docs: full-repository quality report (code, security posture, tests, documentation, peripherals)

[cuioss-oliver]

Summary

Adds a full-repository quality review under doc/quality-report/ — documentation only, no production code, tests, or existing docs were changed.

The review covers, per the request that initiated it:

• Code correctness & edge cases — every production file in config/asset/auth/events, bff, and the data plane (edge/pipeline/routing/tls/forward/http/quarkus) read in full; findings CFG-*, BFF-*, DP-*
• Security posture, claimed vs. implemented — 35-row claims-verification table against the threat model, ADRs, and user docs; fail-closed audit; findings SEC-*
• Test quality — real-content vs. coverage-theater assessment, generator usage, positive/negative coverage, against the project's own testing doctrine; findings TST-*
• Documentation — AsciiDoc tree (link check: 751 references, 0 broken) and Javadoc compliance; findings DOC-*
• Build & peripherals — demo-client, benchmarks, scripts, Docker/compose, CI workflows, POMs; findings PER-*

Every finding carries severity, confidence, file:line evidence, and category. All 98 numbered findings were then re-verified end-to-end by an independent adversarial verification pass started with a clean context and instructed to refute them: 93 confirmed as written, 5 confirmed with detail adjustments (corrected in place), 0 refuted.

Headline results

• No critical finding, no exploitable auth/routing bypass, no fail-open security path, no crypto misuse, no secret leakage. The claimed fail-closed posture is real at every enforcement point traced.
• Top finding (CFG-1, HIGH): TokenValidatorProducer makes token_validation effectively mandatory at boot, contradicting the schema, ConfigValidator, AuthenticationStage Javadoc, and the readiness check — with GatewayReadinessCheck's own comment showing the eager side is the recorded intent and the other three contracts are stale.
• Top doc finding (DOC-1, HIGH): architecture.adoc's "Implementation Deviations" still claims data-plane structured logging is unimplemented; it shipped across ≥10 classes.
• Notable MEDIUMs: session-WebSocket CSWSH gap (doc-admitted), parsed-but-inert resilience keys vs ADR-0008, missing RFC 7230 Connection-nominated header stripping, duplicate-YAML-key silent last-win, dead BFF security LogRecords, SecurityHeadersStage test/activation gap, CLAUDE.md version/module drift, IT stack publishing admin surfaces on 0.0.0.0.

Changes

• doc/quality-report/README.adoc — index, methodology, severity conventions, executive summary
• doc/quality-report/code-correctness.adoc — 48 findings + verified positives
• doc/quality-report/security-posture.adoc — claims table + 12 findings
• doc/quality-report/test-quality.adoc — 13 findings + coverage map
• doc/quality-report/documentation.adoc — 13 findings + Javadoc compliance
• doc/quality-report/build-and-peripherals.adoc — 13 findings + verified positives

Per CLAUDE.md, this is a documentation-only change (all files *.adoc under doc/), so the Maven pre-commit gate is skipped.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YZNZwvaQ54tR6hnErQnbkN

---

Generated by Claude Code

Summary by CodeRabbit

• Documentation
  • Added a repository quality report with executive findings, review methodology, verification results, and severity conventions.
  • Added reports covering build and deployment assets, code correctness, documentation quality, security posture, and test quality.
  • Documented prioritized findings involving configuration, authentication, WebSocket security, headers, session handling, HTTP behavior, observability, credentials, CI settings, and test coverage.
  • Recorded verified strengths and recommended follow-up checks across security, build, documentation, and testing areas.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Warning

Review limit reached

@cuioss-oliver, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 53 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository: cuioss/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a7913aea-5765-493d-9e5f-020e4f8b8943

📥 Commits

Reviewing files that changed from the base of the PR and between c86fffc and 90cf70a.

📒 Files selected for processing (2)

• doc/quality-report/README.adoc
• doc/quality-report/code-correctness.adoc

📝 Walkthrough

Walkthrough

Added six AsciiDoc quality reports under doc/quality-report/. The reports cover review scope, code correctness, security posture, tests, documentation, build peripherals, verified controls, and prioritized findings.

Changes

Repository quality report

Layer / File(s)	Summary
Report index and conventions doc/quality-report/README.adoc	Added report scope, provenance, review domains, linked subreports, severity and confidence definitions, an executive verdict, and prioritized findings.
Code correctness findings doc/quality-report/code-correctness.adoc	Documented configuration, BFF, session, HTTP, WebSocket, TLS, resilience, routing, and data-plane findings with verified positive controls.
Security posture and build peripherals doc/quality-report/security-posture.adoc, doc/quality-report/build-and-peripherals.adoc	Compared security claims with implementation evidence and documented integration, workflow, deployment, credential, and repository hygiene findings.
Test and documentation assessment doc/quality-report/test-quality.adoc, doc/quality-report/documentation.adoc	Added test coverage findings, prioritized assertions, documentation findings, structural assessment, and Javadoc compliance results.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🟡 Moderate · up to c86ff

The report currently contains conflicting finding counts and summaries, an overstated documentation assessment, security conclusions that lack repository-level evidence, and an ambiguous test-coverage claim. Publishing it unchanged could mislead maintainers about the project’s actual quality and security posture, so these documentation issues should be resolved before merge.

Possibly related PRs

• cuioss/API-Sheriff#71: Covers security, documentation, testing, WebSocket, and Docker Compose issues also assessed by these reports.
• cuioss/API-Sheriff#154: Covers ConfigLoader, readiness handling, and asset/security behavior assessed by the code-correctness report.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the documentation-only full-repository quality report and its covered areas.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider adding a short note in README.adoc on how and when this quality report should be updated (e.g., after major architectural or security changes) so it doesn’t silently drift from reality.
• It may help to cross-reference the numbered findings (CFG-, SEC-, etc.) to existing or planned tracking items (e.g., ADRs or issue IDs) directly in the report so readers can see the remediation path from within the documentation.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider adding a short note in README.adoc on how and when this quality report should be updated (e.g., after major architectural or security changes) so it doesn’t silently drift from reality.
- It may help to cross-reference the numbered findings (CFG-*, SEC-*, etc.) to existing or planned tracking items (e.g., ADRs or issue IDs) directly in the report so readers can see the remediation path from within the documentation.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[cuioss-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[cuioss-oliver]

Re: Sourcery's high-level feedback:

1. Update/currency note — implemented in 1e4b107: README.adoc now carries a "Currency" section stating the report is a point-in-time snapshot at commit b54eb12, to be re-run or retired after major architectural or security-relevant changes.
2. Cross-referencing findings to tracking items — partially in place: findings that relate to recorded decisions already cite the governing ADR inline (e.g. CFG-4/SEC-1 → ADR-0015, DP-2 → ADR-0008), and the same commit designates the finding IDs as stable handles for triage. Linking to issue IDs is deferred until the findings are actually triaged into issues — creating those is beyond this documentation-only PR.

---

Generated by Claude Code

[coderabbitai]

Actionable comments posted: 3

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: cuioss/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b5e5757e-b159-4ec8-991b-fc7b061c6c9e

📥 Commits

Reviewing files that changed from the base of the PR and between b54eb12 and c86fffc.

📒 Files selected for processing (6)

• doc/quality-report/README.adoc
• doc/quality-report/build-and-peripherals.adoc
• doc/quality-report/code-correctness.adoc
• doc/quality-report/documentation.adoc
• doc/quality-report/security-posture.adoc
• doc/quality-report/test-quality.adoc