refactor: 각 어댑터터별 리펙토링 진행

.github/ci-gate-matrix.yml

@@ -45,6 +45,96 @@ gates:
     workflow: ci-quality-gates.yml
     job: quality-gates
     execution: check
+  - id: documented-leaf-count
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: verifyDocumentedLeafCount
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: check
+  - id: declared-dependency-absence
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: verifyDependencyPolicy
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: check
+  - id: notification-api-surface
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: verifyNotificationApiSurface
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: check
+  - id: notification-configuration-contract
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: verifyNotificationConfiguration
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: check
+  - id: notification-support-grade-evidence
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: verifyNotificationEvidence
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: check
+  - id: runbook-reference-drift
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: verifyRunbookReferences
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: check
+  - id: graphql-api-surface
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: verifyGraphQlApiSurface
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: check
+  - id: mongo-api-surface
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: verifyMongoApiSurface
+    workflow: ci-quality-gates.yml
+    job: quality-gates
+    execution: check
+  # The strongest evidence this repository produces, and CI does not run it. Fifteen Compose lanes
+  # start real PostgreSQL, MongoDB, Kafka, MinIO, Mailpit and Keycloak, take a real client-credentials
+  # JWT, and prove things no in-JVM test can: that all-off boots with no external resource, that the
+  # notification handoff delivers exactly once across a restart on the same volume, that the startup
+  # log is silent. It runs from a developer's machine via scripts/run-compose-runtime-smoke.sh and
+  # from nowhere else — no workflow invokes it, so nothing re-runs it on a pull request.
+  #
+  # Registered delegated-pending so the gap is a tracked absence rather than an unstated one.
+  # Executing it in CI needs a Docker-capable runner and a decision about the minutes fifteen
+  # container lanes cost, which is an infrastructure choice rather than a wiring oversight.
+  - id: runtime-smoke-matrix
+    release_blocking: conditional
+    mechanism: delegated-pending
+    ref: runtime-smoke-matrix-lane
+    workflow: ci-quality-gates.yml
+    job: release-gate
+    execution: job
+  # `conditional-transport-qualification` above is the registered GraphQL control, and it is a
+  # boundary test: a @SpringBootTest over a nested test application with in-memory Basic Auth. Its own
+  # javadoc says so — "the nested application deliberately owns only test authentication and CORS
+  # policy". That is a legitimate transport-boundary proof and it is not release evidence for the
+  # security posture, which is the distinction the Definition of Done draws.
+  #
+  # The real proof exists: the local-graphql Compose lane obtains a Keycloak client-credentials token
+  # and posts it to /graphql on the running bootJar, asserting that anonymous and malformed
+  # credentials are refused and the authenticated query answers. It is part of the runtime smoke
+  # matrix above, so it inherits that control's pending status rather than having none of its own.
+  - id: graphql-runtime-jwt
+    release_blocking: conditional
+    mechanism: delegated-pending
+    ref: graphql-runtime-jwt-lane
+    workflow: ci-quality-gates.yml
+    job: release-gate
+    execution: job
   - id: one-type-per-file
     release_blocking: true
     mechanism: gradle-custom-task
@@ -287,3 +377,15 @@ gates:
     workflow: httpclient-release.yml
     job: release-gate
     execution: explicit
+  # The messaging platform's only claim that needs a real broker to be true. The gate is the
+  # evidence check rather than the lane, and it depends on the lane: passing means both that every
+  # fault scenario produced the outcome the shared contract fixes and that the committed manifest is
+  # what this run wrote. Before it existed, `CertifiedEvidence` was a hand-authored list and
+  # "certified against a live broker" was a sentence a developer could type.
+  - id: messaging-broker-certification
+    release_blocking: true
+    mechanism: gradle-custom-task
+    ref: verifyMessagingCertificationEvidence
+    workflow: messaging-certification.yml
+    job: broker-certification
+    execution: explicit