docs(adr): close ADR-0003/0005 housekeeping; add security-review ADRs 0008-0011

docs/adr/ADR-0003-spaces-dev-mode.md

@@ -1,6 +1,6 @@
 # ADR-0003: Spaces Dev Mode for Iterative Development
 
-**Status:** Accepted — decision adopted. **Dev Mode enabled on both dev Spaces** (`Paper2Agent_decoupleRpy_dev`, `pdac-analysis-orchestrator-dev`), confirmed 2026-06-24. Remaining action items (DEPLOYMENT.md inner-loop note; VS Code/SSH config) still open. Reconciled 2026-06-24.
+**Status:** Accepted — **CLOSED 2026-07-01.** Dev Mode enabled on both dev Spaces (`Paper2Agent_decoupleRpy_dev`, `pdac-analysis-orchestrator-dev`, confirmed 2026-06-24). The remaining housekeeping is now done: the "Dev Mode inner loop" note, the SSH / VS Code Remote setup step, and the commit-before-promote convention are all documented in `pdac-analysis-orchestrator/DEPLOYMENT.md` (tier "C. Dev Mode inner loop" + the "Golden rule"); `hf-dev/main` verified current with `main` (ahead by unpromoted dev work, `main` 0 ahead — not stale). The one inherently per-developer step (attaching VS Code Remote-SSH via the command in each Space's Dev Mode panel) is documented, not a repo deliverable. Reconciled + closed 2026-07-01.
 **Date:** 2026-06-24
 **Deciders:** Annie Voigt (project lead)
 **Scope:** `DecoupleRpy_Agent` (specialist Space) and `pdac-analysis-orchestrator` (coordinator Space). Enabled by the HF PRO subscription (2026-06). No code change in either repo — this is a Space-settings + workflow change. The orchestrator is named here because it shares the same deploy-and-wait pain; the ADR lives in `DecoupleRpy_Agent/docs/adr/` per the existing ADR-home convention (cf. ADR-0001's cross-repo placement note).
@@ -101,10 +101,10 @@ and does not change how secrets/tokens are managed.
 ## Action Items
 
 1. [x] Enable Dev Mode on `Paper2Agent_decoupleRpy_dev` and `pdac-analysis-orchestrator-dev`. *(done — both enabled, confirmed 2026-06-24)*
-2. [ ] Confirm `hf-dev` actually tracks current `main` before relying on it (SHOWCASE_STATUS flags it as possibly stale).
-3. [ ] Add a short "Dev Mode inner loop" note to `pdac-analysis-orchestrator/DEPLOYMENT.md` so the workflow is documented next to the deploy rules.
-4. [ ] Set up VS Code Remote / SSH config for both dev Spaces.
-5. [ ] Convention: anything proven in a Dev Mode session must land as a commit before prod promotion.
+2. [x] Confirm `hf-dev` actually tracks current `main` before relying on it. *(done 2026-07-01 — `git rev-list --left-right --count main...hf-dev/main` = `0  44`: `hf-dev/main` contains everything on `main` plus unpromoted dev work; `main` is 0 ahead. Not stale. Caveat: compared against local remote-tracking refs; re-run after a `git fetch hf-dev` if in doubt.)*
+3. [x] Add a short "Dev Mode inner loop" note to `pdac-analysis-orchestrator/DEPLOYMENT.md` so the workflow is documented next to the deploy rules. *(done — see DEPLOYMENT.md tier "C. Dev Mode inner loop", which links back to this ADR.)*
+4. [x] Set up VS Code Remote / SSH config for both dev Spaces. *(procedure documented in DEPLOYMENT.md: one-time copy of the SSH command from each Space's Settings → Dev Mode panel, then attach with VS Code Remote-SSH. The attach itself is a per-developer/per-machine step, not a repo artifact.)*
+5. [x] Convention: anything proven in a Dev Mode session must land as a commit before prod promotion. *(documented as the "Golden rule (Dev Mode)" in DEPLOYMENT.md.)*
 
 ## References
 

docs/adr/ADR-0005-private-storage-persistence.md

@@ -1,6 +1,6 @@
 # ADR-0005: Private Storage as Durable Data Persistence
 
-**Status:** Accepted — durable, private-by-default data tier adopted. **`pdac-research-data` confirmed private** 2026-06-24. Remaining action items (onboarding "promote to public on publication" checklist step; private Data Studio verification workflow; `biodata-registry/memory.md` note) still open. Reconciled 2026-06-24.
+**Status:** Accepted — **CLOSED 2026-07-01.** Durable, private-by-default data tier adopted; `pdac-research-data` confirmed private (2026-06-24). Remaining housekeeping now done: the "promote to public on publication" step and the private-Data-Studio validation workflow are documented in `biodata-registry/CLAUDE.md` ("Adding a New Dataset" step 5 + "Manifest validation workflow"), with a dated entry in `biodata-registry/memory.md`. One out-of-repo note (SHOWCASE_STATUS.md h5ad hosting) is tracked below. Reconciled + closed 2026-07-01.
 **Date:** 2026-06-24
 **Deciders:** Annie Voigt (project lead)
 **Scope:** Cross-cutting data layer — primarily the `anne-voigt/pdac-research-data` HF Dataset repo (h5ad hosting consumed by `DecoupleRpy_Agent`), with knock-on benefit to `lit-agent`'s corpus snapshots. Enabled by HF PRO (2026-06). Lives in `DecoupleRpy_Agent/docs/adr/` as the primary data consumer; the `lit-agent` corpus-persistence specifics are governed by its own ADRs.
@@ -92,10 +92,10 @@ registry — only where/how the underlying files are stored and inspected.
 ## Action Items
 
 1. [x] Confirm `pdac-research-data` visibility is private and audit which files are public. *(confirmed private 2026-06-24)*
-2. [ ] Stop any pruning driven solely by storage limits; retain corpus history in lit-agent's durable dataset.
-3. [ ] Add a "promote to public on publication" step to the dataset-onboarding checklist.
-4. [ ] Use private Data Studio as the first-pass check in the `dataset_validate_manifest_against_data` workflow.
-5. [ ] Record the new storage posture in `SHOWCASE_STATUS.md` (h5ad hosting note) and `biodata-registry/memory.md` (validation workflow).
+2. [x] Stop any pruning driven solely by storage limits; retain corpus history in lit-agent's durable dataset. *(codified — `lit-agent/CLAUDE.md` "Retention (PRO storage): keep corpus snapshots across runs rather than minimizing them".)*
+3. [x] Add a "promote to public on publication" step to the dataset-onboarding checklist. *(done 2026-07-01 — `biodata-registry/CLAUDE.md` "Adding a New Dataset" step 5: private-by-default; publish = explicit promote-to-public.)*
+4. [x] Use private Data Studio as the first-pass check in the `dataset_validate_manifest_against_data` workflow. *(done 2026-07-01 — `biodata-registry/CLAUDE.md` "Manifest validation workflow".)*
+5. [x] Record the new storage posture in `SHOWCASE_STATUS.md` (h5ad hosting note) and `biodata-registry/memory.md` (validation workflow). *(done 2026-07-01 — `biodata-registry/memory.md` dated entry + a "h5ad hosting posture — private-by-default (ADR-0005)" bullet in `SHOWCASE_STATUS.md`'s biodata-registry section.)*
 
 ## References