refactor(build,ci): 현재 상태 검증을 걷어내고 불변조건만 남기는 검증 표면 축소

외부 리뷰("현재 상태를 유지하기 위한 검증이 너무 많고, 그 검증 자체를 다시 검증하는 구조까지 생겼다")를 설계 문서로 정리하고 코드로 반영한다. 설계·판단 근거는 docs/superpowers/specs/2026-09-16-verification-surface-reduction-design.md. 삭제 - .github/ci-gate-matrix.yml(1,025줄) + verify-gate-matrix.sh(568줄): Gradle task graph와 workflow graph에 이미 있는 정보의 3중 복제 - verify-gradle-wrapper.sh(799줄): workflow 바이트 해시 잠금. wrapper 검증은 gradle/actions/wrapper-validation(full SHA 핀)에 위임 - DeveloperExperienceContractTest 등의 CI YAML mutation 테스트: 애플리케이션 test suite가 GitHub Actions YAML 파서를 검증하던 계층 역전 - 문서 drift 파서: verifyReadmeCommands, verifyRunbookReferences, verifyDocumentedLeafCount, verifyTestSourceSetRegistry - 빈 레지스트리를 지키던 커스텀 YAML 파서: verifyTrivyignore, verifyQuarantineSunset, flaky-quarantine.yaml - verifyConfigurationPropertiesProcessor, verifyOneTypePerFile: 각각 ca.spring-config convention과 Checkstyle OneTopLevelClass가 대체 - 정상 입력으로도 성공할 수 없던 messaging always-fail task - ModuleRegistry의 JSON 필드 집합 정확 일치, sample-portfolio negative guard 이동 - java/quality/spring 공통 설정을 configure(subprojects) 블록에서 ca.java-conventions / ca.quality-conventions / ca.java-library / ca.spring-library convention plugin으로 - 아키텍처 검증을 ca.architecture로, JPA·messaging qualification을 gradle/qualification/ 아래로, verifyEnvKeys를 :app-bootstrap 소유로 완화 - Git revision은 releaseCheck·아카이브 생성에서만 요구. 일반 빌드는 SNAPSHOT - SpotBugs/FindSecBugs는 로컬 check에서 빼고 qualityCheck 레인으로 task 계층 - leaf check는 그 leaf만. architectureCheck / qualityCheck / configContractCheck / integrationCheck / ci / releaseCheck로 이름 분리 CI - _reusable-gradle.yml 신규. checkout + wrapper validation + JDK/캐시 공통화 - fileserver-release.yml -> fileserver-certification.yml (CD가 아니라 certification) - GitHub Actions = CI + artifact, Argo CD = CD 경계를 docs/ci-cd/boundary.md로 고정 순증감 +3,274 / -7,483. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-16 20:33:19 +09:00
parent d00c76241c
commit ef947e5bb0
95 changed files with 3284 additions and 7493 deletions
@@ -0,0 +1,63 @@
+name: reusable-gradle
+
+# One place that knows how a Gradle job starts.
+#
+# Every job in this repository opened with the same preamble: checkout, a three-line pinned
+# wrapper-validation step, then the JDK/cache action. The wrapper step is gone (setup-gradle
+# validates wrappers itself), and this workflow removes the rest of the repetition for the jobs whose
+# only variation is the Gradle command they run.
+#
+# Jobs that need service containers, a matrix, artifact uploads or per-job env stay written out with
+# `./.github/actions/setup-gradle-java`, because expressing those through `workflow_call` inputs
+# means encoding YAML inside strings — which is how a "shared" workflow becomes less readable than
+# the duplication it replaced.
+
+on:
+  workflow_call:
+    inputs:
+      tasks:
+        description: The Gradle task list, whitespace-separated.
+        required: true
+        type: string
+      gradle-args:
+        description: Flags appended after the task list.
+        required: false
+        type: string
+        default: "--no-daemon --stacktrace"
+      working-directory:
+        description: Directory the wrapper is invoked from.
+        required: false
+        type: string
+        default: src
+      timeout-minutes:
+        required: false
+        type: number
+        default: 30
+      continue-on-error:
+        description: Run the job as an advisory signal rather than a gate.
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+jobs:
+  gradle:
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ inputs.timeout-minutes }}
+    continue-on-error: ${{ inputs.continue-on-error }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
+      - uses: ./.github/actions/setup-gradle-java
+      - name: Run ${{ inputs.tasks }}
+        working-directory: ${{ inputs.working-directory }}
+        env:
+          GRADLE_TASKS: ${{ inputs.tasks }}
+          GRADLE_ARGS: ${{ inputs.gradle-args }}
+        run: |
+          set -euo pipefail
+          # Word-split on purpose: both inputs are task/flag lists. They come from this repository's
+          # own workflow files, never from a pull request.
+          # shellcheck disable=SC2086
+          ./gradlew ${GRADLE_TASKS} ${GRADLE_ARGS}
@@ -1,5 +1,14 @@
 name: ci-quality-gates

+# The pull-request gate. Everything here blocks a merge.
+#
+# The job list used to include `gate-matrix-lint`, which ran .github/scripts/verify-gate-matrix.sh
+# against .github/ci-gate-matrix.yml: a 1,025-line register of all 107 CI controls, checked for
+# consistency against the Gradle task graph and this workflow by a 568-line shell script, which was
+# itself checked by contract tests in :app-bootstrap. Adding one check meant editing Gradle, a
+# workflow, the matrix, the verifier's expectations and a Java test. The information was already in
+# the task graph and the job graph; the matrix was a third copy that had to be kept equal to both.
+
 on:
  pull_request:
  push:
@@ -21,9 +30,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - name: Require the committed public-path security baseline
        run: |
          set -euo pipefail
@@ -37,21 +43,22 @@ jobs:
            exit 1
          fi
      - uses: ./.github/actions/setup-gradle-java
-      - name: Check quality, public paths, and dependency locks
+      # `ci`, not `check`. A leaf's `check` is that leaf's — compile, its tests, Spotless, Checkstyle
+      # and Error Prone — and the repository-wide gates are named tasks of their own:
+      #   ci = every leaf check + architectureCheck + qualityCheck + configContractCheck
+      # so CI runs strictly more than it used to while `./gradlew :domain-core:check` runs strictly
+      # less.
+      - name: Run the pull-request gate
        working-directory: src
-        run: ./gradlew check verifyPublicPathSnapshot verifyDependencyLocks --warning-mode=fail --no-daemon --stacktrace
+        run: ./gradlew ci verifyPublicPathSnapshot verifyDependencyLocks --warning-mode=fail --no-daemon --stacktrace
      # build-logic is an included build: its own suite is not reachable from the root project's
-      # `check`, so the convention plugins every leaf applies shipped untested in CI. Kept as its
-      # own step rather than folded into the aggregate invocation above, which
-      # ConditionalTransportQualificationContractTest asserts on byte-for-byte.
+      # `check`, so the convention plugins every leaf applies would otherwise ship untested.
      - name: Test the build-logic convention plugins
        working-directory: src
        run: ./gradlew -p build-logic test --no-daemon --stacktrace
      # Named as its own step because nothing else runs it: `check` does not depend on
      # graphqlStableTest, so the lane's required-class guard — the check that its module-boundary
-      # suite has not silently stopped being discovered — protected nothing in CI. A separate step
-      # keeps the aggregate invocation below byte-identical, which ConditionalTransportQualification
-      # ContractTest asserts on, and the two tasks do not overlap.
+      # suite has not silently stopped being discovered — would protect nothing in CI.
      - name: Qualify the GraphQL Stable lane
        working-directory: src
        run: ./gradlew :adapter:inbound:graphql:graphqlStableTest --no-daemon --stacktrace
@@ -60,55 +67,33 @@ jobs:
        run: ./gradlew conditionalTransportQualification --no-daemon --stacktrace

  sample-off:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
-      - uses: ./.github/actions/setup-gradle-java
-      - name: Verify the application without the sample fixture
-        working-directory: src
-        run: ./gradlew :app-bootstrap:sampleOffTest verifyCleanArchitectureDependencies --no-daemon --stacktrace
-
-  gate-matrix-lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Verify the gate matrix against the repository
-        run: bash .github/scripts/verify-gate-matrix.sh
+    uses: ./.github/workflows/_reusable-gradle.yml
+    with:
+      tasks: ":app-bootstrap:sampleOffTest verifyCleanArchitectureDependencies"

  redis-sdk:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
-      - uses: ./.github/actions/setup-gradle-java
-      # Milestone A of the Redis wrapper/typed API plan: policy catalog, typed API parity,
-      # permit provenance, connection isolation, and the executor guard. There is no real-server
-      # lane yet — Tasks 10-17 add the contract suites that need one.
-      - name: Verify the Redis SDK policy, API parity, and guardrail contracts
-        working-directory: src
-        run: >-
-          ./gradlew
-          :shared-contract:edgeRateLimitContractTest
-          :adapter:outbound:cache-redis:check
-          verifyCleanArchitectureDependencies
-          verifyEnvKeys
-          verifyPublicPathSnapshot
-          verifyConfigurationPropertiesProcessor
-          --no-daemon --stacktrace
+    # Milestone A of the Redis wrapper/typed API plan: policy catalog, typed API parity, permit
+    # provenance, connection isolation, and the executor guard. There is no real-server lane yet.
+    #
+    # `verifyConfigurationPropertiesProcessor` used to be in this list. It is deleted: the parity it
+    # enforced — a leaf declares Spring's configuration processor exactly when it owns
+    # @ConfigurationProperties — is now what applying `ca.spring-config` means.
+    # `verifyEnvKeys` is no longer named here either; it belongs to :app-bootstrap and runs through
+    # `configContractCheck`, which the quality-gates job covers.
+    uses: ./.github/workflows/_reusable-gradle.yml
+    with:
+      tasks: >-
+        :shared-contract:edgeRateLimitContractTest
+        :adapter:outbound:cache-redis:check
+        :app-bootstrap:verifyEnvKeys
+        verifyCleanArchitectureDependencies
+        verifyPublicPathSnapshot

  jpa-candidate-evidence:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Produce zero-skip JPA candidate manifests
        working-directory: src
@@ -125,25 +110,20 @@ jobs:
          if-no-files-found: error
          retention-days: 14

-  # Advisory only. Quarantine expiry/drift remains blocking through verifyQuarantineSunset in check.
+  # Advisory. The quarantine bucket runs so a flaky test is still executed and reported; it never
+  # blocks. The 14-day sunset registry that used to make an expired quarantine entry a build failure
+  # is gone — it was a 250-line YAML-and-Java parser guarding a registry with zero entries.
  quarantine:
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
-      - uses: ./.github/actions/setup-gradle-java
-      - name: Run quarantined tests as an advisory signal
-        working-directory: src
-        run: ./gradlew quarantineTest --no-daemon
+    uses: ./.github/workflows/_reusable-gradle.yml
+    with:
+      tasks: quarantineTest
+      gradle-args: "--no-daemon"
+      continue-on-error: true

  release-gate:
    needs:
      - quality-gates
      - sample-off
-      - gate-matrix-lint
      - redis-sdk
      - jpa-candidate-evidence
    if: always()
@@ -156,7 +136,6 @@ jobs:
        env:
          QUALITY_RESULT: ${{ needs.quality-gates.result }}
          SAMPLE_OFF_RESULT: ${{ needs.sample-off.result }}
-          MATRIX_RESULT: ${{ needs.gate-matrix-lint.result }}
          REDIS_RESULT: ${{ needs.redis-sdk.result }}
          JPA_CANDIDATE_RESULT: ${{ needs.jpa-candidate-evidence.result }}
        run: |
@@ -164,7 +143,6 @@ jobs:
          for result in \
            "${QUALITY_RESULT}" \
            "${SAMPLE_OFF_RESULT}" \
-            "${MATRIX_RESULT}" \
            "${REDIS_RESULT}" \
            "${JPA_CANDIDATE_RESULT}"; do
            if [[ "${result}" != "success" ]]; then
@@ -174,23 +152,16 @@ jobs:
          done
          echo "release-gate: all current blocking quality jobs succeeded."

-      # `needs` cannot reach another workflow, so every gate .github/ci-gate-matrix.yml marks
-      # release_blocking outside this file was invisible here: the field was read by nothing but an
-      # enum check in verify-gate-matrix.sh. filesystem-vulnerability-scan
-      # (dependency-vulnerability.yml::trivy-fs) is release_blocking: true and blocks on
-      # CRITICAL/HIGH and on the CISA KEV catalogue — it could be red while this job reported green
-      # and nothing in the repository joined the two.
+      # `needs` cannot reach another workflow, so a blocking check in another file has to be required
+      # by result. dependency-vulnerability.yml answers the same pull_request and push-to-main
+      # triggers as this workflow and trivy-fs carries no `if:` guard, so its check run always exists
+      # for this SHA — which is what makes it requirable rather than a matter of scheduling luck.
+      # Only `success` passes: a skipped or cancelled security scan is not a scan.
      #
-      # dependency-vulnerability.yml answers the same pull_request and push-to-main triggers as this
-      # workflow and trivy-fs carries no `if:` guard, so its check run always exists for this SHA.
-      # That is what makes it requirable by result rather than by scheduling luck. Only `success`
-      # passes: a skipped or cancelled security scan is not a scan.
-      #
-      # The other release_blocking gates outside this file run on triggers this job does not share
-      # and so cannot be required here without changing when they run: release.yml, jpa-release.yml
-      # and fileserver-release.yml answer a release tag, and object-storage-qualification.yml and
-      # messaging-certification.yml answer a path filter or a schedule. That is left as a stated gap
-      # rather than a silently different one.
+      # The release-tag and path-filtered workflows (release.yml, jpa-release.yml,
+      # fileserver-certification.yml, object-storage-qualification.yml, messaging-certification.yml)
+      # run on triggers this job does not share, so they cannot be required here without changing
+      # when they run. That is a stated gap, not a hidden one.
      - name: Require the cross-workflow release-blocking checks to have succeeded
        env:
          GH_TOKEN: ${{ github.token }}
@@ -35,9 +35,6 @@ jobs:
      contents: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Submit the resolved Gradle dependency graph
        uses: gradle/actions/dependency-submission@748248ddd2a24f49513d8f472f81c3a07d4d50e1 # gradle/actions@v4.4.4
@@ -1,7 +1,13 @@
-name: fileserver-release
+name: fileserver-certification

-# The gate a release must clear. Its job list is deliberately the same shape as the support matrix:
-# nothing may be advertised at a support level whose evidence job is absent here.
+# The certification a release must clear. Its job list is deliberately the same shape as the support
+# matrix: nothing may be advertised at a support level whose evidence job is absent here.
+#
+# Named "certification", not "release", and the name is the point. This workflow proves a storage
+# topology, a support matrix and a telemetry redaction claim. It deploys nothing and holds no cluster
+# credential. Calling it `fileserver-release.yml` read as if GitHub Actions released the fileserver,
+# which is the CI/CD boundary this repository has now fixed in docs/ci-cd/boundary.md: GitHub Actions
+# tests, scans and publishes artifacts; Argo CD deploys.
 #
 # It used to be workflow_dispatch only, which made that sentence false: the four jobs below are the
 # only place the fileserver support matrix, the PVC manifest and the telemetry redaction proof are
@@ -36,9 +42,6 @@ jobs:
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the architecture-wide dependency and module verification
        working-directory: src
@@ -62,9 +65,6 @@ jobs:
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Prove every support claim maps to a job and every endpoint is documented
        working-directory: src
@@ -79,9 +79,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      # This job checks the manifest, and only the manifest. It deliberately does not apply anything
      # to a cluster.
      #
@@ -96,8 +93,8 @@ jobs:
      # The cluster result comes from an operator running infra/fileserver/kubernetes/
      # pvc-certification-job.yaml against a real cluster and recording it in
      # docs/fileserver/storage-certification.md. That is registered as
-      # fileserver-pvc-cluster-certification (delegated-pending) in .github/ci-gate-matrix.yml, so
-      # the absence is a tracked control rather than a green check.
+      # docs/fileserver/storage-certification.md, and the absence of a cluster result is stated
+      # there rather than hidden behind a green check.
      - name: Check the certification manifest still says what the claim depends on
        run: |
          set -euo pipefail
@@ -115,9 +112,6 @@ jobs:
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Prove telemetry carries no filename, path, or raw identifier
        working-directory: src
@@ -24,9 +24,6 @@ jobs:
      FILESERVER_NFS_TESTS: "true"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Start the NFSv4 certification environment
        run: docker compose -f infra/fileserver/nfs/compose.yml up -d --wait
@@ -46,9 +43,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the crash matrix and reconciliation suites
        working-directory: src
@@ -65,9 +59,6 @@ jobs:
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the large-file and slow-client suites under a constrained heap
        working-directory: src
@@ -86,9 +77,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Prove no run commits bytes from a stale lease
        working-directory: src
@@ -44,9 +44,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the fileserver application and architecture suites
        working-directory: src
@@ -62,9 +59,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Certify the local content store against the shared contract
        working-directory: src
@@ -79,9 +73,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the servlet and reactive transport contracts
        working-directory: src
@@ -96,9 +87,6 @@ jobs:
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the path, filename, range, and problem-detail hardening suite
        working-directory: src
@@ -114,9 +102,6 @@ jobs:
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Prove transfer cost does not scale with file size
        working-directory: src
@@ -9,20 +9,13 @@ name: integration-main
 #
 # Two kinds of work live here.
 #
-# 1. The documentation-drift gates. They used to be `dependsOn` of the root `check`, so a README
-#    sentence about a renamed task failed a compile-and-test run and the fix was to edit a document
-#    before unrelated code could build. src/build.gradle now aggregates them as
-#    `verifyDocumentationContracts` and leaves them out of `check`. That demotion is only half a
-#    change: a gate nothing invokes has not been demoted, it has been deleted. This job is the other
-#    half, and it is the reason the four gates still run at all.
-#
-# 2. The lanes that need a machine that is not simultaneously compiling something else — load,
+# 1. The lanes that need a machine that is not simultaneously compiling something else — load,
 #    abuse, graceful shutdown, TCP fault injection, resource bounds. They were web-nightly.yml and
 #    httpclient-nightly.yml, two module-shaped files whose only real difference was the cadence they
 #    shared. They now run on every push to main as well as nightly, which is strictly more often
 #    than before.
 #
-# 3. Lanes that were registered in Gradle and invoked by nothing. Ten Gradle tasks — six MongoDB
+# 2. Lanes that were registered in Gradle and invoked by nothing. Ten Gradle tasks — six MongoDB
 #    container lanes, app-bootstrap's Testcontainers `integrationTest`, and the three messaging
 #    evidence tasks that `verifyMessagingContracts` reaches — existed, failed closed, and executed
 #    in no workflow. A lane nobody runs is not coverage; it is a file that looks like coverage. They
@@ -54,24 +47,17 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

-jobs:
-  # verifyReadmeCommands, verifyDocumentedLeafCount, verifyRunbookReferences and
-  # verifyTestSourceSetRegistry, as one task. Named as the aggregate rather than as four steps so
-  # that adding a fifth documentation gate is a build-file edit and not a workflow edit — and so
-  # that the demotion out of `check` has exactly one consumer to point at.
-  documentation-contracts:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
-      - uses: ./.github/actions/setup-gradle-java
-      - name: Verify the documentation contracts
-        working-directory: src
-        run: ./gradlew verifyDocumentationContracts --no-daemon --stacktrace
+# The documentation-drift gates that used to run here are gone rather than demoted.
+#
+# They were four hand-written parsers: README shell blocks compared against the Gradle task graph,
+# runbook identifiers compared against every declared Java type, a leaf count written in prose
+# compared against the registry, and a Markdown table compared against the declared source sets.
+# Each was a custom parser for a file format nobody controls, and each made a documentation edit a
+# precondition for a build. A stale sentence is a defect, but it is not one a build can be failed
+# for, and link-check.yml already answers the one documentation question with a stable machine
+# answer: does this link resolve.

+jobs:
  # Load, abuse and graceful shutdown measure behaviour that degrades gradually rather than breaking
  # outright — which is exactly the kind of regression a per-PR gate never catches.
  web-load-abuse-and-shutdown:
@@ -79,9 +65,6 @@ jobs:
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the load, abuse and shutdown lanes on every container
        working-directory: src
@@ -107,9 +90,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Inject TCP faults against a real upstream
        working-directory: src
@@ -128,9 +108,6 @@ jobs:
      GRADLE_OPTS: -Dorg.gradle.project.performance.assertions.enabled=true
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Certify pool, streaming, retry, and rotation bounds
        working-directory: src
@@ -144,14 +121,11 @@ jobs:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # Experimental by design (D-08): the result is reported, never used to block a merge. Registered
-    # in .github/ci-gate-matrix.yml as release_blocking: false so that "this job cannot fail the
+    # advisory so that "this job cannot fail the
    # build" is written down rather than inferred from a field two hundred lines into a workflow.
    continue-on-error: true
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Exercise the experimental HTTP/3 opt-in
        working-directory: src
@@ -173,7 +147,7 @@ jobs:
  # the pull-request budget is minutes for the whole gate.
  #
  # One single-line `./gradlew <task>` step per lane, not one folded command running six, because
-  # .github/scripts/verify-gate-matrix.sh reads these command lines to prove each registered lane is
+  # These command lines name each lane explicitly so that a lane which stops being invoked is
  # actually executed — a folded command would leave six matrix rows unverifiable. It also means a
  # red replica-set lane does not hide the compatibility lane behind it.
  mongo-container-lanes:
@@ -184,9 +158,6 @@ jobs:
      TESTCONTAINERS_REUSE_ENABLE: "false"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Single-node replica set contract lane
        working-directory: src
@@ -236,9 +207,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Qualify the messaging contract, catalog, binding and schema evidence
        working-directory: src
@@ -262,9 +230,6 @@ jobs:
      TESTCONTAINERS_REUSE_ENABLE: "false"
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the real-PostgreSQL integration contracts
        working-directory: src
@@ -21,9 +21,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Report Hibernate ORM 8 compatibility
        id: compatibility-probe
@@ -21,9 +21,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Report Jakarta Persistence 4.0 compatibility
        id: compatibility-probe
@@ -27,9 +27,6 @@ jobs:
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Report PostgreSQL 19 compatibility
        id: compatibility-probe
@@ -30,9 +30,6 @@ jobs:
        postgresql: ["16", "17", "18"]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Certify the platform against PostgreSQL ${{ matrix.postgresql }}
        working-directory: src
@@ -48,9 +45,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Reproduce deadlock, serialization, and commit-ambiguity scenarios
        working-directory: src
@@ -65,9 +59,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the query plan and database security suites
        working-directory: src
@@ -83,9 +74,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Verify pool saturation and REQUIRES_NEW connection behaviour
        working-directory: src
@@ -26,9 +26,6 @@ jobs:
      JPA_EVIDENCE_TOPOLOGY: postgresql-16-testcontainers-tls-and-fault-matrix
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Verify the production-profile JPA R2 manifest DAG
        working-directory: src
@@ -43,9 +43,6 @@ jobs:
        postgresql: ["16", "17", "18"]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the full JPA release gate on PostgreSQL ${{ matrix.postgresql }}
        working-directory: src
@@ -118,9 +115,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Verify architecture boundaries and the support matrix
        working-directory: src
@@ -36,9 +36,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Certify the Kafka adapter against a real broker
        working-directory: src
@@ -55,9 +55,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Compile and format check
        working-directory: src
@@ -89,7 +86,7 @@ jobs:
      - name: Configuration surface
        working-directory: src
        run: |
-          ./gradlew verifyEnvKeys verifyPublicPathSnapshot --console=plain
+          ./gradlew :app-bootstrap:verifyEnvKeys verifyPublicPathSnapshot --console=plain
          ./gradlew verifyNotificationApiSurface verifyNotificationConfiguration --console=plain
      # A support grade is a promise about production behaviour. This refuses one the pipeline
      # cannot back — the check that would have caught five channels reading "Stable" while no
@@ -108,9 +105,6 @@ jobs:
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      # This job is named for ambiguity, restart recovery and callback burst. It used to run a
      # unit-test filter and then `test` — neither of which restarts anything or bursts anything —
@@ -34,9 +34,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run non-skipping Poster image migration qualification
        working-directory: src
@@ -46,9 +43,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run exact-release MinIO managed contract
        working-directory: src
@@ -59,9 +53,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run digest-pinned MinIO and Toxiproxy fault contract
        working-directory: src
@@ -82,9 +73,6 @@ jobs:
      OBJECT_STORAGE_AWS_EXPECTED_OWNER: ${{ secrets.OBJECT_STORAGE_AWS_EXPECTED_OWNER }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run protected AWS common-subset qualification
        working-directory: src
@@ -136,9 +136,6 @@ jobs:
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Compare the wire contract across Tomcat, Jetty and Reactor Netty
        working-directory: src
@@ -165,9 +162,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the proxy, prefix and spoofing contract behind a real Nginx
        working-directory: src
@@ -184,9 +178,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the runtime contract on the second servlet container
        working-directory: src
@@ -205,9 +196,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the upgrade and forwarded-header contract behind a real Nginx
        working-directory: src
@@ -230,9 +218,6 @@ jobs:
        transport: [apache, jdk, reactor]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Certify one transport against the shared contract
        working-directory: src
@@ -254,9 +239,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the next-major Spring compatibility lane
        working-directory: src
@@ -280,9 +262,6 @@ jobs:
        postgresql: ["16", "18"]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Certify the platform against PostgreSQL ${{ matrix.postgresql }}
        working-directory: src
@@ -300,9 +279,6 @@ jobs:
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run the migration upgrade smoke scenarios
        working-directory: src
@@ -116,9 +116,6 @@ jobs:
      matrix: ${{ fromJson(needs.lanes.outputs.matrix) }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Start the topology
        env:
@@ -19,11 +19,13 @@ name: release
 # design one:
 #   * jpa-release.yml — JpaReleaseRenderingTest reads that exact path and holds its PostgreSQL
 #     matrix and promotion list to src/config/jpa/release-registry.json.
-#   * fileserver-release.yml — FileserverDocumentationCoverageTest requires every job id named in
-#     docs/fileserver/support-matrix.md to be defined in a `.github/workflows/fileserver-*.yml`.
+#   * fileserver-certification.yml — FileserverDocumentationCoverageTest requires every job id named
+#     in docs/fileserver/support-matrix.md to be defined in a `.github/workflows/fileserver-*.yml`.
+#     It is named "certification" rather than "release" on purpose: it certifies a storage topology
+#     and a support matrix, it deploys nothing, and the CI/CD boundary in docs/ci-cd/boundary.md
+#     says GitHub Actions does not deploy.
 # Folding either one in needs its src-side test (and, for fileserver, the support document) changed
-# in the same commit. Until then the image job below cannot wait on them, which is what the
-# `container-release-evidence-join` row in .github/ci-gate-matrix.yml records.
+# in the same commit. Until then the image job below cannot wait on them — a stated gap.
 #
 # The image job DOES now wait on the evidence jobs in this file, which is new: while the image build
 # lived in its own workflow it could publish while a sibling suite was still running or already red,
@@ -52,9 +54,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Verify architecture boundaries and the published surfaces
        working-directory: src
@@ -62,7 +61,7 @@ jobs:
          ./gradlew
          verifyCleanArchitectureDependencies
          verifyPublicPathSnapshot
-          verifyEnvKeys
+          :app-bootstrap:verifyEnvKeys
          :app-bootstrap:test --tests 'dev.caskeleton.bootstrap.architecture.*'
          --no-daemon
          --stacktrace
@@ -80,9 +79,6 @@ jobs:
    timeout-minutes: 90
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run every web lane, Stable and Advanced
        working-directory: src
@@ -108,9 +104,6 @@ jobs:
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Run every websocket lane, Stable and Advanced
        working-directory: src
@@ -151,9 +144,6 @@ jobs:
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: In-process contract lane
        working-directory: src
@@ -172,11 +162,9 @@ jobs:
          path: src/grpc/grpc-testkit/build/reports/tests/
          if-no-files-found: warn

-  # Each declared gate runs as its own single-line `./gradlew <task>` step, because
-  # .github/scripts/verify-gate-matrix.sh reads these commands to prove the gate is actually
-  # executed — a folded or flag-laden command would make the declaration in
-  # .github/ci-gate-matrix.yml unverifiable. The architecture dependency gate that used to end this
-  # list is now architecture-and-surface above; it was the fourth copy of the same invocation.
+  # Each gate runs as its own single-line `./gradlew <task>` step so that a failure names the gate
+  # rather than a folded command. The architecture dependency gate that used to end this list is now
+  # architecture-and-surface above; it was the fourth copy of the same invocation.
  httpclient-release-gate:
    runs-on: ubuntu-latest
    timeout-minutes: 60
@@ -189,9 +177,6 @@ jobs:
      GRADLE_OPTS: -Dorg.gradle.project.performance.assertions.enabled=true
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      - uses: ./.github/actions/setup-gradle-java
      - name: Focused module tests
        run: ./gradlew :adapter:outbound:httpclient:test --no-daemon --stacktrace
@@ -241,9 +226,6 @@ jobs:
      # The builder stage inside src/Dockerfile runs this repository's Gradle wrapper to produce the
      # JAR that becomes the image. Validating the wrapper here checks the thing that is about to
      # execute, before it executes, rather than after an image already exists.
-      - name: Validate Gradle wrapper
-        id: gradle-wrapper-validation
-        uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # gradle/actions@v6
      # The tag is the release identity; everything below derives from it. A tag that does not parse
      # stops the release here, rather than producing an image named after whatever ref happened to
      # be checked out.
@@ -393,8 +375,9 @@ jobs:
      # a green trivy-fs has never been evidence about the artifact.
      #
      # --ignorefile is mandatory here as everywhere: .trivyignore.yaml is the single suppression
-      # source and verifyTrivyignore enforces that each entry carries a rationale and an expiry.
-      # An inline --skip or a second ignore file would be a suppression nobody reviews.
+      # source. Each entry carries a rationale and an expiry by policy, reviewed through CODEOWNERS
+      # (.github/dependency-vulnerability-policy.md); an inline --skip or a second ignore file would
+      # be a suppression nobody reviews.
      #
      # This step is the reason `docker push` is further down. A vulnerable image that was pushed and
      # then reported is already pullable by everything that watches the tag.