DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
15 lines
4.6 KiB
JSON
15 lines
4.6 KiB
JSON
{
|
|
"assetKey": "a14-f005-publicpaths-restrictedpathrule",
|
|
"kind": "terminal",
|
|
"command": "set -e\nset -o pipefail\nA=adapter/inbound/web/src/main/java/dev/caskeleton/adapter/inbound/web/auth\necho \"# 등록 순서 — 이 순서가 결과를 정한다\"\nsed -n '83,94p' $A/SecurityConfig.java\necho\necho \"# 규칙 자신은 약해지는 것을 막는다\"\ngrep -n -A4 'requiredAuthorities.isEmpty()' $A/RestrictedPathRule.java\necho\necho \"# 규칙을 내놓는 자리\"\ngrep -rn 'new RestrictedPathRule(' --include=*.java . --exclude-dir=build \\\n | sed -E 's#^[^:]*/src/(main|test)/[^:]*/([^:/]+):#\\1 · \\2:#'\necho\necho \"# 프로덕션이 등록하는 패턴과 그것을 켜야 하는 두 스위치\"\nB=app-bootstrap/src/main/java/dev/caskeleton/bootstrap\nsed -n '25,28p;32p' $B/autoconfigure/fileserver/FileserverAdminPlaneConfiguration.java\necho \" -- 그 설정 클래스를 이름으로 부르는 자리 전부\"\ngit -C .. grep -n 'FileserverAdminPlaneConfiguration'\necho \" -- 그 유일한 @Import 가 든 자동설정과 그 조건\"\nsed -n '61,73p' $B/autoconfigure/fileserver/FileserverPlatformAutoConfiguration.java\ngrep -n 'String PREFIX =' $B/autoconfigure/fileserver/FileserverPlatformSettings.java\necho \" -- 스캔이 그 패키지를 제외하므로 다른 길이 없다\"\nsed -n '49,57p;100,114p' $B/CaSkeletonApplication.java\necho \" -- 관리 라우트 자체는 관리 컨텍스트에 등록되고 포트는 따로 출하된다\"\nsed -n '26,31p' $B/autoconfigure/fileserver/FileserverAdminManagementContextConfiguration.java\ngrep -n 'APP_SERVER_PORT\\|MANAGEMENT_SERVER_PORT' app-bootstrap/src/main/resources/application.yml\ngrep -n 'APP_FILESERVER_PLATFORM_ADMIN_ENABLED\\|APP_FILESERVER_PLATFORM_ENABLED\\|ADMIN_ROLES\\|public-paths' \\\n app-bootstrap/src/main/resources/application.yml\necho\necho \"# 공개 경로를 읽는 자리 — 접근자로 읽는 쪽과 원시 키로 읽는 쪽\"\ngrep -rn 'publicPaths()' --include=*.java . --exclude-dir=build \\\n | sed -E 's#^[^:]*/src/(main|test)/[^:]*/([^:/]+):#\\1 · \\2:#'\necho \" -- 저장소 전체에서 그 키를 쥔 파일. 점 표기와 환경 변수와 중첩 YAML 세 형태로 찾는다\"\nKEYED=$(grep -rlI -e 'ca-skeleton\\.security\\.public-paths' -e 'SECURITY_PUBLIC_PATHS' \\\n -e '^ *public-paths:' .. --exclude-dir=build --exclude-dir=.git --exclude-dir=.gradle \\\n | sed 's#^\\.\\./##' | sort)\necho \"$KEYED\" | while IFS= read -r f; do\n if git -C .. ls-files --error-unmatch \"$f\" >/dev/null 2>&1; then echo \" $f\"; else echo \" ~ $f\"; fi\ndone\necho -n \" 전부 / 그중 추적되지 않는 것(~) : \"\necho -n \"$(echo \"$KEYED\" | wc -l) / \"\necho \"$KEYED\" | while IFS= read -r f; do\n git -C .. ls-files --error-unmatch \"$f\" >/dev/null 2>&1 || echo x\ndone | wc -l\necho -n \" 그중 제한 패턴을 함께 언급하는 파일 : \"\n{ echo \"$KEYED\" | sed 's#^#../#' | xargs grep -lI -e 'RestrictedPathRule' -e 'internal/fileserver' \\\n || echo \"(0)\"; }\necho\necho \"# 겹침을 보는 것이 있는가 — 규칙 이름을 쓰는 자리 전부와 공개 경로 스냅숏 게이트\"\ngit -C .. grep -n -l 'RestrictedPathRule' || echo \" (일치 0)\"\necho -n \" 공개 경로 스냅숏 게이트가 있는 파일 : \"\n{ git -C .. grep -l 'verifyPublicPathSnapshot' -- '*.gradle' || true; } | tr '\\n' ' '; echo\necho \" 그 게이트가 읽는 두 입력 :\"\nsed -n '26p;28p' gradle/public-path-snapshot.gradle\necho -n \" 값 쪽 입력이 추적되는가 : \"\n{ git -C .. check-ignore -v src/.env || echo \" (무시되지 않음)\"; }\necho \" 그 입력이 없으면 :\"\nsed -n '2,4p' gradle/public-path-snapshot.gradle\necho \" 그런데도 그 태스크를 부르는 자리 :\"\ngit -C .. grep -n 'verifyPublicPathSnapshot' -- '.github/workflows/*' | grep -v '::error::'\necho \" 워크플로 전체에서 .env 를 입에 올리는 자리 전부 :\"\n{ git -C .. grep -n '\\.env' -- '.github/workflows/*' || echo \" (없음)\"; }\necho -n \" 그 게이트가 제한 패턴을 언급하는가 : \"\n{ git -C .. grep -c 'RestrictedPathRule\\|internal/fileserver' -- '*.gradle' 'docs/security/*' || echo 0; }\n",
|
|
"cwd": "/shared/codebase/clean-architecture-backend-template/src",
|
|
"exitCode": 0,
|
|
"executedAt": "2026-09-02T22:39:35+00:00",
|
|
"sourceRevision": "21234e38cdb9a926cbc92bb97a2aee2e4a7d2916",
|
|
"raw": "evidence/raw/a14-f005-publicpaths-restrictedpathrule.txt",
|
|
"svg": "evidence/rendered/a14-f005-publicpaths-restrictedpathrule.svg",
|
|
"rawSha256": "ceb86e3586817c5c1deb4c0eaf4dfff0a9f884a3bf7209c7994bc5aeedbf05ef",
|
|
"lines": 138,
|
|
"redaction": "none — 값은 이 자산이 저장소에서 읽은 것이다"
|
|
}
|