# NOT RUN — the GraphQL bootJar JWT qualification

Recorded as not-run with its reason, per this wave's rule that a gate which could not run is never
reported as passing.

## What was attempted

```bash
cd src
./gradlew :app-bootstrap:graphqlRuntimeQualification --console=plain
```

```
* What went wrong:
Cannot locate tasks that match ':app-bootstrap:graphqlRuntimeQualification' as task
'graphqlRuntimeQualification' not found in project ':app-bootstrap'.
exit=1
```

## Why it cannot run

The task does not exist, and neither does the source set the spec names for it.
`app-bootstrap/src/` holds `main`, `test`, `functionalTest`, `conditionalTransportTest` and
`sampleOffTest` — there is no `graphqlRuntimeQualificationTest`.

The spec (`…-five-adapter-runtime-remediation-review-design.md`, GraphQL section) fixes the
canonical task as `:app-bootstrap:graphqlRuntimeQualification`, depending on `bootJar`, running the
produced jar as a child process, taking a client-credentials token from a Keycloak container that
imported the same tracked realm artifact, and calling real HTTP `/graphql`. None of that machinery
was built.

## What exists instead, and why it does not substitute

| Artefact | What it actually proves | Why it is not release evidence |
| --- | --- | --- |
| `GraphqlHttpBoundaryQualificationTest` | `/graphql` and `/graphiql` answer over HTTP in a `@SpringBootTest` | authenticates with `withBasicAuth(USERNAME, PASSWORD)` and `httpBasic(Customizer.withDefaults())` — test-only Basic auth, not the JWT decoder a deployment runs |
| `ConditionalTransportCompositionContractTest` | the GraphQL types load and the leaf's runtime membership matches the registry | `assertThatCodeLoads(typeName)` is class existence; it makes no request and sees no token |

The spec anticipates exactly these two and rules both out by name: the boundary test "may remain a
module contract test but is not aggregated into release evidence", and class existence is named as
the thing the qualification exists to replace.

## Consequence for the Definition of Done

Spec §13 item — *"GraphQL blocking qualification runs the bootJar JWT composition exactly once and
uses neither class-existence nor test-only Basic Auth as release evidence"* — **cannot be ticked**.
It is the one item of the twenty-four in that state.

## This was already declared, not discovered

`.github/ci-gate-matrix.yml` registers the gate as `mechanism: delegated-pending` with the comment
that it "inherits that control's pending status rather than having none of its own", and
`verify-gate-matrix.sh` reports `49 gates, 45 verified, 4 delegated-pending`. The gap is recorded in
the repository's own control plane; this file is the Wave 6 confirmation of it, not a new finding.

## What closing it would take

A new `graphqlRuntimeQualificationTest` source set, a Gradle lane depending on `bootJar`, a child
process launcher for the jar, a Keycloak container importing `infra/keycloak/realms/
ca-skeleton-realm.json`, and the required-class / zero-discovery / stale-XML refusals the spec lists.
That is new capability, which this wave explicitly does not add.