docs: fix stale "active PR #80" references in automation-threat-model.md

[seonghobae]

Root cause

The original documentation repair correctly noticed that PR #80 closed unmerged, but then incorrectly said T-A07/T-A08 atomic publisher controls were not implemented on protected main. Fresh protected-source verification shows .github/workflows/hourly-product-development.yml already carries the expected-absence creation lease, exact-proposal-head deletion lease, cryptographic publication marker, exact head/base matching, unique PR recovery, numeric PR identity and conditional cleanup. Closed PR #80 is historical lineage only.

RED → causal documentation repair

• RED 2814e5eef9deb622b69398c0b57ac6e2e1950d63 binds the threat-model status to the protected publisher implementation and rejects not implemented on protected main.
• documentation repair 107a973ff4e8ea081e4db843f2de05b530c74f3f makes T-A07/T-A08 describe the controls actually present on protected main and points the rationale to protected docs/doctoring/atomic-product-publisher-lease.md.

No workflow/runtime behavior, permissions, provider/model routing, security/quarantine/outbound authority or foreign domain truth changed.

Current exact authority — 2026-09-06 KST

• protected Noema base: main@e1ac9d50f6c646f04be8c137c8acdc7200182fcd;
• exact PR head: 107a973ff4e8ea081e4db843f2de05b530c74f3f;
• lifecycle: open / Draft;
• application CI, required Security Scan, patch-validator image and reviewer workflow surfaces are terminal success on this exact source head;
• repository-wide semantic-review prerequisite is fix(reviewer): fail closed on empty CodeGraph semantics #546 exact 95144d5bcf8f1cb4b9a7c552ede66737c23d6bca. This PR's reviewer success predates that semantic-evidence repair reaching protected truth, so it remains workflow-surface evidence rather than merge-authoritative semantic GREEN.

Keep the source unchanged and Draft. After #546 reaches protected truth, regenerate semantic reviewer evidence for this exact head and re-read current governance before promotion. Do not source-churn for a review event, transfer predecessor semantic authority, self-approve, rewrite history, or weaken publisher race controls.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}