chore: initialize from backend template 0a6dd0e

2026-08-13 20:31:02 +09:00
commit e64e701fe5
3223 changed files with 388401 additions and 0 deletions
@@ -0,0 +1,104 @@
+# Object Storage Batch D Checkpoint
+
+- Date: 2026-07-28
+- Branch: `codex/objectstorage-production-capability`
+- Worktree:
+  `/home/donghyeon/workspace/clean-architecture-backend-template-objectstorage`
+- Scope: direct-transfer provider/application primitives only
+- Public endpoint: none
+- Readiness advanced: no; all direct cards remain R0
+
+## Implemented scope
+
+- Added direct single-upload session policy, durable prepared/issued transitions, bearer
+  redaction, exact completion verification, published-version download resolution, and an
+  S3-presigner lifecycle owned by the selected provider.
+- Added direct multipart durable session and part-grant families, opaque acknowledgement tokens,
+  sharded part records, admission-close/expiry fencing, exact ledger validation, completion/abort
+  states, response-loss resolution, and persisted terminal exact-version replay.
+- Added direct S3 initiate/discovery, exact-part presign, `ListParts` acknowledgement, conditional
+  complete followed by exact HEAD verification, and abort resolution.
+- Registered direct single and multipart delegates only when their exact compiled capability is
+  selected. One presigner is constructed and closed exactly once.
+- Added golden canonical envelopes for the direct session, direct multipart session, and direct
+  multipart grant families.
+- Fixed `MultipartCompleteRequest` null validation so valid immutable `List.of(...)` input no longer
+  throws from `contains(null)`.
+
+## Qualification truth
+
+The exact MinIO release cannot prove create-only PUT or create-only multipart completion, so both
+direct profiles are explicitly `UNSUPPORTED`. The direct MinIO contract/fault lanes are negative
+admission tests: they prove no bearer or multipart mutation enters an unsupported profile. No test
+skip is used as positive evidence.
+
+The AWS managed/direct source sets compile, but no AWS call was made and no AWS evidence row was
+published. No inbound controller, authorization surface, CORS runtime configuration, or public
+direct API exists.
+
+## Verification
+
+Commands completed with `BUILD SUCCESSFUL`:
+
+```bash
+cd src
+./gradlew :adapter:outbound:objectstorage:test \
+  --tests '*DirectTransferCoordinatorTest' \
+  --tests '*PresignedGrantRedactionTest' \
+  --tests '*S3DirectTransferProviderTest' \
+  --tests '*ObjectControlRecordCodecTest' \
+  --tests '*S3ProviderCompositionTest' --console=plain
+./gradlew :adapter:outbound:objectstorage:test \
+  --tests '*DirectMultipartCoordinatorTest' \
+  --tests '*DirectMultipartRaceTest' \
+  --tests '*S3DirectMultipartProviderTest' \
+  --tests '*ObjectControlRecordCodecTest' \
+  --tests '*S3ProviderCompositionTest' --console=plain
+./gradlew \
+  :adapter:outbound:objectstorage:objectStorageMinioContractTest \
+  :adapter:outbound:objectstorage:objectStorageMinioFaultTest \
+  --tests '*DirectTransfer*' --console=plain
+./gradlew :adapter:outbound:objectstorage:test \
+  --tests '*DirectTransferCorsContractTest' --console=plain
+./gradlew :adapter:outbound:objectstorage:objectStorageAwsQualificationTestClasses --console=plain
+./gradlew :adapter:outbound:objectstorage:check --console=plain
+./gradlew :adapter:outbound:objectstorage:verifyDependencyLocks \
+  verifyCleanArchitectureDependencies --console=plain
+./gradlew \
+  :adapter:outbound:objectstorage:objectStorageMinioContractTest \
+  :adapter:outbound:objectstorage:objectStorageMinioFaultTest --console=plain
+bash ../.github/scripts/verify-gate-matrix.sh
+./gradlew test --console=plain
+./gradlew check --console=plain
+```
+
+The module `check` includes unit tests, Checkstyle, Spotless, SpotBugs, architecture, configuration
+processor, environment-key, and repository-wide policy checks. Existing test-only compiler
+warnings remain non-failing. The final repository-wide test run completed 79 tasks and the final
+repository-wide check completed 214 tasks.
+
+## Deliberate limitations
+
+- Issued bearer material is process-local. A restart fails closed instead of reconstructing or
+  reissuing an already-issued bearer.
+- The signing clock/window is stored and bounded, but AWS SDK presigner query timing is not driven
+  by the injected application clock.
+- The direct multipart recovery/race matrix covers its principal fences and completion response
+  loss but is not exhaustive enough for an R2 claim.
+- Retention/Object Lock grant headers and a provider-enforced direct-single hard size ceiling are
+  not qualified.
+- No public endpoint exists, so CORS evidence is a pure contract and no direct card may exceed R0
+  in the current registry.
+
+## Approval Gate A
+
+Tasks 20–24 remain blocked until the user explicitly approves scanner ownership, the sample's
+first publication profile, the additive asynchronous API/status contract, and digest transport.
+No scan/publication/sample endpoint implementation was started.
+
+## LLM Wiki capture
+
+The canonical vault `/home/donghyeon/workspace/ai-tool/llm-wiki-private/` and its parent
+`/home/donghyeon/workspace/ai-tool/` do not exist in this environment. The required
+`raw/branch-notes/codex-objectstorage-production-capability.md` and derived raw documents could not
+be created or updated. No similarly named non-canonical clone was used.