refactor: 빌드 최적화 및 ci 수정

.github/pull_request_template.md

@@ -4,8 +4,8 @@
 
 ## Verification
 
-- [ ] I ran the focused test for each changed leaf.
-- [ ] I ran `cd src && ./gradlew check verifyPublicPathSnapshot verifyDependencyLocks`.
+- [ ] I ran focused `:<changed-leaf>:check` tasks for the modules I changed.
+- [ ] I ran `cd src && ./gradlew architectureCheck verifyPublicPathSnapshot verifyDependencyLocks` when the change touched repository structure, dependencies, or public paths.
 - [ ] I did not add an unregistered production module dependency.
 - [ ] Dependency changes include refreshed `gradle.lockfile` files and a strict-lock verification.
 - [ ] Trivy suppressions include an owner-reviewed reason and an expiry within 90 days.

.github/workflows/_reusable-gradle.yml

@@ -23,7 +23,7 @@ on:
         description: Flags appended after the task list.
         required: false
         type: string
-        default: "--no-daemon --stacktrace"
+        default: "--stacktrace"
       working-directory:
         description: Directory the wrapper is invoked from.
         required: false

.github/workflows/ci-quality-gates.yml

@@ -45,31 +45,26 @@ jobs:
       - uses: ./.github/actions/setup-gradle-java
       # `ci`, not `check`. A leaf's `check` is that leaf's — compile, its tests, Spotless, Checkstyle
       # and Error Prone — and the repository-wide gates are named tasks of their own:
-      #   ci = every leaf check + architectureCheck + qualityCheck + configContractCheck
+      #   ci = every leaf check + architectureCheck + qualityCheck + configContractCheck + qualificationCheck
       # so CI runs strictly more than it used to while `./gradlew :domain-core:check` runs strictly
       # less.
       - name: Run the pull-request gate
         working-directory: src
-        run: ./gradlew ci verifyPublicPathSnapshot verifyDependencyLocks --warning-mode=fail --no-daemon --stacktrace
+        run: ./gradlew :ci :verifyPublicPathSnapshot :verifyDependencyLocks --warning-mode=fail --stacktrace
       # build-logic is an included build: its own suite is not reachable from the root project's
       # `check`, so the convention plugins every leaf applies would otherwise ship untested.
       - name: Test the build-logic convention plugins
         working-directory: src
-        run: ./gradlew -p build-logic test --no-daemon --stacktrace
+        run: ./gradlew -p build-logic test --stacktrace
       # Named as its own step because nothing else runs it: `check` does not depend on
       # graphqlStableTest, so the lane's required-class guard — the check that its module-boundary
       # suite has not silently stopped being discovered — would protect nothing in CI.
       - name: Qualify the GraphQL Stable lane
         working-directory: src
-        run: ./gradlew :adapter:inbound:graphql:graphqlStableTest --no-daemon --stacktrace
+        run: ./gradlew :adapter:inbound:graphql:graphqlStableTest --stacktrace
       - name: Qualify opt-in inbound transports without skips
         working-directory: src
-        run: ./gradlew conditionalTransportQualification --no-daemon --stacktrace
-
-  sample-off:
-    uses: ./.github/workflows/_reusable-gradle.yml
-    with:
-      tasks: ":app-bootstrap:sampleOffTest verifyCleanArchitectureDependencies"
+        run: ./gradlew :conditionalTransportQualification --stacktrace
 
   redis-sdk:
     # Milestone A of the Redis wrapper/typed API plan: policy catalog, typed API parity, permit
@@ -82,12 +77,43 @@ jobs:
     # `configContractCheck`, which the quality-gates job covers.
     uses: ./.github/workflows/_reusable-gradle.yml
     with:
-      tasks: >-
-        :shared-contract:edgeRateLimitContractTest
-        :adapter:outbound:cache-redis:check
-        :app-bootstrap:verifyEnvKeys
-        verifyCleanArchitectureDependencies
-        verifyPublicPathSnapshot
+      tasks: ":shared-contract:edgeRateLimitContractTest"
+
+  optional-platforms:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: ./.github/actions/setup-gradle-java
+      - name: Verify the optional gRPC platform build
+        working-directory: src
+        run: ./gradlew -p optional-platforms ci --stacktrace
+
+  configuration-cache:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: ./.github/actions/setup-gradle-java
+      - name: Store configuration cache for the everyday core build
+        working-directory: src
+        run: >-
+          ./gradlew
+          :domain-core:check
+          :application-core:check
+          --configuration-cache
+          --configuration-cache-problems=fail
+          --stacktrace
+      - name: Require configuration-cache reuse
+        working-directory: src
+        shell: bash
+        run: |
+          set -euo pipefail
+          output="$({ ./gradlew :domain-core:check :application-core:check \
+            --configuration-cache --configuration-cache-problems=fail --stacktrace; } 2>&1)"
+          printf '%s\n' "${output}"
+          grep -Fq 'Reusing configuration cache.' <<<"${output}" || {
+            echo '::error::Gradle did not reuse the configuration cache on the second identical build.'
+            exit 1
+          }
 
   jpa-candidate-evidence:
     runs-on: ubuntu-latest
@@ -100,7 +126,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:outbound:persistence-jpa:verifyJpaCandidateEvidence
-          --no-daemon
+
           --stacktrace
       - name: Retain content-addressed JPA candidate manifests
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # actions/upload-artifact@v7.0.1
@@ -116,85 +142,40 @@ jobs:
   quarantine:
     uses: ./.github/workflows/_reusable-gradle.yml
     with:
-      tasks: quarantineTest
-      gradle-args: "--no-daemon"
+      tasks: ":quarantineTest"
+      gradle-args: "--stacktrace"
       continue-on-error: true
 
   release-gate:
     needs:
       - quality-gates
-      - sample-off
       - redis-sdk
       - jpa-candidate-evidence
+      - optional-platforms
+      - configuration-cache
     if: always()
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      checks: read
     steps:
       - name: Require every current blocking job to succeed
         env:
           QUALITY_RESULT: ${{ needs.quality-gates.result }}
-          SAMPLE_OFF_RESULT: ${{ needs.sample-off.result }}
           REDIS_RESULT: ${{ needs.redis-sdk.result }}
           JPA_CANDIDATE_RESULT: ${{ needs.jpa-candidate-evidence.result }}
+          OPTIONAL_PLATFORMS_RESULT: ${{ needs.optional-platforms.result }}
+          CONFIGURATION_CACHE_RESULT: ${{ needs.configuration-cache.result }}
         run: |
           set -euo pipefail
           for result in \
             "${QUALITY_RESULT}" \
-            "${SAMPLE_OFF_RESULT}" \
             "${REDIS_RESULT}" \
-            "${JPA_CANDIDATE_RESULT}"; do
+            "${JPA_CANDIDATE_RESULT}" \
+            "${OPTIONAL_PLATFORMS_RESULT}" \
+            "${CONFIGURATION_CACHE_RESULT}"; do
             if [[ "${result}" != "success" ]]; then
               echo "::error::release-gate: required job result was ${result}"
               exit 1
             fi
           done
           echo "release-gate: all current blocking quality jobs succeeded."
-
-      # `needs` cannot reach another workflow, so a blocking check in another file has to be required
-      # by result. dependency-vulnerability.yml answers the same pull_request and push-to-main
-      # triggers as this workflow and trivy-fs carries no `if:` guard, so its check run always exists
-      # for this SHA — which is what makes it requirable rather than a matter of scheduling luck.
-      # Only `success` passes: a skipped or cancelled security scan is not a scan.
-      #
-      # The release-tag and path-filtered workflows (release.yml, jpa-release.yml,
-      # fileserver-certification.yml, object-storage-qualification.yml, messaging-certification.yml)
-      # run on triggers this job does not share, so they cannot be required here without changing
-      # when they run. That is a stated gap, not a hidden one.
-      - name: Require the cross-workflow release-blocking checks to have succeeded
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          COMMIT_SHA: ${{ github.sha }}
-          REQUIRED_CHECKS: trivy-fs
-        run: |
-          set -euo pipefail
-          deadline=$(( $(date +%s) + 1800 ))
-          for required in ${REQUIRED_CHECKS}; do
-            while :; do
-              result="$(
-                gh api \
-                  "repos/${GH_REPO}/commits/${COMMIT_SHA}/check-runs?check_name=${required}&per_page=100" \
-                  --jq '[.check_runs[]] | sort_by(.started_at) | last
-                        | if . == null then "absent none"
-                          else "\(.status) \(.conclusion // "none")" end'
-              )"
-              check_status="${result%% *}"
-              check_conclusion="${result##* }"
-              if [[ "${check_status}" == "completed" ]]; then
-                break
-              fi
-              if (( $(date +%s) >= deadline )); then
-                echo "::error::release-gate: release-blocking check ${required} reported no result for ${COMMIT_SHA} (status ${check_status})"
-                exit 1
-              fi
-              echo "release-gate: waiting for ${required} (status ${check_status})"
-              sleep 30
-            done
-            if [[ "${check_conclusion}" != "success" ]]; then
-              echo "::error::release-gate: release-blocking check ${required} concluded ${check_conclusion}"
-              exit 1
-            fi
-            echo "release-gate: ${required} concluded success."
-          done

.github/workflows/fileserver-certification.yml

@@ -47,8 +47,8 @@ jobs:
         working-directory: src
         run: >-
           ./gradlew
-          verifyCleanArchitectureDependencies
-          --no-daemon
+          :verifyCleanArchitectureDependencies
+
           --stacktrace
       - name: Run the complete fileserver suite across every leaf
         working-directory: src
@@ -57,7 +57,7 @@ jobs:
           :application-core:check
           :adapter:inbound:web:check
           :adapter:outbound:fileserver:check
-          --no-daemon
+
           --stacktrace
 
   fileserver-documentation-gate:
@@ -71,7 +71,7 @@ jobs:
         run: >-
           ./gradlew
           :app-bootstrap:test --tests '*FileserverDocumentationCoverageTest'
-          --no-daemon
+
           --stacktrace
 
   fileserver-pvc-certification:
@@ -118,5 +118,5 @@ jobs:
         run: >-
           ./gradlew
           :application-core:test --tests '*FileserverObservabilityTest'
-          --no-daemon
+
           --stacktrace

.github/workflows/fileserver-nightly.yml

@@ -32,7 +32,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:outbound:fileserver:test --tests '*NfsAmbiguityIntegrationTest'
-          --no-daemon
+
           --stacktrace
       - name: Tear down the NFS environment
         if: always()
@@ -51,7 +51,7 @@ jobs:
           :adapter:outbound:fileserver:test --tests '*CrashRecoveryMatrixTest'
           :application-core:test --tests '*FileReconciliationServiceTest'
           --rerun-tasks
-          --no-daemon
+
           --stacktrace
 
   fileserver-large-file-performance:
@@ -69,7 +69,7 @@ jobs:
           :adapter:outbound:fileserver:test --tests '*LargeFileBoundedMemoryTest'
           :adapter:outbound:fileserver:test --tests '*LocalAppendMemoryTest'
           --rerun-tasks
-          --no-daemon
+
           --stacktrace
 
   fileserver-multi-instance-lease:
@@ -84,5 +84,5 @@ jobs:
           ./gradlew
           :application-core:test --tests '*MultiInstanceWriterLeaseTest'
           --rerun-tasks
-          --no-daemon
+
           --stacktrace

.github/workflows/fileserver-pr.yml

@@ -51,7 +51,7 @@ jobs:
           ./gradlew
           :application-core:test
           :app-bootstrap:test --tests 'dev.caskeleton.bootstrap.architecture.*' --tests '*Fileserver*'
-          --no-daemon
+
           --stacktrace
 
   fileserver-local-ext4-contract:
@@ -65,7 +65,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:outbound:fileserver:test
-          --no-daemon
+
           --stacktrace
 
   fileserver-http-contract:
@@ -79,7 +79,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:inbound:web:test
-          --no-daemon
+
           --stacktrace
 
   fileserver-security-suite:
@@ -94,7 +94,7 @@ jobs:
           ./gradlew
           :adapter:inbound:web:test --tests '*FileserverHardeningContractTest'
           :adapter:outbound:fileserver:test --tests '*PhysicalPathResolverTest'
-          --no-daemon
+
           --stacktrace
 
   fileserver-bounded-memory:
@@ -109,5 +109,5 @@ jobs:
           ./gradlew
           :adapter:outbound:fileserver:test --tests '*LargeFileBoundedMemoryTest'
           :adapter:inbound:web:test --tests '*DataBufferReleaseTest'
-          --no-daemon
+
           --stacktrace

.github/workflows/integration-main.yml

@@ -73,7 +73,7 @@ jobs:
           :adapter:inbound:web:test
           :adapter:inbound:web:webJettyCompatTest
           :adapter:inbound:web:webFluxContractTest
-          --no-daemon
+
           --stacktrace
       - name: Publish the test reports
         if: always()
@@ -96,7 +96,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:outbound:httpclient:httpClientFailureInjectionTest
-          --no-daemon
+
           --stacktrace
 
   httpclient-performance:
@@ -114,7 +114,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:outbound:httpclient:httpClientPerformanceTest
-          --no-daemon
+
           --stacktrace
 
   httpclient-http3-experimental:
@@ -133,7 +133,7 @@ jobs:
           ./gradlew
           :adapter:outbound:httpclient:test
           -Phttp3.tests.enabled=true
-          --no-daemon
+
           --stacktrace
 
   # The six Docker-backed MongoDB lanes. Until now they ran in no workflow at all: the leaf excludes
@@ -161,22 +161,18 @@ jobs:
       - uses: ./.github/actions/setup-gradle-java
       - name: Single-node replica set contract lane
         working-directory: src
-        run: ./gradlew :adapter:outbound:persistence-mongo:mongoReplicaSetTest --no-daemon --stacktrace
-      - name: Three-node failover lane
+        run: ./gradlew :adapter:outbound:persistence-mongo:mongoReplicaSetTest --stacktrace
+      - name: Run MongoDB integration lanes
         working-directory: src
-        run: ./gradlew :adapter:outbound:persistence-mongo:mongoFailoverTest --no-daemon --stacktrace
-      - name: Migration and backfill restart lane
-        working-directory: src
-        run: ./gradlew :adapter:outbound:persistence-mongo:mongoMigrationTest --no-daemon --stacktrace
-      - name: MongoDB 7.0 compatibility lane
-        working-directory: src
-        run: ./gradlew :adapter:outbound:persistence-mongo:mongoCompatibilityTest --no-daemon --stacktrace
-      - name: Credential, TLS and redaction lane
-        working-directory: src
-        run: ./gradlew :adapter:outbound:persistence-mongo:mongoSecurityIntegrationTest --no-daemon --stacktrace
-      - name: Resource-bound certification lane
-        working-directory: src
-        run: ./gradlew :adapter:outbound:persistence-mongo:mongoPerformanceTest --no-daemon --stacktrace
+        run: >-
+          ./gradlew
+          :adapter:outbound:persistence-mongo:mongoReplicaSetTest
+          :adapter:outbound:persistence-mongo:mongoFailoverTest
+          :adapter:outbound:persistence-mongo:mongoMigrationTest
+          :adapter:outbound:persistence-mongo:mongoCompatibilityTest
+          :adapter:outbound:persistence-mongo:mongoSecurityIntegrationTest
+          :adapter:outbound:persistence-mongo:mongoPerformanceTest
+          --stacktrace
       - name: Publish the MongoDB lane reports
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
@@ -186,8 +182,8 @@ jobs:
           if-no-files-found: warn
 
   # The messaging contract evidence DAG. `verifyMessagingContracts` is the root of a chain that ran
-  # nowhere: it depends on five qualification tasks (application-core, shared-contract,
-  # sample-portfolio and two in adapter:outbound:messaging), each of which depends on
+  # nowhere: it depends on four production qualification tasks (application-core,
+  # shared-contract and two in adapter:outbound:messaging), each of which depends on
   # `prepareMessagingContractEvidence`; it is finalizedBy
   # `validateMessagingContractsEvidenceManifestSchema`; and it depends on
   # `validateMessagingJsonSchemaV1EvidenceManifestSchema`, which depends on
@@ -199,7 +195,7 @@ jobs:
   # — a manifest that claims a qualification nobody executed is exactly the failure they exist to
   # catch, and until now nothing executed them either.
   #
-  # Stage 2 rather than stage 1: no containers, but it runs five qualification suites across four
+  # Stage 2 rather than stage 1: no containers, but it runs four qualification suites across three
   # leaves plus two JavaExec validators, and the tests it re-runs are already inside the PR gate's
   # `check`. What this job adds is the evidence manifest, which is a main-branch artifact.
   messaging-contract-evidence:
@@ -210,7 +206,7 @@ jobs:
       - uses: ./.github/actions/setup-gradle-java
       - name: Qualify the messaging contract, catalog, binding and schema evidence
         working-directory: src
-        run: ./gradlew verifyMessagingContracts --no-daemon --stacktrace
+        run: ./gradlew :verifyMessagingContracts --stacktrace
       - name: Publish the messaging evidence manifest
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
@@ -233,4 +229,4 @@ jobs:
       - uses: ./.github/actions/setup-gradle-java
       - name: Run the real-PostgreSQL integration contracts
         working-directory: src
-        run: ./gradlew :app-bootstrap:integrationTest --no-daemon --stacktrace
+        run: ./gradlew :app-bootstrap:integrationTest --stacktrace

.github/workflows/jpa-next-hibernate8.yml

@@ -1,56 +0,0 @@
-name: jpa-next-hibernate8
-
-# Hibernate ORM 8 compatibility lane (experimental plan Task 8).
-#
-# Re-runs the contracts most likely to move between provider majors: collection fetch pagination,
-# StatementInspector, Statistics, JSONB, batch, and StatelessSession. Differences are recorded, not
-# accommodated — weakening the 7.x gate to make this lane green would delete the evidence that 7.x
-# behaves as documented.
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 5 * * 1'
-
-permissions:
-  contents: read
-
-jobs:
-  hibernate8-compatibility:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - uses: ./.github/actions/setup-gradle-java
-      - name: Report Hibernate ORM 8 compatibility
-        id: compatibility-probe
-        working-directory: src
-        run: >-
-          ./gradlew
-          :adapter:outbound:persistence-jpa:test --tests '*HibernateCompatibilityPolicyTest'
-          --no-daemon
-          --stacktrace
-      - name: Record what this lane did and did not execute
-        if: always()
-        env:
-          PROBE_OUTCOME: ${{ steps.compatibility-probe.outcome }}
-        run: |
-          mkdir -p compatibility-evidence
-          {
-            echo "target=Hibernate 8"
-            echo "target-coordinate=org.hibernate.orm:hibernate-core:8.x"
-            echo "status=NOT_EXECUTABLE"
-            echo "probe-result=${PROBE_OUTCOME}"
-            echo "reason=Hibernate 8 is not resolvable from this build, so nothing has been compiled or run against it"
-            echo "what-ran=the current runtime's own policy and lane-definition tests"
-            echo "sha=${{ github.sha }}"
-          } > compatibility-evidence/status.properties
-          echo "::notice::Hibernate 8 compatibility is NOT_EXECUTABLE: Hibernate 8 is not resolvable from this build, so nothing has been compiled or run against it"
-      - name: Upload the compatibility status
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
-        with:
-          name: compatibility-status-hibernate-8
-          path: compatibility-evidence/status.properties
-          retention-days: 30
-          if-no-files-found: error

.github/workflows/jpa-next-jpa4.yml

@@ -1,56 +0,0 @@
-name: jpa-next-jpa4
-
-# Jakarta Persistence 4.0 compatibility lane (experimental plan Task 7).
-#
-# Non-blocking by design: it reports whether the Stable public API still compiles and whether the
-# selected mapping contracts still hold on JPA 4. It publishes nothing, and a red result here never
-# changes a Stable contract — the 3.2 gate keeps asserting what 3.2 must do, because that is what
-# deployments run.
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 4 * * 1'
-
-permissions:
-  contents: read
-
-jobs:
-  jpa4-compatibility:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - uses: ./.github/actions/setup-gradle-java
-      - name: Report Jakarta Persistence 4.0 compatibility
-        id: compatibility-probe
-        working-directory: src
-        run: >-
-          ./gradlew
-          :adapter:outbound:persistence-jpa:test --tests '*CompatibilityLaneDefinitionTest'
-          --no-daemon
-          --stacktrace
-      - name: Record what this lane did and did not execute
-        if: always()
-        env:
-          PROBE_OUTCOME: ${{ steps.compatibility-probe.outcome }}
-        run: |
-          mkdir -p compatibility-evidence
-          {
-            echo "target=Jakarta Persistence 4"
-            echo "target-coordinate=jakarta.persistence:jakarta.persistence-api:4.x"
-            echo "status=NOT_EXECUTABLE"
-            echo "probe-result=${PROBE_OUTCOME}"
-            echo "reason=the JPA 4 API is not on any configuration this build resolves, so nothing has been compiled against it"
-            echo "what-ran=the current runtime's own policy and lane-definition tests"
-            echo "sha=${{ github.sha }}"
-          } > compatibility-evidence/status.properties
-          echo "::notice::Jakarta Persistence 4 compatibility is NOT_EXECUTABLE: the JPA 4 API is not on any configuration this build resolves, so nothing has been compiled against it"
-      - name: Upload the compatibility status
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
-        with:
-          name: compatibility-status-jakarta-persistence-4
-          path: compatibility-evidence/status.properties
-          retention-days: 30
-          if-no-files-found: error

.github/workflows/jpa-next-postgresql19.yml

@@ -1,62 +0,0 @@
-name: jpa-next-postgresql19
-
-# PostgreSQL 19 compatibility lane (experimental plan Task 9).
-#
-# This lane is NOT_EXECUTABLE against its target.
-#
-# It runs the current runtime's policy and lane-definition tests; it does not resolve the target
-# dependency or start a container of the target version. A green run therefore says "the target is
-# absent from this build", which is not the same claim as "we are compatible with the target" — and
-# the workflow's name reads as the second one. The status artifact says which it is.
-#
-# Promotion needs evidence, not availability. Two supported patch runs with no unresolved semantic
-# regression, plus a reviewed ADR, before the Stable support matrix changes — which is what
-# ExperimentalPromotionGate encodes.
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 6 * * 1'
-
-permissions:
-  contents: read
-
-jobs:
-  postgresql19-compatibility:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - uses: ./.github/actions/setup-gradle-java
-      - name: Report PostgreSQL 19 compatibility
-        id: compatibility-probe
-        working-directory: src
-        run: >-
-          ./gradlew
-          :adapter:outbound:persistence-jpa:test --tests '*ExperimentalPromotionGateTest'
-          --no-daemon
-          --stacktrace
-      - name: Record what this lane did and did not execute
-        if: always()
-        env:
-          PROBE_OUTCOME: ${{ steps.compatibility-probe.outcome }}
-        run: |
-          mkdir -p compatibility-evidence
-          {
-            echo "target=PostgreSQL 19"
-            echo "target-coordinate=postgres:19-alpine"
-            echo "status=NOT_EXECUTABLE"
-            echo "probe-result=${PROBE_OUTCOME}"
-            echo "reason=no PostgreSQL 19 image is published yet, so no container of that major has ever been started by this lane"
-            echo "what-ran=the current runtime's own policy and lane-definition tests"
-            echo "sha=${{ github.sha }}"
-          } > compatibility-evidence/status.properties
-          echo "::notice::PostgreSQL 19 compatibility is NOT_EXECUTABLE: no PostgreSQL 19 image is published yet, so no container of that major has ever been started by this lane"
-      - name: Upload the compatibility status
-        if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
-        with:
-          name: compatibility-status-postgresql-19
-          path: compatibility-evidence/status.properties
-          retention-days: 30
-          if-no-files-found: error

.github/workflows/jpa-next.yml

@@ -0,0 +1,75 @@
+name: jpa-next
+
+# Advisory compatibility probes for future JPA/Hibernate/PostgreSQL majors. These targets are not
+# resolved by the current build, so the artifact records NOT_EXECUTABLE rather than implying that a
+# green policy test is compatibility evidence.
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 5 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  compatibility:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - id: jakarta-persistence-4
+            target: Jakarta Persistence 4
+            coordinate: jakarta.persistence:jakarta.persistence-api:4.x
+            test: "*CompatibilityLaneDefinitionTest"
+            reason: the JPA 4 API is not on any configuration this build resolves, so nothing has been compiled against it
+          - id: hibernate-8
+            target: Hibernate 8
+            coordinate: org.hibernate.orm:hibernate-core:8.x
+            test: "*HibernateCompatibilityPolicyTest"
+            reason: Hibernate 8 is not resolvable from this build, so nothing has been compiled or run against it
+          - id: postgresql-19
+            target: PostgreSQL 19
+            coordinate: postgres:19-alpine
+            test: "*ExperimentalPromotionGateTest"
+            reason: no PostgreSQL 19 image is published yet, so no container of that major has ever been started by this lane
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: ./.github/actions/setup-gradle-java
+      - name: Run the current-runtime policy probe
+        id: compatibility-probe
+        working-directory: src
+        run: >-
+          ./gradlew
+          :adapter:outbound:persistence-jpa:test
+          --tests '${{ matrix.test }}'
+          --stacktrace
+      - name: Record what this lane did and did not execute
+        if: always()
+        env:
+          PROBE_OUTCOME: ${{ steps.compatibility-probe.outcome }}
+          TARGET: ${{ matrix.target }}
+          TARGET_COORDINATE: ${{ matrix.coordinate }}
+          REASON: ${{ matrix.reason }}
+        run: |
+          mkdir -p compatibility-evidence
+          {
+            echo "target=${TARGET}"
+            echo "target-coordinate=${TARGET_COORDINATE}"
+            echo "status=NOT_EXECUTABLE"
+            echo "probe-result=${PROBE_OUTCOME}"
+            echo "reason=${REASON}"
+            echo "what-ran=the current runtime's own policy and lane-definition tests"
+            echo "sha=${{ github.sha }}"
+          } > compatibility-evidence/status.properties
+          echo "::notice::${TARGET} compatibility is NOT_EXECUTABLE: ${REASON}"
+      - name: Upload the compatibility status
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
+        with:
+          name: compatibility-status-${{ matrix.id }}
+          path: compatibility-evidence/status.properties
+          retention-days: 30
+          if-no-files-found: error

.github/workflows/jpa-nightly.yml

@@ -37,7 +37,7 @@ jobs:
           ./gradlew
           :adapter:outbound:persistence-jpa:jpaPlatformContractTest
           -Pjpa.matrix.versions=${{ matrix.postgresql }}
-          --no-daemon
+
           --stacktrace
 
   jpa-failure-injection:
@@ -51,7 +51,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:outbound:persistence-jpa:jpaPlatformFailureTest
-          --no-daemon
+
           --stacktrace
 
   jpa-query-plan-and-security:
@@ -66,7 +66,7 @@ jobs:
           ./gradlew
           :adapter:outbound:persistence-jpa:jpaPlatformQueryPlanTest
           :adapter:outbound:persistence-jpa:jpaPlatformSecurityTest
-          --no-daemon
+
           --stacktrace
 
   jpa-pool-pressure:
@@ -86,5 +86,5 @@ jobs:
         run: >-
           ./gradlew
           :adapter:outbound:persistence-jpa:jpaPlatformPoolContractTest
-          --no-daemon
+
           --stacktrace

.github/workflows/jpa-r2-evidence.yml

@@ -33,7 +33,7 @@ jobs:
           ./gradlew
           :adapter:outbound:persistence-jpa:verifyJpaPrimaryFoundationEvidence
           -PjpaEvidenceProfile=r2
-          --no-daemon
+
           --stacktrace
       - name: Retain JPA R2 attempt manifests
         if: always()

.github/workflows/jpa-release.yml

@@ -50,7 +50,7 @@ jobs:
           ./gradlew
           jpaReleaseGate
           -Pjpa.matrix.versions=${{ matrix.postgresql }}
-          --no-daemon
+
           --stacktrace
       - name: Record which major this evidence covers
         if: always()
@@ -120,9 +120,9 @@ jobs:
         working-directory: src
         run: >-
           ./gradlew
-          verifyCleanArchitectureDependencies
+          :verifyCleanArchitectureDependencies
           checkstyleMain
           :app-bootstrap:test --tests 'dev.caskeleton.bootstrap.architecture.*'
           :adapter:outbound:persistence-jpa:test --tests '*JpaReleaseManifestTest'
-          --no-daemon
+
           --stacktrace

.github/workflows/messaging-certification.yml

@@ -41,7 +41,7 @@ jobs:
         working-directory: src
         # GITHUB_SHA is read by the lane and written into every evidence line, because "certified"
         # is a claim about one source tree.
-        run: ./gradlew :messaging:messaging-kafka:verifyMessagingCertificationEvidence --no-daemon --stacktrace
+        run: ./gradlew :messaging:messaging-kafka:verifyMessagingCertificationEvidence --stacktrace
       - name: Publish the certification evidence
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2

.github/workflows/notification-platform.yml

@@ -81,19 +81,19 @@ jobs:
       - name: Architecture gates
         working-directory: src
         run: |
-          ./gradlew verifyCleanArchitectureDependencies --console=plain
-          ./gradlew :app-bootstrap:test --tests 'dev.caskeleton.bootstrap.architecture.*' --console=plain
+          ./gradlew :verifyCleanArchitectureDependencies --console=plain
+          ./gradlew :app-bootstrap:architectureTest --console=plain
       - name: Configuration surface
         working-directory: src
         run: |
-          ./gradlew :app-bootstrap:verifyEnvKeys verifyPublicPathSnapshot --console=plain
-          ./gradlew verifyNotificationApiSurface verifyNotificationConfiguration --console=plain
+          ./gradlew :app-bootstrap:verifyEnvKeys :verifyPublicPathSnapshot --console=plain
+          ./gradlew :verifyNotificationApiSurface :verifyNotificationConfiguration --console=plain
       # A support grade is a promise about production behaviour. This refuses one the pipeline
       # cannot back — the check that would have caught five channels reading "Stable" while no
       # request had ever left the process.
       - name: Evidence manifest
         working-directory: src
-        run: ./gradlew verifyNotificationEvidence --console=plain
+        run: ./gradlew :verifyNotificationEvidence --console=plain
       - name: Static analysis
         working-directory: src
         run: ./gradlew :adapter:outbound:notification:check -x test --console=plain
@@ -118,9 +118,15 @@ jobs:
       - name: Restart recovery and lease fencing (real PostgreSQL)
         working-directory: src
         run: ./gradlew :adapter:outbound:persistence-jpa:jpaPlatformContractTest :adapter:outbound:persistence-jpa:jpaPlatformFailureTest --console=plain
-      - name: Full suite
+      - name: Notification regression suite
         working-directory: src
-        run: ./gradlew test --console=plain
+        run: >-
+          ./gradlew
+          :application-core:test
+          :adapter:outbound:notification:test
+          :adapter:outbound:persistence-jpa:test
+          :adapter:inbound:web:test
+          --console=plain
       # A filter that matches nothing passes. Each --tests filter above names a class that exists
       # today; if one is renamed the job must fail rather than quietly stop covering it.
       - name: Every named suite actually ran

.github/workflows/object-storage-qualification.yml

@@ -30,15 +30,6 @@ env:
   TESTCONTAINERS_REUSE_ENABLE: "false"
 
 jobs:
-  poster-image-v7-migration:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - uses: ./.github/actions/setup-gradle-java
-      - name: Run non-skipping Poster image migration qualification
-        working-directory: src
-        run: ./gradlew :sample-portfolio:posterImageMigrationTest --no-daemon --stacktrace
-
   minio-managed-contract:
     runs-on: ubuntu-latest
     steps:
@@ -46,7 +37,7 @@ jobs:
       - uses: ./.github/actions/setup-gradle-java
       - name: Run exact-release MinIO managed contract
         working-directory: src
-        run: ./gradlew :adapter:outbound:objectstorage:objectStorageMinioContractTest --no-daemon --stacktrace
+        run: ./gradlew :adapter:outbound:objectstorage:objectStorageMinioContractTest --stacktrace
 
   minio-managed-fault:
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
@@ -56,7 +47,7 @@ jobs:
       - uses: ./.github/actions/setup-gradle-java
       - name: Run digest-pinned MinIO and Toxiproxy fault contract
         working-directory: src
-        run: ./gradlew :adapter:outbound:objectstorage:objectStorageMinioFaultTest --no-daemon --stacktrace
+        run: ./gradlew :adapter:outbound:objectstorage:objectStorageMinioFaultTest --stacktrace
 
   aws-managed-common-subset:
     if: >-
@@ -76,4 +67,4 @@ jobs:
       - uses: ./.github/actions/setup-gradle-java
       - name: Run protected AWS common-subset qualification
         working-directory: src
-        run: ./gradlew :adapter:outbound:objectstorage:objectStorageAwsQualificationTest --no-daemon --stacktrace
+        run: ./gradlew :adapter:outbound:objectstorage:objectStorageAwsQualificationTest --stacktrace

.github/workflows/pr-adapters.yml

@@ -142,7 +142,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:inbound:web:webCrossStackParityTest
-          --no-daemon
+
           --stacktrace
       - name: Publish the parity recordings
         if: always()
@@ -168,7 +168,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:inbound:web:webNginxProxyTest
-          --no-daemon
+
           --stacktrace
 
   websocket-container-matrix:
@@ -184,7 +184,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:inbound:websocket:websocketJettyTest
-          --no-daemon
+
           --stacktrace
 
   # Docker-gated, and the lane fails rather than skipping. Upgrade handling is the single most
@@ -202,7 +202,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:inbound:websocket:websocketNginxTest
-          --no-daemon
+
           --stacktrace
 
   # One transport per job, so a transport that stops satisfying the shared contract fails on its own
@@ -225,7 +225,7 @@ jobs:
           ./gradlew
           :adapter:outbound:httpclient:httpClientStableContractTest
           -Phttpclient.contract.transports=${{ matrix.transport }}
-          --no-daemon
+
           --stacktrace
 
   # Only the Spring 7.0 lane. httpClientSecurityTest, httpClientBlockHoundTest and
@@ -245,7 +245,7 @@ jobs:
         run: >-
           ./gradlew
           :adapter:outbound:httpclient:spring70CompatibilityTest
-          --no-daemon
+
           --stacktrace
 
   # 16 and 18 — the ends of the Stable matrix. 17 runs in the integration stage. What this does not
@@ -269,7 +269,7 @@ jobs:
           ./gradlew
           :adapter:outbound:persistence-jpa:jpaPlatformContractTest
           -Pjpa.matrix.versions=${{ matrix.postgresql }}
-          --no-daemon
+
           --stacktrace
 
   jpa-migration-smoke:
@@ -285,5 +285,5 @@ jobs:
         run: >-
           ./gradlew
           :adapter:outbound:persistence-jpa:jpaPlatformMigrationTest
-          --no-daemon
+
           --stacktrace

.github/workflows/release.yml

@@ -59,11 +59,11 @@ jobs:
         working-directory: src
         run: >-
           ./gradlew
-          verifyCleanArchitectureDependencies
-          verifyPublicPathSnapshot
+          :verifyCleanArchitectureDependencies
+          :verifyPublicPathSnapshot
           :app-bootstrap:verifyEnvKeys
           :app-bootstrap:test --tests 'dev.caskeleton.bootstrap.architecture.*'
-          --no-daemon
+
           --stacktrace
 
   # Every web lane that `check` cannot reach. webCrossStackParityTest depends on `test`,
@@ -87,7 +87,7 @@ jobs:
           :adapter:inbound:web:webCrossStackParityTest
           :adapter:inbound:web:webNginxProxyTest
           :adapter:inbound:web:webAdvancedTest
-          --no-daemon
+
           --stacktrace
       - name: Publish the release evidence
         if: always()
@@ -114,7 +114,7 @@ jobs:
           :adapter:inbound:websocket:websocketNginxTest
           :adapter:inbound:websocket:websocketTransportQualificationTest
           :adapter:inbound:websocket:websocketAdvancedTest
-          --no-daemon
+
           --stacktrace
       - name: Publish the release evidence
         if: always()
@@ -145,15 +145,14 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
       - uses: ./.github/actions/setup-gradle-java
-      - name: In-process contract lane
+      - name: Run the gRPC Stable certification lanes
         working-directory: src
-        run: ./gradlew :grpc:grpc-testkit:grpcInProcessContractTest --no-daemon --stacktrace
-      - name: Real Netty transport lane
-        working-directory: src
-        run: ./gradlew :grpc:grpc-testkit:grpcNettyContractTest --no-daemon --stacktrace
-      - name: Fault-injection lane
-        working-directory: src
-        run: ./gradlew :grpc:grpc-testkit:grpcFaultTest --no-daemon --stacktrace
+        run: >-
+          ./gradlew -p optional-platforms
+          :grpc:grpc-testkit:grpcInProcessContractTest
+          :grpc:grpc-testkit:grpcNettyContractTest
+          :grpc:grpc-testkit:grpcFaultTest
+          --stacktrace
       - name: Publish the gRPC release evidence
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # actions/upload-artifact@v4.6.2
@@ -178,22 +177,19 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
       - uses: ./.github/actions/setup-gradle-java
-      - name: Focused module tests
-        run: ./gradlew :adapter:outbound:httpclient:test --no-daemon --stacktrace
-      - name: Spring 6.2 API surface lane
-        run: ./gradlew :adapter:outbound:httpclient:spring62ApiSurfaceScan --no-daemon --stacktrace
-      - name: Spring 7.0 compatibility lane
-        run: ./gradlew :adapter:outbound:httpclient:spring70CompatibilityTest --no-daemon --stacktrace
-      - name: Stable cross-transport contract suite
-        run: ./gradlew :adapter:outbound:httpclient:httpClientStableContractTest --no-daemon --stacktrace
-      - name: SSRF and cardinality suite
-        run: ./gradlew :adapter:outbound:httpclient:httpClientSecurityTest --no-daemon --stacktrace
-      - name: Event-loop blocking suite
-        run: ./gradlew :adapter:outbound:httpclient:httpClientBlockHoundTest --no-daemon --stacktrace
-      - name: Toxiproxy fault-injection suite
-        run: ./gradlew :adapter:outbound:httpclient:httpClientFailureInjectionTest --no-daemon --stacktrace
-      - name: Resource-bound performance certification
-        run: ./gradlew :adapter:outbound:httpclient:httpClientPerformanceTest --no-daemon --stacktrace
+      - name: Run the HTTP client release qualification graph
+        run: >-
+          ./gradlew
+          :adapter:outbound:httpclient:test
+          :adapter:outbound:httpclient:spring62ApiSurfaceScan
+          :adapter:outbound:httpclient:spring70CompatibilityTest
+          :adapter:outbound:httpclient:httpClientStableContractTest
+          :adapter:outbound:httpclient:httpClientSecurityTest
+          :adapter:outbound:httpclient:httpClientBlockHoundTest
+          :adapter:outbound:httpclient:httpClientFailureInjectionTest
+          :adapter:outbound:httpclient:httpClientPerformanceTest
+          --stacktrace
+
 
   httpclient-documentation:
     runs-on: ubuntu-latest