3.1 KiB
NOT RUN — the GraphQL bootJar JWT qualification
Recorded as not-run with its reason, per this wave's rule that a gate which could not run is never reported as passing.
What was attempted
cd src
./gradlew :app-bootstrap:graphqlRuntimeQualification --console=plain
* What went wrong:
Cannot locate tasks that match ':app-bootstrap:graphqlRuntimeQualification' as task
'graphqlRuntimeQualification' not found in project ':app-bootstrap'.
exit=1
Why it cannot run
The task does not exist, and neither does the source set the spec names for it.
app-bootstrap/src/ holds main, test, functionalTest, conditionalTransportTest and
sampleOffTest — there is no graphqlRuntimeQualificationTest.
The spec (…-five-adapter-runtime-remediation-review-design.md, GraphQL section) fixes the
canonical task as :app-bootstrap:graphqlRuntimeQualification, depending on bootJar, running the
produced jar as a child process, taking a client-credentials token from a Keycloak container that
imported the same tracked realm artifact, and calling real HTTP /graphql. None of that machinery
was built.
What exists instead, and why it does not substitute
| Artefact | What it actually proves | Why it is not release evidence |
|---|---|---|
GraphqlHttpBoundaryQualificationTest |
/graphql and /graphiql answer over HTTP in a @SpringBootTest |
authenticates with withBasicAuth(USERNAME, PASSWORD) and httpBasic(Customizer.withDefaults()) — test-only Basic auth, not the JWT decoder a deployment runs |
ConditionalTransportCompositionContractTest |
the GraphQL types load and the leaf's runtime membership matches the registry | assertThatCodeLoads(typeName) is class existence; it makes no request and sees no token |
The spec anticipates exactly these two and rules both out by name: the boundary test "may remain a module contract test but is not aggregated into release evidence", and class existence is named as the thing the qualification exists to replace.
Consequence for the Definition of Done
Spec §13 item — "GraphQL blocking qualification runs the bootJar JWT composition exactly once and uses neither class-existence nor test-only Basic Auth as release evidence" — cannot be ticked. It is the one item of the twenty-four in that state.
This was already declared, not discovered
.github/ci-gate-matrix.yml registers the gate as mechanism: delegated-pending with the comment
that it "inherits that control's pending status rather than having none of its own", and
verify-gate-matrix.sh reports 49 gates, 45 verified, 4 delegated-pending. The gap is recorded in
the repository's own control plane; this file is the Wave 6 confirmation of it, not a new finding.
What closing it would take
A new graphqlRuntimeQualificationTest source set, a Gradle lane depending on bootJar, a child
process launcher for the jar, a Keycloak container importing infra/keycloak/realms/ ca-skeleton-realm.json, and the required-class / zero-discovery / stale-XML refusals the spec lists.
That is new capability, which this wave explicitly does not add.