DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
15 lines
4.6 KiB
JSON
15 lines
4.6 KiB
JSON
{
|
|
"assetKey": "a13-f003-accesscontext-reveal",
|
|
"kind": "terminal",
|
|
"command": "set -e\nset -o pipefail\nD=$(mktemp -d); trap 'rm -rf \"$D\"' EXIT\nC=/shared/codebase/clean-architecture-backend-template\nN=$C/src/adapter/outbound/notification\nCORE=$C/src/application-core\njava -version 2>&1 | head -1\nCP=$(find \"$N/build/libs\" \"$CORE/build/libs\" -name \"*+21234e38cdb9.jar\" 2>/dev/null | tr '\\n' ':')\ncat > \"$D/AccessContextProbe.java\" <<'JAVA'\nimport dev.caskeleton.adapter.outbound.notification.platform.security.AesGcmContactPointProtector;\nimport dev.caskeleton.application.notification.platform.contact.ContactPointValue;\nimport dev.caskeleton.application.notification.platform.contact.EmailAddress;\nimport dev.caskeleton.application.notification.platform.security.AccessContext;\nimport dev.caskeleton.application.notification.platform.security.ProtectedContactPoint;\nimport dev.caskeleton.application.notification.platform.security.SecretKeyMaterial;\nimport dev.caskeleton.application.notification.platform.security.SecretMaterialProvider;\nimport dev.caskeleton.application.notification.platform.security.SecretPurpose;\nimport java.lang.reflect.Constructor;\nimport java.lang.reflect.Field;\nimport java.util.Arrays;\n\npublic final class AccessContextProbe {\n\n /** Deterministic material; the probe only needs the round trip to work. */\n private static final SecretMaterialProvider KEYS =\n new SecretMaterialProvider() {\n @Override\n public SecretKeyMaterial activeKey(SecretPurpose purpose) {\n return material(purpose);\n }\n\n @Override\n public SecretKeyMaterial keyById(String keyId) {\n return material(\n keyId.startsWith(\"mac\") ? SecretPurpose.CONTACT_LOOKUP_HMAC\n : SecretPurpose.CONTACT_ENCRYPTION);\n }\n\n private SecretKeyMaterial material(SecretPurpose purpose) {\n boolean hmac = purpose == SecretPurpose.CONTACT_LOOKUP_HMAC;\n byte[] bytes = new byte[32];\n Arrays.fill(bytes, hmac ? (byte) 0x22 : (byte) 0x11);\n return new SecretKeyMaterial(hmac ? \"mac-1\" : \"enc-1\", purpose, bytes);\n }\n };\n\n public static void main(String[] args) throws Exception {\n AesGcmContactPointProtector protector = new AesGcmContactPointProtector(KEYS);\n ProtectedContactPoint stored = protector.protect(EmailAddress.parse(\"user@example.com\"));\n\n System.out.println(\"[문맥을 바꿔 가며 같은 값을 복호화한다]\");\n AccessContext[] contexts = {\n AccessContext.dispatch(\"ses-primary\"),\n new AccessContext(\"BREAK_GLASS\", \"operator@example.com\", true),\n new AccessContext(\"SUPPORT_LOOKUP\", \"agent-42\", true),\n };\n for (AccessContext context : contexts) {\n ContactPointValue revealed = protector.reveal(stored, context);\n System.out.printf(\n \" purposeCode=%-14s auditRequired=%-5s -> %s%n\",\n context.purposeCode(), context.auditRequired(), revealed.getClass().getSimpleName());\n }\n System.out.println();\n\n System.out.println(\"[복호화기가 들고 있는 협력자]\");\n for (Constructor<?> constructor : AesGcmContactPointProtector.class.getDeclaredConstructors()) {\n System.out.printf(\" 생성자 인자 : %s%n\",\n Arrays.toString(Arrays.stream(constructor.getParameterTypes())\n .map(Class::getSimpleName).toArray()));\n }\n for (Field field : AesGcmContactPointProtector.class.getDeclaredFields()) {\n if (!field.getType().isPrimitive() && !field.getName().startsWith(\"$\")) {\n System.out.printf(\" 필드 %-10s : %s%n\", field.getName(), field.getType().getSimpleName());\n }\n }\n System.out.println();\n\n System.out.println(\"[dispatch 팩토리가 정하는 값]\");\n AccessContext dispatch = AccessContext.dispatch(\"ses-primary\");\n System.out.printf(\" purposeCode=%s actorRef=%s auditRequired=%s%n\",\n dispatch.purposeCode(), dispatch.actorRef(), dispatch.auditRequired());\n }\n}\nJAVA\njavac -encoding UTF-8 -cp \"$CP\" -d \"$D\" \"$D/AccessContextProbe.java\"\njava -Dstdout.encoding=UTF-8 -cp \"$CP$D\" AccessContextProbe\n",
|
|
"cwd": "/shared/codebase/clean-architecture-backend-template",
|
|
"exitCode": 0,
|
|
"executedAt": "2026-09-02T14:58:28+00:00",
|
|
"sourceRevision": "21234e38cdb9a926cbc92bb97a2aee2e4a7d2916",
|
|
"raw": "evidence/raw/a13-f003-accesscontext-reveal.txt",
|
|
"svg": "evidence/rendered/a13-f003-accesscontext-reveal.svg",
|
|
"rawSha256": "90aa2f2b89916f263061a947a3ddc1d5663787c3a3308c9dd6814090391bcc13",
|
|
"lines": 17,
|
|
"redaction": "none — 밀폐 탐침 실행 출력, 자격증명 없음"
|
|
}
|