docs(adr): refresh app authorization evidence

[seonghobae]

Summary

• refresh ADR-0008 with current semantic-data-portal PR build(deps-dev): bump httpcore2 from 2.5.0 to 2.9.1 in /services/account_unification #58 and Naruon PR #1321 exact-head evidence
• record the Naruon explicit Keyverse issuer/audience and required iat acceptance boundary
• record semantic-data-portal validation of every tenant alias and fail-closed conflict handling
• update TRACEABILITY maturity rows without claiming either open PR is merged

Verification

• git diff --check
• documentation-only change; no production code or deployment artifact changed

Related: semantic-data-portal#58 and naruon#1321.

Summary by CodeRabbit

• 문서화
  • 추적성 문서의 검토 기준일과 검증 참조를 최신화했습니다.
  • Naruon의 OIDC 수용 경계와 Semantic Data Portal의 커밋·검증 증거를 추가했습니다.
  • Keyverse RP 인가 경계 감사 기록에 최신 검증 상태, 클레임 처리 증거 및 실패 조건을 반영했습니다.

[seonghobae]

@opencode-agent review

Please review exact current head d25c93c for the ADR-0008/TRACEABILITY refresh. Verify that the six non-fork app findings, Keyverse issuer/audience/iat boundaries, and semantic/Naruon current PR evidence are accurately recorded without claiming open PRs are merged. Do not mutate or merge.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b310c095-6ca8-4b39-9cc4-e767bbe22de3

📥 Commits

Reviewing files that changed from the base of the PR and between d25c93c and 079176a.

📒 Files selected for processing (2)

• docs/TRACEABILITY.md
• docs/adr/0008-keyverse-rp-authorization-boundary.md

📝 Walkthrough

Walkthrough

Keyverse OIDC 수용 경계 문서가 최신 감사 기준과 검증 증거를 반영하도록 갱신되었습니다. naruon 항목이 추가되었고, semantic-data-portal의 커밋 및 테스트 증거가 갱신되었습니다.

Changes

인가 경계 감사 문서

Layer / File(s)	Summary
감사 증거 및 검증 기준 갱신 docs/adr/0008-keyverse-rp-authorization-boundary.md	애플리케이션별 issuer, audience, iat, 테넌트 및 역할 클레임 검증과 보호된 체크 요구사항을 갱신했습니다. semantic-data-portal과 naruon의 검증 테스트 및 최신 커밋 참조를 추가했습니다.
추적성 기록 갱신 docs/TRACEABILITY.md	문서 검토일을 갱신했습니다. naruon의 OIDC 수용 경계 항목을 추가하고 semantic-data-portal의 커밋 및 검증 증거를 갱신했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• ContextualWisdomLab/keyverse#75: 동일한 추적성 문서와 ADR-0008의 기존 기준을 갱신했습니다.
• ContextualWisdomLab/keyverse#77: semantic-data-portal의 ADR-0008 감사 참조를 갱신했습니다.
• ContextualWisdomLab/keyverse#78: 애플리케이션 인가 경계 증거를 ADR-0008과 추적성 문서에 기록했습니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 ADR 및 추적성 문서의 애플리케이션 권한 검증 증거 갱신이라는 주요 변경 사항을 정확히 요약합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/adr-app-authorization-evidence-20260812

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/adr/0008-keyverse-rp-authorization-boundary.md`:
- Around line 18-19: Update docs/adr/0008-keyverse-rp-authorization-boundary.md
lines 18-19 to use the actual evidence refresh date or merge the document only
after that refresh; update docs/TRACEABILITY.md line 4 to the actual last review
date, ensuring neither document records the future date 2026-08-12 as completed
work.
- Around line 94-102: Expand the recorded PR head hashes from seven-character
abbreviations to their full 40-character immutable commit hashes: update 103e54b
and 8db9575 in docs/adr/0008-keyverse-rp-authorization-boundary.md lines 94-102
and docs/TRACEABILITY.md lines 24-25, preserving the surrounding active-PR
evidence and references.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f86c46d2-c7f3-44bf-861c-f21575dc1bde

📥 Commits

Reviewing files that changed from the base of the PR and between 214afb4 and d25c93c.

📒 Files selected for processing (2)

• docs/TRACEABILITY.md
• docs/adr/0008-keyverse-rp-authorization-boundary.md

[seonghobae]

@opencode-agent review

Please review exact current head ec7c1d5. Recheck ADR-0008 and TRACEABILITY evidence against the latest Naruon PR #1321 head and semantic-data-portal PR #58 head; do not claim open PRs are merged. Do not mutate or merge.

[seonghobae]

@opencode-agent review

Please review exact current head 079176a only. Verify the corrected full Naruon PR #1321 SHA 6a5cf11902bccbbdacf16901d8cd9b7133eb7d49, semantic PR #58 head 103e54b, and that the ADR/TRACEABILITY maturity labels remain accurate. Do not mutate or merge.