feat: jpa, messaging, notification, mongo, graphql 어댑터터 구현체 추가

.github/workflows/notification-platform.yml

@@ -14,10 +14,20 @@ name: notification-platform
 on:
   pull_request:
     paths:
-      - 'src/application-core/src/**/notification/platform/**'
+      # The filter used to stop at the four notification source trees, so a change to the
+      # composition root, the settings binding, the schema migrations, or the evidence manifest
+      # ran none of this — and those are exactly the surfaces that decide whether the platform
+      # assembles, binds and migrates at all.
+      - 'src/application-core/src/**/notification/**'
       - 'src/adapter/outbound/notification/**'
       - 'src/adapter/outbound/persistence-jpa/src/**/notification/**'
+      - 'src/adapter/outbound/persistence-jpa/src/main/resources/db/migration/jpa/notification-platform/**'
       - 'src/adapter/inbound/web/src/**/notification/**'
+      - 'src/app-bootstrap/src/**/notification/**'
+      - 'src/app-bootstrap/src/main/resources/application*.yml'
+      - 'src/gradle/notification-*.gradle'
+      - 'src/config/architecture/modules.json'
+      - 'src/.env'
       - 'docs/notification/**'
       - 'infra/notification/**'
       - '.github/workflows/notification-platform.yml'
@@ -66,6 +76,16 @@ jobs:
       - name: Persistence and web
         working-directory: src
         run: ./gradlew :adapter:outbound:persistence-jpa:test :adapter:inbound:web:test --console=plain
+      # The PR tier never touched a database, so every claim about migrations, claim atomicity and
+      # lease fencing rested on a fake. Docker is available on this runner; the lane fails closed
+      # when the container cannot start, because a skipped contract reports success for a database
+      # nobody tested.
+      - name: Notification schema and claim contracts (real PostgreSQL)
+        working-directory: src
+        run: ./gradlew :adapter:outbound:persistence-jpa:jpaPlatformContractTest --console=plain
+      - name: Notification migration upgrade (real PostgreSQL)
+        working-directory: src
+        run: ./gradlew :adapter:outbound:persistence-jpa:jpaPlatformMigrationTest --console=plain
       - name: Architecture gates
         working-directory: src
         run: |
@@ -73,7 +93,15 @@ jobs:
           ./gradlew :app-bootstrap:test --tests '*CleanArchitectureTest' --tests '*NotificationArchitectureTest' --console=plain
       - name: Configuration surface
         working-directory: src
-        run: ./gradlew verifyEnvKeys verifyPublicPathSnapshot --console=plain
+        run: |
+          ./gradlew verifyEnvKeys verifyPublicPathSnapshot --console=plain
+          ./gradlew verifyNotificationApiSurface verifyNotificationConfiguration --console=plain
+      # A support grade is a promise about production behaviour. This refuses one the pipeline
+      # cannot back — the check that would have caught five channels reading "Stable" while no
+      # request had ever left the process.
+      - name: Evidence manifest
+        working-directory: src
+        run: ./gradlew verifyNotificationEvidence --console=plain
       - name: Static analysis
         working-directory: src
         run: ./gradlew :adapter:outbound:notification:check -x test --console=plain
@@ -97,12 +125,33 @@ jobs:
             src/**/*.gradle
             src/**/gradle-wrapper.properties
             src/**/gradle.lockfile
+      # This job is named for ambiguity, restart recovery and callback burst. It used to run a
+      # unit-test filter and then `test` — neither of which restarts anything or bursts anything —
+      # so the job name was the only place those three properties existed.
       - name: Ambiguity and fault harness
         working-directory: src
         run: ./gradlew :adapter:outbound:notification:test --tests '*ChaosSecurity*' --tests '*CrossProviderContractSuite*' --console=plain
+      - name: Concurrency and rotation races
+        working-directory: src
+        run: ./gradlew :adapter:outbound:notification:test --tests '*ConcurrencyTest' --tests '*ProviderRuntimeStateTest' --console=plain
+      - name: Restart recovery and lease fencing (real PostgreSQL)
+        working-directory: src
+        run: ./gradlew :adapter:outbound:persistence-jpa:jpaPlatformContractTest :adapter:outbound:persistence-jpa:jpaPlatformFailureTest --console=plain
       - name: Full suite
         working-directory: src
         run: ./gradlew test --console=plain
+      # A filter that matches nothing passes. Each --tests filter above names a class that exists
+      # today; if one is renamed the job must fail rather than quietly stop covering it.
+      - name: Every named suite actually ran
+        working-directory: src
+        run: |
+          set -euo pipefail
+          for suite in ChaosSecurity CrossProviderContractSuite ConcurrencyTest ProviderRuntimeStateTest; do
+            if ! find . -path '*/build/test-results/*' -name "*${suite}*.xml" | grep -q .; then
+              echo "no test results for ${suite}: the filter matched nothing and the job passed vacuously" >&2
+              exit 1
+            fi
+          done
 
   provider-sandbox:
     name: provider sandbox smoke (secret-protected, non-blocking)
@@ -110,12 +159,44 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: notification-provider-sandbox
-    continue-on-error: true
+    # Not a required check: an external outage must not block a merge. But not continue-on-error
+    # either — a job that cannot fail produces no evidence, and this job's entire previous body was
+    # two echo statements, which is what let five channels be graded Stable on nothing.
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - name: Validate Gradle wrapper
+        id: gradle-wrapper-validation
+        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Refuse to report a pass with no credentials
+        env:
+          NOTIFICATION_SANDBOX_CREDENTIALS: ${{ secrets.NOTIFICATION_SANDBOX_CREDENTIALS }}
+        run: |
+          set -euo pipefail
+          if [ -z "${NOTIFICATION_SANDBOX_CREDENTIALS:-}" ]; then
+            echo "provider sandbox credentials are not configured for this environment." >&2
+            echo "The job stops here rather than reporting a green run that called nothing." >&2
+            exit 1
+          fi
       - name: Smoke test against real provider sandboxes
+        working-directory: src
         env:
           NOTIFICATION_SANDBOX_ENABLED: 'true'
-        run: |
-          echo "Runs only where provider sandbox credentials are configured."
-          echo "Never a required check: an external outage must not block a merge."
+          NOTIFICATION_SANDBOX_CREDENTIALS: ${{ secrets.NOTIFICATION_SANDBOX_CREDENTIALS }}
+        run: ./gradlew :adapter:outbound:notification:test --tests '*ProviderSandbox*' --console=plain
+      - name: Upload the wire evidence
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
+        with:
+          name: notification-provider-sandbox-evidence
+          path: src/adapter/outbound/notification/build/test-results/test/
+          if-no-files-found: error
+          retention-days: 90