docs(adr): cite NIST, SARIF, and SLSA for accepted decisions

[seonghobae]

Draft only. Do not merge. Do not mark Ready.

Branched from current develop (57f6cbd), not stacked on open product PRs (including #977, #1006, #939, #1000, #930, #1020–#1030, Bolt/Palette PRs, or any other open PR).

Docs only. No Python, tests, scanner, Dockerfile, pyproject, workflow, .github/, CODEOWNERS, Semgrep, or default-branch setting changes. Existing ADR decision text, Accepted status, and dates are unchanged. No Buyer wording. No invented product behavior, papers, detector methods, autofix transforms, or control-plane APIs. Independent leaf: no runtime dependencies on naruon, gyeot, or other CWL services.

What changed

• Added an APA 7th References section to accepted ADRs 0001–0006 with only the mapped locators below.
• One-line note on the ADR index that 0001–0006 now carry APA locators.
• One Unreleased changelog line under a docs heading.
• One README sentence pointing to docs/adr/ (previously missing).

Citation mapping (decisions unchanged)

ADR	Grounding sources
0001 executable detector truth	NIST SP 800-115 (testing produces evidence from actual execution); NIST SP 800-53A Rev. 5 (assessment methods distinguish Test from Examine; a catalog/registry statement is not a test result)
0002 prevention versus detection	NIST SP 800-218 SSDF v1.1 (producing well-secured software / prevention practices are separate from verify/review/test practices)
0003 external engine provenance	OASIS SARIF 2.1.0 (tool.driver, invocations, and results preserve the producing tool identity; do not claim external engines as the built-in matcher)
0004 tenant and outbound boundaries	NIST SP 800-207 Zero Trust Architecture (never trust untrusted request identity strings; authorize destinations explicitly); OWASP SSRF Prevention Cheat Sheet (stored destinations must be validated and rechecked because DNS/redirects can change)
0005 remediation authority	NIST SP 800-218 SSDF v1.1 PW.7/PW.8 (review and test before release; do not auto-apply behavior-changing patches). Same SSDF locator as 0002
0006 automation authority	SLSA v1.2 Source Track (authoring/review/source-management threats; independent review and separate credentials). Does not claim a SLSA level

Verified locators (live-checked 2026-08-25)

Source	Locator	Live-check
Scarfone, K. A., Souppaya, M. P., Cody, A., & Orebaugh, A. D. (2008). Technical guide to information security testing and assessment (NIST SP 800-115). National Institute of Standards and Technology.	https://doi.org/10.6028/NIST.SP.800-115	Crossref MATCH (K A Scarfone, M P Souppaya, A Cody, A D Orebaugh; 2008). DOI → nvlpubs PDF HTTP 200.
Joint Task Force. (2022). Assessing security and privacy controls in information systems and organizations (NIST SP 800-53A Rev. 5). National Institute of Standards and Technology.	https://doi.org/10.6028/NIST.SP.800-53Ar5	Crossref MATCH (Joint Task Force; 2022-01-25). DOI → nvlpubs PDF HTTP 200.
Souppaya, M., Scarfone, K., & Dodson, D. (2022). Secure Software Development Framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities (NIST SP 800-218). National Institute of Standards and Technology.	https://doi.org/10.6028/NIST.SP.800-218	Crossref MATCH (Murugiah Souppaya, Karen Scarfone, Donna Dodson; 2022-02-03). DOI → nvlpubs PDF HTTP 200.
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST SP 800-207). National Institute of Standards and Technology.	https://csrc.nist.gov/pubs/sp/800/207/final	Crossref MATCH for 10.6028/NIST.SP.800-207 (Scott Rose, Oliver Borchert, Stu Mitchell, Sean Connelly; 2020-08-11) but nvlpubs PDF HTTP 404. CSRC HTML HTTP 200. Cite the CSRC URL, not the dead PDF.
OASIS Open. (2020). Static Analysis Results Interchange Format (SARIF) Version 2.1.0. OASIS.	https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html	HTTP 200.
SLSA Community. (2025). Supply-chain Levels for Software Artifacts specification (Version 1.2).	https://slsa.dev/spec/v1.2/	HTTP 200.
OWASP Foundation. (n.d.). Server-Side Request Forgery Prevention Cheat Sheet. OWASP Cheat Sheet Series. Retrieved August 25, 2026, from https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html	same URL	HTTP 200.

Not cited: NIST SP 800-53 Rev. 5 DOI (nvlpubs PDF 404), drafts, unmerged PRs, cancelled OpenCode/Strix scans, invented papers.

Leave this pull request as GitHub Draft. Do not merge. Do not mark Ready.

  

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}