DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2.5 KiB
kind, slug, title, topic, project, status, sourceRevision, rootTreeNode, evidenceCapturedOn, assets, evidence, source, module
| kind | slug | title | topic | project | status | sourceRevision | rootTreeNode | evidenceCapturedOn | assets | evidence | source | module | |||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| CONCEPT | adapter-outbound-cache-redis-c05 | 렌더된 키 문자열을 받는 API가 없다 | admission-budget-and-backpressure | clean-architecture-backend-template | 게시 전 | 21234e38cdb9a926cbc92bb97a2aee2e4a7d2916 | concept:adapter-outbound-cache-redis-c05 | 2026-09-01 |
|
|
|
adapter-outbound-cache-redis |
렌더된 키 문자열을 받는 API가 없다
QualifiedRedisKey의 javadoc이 이 계층의 규칙이다 — 이미 렌더된 키 문자열을 받는 API가 없으므로 네임스페이스·슬롯·크기 규칙을 우회할 수 없다. 구조가 그것을 강제한다.
본문
QualifiedRedisKey의 javadoc이 이 계층의 규칙이다 — "This is the only key shape the SDK accepts. There is no API that takes an already rendered key string, so namespace, slot, and size rules cannot be bypassed."
타입이 강제하는 형태
RedisTypedKey는 9종만 허용하는 sealed interface고(ValueKey·HashKey·ListKey·SetKey·SortedSetKey·BitmapKey·HyperLogLogKey·GeoKey·StreamKey), 전부 QualifiedRedisKey + 코덱으로 구성된다. QualifiedRedisKey는 RedisNamespace(토큰 3개) + RedisKeyName(entity 토큰 + identifier) + 선택적 RedisSlotTag다. 그리고 RedisKeyRenderer가 중괄호를 쓰는 유일한 장소라서 Cluster 해시 태그가 "the tag and nothing else"를 덮는다.
분석 원문의 규칙 서술
:::evidence key="adapter-outbound-cache-redis-c05" alt="분석 문서 analysis/10-adapter-outbound-cache-redis.md 에서 이 기록의 근거 절을 그대로 잘라낸 15줄. 코드베이스를 측정한 것이 아니라 원본 판정이 무엇을 적었는지를 보여 준다." caption="analysis/10-adapter-outbound-cache-redis.md 발췌 — 15줄" zoom="true" :::
이 검사가 PII 방지의 완결이 아니라고 적는다
RedisKeyRules의 자기 한정도 정직하다 — 규칙은 "mechanical"이며 "Values that are indistinguishable from an ordinary surrogate identifier, such as a bare digit string, cannot be rejected here; those must be fingerprinted by the caller before they become a key part."