docs(adr): APA 7th references for LifeOS ADRs 0001–0003

[seonghobae]

Documentation-only citation work on accepted ADRs. Branched from current main (f8559bf3). Not stacked on #145, #211, or any feature PR. Does not rewrite README.md or ARCHITECTURE.md. Does not change product rules.

What changed

• ADR 0001: Added APA 7th References. Decision remains UUIDv4 (not UUIDv7), opaque non-numeric IDs, and IDs as locators rather than authorization evidence.
• ADR 0002: Converted the informal Standards basis list into APA 7th References. Product rules are unchanged (hashed state, PKCE S256, 10-minute expiry, HTTPS redirect except loopback, HttpOnly/Secure/SameSite, hashed session tokens, UUIDv4 session PKs).
• ADR 0003: Citation correction only. orchestration_mode: auto is unchanged. Fugu author form is now Sakana AI (2026) per the live arXiv abs citation note. Both papers remain marked preprint/technical-report.
• docs/adr/README.md: Index of accepted ADRs 0001–0003.
• CHANGELOG.md: Short Unreleased note.

No existing doc-consistency or citation test was found, so none was added. .github, CODEOWNERS, Semgrep, product services, ARCHITECTURE.md, and README.md were not touched.

Verified locators (2026-08-25)

Source	Locator	Live check
RFC 9562	https://doi.org/10.17487/RFC9562	302 → rfc-editor info
OWASP A01:2021	https://owasp.org/Top10/2021/A01_2021-Broken_Access_Control/index.html	200; names IDOR via unique identifier
OWASP IDOR	https://owasp.org/www-community/attacks/insecure_direct_object_reference	200; sequential IDs leak count/order; UUIDv4 as defense in depth
RFC 7636	https://doi.org/10.17487/RFC7636	302 → rfc-editor info; PKCE S256
RFC 9700 / BCP 240	https://doi.org/10.17487/RFC9700	302 → rfc-editor info; PKCE, exact redirect, HTTPS except loopback, mix-up
GitHub OAuth docs	https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps	200; authorization-code flow
Omidvar & Akhlaghi (2026)	https://doi.org/10.48550/arXiv.2605.09121	302 → arXiv abs; preprint
Sakana Fugu (2026)	https://doi.org/10.48550/arXiv.2606.21228	302 → arXiv abs; cite as “Sakana AI (2026)”; technical report / preprint

Intentionally omitted

• RFC 4122: Obsolete; RFC 9562 is the current UUID specification and defines UUIDv4 as random.
• RFC 6749: The ADR’s hardening rules are specified by RFC 7636 and RFC 9700 (which updates RFC 6749). The decision does not uniquely depend on the 2012 framework text.
• NIST SP 800-63B: No verified section matches hashed session-token persistence or PKCE. PKCE appears in SP 800-63C federation examples, not 63B.

Draft only. Do not merge or mark Ready from this PR.

  

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}