refactor: 각 어댑터터별 리펙토링 진행

.github/scripts/verify-gate-matrix.sh

@@ -27,8 +27,15 @@ readonly MATRIX="${REPO_ROOT}/.github/ci-gate-matrix.yml"
 # Deliberately a literal: a gate silently appearing or disappearing is the drift this lint exists to
 # catch, so growing the matrix is an explicit edit here. 38 as of the HTTP Client platform hardening,
 # which registered httpclient-spring62-runtime as a delegated-pending control — the 6.2 *runtime*
-# claim, distinct from the API-surface scan that was standing in for it.
-readonly EXPECTED_GATE_COUNT=38
+# claim, distinct from the API-surface scan that was standing in for it. 40 after the Gradle
+# convention wave registered documented-leaf-count and declared-dependency-absence, then 46 after
+# the final qualification wave registered the four notification/runbook gates that existed but ran
+# nowhere and the two API-surface gates the convention had already wired into check. 48 once the
+# Compose runtime matrix and the GraphQL runtime JWT claim were registered as delegated-pending —
+# both are real and neither runs in CI. 49 once the messaging broker certification lane registered
+# its evidence gate — the first control in this repository whose subject is not "did the tests pass"
+# but "is the committed evidence what the run produced".
+readonly EXPECTED_GATE_COUNT=49
 
 if [[ ! -f "${MATRIX}" ]]; then
   printf '::error::gate-matrix-lint: missing %s\n' "${MATRIX}" >&2
@@ -135,6 +142,25 @@ gradle_custom_task_is_registered_in_build_file() {
     return 0
   fi
 
+  # A lane declared through the `ca.strict-test-lane` convention. The convention exists because the
+  # five lines every lane used to repeat were copied per lane and per leaf, and two copies had
+  # already lost `failOnNoDiscoveredTests`; registering through it is still registering, so this lint
+  # has to recognise the declaration or it reports every converted lane as missing.
+  if grep -qsE -- "lane\\(['\"]${task_name}['\"]\\)" "${build_file}"; then
+    return 0
+  fi
+
+  # An API surface gate declared through the `ca.api-surface` convention, which derives every task
+  # name from one label so a leaf cannot verify one surface while telling the reader about another.
+  # The name is computed, so there is no literal `tasks.register('verifyMongoApiSurface')` anywhere;
+  # what the build file says is `apiSurface { label = 'Mongo' }`.
+  if [[ "${task_name}" =~ ^verify(.+)ApiSurface$ ]]; then
+    local surface_label="${BASH_REMATCH[1]}"
+    if grep -qsE -- "label[[:space:]]*=[[:space:]]*['\"]${surface_label}['\"]" "${build_file}"; then
+      return 0
+    fi
+  fi
+
   awk -v required_task="${task_name}" '
     index($0, "registerStrictQualificationTest(") > 0 { inside_registration=1 }
     inside_registration && /^[[:space:]]*name:[[:space:]]*/ {
@@ -159,14 +185,64 @@ gradle_custom_task_is_registered_in_build_file() {
   ' "${build_file}"
 }
 
+# Every `dependsOn ... named('x')` in the build, collected once.
+#
+# This used to be one recursive grep per gate. That was affordable at 38 gates and stopped being so
+# at 48: the whole lint crossed the ten-second budget its own contract test asserts, and the first
+# symptom was that test failing rather than anything about gate coverage. One pass, then membership
+# tests against the result.
+CHECK_WIRING_CACHE=""
+load_check_wiring() {
+  [[ -n "${CHECK_WIRING_CACHE}" ]] && return 0
+  CHECK_WIRING_CACHE="$(grep -RhoE -- "dependsOn[^\n]*named\((['\"])[A-Za-z0-9_.-]+\1\)" \
+    "${REPO_ROOT}/src" --include='build.gradle' --include='ca.*.gradle' 2>/dev/null \
+    | grep -oE "(['\"])[A-Za-z0-9_.-]+\1" | tr -d "\"'" | sort -u)"
+  # A build with no such wiring at all would leave this empty and make every membership test pass by
+  # vacuity, so an empty result is a marker rather than an answer.
+  [[ -z "${CHECK_WIRING_CACHE}" ]] && CHECK_WIRING_CACHE="<none>"
+  return 0
+}
+
+gradle_custom_task_wired_into_check() {
+  local task_name="$1"
+  load_check_wiring
+  if printf '%s\n' "${CHECK_WIRING_CACHE}" | grep -qxF -- "${task_name}"; then
+    return 0
+  fi
+  # `ca.api-surface` wires check as `dependsOn tasks.named(verifyName())`, where verifyName() is
+  # derived from the leaf's label. The declaration that makes the gate real is the label, so that is
+  # what proves the wiring — the convention has exactly one check wiring and it is unconditional.
+  if [[ "${task_name}" =~ ^verify(.+)ApiSurface$ ]]; then
+    local surface_label="${BASH_REMATCH[1]}"
+    if grep -RqsE -- "label[[:space:]]*=[[:space:]]*['\"]${surface_label}['\"]" "${REPO_ROOT}/src" \
+        --include='build.gradle' \
+        && grep -qsE -- "dependsOn tasks\.named\(verifyName\(\)\)" \
+          "${REPO_ROOT}/src/build-logic/src/main/groovy/ca.api-surface.gradle"; then
+      return 0
+    fi
+  fi
+  return 1
+}
+
+# The build files, found once rather than once per gate. Same reason as the wiring cache above: the
+# per-gate `find` was a fixed cost multiplied by a number that grew.
+GRADLE_FILE_CACHE=""
+load_gradle_files() {
+  [[ -n "${GRADLE_FILE_CACHE}" ]] && return 0
+  GRADLE_FILE_CACHE="$(find "${REPO_ROOT}/src" -type f -name '*.gradle' | sort)"
+  return 0
+}
+
 gradle_custom_task_is_registered() {
   local task_name="$1"
   local build_file
-  while IFS= read -r -d '' build_file; do
+  load_gradle_files
+  while IFS= read -r build_file; do
+    [[ -z "${build_file}" ]] && continue
     if gradle_custom_task_is_registered_in_build_file "${task_name}" "${build_file}"; then
       return 0
     fi
-  done < <(find "${REPO_ROOT}/src" -type f -name '*.gradle' -print0)
+  done <<< "${GRADLE_FILE_CACHE}"
   return 1
 }
 
@@ -325,9 +401,16 @@ while IFS=$'\t' read -r id blocking mechanism ref workflow job execution; do
         failures+=("gate '${id}' expects Gradle check in job '${job}'")
         continue
       fi
+      # Build files *and* convention plugins. A gate can now be wired into check from an included
+      # build's convention rather than from a leaf's build.gradle, and a lint that only reads
+      # build.gradle would call such a gate unwired while it runs on every leaf — a false failure
+      # that teaches the next author to delete the matrix row instead of trusting it.
+      #
+      # A convention that derives the task name from a label wires check by that derived name, so
+      # there is no literal to grep for either; `gradle_custom_task_wired_into_check` handles both
+      # the literal and the derived form.
       if [[ "${mechanism}" == "gradle-custom-task" ]] \
-          && ! grep -RqsE -- "dependsOn.*named\\(['\"]${ref}['\"]\\)" "${REPO_ROOT}/src" \
-            --include='build.gradle'; then
+          && ! gradle_custom_task_wired_into_check "${ref}"; then
         failures+=("gate '${id}' task '${ref}' exists but is not wired into Gradle check")
         continue
       fi