DongHyeonkaandClaude Opus 5
b2963105a8
The keycloak project ended with four open questions that design could not
settle. A two-VM lab was built to answer them by measurement, and this is
that material: 26 experiments, 125 raw command outputs, 22 browser captures.
Follows the import procedure in README.md.
source/ the originating repository verbatim — 78 documents, 28 SVGs,
8 manifests, plus .source-revision recording the commit
final/ the SSOT
document.md 729 lines written from the 29 experiment documents, not
concatenated: what was predicted, what was measured, and
where the measurement itself was wrong
evidence/raw 125 outputs, flattened to <experiment>__<file> because
the originals collided (01-baseline.txt appeared three
times) and the audit only globs the top level
evidence/meta one per raw file; command and exitCode are null and the
README says why rather than inventing them
evidence/browser 22 captures
assets/ three diagrams through techviz
.techviz/ their VizSpecs
A separate project rather than an addition to keycloak: the B-layer answers
that project's four questions, but the A, C and D layers are about cluster
failure, SSO and operations, and one document.md should hold one subject.
The four question records there can point here through 관계.
Recorded rather than papered over: only three of the 28 diagrams were
remade. The repository forbids hand-drawn SVG and forbids titles inside the
canvas; all 28 originals carry both, so converting them is redrawing, not
reformatting. They stay in source/ and the gap is written into the document.
verify-pipeline.py passes. audit-records.py reports no issues.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
53 lines
2.5 KiB
Plaintext
53 lines
2.5 KiB
Plaintext
# 시작 검증기가 거절하는 문구
|
|
problems.add("a cursor signing key is required; unsigned cursors are client-editable");
|
|
# 그 검증기는 실제로 돈다 — 자동설정의 호출 지점: 127: validator.validate(properties);
|
|
|
|
# 그 키 설정을 소비하는 main 코드
|
|
GraphQlPlatformActuatorEndpoint.java:62: properties.cursor().keyIds(),
|
|
GraphQlPlatformStartupValidator.java:42: if (properties.production() && properties.cursor().keyIds().isEmpty()) {
|
|
# 그중 액추에이터 엔드포인트를 만드는 main 코드: 0
|
|
|
|
# 서명 코덱과 키링
|
|
GraphQlCursorCodec 구현체 수: 1
|
|
그것을 만드는 main 코드: 0
|
|
|
|
# 서명될 커서가 지금 있는가
|
|
커넥션 조립기를 만드는 main 코드: 0
|
|
배포되는 스키마 전체
|
|
type Query {
|
|
"Liveness token for the GraphQL transport — mirrors the web adapter's /healthcheck."
|
|
_health: String!
|
|
}
|
|
|
|
# 그런데 릴리스 게이트가 읽는 매니페스트는 이미 승인 목록에 넣어 두었다
|
|
24- "REQUEST_CONTEXT",
|
|
25- "SECURITY",
|
|
26- "DATALOADER",
|
|
27: "SIGNED_CURSOR_CONNECTION",
|
|
|
|
# 그 부재를 고정하는 테스트
|
|
assertThat(context)
|
|
.as(
|
|
"and nothing signs with it: production refuses to start without a key that "
|
|
+ "protects nothing, which is worse than not asking for one")
|
|
.doesNotHaveBean(GraphQlCursorCodec.class);
|
|
assertThat(context).doesNotHaveBean(GraphQlCursorKeyRing.class);
|
|
});
|
|
# 그리고 요구는 남기라고 못 박는 네 번째 케이스
|
|
@DisplayName("the startup validator still demands the key it cannot make anyone use")
|
|
void theValidatorStillDemandsTheUnusedKey() {
|
|
GraphQlPlatformSettings production =
|
|
GraphQlPlatformSettings.productionDefaults().withCursorKeyIds(Set.of());
|
|
|
|
assertThat(new GraphQlPlatformStartupValidator().problems(production))
|
|
.as(
|
|
"kept, not removed: the demand is right and the missing half is the implementation. "
|
|
+ "When cursor signing reaches the request path, the two cases above invert and "
|
|
+ "this one stays exactly as it is.")
|
|
.anySatisfy(problem -> assertThat(problem).contains("cursor signing key"));
|
|
|
|
# 등급표가 두 능력에 매긴 등급
|
|
149:| cursor 서명 (`pagination/`) | `modelled` | `HmacGraphQlCursorC
|
|
150:| mutation 멱등성 (`mutation/`) | `modelled` | `GraphQlMutation
|
|
168:- **cursor 서명이 요청 경로에 없다 (GQL-INT-003).** `bac
|