docs(b4): item 3 is no longer unmeasured — link it to the follow-up result

B-4 left role propagation open because oauth2-proxy was not deployed yet. B-7 deployed it and the follow-up measured it: the value does not change with request count, only when a new session is created. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs: close the three untested items — all three are now measured
2026-09-04 18:10:43 +09:00 · 2026-09-04 18:10:04 +09:00 · 2026-09-04 18:04:44 +09:00 · 2026-09-04 17:28:01 +09:00 · 2026-09-04 17:12:31 +09:00 · 2026-09-04 17:01:54 +09:00
147 changed files with 7600 additions and 56 deletions
@@ -0,0 +1,2 @@
+[     275ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=G2-BDWkehNWO7hGwhYCxXBVRKZ6AomLIrSLBtIXr0Gw%3A%2Fapi%2Fecho&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=4155f58e-6a58-e47b-93bd-7e2b625c2b91.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0
+[     408ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=Da-7OcMB4f7vyHgr-6CqrTtJpmj1R_SfRfcE3CUJNzE%3A%2Ffavicon.ico&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=96d66247-91b0-0cc1-89dc-e527c2b69bf2.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0
@@ -0,0 +1,2 @@
+[     266ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=TZnQvjIWCEySrf4PMg2WLVFoOfkyOJWB58f2LGjVfpo%3A%2Fapi%2Fecho&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=8ae913a1-2647-0ed9-625e-3d80e1565024.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0
+[     416ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=uAYwZp59ncz95XjkJXAlIgsT7oksBQBViiQS07t2eow%3A%2Ffavicon.ico&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=7b7fc816-0b27-93a0-83b8-656488813253.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0
@@ -0,0 +1,2 @@
+[     287ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=0EOFj1PoLyPil0dgukpi7zKW4JKnGZTP9Wj6EhTR-lw%3A%2Fapi%2Fecho&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=d13cc206-133f-00a9-9908-599988c4d7cf.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0
+[     457ms] [ERROR] Failed to load resource: the server responded with a status of 502 () @ https://app2.hyeonworks.com/oauth2/callback?state=kbYC5O4_ELsoQFw85vyYfgWEqlI2yWImB4rmelbmSTM%3A%2Ffavicon.ico&session_state=vsW8xDlLJN3DUl-0B-X1WL7Q&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=91f9fde9-f376-b6f3-4622-a1ba674cc4fd.vsW8xDlLJN3DUl-0B-X1WL7Q.80431dbc-af81-4673-9790-ad06d1570b2e:0
@@ -0,0 +1 @@
+[     307ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0
@@ -0,0 +1 @@
+[     261ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0
@@ -0,0 +1 @@
+[     882ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0
@@ -0,0 +1 @@
+[     178ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0
@@ -0,0 +1,2 @@
+[   19340ms] [ERROR] Failed to load resource: the server responded with a status of 403 () @ https://app2.hyeonworks.com/oauth2/callback?state=rKipZCUv8W5a-xgYheJbjBsInoD5Il1AaF1RlM_RB2s%3A%2Fapi%2Fecho&session_state=Mw52KcQijFB9Bq4rN-C4SF5Y&iss=https%3A%2F%2Fauth.hyeonworks.com%2Frealms%2Fkeycloak-patterns&code=f9a4835a-2af3-b886-bd04-10b5347ee8d2.Mw52KcQijFB9Bq4rN-C4SF5Y.80431dbc-af81-4673-9790-ad06d1570b2e:0
+[   20374ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0
@@ -0,0 +1 @@
+[     210ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0
@@ -0,0 +1 @@
+[     423ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0
@@ -0,0 +1,8 @@
+[    1127ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[    2377ms] [WARNING] <meta name="apple-mobile-web-app-capable" content="yes"> is deprecated. Please include <meta name="mobile-web-app-capable" content="yes"> @ https://app2.hyeonworks.com/explore?schemaVersion=1&panes=%7B%22h4a%22%3A%7B%22datasource%22%3A%22PBFA97CFB590B2093%22%2C%22queries%22%3A%5B%7B%22refId%22%3A%22A%22%2C%22expr%22%3A%22vendor_cluster_size%22%2C%22range%22%3Atrue%2C%22instant%22%3Afalse%2C%22editorMode%22%3A%22code%22%2C%22legendFormat%22%3A%22cluster_size+%7B%7Bpod%7D%7D%22%2C%22datasource%22%3A%7B%22type%22%3A%22prometheus%22%2C%22uid%22%3A%22PBFA97CFB590B2093%22%7D%7D%2C%7B%22refId%22%3A%22B%22%2C%22expr%22%3A%22up%7Bjob%3D%5C%22keycloak%5C%22%7D%22%2C%22range%22%3Atrue%2C%22instant%22%3Afalse%2C%22editorMode%22%3A%22code%22%2C%22legendFormat%22%3A%22up+%7B%7Bpod%7D%7D%22%2C%22datasource%22%3A%7B%22type%22%3A%22prometheus%22%2C%22uid%22%3A%22PBFA97CFB590B2093%22%7D%7D%5D%2C%22range%22%3A%7B%22from%22%3A%22now-30m%22%2C%22to%22%3A%22now%22%7D%7D%7D&orgId=1:0
+[    2472ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[    3501ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[    5119ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[    8511ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   14956ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   28065ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
@@ -0,0 +1,10 @@
+[    1362ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[    1874ms] [WARNING] <meta name="apple-mobile-web-app-capable" content="yes"> is deprecated. Please include <meta name="mobile-web-app-capable" content="yes"> @ https://app2.hyeonworks.com/explore?schemaVersion=1&orgId=1&panes=%7B%22a%22%3A%7B%22datasource%22%3A%22PBFA97CFB590B2093%22%2C%22queries%22%3A%5B%7B%22refId%22%3A%22A%22%2C%22expr%22%3A%22vendor_cluster_size%22%2C%22range%22%3Atrue%2C%22instant%22%3Afalse%2C%22editorMode%22%3A%22code%22%2C%22legendFormat%22%3A%22cluster_size%20%7B%7Bpod%7D%7D%22%2C%22datasource%22%3A%7B%22type%22%3A%22prometheus%22%2C%22uid%22%3A%22PBFA97CFB590B2093%22%7D%7D%2C%7B%22refId%22%3A%22B%22%2C%22expr%22%3A%22up%7Bjob%3D%5C%22keycloak%5C%22%7D%22%2C%22range%22%3Atrue%2C%22instant%22%3Afalse%2C%22editorMode%22%3A%22code%22%2C%22legendFormat%22%3A%22up%20%7B%7Bpod%7D%7D%22%2C%22datasource%22%3A%7B%22type%22%3A%22prometheus%22%2C%22uid%22%3A%22PBFA97CFB590B2093%22%7D%7D%5D%2C%22range%22%3A%7B%22from%22%3A%221788502680000%22%2C%22to%22%3A%221788503520000%22%7D%7D%7D:0
+[    2907ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[    3998ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[    6253ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[    9426ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   12495ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   24486ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   31338ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   46196ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
@@ -0,0 +1,198 @@
+[    1319ms] [WARNING] <meta name="apple-mobile-web-app-capable" content="yes"> is deprecated. Please include <meta name="mobile-web-app-capable" content="yes"> @ https://app2.hyeonworks.com/explore?schemaVersion=1&orgId=1&panes=%7B%22a%22%3A%7B%22datasource%22%3A%22PBFA97CFB590B2093%22%2C%22queries%22%3A%5B%7B%22refId%22%3A%22A%22%2C%22expr%22%3A%22vendor_cluster_size%22%2C%22range%22%3Atrue%2C%22instant%22%3Afalse%2C%22editorMode%22%3A%22code%22%2C%22legendFormat%22%3A%22cluster_size%20%7B%7Bpod%7D%7D%22%2C%22datasource%22%3A%7B%22type%22%3A%22prometheus%22%2C%22uid%22%3A%22PBFA97CFB590B2093%22%7D%7D%2C%7B%22refId%22%3A%22B%22%2C%22expr%22%3A%22vendor_statistics_approximate_entries_unique%7Bcache%3D%5C%22sessions%5C%22%7D%22%2C%22range%22%3Atrue%2C%22instant%22%3Afalse%2C%22editorMode%22%3A%22code%22%2C%22legendFormat%22%3A%22sessions%20%5Cuce90%5Cuc2dc%20%7B%7Bpod%7D%7D%22%2C%22datasource%22%3A%7B%22type%22%3A%22prometheus%22%2C%22uid%22%3A%22PBFA97CFB590B2093%22%7D%7D%5D%2C%22range%22%3A%7B%22from%22%3A%221788497040000%22%2C%22to%22%3A%221788499080000%22%7D%7D%7D:0
+[    5941ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   11107ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   14234ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   17005ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   23049ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   30565ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   44135ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   54992ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   63653ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   70658ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[   90768ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  105475ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  114995ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  125443ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  137321ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  147252ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  167227ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  179100ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  187598ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  207362ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  213255ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  230544ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  248833ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  257549ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  262324ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  274443ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  294124ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  310689ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  312049ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  327025ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  339933ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  342391ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  362305ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  370693ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  378685ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  397930ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  414007ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  419130ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  420355ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  428557ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  442088ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  445041ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  446677ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  460087ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  462505ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  463673ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  482762ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  495123ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  513442ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  516414ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  536581ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  543441ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  563624ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  580510ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  588408ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  594209ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  604166ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  605295ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  621987ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  639705ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  653320ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  660911ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  678105ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  693662ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  703089ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  704712ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  719727ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  725514ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  730429ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  735135ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  736677ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  751626ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  767197ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  782052ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  797775ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  803343ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  822168ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  828683ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  845938ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  865903ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  883116ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  894375ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  898471ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  914886ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  933184ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  953353ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  963902ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  982846ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[  998975ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1000721ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1003229ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1009879ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1016334ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1023805ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1043684ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1049467ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1059107ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1075856ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1076956ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1094159ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1102825ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1116077ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1134809ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1136553ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1141191ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1158221ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1173507ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1190834ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1198506ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1217761ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1231342ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1233528ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1243017ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1253381ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1256056ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1258513ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1271317ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1284530ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1301830ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1307562ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1310330ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1317970ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1328668ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1336338ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1340155ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1346989ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1348836ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1352113ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1367871ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1371158ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1390720ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1405259ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1420920ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1433518ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1450513ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1453685ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1460654ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1470589ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1489330ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1503666ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1521587ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1537970ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1540426ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1548105ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1549441ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1567671ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1585493ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1597054ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1602669ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1607866ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1623290ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1631460ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1640086ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1645979ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1650742ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1652863ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1663908ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1666587ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1668427ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1676825ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1687882ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1691062ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1698532ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1709597ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1725669ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1739294ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1744412ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1753319ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1761792ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1765298ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1784381ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1786396ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1798982ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1807180ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1823569ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1837292ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1838720ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1848387ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1856847ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1866742ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1879249ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1884700ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1900774ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1912256ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1931088ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1937844ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1948191ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1951360ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1957512ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1958836ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1979011ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 1993551ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 2011369ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 2024782ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 2040763ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 2044650ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 400 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
+[ 2061337ms] [ERROR] WebSocket connection to 'wss://app2.hyeonworks.com/api/live/ws' failed: Error during WebSocket handshake: Unexpected response code: 302 @ https://app2.hyeonworks.com/public/build/1518.a3f1f690c084a37f01c7.js:362
@@ -0,0 +1 @@
+[   12202ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0
@@ -0,0 +1 @@
+[     451ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0
@@ -0,0 +1,4 @@
+- generic [active] [ref=f40e1]:
+  - heading "502 Bad Gateway" [level=1] [ref=f40e3]
+  - separator [ref=f40e4]
+  - generic [ref=f40e5]: nginx/1.30.4
@@ -0,0 +1,4 @@
+- generic [active] [ref=f41e1]:
+  - heading "502 Bad Gateway" [level=1] [ref=f41e3]
+  - separator [ref=f41e4]
+  - generic [ref=f41e5]: nginx/1.30.4
@@ -0,0 +1,4 @@
+- generic [active] [ref=f42e1]:
+  - heading "502 Bad Gateway" [level=1] [ref=f42e3]
+  - separator [ref=f42e4]
+  - generic [ref=f42e5]: nginx/1.30.4
@@ -0,0 +1 @@
+- generic [active] [ref=f43e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=60c3e7ae41ffc00665f4a2c377def399; grafana_session_expiry=1788497124; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMWlNall4TVRGbVltUXhabVJoWWpOaFpUSXhPREpsTWpnM01EQXhZakF5WVEuTk81VE82RHRod2NWZWstaHpPZVg1Zw==|1788500470|iPSRUlwHDB0XgC6sUdU4dq1EHq9WQDPYrDoezajKVUA=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.0.53\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }"
@@ -0,0 +1 @@
+- generic [active] [ref=f44e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=60c3e7ae41ffc00665f4a2c377def399; grafana_session_expiry=1788497124; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMDVOemhrWm1GbFptSmtZV1JqWTJJNU5tTTNZbVV4TmpJMVpHSmhOVFl4TmcucmoxSnJPYjJKOW1ZV191aXVWa2FCZw==|1788500538|RoiStOeQcIDldxB3cckyO-OAiMgBjBfw5gOSvUsgTFU=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.1.132\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }"
@@ -0,0 +1,16 @@
+- generic [ref=f45e3]:
+  - banner [ref=f45e4]:
+    - generic [ref=f45e5]: keycloak-patterns
+  - main [ref=f45e6]:
+    - heading "Sign in to your account" [level=1] [ref=f45e8]
+    - generic [ref=f45e12]:
+      - generic [ref=f45e13]:
+        - generic [ref=f45e14]: Username or email
+        - textbox "Username or email" [active] [ref=f45e17]
+      - generic [ref=f45e18]:
+        - generic [ref=f45e19]: Password
+        - generic [ref=f45e21]:
+          - textbox "Password" [ref=f45e24]
+          - button "Show password" [ref=f45e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f45e27]: 
+      - button "Sign In" [ref=f45e30] [cursor=pointer]
@@ -0,0 +1,7 @@
+- main [ref=f46e2]:
+  - heading "AP3 · Backend-for-Frontend" [level=1] [ref=f46e3]
+  - paragraph [ref=f46e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
+  - button "Keycloak 로그인" [ref=f46e5] [cursor=pointer]
+  - button "token 경계 확인" [ref=f46e6] [cursor=pointer]
+  - button "BFF 경유 API 호출" [ref=f46e7] [cursor=pointer]
+  - button "CSRF token으로 상태 변경" [ref=f46e8] [cursor=pointer]
@@ -0,0 +1 @@
+- generic [active] [ref=f47e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=60c3e7ae41ffc00665f4a2c377def399; grafana_session_expiry=1788497124; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMDJZakF5T0dFM01HWTJPV000WmpCa1lUazVOalpsWWpNMk9UY3laR1ptTWcuWmpUamNTbGxVSHV1RmJjQ2ZRd2lsUQ==|1788500797|17Hbo3RDtzOldnLZx2xOt3e34lHo_v0yqRNdqdKUx-g=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.0.53\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }"
@@ -0,0 +1 @@
+- generic [active] [ref=f48e1]: "{\"pattern\":\"AP3-backend-for-frontend\",\"principal\":\"labuser\",\"accessTokenStoredOnServer\":true,\"refreshTokenStoredOnServer\":true,\"browserTokenCount\":0,\"csrfProtectionEnabled\":true}"
@@ -0,0 +1 @@
+- generic [active] [ref=f49e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=60c3e7ae41ffc00665f4a2c377def399; grafana_session_expiry=1788497124; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMDJZakF5T0dFM01HWTJPV000WmpCa1lUazVOalpsWWpNMk9UY3laR1ptTWcuWmpUamNTbGxVSHV1RmJjQ2ZRd2lsUQ==|1788500797|17Hbo3RDtzOldnLZx2xOt3e34lHo_v0yqRNdqdKUx-g=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.0.53\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }"
@@ -0,0 +1 @@
+- generic [active] [ref=f50e1]: "{\"pattern\":\"AP3-backend-for-frontend\",\"principal\":\"labuser\",\"accessTokenStoredOnServer\":true,\"refreshTokenStoredOnServer\":true,\"browserTokenCount\":0,\"csrfProtectionEnabled\":true}"
@@ -0,0 +1,16 @@
+- generic [ref=f51e3]:
+  - banner [ref=f51e4]:
+    - generic [ref=f51e5]: keycloak-patterns
+  - main [ref=f51e6]:
+    - heading "Sign in to your account" [level=1] [ref=f51e8]
+    - generic [ref=f51e12]:
+      - generic [ref=f51e13]:
+        - generic [ref=f51e14]: Username or email
+        - textbox "Username or email" [active] [ref=f51e17]
+      - generic [ref=f51e18]:
+        - generic [ref=f51e19]: Password
+        - generic [ref=f51e21]:
+          - textbox "Password" [ref=f51e24]
+          - button "Show password" [ref=f51e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f51e27]: 
+      - button "Sign In" [ref=f51e30] [cursor=pointer]
@@ -0,0 +1,7 @@
+- main [ref=f52e2]:
+  - heading "AP3 · Backend-for-Frontend" [level=1] [ref=f52e3]
+  - paragraph [ref=f52e4]: 브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource Server 요청에 붙입니다.
+  - button "Keycloak 로그인" [ref=f52e5] [cursor=pointer]
+  - button "token 경계 확인" [ref=f52e6] [cursor=pointer]
+  - button "BFF 경유 API 호출" [ref=f52e7] [cursor=pointer]
+  - button "CSRF token으로 상태 변경" [ref=f52e8] [cursor=pointer]
@@ -0,0 +1,16 @@
+- generic [ref=f53e3]:
+  - banner [ref=f53e4]:
+    - generic [ref=f53e5]: keycloak-patterns
+  - main [ref=f53e6]:
+    - heading "Sign in to your account" [level=1] [ref=f53e8]
+    - generic [ref=f53e12]:
+      - generic [ref=f53e13]:
+        - generic [ref=f53e14]: Username or email
+        - textbox "Username or email" [ref=f53e17]
+      - generic [ref=f53e18]:
+        - generic [ref=f53e19]: Password
+        - generic [ref=f53e21]:
+          - textbox "Password" [ref=f53e24]
+          - button "Show password" [ref=f53e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f53e27]: 
+      - button "Sign In" [ref=f53e30] [cursor=pointer]
@@ -0,0 +1,16 @@
+- generic [ref=f53e3]:
+  - banner [ref=f53e4]:
+    - generic [ref=f53e5]: keycloak-patterns
+  - main [ref=f53e6]:
+    - heading "Sign in to your account" [level=1] [ref=f53e8]
+    - generic [ref=f53e12]:
+      - generic [ref=f53e13]:
+        - generic [ref=f53e14]: Username or email
+        - textbox "Username or email" [ref=f53e17]: labuser
+      - generic [ref=f53e18]:
+        - generic [ref=f53e19]: Password
+        - generic [ref=f53e21]:
+          - textbox "Password" [active] [ref=f53e24]: labpass
+          - button "Show password" [ref=f53e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f53e27]: 
+      - button "Sign In" [ref=f53e30] [cursor=pointer]
@@ -0,0 +1,16 @@
+- generic [ref=f53e3]:
+  - banner [ref=f53e4]:
+    - generic [ref=f53e5]: keycloak-patterns
+  - main [ref=f53e6]:
+    - heading "Sign in to your account" [level=1] [ref=f53e8]
+    - generic [ref=f53e12]:
+      - generic [ref=f53e13]:
+        - generic [ref=f53e14]: Username or email
+        - textbox "Username or email" [ref=f53e17]: labuser
+      - generic [ref=f53e18]:
+        - generic [ref=f53e19]: Password
+        - generic [ref=f53e21]:
+          - textbox "Password" [active] [ref=f53e24]: labpass
+          - button "Show password" [ref=f53e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f53e27]: 
+      - button "Sign In" [ref=f53e30] [cursor=pointer]
@@ -0,0 +1,16 @@
+- generic [ref=f53e3]:
+  - banner [ref=f53e4]:
+    - generic [ref=f53e5]: keycloak-patterns
+  - main [ref=f53e6]:
+    - heading "Sign in to your account" [level=1] [ref=f53e8]
+    - generic [ref=f53e12]:
+      - generic [ref=f53e13]:
+        - generic [ref=f53e14]: Username or email
+        - textbox "Username or email" [ref=f53e17]: labuser
+      - generic [ref=f53e18]:
+        - generic [ref=f53e19]: Password
+        - generic [ref=f53e21]:
+          - textbox "Password" [active] [ref=f53e24]: labpass
+          - button "Show password" [ref=f53e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f53e27]: 
+      - button "Sign In" [ref=f53e30] [cursor=pointer]
@@ -0,0 +1,16 @@
+- generic [ref=f54e3]:
+  - banner [ref=f54e4]:
+    - generic [ref=f54e5]: keycloak-patterns
+  - main [ref=f54e6]:
+    - heading "Sign in to your account" [level=1] [ref=f54e8]
+    - generic [ref=f54e12]:
+      - generic [ref=f54e13]:
+        - generic [ref=f54e14]: Username or email
+        - textbox "Username or email" [ref=f54e17]
+      - generic [ref=f54e18]:
+        - generic [ref=f54e19]: Password
+        - generic [ref=f54e21]:
+          - textbox "Password" [ref=f54e24]
+          - button "Show password" [ref=f54e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f54e27]: 
+      - button "Sign In" [ref=f54e30] [cursor=pointer]
@@ -0,0 +1,16 @@
+- generic [ref=f54e3]:
+  - banner [ref=f54e4]:
+    - generic [ref=f54e5]: keycloak-patterns
+  - main [ref=f54e6]:
+    - heading "Sign in to your account" [level=1] [ref=f54e8]
+    - generic [ref=f54e12]:
+      - generic [ref=f54e13]:
+        - generic [ref=f54e14]: Username or email
+        - textbox "Username or email" [ref=f54e17]: labuser
+      - generic [ref=f54e18]:
+        - generic [ref=f54e19]: Password
+        - generic [ref=f54e21]:
+          - textbox "Password" [active] [ref=f54e24]: labpass
+          - button "Show password" [ref=f54e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f54e27]: 
+      - button "Sign In" [ref=f54e30] [cursor=pointer]
@@ -0,0 +1,16 @@
+- generic [ref=f55e3]:
+  - banner [ref=f55e4]:
+    - generic [ref=f55e5]: keycloak-patterns
+  - main [ref=f55e6]:
+    - heading "Sign in to your account" [level=1] [ref=f55e8]
+    - generic [ref=f55e12]:
+      - generic [ref=f55e13]:
+        - generic [ref=f55e14]: Username or email
+        - textbox "Username or email" [ref=f55e17]
+      - generic [ref=f55e18]:
+        - generic [ref=f55e19]: Password
+        - generic [ref=f55e21]:
+          - textbox "Password" [ref=f55e24]
+          - button "Show password" [ref=f55e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f55e27]: 
+      - button "Sign In" [ref=f55e30] [cursor=pointer]
@@ -0,0 +1,16 @@
+- generic [ref=f55e3]:
+  - banner [ref=f55e4]:
+    - generic [ref=f55e5]: keycloak-patterns
+  - main [ref=f55e6]:
+    - heading "Sign in to your account" [level=1] [ref=f55e8]
+    - generic [ref=f55e12]:
+      - generic [ref=f55e13]:
+        - generic [ref=f55e14]: Username or email
+        - textbox "Username or email" [ref=f55e17]: labuser
+      - generic [ref=f55e18]:
+        - generic [ref=f55e19]: Password
+        - generic [ref=f55e21]:
+          - textbox "Password" [ref=f55e24]: labpass
+          - button "Show password" [ref=f55e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f55e27]: 
+      - button "Sign In" [ref=f55e30] [cursor=pointer]
@@ -0,0 +1,17 @@
+- generic [ref=f56e1]:
+  - generic [ref=f56e3]:
+    - generic [ref=f56e4]: "403"
+    - heading "Forbidden" [level=1] [ref=f56e6]
+    - generic [ref=f56e8]:
+      - paragraph [ref=f56e9]: More Info
+      - generic [ref=f56e10] [cursor=pointer]: 
+    - separator [ref=f56e12]
+    - generic [ref=f56e13]:
+      - button "Go back" [ref=f56e16] [cursor=pointer]
+      - button "Sign in" [ref=f56e19] [cursor=pointer]
+  - contentinfo [ref=f56e20]:
+    - paragraph [ref=f56e22]:
+      - text: Secured with
+      - link "OAuth2 Proxy" [ref=f56e23] [cursor=pointer]:
+        - /url: https://github.com/oauth2-proxy/oauth2-proxy#oauth2_proxy
+      - text: version v7.7.1
@@ -0,0 +1 @@
+- generic [ref=f57e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=60c3e7ae41ffc00665f4a2c377def399; grafana_session_expiry=1788497124; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMDNZMkZrTUdZM01tRmlZekkwWldFell6a3lOREJpTW1KaE5UZGpOVEJoWWcuZVVmckp5VHRqY1VsXzdiV1hiX3hwdw==|1788503135|yDSo7VdgRSlvoVfj9raHPClKTlQiWDg7FauLfoUayw4=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.0.53\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }"
@@ -0,0 +1 @@
+- generic [ref=f58e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=60c3e7ae41ffc00665f4a2c377def399; grafana_session_expiry=1788497124; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMHpabUV5TVdKaVpEa3lOemRrTlRFMU9USTBaV00wWWpGaE16bGhNak0zT1EuN2tTa3dnWUdISDkwMGFSSTVOSUFFUQ==|1788503202|snWKU5IRfRLoD9-bXEodGjEgfHeAw8PQaoHnecpFH90=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"changed-labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.1.132\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }"
@@ -0,0 +1,175 @@
+- generic [ref=f59e1]:
+  - generic [ref=f59e4]:
+    - link "Skip to main content" [ref=f59e5] [cursor=pointer]:
+      - /url: "#pageContent"
+    - banner [ref=f59e7]:
+      - generic [ref=f59e8]:
+        - link [ref=f59e10] [cursor=pointer]:
+          - /url: /
+          - img "Grafana" [ref=f59e11]
+        - generic [ref=f59e14]:
+          - button "Search or jump to..." [ref=f59e18] [cursor=pointer]
+          - generic [ref=f59e19]: ctrl+k
+        - generic [ref=f59e23]:
+          - button "New" [ref=f59e24] [cursor=pointer]
+          - button "Help" [ref=f59e30] [cursor=pointer]
+          - button "News" [ref=f59e33] [cursor=pointer]
+          - button "Profile" [ref=f59e36] [cursor=pointer]:
+            - img "User avatar" [ref=f59e37]
+      - generic [ref=f59e38]:
+        - button "Open menu" [ref=f59e40] [cursor=pointer]
+        - navigation "Breadcrumbs" [ref=f59e43]:
+          - list [ref=f59e44]:
+            - listitem [ref=f59e45]:
+              - link "Home" [ref=f59e46] [cursor=pointer]:
+                - /url: /
+            - listitem [ref=f59e50]:
+              - link "Explore" [ref=f59e51] [cursor=pointer]:
+                - /url: /explore
+            - listitem [ref=f59e55]:
+              - generic "Prometheus" [ref=f59e56]
+        - generic [ref=f59e57]:
+          - generic [ref=f59e60]:
+            - button "Copy shortened URL" [ref=f59e61] [cursor=pointer]
+            - button "Open copy link options" [ref=f59e64] [cursor=pointer]
+          - button "Toggle top search bar" [ref=f59e68] [cursor=pointer]
+    - main [ref=f59e74]:
+      - generic [ref=f59e76]:
+        - heading "Explore" [level=1] [ref=f59e77]
+        - generic [ref=f59e82]:
+          - navigation "Explore toolbar" [ref=f59e84]:
+            - navigation "Search links" [ref=f59e86]:
+              - generic [ref=f59e87]:
+                - button "Content outline" [expanded] [ref=f59e89] [cursor=pointer]:
+                  - generic [ref=f59e92]: Outline
+                - generic [ref=f59e97] [cursor=pointer]:
+                  - img "Prometheus logo" [ref=f59e99]
+                  - textbox "Select a data source" [ref=f59e100]:
+                    - /placeholder: Prometheus
+            - generic [ref=f59e104]:
+              - button "Split the pane" [ref=f59e106] [cursor=pointer]:
+                - generic [ref=f59e109]: Split
+              - button "Add" [ref=f59e111] [cursor=pointer]
+              - generic [ref=f59e116]:
+                - 'button "Time range selected: Last 30 minutes" [ref=f59e117] [cursor=pointer]'
+                - button "Zoom out time range" [ref=f59e122] [cursor=pointer]
+              - generic [ref=f59e126]:
+                - button "Cancel" [ref=f59e127] [cursor=pointer]
+                - button "Auto refresh turned off. Choose refresh time interval" [ref=f59e129] [cursor=pointer]
+          - generic [ref=f59e133]:
+            - generic [ref=f59e137]:
+              - button "Collapse outline" [expanded] [ref=f59e139] [cursor=pointer]:
+                - img "arrow-from-right" [ref=f59e140]
+              - generic [ref=f59e142]:
+                - button "Content outline item collapse button" [ref=f59e143] [cursor=pointer]:
+                  - img "angle-right" [ref=f59e144]
+                - button "Queries" [ref=f59e146] [cursor=pointer]:
+                  - img "arrow" [ref=f59e147]
+            - generic [ref=f59e154]:
+              - generic [ref=f59e156]:
+                - generic [ref=f59e157]:
+                  - generic "Query editor row" [ref=f59e159]:
+                    - generic [ref=f59e160]:
+                      - generic [ref=f59e162]:
+                        - generic [ref=f59e163]:
+                          - button "Collapse query row" [expanded] [ref=f59e164] [cursor=pointer]
+                          - generic [ref=f59e167]:
+                            - button "Query editor row title A" [ref=f59e168] [cursor=pointer]:
+                              - generic [ref=f59e169]: A
+                            - emphasis [ref=f59e170]: (Prometheus)
+                        - generic [ref=f59e171]:
+                          - button "Show data source help" [ref=f59e173] [cursor=pointer]
+                          - button "Duplicate query" [ref=f59e177] [cursor=pointer]
+                          - button "Hide response" [ref=f59e181] [cursor=pointer]
+                          - button "Remove query" [ref=f59e185] [cursor=pointer]
+                          - button "Drag and drop to reorder" [ref=f59e188]:
+                            - img "Drag and drop to reorder" [ref=f59e189]
+                      - generic [ref=f59e192]:
+                        - generic [ref=f59e193]:
+                          - button "Kick start your query" [ref=f59e194] [cursor=pointer]
+                          - generic [ref=f59e197]:
+                            - generic [ref=f59e198] [cursor=pointer]: Explain
+                            - generic [ref=f59e199]:
+                              - checkbox "Explain Toggle switch" [ref=f59e200]
+                              - generic "Toggle switch" [ref=f59e201] [cursor=pointer]
+                          - radiogroup [ref=f59e206]:
+                            - generic [ref=f59e207]:
+                              - radio "Builder" [ref=f59e208] [cursor=pointer]
+                              - generic [ref=f59e209] [cursor=pointer]: Builder
+                            - generic [ref=f59e210]:
+                              - radio "Code" [checked] [ref=f59e211] [cursor=pointer]
+                              - generic [ref=f59e212] [cursor=pointer]: Code
+                        - generic [ref=f59e214]:
+                          - generic [ref=f59e216]:
+                            - button "Loading metrics..." [disabled] [ref=f59e217] [cursor=pointer]
+                            - code [ref=f59e224]:
+                              - generic [ref=f59e225]:
+                                - generic [ref=f59e230]: vendor_cluster_size
+                                - textbox "Editor content;Press Alt+F1 for Accessibility Options." [ref=f59e235]: vendor_cluster_size
+                          - 'button "Options Legend: cluster_size {{pod}} Format: Time series Step: auto Type: Range Exemplars: false" [ref=f59e241] [cursor=pointer]':
+                            - generic [ref=f59e245]:
+                              - heading "Options" [level=6] [ref=f59e246]
+                              - generic [ref=f59e247]:
+                                - generic [ref=f59e248]: "Legend: cluster_size {{pod}}"
+                                - generic [ref=f59e249]: "Format: Time series"
+                                - generic [ref=f59e250]: "Step: auto"
+                                - generic [ref=f59e251]: "Type: Range"
+                                - generic [ref=f59e252]: "Exemplars: false"
+                  - generic "Query editor row" [ref=f59e254]:
+                    - generic [ref=f59e255]:
+                      - generic [ref=f59e257]:
+                        - generic [ref=f59e258]:
+                          - button "Collapse query row" [expanded] [ref=f59e259] [cursor=pointer]
+                          - generic [ref=f59e262]:
+                            - button "Query editor row title B" [ref=f59e263] [cursor=pointer]:
+                              - generic [ref=f59e264]: B
+                            - emphasis [ref=f59e265]: (Prometheus)
+                        - generic [ref=f59e266]:
+                          - button "Show data source help" [ref=f59e268] [cursor=pointer]
+                          - button "Duplicate query" [ref=f59e272] [cursor=pointer]
+                          - button "Hide response" [ref=f59e276] [cursor=pointer]
+                          - button "Remove query" [ref=f59e280] [cursor=pointer]
+                          - button "Drag and drop to reorder" [ref=f59e283]:
+                            - img "Drag and drop to reorder" [ref=f59e284]
+                      - generic [ref=f59e287]:
+                        - generic [ref=f59e288]:
+                          - button "Kick start your query" [ref=f59e289] [cursor=pointer]
+                          - generic [ref=f59e292]:
+                            - generic [ref=f59e293] [cursor=pointer]: Explain
+                            - generic [ref=f59e294]:
+                              - checkbox "Explain Toggle switch" [ref=f59e295]
+                              - generic "Toggle switch" [ref=f59e296] [cursor=pointer]
+                          - radiogroup [ref=f59e301]:
+                            - generic [ref=f59e302]:
+                              - radio "Builder" [ref=f59e303] [cursor=pointer]
+                              - generic [ref=f59e304] [cursor=pointer]: Builder
+                            - generic [ref=f59e305]:
+                              - radio "Code" [checked] [ref=f59e306] [cursor=pointer]
+                              - generic [ref=f59e307] [cursor=pointer]: Code
+                        - generic [ref=f59e309]:
+                          - generic [ref=f59e311]:
+                            - button "Loading metrics..." [disabled] [ref=f59e312] [cursor=pointer]
+                            - code [ref=f59e319]:
+                              - generic [ref=f59e320]:
+                                - generic [ref=f59e325]: "up{job=\"keycloak\"}"
+                                - textbox "Editor content;Press Alt+F1 for Accessibility Options." [ref=f59e330]: "up{job=\"keycloak\"}"
+                          - 'button "Options Legend: up {{pod}} Format: Time series Step: auto Type: Range Exemplars: false" [ref=f59e336] [cursor=pointer]':
+                            - generic [ref=f59e340]:
+                              - heading "Options" [level=6] [ref=f59e341]
+                              - generic [ref=f59e342]:
+                                - generic [ref=f59e343]: "Legend: up {{pod}}"
+                                - generic [ref=f59e344]: "Format: Time series"
+                                - generic [ref=f59e345]: "Step: auto"
+                                - generic [ref=f59e346]: "Type: Range"
+                                - generic [ref=f59e347]: "Exemplars: false"
+                - generic [ref=f59e348]:
+                  - button "Add query" [ref=f59e349] [cursor=pointer]
+                  - button "Query history" [ref=f59e353] [cursor=pointer]
+                  - button "Query inspector" [ref=f59e357] [cursor=pointer]
+              - generic:
+                - main
+  - generic [ref=f59e364]:
+    - alert
+    - alert
+    - complementary
+    - complementary
@@ -0,0 +1,56 @@
+- generic [ref=f62e4]:
+  - link "Skip to main content" [ref=f62e5] [cursor=pointer]:
+    - /url: "#pageContent"
+  - banner [ref=f62e7]:
+    - generic [ref=f62e8]:
+      - link [ref=f62e10] [cursor=pointer]:
+        - /url: /
+        - img "Grafana" [ref=f62e11]
+      - generic [ref=f62e14]:
+        - button "Search or jump to..." [ref=f62e18] [cursor=pointer]
+        - generic [ref=f62e19]: ctrl+k
+      - generic [ref=f62e23]:
+        - button "New" [ref=f62e24] [cursor=pointer]
+        - button "Help" [ref=f62e30] [cursor=pointer]
+        - button "News" [ref=f62e33] [cursor=pointer]
+        - button "Profile" [ref=f62e36] [cursor=pointer]:
+          - img "User avatar" [ref=f62e37]
+    - generic [ref=f62e38]:
+      - button "Open menu" [ref=f62e40] [cursor=pointer]
+      - navigation "Breadcrumbs" [ref=f62e43]:
+        - list [ref=f62e44]:
+          - listitem [ref=f62e45]:
+            - link "Home" [ref=f62e46] [cursor=pointer]:
+              - /url: /
+          - listitem [ref=f62e50]:
+            - link "Explore" [ref=f62e51] [cursor=pointer]:
+              - /url: /explore
+          - listitem [ref=f62e55]:
+            - generic "Prometheus" [ref=f62e56]
+      - generic [ref=f62e57]:
+        - button "Show more items" [ref=f62e60] [cursor=pointer]
+        - button "Toggle top search bar" [ref=f62e64] [cursor=pointer]
+  - main [ref=f62e70]:
+    - generic [ref=f62e72]:
+      - heading "Explore" [level=1] [ref=f62e73]
+      - generic [ref=f62e78]:
+        - navigation "Explore toolbar" [ref=f62e80]:
+          - navigation "Search links" [ref=f62e82]:
+            - generic [ref=f62e83]:
+              - button "Content outline" [expanded] [ref=f62e85] [cursor=pointer]:
+                - generic [ref=f62e88]: Outline
+              - generic [ref=f62e93] [cursor=pointer]:
+                - img "Prometheus logo" [ref=f62e95]
+                - textbox "Select a data source" [ref=f62e96]:
+                  - /placeholder: Prometheus
+          - button "Show more items" [ref=f62e102] [cursor=pointer]
+        - generic [ref=f62e106]:
+          - button "Collapse outline" [expanded] [ref=f62e112] [cursor=pointer]:
+            - img "arrow-from-right" [ref=f62e113]
+          - generic [ref=f62e119]:
+            - generic [ref=f62e122]:
+              - button "Add query" [ref=f62e123] [cursor=pointer]
+              - button "Query history" [ref=f62e127] [cursor=pointer]
+              - button "Query inspector" [ref=f62e131] [cursor=pointer]
+            - generic:
+              - main
@@ -0,0 +1,29 @@
+- generic [ref=f65e4]:
+  - link "Skip to main content" [ref=f65e5] [cursor=pointer]:
+    - /url: "#pageContent"
+  - banner [ref=f65e7]:
+    - generic [ref=f65e8]:
+      - link [ref=f65e10] [cursor=pointer]:
+        - /url: /
+        - img "Grafana" [ref=f65e11]
+      - generic [ref=f65e14]:
+        - button "Search or jump to..." [ref=f65e18] [cursor=pointer]
+        - generic [ref=f65e19]: ctrl+k
+      - generic [ref=f65e23]:
+        - button "New" [ref=f65e24] [cursor=pointer]
+        - button "Help" [ref=f65e30] [cursor=pointer]
+        - button "News" [ref=f65e33] [cursor=pointer]
+        - button "Profile" [ref=f65e36] [cursor=pointer]:
+          - img "User avatar" [ref=f65e37]
+    - generic [ref=f65e38]:
+      - button "Open menu" [ref=f65e40] [cursor=pointer]
+      - navigation "Breadcrumbs" [ref=f65e43]:
+        - list [ref=f65e44]:
+          - listitem [ref=f65e45]:
+            - link "Home" [ref=f65e46] [cursor=pointer]:
+              - /url: /
+          - listitem [ref=f65e50]:
+            - generic "Explore" [ref=f65e51]
+      - button "Toggle top search bar" [ref=f65e53] [cursor=pointer]
+  - main [ref=f65e59]:
+    - heading "Explore" [level=1] [ref=f65e62]
@@ -0,0 +1,16 @@
+- generic [ref=f68e3]:
+  - banner [ref=f68e4]:
+    - generic [ref=f68e5]: keycloak-patterns
+  - main [ref=f68e6]:
+    - heading "Sign in to your account" [level=1] [ref=f68e8]
+    - generic [ref=f68e12]:
+      - generic [ref=f68e13]:
+        - generic [ref=f68e14]: Username or email
+        - textbox "Username or email" [ref=f68e17]
+      - generic [ref=f68e18]:
+        - generic [ref=f68e19]: Password
+        - generic [ref=f68e21]:
+          - textbox "Password" [ref=f68e24]
+          - button "Show password" [ref=f68e26] [cursor=pointer]:
+            - generic [aria-hidden] [ref=f68e27]: 
+      - button "Sign In" [ref=f68e30] [cursor=pointer]
@@ -0,0 +1 @@
+- generic [active] [ref=f69e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cache-control\" : [ \"max-age=0\" ], \"cookie\" : [ \"grafana_session=bfb5f2c2406b3f163ea01063ac1b8b83; grafana_session_expiry=1788508427; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMHhNamhoWXprNFpHSmxORGRoT0RObU16UmlNemMxTTJJd016ZGlZakpqTWcuQVVUYldxYkFlejYxNXozUUZBcGh1dw==|1788508274|biz4o9E4vZXX07LnF32LU7tIEMrvfwxwCIBsZkxpwbY=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"same-site\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.1.132\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }"
@@ -0,0 +1 @@
+- generic [ref=f70e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=bfb5f2c2406b3f163ea01063ac1b8b83; grafana_session_expiry=1788508427; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMWhOakZqTlRjM1ptSTVORFF5TVdWbU1qQmpaak5pWXpka1pXRTFPR1F6WWcuOXF3TmRyQzJIOFlrSDh6T1pTMl91QQ==|1788508374|Ehcd4hjNk0noEy2MSPI-C5jg84JZmilWcKhuj8OH3uw=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"changed-labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.0.53\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }"
@@ -0,0 +1,128 @@
+# Experiment B-7 — oauth2-proxy, to measure how replicas share a cookie secret
+# and what happens when it is rotated (Q1, unknown 7).
+#
+# This is a different shape of problem from the BFF. The BFF keeps state on the
+# server, so the question was "which store". oauth2-proxy keeps no server state
+# at all: the whole session rides in a cookie that is signed and encrypted with
+# --cookie-secret. So there is nothing to share and nothing to lose on restart —
+# instead, every replica must hold the *same* secret, and changing it invalidates
+# every cookie at once.
+#
+#   kubectl apply -f deploy/lab/k8s/b7-oauth2-proxy.yaml
+#
+# app2.hyeonworks.com is borrowed from Grafana for the duration of this
+# experiment; the certificate only covers auth / app1 / app2, so a fourth name
+# is not available. Grafana's Ingress is restored afterwards.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: oauth2-proxy-secrets
+  namespace: keycloak-lab
+type: Opaque
+stringData:
+  # oauth2-proxy requires exactly 16, 24 or 32 bytes. This is the value whose
+  # rotation the experiment is about.
+  COOKIE_SECRET_A: "lab-cookie-secret-aaaaaaaaaaaaaa"
+  COOKIE_SECRET_B: "lab-cookie-secret-bbbbbbbbbbbbbb"
+  CLIENT_SECRET: proxy-lab-secret
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy
+  namespace: keycloak-lab
+spec:
+  # Two replicas is the point: Q1 asks how they share the secret.
+  replicas: 2
+  selector:
+    matchLabels: { app: oauth2-proxy }
+  template:
+    metadata:
+      labels: { app: oauth2-proxy }
+    spec:
+      # See B-1: Kubernetes injects <SVCNAME>_PORT as a tcp:// URL and it
+      # collides with ordinary configuration names.
+      enableServiceLinks: false
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels: { app: oauth2-proxy }
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
+          args:
+            - --provider=oidc
+            - --oidc-issuer-url=https://auth.hyeonworks.com/realms/keycloak-patterns
+            - --client-id=oauth2-proxy
+            - --redirect-url=https://app2.hyeonworks.com/oauth2/callback
+            - --email-domain=*
+            - --http-address=0.0.0.0:4180
+            # The upstream is the same echo app the B-4 header experiment used,
+            # so what the proxy forwards can be read straight off the response.
+            - --upstream=http://echo.header-lab.svc:8081
+            # ★ 이 옵션을 켜면 세션(=쿠키)에 access token 이 들어간다.
+            # 그러면 Set-Cookie 가 커져 프록시 앞단에서 502 가 났다.
+            # B-4 에서 본 헤더 크기 절벽이 이번에는 응답 쪽에서 나타난 것이다.
+            # - --pass-authorization-header=true
+            - --set-xauthrequest=true
+            - --reverse-proxy=true
+            - --cookie-secure=true
+            # One hour, matching the value Q1 records for the current setup.
+            - --cookie-expire=1h
+            - --skip-provider-button=true
+            # ★ 쿠키에 세션 전체를 담으면 Set-Cookie 가 커지고, 그 응답이
+            # 앞단 nginx 의 proxy_buffer 를 넘겨 502 가 났다(측정됨).
+            # Redis 로 옮기면 쿠키에는 티켓만 남는다 — 그리고 그 순간
+            # "replica 가 secret 을 공유해야 한다"는 문제의 성격도 바뀐다.
+            - --session-store-type=redis
+            - --redis-connection-url=redis://redis.keycloak-lab.svc:6379
+          env:
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef: { name: oauth2-proxy-secrets, key: CLIENT_SECRET }
+            # Which of the two secrets is in use is switched here. Both replicas
+            # read the same key, which is exactly the sharing Q1 asks about.
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef: { name: oauth2-proxy-secrets, key: COOKIE_SECRET_A }
+          ports:
+            - containerPort: 4180
+              name: http
+          readinessProbe:
+            httpGet: { path: /ping, port: http }
+            initialDelaySeconds: 5
+          resources:
+            requests: { memory: 32Mi, cpu: 20m }
+            limits:   { memory: 128Mi }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2-proxy
+  namespace: keycloak-lab
+spec:
+  selector: { app: oauth2-proxy }
+  ports:
+    - port: 4180
+      targetPort: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: oauth2-proxy
+  namespace: keycloak-lab
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: app2.hyeonworks.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy
+                port:
+                  number: 4180
@@ -24,9 +24,24 @@ stringData:
  # Base64 in etcd is not encryption — see D-3.
  KEYCLOAK_CLIENT_SECRET: bff-lab-secret
 ---
-# Redis. No persistence yet: `--save ""` and no appendonly, so a restart loses
-# everything. B-5 and B-6 compare that against RDB and AOF, which is easier to
-# reason about when the starting point is "nothing survives".
+# Redis. B-5 measured that turning on AOF with `redis-cli config set` changes
+# nothing here, because /data is the container filesystem and dies with the
+# container — the appendonlydir was created and then thrown away. Persistence
+# configuration without a volume is decoration.
+#
+# So the volume comes first, and only then does `--appendonly yes` mean anything.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-data
+  namespace: keycloak-lab
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 1Gi
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -47,16 +62,25 @@ spec:
      containers:
        - name: redis
          image: redis:7.4-alpine
-          args: ["redis-server", "--save", "", "--appendonly", "no"]
+          # appendfsync everysec 이 기본값이다 — 1초 분량을 잃을 수 있다.
+          # Keycloak 의 synchronous_commit OFF(A-3)와 같은 모양의 트레이드오프다.
+          args: ["redis-server", "--appendonly", "yes", "--dir", "/data"]
          ports:
            - containerPort: 6379
              name: redis
          readinessProbe:
            exec: { command: ["redis-cli", "ping"] }
            initialDelaySeconds: 3
+          volumeMounts:
+            - name: data
+              mountPath: /data
          resources:
            requests: { memory: 32Mi, cpu: 20m }
            limits:   { memory: 128Mi }
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: redis-data
 ---
 apiVersion: v1
 kind: Service
@@ -0,0 +1,12 @@
+# 다이어그램 규약
+
+| 표현 | 뜻 |
+|---|---|
+| 실선 상자 | 살아 있는 구성 요소 |
+| 붉은 점선 상자 | 이 실험에서 죽이거나 막은 것 |
+| ✂ 붉은 X | 주입 지점 |
+| 실선 화살표 | 정상 경로 |
+| 붉은 점선 화살표 | 실험에서 깨진 경로 |
+| 회색 글씨 | 측정값 |
+
+SVG 는 GitHub 에서 그대로 렌더링되며 외부 폰트를 쓰지 않는다.
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 300" width="700" height="300" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">A-2 · PostgreSQL 정지 — 살아남는 노드가 없다</text>
+  <rect class="box" x="30" y="46" width="180" height="52"/><text class="t" x="120" y="68" text-anchor="middle">keycloak-1</text><text class="s" x="120" y="86" text-anchor="middle">캐시: 세션 N개</text>
+  <rect class="box" x="480" y="46" width="180" height="52"/><text class="t" x="570" y="68" text-anchor="middle">keycloak-0</text><text class="s" x="570" y="86" text-anchor="middle">캐시: 세션 M개</text>
+  <path class="ln" d="M210,72 L480,72"/><text class="s" x="345" y="66" text-anchor="middle">7800 · 살아 있다</text>
+  <path class="bad" d="M120,100 L300,150"/><path class="bad" d="M570,100 L400,150"/>
+  <rect class="dead" x="270" y="156" width="160" height="52"/>
+  <text class="r" x="350" y="178" text-anchor="middle">postgres ✗</text><text class="s" x="350" y="196" text-anchor="middle">replicas=0</text>
+  <rect class="dead" x="30" y="228" width="290" height="52"/>
+  <text class="r" x="175" y="250" text-anchor="middle">양쪽 모두 NotReady</text><text class="s" x="175" y="268" text-anchor="middle">ready 주소 = [] · 외부 503</text>
+  <rect class="box" x="370" y="228" width="290" height="52"/>
+  <text class="t" x="515" y="250" text-anchor="middle">up{job="keycloak"} = 1</text><text class="s" x="515" y="268" text-anchor="middle">프로세스는 살아 있다 — up 은 못 잡는다</text>
+</svg>
@@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 720 330" width="720" height="330" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+  </style>
+  <defs><marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker></defs>
+  <text class="h" x="16" y="24">A-7 · 같은 주입, 같은 관측, 정반대 결과</text>
+
+  <text class="h" x="180" y="52" text-anchor="middle">persistent (KC 26 기본)</text>
+  <rect class="box" x="30" y="62" width="300" height="54"/>
+  <text class="t" x="180" y="84" text-anchor="middle">keycloak ×2 — 로컬 캐시</text>
+  <path class="ln" d="M180,116 L180,140"/>
+  <rect class="ok" x="70" y="142" width="220" height="40"/>
+  <text class="g" x="180" y="167" text-anchor="middle">PostgreSQL — 진실의 원천</text>
+
+  <text class="h" x="540" y="52" text-anchor="middle">volatile (KC 24 이전 방식)</text>
+  <rect class="box" x="390" y="62" width="300" height="54"/>
+  <text class="t" x="540" y="84" text-anchor="middle">keycloak ×2 — 캐시가 곧 진실</text>
+  <path class="ln" d="M470,116 L470,140"/><path class="ln" d="M610,140 L610,116"/>
+  <rect class="ok" x="430" y="142" width="220" height="40"/>
+  <text class="g" x="540" y="167" text-anchor="middle">클러스터 복제 (7800)</text>
+
+  <rect class="box" x="30" y="202" width="660" height="112"/>
+  <text class="t" x="360" y="224" text-anchor="middle">뒤집힌 세 결과</text>
+  <text class="s" x="200" y="248" text-anchor="middle">A-1 7800 차단 후 교차 refresh</text>
+  <text class="g" x="430" y="248" text-anchor="middle">200</text><text class="r" x="560" y="248" text-anchor="middle">400 Session not active</text>
+  <text class="s" x="200" y="272" text-anchor="middle">A-8 롤링 재시작 후 refresh</text>
+  <text class="g" x="430" y="272" text-anchor="middle">200</text><text class="r" x="560" y="272" text-anchor="middle">400 Session not active</text>
+  <text class="s" x="200" y="296" text-anchor="middle">A-2 DB 정지 중 새 로그인</text>
+  <text class="r" x="430" y="296" text-anchor="middle">500</text><text class="g" x="560" y="296" text-anchor="middle">200</text>
+  <text class="s" x="430" y="230" text-anchor="middle">persistent</text><text class="s" x="560" y="230" text-anchor="middle">volatile</text>
+</svg>
@@ -0,0 +1,33 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 330" width="700" height="330" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">B-1 · Redis 는 세션만 옮기고 토큰은 두고 간다</text>
+  <rect class="box" x="30" y="46" width="140" height="46"/><text class="t" x="100" y="66" text-anchor="middle">bff-0</text><text class="s" x="100" y="82" text-anchor="middle">kc-lab-1</text>
+  <rect class="box" x="30" y="104" width="140" height="46"/><text class="t" x="100" y="124" text-anchor="middle">bff-1</text><text class="s" x="100" y="140" text-anchor="middle">kc-lab-2</text>
+  <rect class="ok" x="330" y="46" width="330" height="60"/>
+  <text class="t" x="495" y="68" text-anchor="middle">Redis — Application Session</text>
+  <text class="s" x="495" y="86" text-anchor="middle">sessionRepository → RedisSessionRepository ✔ 옮겨졌다</text>
+  <text class="s" x="495" y="100" text-anchor="middle">필드: SPRING_SECURITY_CONTEXT · TTL 1772초</text>
+  <rect class="dead" x="330" y="122" width="330" height="60"/>
+  <text class="r" x="495" y="144" text-anchor="middle">프로세스 메모리 — OAuth2AuthorizedClient</text>
+  <text class="s" x="495" y="162" text-anchor="middle">InMemoryOAuth2AuthorizedClientService ✗ 그대로</text>
+  <text class="s" x="495" y="176" text-anchor="middle">access token · refresh token 이 여기 있다</text>
+  <path class="ln" d="M170,69 L330,69"/><path class="ln" d="M170,127 L330,80"/>
+  <path class="bad" d="M170,140 L330,150"/>
+  <rect class="box" x="30" y="210" width="630" height="90"/>
+  <text class="t" x="345" y="234" text-anchor="middle">그 결과 사용자에게 보이는 것</text>
+  <text class="s" x="345" y="256" text-anchor="middle">principal: labuser        ← 로그인은 되어 있다</text>
+  <text class="s" x="345" y="272" text-anchor="middle">accessTokenStoredOnServer: false   ← 토큰이 없다</text>
+  <text class="r" x="345" y="292" text-anchor="middle">완전히 로그아웃되는 편이 차라리 낫다</text>
+</svg>
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 300" width="700" height="300" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">B-3 · 동시 refresh — 경쟁이 아니라 세션 파괴</text>
+  <rect class="box" x="30" y="46" width="150" height="40"/><text class="t" x="105" y="71" text-anchor="middle">같은 refresh token ×5</text>
+  <path class="ln" d="M180,66 L280,66"/>
+  <rect class="box" x="280" y="42" width="180" height="48"/><text class="t" x="370" y="62" text-anchor="middle">Keycloak</text>
+  <text class="s" x="370" y="80" text-anchor="middle">rotation ON · maxReuse=0</text>
+  <path class="ln" d="M460,58 L560,58"/><rect class="box" x="560" y="42" width="110" height="24"/><text class="s" x="615" y="58" text-anchor="middle">1× HTTP 200</text>
+  <path class="bad" d="M460,78 L560,78"/><rect class="dead" x="560" y="66" width="110" height="24"/><text class="s" x="615" y="82" text-anchor="middle">4× HTTP 400</text>
+  <rect class="dead" x="120" y="120" width="460" height="70"/>
+  <text class="r" x="350" y="144" text-anchor="middle">재사용 탐지가 client session 을 제거한다</text>
+  <text class="s" x="350" y="164" text-anchor="middle">user_session 은 남고 client_session = 0 (정상 세션은 1)</text>
+  <text class="s" x="350" y="180" text-anchor="middle">그래서 오류가 "Session doesn't have required client"</text>
+  <rect class="dead" x="120" y="210" width="460" height="60"/>
+  <text class="r" x="350" y="234" text-anchor="middle">★ 이긴 요청의 새 토큰도 곧바로 400</text>
+  <text class="s" x="350" y="254" text-anchor="middle">재시도로 회복 불가 → Q2 의 판정은 lock</text>
+</svg>
@@ -0,0 +1,37 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 290" width="700" height="290" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">B-4 · edge 가 설정하지 않은 헤더는 그대로 통과한다</text>
+  <rect class="box" x="30" y="46" width="130" height="60"/><text class="t" x="95" y="68" text-anchor="middle">공격자</text>
+  <text class="s" x="95" y="86" text-anchor="middle">X-Auth-Request-</text><text class="s" x="95" y="100" text-anchor="middle">Roles: admin</text>
+  <path class="ln" d="M160,76 L250,76"/>
+  <rect class="box" x="250" y="40" width="180" height="72"/><text class="t" x="340" y="62" text-anchor="middle">nginx</text>
+  <text class="s" x="340" y="82" text-anchor="middle">proxy_set_header 한 것만 덮어쓴다</text>
+  <text class="r" x="340" y="100" text-anchor="middle">X-Auth-Request-* 는 설정이 없다</text>
+  <path class="bad" d="M430,76 L520,76"/>
+  <rect class="dead" x="520" y="46" width="150" height="60"/>
+  <text class="r" x="595" y="68" text-anchor="middle">upstream</text>
+  <text class="s" x="595" y="86" text-anchor="middle">['viewer','admin']</text><text class="s" x="595" y="100" text-anchor="middle">둘 다 도착 · 검증 없음</text>
+  <rect class="box" x="30" y="134" width="310" height="66"/>
+  <text class="t" x="185" y="156" text-anchor="middle">구분자 문제</text>
+  <text class="s" x="185" y="176" text-anchor="middle">"admin,editor" 와 "role-with,comma" 가</text>
+  <text class="s" x="185" y="192" text-anchor="middle">도착 시점에 구별되지 않는다</text>
+  <rect class="box" x="360" y="134" width="310" height="66"/>
+  <text class="t" x="515" y="156" text-anchor="middle">크기는 절벽이다</text>
+  <text class="s" x="515" y="176" text-anchor="middle">4KB 통과 · 8KB → Tomcat 400</text>
+  <text class="s" x="515" y="192" text-anchor="middle">16KB → 연결 끊김 (nginx)</text>
+  <rect class="dead" x="30" y="222" width="640" height="50"/>
+  <text class="r" x="350" y="244" text-anchor="middle">헤더가 인가 근거가 되면 위조 가능성이 곧 권한 상승이다</text>
+  <text class="s" x="350" y="262" text-anchor="middle">Q4 의 5문항 중 2·4번 해당 → Q4 자신의 기준으로 BFF 구조</text>
+</svg>
@@ -0,0 +1,35 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 300" width="700" height="300" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">B-5 · 파드가 Ready 인 채로 계속 실패한다</text>
+  <rect class="box" x="30" y="46" width="180" height="76"/>
+  <text class="t" x="120" y="68" text-anchor="middle">bff ×2</text>
+  <text class="g" x="120" y="90" text-anchor="middle">Ready = true</text>
+  <text class="s" x="120" y="110" text-anchor="middle">Service 에 그대로 남는다</text>
+  <path class="bad" d="M210,84 L330,84"/>
+  <rect class="dead" x="330" y="58" width="160" height="52"/>
+  <text class="r" x="410" y="80" text-anchor="middle">redis ✗</text><text class="s" x="410" y="98" text-anchor="middle">replicas=0</text>
+  <rect class="box" x="30" y="146" width="310" height="110"/>
+  <text class="t" x="185" y="168" text-anchor="middle">health group 이 갈랐다</text>
+  <text class="r" x="185" y="192" text-anchor="middle">/actuator/health → 503</text>
+  <text class="g" x="185" y="214" text-anchor="middle">/actuator/health/readiness → 200 UP</text>
+  <text class="s" x="185" y="238" text-anchor="middle">redis 지표가 readiness 그룹에 없다</text>
+  <rect class="box" x="360" y="146" width="310" height="110"/>
+  <text class="t" x="515" y="168" text-anchor="middle">A-2 와 정반대</text>
+  <text class="s" x="515" y="192" text-anchor="middle">A-2 Keycloak: DB 검사가 readiness 에</text>
+  <text class="s" x="515" y="208" text-anchor="middle">→ NotReady → 503 (명확)</text>
+  <text class="s" x="515" y="230" text-anchor="middle">B-5 BFF: 없음 → Ready 유지</text>
+  <text class="r" x="515" y="248" text-anchor="middle">→ HTTP 000 (멈춤)</text>
+  <text class="s" x="16" y="284">영속화: 볼륨 없이 AOF 만 켜면 appendonlydir 은 생기지만 파드 삭제로 전부 사라진다 — 볼륨이 먼저다</text>
+</svg>
@@ -0,0 +1,34 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 260" width="700" height="260" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">B-6 · 회전은 안전하고 옛 키를 버리는 순간이 위험하다</text>
+  <rect class="ok" x="30" y="46" width="190" height="76"/>
+  <text class="t" x="125" y="68" text-anchor="middle">t0 — 키 A 만</text>
+  <text class="s" x="125" y="88" text-anchor="middle">발급 A · 검증 A</text>
+  <text class="s" x="125" y="108" text-anchor="middle">JWKS RS256 1개</text>
+  <path class="ln" d="M220,84 L255,84"/>
+  <rect class="ok" x="255" y="46" width="190" height="76"/>
+  <text class="t" x="350" y="68" text-anchor="middle">t1 — B 추가 (priority 200)</text>
+  <text class="g" x="350" y="88" text-anchor="middle">발급 B · 검증 A+B</text>
+  <text class="s" x="350" y="108" text-anchor="middle">옛 토큰 200 · 새 토큰 200</text>
+  <path class="bad" d="M445,84 L480,84"/>
+  <rect class="dead" x="480" y="46" width="190" height="76"/>
+  <text class="t" x="575" y="68" text-anchor="middle">t2 — A 제거</text>
+  <text class="r" x="575" y="88" text-anchor="middle">옛 토큰 즉시 401</text>
+  <text class="s" x="575" y="108" text-anchor="middle">캐시가 유예를 주지 않는다</text>
+  <rect class="box" x="30" y="146" width="640" height="60"/>
+  <text class="t" x="350" y="168" text-anchor="middle">겹침 구간(t1~t2)의 최소 길이 = 옛 키로 서명된 것 중 가장 오래 사는 것의 수명</text>
+  <text class="s" x="350" y="190" text-anchor="middle">access token 60초 · refresh token 1800초 → 최소 30분</text>
+  <text class="s" x="16" y="234">모르는 kid 를 만나면 JWKS 를 다시 받으므로 제거가 즉시 반영된다. 유예는 옛 키를 남겨두는 기간으로 만든다.</text>
+</svg>
@@ -0,0 +1,31 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 300" width="700" height="300" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">C-1 · SSO 의 구조와 IdP 로그아웃의 한계</text>
+  <rect class="box" x="220" y="42" width="260" height="52"/>
+  <text class="t" x="350" y="64" text-anchor="middle">Keycloak user session ×1</text>
+  <text class="s" x="350" y="82" text-anchor="middle">oqOjHekin4JU-BZjgQLjUByW</text>
+  <path class="ln" d="M300,96 L180,130"/><path class="ln" d="M400,96 L520,130"/>
+  <rect class="box" x="60" y="134" width="240" height="52"/>
+  <text class="t" x="180" y="156" text-anchor="middle">client session — bff-confidential</text>
+  <text class="s" x="180" y="174" text-anchor="middle">app1 · Redis 세션 + PostgreSQL 토큰</text>
+  <rect class="box" x="400" y="134" width="240" height="52"/>
+  <text class="t" x="520" y="156" text-anchor="middle">client session — oauth2-proxy</text>
+  <text class="s" x="520" y="174" text-anchor="middle">app2 · 쿠키 티켓 + Redis 세션</text>
+  <rect class="dead" x="220" y="206" width="260" height="40"/>
+  <text class="r" x="350" y="231" text-anchor="middle">IdP 세션 삭제 ✗</text>
+  <path class="bad" d="M300,246 L200,262"/><path class="bad" d="M400,246 L500,262"/>
+  <rect class="ok" x="60" y="256" width="240" height="34"/><text class="g" x="180" y="278" text-anchor="middle">app1 그대로 동작</text>
+  <rect class="ok" x="400" y="256" width="240" height="34"/><text class="g" x="520" y="278" text-anchor="middle">app2 그대로 동작</text>
+</svg>
@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 270" width="700" height="270" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">D-1 · 빈 데이터베이스가 200 을 냈다</text>
+  <rect class="box" x="30" y="46" width="180" height="46"/><text class="t" x="120" y="66" text-anchor="middle">pg_dump</text><text class="s" x="120" y="82" text-anchor="middle">395KB · 101 테이블 · 세션 포함</text>
+  <path class="ln" d="M210,69 L270,69"/>
+  <rect class="dead" x="270" y="42" width="180" height="54"/>
+  <text class="r" x="360" y="64" text-anchor="middle">DROP SCHEMA CASCADE</text><text class="s" x="360" y="84" text-anchor="middle">남은 테이블 0</text>
+  <path class="ln" d="M450,69 L510,69"/>
+  <rect class="ok" x="510" y="42" width="160" height="54"/>
+  <text class="g" x="590" y="64" text-anchor="middle">복구 1초</text><text class="s" x="590" y="84" text-anchor="middle">오류 0건 · 재시작 0회</text>
+  <rect class="box" x="30" y="118" width="640" height="76"/>
+  <text class="t" x="350" y="140" text-anchor="middle">테이블이 0개일 때 무엇이 깨졌는가 — 전부가 아니다</text>
+  <text class="g" x="350" y="162" text-anchor="middle">/protocol/openid-connect/certs → 200   (realm 키가 캐시에 있다)</text>
+  <text class="r" x="350" y="182" text-anchor="middle">/.well-known → 500      토큰 발급 → 400</text>
+  <rect class="dead" x="30" y="210" width="640" height="46"/>
+  <text class="r" x="350" y="232" text-anchor="middle">헬스체크는 "DB 가 살아 있다"만 보고 "데이터가 있다"는 안 본다</text>
+  <text class="s" x="350" y="250" text-anchor="middle">RPO = 백업 주기 + A-3 의 synchronous_commit 손실 · 덤프는 같은 호스트 /tmp 에 있었다</text>
+</svg>
@@ -0,0 +1,31 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 280" width="700" height="280" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">D-3 · 네 경로 중 RBAC 만 실제로 감춘다</text>
+  <rect class="dead" x="30" y="46" width="310" height="60"/>
+  <text class="r" x="185" y="68" text-anchor="middle">kubectl get -o jsonpath | base64 -d</text>
+  <text class="s" x="185" y="88" text-anchor="middle">POSTGRES_PASSWORD = lab-postgres-change-me</text>
+  <rect class="dead" x="360" y="46" width="310" height="60"/>
+  <text class="r" x="515" y="68" text-anchor="middle">저장소 (at rest)</text>
+  <text class="s" x="515" y="88" text-anchor="middle">Encryption Disabled · state.db 에 평문</text>
+  <rect class="dead" x="30" y="120" width="310" height="60"/>
+  <text class="r" x="185" y="142" text-anchor="middle">파드 안</text>
+  <text class="s" x="185" y="162" text-anchor="middle">KEYCLOAK_CLIENT_SECRET=... 환경변수</text>
+  <rect class="ok" x="360" y="120" width="310" height="60"/>
+  <text class="g" x="515" y="142" text-anchor="middle">RBAC</text>
+  <text class="s" x="515" y="162" text-anchor="middle">default SA 는 get secrets 불가</text>
+  <rect class="box" x="30" y="200" width="640" height="60"/>
+  <text class="t" x="350" y="222" text-anchor="middle">describe 는 "14 bytes" 만 보여줘 감춰졌다는 착각을 준다</text>
+  <text class="s" x="350" y="244" text-anchor="middle">base64 는 감추기 위한 것이 아니라 YAML 에 임의 바이트를 담기 위한 인코딩이다</text>
+</svg>
@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 700 250" width="700" height="250" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .r{font-size:12px;fill:#cf222e;font-weight:600}.g{font-size:12px;fill:#1a7f37;font-weight:600}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+    .ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+    .bad{stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;fill:none;marker-end:url(#b)}
+  </style>
+  <defs>
+    <marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker>
+    <marker id="b" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#cf222e"/></marker>
+  </defs>
+  <text class="h" x="16" y="24">D-4 · 인증서 체인과 SAN 제약</text>
+  <rect class="ok" x="30" y="46" width="300" height="104"/>
+  <text class="t" x="180" y="68" text-anchor="middle">체인 4단계 · Verify return code: 0</text>
+  <text class="s" x="180" y="90" text-anchor="middle">0  CN=auth.hyeonworks.com</text>
+  <text class="s" x="180" y="106" text-anchor="middle">1  Let's Encrypt YE2</text>
+  <text class="s" x="180" y="122" text-anchor="middle">2  ISRG Root YE</text>
+  <text class="s" x="180" y="138" text-anchor="middle">3  ISRG Root X2</text>
+  <rect class="box" x="360" y="46" width="310" height="104"/>
+  <text class="t" x="515" y="68" text-anchor="middle">SAN 3개 · 와일드카드 아님</text>
+  <text class="s" x="515" y="90" text-anchor="middle">auth · app1 · app2</text>
+  <text class="r" x="515" y="114" text-anchor="middle">네 번째 이름이 없다</text>
+  <text class="s" x="515" y="134" text-anchor="middle">B-7 에서 Grafana 의 app2 를 빌려야 했다</text>
+  <rect class="box" x="30" y="168" width="640" height="60"/>
+  <text class="t" x="350" y="190" text-anchor="middle">단계가 1개면 cert.pem, 2개 이상이면 fullchain.pem 이다</text>
+  <text class="s" x="350" y="212" text-anchor="middle">브라우저는 중간 인증서를 캐시하므로 cert.pem 실수는 캐시 없는 클라이언트에서만 드러난다</text>
+</svg>
@@ -0,0 +1,94 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 860 520" font-family="-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,sans-serif">
+<style>
+.box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+.dead{fill:#fff5f5;stroke:#cf222e;stroke-width:1.6;stroke-dasharray:5 3;rx:6}
+.ok{fill:#f6fdf6;stroke:#1a7f37;stroke-width:1.6;rx:6}
+.t{font-size:12px;fill:#1f2328}
+.tb{font-size:12.5px;fill:#1f2328;font-weight:600}
+.s{font-size:10.5px;fill:#656d76}
+.ttl{font-size:14px;fill:#1f2328;font-weight:600}
+.r{stroke:#cf222e;stroke-width:1.6;fill:none}
+.g{stroke:#1a7f37;stroke-width:1.6;fill:none}
+.k{stroke:#8c959f;stroke-width:1.3;fill:none}
+</style>
+<defs>
+<marker id="a" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto"><path d="M0,0 L7,3 L0,6 z" fill="#8c959f"/></marker>
+<marker id="ar" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto"><path d="M0,0 L7,3 L0,6 z" fill="#cf222e"/></marker>
+<marker id="ag" markerWidth="8" markerHeight="8" refX="7" refY="3" orient="auto"><path d="M0,0 L7,3 L0,6 z" fill="#1a7f37"/></marker>
+</defs>
+
+<text x="20" y="26" class="ttl">D-4 — 「갱신 성공」과 「새 인증서 서빙」 사이의 36분 39초</text>
+<text x="20" y="44" class="s">측정: 2026-09-04 · 일련번호 5초 간격 564표본 · 새 연결 0.2초 간격 8856건</text>
+
+<!-- 좌: 디스크 -->
+<rect x="20" y="70" width="250" height="196" class="box"/>
+<text x="34" y="92" class="tb">디스크 — certbot</text>
+<rect x="36" y="104" width="218" height="46" class="box"/>
+<text x="48" y="122" class="t">cert1.pem</text>
+<text x="48" y="138" class="s">09-03 10:47:40 · notAfter Dec 2</text>
+<rect x="36" y="158" width="218" height="46" class="ok"/>
+<text x="48" y="176" class="t">cert2.pem</text>
+<text x="48" y="192" class="s">09-04 17:22:13 · notAfter Dec 3</text>
+<text x="36" y="224" class="s">certbot renew --force-renewal</text>
+<text x="36" y="240" class="s">→ 성공. live/ 링크가 2번을 가리킨다</text>
+<text x="36" y="256" class="s">경로는 그대로, 내용만 바뀐다</text>
+
+<!-- 중: 끊긴 고리 -->
+<rect x="300" y="96" width="260" height="144" class="dead"/>
+<text x="316" y="118" class="tb">★ 잇는 것이 없다</text>
+<text x="316" y="140" class="t">1. ExecStartPost</text>
+<text x="470" y="140" class="t" fill="#cf222e">없음</text>
+<text x="316" y="160" class="t">2. renewal-hooks/deploy/</text>
+<text x="470" y="160" class="t" fill="#cf222e">비었음</text>
+<text x="316" y="180" class="t">3. certbot nginx 플러그인</text>
+<text x="470" y="180" class="t" fill="#cf222e">없음</text>
+<text x="316" y="206" class="s">post/ · pre/ 도 비어 있다 (total 8)</text>
+<text x="316" y="222" class="s">셋 다 비면 아무도 reload 를 부르지 않는다</text>
+<path d="M270 168 L296 168" class="r" marker-end="url(#ar)"/>
+<path d="M300 230 L560 108" stroke="#cf222e" stroke-width="1.2" stroke-dasharray="4 3"/>
+<path d="M300 108 L560 230" stroke="#cf222e" stroke-width="1.2" stroke-dasharray="4 3"/>
+
+<!-- 우: nginx -->
+<rect x="590" y="70" width="250" height="196" class="box"/>
+<text x="604" y="92" class="tb">nginx — 메모리</text>
+<rect x="606" y="104" width="218" height="60" class="dead"/>
+<text x="618" y="124" class="t">기동 시 읽은 cert1</text>
+<text x="618" y="140" class="s">master 585 / worker 586</text>
+<text x="618" y="156" class="s">둘 다 09-03 19:00:39, 22.4시간째</text>
+<text x="606" y="184" class="s">reload 없이는 디스크를 다시 안 본다.</text>
+<text x="606" y="200" class="s">reload 하면 마스터는 남고</text>
+<text x="606" y="216" class="s">워커만 새로 뜬다 → 워커 PID 로 확인</text>
+<text x="606" y="240" class="s">ssl_certificate .../fullchain.pem</text>
+<path d="M564 168 L586 168" class="k" marker-end="url(#a)"/>
+
+<!-- 타임라인 -->
+<text x="20" y="306" class="tb">밖에서 본 것 — 일련번호 (5초 간격)</text>
+<line x1="60" y1="356" x2="800" y2="356" class="k"/>
+<line x1="60" y1="350" x2="60" y2="362" class="k"/>
+<line x1="300" y1="350" x2="300" y2="362" class="k"/>
+<line x1="660" y1="344" x2="660" y2="368" stroke="#1a7f37" stroke-width="2"/>
+<line x1="800" y1="350" x2="800" y2="362" class="k"/>
+<text x="46" y="382" class="s">08:10:51</text>
+<text x="278" y="382" class="s">08:22:13</text>
+<text x="620" y="382" class="s">08:58:52</text>
+<text x="770" y="382" class="s">09:02</text>
+<text x="278" y="398" class="s">디스크 기록</text>
+<text x="618" y="398" class="s">nginx -s reload</text>
+
+<rect x="60" y="330" width="600" height="16" class="dead"/>
+<text x="300" y="342" class="s" text-anchor="middle" fill="#cf222e">0520BB…B853 (옛 인증서) — 이 구간에서 428회 관측</text>
+<rect x="660" y="330" width="140" height="16" class="ok"/>
+<text x="730" y="342" class="s" text-anchor="middle" fill="#1a7f37">06C7CB…EA1D</text>
+<path d="M300 416 L660 416" class="r" marker-end="url(#ar)"/>
+<path d="M660 416 L300 416" class="r" marker-end="url(#ar)"/>
+<text x="480" y="410" class="tb" text-anchor="middle" fill="#cf222e">36분 39초</text>
+<text x="480" y="434" class="s" text-anchor="middle">사람이 reload 했기에 36분이다. 아무도 안 했다면 다음 재시작까지 — 무기한</text>
+
+<!-- reload 판정 -->
+<rect x="20" y="452" width="400" height="52" class="ok"/>
+<text x="34" y="472" class="tb">reload 는 무중단이었다</text>
+<text x="34" y="490" class="s">새 연결 8856건 전부 200 · p95 205.7 → 204.3ms (변화 없음)</text>
+<rect x="440" y="452" width="400" height="52" class="ok"/>
+<text x="454" y="472" class="tb">진행 중이던 요청도 살아남았다</text>
+<text x="454" y="490" class="s">전송 12초째에 reload · 845361바이트 전량 · 연결수 1</text>
+</svg>
@@ -0,0 +1,57 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 760 470" width="760" height="470" font-family="system-ui,-apple-system,Segoe UI,Roboto,sans-serif">
+  <style>
+    .t{font-size:13px;fill:#1f2328}.s{font-size:11px;fill:#59636e}.h{font-size:14px;font-weight:600;fill:#1f2328}
+    .box{fill:#fff;stroke:#8c959f;stroke-width:1.4;rx:6}
+    .host{fill:#f6f8fa;stroke:#59636e;stroke-width:1.6;rx:8}
+    .node{fill:#fff;stroke:#0969da;stroke-width:1.6;rx:8}
+    .ln{stroke:#59636e;stroke-width:1.4;fill:none;marker-end:url(#a)}
+  </style>
+  <defs><marker id="a" markerWidth="9" markerHeight="9" refX="8" refY="4.5" orient="auto"><path d="M0,0 L9,4.5 L0,9 z" fill="#59636e"/></marker></defs>
+
+  <rect class="box" x="290" y="12" width="180" height="38"/>
+  <text class="t" x="380" y="30" text-anchor="middle">개발 노트북</text>
+  <text class="s" x="380" y="44" text-anchor="middle">브라우저 · kubectl · Playwright</text>
+  <path class="ln" d="M380,52 L380,80"/>
+  <text class="s" x="392" y="70">https · tailnet 100.x · split DNS</text>
+
+  <rect class="host" x="40" y="84" width="680" height="66"/>
+  <text class="h" x="56" y="106">test-server</text>
+  <text class="s" x="56" y="122">Arch Linux · 12GB · WiFi only · sudo 는 비밀번호 필요</text>
+  <rect class="box" x="430" y="94" width="270" height="46"/>
+  <text class="t" x="565" y="112" text-anchor="middle">nginx :443 — TLS 종료</text>
+  <text class="s" x="565" y="128" text-anchor="middle">auth / app1 / app2 (SAN 3개, 와일드카드 아님)</text>
+
+  <path class="ln" d="M240,152 L200,186"/><path class="ln" d="M520,152 L560,186"/>
+  <text class="s" x="330" y="172" text-anchor="middle">http · libvirt NAT (virbr0)</text>
+
+  <rect class="node" x="40" y="190" width="320" height="250"/>
+  <text class="h" x="56" y="212">kc-lab-1 · 5120MB</text>
+  <text class="s" x="56" y="228">k3s server · 10.42.0.0/24</text>
+  <rect class="box" x="56" y="238" width="130" height="26"/><text class="t" x="121" y="255" text-anchor="middle">traefik ×1</text>
+  <rect class="box" x="196" y="238" width="148" height="26"/><text class="t" x="270" y="255" text-anchor="middle">coredns</text>
+  <rect class="box" x="56" y="272" width="130" height="26"/><text class="t" x="121" y="289" text-anchor="middle">keycloak-1</text>
+  <rect class="box" x="196" y="272" width="148" height="26"/><text class="t" x="270" y="289" text-anchor="middle">bff (1/2)</text>
+  <rect class="box" x="56" y="306" width="288" height="26"/><text class="t" x="200" y="323" text-anchor="middle">oauth2-proxy (1/2)</text>
+  <rect class="box" x="56" y="340" width="288" height="46"/>
+  <text class="t" x="200" y="358" text-anchor="middle">prometheus (PVC) · grafana</text>
+  <text class="s" x="200" y="374" text-anchor="middle">관측 스택은 여기 고정 — 죽이지 않는다</text>
+
+  <rect class="node" x="400" y="190" width="320" height="250"/>
+  <text class="h" x="416" y="212">kc-lab-2 · 4096MB</text>
+  <text class="s" x="416" y="228">k3s agent · 10.42.1.0/24</text>
+  <rect class="box" x="416" y="238" width="288" height="26"/><text class="t" x="560" y="255" text-anchor="middle">keycloak-0</text>
+  <rect class="box" x="416" y="272" width="140" height="26"/><text class="t" x="486" y="289" text-anchor="middle">bff (2/2)</text>
+  <rect class="box" x="566" y="272" width="138" height="26"/><text class="t" x="635" y="289" text-anchor="middle">oauth2-proxy</text>
+  <rect class="box" x="416" y="306" width="140" height="46"/>
+  <text class="t" x="486" y="324" text-anchor="middle">postgres</text><text class="s" x="486" y="340" text-anchor="middle">PVC (노드 고정)</text>
+  <rect class="box" x="566" y="306" width="138" height="46"/>
+  <text class="t" x="635" y="324" text-anchor="middle">redis</text><text class="s" x="635" y="340" text-anchor="middle">PVC + AOF</text>
+  <text class="s" x="560" y="374" text-anchor="middle">장애 주입은 여기</text>
+
+  <path d="M360,290 L400,290" stroke="#0969da" stroke-width="1.6" fill="none" marker-end="url(#a)"/>
+  <path d="M400,300 L360,300" stroke="#0969da" stroke-width="1.6" fill="none" marker-end="url(#a)"/>
+  <text class="s" x="380" y="284" text-anchor="middle">7800</text>
+  <text class="s" x="380" y="318" text-anchor="middle">JGroups</text>
+
+  <text class="s" x="40" y="460">A-0 에서 확인: 세션은 이 7800 이 아니라 postgres 를 통해 공유된다</text>
+</svg>
@@ -0,0 +1,9 @@
+=== A-3 이 가정만 하고 재지 않은 값 ===
+          name          | setting | unit | source  
+------------------------+---------+------+---------
+ commit_delay           | 0       |      | default
+ synchronous_commit     | on      |      | default
+ wal_writer_delay       | 200     | ms   | default
+ wal_writer_flush_after | 128     | 8kB  | default
+(4 rows)
+
@@ -0,0 +1,19 @@
+# 주의 — 이 파일은 원 실험 시점에 0바이트로 저장됐다.
+# 리다이렉션이 stdout 만 받았는데 출력이 stderr 로 갔거나 tee 앞 파이프가
+# 비어 있었던 것으로 보인다. README 는 그 사이 파일 내용을 서술하고 있었는데,
+# 그것은 화면에서 본 것을 적은 것이지 이 파일에서 온 것이 아니었다.
+#
+# 아래는 사후에 다시 수집한 것이며, 원 시점의 DROP 규칙(0 패킷)은 이미
+# 제거되어 재현되지 않는다. 구조적 사실(kube-router 가 자기 체인을 FORWARD
+# 최상단에 유지한다)만 확인할 수 있다.
+# 원 실험의 결정적 증거는 04-correct-direction.txt 의 패킷 카운터 19/21 이다.
+
+=== A-5 재수집 — filter 테이블 규칙이 CNI 체인에 밀리는 것 ===
+Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
+num   pkts bytes target     prot opt in     out     source               destination         
+1     1690 3386K KUBE-ROUTER-FORWARD  0    --  *      *       0.0.0.0/0            0.0.0.0/0            /* kube-router netpol - TEMCG2JMHZYE7H7T */
+2        7   612 KUBE-PROXY-FIREWALL  0    --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate NEW /* kubernetes load balancer firewall */
+3       40 13196 KUBE-FORWARD  0    --  *      *       0.0.0.0/0            0.0.0.0/0            /* kubernetes forwarding rules */
+
+  (원 실험 시점의 규칙은 이미 제거됐다. 아래는 kube-router 가 자기 체인을
+   FORWARD 최상단에 유지한다는 구조적 사실만 보여준다 — 그것이 실패 원인이었다.)
@@ -16,3 +16,10 @@
 1. **세션은 옮겨졌고 토큰은 안 옮겨졌다.** 빈 81개가 늘었는데 authorized client 관련은 하나도 안 바뀌었다.
 2. **refresh token 은 Redis 에 평문으로 있는 게 아니라 아예 없다.** 암호화를 고민하기 전에 이걸 알아야 한다.
 3. **"로그인은 되어 있는데 아무것도 못 하는" 상태가 만들어진다** — 완전 로그아웃보다 나쁘다.
+
+## 스크린샷 주의
+
+`b1-login-works-two-replicas.png` 과 `b1-token-boundary-after-redis.png` 는
+**동일 파일**이며 `b2-before-relogin.png` 와도 같다 (md5 `6de826a7…`).
+세 시점 모두 `accessTokenStoredOnServer: false` 인 같은 화면이었다.
+**시점 구별은 터미널 출력과 Redis/DB 조회가 한다.**
@@ -19,3 +19,14 @@
 2. **refresh token 은 평문이다.** DB 읽기 권한이면 작동하는 토큰을 얻는다.
 3. **같은 사용자의 두 번째 로그인이 첫 번째를 덮어쓴다.** 기본키에 session id 가 없어 구조적으로 그렇다.
 4. **로그아웃은 셋 중 하나만 지운다.** 평문 토큰과 Keycloak SSO 세션이 남는다.
+
+## 스크린샷 주의
+
+`b2-tokens-shared-across-instances.png` 는 **B-0 의
+`b0-bff-token-boundary.png` 와 동일 파일**이다 (md5 `9ed00537…`).
+두 시점 모두 `accessTokenStoredOnServer: true` 인 같은 화면이라 바이트가 같다.
+
+**그래서 이 png 는 "JDBC 전환으로 토큰이 공유된다" 를 단독으로 증명하지
+못한다.** 그 증명은 `01-jdbc-store-deploy.txt`(테이블 생성)과
+`03-plaintext-tokens.txt`(행에 토큰이 들어 있음)가 한다.
+`b2-before-relogin.png` 는 B-1 의 캡처와 동일 파일이다.
@@ -0,0 +1,40 @@
+=== Q4 ① 다중 값 role — 구분자와 동명 헤더 ===
+(a) 쉼표 구분 한 개 헤더
+    보냄:   X-Auth-Request-Roles: admin,editor,viewer
+    도착:   ['admin,editor,viewer']          ← 문자열 하나 그대로
+
+(b) 동명 헤더 두 개
+    보냄:   X-Auth-Request-Roles: admin
+            X-Auth-Request-Roles: editor
+    도착:   ['admin', 'editor']              ← ★ 둘 다 도착. 덮어쓰지도 합치지도 않는다
+
+(c) 값 안에 구분자가 들어간 경우
+    보냄:   X-Auth-Request-Roles: role-with,comma
+    도착:   ['role-with,comma']              ← (a) 와 구별 불가
+
+=== Q4 ② 헤더 크기 상한 ===
+  보낸 길이   1000 → HTTP 200, 도착 길이 1000
+  보낸 길이   4000 → HTTP 200, 도착 길이 4000
+  보낸 길이   8000 → HTTP 400  (Tomcat 의 HTML 오류 페이지)
+  보낸 길이  16000 → HTTP 000  (응답을 못 받음 = 연결이 끊김)
+  보낸 길이  32000 → HTTP 000
+
+  → 자르지 않는다. 거부한다. 그리고 거부하는 계층이 둘이며 증상이 다르다.
+
+=== Q4 ④ upstream 이 검증하는가 ===
+  아무 인증 없이 보냄:
+    x-auth-request-user        ['administrator']
+    x-auth-request-email       ['admin@example.com']
+    x-auth-request-roles       ['realm-admin,superuser']
+    remoteAddr                 100.123.124.30
+  → 그대로 도착. 검증 없음.
+
+  대조 — JWT 를 요구하는 경로:
+    /api/echo        HTTP 200   (permitAll)
+    /api/me          HTTP 401
+    /api/protected   HTTP 401
+
+  backend SecurityConfig:
+    .requestMatchers("/actuator/health", "/actuator/health/**", "/api/public", ...).permitAll()
+    .anyRequest().authenticated()
+    .oauth2ResourceServer(oauth2 -> oauth2.jwt(...))
@@ -0,0 +1,14 @@
+# B-4 — Edge 인가 범위 증거
+
+2026-09-04 15:25–15:35 KST
+해설: [`docs/experiment-b4-edge-authorization-scope.md`](../../experiment-b4-edge-authorization-scope.md)
+
+| 파일 | 무엇을 보여주는가 |
+|---|---|
+| `01-header-handling.txt` | ① 동명 헤더가 **둘 다 도착**(`['admin','editor']`)하고 값 안의 쉼표를 구분자와 구별할 수 없다 · ② 8KB 에서 Tomcat 400, 16KB 에서 연결 끊김 — **자르지 않고 거부** · ④ 위조 신원 헤더가 그대로 도착, JWT 경로는 401 |
+
+## 핵심 세 줄
+
+1. **Q4 의 「nginx 가 동명 헤더를 덮어쓴다」는 조건부다.** nginx 는 자기가 `proxy_set_header` 한 헤더만 덮어쓰고, 나머지는 통과시킨다 — 지금 `X-Auth-Request-*` 는 통과한다.
+2. **크기는 절벽이다.** 점진적으로 나빠지지 않고 8KB 에서 전면 400 이 되며, role 이 많은 사용자만 깨진다.
+3. **헤더를 인가 근거로 쓰면 위조 가능성이 곧 권한 상승이다.** 2홉 실험의 결론이 여기서는 신원 자체에 적용된다.
@@ -0,0 +1,9 @@
+=== 기준선 ===
+  Redis 키: 1
+  PostgreSQL 토큰: 1 행
+  Redis 영속화 설정:
+    save = save	
+    appendonly	no
+
+=== 외부 진입점 정상 확인 ===
+  https://app1.hyeonworks.com/  HTTP 200
@@ -0,0 +1,25 @@
+=== ① Redis 정지 ===
+  정지: 14:26:30
+deployment.apps/redis scaled
+  삭제 완료
+
+=== 로그인한 사용자의 다음 요청은 어떻게 되는가 ===
+  /                      HTTP 200
+  /bff/token-boundary    HTTP 000
+  /actuator/health       HTTP 503
+  --- token-boundary 응답 본문 ---
+
+
+=== 파드 상태 — readiness 가 Redis 를 보는가 ===
+bff-555df79c97-6j86w   1/1   Running   0     17m
+bff-555df79c97-vgg6g   1/1   Running   0     16m
+
+=== health 상세 ===
+
+
+=== BFF 로그 ===
+	at java.base/sun.nio.ch.Net.pollConnect(Native Method) ~[na:na]
+	at java.base/sun.nio.ch.Net.pollConnectNow(Unknown Source) ~[na:na]
+	at java.base/sun.nio.ch.SocketChannelImpl.finishConnect(Unknown Source) ~[na:na]
+	at io.netty.channel.socket.nio.NioSocketChannel.doFinishConnect(NioSocketChannel.java:336) ~[netty-transport-4.1.135.Final.jar!/:4.1.135.Final]
+	at io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:339) ~[netty-transport-4.1.135.Final.jar!/:4.1.135.Final]
@@ -0,0 +1,13 @@
+=== health 그룹별 응답 — 왜 파드는 Ready 인가 ===
+  /actuator/health             HTTP server
+  /actuator/health/readiness   HTTP 200
+  /actuator/health/liveness    HTTP 200
+
+=== /actuator/health 본문 (Redis 항목이 있는가) ===
+
+
+=== /actuator/health/readiness 본문 ===
+{"status":"UP"}
+
+=== Service 엔드포인트 — 트래픽을 계속 받는가 ===
+  ready: [10.42.0.52 10.42.1.124]
@@ -0,0 +1,39 @@
+=== 복구 ===
+deployment.apps/redis scaled
+deployment "redis" successfully rolled out
+  /actuator/health       HTTP 200
+  /bff/token-boundary    HTTP 302
+  BFF 재시작 필요했나: 0,0 회 재시작
+
+=== ② 영속화 — 지금 설정으로 재시작하면 무엇이 남는가 ===
+  키 심음: before-restart
+  dbsize: 4
+
+  --- AOF 를 켜고 다시 심는다 (영속화가 켜져 있으면 살아남는가) ---
+    appendonly	yes
+    total 12
+    drwxr-xr-x    3 redis    redis         4096 Sep  4 05:26 .
+    drwxr-xr-x    1 root     root          4096 Sep  4 05:26 ..
+    drwx------    2 redis    redis         4096 Sep  4 05:26 appendonlydir
+
+  --- 파드를 지운다 ---
+deployment "redis" successfully rolled out
+  재기동 후:
+    dbsize:    0
+    b5:probe   
+    b5:aof     
+    appendonly no
+persistentvolumeclaim/redis-data created
+deployment.apps/redis configured
+deployment "redis" successfully rolled out
+
+=== 영속 볼륨 위에서 다시 시험 ===
+  appendonly	yes
+  키 심음: written-on-pvc
+sed: -e expression #1, char 8: unknown option to 's'
+
+  --- 파드를 지운다 ---
+deployment "redis" successfully rolled out
+  재기동 후:
+    dbsize:  1
+    b5:pvc   written-on-pvc
@@ -0,0 +1,17 @@
+# B-5 — Redis 상실과 영속화 증거
+
+2026-09-04 15:35–15:50 KST
+해설: [`docs/experiment-b5-redis-loss-persistence.md`](../../experiment-b5-redis-loss-persistence.md)
+
+| 파일 | 무엇을 보여주는가 |
+|---|---|
+| `01-baseline.txt` | 정지 전 — Redis 1키, PostgreSQL 1행, `save`/`appendonly no`, 외부 200 |
+| `02-redis-down.txt` | 정지 후 — `/bff/token-boundary` **`HTTP 000`(멈춤)**, `/actuator/health` 503, **파드는 1/1 Ready 유지**, Lettuce 재연결 스택 |
+| `03-health-groups.txt` | **핵심** — `/actuator/health` 503 인데 `/actuator/health/readiness` 는 `{"status":"UP"}`. Service 엔드포인트에 두 파드 모두 남아 있다 |
+| `04-persistence.txt` | 복구는 자동(재시작 0회) · **AOF 를 켰는데 파드 삭제 후 `dbsize 0`** · PVC 를 붙인 뒤 `written-on-pvc` **생존** |
+
+## 핵심 세 줄
+
+1. **파드가 Ready 를 유지한 채 계속 실패한다.** `redis` 헬스 지표가 readiness 그룹에 없기 때문이며, A-2 에서 Keycloak 이 NotReady 가 된 것과 정반대다.
+2. **오류가 아니라 멈춤이다.** `HTTP 000` — 빠른 실패가 안 되어 있어 사용자는 멈춘 화면을 본다.
+3. **볼륨 없이 AOF 만 켜는 것은 장식이다.** `appendonlydir` 까지 만들어지지만 컨테이너와 함께 사라진다.
@@ -0,0 +1,9 @@
+=== [1] 회전 전: 토큰 발급 + JWKS 상태 ===
+  발급 토큰의 kid: OY-caYDNGoP4HMAz-Q9UPTU-DM1i896NuzUZu6gfCqM
+  JWKS 의 RS256 키 수: 1
+  JWKS kid 목록:
+    {"keys":[{"kid":"gokjn0zFUok8r7JVqW1cxuyojH1bTT87vzfQG9RrFX4"
+    {"kid":"OY-caYDNGoP4HMAz-Q9UPTU-DM1i896NuzUZu6gfCqM"
+
+=== [2] 그 토큰이 지금 통하는가 (리소스 서버) ===
+  /api/me  HTTP 200
@@ -0,0 +1,16 @@
+=== [3] 키 회전 — 우선순위가 더 높은 RSA 공급자를 추가한다 ===
+Created new component with id '7902af43-a0cc-4ebd-ad25-04d563854d16'
+
+=== [4] 회전 후 JWKS — 옛 키가 남아 있는가 ===
+  RS256 키 수: 2
+  kid 목록:
+    {"keys":[{"kid":"1B4AQHoxZvFaQi1tc1byz8ifU-nYFB6engD4YB4Fz84"
+    {"kid":"gokjn0zFUok8r7JVqW1cxuyojH1bTT87vzfQG9RrFX4"
+    {"kid":"OY-caYDNGoP4HMAz-Q9UPTU-DM1i896NuzUZu6gfCqM"
+
+=== [5] 새 토큰은 어느 키로 서명되는가 ===
+  새 토큰의 kid: 1B4AQHoxZvFaQi1tc1byz8ifU-nYFB6engD4YB4Fz84
+
+=== [6] ★ 회전 전에 발급된 토큰은 아직 통하는가 ===
+  옛 토큰  /api/me  HTTP 200
+  새 토큰  /api/me  HTTP 200
@@ -0,0 +1,16 @@
+=== [7] 옛 RSA 공급자(980ee9b7 = OY-caYDN 키) 제거 ===
+  제거 완료
+
+=== [8] JWKS 에서 사라졌는가 ===
+  RS256 키 수: 1
+    {"keys":[{"kid":"1B4AQHoxZvFaQi1tc1byz8ifU-nYFB6engD4YB4Fz84"
+    {"kid":"gokjn0zFUok8r7JVqW1cxuyojH1bTT87vzfQG9RrFX4"
+
+=== [9] ★ 옛 키로 서명된 토큰은 이제 어떻게 되는가 ===
+  옛 토큰  /api/me  HTTP 401  (캐시가 살아 있으면 아직 통할 수 있다)
+  새 토큰  /api/me  HTTP 200
+
+=== [10] 리소스 서버를 재시작해 JWKS 캐시를 비우면 ===
+deployment "echo" successfully rolled out
+  옛 토큰  /api/me  HTTP 401
+  새 토큰  /api/me  HTTP 200
@@ -0,0 +1,16 @@
+# B-6 — key 회전 증거
+
+2026-09-04 15:50–16:00 KST
+해설: [`docs/experiment-b6-key-rotation.md`](../../experiment-b6-key-rotation.md)
+
+| 파일 | 무엇을 보여주는가 |
+|---|---|
+| `01-before-rotation.txt` | 회전 전 — 토큰 `kid=OY-caYDN...`, JWKS RS256 1개, `/api/me` 200 |
+| `02-rotation.txt` | 우선순위 200 공급자 추가 → **JWKS RS256 2개**, 새 토큰은 새 kid, **옛 토큰도 새 토큰도 200** (무중단) |
+| `03-old-key-removed.txt` | 옛 공급자 제거 → JWKS 1개, **옛 토큰 즉시 401**. 리소스 서버 재시작 후에도 동일 |
+
+## 핵심 세 줄
+
+1. **Keycloak 의 키 회전은 "바꾸기"가 아니라 "더 높은 우선순위로 추가하기"** 다. 추가만으로는 아무것도 안 깨진다.
+2. **위험한 것은 옛 키를 버리는 시점이다.** 제거 즉시 그 키로 서명된 토큰이 401 이 된다.
+3. **캐시는 유예가 아니다.** 모르는 `kid` 를 만나면 JWKS 를 다시 받으므로 제거가 곧바로 반영된다. 유예는 옛 키를 남겨두는 기간으로 만들어야 한다.
@@ -0,0 +1,13 @@
+=== Grafana ingress 를 잠시 내린다 (app2 를 빌린다) ===
+  grafana ingress 삭제
+secret/oauth2-proxy-secrets created
+deployment.apps/oauth2-proxy created
+service/oauth2-proxy created
+ingress.networking.k8s.io/oauth2-proxy created
+deployment "oauth2-proxy" successfully rolled out
+oauth2-proxy-c76b49c59-8p5hl   true   kc-lab-1
+oauth2-proxy-c76b49c59-b9928   true   kc-lab-2
+
+=== 진입점 확인 ===
+  https://app2.hyeonworks.com/  HTTP 302
+  /ping                         HTTP 200
@@ -0,0 +1,9 @@
+=== curl 로 OAuth 흐름을 완주한다 (nginx 우회, Traefik 직접) ===
+  로그인 폼 action: https://auth.hyeonworks.com/realms/keycloak-patterns/login-actions/authenticate?session_co...
+  쿠키 항아리:
+                                 len=0
+    KC_AUTH_SESSION_HASH         len=64
+
+=== 두 replica 모두 이 쿠키를 받아들이는가 ===
+  10.42.1.135    /oauth2/auth  HTTP 000
+  10.42.1.134    /oauth2/auth  HTTP 000
@@ -0,0 +1,31 @@
+=== 세션이 Redis 에 들어갔는가 ===
+b5:pvc
+_oauth2_proxy-b26111fbd1fdab3ae2182e287001b02a
+  dbsize: 2
+
+=== oauth2-proxy 가 cookie secret 을 여러 개 받는가 ===
+        --cookie-secret string                                the seed string for secure cookies (optionally base64 encoded)
+
+=== ★ secret 을 A → B 로 교체한다 ===
+deployment.apps/oauth2-proxy patched
+deployment "oauth2-proxy" successfully rolled out
+  현재 secret 키: COOKIE_SECRET_B
+  Redis 세션은 그대로인가: 2 키
+=== secret 교체 후 oauth2-proxy 로그 — 옛 쿠키를 어떻게 처리했나 ===
+[2026/09/04 05:41:46] [oauthproxy.go:178] Cookie settings: name:_oauth2_proxy secure(https):true httponly:true expiry:1h0m0s domains: path:/ samesite: refresh:disabled
+[2026/09/04 05:42:18] [oauthproxy.go:1024] No valid authentication in request. Initiating login.
+100.123.124.30 - cb8c0ec1-1d87-479c-9aef-e1d9158a5829 - - [2026/09/04 05:42:18] app2.hyeonworks.com GET - "/api/echo" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, lik
+[2026/09/04 05:42:18] [stored_session.go:94] Error loading cookied session: session ticket cookie failed validation: <nil>, removing session
+[2026/09/04 05:42:18] [stored_session.go:97] Error removing session: error decoding ticket to clear session: session ticket cookie failed validation: <nil>
+100.123.124.30 - 28af938f-08b5-4e15-9094-8d9591a18a3f - labuser@example.com [2026/09/04 05:42:18] app2.hyeonworks.com GET / "/api/echo" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/
+[2026/09/04 05:41:58] [providers.go:146] Warning: Your provider supports PKCE methods ["plain" "S256"], but you have not enabled one with --code-challenge-method
+[2026/09/04 05:41:58] [oauthproxy.go:172] OAuthProxy configured for OpenID Connect Client ID: oauth2-proxy
+[2026/09/04 05:41:58] [oauthproxy.go:178] Cookie settings: name:_oauth2_proxy secure(https):true httponly:true expiry:1h0m0s domains: path:/ samesite: refresh:disabled
+100.123.124.30 - 5a08219f-60e0-4c97-bfee-78cae8891ca8 - labuser@example.com [2026/09/04 05:42:18] [AuthSuccess] Authenticated via OAuth2: Session{email:labuser@example.com user:27df5ea9-8703
+100.123.124.30 - 5a08219f-60e0-4c97-bfee-78cae8891ca8 - - [2026/09/04 05:42:18] app2.hyeonworks.com GET - "/oauth2/callback?state=j7eKInWCrYqRyi5LVDGDjtLrIBJCpwdkmzoJVdhJUc0%3A%2Fapi%2Fecho&
+100.123.124.30 - a3074807-5143-49b9-b77c-e7e2eb90ac24 - labuser@example.com [2026/09/04 05:42:18] app2.hyeonworks.com GET / "/favicon.ico" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebK
+
+=== Redis 세션 수 (옛 세션이 남아 있는가) ===
+  _oauth2_proxy-978dfaefbdadccb96c7be1625dba5616
+  _oauth2_proxy-b26111fbd1fdab3ae2182e287001b02a
+  총: 2 개
@@ -0,0 +1,18 @@
+# B-7 — oauth2-proxy cookie secret 교체 증거
+
+2026-09-04 16:00–16:15 KST
+해설: [`docs/experiment-b7-cookie-secret-rotation.md`](../../experiment-b7-cookie-secret-rotation.md)
+
+| 파일 | 무엇을 보여주는가 |
+|---|---|
+| `01-deploy.txt` | 양 노드에 replica 하나씩. `/` 302, `/ping` 200 |
+| `02-cookie-portability.txt` | curl 로 흐름을 완주하려던 시도 — 파드 IP 는 호스트에서 안 닿는다 |
+| `03-rotation.txt` | **`--cookie-secret string` 단수 확인** · 교체 후 `session ticket cookie failed validation` · **`Error removing session`** · Redis 에 **고아 세션 2개** |
+| `b7-oauth2proxy-login-success.png` | Redis 세션 전환 후 성공한 Forward-Auth — `x-forwarded-user/email/preferred-username` 과 **티켓 형태 쿠키** |
+
+## 핵심 네 줄
+
+1. **BFF 와 정반대다.** 인가 요청이 쿠키에 있어 **콜백이 다른 replica 로 가도 성공**한다 — B-0 에서 BFF 가 실패한 바로 그 지점.
+2. **502 의 원인은 큰 쿠키였다.** Traefik 직접은 정상이고 nginx 만 502 — B-4 의 헤더 절벽이 응답 쪽에서 재현됐다.
+3. **겹침 구간을 만들 수 없다.** `--cookie-secret` 이 단수라 B-6 의 무중단 회전이 불가능하다.
+4. **교체하면 서버 세션이 고아로 남는다.** 티켓을 못 푸니 지울 수도 없다.
@@ -0,0 +1,11 @@
+=== 깨끗한 상태로 초기화 ===
+DELETE 1
+
+=== 기준선 ===
+  Keycloak 온라인 세션: 4
+  Redis 키: 0
+
+=== 두 앱의 구조 ===
+  app1.hyeonworks.com  →  BFF        (서버 세션: Redis + PostgreSQL)
+  app2.hyeonworks.com  →  oauth2-proxy (쿠키 티켓 + Redis)
+  둘 다 realm keycloak-patterns 를 쓴다
@@ -0,0 +1,9 @@
+=== app1 로그인 직후 Keycloak 세션 ===
+     user_session_id      | client_sessions 
+--------------------------+-----------------
+ oqOjHekin4JU-BZjgQLjUByW |               1
+(1 row)
+
+  Redis 키: 1
+    bff:session:sessions:6e0d9af4-2c8f-47d2-bf83-8b1e9670c679
+  PostgreSQL authorized client: 1 행
@@ -0,0 +1,20 @@
+=== app2 방문 후 — 로그인 화면 없이 통과했는가 ===
+     user_session_id      | client_sessions 
+--------------------------+-----------------
+ oqOjHekin4JU-BZjgQLjUByW |               2
+(1 row)
+
+
+=== 어느 클라이언트가 붙었는가 ===
+              client_id               |       name       
+--------------------------------------+------------------
+ 9055fa46-6abb-4d6d-a339-8a9183bbf26d | bff-confidential
+ 80431dbc-af81-4673-9790-ad06d1570b2e | oauth2-proxy
+(2 rows)
+
+
+=== 저장소 상태 ===
+  Redis 키:
+    _oauth2_proxy-6b028a70f69c8f0da9966eb36972dff2
+    bff:session:sessions:6e0d9af4-2c8f-47d2-bf83-8b1e9670c679
+  PostgreSQL authorized client: 1 행
@@ -0,0 +1,25 @@
+=== ★ Keycloak 의 SSO 세션 하나를 죽인다 ===
+  남은 Keycloak 세션: 1
+
+=== 두 앱의 애플리케이션 세션은 그대로인가 ===
+  _oauth2_proxy-6b028a70f69c8f0da9966eb36972dff2
+  bff:session:sessions:6e0d9af4-2c8f-47d2-bf83-8b1e9670c679
+  PostgreSQL authorized client: 1 행
+
+  → IdP 세션은 없어졌는데 앱 세션은 남아 있다면, 두 계층의 수명이 어긋난 것이다
+=== 사용자 단위 로그아웃 (IdP 세션만 끊는다) ===
+  남은 Keycloak 세션: 1
+
+=== 앱 세션은 남아 있는가 ===
+  _oauth2_proxy-6b028a70f69c8f0da9966eb36972dff2
+  bff:session:sessions:6e0d9af4-2c8f-47d2-bf83-8b1e9670c679
+  PostgreSQL authorized client: 1 행
+=== 남은 세션의 realm 과 client ===
+     user_session_id      | realm  | clients 
+--------------------------+--------+---------
+ E1q5xI7tt4U_WhZpW7rEPIF2 | master |       1
+(1 row)
+
+
+=== 브라우저에서 두 앱을 다시 열면 어떻게 되는가 ===
+  (IdP 세션이 사라졌으면 재로그인이 필요해야 한다)
@@ -0,0 +1,27 @@
+# C-1 — 다중 앱 SSO 증거
+
+2026-09-04 16:15–16:30 KST
+해설: [`docs/experiment-c1-multi-app-sso.md`](../../experiment-c1-multi-app-sso.md)
+
+| 파일 | 무엇을 보여주는가 |
+|---|---|
+| `01-baseline.txt` | 초기화 시도 — `logout-all` 이 안 먹어 세션 4개가 남았다 |
+| `02-after-app1-login.txt` | app1 로그인 후 — user session 1 · client session 1 · Redis 1 · DB 1행 |
+| `03-after-app2-visit.txt` | **app2 방문 후 client session 1 → 2**, `bff-confidential` 과 `oauth2-proxy` 가 같은 user session 에 붙음. Redis 에 두 종류 세션 |
+| `04-sso-session-killed.txt` | IdP 세션 삭제 후 — **앱 세션 셋 다 남아 있다**. realm 을 join 해 보고서야 남은 것이 master 세션임을 확인 |
+| `c1-sso-app2-no-login-screen.png` | app2 가 로그인 화면 없이 열린 화면 |
+| `c1-apps-alive-after-idp-logout.png` | **IdP 세션을 죽인 뒤에도 그대로 열리는 화면** |
+
+## 핵심 세 줄
+
+1. **SSO 는 user session 1개에 client session N개** 구조다 — A-3(전체 소실)과 B-3(client 만 제거)의 차이가 여기서 의미를 갖는다.
+2. **IdP 세션을 죽여도 두 앱은 계속 동작한다.** 세 층(IdP·앱·토큰)의 수명이 각자이기 때문이다.
+3. **IdP 는 "로그인 경로"의 단일 장애점이지 "이미 로그인한 사용자"의 단일 장애점이 아니다.** 장애는 앱 세션 수명만큼 지연되어 몰려온다.
+
+## 스크린샷 주의
+
+`c1-sso-app2-no-login-screen.png` 과 `c1-apps-alive-after-idp-logout.png` 는
+**바이트 단위로 동일한 파일**이다 (md5 `2c703176…`). 두 시점의 화면이 실제로
+같은 내용이었기 때문이며, 조작이 아니다. **다만 그래서 두 시점을 구별하는
+증거가 되지 못한다** — 구별은 `03-` 과 `04-` 의 터미널 출력(client_sessions
+1→2, 그리고 IdP 세션 삭제 후 Redis 키 잔존)이 한다.
@@ -0,0 +1,12 @@
+=== 현재 클라이언트의 백채널 로그아웃 설정 ===
+--- bff-confidential ---
+    "frontchannelLogout" : false,
+--- oauth2-proxy ---
+    "frontchannelLogout" : false,
+
+=== BFF 가 백채널 로그아웃 엔드포인트를 갖고 있는가 ===
+
+=== 실제로 그 경로가 있는가 ===
+  /logout/connect/back-channel/keycloak      HTTP 302
+  /backchannel-logout                        HTTP 302
+  /oauth2/sign_out                           HTTP 302
@@ -0,0 +1,8 @@
+=== IdP 쪽에만 백채널 로그아웃 URL 을 설정한다 ===
+  client id: 9055fa46-6abb-4d6d-a339-8a9183bbf26d
+command terminated with exit code 1
+
+=== 로그인 상태를 만든다 ===
+  (브라우저에 이미 세션이 있다)
+  Keycloak 세션: 2
+  Redis: 2 키
@@ -0,0 +1,28 @@
+=== 로그아웃 전 상태 ===
+  Redis: 2 키
+  keycloak-patterns 세션: 0
+
+=== ★ IdP 로그아웃 — Keycloak 이 백채널 알림을 보낼 것이다 ===
+  시각: 14:53:29
+
+=== Keycloak 로그 — 백채널 요청을 보냈는가, 결과는 ===
+
+=== BFF 로그 — 백채널 요청이 도착했는가 ===
+
+=== 앱 세션이 정리되었는가 ===
+  Redis: 2 키
+    _oauth2_proxy-6b028a70f69c8f0da9966eb36972dff2
+    bff:session:sessions:6e0d9af4-2c8f-47d2-bf83-8b1e9670c679
+=== 로그아웃 전 — 실제 세션이 있는가 ===
+  keycloak-patterns 세션: 1
+  Redis: 1 키
+
+=== ★ IdP 로그아웃 → 백채널 알림 ===
+  시각: 14:54:21
+
+=== Keycloak 로그 ===
+
+=== BFF 로그 — 요청이 왔는가 ===
+
+=== 앱 세션 ===
+  Redis: 1 키
@@ -0,0 +1,15 @@
+=== IdP 세션은 실제로 끊겼는가 ===
+  keycloak-patterns 세션: 0
+
+=== ★ Keycloak 파드가 app1.hyeonworks.com 에 닿는가 ===
+  DNS 해석:
+    Address: 100.83.212.4
+    
+    Non-authoritative answer:
+    
+  HTTPS 도달:
+    HTTP 200  (0 이면 못 닿음)
+
+=== Keycloak 로그 전체에서 backchannel 흔적 ===
+  keycloak-0: 0 줄
+  keycloak-1: 0 줄
@@ -0,0 +1,17 @@
+# C-2 — 백채널 로그아웃 증거
+
+2026-09-04 16:30–16:55 KST
+해설: [`docs/experiment-c2-backchannel-logout.md`](../../experiment-c2-backchannel-logout.md)
+
+| 파일 | 무엇을 보여주는가 |
+|---|---|
+| `01-current-state.txt` | 두 클라이언트 모두 `backchannelLogoutUrl` 없음 · BFF 소스에 `oidcLogout` 없음 · 후보 경로 셋 다 **302**(핸들러 없음) |
+| `02-configure-idp.txt` | IdP 쪽에만 `backchannel.logout.url` 설정 (점 표기는 실패, JSON 으로 성공) |
+| `03-logout-attempt.txt` | **살아 있는 세션(1)에 로그아웃 → IdP 세션 0, Redis 세션은 1 그대로.** Keycloak·BFF 로그에 흔적 없음 |
+| `04-reachability.txt` | **Keycloak 파드가 `app1.hyeonworks.com` 에 `HTTP 200` 으로 닿는다** — 네트워크 문제가 아님 |
+
+## 핵심 세 줄
+
+1. **백채널 로그아웃은 어느 쪽에도 구현되어 있지 않았다.** C-1 이 관측한 "전파 안 됨"의 원인이다.
+2. **IdP 쪽만 설정해도 소용없다.** 받을 엔드포인트와 `sid → 세션` 역인덱스가 앱에 있어야 한다.
+3. **도달성이 숨은 전제다.** 이 실험대는 닿지만, 앱이 사설망에 있으면 설정해도 조용히 실패한다.
@@ -0,0 +1,15 @@
+=== 백업 전 상태 ===
+  realms|clients|users|sessions|authclients = 2|15|2|3|1
+
+=== pg_dump — 전체 덤프 ===
+  시작: 14:59:30
+  완료: 14:59:30
+  크기: 394945 bytes  (6956 줄)
+  포함된 테이블 수: 101
+
+=== 덤프에 세션이 들어 있는가 ===
+  offline_user_session 언급: 13
+    COPY public.offline_user_session (user_session_id, user_id, realm_id, created_on, offline_flag, data, last_session_refre
+    E1q5xI7tt4U_WhZpW7rEPIF2	48b37d33-8419-49aa-9b5b-7731975be50c	7845f394-723a-4d07-b530-c7416b2e1d31	1788500836	0	{"ipAddr
+    2ap3DyRiBF8OdMiqCodsJ0mp	48b37d33-8419-49aa-9b5b-7731975be50c	7845f394-723a-4d07-b530-c7416b2e1d31	1788501029	0	{"ipAddr
+    Zsk4QcgXf_qgyMKzde5AG-Fz	48b37d33-8419-49aa-9b5b-7731975be50c	7845f394-723a-4d07-b530-c7416b2e1d31	1788501263	0	{"ipAddr
@@ -0,0 +1,17 @@
+=== ★ 파괴 — 스키마를 통째로 지운다 ===
+  시각: 14:59:47
+DROP SCHEMA
+CREATE SCHEMA
+  남은 테이블: 0
+
+=== 서비스 영향 ===
+  https://auth.hyeonworks.com/realms/master   HTTP 200
+  https://app1.hyeonworks.com/                HTTP 200
+bff-555df79c97-6j86w           1/1   Running   0     49m
+bff-555df79c97-vgg6g           1/1   Running   0     49m
+keycloak-0                     1/1   Running   0     4m15s
+keycloak-1                     1/1   Running   0     4m38s
+
+=== Keycloak 이 무엇을 말하는가 ===
+  2026-09-04 05:58:02,598 WARN  [org.keycloak.jgroups.protocol.KEYCLOAK_JDBC_PING2] (blocking-thread--p3-t2) Failed to fetch the cluster members from the database.: org.postgresql.ut
+  	at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2904)
@@ -0,0 +1,29 @@
+=== 무엇이 실제로 깨지는가 ===
+  /.well-known/openid-configuration      HTTP 500
+  /protocol/openid-connect/certs         HTTP 200
+  토큰 발급 (DB 쓰기 필요)       HTTP 400
+
+=== ★ 복구 — 덤프에서 되돌린다 ===
+  시작: 15:00:12
+  완료: 15:00:13
+  오류 줄: 0
+
+=== 복구 후 데이터 ===
+  realms|clients|users|sessions|authclients = 2|15|2|3|1
+=== 복구 직후 — 재시작 없이 되는가 ===
+  +15초  well-known=200  토큰발급=200
+  → 재시작 없이 회복
+
+=== 복구 전 세션이 살아났는가 ===
+     user_session_id      |       realm       
+--------------------------+-------------------
+ E1q5xI7tt4U_WhZpW7rEPIF2 | master
+ 2ap3DyRiBF8OdMiqCodsJ0mp | master
+ Zsk4QcgXf_qgyMKzde5AG-Fz | master
+ vsDgCVo12-qX0CC63ZmYzbYF | keycloak-patterns
+(4 rows)
+
+
+=== 파드 재시작 횟수 ===
+  keycloak-0 restarts=0
+  keycloak-1 restarts=0
@@ -0,0 +1,16 @@
+# D-1 — 백업·복구 리허설 증거
+
+2026-09-04 16:55–17:05 KST
+해설: [`docs/experiment-d1-backup-restore.md`](../../experiment-d1-backup-restore.md)
+
+| 파일 | 무엇을 보여주는가 |
+|---|---|
+| `01-backup.txt` | `pg_dump --clean --if-exists` — 395KB · 101 테이블 · **세션 데이터 포함** |
+| `02-destruction.txt` | `DROP SCHEMA public CASCADE` → 테이블 0개. **그런데 외부는 `HTTP 200`** — Keycloak 이 realm 캐시로 서빙한다 |
+| `03-restore.txt` | 깨지는 것과 안 깨지는 것(`certs` 200 / `well-known` 500 / 토큰 400) · **복구 1초 · 오류 0건 · 데이터 완전 일치 · 재시작 0회** |
+
+## 핵심 세 줄
+
+1. **데이터베이스를 통째로 비웠는데 서비스가 200 을 냈다.** 헬스체크는 "DB 가 살아 있다"만 보고 "데이터가 있다"는 안 본다.
+2. **복구는 1초, 오류 0건, 재시작 불필요.** 절차가 맞다는 것은 확인됐다.
+3. **RPO 는 두 겹이다** — 백업 주기 + A-3 에서 측정한 `synchronous_commit OFF` 손실. 그리고 이번 덤프는 호스트의 `/tmp` 에 있어 **같은 장애 도메인**이다.
@@ -0,0 +1,9 @@
+=== D-1 의 교훈: 업그레이드 전에 백업한다 ===
+  백업: 396333 bytes
+
+=== 현재 버전과 스키마 상태 ===
+quay.io/keycloak/keycloak:26.7.0
+  총 마이그레이션 수: 210
+
+=== 로그인 상태 만들기 (업그레이드 후 살아남는지 볼 것) ===
+  현재 세션: 4
@@ -0,0 +1,17 @@
+=== ★ 롤백 시도: 26.7.0 → 26.0 ===
+  시각: 15:02:20
+statefulset.apps/keycloak image updated
+  +20초  keycloak-0:Running(1/1) keycloak-1:Running(0/1) 
+  +40초  keycloak-0:Running(1/1) keycloak-1:Running(0/1) 
+  +60초  keycloak-0:Running(1/1) keycloak-1:Running(0/1) 
+  +80초  keycloak-0:Running(1/1) keycloak-1:Error(0/1) 
+  +100초  keycloak-0:Running(1/1) keycloak-1:Running(0/1) 
+  +120초  keycloak-0:Running(1/1) keycloak-1:Error(0/1) 
+  +140초  keycloak-0:Running(1/1) keycloak-1:CrashLoopBackOff(0/1) 
+  +160초  keycloak-0:Running(1/1) keycloak-1:Running(0/1) 
+
+=== 새 파드가 무엇을 말하는가 ===
+2026-09-04 06:03:25,877 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Failed to start server in (production) mode
+2026-09-04 06:03:25,877 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: liquibase.exception.ValidationFailedException: Validation Failed:
+2026-09-04 06:03:25,877 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Validation Failed:
+2026-09-04 06:03:25,877 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) For more details run the same command passing the '--verbose' option. Also you can use '--help' to see the detai
@@ -0,0 +1,20 @@
+=== 서비스는 살아 있는가 (StatefulSet 롤링이 막아줬다) ===
+  https://auth.hyeonworks.com/realms/master  HTTP 200
+Warning: v1 Endpoints is deprecated in v1.33+; use discovery.k8s.io/v1 EndpointSlice
+  ready 주소: [10.42.1.140]sed: -e expression #1, char 27: unknown option to 's'
+
+=== Liquibase 오류 상세 ===
+2026-09-04 06:03:25,877 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: liquibase.exception.ValidationFailedException: Validation Failed:
+     1 changesets check sum
+2026-09-04 06:03:25,877 ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: Validation Failed:
+     1 changesets check sum
+
+=== ★ 앞으로 되돌린다 (26.7.0) ===
+statefulset.apps/keycloak image updated
+partitioned roll out complete: 2 new pods have been updated...
+keycloak-0                     1/1   Running   0     10m
+keycloak-1                     1/1   Running   0     28s
+
+=== 데이터는 무사한가 ===
+  realms|clients|migrations|sessions = 2|15|210|4
+  외부 진입점 HTTP 200
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
DongHyeonkaandClaude Opus 5	9dbee18a42	docs(b4): item 3 is no longer unmeasured — link it to the follow-up result B-4 left role propagation open because oauth2-proxy was not deployed yet. B-7 deployed it and the follow-up measured it: the value does not change with request count, only when a new session is created. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 18:10:43 +09:00
DongHyeonkaandClaude Opus 5	905392947d	docs: close the three untested items — all three are now measured D-2 forward upgrade and B-4 role propagation were filled earlier. D-4 forced renewal was the third, and it needed a person at the keyboard because the host asks for a sudo password. It turned out to hold the largest finding of the three: the renewal succeeded and went unserved for 36 minutes 39 seconds, because nothing in the setup reloads nginx — no ExecStartPost, three empty hook directories, no nginx plugin. And the half of the plan's question that was still an expectation is now a measurement: the reload is graceful, 8856 connections with zero failures and an in-flight request surviving intact. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 18:10:04 +09:00
DongHyeonkaandClaude Opus 5	faf55dc1be	docs(d4): the renewal succeeded and was not served for 36 minutes 39 seconds The forced renewal did work. What did not work was anything making nginx notice. disk cert2.pem written 2026-09-04 17:22:13 KST network old serial through 08:58:47 UTC, new serial from 08:58:52 UTC gap 2199 seconds, and the old certificate was observed 428 times in it The gap closed only because a person ran `nginx -s reload`. Nothing else would have: certbot-renew.service is just `ExecStart=/usr/bin/certbot -q renew` with no ExecStartPost, all three of renewal-hooks/{deploy,post,pre} are empty, and certbot 5.7.0 here has no nginx plugin (dns-cloudflare, manual, null, standalone, webroot). Three paths, all empty. Any one of them would have been enough. nginx holds the certificate in memory from startup, and certbot swaps the live/ symlink rather than the path — so the config still looks right while the served certificate is stale. Master 585 and worker 586 sharing a start time 22.4 hours old is what proved no reload had happened. This is invisible for 88 days. The timer ran twice today and exited 0/SUCCESS both times, because a renewal is not due yet. The day it becomes due, the symptom is an expired certificate and the log still says SUCCESS. The other half of the plan's question now has a measurement rather than an expectation. The reload is genuinely graceful: 8856 polled connections, zero non-200, p95 205.7ms before against 204.3ms after. And an in-flight request — 845KB pulled at 20k/s, so still transferring 12 seconds in when the reload landed — completed with all 845361 bytes over a single connection. The earlier note that nginx reload "is graceful by design but must not be written that way without checking" was right to hold back. The neighbouring belief, that renewing gets the new certificate served, was the one that was false, and there was no way to tell in advance which it would be. Adds diagrams/d4-renewal-gap.svg and evidence 09-13. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 18:04:44 +09:00
DongHyeonkaandClaude Opus 5	0d84921a56	docs(d4): the renewal unit has no reload, and nginx has not reloaded in 22 hours The forced renewal did not change the certificate being served — 161 serial samples over 13 minutes, all identical, notBefore still Sep 3. Two things were readable without sudo and both matter. nginx has never been reloaded: master 585 and worker 586 share a start time and both are 80529 seconds old. A reload keeps the master and replaces the workers, so the original fork still being there means no reload has happened since Sep 3 19:00. nginx reads the certificate at startup and holds it in memory; without a reload it serves the old one no matter what is on disk. And the unit that is supposed to renew has nothing that would reload it: [Service] Type=oneshot ExecStart=/usr/bin/certbot -q renew PrivateTmp=true No ExecStartPost, no --deploy-hook. The timer runs twice a day and exited 0/SUCCESS both times today, which is precisely why this stays invisible — the renewal is not due for 88 days, so nothing has failed yet. What remains undetermined is whether the user's --force-renewal failed, or succeeded and left new files that nginx never picked up. Telling those apart needs /etc/letsencrypt, which is root-only. If it is the latter, that is the most valuable thing this lab has produced: "renewal succeeded" and "the new certificate is being served" are different events. CT logs looked like a way around the permission problem and were not: the served certificate carries two valid SCTs, yet crt.sh returns zero rows for auth.hyeonworks.com. Same shape as A-2's `up` metric — the observing tool sees a subset of the truth. Also recorded: 76 in-flight failures at 08:15:04 are a local artifact, not a server event. The concurrent 0.2s poll was clean across the same second, num_connects was 0, and time_total was 50 microseconds. Not reproducible in 100 retries. The monitor now records curl's exit code so a recurrence is diagnosable. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 17:28:01 +09:00
DongHyeonkaandClaude Opus 5	716e62524a	docs(d4): measure the controls before the injection that needs a password The forced renewal needs sudo on the host, and the host asks for a password. That blocks the injection, not the experiment — the part worth doing first was the control anyway. Control 1 — new connections, 0.2s x 900 over 180s: 900/900 = 200, zero failures. The noise floor is 0, so a single non-200 during the renewal can be attributed to the renewal. Without this the observation would have been uninterpretable, which is the mistake A-6 made calling a -41% control "no effect" and A-8 made claiming zero-downtime from 9 samples. Control 2 — the poll cannot answer the question the plan actually asked. TLS handshakes were 900/900, meaning every request is a fresh connection, so it measures "are new connections accepted", not "what happens to a request already in flight". A separate device: the 845KB admin console bundle pulled at --limit-rate 20k, holding one request open for 42 seconds. Baseline 200 / 845361 bytes / 1 connection. Monitors are running under setsid, and stop three minutes after the certificate serial changes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 17:12:31 +09:00
DongHyeonkaandClaude Opus 5	74c9b3cea7	docs: replace prose placeholders in reproduction steps with executable commands The audit found ~80 placeholders, and the damaging ones were where the measuring apparatus itself was prose rather than a command: a6 "( curl ... ) & 를 20개 띄우고 wait" — the 22.2s headline came from this a3 "<로그인 반복, sid 를 /tmp/sids 에>" — the whole RPO measurement a3 "<sid 목록>" — the control it is compared against a5 "<수신 파드IP>" — the injection a8 writes /tmp/tok, reads /tmp/rt — self-inconsistent, sent an empty token b3 $KC / $RT / $NEW never assigned c2 bare kcadm.sh with no kubectl exec a1 conntrack tuples written by hand, though the direction flips per restart Each is now a shell-expandable form: pod IPs from jsonpath, the admin password from the secret, ids from kcadm --format csv, conntrack tuples derived from "conntrack -L" with awk rather than transcribed. Then the rewritten commands were executed against the live cluster, and one of them failed — the 20-way load generator, written as "kubectl run --rm -i", lost its output stream twice in a row. That is a trap this series already hit once, and the rewrite reintroduced it. A-6 now uses a resident probe pod that collects into a file and is cat-ed once; verified 20/20 lines. Evidence: docs/evidence/followup/05-command-reproducibility.txt Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 17:01:54 +09:00
DongHyeonkaandClaude Opus 5	f3f3a8da46	docs: re-measure B-4 role propagation and record it as evidence The twelve-request result and the post-reauth value were printed in the document but never written to a file; the audit flagged it as a conclusion standing without evidence. Measured again with timestamps into 03-b4-role-propagation.txt, which also surfaced a 107-second clock skew between the browser host and the lab host that the file now records so the two timelines can be compared. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 16:54:05 +09:00
DongHyeonkaandClaude Opus 5	e0d27d47ce	docs: correct the places where documents contradicted their own evidence An independent audit found ten documents printing values their evidence files do not contain. C-1 printed a session count of 0 where the evidence says 4, C-2 printed a success readback for a command that exited 1, and A-1 credited the conntrack flush with a split that the timestamps attribute to a pod restart four seconds earlier. Also measured wal_writer_delay, which A-3 had asserted as matching without ever querying it, relabelled the A-6 control that moved 41 percent, noted A-8's nine-sample resolution, corrected D-1's RTO to the 41 seconds its own timeline shows, and added a correction banner to D-2. Every experiment document now links its evidence files with their real collection times, and the duplicate screenshots are documented as duplicates. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 16:35:49 +09:00
DongHyeonkaandClaude Opus 5	78b270559c	docs: add SVG diagrams, explicit concept sections and the diagram convention Twelve SVG architecture diagrams cover the experiments whose documents had little or no structure drawing, embedded under a 구조 heading with a shared convention file. Seven documents carried their concepts under narrative headings and now have an explicit 개념 section so they can be found. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 16:20:05 +09:00
DongHyeonkaandClaude Opus 5	98a74e90a5	docs: fill the untested items and record why the B layer has no graphs The forward upgrade to 26.7.3 was zero downtime across 87 samples, and since databasechangelog stayed at 210 the rollback to 26.7.0 also succeeded, which narrows D-2's conclusion: rolling back fails when the schema moved, not because of the version number. The row count is the check. Role changes never reach the upstream through request repetition; the session is a snapshot taken at login and only a new session picks up the new claim. Auditing the docs also surfaced that Prometheus scrapes only keycloak, kubelet, node-exporter and itself, so the B-layer experiments have no metrics to screenshot rather than missing screenshots. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 16:18:33 +09:00
DongHyeonkaandClaude Opus 5	b5528fae87	docs: index all 23 experiments with what each measured One table per experiment with its branch and result, plus the nine injections that silently did nothing and the five predictions that turned out wrong. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 15:11:32 +09:00
DongHyeonkaandClaude Opus 5	4864d837f1	docs: D-4 — the certificate is fine and the renewal itself went untested Three SAN entries and no wildcard is the constraint that cost something real in B-7, where oauth2-proxy had to borrow Grafana's app2 hostname because a fourth name was not available. The served chain is four deep and verifies, so fullchain.pem is configured rather than the cert.pem mistake that only breaks clients without a cached intermediate. The forced renewal and the reload behaviour could not be measured because sudo on the host asks for a password, the same silent failure first noticed in B-7. nginx reload is graceful by design, but this lab has repeatedly shown that by design is not the same as measured, so it is recorded as untested rather than assumed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 15:09:36 +09:00
DongHyeonkaandClaude Opus 5	027c24ee27	docs: D-3 — only RBAC actually hides anything Every secret in the lab prints in four commands, while kubectl describe shows just a byte count and creates the impression that something is hidden. k3s reports encryption at rest disabled and the plaintext password is present in state.db, so one node disk carries the whole cluster's secrets, and inside the pod they are ordinary environment variables visible to exec, /proc and crash dumps. The default service account cannot read secrets, which makes RBAC the one control doing real work here and the thing worth tightening. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 15:07:35 +09:00
DongHyeonkaandClaude Opus 5	df140ab218	docs: D-2 — rolling back the image does not roll back the schema Downgrading from 26.7.0 to 26.0 fails with liquibase ValidationFailedException on a changeset checksum, which is stricter than an unknown migration: the old version knows the changeset but its definition differs. The pod goes CrashLoopBackOff and never starts. The StatefulSet stopped the rollout at the first pod, so the other kept serving and the front door stayed at 200, which replica 1 would not have done. The failed start never touched the schema, so restoring the image was enough; had the migration already applied, the D-1 database restore would have been the only way back. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 15:05:36 +09:00
DongHyeonkaandClaude Opus 5	df5af95cb3	docs: D-1 — an empty database still answered 200 Dropping the schema left Keycloak serving realm metadata and JWKS from its Infinispan cache, so the front door stayed at 200 while only the paths that read the database failed. That is a different shape from A-2, where the connection itself broke and readiness pulled the pods out of the Service; here the connection is fine and the tables are simply gone, which the health check does not notice. Restoring the pg_dump took one second with zero errors and no pod restart, and the row counts matched the backup exactly, sessions included. The real RPO is the backup interval plus the synchronous_commit loss measured in A-3, and this dump sits in the host's /tmp, which is the same failure domain as the thing it protects. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 14:59:56 +09:00
DongHyeonkaandClaude Opus 5	6c310c93b7	docs: C-2 — nothing propagates because nobody implemented the receiving end Neither client had a backchannel logout URL and the BFF has no oidcLogout configuration, so the three candidate paths all answer 302, which is the authentication redirect rather than a handler. Setting the URL on the identity provider alone changed nothing: with a live session, logging the user out emptied the Keycloak side and left the Redis session untouched. Reachability is not the blocker here, since a Keycloak pod fetches the app's public URL with a 200, but that is a property of this tailnet split-DNS lab and is the assumption most likely to fail in production, where it fails silently. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 14:56:58 +09:00
DongHyeonkaandClaude Opus 5	e856e7af4d	docs: C-1 — killing the SSO session logs nobody out One user session carries a client session per application, so visiting the second app skips the login screen. Deleting the identity provider session leaves both application sessions untouched and both apps keep serving, because the identity provider, the application session and the access token each have their own lifetime. That inverts the B-2 finding: there the app session was cleared and the surviving SSO session let the user straight back in. Either way, clearing one side leaves the other. It also means an identity provider outage is a single point of failure for logging in, not for already-authenticated users, and the failure arrives late and all at once. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 14:49:36 +09:00
DongHyeonkaandClaude Opus 5	bcb563a04e	docs: B-7 — the cookie secret has no overlap window and rotation orphans sessions oauth2-proxy carries the authorization request in a signed cookie, so the callback can land on a different replica and still succeed, which is the opposite of the BFF failure in B-0. Sharing is therefore just sharing one Secret. Rotating it is all-or-nothing: --cookie-secret is singular, so there is no second key to read old tickets with, and the log shows both the validation failure and Error removing session, leaving the Redis session orphaned because the key cannot be derived from a ticket that will not decode. Getting there required two diagnoses: the callback 502 came from the full session riding in Set-Cookie past nginx's buffer, and every earlier attempt to read nginx config returned nothing because sudo on the host asks for a password while the guests do not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 14:44:00 +09:00
DongHyeonkaandClaude Opus 5	aa2c3907f5	docs: B-6 — rotation is safe, retiring the old key is not Adding a higher-priority RSA provider leaves both kids in JWKS, so tokens signed before and after the rotation both validate. Deleting the old provider makes its tokens 401 immediately, and the resource server's JWKS cache does not buy a grace period because an unknown kid triggers a refetch. The encryption key Q3 asks about does not exist yet, since B-2 showed the tokens are stored as plaintext JWTs, so the measured signing-key rotation is what its design has to copy: write with one key, read with several, and keep the overlap longer than the lifetime of anything signed with the old one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 14:33:42 +09:00
DongHyeonkaandClaude Opus 5	f45a2a2aaa	docs: B-5 — the pod stays Ready while every request hangs Stopping Redis returns HTTP 000 rather than an error because the client waits on reconnect, and the pod keeps serving traffic because the redis health indicator is not in the readiness group even though /actuator/health returns 503. That is the mirror image of A-2, where Keycloak put its database check in readiness and the pods left the Service. Turning on AOF with config set created the appendonlydir and still lost everything on pod deletion, because /data was the container filesystem; adding a PVC makes the same setting work. Volume first, persistence setting second. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 14:29:17 +09:00
DongHyeonkaandClaude Opus 5	7dc0a3e5da	docs: B-4 — the edge does not overwrite the headers it never sets Two headers of the same name both arrive rather than one overwriting the other, because nginx only replaces headers it sets with proxy_set_header. A comma inside a role name is indistinguishable from the delimiter, and the size limit is a cliff: Tomcat returns 400 around 8KB and the connection dies around 16KB, so the same cause produces two different-looking failures. Forged identity headers reach the upstream untouched while the JWT-protected paths return 401, which is Q4's own point that a header-fed upstream has nothing to verify against. By Q4's checklist that answer alone points at the BFF structure. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-04 14:23:41 +09:00
				`@@ -0,0 +1 @@`
				`[ 307ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0`
				`@@ -0,0 +1 @@`
				`[ 261ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0`
				`@@ -0,0 +1 @@`
				`[ 882ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0`
				`@@ -0,0 +1 @@`
				`[ 178ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0`
				`@@ -0,0 +1 @@`
				`[ 210ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0`
				`@@ -0,0 +1 @@`
				`[ 423ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0`
				`@@ -0,0 +1 @@`
				`[ 12202ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0`
				`@@ -0,0 +1 @@`
				`[ 451ms] [ERROR] Failed to load resource: the server responded with a status of 401 () @ https://app2.hyeonworks.com/favicon.ico:0`
				`@@ -0,0 +1 @@`
				- generic [active] [ref=f43e1]: "{ \"headers\" : { \"host\" : [ \"app2.hyeonworks.com\" ], \"user-agent\" : [ \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36\" ], \"accept\" : [ \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7\" ], \"accept-encoding\" : [ \"gzip, deflate, br, zstd\" ], \"accept-language\" : [ \"en-US,en;q=0.9\" ], \"cookie\" : [ \"grafana_session=60c3e7ae41ffc00665f4a2c377def399; grafana_session_expiry=1788497124; _oauth2_proxy=djIuWDI5aGRYUm9NbDl3Y205NGVTMWlNall4TVRGbVltUXhabVJoWWpOaFpUSXhPREpsTWpnM01EQXhZakF5WVEuTk81VE82RHRod2NWZWstaHpPZVg1Zw==\|1788500470\|iPSRUlwHDB0XgC6sUdU4dq1EHq9WQDPYrDoezajKVUA=\" ], \"priority\" : [ \"u=0, i\" ], \"sec-ch-ua\" : [ \"\\\"Chromium\\\";v=\\\"152\\\", \\\"Not?A_Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"152\\\"\" ], \"sec-ch-ua-mobile\" : [ \"?0\" ], \"sec-ch-ua-platform\" : [ \"\\\"Linux\\\"\" ], \"sec-fetch-dest\" : [ \"document\" ], \"sec-fetch-mode\" : [ \"navigate\" ], \"sec-fetch-site\" : [ \"none\" ], \"sec-fetch-user\" : [ \"?1\" ], \"upgrade-insecure-requests\" : [ \"1\" ], \"x-forwarded-email\" : [ \"labuser@example.com\" ], \"x-forwarded-host\" : [ \"app2.hyeonworks.com\" ], \"x-forwarded-port\" : [ \"443\" ], \"x-forwarded-preferred-username\" : [ \"labuser\" ], \"x-forwarded-proto\" : [ \"https\" ], \"x-forwarded-server\" : [ \"traefik-5d6fcf895-wpfhr\" ], \"x-forwarded-user\" : [ \"27df5ea9-8703-4ec5-badd-d972c583e1ff\" ], \"x-real-ip\" : [ \"100.123.124.30\" ] }, \"remoteAddr\" : \"100.123.124.30\", \"localAddr\" : \"10.42.0.53\", \"scheme\" : \"https\", \"secure\" : true, \"serverName\" : \"app2.hyeonworks.com\", \"serverPort\" : 443, \"requestUrl\" : \"https://app2.hyeonworks.com/api/echo\" }"