feat: jpa, messaging, notification, mongo, graphql 어댑터터 구현체 추가

scripts/verify-mongodb-advanced.sh

@@ -81,10 +81,19 @@ fi
 # --- actual-topology -------------------------------------------------------------------------
 echo ""
 echo "=== [actual-topology] provider environments"
+# The URI travels in the environment, never as a JVM argument. `-Dmongodb.sharded.uri=mongodb://
+# user:pass@host` is visible in `ps` to every user on the machine, in the Gradle failure output and
+# in any CI log that echoes the command.
+#
+# The selector names the contract's class. `--tests '*Shard*'` was satisfied by the hermetic
+# ShardKeyAnalyzerTest, so "sharded topology" was certified by a unit test that never opened a
+# connection. Which classes count is `src/config/mongodb/release-contracts.json`, and
+# MongoReleaseEvidenceVerifier checks the JUnit XML rather than the exit code.
 if [[ -n "${MONGODB_SHARDED_URI:-}" ]]; then
-  if (cd "${GRADLE_DIR}" && "${GRADLE[@]}" "${MODULE}:test" --tests '*Shard*' \
-        -Dmongodb.sharded.uri="${MONGODB_SHARDED_URI}"); then
-    echo "actual-topology(sharded): supplied"
+  SHARDED_CLASS="$(python3 -c "import json,sys; print(next(c['className'] for c in json.load(open('${REPO_ROOT}/src/config/mongodb/release-contracts.json'))['contracts'] if c['topology']=='sharded'))")"
+  if (cd "${GRADLE_DIR}" && MONGODB_SHARDED_URI="${MONGODB_SHARDED_URI}" \
+        "${GRADLE[@]}" "${MODULE}:mongoShardedTest" --tests "${SHARDED_CLASS}"); then
+    echo "actual-topology(sharded): ${SHARDED_CLASS} executed"
   else
     FAILED+=("actual-topology:sharded")
   fi
@@ -93,26 +102,38 @@ else
   MISSING_EVIDENCE+=("actual-topology: sharded cluster")
 fi
 
+# Present is not exercised. An environment variable proves somebody exported a string; the
+# contract is satisfied by a lane that ran against the deployment it names, which is why this
+# records the variable as *not yet* evidence until MONGO-REL-011's class has run.
 if [[ -n "${MONGODB_ATLAS_URI:-}" ]]; then
-  echo "actual-topology(search/vector): MONGODB_ATLAS_URI present"
+  echo "actual-topology(search/vector): MONGODB_ATLAS_URI present (lane not yet implemented)"
+  MISSING_EVIDENCE+=("actual-topology: MONGO-REL-011 has no lane; an exported URI is not a run")
 else
   echo "actual-topology(search/vector): no MONGODB_ATLAS_URI"
   MISSING_EVIDENCE+=("actual-topology: search/vector on the actual target deployment")
 fi
 
 if [[ -n "${MONGODB_KMS:-}" ]]; then
-  echo "actual-topology(encryption): MONGODB_KMS present"
+  echo "actual-topology(encryption): MONGODB_KMS present (lane not yet implemented)"
+  MISSING_EVIDENCE+=("actual-topology: MONGO-REL-012 has no lane; an exported KMS is not a run")
 else
   echo "actual-topology(encryption): no MONGODB_KMS"
   MISSING_EVIDENCE+=("actual-topology: real KMS and key vault")
 fi
 
 # --- security + migration ---------------------------------------------------------------------
-# These are review artefacts, not test runs: a role review and a documented migration path per
-# capability. The gate records that they are outstanding rather than pretending a green test covers
-# them.
-MISSING_EVIDENCE+=("security: per-capability privilege review sign-off")
-MISSING_EVIDENCE+=("migration: per-capability migration path sign-off")
+# Review artefacts, not test runs: a role review and a documented migration path per capability.
+# These used to be appended unconditionally, so the gate could never reach PROMOTABLE no matter what
+# anybody did — a gate with no passing state is a gate nobody can act on. They are now satisfied by
+# a committed sign-off file, which is the artefact the review actually produces.
+for signoff in security migration; do
+  path="${REPO_ROOT}/docs/mongodb/advanced/signoff/${signoff}.md"
+  if [[ -f "${path}" ]]; then
+    echo "${signoff}: sign-off recorded at docs/mongodb/advanced/signoff/${signoff}.md"
+  else
+    MISSING_EVIDENCE+=("${signoff}: per-capability sign-off (docs/mongodb/advanced/signoff/${signoff}.md)")
+  fi
+done
 
 # --- Report ------------------------------------------------------------------------------------
 echo ""