docs(adr): cite IANA and TLS RFCs for destination and identity ADRs

CHANGELOG.md

@@ -37,6 +37,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Changed
 
+- Added APA 7th References with DOI and RFC Editor or IANA URL locators to ADR 0004 and ADR 0006 for the IANA special-purpose registries and TLS/HTTP RFCs those decisions already name.
 - Aligned the hourly product-development branch-coverage toolchain and its one-shot materializer with the reviewed `nightly-2026-08-18` pin, and corrected the official Dependabot Rust-toolchain reference.
 - Separated logical origin authority from resolved network destination authority; an origin grant no longer implies permission to connect to every resolver result.
 - Separated resolved-address authorization from direct transport evidence; an approved IP now becomes a usable stream only after the operating system reports the exact requested IP and port.

docs/adr/0004-resolved-destination-policy.md

@@ -135,3 +135,13 @@ Separate ADRs are required before implementing:
 - MIME and observed-content validation;
 - Chromium/BiDi/CDP integration;
 - persistent connection and redirect provenance.
+
+## References
+
+Cotton, M., Vegoda, L., Bonica, R. (Ed.), & Haberman, B. (2013). *Special-purpose IP address registries* (RFC 6890). RFC Editor. https://doi.org/10.17487/RFC6890 https://www.rfc-editor.org/rfc/rfc6890
+
+Internet Assigned Numbers Authority. (n.d.). *IANA IPv4 Special-Purpose Address Registry*. Retrieved August 25, 2026, from https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+Internet Assigned Numbers Authority. (n.d.). *IANA IPv6 Special-Purpose Address Registry*. Retrieved August 25, 2026, from https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
+
+Fielding, R. (Ed.), Nottingham, M. (Ed.), & Reschke, J. (Ed.). (2022). *HTTP semantics* (RFC 9110). RFC Editor. https://doi.org/10.17487/RFC9110 https://www.rfc-editor.org/rfc/rfc9110

docs/adr/0006-tls-server-identity.md

@@ -229,6 +229,12 @@ The merge gate requires:
 - complete public rustdoc;
 - current-head CI, Security Scan, Semgrep, and independent review success.
 
-## Standards
+## References
 
-RFC 5280 defines the Internet PKIX certificate and CRL profile. RFC 9846 defines TLS 1.3 and obsoletes RFC 8446. RFC 9525 defines service identity for TLS, requires applicable subjectAltName identifiers, and supersedes the older RFC 6125 guidance. The implementation uses the pinned rustls 0.23.42 API and rcgen 0.14.8 only for deterministic test certificates. Full APA 7th references and the evidence-to-decision trace are recorded in `docs/doctoring.md`.
+RFC 5280 defines the Internet PKIX certificate and CRL profile. RFC 9846 defines TLS 1.3 and obsoletes RFC 8446. RFC 9525 defines service identity for TLS, requires applicable subjectAltName identifiers, and supersedes the older RFC 6125 guidance. The implementation uses the pinned rustls 0.23.42 API and rcgen 0.14.8 only for deterministic test certificates. The evidence-to-decision trace remains in `docs/doctoring.md`.
+
+Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., & Polk, W. (2008). *Internet X.509 public key infrastructure certificate and certificate revocation list (CRL) profile* (RFC 5280). RFC Editor. https://doi.org/10.17487/RFC5280 https://www.rfc-editor.org/rfc/rfc5280
+
+Rescorla, E. (2026). *The Transport Layer Security (TLS) protocol version 1.3* (RFC 9846). RFC Editor. https://doi.org/10.17487/RFC9846 https://www.rfc-editor.org/rfc/rfc9846
+
+Saint-Andre, P., & Salz, R. (2023). *Service identity in TLS* (RFC 9525). RFC Editor. https://doi.org/10.17487/RFC9525 https://www.rfc-editor.org/rfc/rfc9525

docs/adr/README.md

@@ -28,6 +28,8 @@ An Accepted ADR is **design authority, not implementation evidence**. Protected-
 | [0008](0008-leaf-validity-horizon.md) | Delegated-task TLS leaf-validity horizon | Accepted | minimum certificate-validity horizon for bounded delegated tasks |
 | [0010](0010-session-context-bound-node-authority.md) | Session/context-bound node authority | Accepted | browser-session, browsing-context, origin, document-epoch and stale-node authority |
 
+ADR 0004 and ADR 0006 now carry APA 7th locators for the IANA special-purpose registries, RFC 6890, RFC 9110, RFC 5280, RFC 9846, and RFC 9525 already named in those decisions.
+
 ## Proposed architecture decisions
 
 Proposed ADR files are reviewable target architecture without becoming Accepted or shipped behavior. The provenance subsections distinguish files already present in the protected-main baseline from decisions introduced by this documentation reconciliation. Provenance never changes lifecycle: file presence on an active branch is not protected-main truth, and later integration does not itself promote a Proposed ADR to Accepted.