DongHyeonkaandClaude Opus 5
0cd959a494
The review found one defect shape repeated across the platform: surfaces that were declared, bound, and documented, but that nothing read. An operator configuring fullUrlRecording, bodyLogging, retry.policy, validatedDnsPinning, timeout.dns, or any of ten declared metric names got a guarantee the code never delivered. Every such surface is now in exactly one of three states -- wired for real, rejected at startup, or registered in a test-enforced gap list with its reason. No silent no-ops remain. P0: - Activate the platform from bootstrap behind app.httpclient.enabled, with a single auto-configuration importing the nine child configurations. - Give the platform a strict, repository-level ENV contract: 74 leaf fields derived from the settings record tree, unknown APP_HTTPCLIENT_* rejected. - Route typed HTTP service clients through the call kernel via KernelHttpExchangeAdapter, so they stop bypassing platform policy. - Pin dynamic-target DNS resolution to the socket for the life of a call, closing the resolve-then-connect TOCTOU / rebinding window. - Actually transmit the idempotency key, and make retry eligibility depend on transmission rather than on merely holding one. - Reject reactive authentication and reactive redirect at startup instead of declaring support that does not function. - Fix the Reactor-only Stable contract row so the lane stops failing. - Stop advertising HTTP/3 on a transport that negotiates HTTP/1. P1 covers execution and retry accounting, redirect security (per-hop target guarding, sensitive-header stripping, 303 body handling), runtime rotation and transport resource ownership keyed by generation, dynamic-target hardening (subdomain matching, global-unicast classification, strict CIDR parsing), protocol intent, pool and timeout wiring, streaming and body limits, observability parity, and OAuth single-flight refresh on a bounded pool with a bounded wait. P2 covers configuration and documentation drift, the Gradle check wiring for the four hermetic lanes, and the CI gate matrix. Two test-quality defects surfaced while closing these: the HTTP/2 stream saturation test ran against cleartext HTTP/1.1 while asserting nothing about the protocol, and an OAuth contention test slept on a latch that could fire before the callers it meant to observe. Both now assert what their names claim. Verification run: :adapter:outbound:httpclient:check and :app-bootstrap:check (checkstyle, spotless, spotbugs, and the four hermetic lanes), verifyCleanArchitectureDependencies, verifyEnvKeys, verifyOneTypePerFile, verifyDependencyLocks, the documentation and gate-matrix verifiers, and the performance lane against a real TLS+ALPN HTTP/2 server. Not executed, and tracked rather than claimed: Docker/Toxiproxy fault injection, JMH, a real QUIC/HTTP3 server, a real Spring Framework 6.2 distribution (now a delegated-pending gate), live OAuth/TLS/proxy/DNS integration, and a whole-repository check. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
290 lines
9.4 KiB
YAML
290 lines
9.4 KiB
YAML
# Current repository CI controls. This file lists only mechanisms and jobs that exist in this
|
|
# checkout. Build/release supply-chain, image, signing, provenance, SBOM, and tag-release jobs are
|
|
# intentionally absent until their later bounded reconstruction.
|
|
#
|
|
# Fields:
|
|
# release_blocking: true, false, or conditional
|
|
# mechanism: gradle-custom-task, gradle-plugin-task, contract-test, workflow-job,
|
|
# or delegated-pending
|
|
# ref: task, plugin@task, repository-relative test path below src/, or workflow job id
|
|
# workflow/job: canonical workflow and job that execute or represent the control
|
|
# execution: check (through Gradle check), explicit (named in the job), or job
|
|
gates:
|
|
- id: format-lint
|
|
release_blocking: true
|
|
mechanism: gradle-plugin-task
|
|
ref: com.diffplug.spotless@spotlessCheck
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: unit-and-contract-tests
|
|
release_blocking: true
|
|
mechanism: gradle-plugin-task
|
|
ref: java@test
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: conditional-transport-qualification
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: conditionalTransportQualification
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: explicit
|
|
- id: clean-architecture-dependencies
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyCleanArchitectureDependencies
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: environment-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyEnvKeys
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: one-type-per-file
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyOneTypePerFile
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: readme-command-drift
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyReadmeCommands
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: trivy-suppression-governance
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyTrivyignore
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: quarantine-sunset
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyQuarantineSunset
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: public-path-snapshot
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyPublicPathSnapshot
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: explicit
|
|
- id: dependency-locks
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyDependencyLocks
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: explicit
|
|
- id: architecture-contract-test
|
|
release_blocking: true
|
|
mechanism: contract-test
|
|
ref: app-bootstrap/src/test/java/dev/caskeleton/bootstrap/architecture/CleanArchitectureTest.java
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: sample-off
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: sampleOffTest
|
|
workflow: ci-quality-gates.yml
|
|
job: sample-off
|
|
execution: explicit
|
|
- id: gate-matrix-lint
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: gate-matrix-lint
|
|
workflow: ci-quality-gates.yml
|
|
job: gate-matrix-lint
|
|
execution: job
|
|
- id: redis-sdk
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: redis-sdk
|
|
workflow: ci-quality-gates.yml
|
|
job: redis-sdk
|
|
execution: job
|
|
- id: jpa-candidate-evidence
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: jpa-candidate-evidence
|
|
workflow: ci-quality-gates.yml
|
|
job: jpa-candidate-evidence
|
|
execution: job
|
|
- id: jpa-r2-evidence
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: jpa-r2-evidence
|
|
workflow: jpa-r2-evidence.yml
|
|
job: jpa-r2-evidence
|
|
execution: job
|
|
- id: quality-release-gate
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: release-gate
|
|
workflow: ci-quality-gates.yml
|
|
job: release-gate
|
|
execution: job
|
|
- id: flaky-quarantine
|
|
release_blocking: false
|
|
mechanism: workflow-job
|
|
ref: quarantine
|
|
workflow: ci-quality-gates.yml
|
|
job: quarantine
|
|
execution: job
|
|
- id: dependency-review
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: dependency-review
|
|
workflow: dependency-vulnerability.yml
|
|
job: dependency-review
|
|
execution: job
|
|
- id: dependency-submission
|
|
release_blocking: false
|
|
mechanism: workflow-job
|
|
ref: dependency-submission
|
|
workflow: dependency-vulnerability.yml
|
|
job: dependency-submission
|
|
execution: job
|
|
- id: filesystem-vulnerability-scan
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: trivy-fs
|
|
workflow: dependency-vulnerability.yml
|
|
job: trivy-fs
|
|
execution: job
|
|
- id: documentation-links
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: lychee
|
|
workflow: link-check.yml
|
|
job: lychee
|
|
execution: job
|
|
- id: object-storage-minio-managed-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: objectStorageMinioContractTest
|
|
workflow: object-storage-qualification.yml
|
|
job: minio-managed-contract
|
|
execution: explicit
|
|
- id: poster-image-migration
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: posterImageMigrationTest
|
|
workflow: object-storage-qualification.yml
|
|
job: poster-image-v7-migration
|
|
execution: explicit
|
|
- id: object-storage-minio-managed-fault
|
|
release_blocking: conditional
|
|
mechanism: gradle-custom-task
|
|
ref: objectStorageMinioFaultTest
|
|
workflow: object-storage-qualification.yml
|
|
job: minio-managed-fault
|
|
execution: explicit
|
|
- id: object-storage-aws-protected-qualification
|
|
release_blocking: conditional
|
|
mechanism: delegated-pending
|
|
ref: approval-gate-b
|
|
workflow: object-storage-qualification.yml
|
|
job: aws-managed-common-subset
|
|
execution: job
|
|
- id: redis-sdk-support-matrix
|
|
release_blocking: true
|
|
mechanism: contract-test
|
|
ref: adapter/outbound/cache-redis/src/test/java/dev/caskeleton/adapter/outbound/cache/redis/sdk/RedisSupportMatrixTest.java
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
# Promoted from delegated-pending: the workflow is no longer manual-only. A pull request that
|
|
# touches the Redis leaf runs the standalone lane, and the full supported-version x topology
|
|
# matrix runs nightly and on a release candidate. While it was dispatch-only, a release could
|
|
# claim topology evidence that nobody had produced for that commit.
|
|
- id: redis-sdk-topology-evidence
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: topology-evidence
|
|
workflow: redis-sdk-topology.yml
|
|
job: topology-evidence
|
|
execution: job
|
|
- id: httpclient-stable-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientStableContractTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-security-suite
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientSecurityTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-fault-injection
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientFailureInjectionTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-performance-certification
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientPerformanceTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-spring62-api-surface
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: spring62ApiSurfaceScan
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
# The 6.2 API-surface scan above proves the common packages compile against the older surface. It
|
|
# does not prove they run on it, and the two were being conflated: a lane called
|
|
# "spring62CompatibilityTest" reads as a runtime compatibility proof. The Gradle task is renamed to
|
|
# say what it does, and the runtime claim is registered here as its own delegated-pending control
|
|
# so the gap is a tracked absence rather than an unstated one. Executing it needs a Spring
|
|
# Framework 6.2 distribution resolved into a separate test runtime, which this repository's
|
|
# Boot 4.0 baseline does not carry.
|
|
- id: httpclient-spring62-runtime
|
|
release_blocking: conditional
|
|
mechanism: delegated-pending
|
|
ref: spring62-runtime-lane
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: job
|
|
- id: httpclient-spring70-compatibility
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: spring70CompatibilityTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-documentation-drift
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: httpclient-documentation
|
|
workflow: httpclient-release.yml
|
|
job: httpclient-documentation
|
|
execution: job
|
|
- id: httpclient-event-loop-blocking
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientBlockHoundTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|