docs/architecture/adr/0019-no-security-base-functions.md

@@ -1,6 +1,6 @@
 # ADR 0019: No security base functions in the application (§52 VSA)
 
-- Status: proposed
+- Status: accepted (2026-07-31)
 - Date: 2026-07-29
 
 ## Context

docs/architecture/adr/0020-token-crypto-key-separation.md

@@ -1,6 +1,6 @@
 # ADR 0020: Token crypto — HKDF key separation and a vetted JWT library
 
-- Status: proposed
+- Status: accepted (2026-07-31)
 - Date: 2026-07-29
 
 ## Context

docs/architecture/adr/0021-external-authentication.md

@@ -1,6 +1,6 @@
 # ADR 0021: External authentication via OIDC; local passwords optional
 
-- Status: proposed
+- Status: accepted (2026-07-31)
 - Date: 2026-07-29
 
 ## Context
@@ -28,12 +28,14 @@ expect the application to trust a header or a client certificate.
    `subject` from the token. Linking an OIDC identity to an existing local
    user follows an explicit, documented rule — never silently by e-mail
    address, which would be an account-takeover path.
-3. **Local authentication is switchable off in full**, via
+3. **Local authentication is switchable off in full** (realized
-   `auth.local.enabled = false`. "In full" means every credential-issuing
+   deploy-level as `AUTH_LOCAL_ENABLED`, see #216 below). "In full" means
-   flow: password login, self-service signup, password reset,
+   every interactive credential flow: password login, self-service
-   verification-as-login, and the token flows (PAT, feed tokens). A
+   signup, password reset, verification-as-login. PAT and feed-token
-   half-closed local path makes the operating concept untrue, which is
+   issuance deliberately stays available to IdP-authenticated sessions —
-   worse than not closing it.
+   they authorize API access under their own switches and are not
+   interactive sign-in (#216). A half-closed local path makes the
+   operating concept untrue, which is worse than not closing it.
 4. **Proxy header and mTLS are a supported alternative path, off by
    default.** When enabled they require an allowlist of trusted peers; a
    request carrying the header from an untrusted peer is rejected and

docs/architecture/adr/0022-page-classification.md

@@ -1,6 +1,6 @@
 # ADR 0022: Classification as first-class page metadata
 
-- Status: proposed
+- Status: accepted (2026-07-31)
 - Date: 2026-07-29
 
 ## Context

docs/architecture/adr/0023-read-access-audit-trail.md

@@ -1,6 +1,6 @@
 # ADR 0023: Read-access audit trail limited to classified content
 
-- Status: proposed
+- Status: accepted (2026-07-31)
 - Date: 2026-07-29
 
 ## Context

docs/architecture/adr/0024-reproducible-offline-deployment.md

@@ -1,6 +1,6 @@
 # ADR 0024: Reproducible offline deployment
 
-- Status: proposed
+- Status: accepted (2026-07-31)
 - Date: 2026-07-29
 
 ## Context

docs/architecture/adr/0025-plugin-trust-model.md

@@ -1,6 +1,6 @@
 # ADR 0025: Plugin trust model
 
-- Status: proposed
+- Status: accepted (2026-07-31)
 - Date: 2026-07-29
 
 ## Context

docs/architecture/adr/0026-backup-target-restriction.md

@@ -1,6 +1,6 @@
 # ADR 0026: Backup target restriction
 
-- Status: proposed
+- Status: accepted (2026-07-31)
 - Date: 2026-07-29
 
 ## Context

docs/architecture/adr/0027-vs-nfd-hardening-profile-mode.md

@@ -1,6 +1,6 @@
 # ADR 0027: VS-NfD hardening-profile mode and configuration catalog
 
-- Status: proposed
+- Status: accepted (2026-07-31)
 - Date: 2026-07-31
 
 ## Context