DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
191 lines
16 KiB
XML
191 lines
16 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="1910" viewBox="0 0 1200 1910" role="img">
|
|
<title>terminal evidence</title>
|
|
<desc>Terminal-style rendering generated from retained command output. Sensitive-looking values are redacted in the visual asset.</desc>
|
|
<rect x="1" y="1" width="1198" height="1908" rx="14" fill="#0d1117" stroke="#30363d"/>
|
|
<rect x="1" y="1" width="1198" height="44" rx="14" fill="#161b22"/>
|
|
<rect x="1" y="30" width="1198" height="14" fill="#161b22"/>
|
|
<circle cx="24" cy="22" r="6" fill="#ff5f57"/>
|
|
<circle cx="44" cy="22" r="6" fill="#febc2e"/>
|
|
<circle cx="64" cy="22" r="6" fill="#28c840"/>
|
|
<text x="92" y="27" fill="#8b949e" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace">terminal evidence</text>
|
|
<text x="24" y="68" fill="#c9d1d9" font-size="15" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">$ set -e
|
|
D=$(mktemp -d); trap 'rm -rf "$D"' EXIT
|
|
JAR=/shared/codebase/clean-architecture-backend-template/src/adapter/ou</tspan><tspan x="24" dy="22">tbound/cache-redis/build/libs/cache-redis-0.0.1+21234e38cdb9.jar
|
|
java -version 2>&1 | head -1
|
|
cat > "$D/IdentifierBranch</tspan><tspan x="24" dy="22">Probe.java" <<'JAVA'
|
|
import dev.caskeleton.adapter.outbound.cache.redis.sdk.api.key.RedisKeyRules;
|
|
import java.util.Loca</tspan><tspan x="24" dy="22">le;
|
|
import java.util.Random;
|
|
import java.util.regex.Pattern;
|
|
|
|
public final class IdentifierBranchProbe {
|
|
|
|
private stat</tspan><tspan x="24" dy="22">ic final Pattern IDENTIFIER =
|
|
Pattern.compile("^[A-Za-z0-9][A-Za-z0-9._~-]{0,127}$");
|
|
private static final Patte</tspan><tspan x="24" dy="22">rn JSON_WEB_TOKEN =
|
|
Pattern.compile("^[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}$");
|
|
private stat</tspan><tspan x="24" dy="22">ic final Pattern INTERNATIONAL_PHONE = Pattern.compile("^\\+\\d[\\d.~-]{7,}$");
|
|
|
|
private static final String[] GUARDS </tspan><tspan x="24" dy="22">= {"문자클래스", "메일", "JWT", "전화", "접두"};
|
|
|
|
/** Which guards a value satisfies, in source order. */
|
|
private st</tspan><tspan x="24" dy="22">atic boolean[] guards(String v) {
|
|
String low = v.toLowerCase(Locale.ROOT);
|
|
return new boolean[] {
|
|
!IDENTIF</tspan><tspan x="24" dy="22">IER.matcher(v).matches(),
|
|
v.indexOf('@') >= 0,
|
|
JSON_WEB_TOKEN.matcher(v).matches(),
|
|
INTERNATIONAL_PHON</tspan><tspan x="24" dy="22">E.matcher(v).matches(),
|
|
low.startsWith("bearer") || low.startsWith("eyj"),
|
|
};
|
|
}
|
|
|
|
/** The message the first</tspan><tspan x="24" dy="22"> satisfied guard would produce. */
|
|
private static String predict(String v) {
|
|
boolean[] hit = guards(v);
|
|
if (hi</tspan><tspan x="24" dy="22">t[0]) {
|
|
return "identifier must be 1..128 characters of [A-Za-z0-9._~-] and must not contain a"
|
|
+ " key </tspan><tspan x="24" dy="22">separator";
|
|
}
|
|
if (hit[1]) {
|
|
return "identifier must not contain a mail address";
|
|
}
|
|
if (hit[2]) {
|
|
</tspan><tspan x="24" dy="22"> return "identifier must not contain a JSON web token";
|
|
}
|
|
if (hit[3]) {
|
|
return "identifier must not co</tspan><tspan x="24" dy="22">ntain a phone number";
|
|
}
|
|
if (hit[4]) {
|
|
return "identifier must not contain authentication material";
|
|
}</tspan><tspan x="24" dy="22">
|
|
return "통과";
|
|
}
|
|
|
|
private static String actual(String v) {
|
|
try {
|
|
RedisKeyRules.requireIdentifier(v);
|
|
</tspan><tspan x="24" dy="22"> return "통과";
|
|
} catch (IllegalArgumentException e) {
|
|
return e.getMessage();
|
|
}
|
|
}
|
|
|
|
private static</tspan><tspan x="24" dy="22"> void run(String label, String v) {
|
|
boolean[] hit = guards(v);
|
|
StringBuilder marks = new StringBuilder();
|
|
fo</tspan><tspan x="24" dy="22">r (int i = 0; i < GUARDS.length; i++) {
|
|
marks.append(hit[i] ? GUARDS[i] : " ".repeat(GUARDS[i].length())).append('</tspan><tspan x="24" dy="22"> ');
|
|
}
|
|
System.out.printf("%-16s %-4d %s| %s%n", label, v.length(), marks, actual(v));
|
|
}
|
|
|
|
public static void </tspan><tspan x="24" dy="22">main(String[] args) {
|
|
String jwtHead = "eyJhbGciOiJIUzI1NiJ9";
|
|
String longJwt = jwtHead + "." + "a".repeat(120) </tspan><tspan x="24" dy="22">+ "." + "b".repeat(96);
|
|
|
|
System.out.println("입력 길이 걸리는 검사 전부 | requireId</tspan><tspan x="24" dy="22">entifier 가 낸 메시지");
|
|
System.out.println("-".repeat(122));
|
|
run("test: 메일", "person@example.com");
|
|
run("</tspan><tspan x="24" dy="22">test: 전화", "+821012345678");
|
|
run("test: eyj", jwtHead);
|
|
run("test: bearer", "bearer-abcdefabcdef");
|
|
run("t</tspan><tspan x="24" dy="22">est: JWT", jwtHead + ".eyJzdWIiOiIxIn0.c2lnbmF0dXJlLXZhbHVl");
|
|
run("test: 129자", "a".repeat(129));
|
|
System.out.p</tspan><tspan x="24" dy="22">rintln();
|
|
System.out.println("JWT 분기만 걸리는 값이 있는가");
|
|
run("합성 JWT 26자", "abcdefgh.abcdefgh.abcdefgh"</tspan><tspan x="24" dy="22">);
|
|
run("_로 시작", "_bcdefgh.abcdefgh.abcdefgh");
|
|
run("실제 크기 JWT", longJwt);
|
|
System.out.println();
|
|
S</tspan><tspan x="24" dy="22">ystem.out.println("메일과 전화 분기만 걸리는 값이 있는가");
|
|
System.out.println(" 메일 분기는 '@' 를 요구한다 -> I</tspan><tspan x="24" dy="22">DENTIFIER 문자 클래스에 '@' 없음");
|
|
System.out.println(" 전화 분기는 '+' 로 시작한다 -> IDENTIFIER 첫 문자는 [A-Z</tspan><tspan x="24" dy="22">a-z0-9]");
|
|
System.out.println();
|
|
System.out.println("옮겨 적은 정규식이 실제와 같은지 무작위 입력으로 대조한다."</tspan><tspan x="24" dy="22">);
|
|
selfCheck(200_000);
|
|
}
|
|
|
|
private static void selfCheck(int rounds) {
|
|
String alphabet = "abcdefghjrzABZ09._~</tspan><tspan x="24" dy="22">-@+:{} eyj.";
|
|
Random random = new Random(20260902L);
|
|
int agreed = 0;
|
|
int[] firstGuard = new int[GUARDS.lengt</tspan><tspan x="24" dy="22">h + 1];
|
|
for (int i = 0; i < rounds; i++) {
|
|
int length = 1 + random.nextInt(200);
|
|
StringBuilder b = new S</tspan><tspan x="24" dy="22">tringBuilder(length);
|
|
for (int j = 0; j < length; j++) {
|
|
b.append(alphabet.charAt(random.nextInt(alphabet.</tspan><tspan x="24" dy="22">length())));
|
|
}
|
|
// Half the draws start from a token shape so the later guards are reachable.
|
|
String va</tspan><tspan x="24" dy="22">lue = (i % 2 == 0) ? b.toString() : seeded(random, b.toString());
|
|
if (actual(value).equals(predict(value))) {
|
|
</tspan><tspan x="24" dy="22"> agreed++;
|
|
}
|
|
boolean[] hit = guards(value);
|
|
int landed = GUARDS.length;
|
|
for (int g = 0; g < G</tspan><tspan x="24" dy="22">UARDS.length; g++) {
|
|
if (hit[g]) {
|
|
landed = g;
|
|
break;
|
|
}
|
|
}
|
|
firstGuard[lan</tspan><tspan x="24" dy="22">ded]++;
|
|
}
|
|
System.out.printf(" %d / %d 일치%n", agreed, rounds);
|
|
for (int g = 0; g < GUARDS.length; g++) {
|
|
</tspan><tspan x="24" dy="22"> System.out.printf(" %-10s 에서 갈린 입력 %d%n", GUARDS[g], firstGuard[g]);
|
|
}
|
|
System.out.printf(" %-10</tspan><tspan x="24" dy="22">s %d%n", "통과", firstGuard[GUARDS.length]);
|
|
}
|
|
|
|
/** A value shaped like something the later guards could match. */
|
|
</tspan><tspan x="24" dy="22"> private static String seeded(Random random, String tail) {
|
|
String core = tail.replaceAll("[^A-Za-z0-9_-]", "a");
|
|
</tspan><tspan x="24" dy="22"> return switch (random.nextInt(4)) {
|
|
case 0 -> "eyj" + core;
|
|
case 1 -> "bearer" + core;
|
|
case 2 -> "+8</tspan><tspan x="24" dy="22">210" + core.replaceAll("\\D", "1");
|
|
default -> {
|
|
String seg = (core + "abcdefgh").substring(0, 8);
|
|
</tspan><tspan x="24" dy="22"> yield seg + "." + seg + "." + seg;
|
|
}
|
|
};
|
|
}
|
|
}
|
|
JAVA
|
|
javac -encoding UTF-8 -cp "$JAR" -d "$D" "$D/IdentifierBra</tspan><tspan x="24" dy="22">nchProbe.java"
|
|
java -Dstdout.encoding=UTF-8 -cp "$JAR:$D" IdentifierBranchProbe
|
|
</tspan></text>
|
|
<text x="24" y="1102" fill="#8b949e" font-size="13" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">cwd: /shared/codebase/clean-architecture-backend-template</tspan></text>
|
|
<text x="24" y="1124" fill="#8b949e" font-size="13" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">time: 2026-09-02T12:55:51+00:00 · exit 0</tspan></text>
|
|
<line x1="24" y1="1138" x2="1176" y2="1138" stroke="#30363d"/>
|
|
<text x="24" y="1178" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">openjdk version "21.0.12" 2026-07-21</tspan></text>
|
|
<text x="24" y="1200" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">입력 길이 걸리는 검사 전부 | requireIdentifier 가 낸 메시지</tspan></text>
|
|
<text x="24" y="1222" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">--------------------------------------------------------------------------------------------------------------------------</tspan></text>
|
|
<text x="24" y="1244" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">test: 메일 18 문자클래스 메일 | identifier must be 1..128 characters of [A-Za-z0-9._~-] and must not contain</tspan><tspan x="24" dy="22"> a key separator</tspan></text>
|
|
<text x="24" y="1288" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">test: 전화 13 문자클래스 전화 | identifier must be 1..128 characters of [A-Za-z0-9._~-] and must not contain</tspan><tspan x="24" dy="22"> a key separator</tspan></text>
|
|
<text x="24" y="1332" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">test: eyj 20 접두 | identifier must not contain authentication material</tspan></text>
|
|
<text x="24" y="1354" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">test: bearer 19 접두 | identifier must not contain authentication material</tspan></text>
|
|
<text x="24" y="1376" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">test: JWT 57 JWT 접두 | identifier must not contain a JSON web token</tspan></text>
|
|
<text x="24" y="1398" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">test: 129자 129 문자클래스 | identifier must be 1..128 characters of [A-Za-z0-9._~-] and must not contain a </tspan><tspan x="24" dy="22">key separator</tspan></text>
|
|
<text x="24" y="1442" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
<text x="24" y="1464" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">JWT 분기만 걸리는 값이 있는가</tspan></text>
|
|
<text x="24" y="1486" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">합성 JWT 26자 26 JWT | identifier must not contain a JSON web token</tspan></text>
|
|
<text x="24" y="1508" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">_로 시작 26 문자클래스 JWT | identifier must be 1..128 characters of [A-Za-z0-9._~-] and must not contain </tspan><tspan x="24" dy="22">a key separator</tspan></text>
|
|
<text x="24" y="1552" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">실제 크기 JWT 238 문자클래스 JWT 접두 | identifier must be 1..128 characters of [A-Za-z0-9._~-] and must not conta</tspan><tspan x="24" dy="22">in a key separator</tspan></text>
|
|
<text x="24" y="1596" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
<text x="24" y="1618" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">메일과 전화 분기만 걸리는 값이 있는가</tspan></text>
|
|
<text x="24" y="1640" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 메일 분기는 '@' 를 요구한다 -> IDENTIFIER 문자 클래스에 '@' 없음</tspan></text>
|
|
<text x="24" y="1662" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 전화 분기는 '+' 로 시작한다 -> IDENTIFIER 첫 문자는 [A-Za-z0-9]</tspan></text>
|
|
<text x="24" y="1684" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
<text x="24" y="1706" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">옮겨 적은 정규식이 실제와 같은지 무작위 입력으로 대조한다.</tspan></text>
|
|
<text x="24" y="1728" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 200000 / 200000 일치</tspan></text>
|
|
<text x="24" y="1750" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 문자클래스 에서 갈린 입력 144166</tspan></text>
|
|
<text x="24" y="1772" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 메일 에서 갈린 입력 0</tspan></text>
|
|
<text x="24" y="1794" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> JWT 에서 갈린 입력 23462</tspan></text>
|
|
<text x="24" y="1816" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 전화 에서 갈린 입력 0</tspan></text>
|
|
<text x="24" y="1838" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 접두 에서 갈린 입력 30843</tspan></text>
|
|
<text x="24" y="1860" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 통과 1529</tspan></text>
|
|
</svg>
|