docs: expand ADRs 0001–0007 and rewrite buyer README

[seonghobae]

Documentation-only, stacked on #112 (fix/account-unification-lock-20260819) at prerequisite head f02acf93367a40dbfb23a73985017dca8d42ff39; this PR is evaluated relative to that base and intentionally contains no lockfile change.

What this is

• Rewrites README.md as a customer/operator page: what Keyverse is, how to run this repo alone, how an RP calls published OIDC/OAuth/SCIM contracts, and where ADRs and standards live.
• Removes the hourly OpenCode / bot-loop section and the “Generated with Claude Code” footer from the buyer README (those procedures stay in docs/operations/hourly-product-development.md).
• Expands the thin accepted ADRs 0001–0007 in place (same decisions, still Accepted) with Context / Decision / Consequences / APA 7th references.
• Adds docs/REFERENCES.md as the shared bibliography for those expansions.
• Does not edit ADR 0008. Does not create ADR 0009–0012 (owned by Add account-derived LineageWeave RP profile #100 / feat(authorization): hierarchical PDP, start-login helper, and PATs #103).

What this is not

• No runtime, realm, Helm, lockfile, workflow, CODEOWNERS, Semgrep, or security-gate change.
• No merge, approve, or review-comment deliverable.
• Citations are draft until an independent researcher re-verifies the opened official URLs/DOIs.

Product cuts recorded

• Keyverse is the CWL identity leaf/hub and boots from this repo’s Compose/Helm.
• naruon and gyeot may call this leaf; sibling checkouts are not required.
• Orgmetra owns employment/org-tree truth; Keyverse does not copy those tables.
• Authorized identity data stays usable under purpose-bound access control, encryption, and audit. No masking prescription.

OAuth 2.1 note

OAuth 2.1 was opened as IETF Internet-Draft draft-ietf-oauth-v2-1-15 (work in progress) and is not cited as a final RFC. Official records used are RFC 6749, RFC 8252, RFC 7636, and RFC 9700.

  

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4453b038-e6ae-448d-8b2a-33c757ad1239

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head fix pushed: 01b6dc73f55680d6980e249bcf9dfd71945542f7.

The exact-head CI failure was uv sync --locked rejecting the stale account-unification lockfile before docs tests ran. Cherry-picked the validated #112 lockfile resynchronization commit; no runtime behavior changed.

Local verification at this exact tree: locked dependency sync and the complete account-unification pytest suite passed; git diff check passed.

@opencode-agent please independently review this exact head and revalidate all terminal Checks. Do not self-approve, merge, or enable auto-merge.

[seonghobae]

Validation update for exact head 0353001:

• PR is now ready for review and remains intentionally stacked on build(account-unification): resync uv lockfile #112 at base fix/account-unification-lock-20260819.
• The net PR diff contains no services/account_unification/uv.lock change; the lockfile is inherited from build(account-unification): resync uv lockfile #112.
• Stacked merge-overlay checks passed: git diff --check, uv lock --check in services/account_unification, and all 21 distinct reference URLs returned HTTP 200.
• Review-only scheduler dispatch sent with auto-merge, branch updates, and merge disabled. No approval or merge is being inferred from queued Checks.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Current-head review request: Please obtain an independent current-head review on exact SHA 0353001438efb060b85373c121f4d54dfd48e8c8; one hosted Check remains pending and reviewDecision is REVIEW_REQUIRED. Exact SHA: 0353001438efb060b85373c121f4d54dfd48e8c8.

[seonghobae]

Review only exact current HEAD 0353001438efb060b85373c121f4d54dfd48e8c8 against fix/account-unification-lock-20260819@f02acf93367a40dbfb23a73985017dca8d42ff39. Re-evaluate the ADR/README documentation scope, buyer-facing claims, and inherited lockfile/security contracts. Do not modify or merge.

[seonghobae]

Review only exact current HEAD 7da9d43087d5647fefb946eb154ee1e5c10c576d against base fix/account-unification-lock-20260819@f02acf93367a40dbfb23a73985017dca8d42ff39. The normal branch update now includes the lock-refresh base; re-evaluate the ADR/README documentation claims and inherited lockfile/security contracts. Do not modify or merge.