chore(work): finish epic security-headers-rate-limit-sbom

docs/work/_system/_state.json

@@ -1,5 +1,5 @@
 {
-  "updated_at": "2026-05-20T11:41:53.388Z",
+  "updated_at": "2026-05-20T11:49:45.039Z",
   "epics": {
     "binder-wrap-helper": {
       "status": "done",
@@ -568,7 +568,7 @@
       }
     },
     "security-headers-rate-limit-sbom": {
-      "status": "in-progress",
+      "status": "done",
       "title": "Security headers + rate-limit primitive + SBOM in CI — Epic C of ADR-025",
       "prd": "docs/work/prds/security-headers-rate-limit-sbom.prd.md",
       "stories": {
@@ -675,23 +675,17 @@
           "blocks": []
         },
         "11-documentation": {
-          "status": "in-progress",
+          "status": "done",
           "title": "Documentation and conformance reference updates",
           "ac_total": 2,
-          "ac_completed": 1,
+          "ac_completed": 2,
           "depends_on": [],
           "blocks": []
         }
       }
     }
   },
-  "ready": [
-    {
-      "epic": "security-headers-rate-limit-sbom",
-      "story": "11-documentation",
-      "title": "Documentation and conformance reference updates"
-    }
-  ],
+  "ready": [],
   "blocked": [],
   "needs_prd_ship": []
 }

docs/work/epics/security-headers-rate-limit-sbom/11-documentation/_story.md

@@ -3,7 +3,7 @@ id: 11-documentation
 epic: security-headers-rate-limit-sbom
 title: Documentation and conformance reference updates
 type: technical-story
-status: in-progress
+status: done
 feature: core-shared
 depends-on:
   [
@@ -14,7 +14,7 @@ depends-on:
   ]
 blocks: []
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T11:41:53.228Z
+updated: 2026-05-20T11:49:44.873Z
 ---
 
 ## Goal
@@ -51,4 +51,4 @@ Implementations are complete after Story 10, but the institutional knowledge of
 ## Tasks
 
 - [x] Write `docs/guides/security-headers.md` (per-framework wiring, nonce threading for consumer inline scripts, CSP allowlist customization, Sentry nonce integration, securityheaders.com verification) and `docs/guides/rate-limiting.md` (manifest field, key-naming convention `<feature>:<scope>:<key>`, multi-budget patterns, dev/staging/prod backend wiring); all gates pass.
-- [ ] Add entries for `IRateLimit`, `RateLimited` brand, `withRateLimit`, `SecurityHeadersConfig`, `buildSecurityHeaders`, `SBOM`, `nonce` (CSP context) to `docs/glossary.md`; update `CLAUDE.md` conformance rule count 12 → 13 and add `rateLimit?: RateLimitBudget[]` to the manifest field documentation; add `no-undeclared-rate-limit` as the 13th rule in `docs/guides/conformance-quickref.md`; all gates pass.
+- [x] Add entries for `IRateLimit`, `RateLimited` brand, `withRateLimit`, `SecurityHeadersConfig`, `buildSecurityHeaders`, `SBOM`, `nonce` (CSP context) to `docs/glossary.md`; update `CLAUDE.md` conformance rule count 12 → 13 and add `rateLimit?: RateLimitBudget[]` to the manifest field documentation; add `no-undeclared-rate-limit` as the 13th rule in `docs/guides/conformance-quickref.md`; all gates pass.

docs/work/epics/security-headers-rate-limit-sbom/_epic.md

@@ -3,11 +3,11 @@ id: security-headers-rate-limit-sbom
 prd: docs/work/prds/security-headers-rate-limit-sbom.prd.md
 title: Security headers + rate-limit primitive + SBOM in CI — Epic C of ADR-025
 type: epic
-status: in-progress
+status: done
 features:
   [core-shared, core-testing, core-eslint, auth, web-next, web-tanstack, cms]
 created: 2026-05-20T00:00:00Z
-updated: 2026-05-20T11:33:07.860Z
+updated: 2026-05-20T11:49:44.873Z
 ---
 
 ## Goal
@@ -30,4 +30,4 @@ Security scanners flag the absence of HSTS, X-Frame-Options, X-Content-Type-Opti
 - [x] [08 — App wiring: web-next](08-app-wiring-web-next/_story.md)
 - [x] [09 — App wiring: web-tanstack and cms](09-app-wiring-web-tanstack-and-cms/_story.md)
 - [x] [10 — SBOM CI workflow and ADR-023 amendment](10-sbom-ci-workflow/_story.md)
-- [ ] [11 — Documentation and conformance reference updates](11-documentation/_story.md)
+- [x] [11 — Documentation and conformance reference updates](11-documentation/_story.md)