docs(adr): expand 0001–0008 with verified APA 7th citations

[seonghobae]

Documentation-only ADR expansion against live main. Unstacked. Not based on #100, #103, #112, or closed #104.

Status: Draft. Not Ready. Not to merge. Do not APPROVE.

Files changed

• docs/adr/0001-keycloak-hub.md
• docs/adr/0002-passwordless-local-accounts.md
• docs/adr/0003-identity-matching.md
• docs/adr/0004-desired-state-reconciliation.md
• docs/adr/0005-secret-ownership.md
• docs/adr/0006-user-operation-lock.md
• docs/adr/0007-automation-authority.md
• docs/adr/0008-keyverse-rp-authorization-boundary.md
• docs/adr/README.md
• CHANGELOG.md

No product code, tests, workflows, CODEOWNERS, Semgrep, package runtime, or README rewrite.

What changed

Live-main ADRs 0001–0005 and 0007 were short decision paragraphs. 0006 and 0008 already had Context/Decision/Consequences. This PR keeps each existing Decision intent and adds Context, Consequences, and APA 7th References.

Closed #104 merged only onto the #112 product branch, not main. This work was written from the live default-branch text.

Verified sources (official record opened 2026-08-24)

Source	Official record
RFC 6749 OAuth 2.0	https://doi.org/10.17487/RFC6749
RFC 6750 Bearer token	https://www.rfc-editor.org/rfc/rfc6750.txt
RFC 7519 JWT	https://doi.org/10.17487/RFC7519
RFC 7643 SCIM Core	https://doi.org/10.17487/RFC7643
RFC 7644 SCIM Protocol	https://www.rfc-editor.org/info/rfc7644
RFC 4514 LDAP DN	https://www.rfc-editor.org/info/rfc4514
RFC 8725 JWT BCP	https://www.rfc-editor.org/rfc/rfc8725.txt
RFC 9068 JWT access-token profile	https://www.rfc-editor.org/rfc/rfc9068.txt
RFC 9700 OAuth 2.0 security BCP	https://www.rfc-editor.org/info/rfc9700
OpenID Connect Core 1.0 errata set 2	https://openid.net/specs/openid-connect-core-1_0.html
NIST SP 800-63B-4 (final, July 2025)	https://doi.org/10.6028/NIST.SP.800-63B-4
NIST SP 800-63C-4 (final, July 2025)	https://doi.org/10.6028/NIST.SP.800-63C-4
NIST SP 800-218 SSDF 1.1	https://doi.org/10.6028/NIST.SP.800-218
SAML 2.0 core (OASIS Standard)	https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
W3C WebAuthn Level 2	https://www.w3.org/TR/webauthn-2/
Keycloak Server Administration Guide	https://www.keycloak.org/docs/latest/server_admin/
SLSA specification v1.2	https://slsa.dev/spec/v1.2/

The 2017 NIST SP 800-63B catalog record is withdrawn and superseded; ADRs cite the July 2025 finals. Citations are standards evidence, not conformance claims. No invented papers. No cancelled OpenCode/Strix bibliographic entries.

Local check

Root documentation-contract tests passed (test_adr_index_contains_governing_identity_decisions and the other four existing contract tests). Hosted Checks are not treated as merge permission.

Out of scope

• Product, test, workflow, or lockfile changes
• README rewrite (current README is already customer/operator facing)
• Merge, Ready-for-review, or approval

  

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}