docs: retire stale canonical owner claims

[seonghobae]

Summary

• add executable documentation contracts that reject closed PR docs: establish canonical product and trust-boundary documentation #71 as an active owner
• record canonical documentation and credential/security coverage as protected-main truth
• document the protected delegated GitHub credential capability-file boundary so scripts do not receive maintainer credentials through ambient GH_TOKEN
• keep issue security(automation): reconcile maintainer credential source with KV-only script policy #111 fail-closed: the hardened capability-file implementation is recorded, but this PR does not authorize an exception to the repository's KV-only credential-source policy
• remove the obsolete claim that issue quality(coverage): remove broad V8 ignore from credential-exchange security core #84 remains open

Security boundary

Protected main already writes the short-lived Maintainer App token to an owner-only capability file and passes only NOEMA_MAINTAINER_TOKEN_PATH to credential-bearing scripts. The helper rejects symlinks, non-regular files, owner mismatch, modes other than 0600, file-identity races, oversized/invalid token material, and constructs a minimal child environment. This PR makes canonical PRD/traceability/gap audit match that protected implementation without equating a plaintext capability file to a governed KV/credential registry.

Issue #111 remains open because AGENTS.md still requires real script secrets to originate from KV/credential registry. An authorized governance decision must choose a real registry, a narrowly scoped Actions credential exception, or another reviewed registry design; automation does not make that decision here.

TDD / repair lineage

The documentation contract was committed before the documentation repair. Exact-head application CI at 76dd5f0250bcbe7394fe28127e264e78a7eae515 exposed two stale predecessor assertions in existing documentation tests: one still required closed PR #71 as an active owner, and one required literal historical PR #413/PR #415 integration wording. Those tests were repaired to assert protected semantic truth rather than obsolete PR-number prose. A follow-up contract prevents capability-file hardening from silently closing issue #111.

Current exact head: 55ae86b2bbaa2c44c893b8a3deb122ac67fd91e9. Only this head's own terminal CI/reviewer/Security evidence may qualify it.

Ownership

Noema-only documentation/test lane. It does not mutate central .github, naruon, contextual-orchestrator, or other dedicated-writer repositories.

Summary by CodeRabbit

• 문서

  • 보호된 메인 브랜치 기준으로 아키텍처, 운영, 준비성 및 추적성 문서를 최신화했습니다.
  • 위임된 GitHub 자격 증명 파일의 보안 요구사항과 관련 정책의 미해결 상태를 명확히 했습니다.
  • 문서 감사, 소유권, 커버리지 및 거버넌스 기준을 현재 상태에 맞게 정리했습니다.

• 테스트

  • 최신 문서 통합 상태와 활성 작업 소유자를 검증하도록 문서 관련 테스트를 업데이트했습니다.
  • 자격 증명 파일 권한, 심볼릭 링크, 환경 토큰 조건 및 보호된 문서 기준 검증을 강화했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6e7a4cb3-dd9d-4650-ba96-d0ca3e8f9318

📥 Commits

Reviewing files that changed from the base of the PR and between 38d2b2d and d9c17db.

📒 Files selected for processing (6)

• docs/DOCUMENTATION_GAP_AUDIT.md
• docs/PRD.md
• docs/TRACEABILITY.md
• test/architecture-documentation.test.ts
• test/documentation-active-work-contract.test.ts
• test/documentation-architecture-contract.test.ts

---

📝 Walkthrough

Walkthrough

보호된 main 기준으로 문서 상태, 소유권, 커버리지 불변조건을 갱신했습니다. Delegated GitHub credential의 capability file 정책과 Issue 111의 미해결 상태를 기록했습니다. 관련 문서 계약 테스트도 현재 기준에 맞게 수정했습니다.

Changes

문서 기준 및 계약 갱신

Layer / File(s)	Summary
Canonical 문서 상태 갱신 docs/DOCUMENTATION_GAP_AUDIT.md, docs/PRD.md, docs/TRACEABILITY.md	보호된 main 기준의 문서 상태, 소유권, Issue 84, 커버리지 불변조건, 추적성 정보를 갱신했습니다.
Delegated credential 정책 추적 docs/PRD.md, docs/TRACEABILITY.md	Capability file 전달, 파일 보안 검증, ambient token 거부, KV-only 정책의 미해결 상태를 문서화했습니다.
문서 계약 테스트 갱신 test/architecture-documentation.test.ts, test/documentation-active-work-contract.test.ts, test/documentation-architecture-contract.test.ts	현재 문서 소유자와 protected-main 문구를 검증하고, 과거 소유권 문구 및 안전하지 않은 credential 전달 조건을 검증 대상에서 제외하거나 부재 조건으로 변경했습니다.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• ContextualWisdomLab/noema#343: Delegated GitHub credential capability-file 동작을 도입한 변경과 직접 연결됩니다.
• ContextualWisdomLab/noema#394: NOEMA_MAINTAINER_TOKEN_PATH와 ambient token 거부 정책을 함께 다룹니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/current-owner-traceability

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.