ci: expand CodeQL coverage and tighten repo guardrails

[seonghobae]

Summary

• expand CodeQL coverage to scan both Python and GitHub Actions while adding repository CODEOWNERS coverage
• document protected-branch review gates and embed verified local /docs and /redoc screenshots in the Korean manual
• keep the direct fuzzer smoke entrypoint working when invoked as a script and add regression tests for the new governance/docs expectations

Verification

• uv run pytest tests/test_fuzzing_integration.py::test_dom_builder_fuzzer_smoke_mode_runs_without_cluster -q
• uv run pytest tests/test_repository_governance.py -q
• uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing --cov-fail-under=100
• lint_by_filetype (markdownlint/black/ruff clean; repo-wide mypy remains pre-existing and outside this change)

Summary by CodeRabbit

릴리스 노트

• 문서

  • 시작 가이드의 실행 명령 앱 디렉터리 지정으로 수정
  • 로컬 검증한 API 콘솔 스크린샷 저장·참조 절차 추가
  • 개발·보안 게이트(브랜치 보호, 승인·필수 체크) 문서화 및 다양한 계획/정책 문서 대거 추가

• 테스트

  • 저장소 거버넌스·문서·워크플로우 일관성 검증 테스트 추가
  • 퍼징 통합 및 관련 테스트 확장

• 잡무(Chores)

  • 저장소 소유권 규정 추가
  • 코드스캔 범위에 액션스 포함으로 확장
  • 빌드/배포 워크플로우 트리거 및 입력 조정
  • 런타임 생성물 제외 패턴(.gitignore) 추가

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

저장소 거버넌스·CI·문서·퍼저 진입점 관련 변경: CODEOWNERS 추가·지정, CodeQL에 actions 추가, .gitignore 패턴 추가, 거버넌스 검증용 pytest 추가, 문서/매뉴얼·계획 파일 추가·수정, 퍼저 스크립트의 import/argv 처리 및 ClusterFuzzLite 입력 변경.

Changes

Cohort / File(s)	Summary
거버넌스 메타데이터 /.github/CODEOWNERS, /.gitignore, /.github/workflows/codeql.yml	전체(*) 및 .github/, docs/, manual/ 소유자 지정 추가; .gitignore에 site/, registered_agents.json, task_agent_mapping.json 추가; CodeQL initializer의 languages에 actions 포함 및 잡명 업데이트.
문서 및 계획 README.md, manual/api-reference.md, manual/development.md, manual/index.md, manual/installation.md, docs/plans/..., docs/adr/..., AGENTS.md, ARCHITECTURE.md, CONTRIBUTING.md, docs/...	Uvicorn 실행명령을 --app-dir src로 변경; API 콘솔 스크린샷 캡처·참조 문서 및 여러 엔지니어링/정책/운영 문서(계획·실행·검증·보안 체크리스트 등) 추가·수정; 보호된 브랜치·리뷰·CI 요구사항 문서화(2승인·CODEOWNERS 등).
퍼저 및 워크플로우 통합 fuzzers/dom_builder_fuzzer.py, .github/workflows/clusterfuzzlite.yml, .clusterfuzzlite/build.sh	퍼저가 <repo_root>/src를 sys.path에 삽입해 모듈 불러오기 변경; argparse를 parse_known_args로 전환해 추가 fuzz 인자 수집 및 Atheris에 전달되는 argv 조정; ClusterFuzzLite 빌드에 bad-build-check: false 입력 추가; 빌드 스크립트에서 null-terminated find/read 루프 사용으로 안전성 향상.
거버넌스·정합성 테스트 tests/test_repository_governance.py, tests/test_truth_source_alignment.py, tests/test_fuzzing_integration.py, tests/test_engineering_canonical_docs.py, tests/test_release_pipeline.py, tests/test_repository_*	새로운 검증 테스트 추가: CODEOWNERS 매핑, CodeQL에 actions 포함 검증, 매뉴얼 스크린샷 존재·PNG 서명 검사, 개발 문서 내 리뷰 게이트 문구 확인, .gitignore 패턴 검증, gh-pages 브랜치 트리거 검증, 퍼저 argv/atheris Setup 호출 검증, 릴리스 attestation 툴링 호출 변경 반영 등.
릴리스/스크립트 수정 scripts/release/export_release_attestations.py, tests/test_release_pipeline.py	gh 실행 파일 경로를 shutil.which로 해석하는 헬퍼 추가 및 호출을 resolved path로 교체; subprocess 호출에 cwd 사용; 테스트에서 경로·호출 시그니처에 맞춰 업데이트.
문서 인덱스·엔지니어링 가이드 docs/engineering/*, docs/agents/README.md, docs/coderabbit/review-commands.md	다수의 엔지니어링 정책·실행·검증·리뷰·데이터 정책 문서 추가로 레퍼런스·검증 절차와 규칙을 명시함.

Sequence Diagram(s)

(생략)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25분

Possibly related issues

• Resolve reviewer-capacity mismatch with protected-branch approval policy #36 — CODEOWNERS 추가 및 보호 브랜치/검토 요구사항 변경은 리뷰어-용량·브랜치 보호 이슈와 직접적으로 연관됨.

Possibly related PRs

• fix: harden workflow attestation and fuzz builder paths #39 — 퍼저 반복 처리(null-delim find/read) 및 릴리스 attestation 경로 해석 변경과 코드 수준으로 중복/연관됨.
• docs: add canonical engineering truth sources #38 — 대규모 문서/정책/테스트 추가(AGENTS.md, ARCHITECTURE.md, canonical docs 관련 테스트 등)와 중복 파일·검증 논리 공유.
• ci: close immediate in-repo OpenSSF Scorecard gaps #26 — 릴리스 attestation 툴링 및 gh CLI 해석 변경과 직접적인 코드 연관성 존재.

Suggested labels

github_actions

Poem

🐰 깡충, 저장소 길닦이 왔네,
문서랑 테스트에 당근 하나 얹네.
CODEOWNERS로 길잡이 세우고,
퍼저는 argv 정리해 숨 고르네.
스크린샷 반짝, 배포도 준비됐네 🥕✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 11.76% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	제목이 PR의 주요 변경사항을 명확하게 요약하고 있습니다: CodeQL 확대, CODEOWNERS 추가, 저장소 보안 강화.
Description check	✅ Passed	PR 설명이 주요 변경사항을 요약하고 있으며, Git Flow 대상 브랜치는 develop(올바름)이고, 구체적인 검증 명령어가 포함되어 있습니다.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/security-manual-hardening

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🧹 Nitpick comments (2)

docs/plans/2026-04-10-code-scanning-hardening-and-manual-screenshots.md (2)

3-4: 도구 종속 지시문은 계획 본문에서 분리하는 편이 좋습니다.

For Claude처럼 특정 도구/에이전트에 고정된 문구는 문서 재사용성과 협업 가독성을 떨어뜨립니다. 동일 내용을 체크리스트 형태의 중립 문구로 바꾸는 것을 권장합니다.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/plans/2026-04-10-code-scanning-hardening-and-manual-screenshots.md`
around lines 3 - 4, Replace the tool-specific directive "For Claude: REQUIRED
SUB-SKILL: Use superpowers:executing-plans" with a neutral, reusable checklist
entry; locate that exact phrase in the plan text and change it to a generic
instruction such as "Required sub-skill: executing plans (follow task-by-task
execution guidelines)" or a checklist item like "- Execute the plan
task-by-task" so the document is not tied to a specific agent and remains clear
for collaborators.

---

129-133: 규칙셋 ID 하드코딩은 재현성을 깨뜨릴 수 있습니다.

rulesets/14875805 고정값은 저장소/포크/환경 변경 시 쉽게 깨집니다 (lines 129, 142). 규칙셋 이름으로 ID를 먼저 조회한 뒤 후속 검증 명령에 주입하는 흐름으로 바꾸면 더 안전합니다.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/plans/2026-04-10-code-scanning-hardening-and-manual-screenshots.md`
around lines 129 - 133, 현재 하드코딩된 경로 "rulesets/14875805"을 사용하면 저장소나 포크 변경 시 재현성이
깨지므로, 먼저 ruleset 목록을 조회해 대상 규칙셋의 이름으로 ID를 조회한 뒤 후속 검증에 그 ID를 주입하도록 수정하세요; 예: 호출
흐름을 "gh api repos/:owner/:repo/rulesets"로 규칙셋 목록을 받아 규칙셋 이름으로 일치하는 항목의 id를 추출한 후
그 id를 사용해 "rulesets/<id>"를 조회하여 required_approving_review_count 및
require_code_owner_review 값을 검증하도록 변경(즉, "rulesets/14875805" 고정 문자열을 제거하고 이름→id
조회 후 재사용).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/test_repository_governance.py`:
- Around line 56-58: The current test reads gitignore_text and asserts patterns
exist via substring matching, which can falsely pass on commented lines; update
the test in tests/test_repository_governance.py to first split gitignore_text
into lines, filter out lines that are empty or start with '#' (trim leading
whitespace), and then check that each pattern from the tuple ("site/",
"registered_agents.json", "task_agent_mapping.json") appears in the resulting
non-comment lines list (or join of those lines) rather than raw gitignore_text;
reference the gitignore_text variable and the for-loop that iterates over
patterns to locate where to apply this change.
- Around line 19-22: The test currently does an exact string match against
workflow_text for "languages: python, actions" which is brittle; change it to
parse workflow_text with yaml.safe_load(), locate the CodeQL action's languages
value (from the loaded dict under the action's "with" or a top-level "languages"
key), normalize that value into a list (accept YAML lists or comma-separated
strings, trim whitespace and lowercase), and then assert that "python" and
"actions" are present in the resulting list instead of using the exact string
comparisons on workflow_text.
- Around line 7-15: The current rules parsing in
tests/test_repository_governance.py builds rules with tuple(line.split()) which
fails on lines with multiple owners (e.g., "* `@Seongho-Bae` `@team`"); change the
parsing so each rule is stored as (path, frozenset(owners)) by splitting the
line, taking the first token as the path and the rest as owner tokens, and
collecting owners into a set; then update the assertions to check that the
owners set for a given path contains "@Seongho-Bae" (or compare to an expected
frozenset) instead of exact tuple equality; adjust the variable rules and
assertions accordingly.

---

Nitpick comments:
In `@docs/plans/2026-04-10-code-scanning-hardening-and-manual-screenshots.md`:
- Around line 3-4: Replace the tool-specific directive "For Claude: REQUIRED
SUB-SKILL: Use superpowers:executing-plans" with a neutral, reusable checklist
entry; locate that exact phrase in the plan text and change it to a generic
instruction such as "Required sub-skill: executing plans (follow task-by-task
execution guidelines)" or a checklist item like "- Execute the plan
task-by-task" so the document is not tied to a specific agent and remains clear
for collaborators.
- Around line 129-133: 현재 하드코딩된 경로 "rulesets/14875805"을 사용하면 저장소나 포크 변경 시 재현성이
깨지므로, 먼저 ruleset 목록을 조회해 대상 규칙셋의 이름으로 ID를 조회한 뒤 후속 검증에 그 ID를 주입하도록 수정하세요; 예: 호출
흐름을 "gh api repos/:owner/:repo/rulesets"로 규칙셋 목록을 받아 규칙셋 이름으로 일치하는 항목의 id를 추출한 후
그 id를 사용해 "rulesets/<id>"를 조회하여 required_approving_review_count 및
require_code_owner_review 값을 검증하도록 변경(즉, "rulesets/14875805" 고정 문자열을 제거하고 이름→id
조회 후 재사용).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 868b7b06-ebed-40e5-b048-f7c85118ee8c

📥 Commits

Reviewing files that changed from the base of the PR and between a3edbce and a6c2db5.

⛔ Files ignored due to path filters (2)

• manual/assets/redoc.png is excluded by !**/*.png
• manual/assets/swagger-ui.png is excluded by !**/*.png

📒 Files selected for processing (10)

• .github/CODEOWNERS
• .github/workflows/codeql.yml
• .gitignore
• README.md
• docs/plans/2026-04-10-code-scanning-hardening-and-manual-screenshots.md
• fuzzers/dom_builder_fuzzer.py
• manual/api-reference.md
• manual/development.md
• manual/index.md
• tests/test_repository_governance.py

[seonghobae]

All required checks are green on this branch now. Merge is still blocked by the repository ruleset, which currently requires 2 approving reviews, CODEOWNERS review, and last-push approval on develop.

Fresh collaborator inventory currently shows only the author/admin account on this repository, so those non-author approvals are not satisfiable with the present reviewer roster unless additional reviewers are added or the policy is changed. Leaving this PR open as merge-ready-from-a-code/CI standpoint and treating reviewer capacity as the remaining external blocker.

[seonghobae]

Tracking the remaining merge blocker in #36. This PR is green on checks and code review state, but still cannot merge until the reviewer-capacity mismatch with the current 2-approval + CODEOWNERS ruleset is resolved.

[coderabbitai]

🧹 Nitpick comments (2)

docs/plans/2026-04-10-truth-source-alignment.md (1)

133-134: 커밋 단계에서 git add .는 오커밋 위험이 있습니다.

변경 범위를 명시적으로 지정하면 계획 재현성과 안전성이 높아집니다.

제안 diff

-git add .
+git add tests/test_truth_source_alignment.py \
+  manual/installation.md \
+  .github/workflows/gh-pages.yml \
+  docs/adr/0001-openssf-best-practices-badge.md \
+  docs/plans/2026-04-08-security-gates.md \
+  docs/plans/2026-04-08-security-gates-design.md
 git commit -m "docs: restore truth-source alignment for workflow and manual"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@docs/plans/2026-04-10-truth-source-alignment.md` around lines 133 - 134, The
commit step uses a risky blanket "git add ." which can accidentally include
unrelated changes; replace it with an explicit staging command (e.g., "git add
docs/plans/2026-04-10-truth-source-alignment.md" or the exact set of files
changed) or use "git add -p" to interactively stage hunks, then run "git commit
-m 'docs: restore truth-source alignment for workflow and manual'"; ensure the
script or documented workflow references the specific file names or patterns
instead of "git add .".

tests/test_truth_source_alignment.py (1)

13-19: integration 마커 탐색이 하위 테스트 디렉터리를 놓칠 수 있습니다.

glob("test_*.py")는 루트만 확인합니다. tests/** 구조를 대비해 재귀 탐색으로 바꾸는 편이 안전합니다.

제안 diff

-    for test_path in Path("tests").glob("test_*.py"):
+    for test_path in Path("tests").rglob("test_*.py"):

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/test_truth_source_alignment.py` around lines 13 - 19, The current test
discovery uses Path("tests").glob("test_*.py") which only lists top-level files
and can miss nested test files; change the search to a recursive pattern (e.g.,
Path("tests").rglob("test_*.py") or Path("tests").glob("**/test_*.py")) where
the loop over test_path (and the existing check comparing test_path.name to
Path(__file__).name) remains the same so integration marker detection
(INTEGRATION_MARK_RE.search(text)) covers subdirectories as well.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@docs/plans/2026-04-10-truth-source-alignment.md`:
- Around line 133-134: The commit step uses a risky blanket "git add ." which
can accidentally include unrelated changes; replace it with an explicit staging
command (e.g., "git add docs/plans/2026-04-10-truth-source-alignment.md" or the
exact set of files changed) or use "git add -p" to interactively stage hunks,
then run "git commit -m 'docs: restore truth-source alignment for workflow and
manual'"; ensure the script or documented workflow references the specific file
names or patterns instead of "git add .".

In `@tests/test_truth_source_alignment.py`:
- Around line 13-19: The current test discovery uses
Path("tests").glob("test_*.py") which only lists top-level files and can miss
nested test files; change the search to a recursive pattern (e.g.,
Path("tests").rglob("test_*.py") or Path("tests").glob("**/test_*.py")) where
the loop over test_path (and the existing check comparing test_path.name to
Path(__file__).name) remains the same so integration marker detection
(INTEGRATION_MARK_RE.search(text)) covers subdirectories as well.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 65eb6e1d-bae3-4202-99c3-2cb1226dbed3

📥 Commits

Reviewing files that changed from the base of the PR and between bb1cb40 and a9d0ebb.

📒 Files selected for processing (8)

• .github/workflows/gh-pages.yml
• docs/adr/0001-openssf-best-practices-badge.md
• docs/plans/2026-04-08-security-gates-design.md
• docs/plans/2026-04-08-security-gates.md
• docs/plans/2026-04-10-truth-source-alignment-design.md
• docs/plans/2026-04-10-truth-source-alignment.md
• manual/installation.md
• tests/test_truth_source_alignment.py

💤 Files with no reviewable changes (1)

• .github/workflows/gh-pages.yml

✅ Files skipped from review due to trivial changes (3)

• docs/plans/2026-04-08-security-gates.md
• docs/plans/2026-04-10-truth-source-alignment-design.md
• docs/adr/0001-openssf-best-practices-badge.md

[seonghobae]

Opened stacked follow-up PRs while #36 remains the merge blocker on this branch:

• docs: add canonical engineering truth sources #38 docs: add canonical engineering truth sources
• fix: harden workflow attestation and fuzz builder paths #39 fix: harden workflow attestation and fuzz builder paths

Both are repo-local follow-ups on top of chore/security-manual-hardening so review/CI work can continue without changing the current reviewer-capacity blocker assessment for #35.

[seonghobae]

Stacked follow-up PRs #38 and #39 have now merged into chore/security-manual-hardening, so PR #35 is carrying the canonical engineering docs plus workflow-robustness fixes on the parent branch. Checks may rerun from the updated head, but the remaining blocker assessment is unchanged: reviewer capacity still comes from #36, not from code/CI state.

[seonghobae]

Fresh parent-branch verification after folding in PR #38 and #39:

• uv run pytest --cov=src/newsdom_api --cov-branch --cov-report=term-missing --cov-fail-under=100 ✅ (126 passed, 100% coverage)
• uv run mkdocs build --strict ✅
• targeted markdownlint-cli2 on the new canonical docs set ✅

The MkDocs build now emits a future-toolchain warning from Material for MkDocs about MkDocs 2.0 compatibility. That warning is tracked separately in #40 and is not the current merge blocker for this branch.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

🧹 Nitpick comments (2)

tests/test_engineering_canonical_docs.py (1)

72-82: 대소문자 민감 매칭은 문서 편집만으로 테스트가 깨질 수 있어 완화하면 더 안정적입니다.

Line 73에서 text.lower()로 정규화한 뒤 기대값도 소문자로 비교하면 불필요한 flaky 실패를 줄일 수 있습니다.

🔧 제안 패치

 def test_runtime_data_policy_protects_private_inputs() -> None:
-    text = Path("docs/engineering/runtime-data-policy.md").read_text(encoding="utf-8")
+    text = Path("docs/engineering/runtime-data-policy.md").read_text(
+        encoding="utf-8"
+    ).lower()
     for expected in (
         "synthetic fixtures",
         "private reference",
         "tmp/",
         "logs",
         "do not commit secrets",
     ):
         assert expected in text

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/test_engineering_canonical_docs.py` around lines 72 - 82, The test
test_runtime_data_policy_protects_private_inputs currently does case-sensitive
substring checks against the file content; normalize the file content by calling
text.lower() and compare against lowercased expected strings (e.g., map each
expected to expected.lower()) before asserting membership so the assertions
become case-insensitive and less flaky.

scripts/release/export_release_attestations.py (1)

48-52: 외부 CLI 호출에 타임아웃을 넣어 릴리스 잡 무한 대기를 방지해 주세요.

Line 48의 subprocess.run은 네트워크/CLI 상태에 따라 멈출 수 있어, CI가 장시간 블로킹될 수 있습니다. 타임아웃을 명시하는 편이 안전합니다.

⏱️ 제안 패치

         subprocess.run(
             [gh_executable, "attestation", "download", str(artifact_path), "-R", repo],
             check=True,
             cwd=working_dir,
+            timeout=120,
         )

(이 변경을 적용하면 tests/test_release_pipeline.py의 fake_run 시그니처/기대값에도 timeout 반영이 필요합니다.)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/release/export_release_attestations.py` around lines 48 - 52, The
subprocess.run call in scripts/release/export_release_attestations.py should
include a timeout to avoid CI hanging; add a sensible timeout (e.g.,
timeout=300) to the subprocess.run invocation that runs [gh_executable,
"attestation", "download", ...] and propagate this change to tests by updating
tests/test_release_pipeline.py's fake_run signature/expectation to accept the
timeout kwarg (or assert on timeout value) so the unit test matches the real
call.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@scripts/release/export_release_attestations.py`:
- Around line 48-52: The subprocess.run call in
scripts/release/export_release_attestations.py should include a timeout to avoid
CI hanging; add a sensible timeout (e.g., timeout=300) to the subprocess.run
invocation that runs [gh_executable, "attestation", "download", ...] and
propagate this change to tests by updating tests/test_release_pipeline.py's
fake_run signature/expectation to accept the timeout kwarg (or assert on timeout
value) so the unit test matches the real call.

In `@tests/test_engineering_canonical_docs.py`:
- Around line 72-82: The test test_runtime_data_policy_protects_private_inputs
currently does case-sensitive substring checks against the file content;
normalize the file content by calling text.lower() and compare against
lowercased expected strings (e.g., map each expected to expected.lower()) before
asserting membership so the assertions become case-insensitive and less flaky.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2411f28d-f9db-42de-8ce5-aaa975d66aa7

📥 Commits

Reviewing files that changed from the base of the PR and between a9d0ebb and 737696b.

📒 Files selected for processing (21)

• .clusterfuzzlite/build.sh
• AGENTS.md
• ARCHITECTURE.md
• CONTRIBUTING.md
• docs/agents/README.md
• docs/coderabbit/review-commands.md
• docs/engineering/acceptance-criteria.md
• docs/engineering/canonical-docs.md
• docs/engineering/execution-policy.md
• docs/engineering/harness-engineering.md
• docs/engineering/review-policy.md
• docs/engineering/runtime-data-policy.md
• docs/engineering/skills-subagents-mcp.md
• docs/operations/deploy-runbook.md
• docs/security/api-security-checklist.md
• docs/workflow/one-day-delivery-plan.md
• docs/workflow/pr-continuity.md
• scripts/release/export_release_attestations.py
• tests/test_engineering_canonical_docs.py
• tests/test_fuzzing_integration.py
• tests/test_release_pipeline.py

✅ Files skipped from review due to trivial changes (16)

• docs/agents/README.md
• docs/coderabbit/review-commands.md
• CONTRIBUTING.md
• docs/engineering/review-policy.md
• docs/engineering/acceptance-criteria.md
• docs/engineering/runtime-data-policy.md
• AGENTS.md
• docs/engineering/canonical-docs.md
• docs/workflow/pr-continuity.md
• ARCHITECTURE.md
• docs/engineering/execution-policy.md
• docs/engineering/skills-subagents-mcp.md
• docs/operations/deploy-runbook.md
• docs/engineering/harness-engineering.md
• docs/security/api-security-checklist.md
• docs/workflow/one-day-delivery-plan.md

🚧 Files skipped from review as they are similar to previous changes (1)

• tests/test_fuzzing_integration.py

[seonghobae]

Stacked follow-up PR #42 has now merged into chore/security-manual-hardening, so PR #35 also carries the markdownlint scope policy and docs/workflow/git-flow.md lint cleanup on the parent branch. The remaining blocker is still #36 reviewer capacity, not repository-local verification work.

[seonghobae]

Stacked follow-up PR #43 has now merged into chore/security-manual-hardening, so PR #35 also carries the documented MkDocs 1.x / Material <9.7 hold and the new docs-toolchain regression coverage. The upstream warning itself still exists, but the repository-local policy and evidence requested in #40 are now in place.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Reopened #40 and #41 so repository-wide tracking matches the current reality: both fixes exist on this blocked branch, but neither has landed on the default develop branch yet. They should close again when PR #35 (or an equivalent develop-targeted path) merges.