Upload folder using huggingface_hub

docs/authentication.md

@@ -12,9 +12,23 @@ Current status
   this service. The last four were unauthenticated until this was fixed — see
   `tests/test_deps.py` for the tests that verify the dependency itself actually rejects what
   it should, not just that it's wired in.
+- `routes_incidents.py`'s `POST /report_incident` requires the same `X-Internal-Key`
+  dependency as above — it did not until a later audit found it had none at all, unlike every
+  other route in this file, despite its own docstring saying it's meant for internal monitoring
+  tools only. Anyone could previously write arbitrary events into the incident history that
+  feeds the causal explainer and `GET /history`. That history is now also a bounded
+  `deque(maxlen=10_000)` (`app/core/storage.py`), not an unbounded list — the same audit found
+  `POST /report_incident` and `GET /history` were reading/writing two _different_ Python lists
+  with the same name, so `GET /history` had in fact always returned empty regardless of what was
+  reported; both routers now share the one list in `app.core.storage`.
 - `routes_admin.py`: individual `/admin/*` endpoints require an `admin_key` query parameter,
   verified against `ARF_ADMIN_API_KEY` (`app/api/deps.py`, or the local `verify_admin`
-  dependency in that router). Also fails closed if unset.
+  dependency in that router). Also fails closed if unset. Includes
+  `POST /admin/keys/{key_id}/rotate` — deactivates a key and issues a new one on the same
+  tenant/tier in one transaction, for when a key needs to be revoked without losing the
+  tenant's identity or history. `api_keys` itself lives in Postgres (`DATABASE_URL`), shared
+  with arf-gateway (both must use the identical `ARF_KEY_PEPPER`) — see the comments on those
+  two variables in `.env.example` for why.
 - `routes_pricing.py`: individual `/pricing/*` endpoints require a real per-customer API key
   (`Authorization: Bearer <key>` or `?api_key=`), verified against the tracked/tenant-scoped
   `enforce_quota` dependency (`app/core/usage_tracker.py`) — a different mechanism from