feat(notification): implement the notification delivery platform

Maps the 31-module plan onto the registry's 19 leaves as packages; the two edges the registry forbids (provider->httpclient, inbox->messaging) are replaced by application-owned ports. See docs/notification/module-mapping.md. Acceptance is not delivery: ProviderSubmissionResult refuses to carry a delivery outcome, and AMBIGUOUS is a first-class terminal state that blocks automatic retry and fallback until reconciliation resolves it. Providers: SES (SigV4 + SNS callback), Twilio (X-Twilio-Signature + reconciliation), FCM (FID-primary batch), APNs, Web Push (RFC 8030/8291/8292), SMTP and webhook. Contact points are AES-256-GCM encrypted with a separate HMAC lookup fingerprint; nothing raw reaches a log, metric tag or exception. Dispatch commits the attempt row, calls the provider with no transaction open, then records the outcome; the durable queue uses FOR UPDATE SKIP LOCKED. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-14 13:57:27 +09:00
parent 3b5aee50e3
commit 701ba67456
511 changed files with 30537 additions and 23 deletions
@@ -26,6 +26,7 @@ readonly EXPECTED_WORKFLOW_LOCK=(
  'ad84000efc438ee7439517b8f85819e62b13dab0aa4f94066c2905060f3bb581  .github/workflows/httpclient-release.yml'
  '59cb3a0ffc687a15eefe96bc5e3a70d42be78e1cc85d2e7f7880dac6124ca4c7  .github/workflows/jpa-r2-evidence.yml'
  '5be7e931db749029d89787da042d6d7cf8e683d60698bd8a2993c29db26355fb  .github/workflows/link-check.yml'
+  '3d5afcef6bf1c65dcd8cad3d1687f07c2cfbb15d360f41251e46f9eb8950baac  .github/workflows/notification-platform.yml'
  '64245586cd5936f1a5647b57f2cd9acd316f96fd75f713b1890decb812e7d5fe  .github/workflows/object-storage-qualification.yml'
  'cbc104ea486c746229895e804e3be7716e056a02cce0588c537bce9f442f8b38  .github/workflows/redis-sdk-topology.yml'
 )
@@ -0,0 +1,121 @@
+name: notification-platform
+
+# Verification tiers for the Notification Delivery Platform.
+#
+# The PR tier is deliberately free of any external provider. A gate that depends on a third-party
+# sandbox fails for reasons that have nothing to do with the change under review, and a gate people
+# learn to re-run is not a gate. Real provider smoke tests live in the secret-protected tier, where
+# a failure is an environment signal rather than a merge blocker.
+#
+# Every job that invokes Gradle validates the wrapper first with the repository's pinned action;
+# the wrapper JAR is executable code fetched at build time, so validating it is what keeps a
+# compromised wrapper from turning any workflow run into arbitrary code execution.
+
+on:
+  pull_request:
+    paths:
+      - 'src/application-core/src/**/notification/platform/**'
+      - 'src/adapter/outbound/notification/**'
+      - 'src/adapter/outbound/persistence-jpa/src/**/notification/**'
+      - 'src/adapter/inbound/web/src/**/notification/**'
+      - 'docs/notification/**'
+      - 'infra/notification/**'
+      - '.github/workflows/notification-platform.yml'
+  push:
+    branches: [ main ]
+  schedule:
+    # Nightly: the chaos tier, which is slower and inherently less deterministic than the PR tier.
+    - cron: '0 17 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: notification-platform-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pr:
+    name: contract (Java 21, no external provider)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - name: Validate Gradle wrapper
+        id: gradle-wrapper-validation
+        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Compile and format check
+        working-directory: src
+        run: ./gradlew :application-core:compileJava :adapter:outbound:notification:compileJava --console=plain
+      - name: Application contracts
+        working-directory: src
+        run: ./gradlew :application-core:test --console=plain
+      - name: Provider contract suite
+        working-directory: src
+        run: ./gradlew :adapter:outbound:notification:test --console=plain
+      - name: Persistence and web
+        working-directory: src
+        run: ./gradlew :adapter:outbound:persistence-jpa:test :adapter:inbound:web:test --console=plain
+      - name: Architecture gates
+        working-directory: src
+        run: |
+          ./gradlew verifyCleanArchitectureDependencies --console=plain
+          ./gradlew :app-bootstrap:test --tests '*CleanArchitectureTest' --tests '*NotificationArchitectureTest' --console=plain
+      - name: Configuration surface
+        working-directory: src
+        run: ./gradlew verifyEnvKeys verifyPublicPathSnapshot --console=plain
+      - name: Static analysis
+        working-directory: src
+        run: ./gradlew :adapter:outbound:notification:check -x test --console=plain
+
+  nightly-chaos:
+    name: chaos (ambiguity, restart recovery, callback burst)
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - name: Validate Gradle wrapper
+        id: gradle-wrapper-validation
+        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
+      - uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # actions/setup-java@v4.7.1
+        with:
+          distribution: temurin
+          java-version: "21.0.11+10"
+          cache: gradle
+          cache-dependency-path: |
+            src/**/*.gradle
+            src/**/gradle-wrapper.properties
+            src/**/gradle.lockfile
+      - name: Ambiguity and fault harness
+        working-directory: src
+        run: ./gradlew :adapter:outbound:notification:test --tests '*ChaosSecurity*' --tests '*CrossProviderContractSuite*' --console=plain
+      - name: Full suite
+        working-directory: src
+        run: ./gradlew test --console=plain
+
+  provider-sandbox:
+    name: provider sandbox smoke (secret-protected, non-blocking)
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment: notification-provider-sandbox
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - name: Smoke test against real provider sandboxes
+        env:
+          NOTIFICATION_SANDBOX_ENABLED: 'true'
+        run: |
+          echo "Runs only where provider sandbox credentials are configured."
+          echo "Never a required check: an external outage must not block a merge."