DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
107 lines
10 KiB
XML
107 lines
10 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="1250" viewBox="0 0 1200 1250" role="img">
|
|
<title>terminal evidence</title>
|
|
<desc>Terminal-style rendering generated from retained command output. Sensitive-looking values are redacted in the visual asset.</desc>
|
|
<rect x="1" y="1" width="1198" height="1248" rx="14" fill="#0d1117" stroke="#30363d"/>
|
|
<rect x="1" y="1" width="1198" height="44" rx="14" fill="#161b22"/>
|
|
<rect x="1" y="30" width="1198" height="14" fill="#161b22"/>
|
|
<circle cx="24" cy="22" r="6" fill="#ff5f57"/>
|
|
<circle cx="44" cy="22" r="6" fill="#febc2e"/>
|
|
<circle cx="64" cy="22" r="6" fill="#28c840"/>
|
|
<text x="92" y="27" fill="#8b949e" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace">terminal evidence</text>
|
|
<text x="24" y="68" fill="#c9d1d9" font-size="15" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">$ set -e
|
|
set -o pipefail
|
|
D=$(mktemp -d); trap 'rm -rf "$D"' EXIT
|
|
H=/shared/codebase/clean-architecture-backend-template/</tspan><tspan x="24" dy="22">src/adapter/outbound/httpclient
|
|
JAR=$H/build/libs/httpclient-0.0.1+21234e38cdb9.jar
|
|
java -version 2>&1 | head -1
|
|
javac -</tspan><tspan x="24" dy="22">encoding UTF-8 -cp "$JAR" -d "$D" \
|
|
"$H/src/testkit/java/dev/caskeleton/adapter/outbound/httpclient/testkit/ClientProf</tspan><tspan x="24" dy="22">iles.java"
|
|
cat > "$D/DnsPinProbe.java" <<'JAVA'
|
|
import dev.caskeleton.adapter.outbound.httpclient.profile.ClientMode;
|
|
im</tspan><tspan x="24" dy="22">port dev.caskeleton.adapter.outbound.httpclient.profile.ClientProfile;
|
|
import dev.caskeleton.adapter.outbound.httpclient</tspan><tspan x="24" dy="22">.profile.HttpProtocol;
|
|
import dev.caskeleton.adapter.outbound.httpclient.testkit.ClientProfiles;
|
|
import dev.caskeleton.a</tspan><tspan x="24" dy="22">dapter.outbound.httpclient.transport.BlockingTransportCapabilities;
|
|
import dev.caskeleton.adapter.outbound.httpclient.tr</tspan><tspan x="24" dy="22">ansport.ReactiveTransportCapabilities;
|
|
import dev.caskeleton.adapter.outbound.httpclient.transport.TransportCapabilityVa</tspan><tspan x="24" dy="22">lidator;
|
|
import java.util.Set;
|
|
|
|
public final class DnsPinProbe {
|
|
|
|
private static final TransportCapabilityValidator VA</tspan><tspan x="24" dy="22">LIDATOR = new TransportCapabilityValidator();
|
|
private static final Set<HttpProtocol> BOTH = Set.of(HttpProtocol.HTTP_1</tspan><tspan x="24" dy="22">_1, HttpProtocol.HTTP_2);
|
|
|
|
private static BlockingTransportCapabilities blocking(boolean pinning, boolean stable) {
|
|
</tspan><tspan x="24" dy="22"> return new BlockingTransportCapabilities(BOTH, true, true, true, true, pinning, stable);
|
|
}
|
|
|
|
private static Reactiv</tspan><tspan x="24" dy="22">eTransportCapabilities reactive(boolean pinning, boolean stable) {
|
|
return new ReactiveTransportCapabilities(
|
|
</tspan><tspan x="24" dy="22"> BOTH, true, true, true, true, pinning, stable, true, true);
|
|
}
|
|
|
|
private static String verdict(Runnable call) {
|
|
t</tspan><tspan x="24" dy="22">ry {
|
|
call.run();
|
|
return "통과";
|
|
} catch (RuntimeException rejected) {
|
|
String message = rejected.ge</tspan><tspan x="24" dy="22">tMessage();
|
|
int at = message.indexOf("requires: ");
|
|
return "거부 — " + (at < 0 ? message : message.substrin</tspan><tspan x="24" dy="22">g(at + "requires: ".length()));
|
|
}
|
|
}
|
|
|
|
public static void main(String[] args) {
|
|
ClientProfile dynamic =
|
|
</tspan><tspan x="24" dy="22"> ClientProfiles.builder("lookup").mode(ClientMode.DYNAMIC).protocols(BOTH).build();
|
|
|
|
System.out.println("동적 대상 </tspan><tspan x="24" dy="22">프로파일 하나에 두 플래그 조합 넷을 넣는다");
|
|
System.out.println();
|
|
System.out.println("-".repeat(96));
|
|
bool</tspan><tspan x="24" dy="22">ean[][] combinations = {{true, true}, {false, false}, {true, false}, {false, true}};
|
|
for (boolean[] flags : combinat</tspan><tspan x="24" dy="22">ions) {
|
|
String label =
|
|
String.format("pinning=%-5s stable=%-5s", flags[0], flags[1]);
|
|
System.out.p</tspan><tspan x="24" dy="22">rintln(label);
|
|
System.out.println(" 블로킹 : " + verdict(() -> VALIDATOR.validate(dynamic, blocking(flags[0], f</tspan><tspan x="24" dy="22">lags[1]))));
|
|
System.out.println(" 반응형 : " + verdict(() -> VALIDATOR.validate(dynamic, reactive(flags[0], fla</tspan><tspan x="24" dy="22">gs[1]))));
|
|
}
|
|
System.out.println();
|
|
System.out.println("출하된 반응형 전송 둘의 두 플래그");
|
|
ReactiveTran</tspan><tspan x="24" dy="22">sportCapabilities netty = ReactiveTransportCapabilities.reactorNetty();
|
|
ReactiveTransportCapabilities jetty = Reacti</tspan><tspan x="24" dy="22">veTransportCapabilities.jettyHttp3Experimental();
|
|
System.out.printf(" reactorNetty pinning=%-5s stable=%s</tspan><tspan x="24" dy="22">%n",
|
|
netty.validatedDnsPinning(), netty.dynamicTargetStable());
|
|
System.out.printf(" jettyHttp3Experimental </tspan><tspan x="24" dy="22">pinning=%-5s stable=%s%n",
|
|
jetty.validatedDnsPinning(), jetty.dynamicTargetStable());
|
|
}
|
|
}
|
|
JAVA
|
|
javac -encoding</tspan><tspan x="24" dy="22"> UTF-8 -cp "$JAR:$D" -d "$D" "$D/DnsPinProbe.java"
|
|
java -Dstdout.encoding=UTF-8 -cp "$JAR:$D" DnsPinProbe
|
|
</tspan></text>
|
|
<text x="24" y="706" fill="#8b949e" font-size="13" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">cwd: /shared/codebase/clean-architecture-backend-template</tspan></text>
|
|
<text x="24" y="728" fill="#8b949e" font-size="13" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">time: 2026-09-02T14:06:51+00:00 · exit 0</tspan></text>
|
|
<line x1="24" y1="742" x2="1176" y2="742" stroke="#30363d"/>
|
|
<text x="24" y="782" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">openjdk version "21.0.12" 2026-07-21</tspan></text>
|
|
<text x="24" y="804" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">동적 대상 프로파일 하나에 두 플래그 조합 넷을 넣는다</tspan></text>
|
|
<text x="24" y="826" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
<text x="24" y="848" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">------------------------------------------------------------------------------------------------</tspan></text>
|
|
<text x="24" y="870" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">pinning=true stable=true </tspan></text>
|
|
<text x="24" y="892" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 블로킹 : 통과</tspan></text>
|
|
<text x="24" y="914" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 반응형 : 통과</tspan></text>
|
|
<text x="24" y="936" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">pinning=false stable=false</tspan></text>
|
|
<text x="24" y="958" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 블로킹 : 거부 — validated DNS pinning for dynamic targets, call-scoped validated DNS pinning</tspan></text>
|
|
<text x="24" y="980" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 반응형 : 거부 — validated DNS pinning for dynamic targets</tspan></text>
|
|
<text x="24" y="1002" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">pinning=true stable=false</tspan></text>
|
|
<text x="24" y="1024" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 블로킹 : 거부 — validated DNS pinning for dynamic targets</tspan></text>
|
|
<text x="24" y="1046" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 반응형 : 거부 — validated DNS pinning for dynamic targets</tspan></text>
|
|
<text x="24" y="1068" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">pinning=false stable=true </tspan></text>
|
|
<text x="24" y="1090" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 블로킹 : 거부 — call-scoped validated DNS pinning</tspan></text>
|
|
<text x="24" y="1112" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> 반응형 : 통과</tspan></text>
|
|
<text x="24" y="1134" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"></tspan></text>
|
|
<text x="24" y="1156" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0">출하된 반응형 전송 둘의 두 플래그</tspan></text>
|
|
<text x="24" y="1178" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> reactorNetty pinning=true stable=true</tspan></text>
|
|
<text x="24" y="1200" fill="#e6edf3" font-size="14" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" xml:space="preserve"><tspan x="24" dy="0"> jettyHttp3Experimental pinning=false stable=false</tspan></text>
|
|
</svg>
|