,state,isDraft,title,headRefName,headRefOid,baseRefName,mergeStateStatus,reviewDecision,mergedAt,closedAt,statusCheckRollup

echo "== newsdom-api PR `#595` reviews and discussion evidence =="
gh api --paginate \
  repos/ContextualWisdomLab/newsdom-api/pulls/595/reviews \
  --jq '.[] | {user: .user.login, state: .state, commit_id: .commit_id, submitted_at: .submitted_at, body: .body}' || true
gh api --paginate \
  repos/ContextualWisdomLab/newsdom-api/issues/595/comments \
  --jq '.[] | {user: .user.login, created_at: .created_at, body: .body}' || true

echo "== newsdom-api PR `#595` changed-file evidence =="
gh pr diff 595 --repo ContextualWisdomLab/newsdom-api --name-only

Length of output: 83992

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="ContextualWisdomLab/newsdom-api"
ref="3025be1518a78f469d686644bde8b82f5f7bed05"

get_file() {
  local path="$1"
  echo "== ${path} at ${ref} =="
  gh api "repos/${repo}/contents/${path}?ref=${ref}" --jq '.content' \
    | tr -d '\n' | base64 -d
  printf '\n'
}

echo "== Commit range and changed files =="
gh api "repos/${repo}/compare/f79025224dabc997ea6376225066804f1ed6ba6e...${ref}" \
  --jq '{status, ahead_by, commits: [.commits[] | {sha, message: .commit.message}], files: [.files[] | {filename, status}]}'

get_file 'src/newsdom_api/config.py'
get_file 'src/newsdom_api/main.py'
get_file 'tests/test_auth.py'
get_file 'README.md'
get_file '.clusterfuzzlite/Dockerfile'
get_file 'pyproject.toml'

echo "== Dependency-lock references for pypdf =="
gh api "repos/${repo}/contents/uv.lock?ref=${ref}" --jq '.content' \
  | tr -d '\n' | base64 -d | rg -n -C 3 '^name = "pypdf"$|pypdf' || true

Length of output: 32153

---

@seonghobae Review complete for exact commit cdd9d7c9c61de7dacb041afb627182d3a4f7d0e9.

I found no documentation-accuracy issues.

• ADR-0008 and TRACEABILITY both cite newsdom-api PR #595 at current head 3025be1518a78f469d686644bde8b82f5f7bed05.
• PR #595 is open, targets develop, and remains BLOCKED. It is not merged.
• The cited review follow-up is accurate. The prior CodeRabbit review requested the credential registry, authenticated examples, executable healthcheck, and complete 401 contract. Commit 3025be1 implements these items, and CodeRabbit approved that commit.
• The cited pypdf remediation is supported by pypdf>=6.14.2,<7.0 and locked pypdf 6.15.0.
• Both documents retain active-PR maturity. They do not claim protected-branch completion, release, Keyverse authorization readiness, or external exposure approval.
• Both documents preserve the requirement for a Keyverse-aware gateway or verified service boundary before exposure.
• git diff --check reported no whitespace errors.

At inspection time, PR #80 was also open and BLOCKED, with checks still in progress. The documentation does not misrepresent that state.

⚠️ Action not completed

Pull request is closed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.