SSOT Backlog Resolution — Internal Key Naming Revision · Sprint-250 ADR Frontmatter · ADR Count · c-ares CVE
SummaryThree backlog doc items from Sprint 249–250 resolved. ①CLAUDE.md Q-5 internal key naming SSOT revised — two patterns separated by call direction: Gateway→MSA (`INTERNAL_KEY_<TARGET>`) and inter-service direct calls (`<TARGET>_SERVICE_KEY`) (Sprint 249 decision applied). ②Sprint-250 ADR KR+EN frontmatter fields added (Critic P2 resolved). ③docs/adr/README.md ADR count updated to 188 + blog/Dockerfile c-ares CVE fixed. 3 commits (04b74bb · 854c90e · ee4d4fe), Critic CLEAN.
Date: 2026-07-17
Goal
Fully resolve documentation backlog items carried over from Sprint 249–250:
- CLAUDE.md Q-5 internal key naming SSOT only described a single pattern (
<SERVICE>_SERVICE_KEY) — the two actual code patterns (Gateway outbound vs. inter-service direct calls) were not reflected. - Sprint-250 ADR KR+EN had missing frontmatter fields — Critic P2 unresolved.
- docs/adr/README.md ADR count was stale + blog/Dockerfile c-ares CVE still present.
Decisions
D1. Internal Key Naming SSOT — Two-Pattern Split (CLAUDE.md Q-5 revision)
Before: Only a single pattern <SERVICE>_SERVICE_KEY was documented.
After: Two patterns separated by call direction.
| Direction | Env Var Pattern | Example | SSOT Code File |
|---|---|---|---|
| Inbound (own service key verification) | INTERNAL_API_KEY | — | Common to all services |
| Outbound — Gateway → MSA | INTERNAL_KEY_<TARGET> | INTERNAL_KEY_PROBLEM | services/gateway/src/common/config/service-keys.config.ts |
| Outbound — Inter-service direct calls | <TARGET>_SERVICE_KEY | PROBLEM_SERVICE_KEY | services/submission/src/common/problem-service-client/problem-service-client.ts, services/github-worker/src/config.ts |
Rationale: Prevents recurrence of the Sprint 248 incident — when sealing SealedSecrets, the actual code config field names (not CLAUDE.md examples) must be used as SSOT. This lesson is now codified in the SSOT document itself.
D2. Sprint-250 ADR Frontmatter Missing Fields Added
docs/adr/sprints/sprint-250.md and docs/adr-en/sprints/sprint-250.md were both missing frontmatter fields (related_memory, etc.) flagged as Critic P2 — resolved.
D3. Docs and CVE Updates
docs/adr/README.md: ADR count corrected to 188.blog/Dockerfile: c-ares CVE vulnerable version fixed.
Completed Items
| Commit | PR | Description |
|---|---|---|
04b74bb | — | docs/adr/README.md ADR count updated to 188 + blog c-ares CVE fix |
854c90e | #468 | CLAUDE.md Q-5 internal key naming SSOT revision (two-pattern split) |
ee4d4fe | #469 | Sprint-250 ADR KR+EN frontmatter fields added + ADR count aligned |
Critic Result: Codex gpt-5.5 (--base 04b74bb) — docs-only changes → 0 findings, CLEAN.