feat: jpa, messaging, notification, mongo, graphql 어댑터터 리펙토링

2026-08-18 10:59:56 +09:00
parent 2f5d2fc219
commit e98b56eb03
372 changed files with 25131 additions and 20357 deletions
@@ -20,12 +20,15 @@ env_keys:
  # === Profile / Identity (feature-env-driven-runtime-configuration) ===

  - name: SPRING_PROFILES_ACTIVE
-    # source: feature-env-driven-runtime-configuration D6 (2026-06-06)
-    # Profile selector is Spring-native and sole (APP_PROFILE was dropped). Unset
-    # -> local fallback in application.yml for early Boot profile binding.
-    type: csv_list
-    default: local
-    allowed_values: [local, dev, staging, prod, sample]
+    # source: feature-env-driven-runtime-configuration D6 (2026-06-06), amended by
+    # five-adapter-runtime-remediation §7.1. Profile selector is Spring-native and sole
+    # (APP_PROFILE was dropped). Exactly one value, not a CSV list: two environments cannot both
+    # have their safety rules apply, and whichever lost did so silently.
+    type: enum
+    # No default. A profile that is guessed is a deployment nobody chose: a jar started
+    # with none used to become local, which before persistence was gated also meant an
+    # in-memory database that loses every write on restart.
+    allowed_values: [local, dev, prod]
    classification: public-config
    required: true
    reload_policy: restart-only
@@ -389,14 +392,19 @@ env_keys:
  - name: APP_DATASOURCE_CONNECTION_TIMEOUT
    # source: feature-env-driven-runtime-configuration "datasource/pool env"
    #         + feature-persistence-failure-baseline "Hikari Alert Threshold: pool wait p99 > 100ms"
-    type: duration
-    default: 5s
+    # unit: milliseconds. It feeds spring.datasource.hikari.connection-timeout, which binds onto
+    # HikariConfig#setConnectionTimeout(long) — a duration shorthand such as "5s" does not bind and
+    # fails the boot. This row said `duration` / `5s`, application.yml copied that default, and
+    # every prod and dev deployment refused to start; five-adapter-runtime-remediation Wave 2 found
+    # it in the prod-smoke lane. Corrected to what the property actually accepts.
+    type: integer
+    default: 5000
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
-    validation: spring_duration_shorthand
+    validation: positive_integer_milliseconds
    compatibility_impact: behavior-change
    required_test: env-contract:connection-timeout-set

@@ -4250,6 +4258,117 @@ env_keys:
  # default. Every key carries an inline default so a deployment that leaves the platform off
  # supplies nothing. Reference: docs/notification/configuration.md.

+  - name: APP_PERSISTENCE_JPA_ENABLED
+    # source: five-adapter-runtime-remediation §5.1 — master switch for relational persistence.
+    # false means no DataSource, no entity scan, no repositories, no Hibernate, no Flyway and no DB
+    # health contributor; the old app.jpa-platform.enabled gated three add-on beans while reading
+    # like this one and defaulting to on.
+    type: boolean
+    default: false
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-five-adapter-activation
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:persistence-jpa-disabled-safe
+  - name: APP_PERSISTENCE_MONGO_ENABLED
+    # source: five-adapter-runtime-remediation §5.1 — master switch for MongoDB persistence.
+    type: boolean
+    default: false
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-five-adapter-activation
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:persistence-mongo-disabled-safe
+  - name: APP_PERSISTENCE_MONGO_ACTIVE_PROFILE
+    # source: five-adapter-runtime-remediation §5.1 — selects exactly one Mongo profile. The runtime
+    # builds one sync client and one pool; a profile present in the map but not selected has neither
+    # its secret resolved nor a client created.
+    type: string
+    default: ""
+    classification: public-config
+    required: false
+    required_when: APP_PERSISTENCE_MONGO_ENABLED=true
+    reload_policy: restart-only
+    owner_branch: worktree-five-adapter-activation
+    validation: nonblank-when-required
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:persistence-mongo-active-profile
+  - name: APP_MESSAGING_ENABLED
+    # source: five-adapter-runtime-remediation §5.1 — master switch for broker publication.
+    # APP_MESSAGING_BROKER selects which transport and is no longer the de-facto switch.
+    type: boolean
+    default: false
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-five-adapter-activation
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:messaging-disabled-safe
+  - name: APP_GRAPHQL_ENABLED
+    # source: five-adapter-runtime-remediation §5.1 — master switch for the GraphQL transport.
+    # false publishes no /graphql route, including the one Spring GraphQL would publish by itself.
+    type: boolean
+    default: false
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-five-adapter-activation
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:graphql-disabled-safe
+  - name: APP_GRAPHQL_DEPLOYMENT_MODE
+    # source: five-adapter-runtime-remediation §5.1 / GQL-INT-002 — replaces backend.graphql.production
+    # and backend.graphql.environment, which defaulted to production=false with
+    # environment=PRODUCTION_PUBLIC and let anonymous-principal and allow-by-default authorization
+    # read one axis while the other claimed production.
+    type: enum
+    default: ""
+    allowed_values: [LOCAL, DEV, PRODUCTION_INTERNAL, PRODUCTION_PUBLIC]
+    classification: public-config
+    required: false
+    required_when: APP_GRAPHQL_ENABLED=true
+    reload_policy: restart-only
+    owner_branch: worktree-five-adapter-activation
+    validation: enum
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:graphql-deployment-mode
+  - name: APP_OUTBOX_ENABLED
+    # source: five-adapter-runtime-remediation §6.1 JPA-INT-004 — the outbox capability switch.
+    # relay-enabled below only starts the scheduler; conflating the two meant a relay-off deployment
+    # still assembled outbox metrics over a store port a database-less runtime does not have.
+    type: boolean
+    default: false
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-five-adapter-activation
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:outbox-capability-disabled-safe
+  - name: APP_OUTBOX_RELAY_ENABLED
+    # source: five-adapter-runtime-remediation §6.3 MSG-INT-001 — starts the relay scheduler.
+    # Requires APP_OUTBOX_ENABLED, APP_PERSISTENCE_JPA_ENABLED and APP_MESSAGING_ENABLED with a
+    # broker; the shipped default was true beside a blank broker, which refused every startup.
+    type: boolean
+    default: false
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-five-adapter-activation
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:outbox-relay-dependency
  - name: APP_NOTIFICATION_PLATFORM_ENABLED
    # source: NTF-025 — master switch for the notification delivery platform; false binds nothing at all
    type: boolean
@@ -4263,11 +4382,469 @@ env_keys:
    compatibility_impact: behavior-change
    required_test: adapter-contract:notification-platform-disabled-safe

+  - name: APP_NOTIFICATION_PLATFORM_CONTACT_ENCRYPTION_KEY
+    # source: NTF-INT-007 — Encrypts recipient contact points at rest — addresses and phone numbers.
+    # Full row owned by secrets-classification.yaml. Bound by
+    # ca-skeleton.notification.platform.secrets.contact-encryption-key; the platform decodes it at startup and
+    # refuses to boot if it is blank, shorter than 32 bytes, or equal to another purpose's key.
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: base64_at_least_32_bytes_and_distinct_per_purpose
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_CONTACT_LOOKUP_HMAC_KEY
+    # source: NTF-INT-007 — Blind index over contact points, so a lookup never needs the plaintext.
+    # Full row owned by secrets-classification.yaml. Bound by
+    # ca-skeleton.notification.platform.secrets.contact-lookup-hmac-key; the platform decodes it at startup and
+    # refuses to boot if it is blank, shorter than 32 bytes, or equal to another purpose's key.
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: base64_at_least_32_bytes_and_distinct_per_purpose
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_CALLBACK_SIGNING_KEY
+    # source: NTF-INT-007 — Signs the callback URLs a provider posts delivery outcomes back to.
+    # Full row owned by secrets-classification.yaml. Bound by
+    # ca-skeleton.notification.platform.secrets.callback-signing-key; the platform decodes it at startup and
+    # refuses to boot if it is blank, shorter than 32 bytes, or equal to another purpose's key.
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: base64_at_least_32_bytes_and_distinct_per_purpose
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_PROVIDER_CREDENTIAL_KEY
+    # source: NTF-INT-007 — Encrypts stored provider credentials, which are themselves secrets.
+    # Full row owned by secrets-classification.yaml. Bound by
+    # ca-skeleton.notification.platform.secrets.provider-credential-key; the platform decodes it at startup and
+    # refuses to boot if it is blank, shorter than 32 bytes, or equal to another purpose's key.
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: base64_at_least_32_bytes_and_distinct_per_purpose
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_PAYLOAD_ENCRYPTION_KEY
+    # source: NTF-INT-007 — Encrypts notification variables and retained callback bodies at rest.
+    # Full row owned by secrets-classification.yaml. Bound by
+    # ca-skeleton.notification.platform.secrets.payload-encryption-key; the platform decodes it at startup and
+    # refuses to boot if it is blank, shorter than 32 bytes, or equal to another purpose's key.
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: base64_at_least_32_bytes_and_distinct_per_purpose
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_VAPID_SIGNING_KEY
+    # source: NTF-INT-007 — Signs Web Push requests; the browser push service rejects anything else.
+    # Full row owned by secrets-classification.yaml. Bound by
+    # ca-skeleton.notification.platform.secrets.vapid-signing-key; the platform decodes it at startup and
+    # refuses to boot if it is blank, shorter than 32 bytes, or equal to another purpose's key.
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: base64_at_least_32_bytes_and_distinct_per_purpose
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_PROVIDER_REQUEST_LOOKUP_HMAC_KEY
+    # source: NTF-INT-007 — Keyed hash of provider request ids, which are provider-side identifiers.
+    # Full row owned by secrets-classification.yaml. Bound by
+    # ca-skeleton.notification.platform.secrets.provider-request-lookup-hmac-key; the platform decodes it at startup and
+    # refuses to boot if it is blank, shorter than 32 bytes, or equal to another purpose's key.
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: base64_at_least_32_bytes_and_distinct_per_purpose
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_CALLBACK_FINGERPRINT_HMAC_KEY
+    # source: NTF-INT-007 — Keyed fingerprint of callback bodies, used to detect replays.
+    # Full row owned by secrets-classification.yaml. Bound by
+    # ca-skeleton.notification.platform.secrets.callback-fingerprint-hmac-key; the platform decodes it at startup and
+    # refuses to boot if it is blank, shorter than 32 bytes, or equal to another purpose's key.
+    type: string
+    default: null
+    allowed_values: null
+    classification: secret
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: base64_at_least_32_bytes_and_distinct_per_purpose
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_CONTACT_ENCRYPTION_KEY_ID
+    # source: NTF-INT-007 — the id written into every envelope the CONTACT_ENCRYPTION key produces.
+    # An identifier, not key material, so it is public-config; the material itself is the
+    # APP_NOTIFICATION_PLATFORM_CONTACT_ENCRYPTION_KEY row above. Bound into
+    # ca-skeleton.notification.platform.secrets.active-key-ids.CONTACT_ENCRYPTION.
+    type: string
+    default: null
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank_when_platform_enabled
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_CONTACT_LOOKUP_HMAC_KEY_ID
+    # source: NTF-INT-007 — the id written into every envelope the CONTACT_LOOKUP_HMAC key produces.
+    # An identifier, not key material, so it is public-config; the material itself is the
+    # APP_NOTIFICATION_PLATFORM_CONTACT_LOOKUP_HMAC_KEY row above. Bound into
+    # ca-skeleton.notification.platform.secrets.active-key-ids.CONTACT_LOOKUP_HMAC.
+    type: string
+    default: null
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank_when_platform_enabled
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_CALLBACK_SIGNING_KEY_ID
+    # source: NTF-INT-007 — the id written into every envelope the CALLBACK_SIGNING key produces.
+    # An identifier, not key material, so it is public-config; the material itself is the
+    # APP_NOTIFICATION_PLATFORM_CALLBACK_SIGNING_KEY row above. Bound into
+    # ca-skeleton.notification.platform.secrets.active-key-ids.CALLBACK_SIGNING.
+    type: string
+    default: null
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank_when_platform_enabled
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_PROVIDER_CREDENTIAL_KEY_ID
+    # source: NTF-INT-007 — the id written into every envelope the PROVIDER_CREDENTIAL key produces.
+    # An identifier, not key material, so it is public-config; the material itself is the
+    # APP_NOTIFICATION_PLATFORM_PROVIDER_CREDENTIAL_KEY row above. Bound into
+    # ca-skeleton.notification.platform.secrets.active-key-ids.PROVIDER_CREDENTIAL.
+    type: string
+    default: null
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank_when_platform_enabled
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_PAYLOAD_ENCRYPTION_KEY_ID
+    # source: NTF-INT-007 — the id written into every envelope the PAYLOAD_ENCRYPTION key produces.
+    # An identifier, not key material, so it is public-config; the material itself is the
+    # APP_NOTIFICATION_PLATFORM_PAYLOAD_ENCRYPTION_KEY row above. Bound into
+    # ca-skeleton.notification.platform.secrets.active-key-ids.PAYLOAD_ENCRYPTION.
+    type: string
+    default: null
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank_when_platform_enabled
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_VAPID_SIGNING_KEY_ID
+    # source: NTF-INT-007 — the id written into every envelope the VAPID_SIGNING key produces.
+    # An identifier, not key material, so it is public-config; the material itself is the
+    # APP_NOTIFICATION_PLATFORM_VAPID_SIGNING_KEY row above. Bound into
+    # ca-skeleton.notification.platform.secrets.active-key-ids.VAPID_SIGNING.
+    type: string
+    default: null
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank_when_platform_enabled
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_PROVIDER_REQUEST_LOOKUP_HMAC_KEY_ID
+    # source: NTF-INT-007 — the id written into every envelope the PROVIDER_REQUEST_LOOKUP_HMAC key produces.
+    # An identifier, not key material, so it is public-config; the material itself is the
+    # APP_NOTIFICATION_PLATFORM_PROVIDER_REQUEST_LOOKUP_HMAC_KEY row above. Bound into
+    # ca-skeleton.notification.platform.secrets.active-key-ids.PROVIDER_REQUEST_LOOKUP_HMAC.
+    type: string
+    default: null
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank_when_platform_enabled
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_CALLBACK_FINGERPRINT_HMAC_KEY_ID
+    # source: NTF-INT-007 — the id written into every envelope the CALLBACK_FINGERPRINT_HMAC key produces.
+    # An identifier, not key material, so it is public-config; the material itself is the
+    # APP_NOTIFICATION_PLATFORM_CALLBACK_FINGERPRINT_HMAC_KEY row above. Bound into
+    # ca-skeleton.notification.platform.secrets.active-key-ids.CALLBACK_FINGERPRINT_HMAC.
+    type: string
+    default: null
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank_when_platform_enabled
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-secret-material-required
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_ENABLED
+    # source: NTF-INT-001 — master switch of the shipped SMTP provider profile; false means assembly skips it entirely.
+    type: boolean
+    default: false
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_PRIMARY
+    # source: NTF-INT-001 — whether this profile is the primary route for EMAIL; exactly one primary per channel.
+    type: boolean
+    default: true
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_ENVIRONMENT
+    # source: NTF-INT-001 — the profile's declared environment, carried on every dispatch record.
+    type: string
+    default: local
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_CREDENTIAL_PROFILE
+    # source: NTF-INT-001 — the credential profile the relay's credentials are resolved through.
+    type: string
+    default: default
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: non_blank
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_TIMEOUT
+    # source: NTF-INT-001 — per-attempt provider timeout for this profile.
+    type: duration
+    default: 10s
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: duration_spring_shorthand
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_MAX_CONCURRENCY
+    # source: NTF-INT-001 — how many attempts this profile may have in flight.
+    type: int
+    default: 4
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: positive_int
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_RATE_PER_SECOND
+    # source: NTF-INT-001 — the profile's attempt rate limit.
+    type: int
+    default: 10
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: positive_int
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_TLS_MODE
+    # source: NTF-INT-001 — transport security of the SMTP session; the type has no plaintext member.
+    type: enum
+    default: STARTTLS_REQUIRED
+    allowed_values: [STARTTLS_REQUIRED, IMPLICIT_TLS]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: enum_in_allowed_values
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_SENDER_IDENTITY
+    # source: NTF-INT-001 — the envelope sender every message is sent as.
+    type: string
+    default: no-reply@example.invalid
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: email_address
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_CONNECT_TIMEOUT
+    # source: NTF-INT-001 — how long a connection attempt to the relay may take.
+    type: duration
+    default: 5s
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: duration_spring_shorthand
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_READ_TIMEOUT
+    # source: NTF-INT-001 — how long a relay reply may take.
+    type: duration
+    default: 10s
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: duration_spring_shorthand
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_WRITE_TIMEOUT
+    # source: NTF-INT-001 — how long a write to the relay may take.
+    type: duration
+    default: 10s
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: duration_spring_shorthand
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_NOTIFICATION_PLATFORM_SMTP_DISPATCH_CONCURRENCY
+    # source: NTF-INT-001 — size of the bounded executor SMTP sends run on.
+    type: int
+    default: 4
+    allowed_values: null
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: worktree-notification-platform
+    validation: positive_int
+    compatibility_impact: behavior-change
+    required_test: adapter-contract:notification-smtp-provider-assembled
+
+  - name: APP_OPENAPI_DOCS_ENABLED
+    # source: five-adapter-runtime-remediation §9 — whether /v3/api-docs is served; application-prod.yml pins it false. Stated rather than defaulted because
+    # SpringDoc warns on every startup until a deployment decides, and a warning on every start is
+    # one nobody reads.
+    type: boolean
+    default: true
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: main
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: env-contract:openapi-exposure-decided
+
+  - name: APP_OPENAPI_UI_ENABLED
+    # source: five-adapter-runtime-remediation §9 — whether the Swagger UI is served; application-prod.yml pins it false. Stated rather than defaulted because
+    # SpringDoc warns on every startup until a deployment decides, and a warning on every start is
+    # one nobody reads.
+    type: boolean
+    default: true
+    allowed_values: [true, false]
+    classification: public-config
+    required: false
+    reload_policy: restart-only
+    owner_branch: main
+    validation: boolean
+    compatibility_impact: behavior-change
+    required_test: env-contract:openapi-exposure-decided
+
  - name: APP_NOTIFICATION_PLATFORM_MODE
-    # source: NTF-025 — SERVING refuses to start without a working provider; ACCEPT_ONLY stores and does not dispatch
+    # source: NTF-025 — SERVING refuses to start without a working provider; INGEST_ONLY stores and does not dispatch.
+    # The constant is INGEST_ONLY. This row said ACCEPT_ONLY, a name NotificationPlatformMode has
+    # never had, so an operator following the registry got a binding failure naming a value the
+    # documentation does not mention. NotificationModeSsotTest derives the list below from the enum.
    type: enum
    default: SERVING
-    allowed_values: [SERVING, ACCEPT_ONLY]
+    allowed_values: [SERVING, INGEST_ONLY]
    classification: public-config
    required: false
    reload_policy: restart-only
@@ -226,6 +226,134 @@ secrets:

  # === Tier 2: sensitive-config (token-bearing URL or id with exposure restriction) ===

+  - name: APP_NOTIFICATION_PLATFORM_CONTACT_ENCRYPTION_KEY
+    # Encrypts recipient contact points at rest — addresses and phone numbers.
+    # One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
+    # means a compromise of any one of them is a compromise of all eight, and the platform enforces
+    # the distinction at startup rather than trusting the deployment to have noticed.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    required_when: ca-skeleton.notification.platform.enabled=true
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: worktree-notification-platform
+    masking_rule: full
+    compatibility_impact: behavior-change
+    required_test: secrets-contract:notification-contact-encryption-no-leak
+
+  - name: APP_NOTIFICATION_PLATFORM_CONTACT_LOOKUP_HMAC_KEY
+    # Blind index over contact points, so a lookup never needs the plaintext.
+    # One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
+    # means a compromise of any one of them is a compromise of all eight, and the platform enforces
+    # the distinction at startup rather than trusting the deployment to have noticed.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    required_when: ca-skeleton.notification.platform.enabled=true
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: worktree-notification-platform
+    masking_rule: full
+    compatibility_impact: behavior-change
+    required_test: secrets-contract:notification-contact-lookup-hmac-no-leak
+
+  - name: APP_NOTIFICATION_PLATFORM_CALLBACK_SIGNING_KEY
+    # Signs the callback URLs a provider posts delivery outcomes back to.
+    # One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
+    # means a compromise of any one of them is a compromise of all eight, and the platform enforces
+    # the distinction at startup rather than trusting the deployment to have noticed.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    required_when: ca-skeleton.notification.platform.enabled=true
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: worktree-notification-platform
+    masking_rule: full
+    compatibility_impact: behavior-change
+    required_test: secrets-contract:notification-callback-signing-no-leak
+
+  - name: APP_NOTIFICATION_PLATFORM_PROVIDER_CREDENTIAL_KEY
+    # Encrypts stored provider credentials, which are themselves secrets.
+    # One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
+    # means a compromise of any one of them is a compromise of all eight, and the platform enforces
+    # the distinction at startup rather than trusting the deployment to have noticed.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    required_when: ca-skeleton.notification.platform.enabled=true
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: worktree-notification-platform
+    masking_rule: full
+    compatibility_impact: behavior-change
+    required_test: secrets-contract:notification-provider-credential-no-leak
+
+  - name: APP_NOTIFICATION_PLATFORM_PAYLOAD_ENCRYPTION_KEY
+    # Encrypts notification variables and retained callback bodies at rest.
+    # One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
+    # means a compromise of any one of them is a compromise of all eight, and the platform enforces
+    # the distinction at startup rather than trusting the deployment to have noticed.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    required_when: ca-skeleton.notification.platform.enabled=true
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: worktree-notification-platform
+    masking_rule: full
+    compatibility_impact: behavior-change
+    required_test: secrets-contract:notification-payload-encryption-no-leak
+
+  - name: APP_NOTIFICATION_PLATFORM_VAPID_SIGNING_KEY
+    # Signs Web Push requests; the browser push service rejects anything else.
+    # One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
+    # means a compromise of any one of them is a compromise of all eight, and the platform enforces
+    # the distinction at startup rather than trusting the deployment to have noticed.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    required_when: ca-skeleton.notification.platform.enabled=true
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: worktree-notification-platform
+    masking_rule: full
+    compatibility_impact: behavior-change
+    required_test: secrets-contract:notification-vapid-signing-no-leak
+
+  - name: APP_NOTIFICATION_PLATFORM_PROVIDER_REQUEST_LOOKUP_HMAC_KEY
+    # Keyed hash of provider request ids, which are provider-side identifiers.
+    # One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
+    # means a compromise of any one of them is a compromise of all eight, and the platform enforces
+    # the distinction at startup rather than trusting the deployment to have noticed.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    required_when: ca-skeleton.notification.platform.enabled=true
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: worktree-notification-platform
+    masking_rule: full
+    compatibility_impact: behavior-change
+    required_test: secrets-contract:notification-provider-request-lookup-hmac-no-leak
+
+  - name: APP_NOTIFICATION_PLATFORM_CALLBACK_FINGERPRINT_HMAC_KEY
+    # Keyed fingerprint of callback bodies, used to detect replays.
+    # One of eight purpose-scoped keys. They must all differ: a single key reused across purposes
+    # means a compromise of any one of them is a compromise of all eight, and the platform enforces
+    # the distinction at startup rather than trusting the deployment to have noticed.
+    classification: secret
+    source: secret-manager
+    rotation_policy: dual-read-restart-only
+    prod_default: null
+    required_when: ca-skeleton.notification.platform.enabled=true
+    dev_sentinel_prefix: __LOCAL_DEV_
+    owner_branch: worktree-notification-platform
+    masking_rule: full
+    compatibility_impact: behavior-change
+    required_test: secrets-contract:notification-callback-fingerprint-hmac-no-leak
+
  - name: APP_NOTIFICATION_SLACK_WEBHOOK_URL
    # source: feature-integration-adapter-templates 2026-05-22
    # "Slack | disabled optional module | notification failure policy"