chore: harden workflow download integrity and maintainer runbook

.github/workflows/code-quality.yml

@@ -34,5 +34,12 @@ jobs:
 
       - name: Lint GitHub workflows
         run: |
-          curl -sSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash | bash -s -- 1.7.10
+          ACTIONLINT_VERSION="1.7.10"
+          ACTIONLINT_FILE="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          ACTIONLINT_BASE_URL="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}"
+          curl -sSLo "$ACTIONLINT_FILE" "${ACTIONLINT_BASE_URL}/${ACTIONLINT_FILE}"
+          curl -sSLo actionlint_checksums.txt "${ACTIONLINT_BASE_URL}/actionlint_${ACTIONLINT_VERSION}_checksums.txt"
+          grep "$ACTIONLINT_FILE" actionlint_checksums.txt | sha256sum -c -
+          tar -xzf "$ACTIONLINT_FILE" actionlint
+          chmod +x actionlint
           ./actionlint

ARCHITECTURE.md

@@ -19,6 +19,8 @@ metadata and CI are wired, and which parts are safe to evolve.
 - `.github/ISSUE_TEMPLATE/` - structured issue intake templates
 - `.github/CODEOWNERS` - code ownership map for reviews
 - `.github/dependabot.yml` - Automated Actions dependency updates
+- `docs/coderabbit/review-commands.md` - CodeRabbit command quick reference
+- `docs/operations/maintenance-runbook.md` - recurring maintainer operations checklist
 - `README.md` - User/developer entrypoint
 - `CONTRIBUTING.md` - Contribution process and verification baseline
 - `AGENTS.md`, `CLAUDE.md` - Agent operation guardrails
@@ -79,7 +81,9 @@ package metadata, and CI workflow definitions in Git.
 ## 7. Security Considerations
 
 - Actions are pinned to full commit SHAs.
-- Code scanning and dependency review are enabled in CI.
+- Private-repo-safe checks are enforced with `security-audit.yml` and required checks.
+- CodeQL/dependency-review workflows are present but skipped when platform
+  features are unavailable.
 - No secrets are required for package checks.
 
 ## 8. Development & Testing Environment
@@ -101,7 +105,7 @@ package metadata, and CI workflow definitions in Git.
 - Project Name: aFIPC
 - Repository URL: `https://github.com/seonghobae/aFIPC`
 - Primary Contact: Seongho Bae
-- Date of Last Update: 2026-02-14
+- Date of Last Update: 2026-02-15
 
 ## 11. Glossary / Acronyms
 

README.md

@@ -35,6 +35,8 @@ preserve numerical behavior while modernizing repository operations
 - Code quality checks: `.github/workflows/code-quality.yml`
 - Security checks (private-safe): `.github/workflows/security-audit.yml`
 - Secret-scan policy config: `.gitleaks.toml`
+- CodeRabbit command reference: `docs/coderabbit/review-commands.md`
+- Maintainer operations runbook: `docs/operations/maintenance-runbook.md`
 
 ## Local package check
 

docs/coderabbit/review-commands.md

@@ -0,0 +1,29 @@
+# CodeRabbit Review Commands
+
+This repository uses `@coderabbitai` as the only bot reviewer mention target.
+
+## Command placement rules
+
+- Use in PR comments:
+  - `@coderabbitai review`
+  - `@coderabbitai full review`
+  - `@coderabbitai pause`
+  - `@coderabbitai resume`
+  - `@coderabbitai resolve`
+  - `@coderabbitai help`
+- Use in PR description only:
+  - `@coderabbitai ignore`
+
+## Safe default workflow
+
+1. Push branch updates.
+2. Wait for required checks to finish.
+3. Comment `@coderabbitai review`.
+4. Resolve or answer actionable bot comments with evidence.
+5. Comment `@coderabbitai full review` before merge when substantial changes
+   were made.
+
+## Notes
+
+- Do not mention human reviewers by default.
+- Treat bot feedback as hypotheses; verify with tests/logs before applying.

docs/operations/maintenance-runbook.md

@@ -0,0 +1,40 @@
+# Maintenance Runbook
+
+This runbook defines the minimum recurring operations for maintaining `aFIPC`
+without changing historical numerical behavior by accident.
+
+## Weekly cycle
+
+1. Check open PR queue:
+   - `gh pr list --state open --limit 50`
+2. Rebase stale Dependabot PRs:
+   - `for n in 1 2 3 4; do gh pr comment "$n" --body "@dependabot rebase"; done`
+3. Verify required checks on active PRs:
+   - `gh pr checks <PR_NUMBER> --required`
+
+## Monthly cycle
+
+1. Verify ruleset is still enforcing required checks:
+   - `gh api repos/seonghobae/aFIPC/rules/branches/master`
+2. Review recent workflow failures:
+   - `gh run list --limit 30`
+3. Confirm security toggles best-effort state:
+   - `gh api -i repos/seonghobae/aFIPC/vulnerability-alerts`
+   - `gh api repos/seonghobae/aFIPC/automated-security-fixes`
+   - `gh api -i repos/seonghobae/aFIPC/dependency-graph/sbom`
+
+## Release-quality gate
+
+Before merging operational changes, run:
+
+- `python3 -m yamllint .yamllint.yml .github/dependabot.yml .github/workflows/*.yml`
+- `actionlint`
+- `Rscript -e 'rcmdcheck::rcmdcheck(args = c("--no-manual", "--as-cran"),
+  error_on = "error")'`
+
+## Risk policy
+
+- Do not make algorithmic changes in `R/aFIPC.R` without explicit regression
+  evidence.
+- If a bot requests broad behavioral refactoring, split into a dedicated PR with
+  reproducibility fixtures first.