tech-log-backend/docs/registries/env-keys.yaml

# Registry: Env Keys
# SSOT: wiki/projects/ca-tmpl/registries/env-keys.yaml
# Schema owner: feature-contract-registry-governance
# Owner branch: feature-env-driven-runtime-configuration
# Last updated: 2026-06-06
#
# Conventions:
# - Application-owned env uses `APP_` prefix, fully unified (D2, 2026-06-05):
#   datasource/server/etc. keys that map onto Spring properties are renamed APP_*
#   as well (e.g. SERVER_PORT -> APP_SERVER_PORT).
# - Only env the Spring runtime reads natively stays native: SPRING_* and
#   SPRING_PROFILES_ACTIVE (D6 — profile selector is Spring-native, not APP_).
# - `classification: secret` rows only reference secrets-classification.yaml; full row owned there.
# - reload_policy default = `restart-only` (env-driven branch "config reload: no runtime reload").
# - boolean encoding = true/false only (env-driven branch 2026-05-22).
# - Duration encoding = Spring shorthand (`30s`); ISO-8601 (`PT30S`) forbidden (env-driven branch 2026-05-22).
# - DataSize encoding = `10MB` (env-driven branch 2026-05-22).

env_keys:
  # === Profile / Identity (feature-env-driven-runtime-configuration) ===

  - name: SPRING_PROFILES_ACTIVE
    # source: feature-env-driven-runtime-configuration D6 (2026-06-06)
    # Profile selector is Spring-native and sole (APP_PROFILE was dropped). Unset
    # -> local fallback in application.yml for early Boot profile binding.
    type: csv_list
    default: local
    allowed_values: [local, dev, staging, prod, sample]
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: env-contract:profile-active

  # APP_PROFILE intentionally removed (D6, 2026-06-06): profile = SPRING_PROFILES_ACTIVE
  # alone. A duplicate APP_PROFILE would only add information doubling + mismatch-fail
  # cost. See branch note feature-env-driven-runtime-configuration Claims (wont-fix).

  - name: APP_NAME
    # source: feature-env-driven-runtime-configuration 2026-05-22
    # "Required config: APP_NAME, APP_PROFILE..."
    type: string
    default: null
    allowed_values: null
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: non_empty_string
    compatibility_impact: behavior-change
    required_test: env-contract:app-name-present

  # === HTTP server (APP_ unified per D2) ===

  - name: APP_SERVER_PORT
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — full APP_
    #         unification; server.port maps from APP_SERVER_PORT.
    #         + feature-management-actuator-security-contract 2026-05-22 "management port default = 9001 (separate from app 8080)"
    type: int
    default: 8080
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: port_range_1_65535
    compatibility_impact: behavior-change
    required_test: env-contract:server-port-bound

  - name: MANAGEMENT_SERVER_PORT
    # source: feature-management-actuator-security-contract 2026-05-22
    # "management port default = 9001 (separate from app 8080). single-port는 platform ingress 보호 + 문서화 시만 허용."
    type: int
    default: 9001
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-management-actuator-security-contract
    validation: port_range_1_65535
    compatibility_impact: behavior-change
    required_test: actuator-contract:management-port-separated

  - name: APP_SERVER_SHUTDOWN
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (server.shutdown mode; graceful drains in-flight requests)
    type: enum
    default: graceful
    allowed_values: [graceful, immediate]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: env-contract:server-shutdown-mode

  - name: APP_SERVER_SHUTDOWN_TIMEOUT
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification.
    #         Supersedes the old APP_SHUTDOWN_TIMEOUT row. Must stay <= k8s
    #         terminationGracePeriod (cross-ref feature-container-runtime-contract).
    type: duration
    default: 30s
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: spring_duration_shorthand_le_termination_grace
    compatibility_impact: behavior-change
    required_test: env-contract:server-shutdown-timeout-aligned

  - name: APP_SERVER_FORWARD_HEADERS_STRATEGY
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (trust X-Forwarded-* when behind LB/proxy)
    type: enum
    default: framework
    allowed_values: [none, native, framework]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: env-contract:server-forward-headers-strategy

  - name: APP_SERVER_TOMCAT_MAX_THREADS
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (ceiling on concurrent request workers)
    type: int
    default: 200
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: env-contract:tomcat-max-threads-bounded

  - name: APP_SERVER_TOMCAT_MIN_SPARE_THREADS
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (idle worker pool floor)
    type: int
    default: 10
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: non_negative_int
    compatibility_impact: behavior-change
    required_test: env-contract:tomcat-min-spare-threads-valid

  - name: APP_SERVER_TOMCAT_ACCEPT_COUNT
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (OS-level backlog queue depth for incoming TCP connections)
    type: int
    default: 100
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: non_negative_int
    compatibility_impact: behavior-change
    required_test: env-contract:tomcat-accept-count-valid

  - name: APP_SERVER_TOMCAT_MAX_CONNECTIONS
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (hard cap on simultaneously open connections)
    type: int
    default: 8192
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: env-contract:tomcat-max-connections-bounded

  - name: APP_SERVER_TOMCAT_CONNECTION_TIMEOUT
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (connection timeout for the Tomcat connector)
    type: duration
    default: 20s
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: spring_duration_shorthand
    compatibility_impact: behavior-change
    required_test: env-contract:tomcat-connection-timeout-set

  - name: APP_SERVER_COMPRESSION_ENABLED
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (server.compression toggle)
    type: boolean
    default: true
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: env-contract:server-compression-toggle

  - name: APP_SERVER_COMPRESSION_MIN_RESPONSE_SIZE
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (payloads below this threshold are not compressed)
    type: data_size
    default: 1KB
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: spring_data_size
    compatibility_impact: behavior-change
    required_test: env-contract:server-compression-min-size

  - name: APP_SERVER_ERROR_INCLUDE_STACKTRACE
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (spring.web.error.include-stacktrace policy)
    type: enum
    default: never
    allowed_values: [always, never, on_param]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: env-contract:server-error-stacktrace-policy

  - name: APP_SERVER_ERROR_INCLUDE_MESSAGE
    # source: feature-env-driven-runtime-configuration D2 (2026-06-05) — APP_ unification
    #         (spring.web.error.include-message policy)
    type: enum
    default: never
    allowed_values: [always, never, on_param]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: env-contract:server-error-message-policy

  # === Error exposure / body logging (env-driven branch "Required config: error exposure, log") ===

  - name: APP_ERROR_DETAIL_EXPOSURE_ENABLED
    # source: feature-env-driven-runtime-configuration 2026-05-22
    # "prod profile에서 body logging과 internal error detail exposure는 기본 금지"
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: prod_profile_must_be_false
    compatibility_impact: behavior-change
    required_test: env-contract:error-exposure-prod-safe

  - name: APP_LOG_BODY_CAPTURE_ENABLED
    # source: feature-env-driven-runtime-configuration 2026-05-22 "prod profile에서 body logging ... 기본 금지"
    #         + feature-log-management-contract "request body capture filter — allowlist 없이는 capture 자체 금지"
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: prod_profile_must_be_false
    compatibility_impact: behavior-change
    required_test: env-contract:body-logging-prod-safe

  - name: APP_MULTI_INSTANCE_ENABLED
    # source: feature-env-driven-runtime-configuration D8 (2026-06-06)
    # When true, StartupSafetyValidator (SmartInitializingSingleton) requires the 5
    # instance-coordination beans (distributed lock / cache-stampede / outbox leader
    # / rate-limiter / migration runner) to be present, else startup fails. Consumed
    # by feature-runtime-health-lifecycle-contract, feature-background-job-async-contract,
    # feature-cache-consistency-contract, feature-domain-event-outbox-contract,
    # feature-rate-limit-idempotency-contract, feature-migration-startup-contract.
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: requires_coordination_beans_when_true
    compatibility_impact: behavior-change
    required_test: env-contract:multi-instance-beans-present

  - name: APP_MIGRATION_ON_STARTUP
    # source: feature-migration-startup-contract
    # When true, Flyway migrations are executed automatically during application startup.
    # When false, migrations are bypassed (delegated to out-of-app container/pipeline jobs).
    type: boolean
    default: true
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-migration-startup-contract
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: env-contract:migration-on-startup-toggle

  # === Datasource / pool (env-driven branch "Required config: datasource") ===

  - name: APP_DATASOURCE_URL
    # source: feature-env-driven-runtime-configuration "Required config: datasource"
    #         + feature-persistence-failure-baseline "datasource/pool/timeout/connection exhaustion log field"
    type: url
    default: null
    allowed_values: null
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: jdbc_url_pattern
    compatibility_impact: behavior-change
    required_test: env-contract:datasource-url-resolvable

  - name: APP_DATASOURCE_USERNAME
    # source: feature-env-driven-runtime-configuration "Required config: datasource"
    type: string
    default: null
    allowed_values: null
    classification: sensitive-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: non_empty_string
    compatibility_impact: behavior-change
    required_test: env-contract:datasource-credential-present

  - name: APP_DATASOURCE_PASSWORD
    # source: feature-env-driven-runtime-configuration "Required config: datasource"
    #         + feature-secrets-config-source-contract — secret 분류로 secrets-classification.yaml에서 owns
    type: string
    default: null
    allowed_values: null
    classification: secret
    required: true
    reload_policy: restart-only
    owner_branch: feature-secrets-config-source-contract
    validation: must_not_be_local_dev_sentinel_in_prod
    compatibility_impact: breaking
    required_test: secrets-contract:db-password-not-leaked

  - name: APP_DATASOURCE_POOL_MAX_SIZE
    # source: feature-env-driven-runtime-configuration "datasource/pool env"
    #         + feature-persistence-failure-baseline "Hikari metric 노출 기준"
    type: int
    default: 10
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: env-contract:pool-bounded

  - name: APP_DATASOURCE_POOL_MIN_IDLE
    # source: feature-env-driven-runtime-configuration "datasource/pool env"
    type: int
    default: 2
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: non_negative_int
    compatibility_impact: behavior-change
    required_test: env-contract:pool-min-idle-valid

  - name: APP_DATASOURCE_CONNECTION_TIMEOUT
    # source: feature-env-driven-runtime-configuration "datasource/pool env"
    #         + feature-persistence-failure-baseline "Hikari Alert Threshold: pool wait p99 > 100ms"
    type: duration
    default: 5s
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: spring_duration_shorthand
    compatibility_impact: behavior-change
    required_test: env-contract:connection-timeout-set

  - name: APP_DATASOURCE_DRIVER
    # source: feature-env-driven-runtime-configuration "Required config: datasource"
    #         (JDBC driver class for the configured datasource URL)
    type: string
    default: org.postgresql.Driver
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: non_empty_string
    compatibility_impact: behavior-change
    required_test: env-contract:datasource-driver-set

  - name: APP_DATASOURCE_DDL_AUTO
    # source: feature-env-driven-runtime-configuration "Required config: datasource"
    #         (Hibernate ddl-auto; prod must be validate|none, local update convenient)
    type: enum
    default: validate
    allowed_values: [none, validate, update, create, create-drop]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: env-contract:datasource-ddl-auto-safe

  - name: APP_DATASOURCE_SHOW_SQL
    # source: feature-env-driven-runtime-configuration "Required config: datasource"
    #         (echo SQL to logs)
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: env-contract:datasource-show-sql-toggle

  - name: APP_DATASOURCE_FORMAT_SQL
    # source: feature-env-driven-runtime-configuration "Required config: datasource"
    #         (pretty-print SQL — only useful when SHOW_SQL=true)
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: env-contract:datasource-format-sql-toggle

  - name: APP_DATASOURCE_OPEN_IN_VIEW
    # source: feature-env-driven-runtime-configuration "Required config: datasource"
    #         (Hibernate OSIV — don't enable in prod)
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: env-contract:datasource-open-in-view-toggle

  - name: APP_DATASOURCE_POOL_IDLE_TIMEOUT
    # source: feature-env-driven-runtime-configuration "datasource/pool env"
    #         (Hikari milliseconds; idle connection eviction threshold)
    type: int
    default: 600000
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: non_negative_int
    compatibility_impact: behavior-change
    required_test: env-contract:pool-idle-timeout-valid

  - name: APP_DATASOURCE_POOL_MAX_LIFETIME
    # source: feature-env-driven-runtime-configuration "datasource/pool env"
    #         (Hikari milliseconds; max lifetime — rotate before broker timeout)
    type: int
    default: 1800000
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-env-driven-runtime-configuration
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: env-contract:pool-max-lifetime-valid

  # === Outbound HTTP timeout / retry / circuit breaker (env-driven branch + outbound-http-client-baseline) ===

  - name: APP_OUTBOUND_HTTP_CONNECT_TIMEOUT
    # source: feature-outbound-http-client-baseline 2026-05-22
    # "outbound HTTP timeout default = connect 2s / read 5s / global call 10s"
    type: duration
    default: 2s
    allowed_values: null
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: spring_duration_shorthand_non_zero
    compatibility_impact: behavior-change
    required_test: outbound-contract:connect-timeout-bounded

  - name: APP_OUTBOUND_HTTP_READ_TIMEOUT
    # source: feature-outbound-http-client-baseline 2026-05-22 "read 5s"
    type: duration
    default: 5s
    allowed_values: null
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: spring_duration_shorthand_non_zero
    compatibility_impact: behavior-change
    required_test: outbound-contract:read-timeout-bounded

  - name: APP_OUTBOUND_HTTP_GLOBAL_CALL_TIMEOUT
    # source: feature-outbound-http-client-baseline 2026-05-22 "global call 10s"
    type: duration
    default: 10s
    allowed_values: null
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: spring_duration_shorthand_non_zero
    compatibility_impact: behavior-change
    required_test: outbound-contract:global-call-timeout-bounded

  - name: APP_OUTBOUND_HTTP_RETRY_ENABLED
    # source: feature-outbound-http-client-baseline 2026-05-22
    # "retry 기본값은 disabled이며, 활성화 시 retryable registry error와 low-cardinality retry metric이 필수"
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: outbound-contract:retry-metric-when-enabled

  - name: APP_OUTBOUND_HTTP_RETRY_MAX_ATTEMPTS
    # source: feature-outbound-http-resilience-config 2026-06-12
    # "retry maxAttempts 외부화 — 기본값 3 (기존 하드코딩 보존)"
    type: int
    default: 3
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: outbound-contract:retry-max-attempts-configurable

  - name: APP_OUTBOUND_HTTP_RETRY_INITIAL_BACKOFF
    # source: feature-outbound-http-resilience-config 2026-06-12
    # "exponential backoff 시작 간격 100ms (기존 하드코딩 보존)"
    type: duration
    default: 100ms
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: spring_duration_shorthand_non_zero
    compatibility_impact: behavior-change
    required_test: outbound-contract:retry-initial-backoff-configurable

  - name: APP_OUTBOUND_HTTP_RETRY_BACKOFF_MULTIPLIER
    # source: feature-outbound-http-resilience-config 2026-06-12
    # "exponential backoff multiplier 2.0 (기존 하드코딩 보존)"
    type: double
    default: 2.0
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: double_ge_1
    compatibility_impact: behavior-change
    required_test: outbound-contract:retry-backoff-multiplier-configurable

  - name: APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_ENABLED
    # source: feature-outbound-http-client-baseline 2026-05-22
    # "circuit breaker | Resilience4j optional env | disabled local"
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: outbound-contract:cb-metric-when-enabled

  - name: APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_FAILURE_RATE_THRESHOLD
    # source: feature-outbound-http-resilience-config 2026-06-12
    # "failure rate threshold 50% (Resilience4j ofDefaults 보존)"
    type: float
    default: 50
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: float_in_0_exclusive_to_100
    compatibility_impact: behavior-change
    required_test: outbound-contract:cb-failure-rate-configurable

  - name: APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_SLIDING_WINDOW_SIZE
    # source: feature-outbound-http-resilience-config 2026-06-12
    # "sliding window size 100 (COUNT_BASED, Resilience4j ofDefaults 보존)"
    type: int
    default: 100
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: outbound-contract:cb-sliding-window-configurable

  - name: APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_MINIMUM_NUMBER_OF_CALLS
    # source: feature-outbound-http-resilience-config 2026-06-12
    # "minimum number of calls 100 (Resilience4j ofDefaults 보존)"
    type: int
    default: 100
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: outbound-contract:cb-minimum-calls-configurable

  - name: APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_WAIT_DURATION_IN_OPEN_STATE
    # source: feature-outbound-http-resilience-config 2026-06-12
    # "wait duration in open state 60s (Resilience4j ofDefaults 보존)"
    type: duration
    default: 60s
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: spring_duration_shorthand_non_zero
    compatibility_impact: behavior-change
    required_test: outbound-contract:cb-wait-duration-configurable

  - name: APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_PERMITTED_CALLS_IN_HALF_OPEN
    # source: feature-outbound-http-resilience-config 2026-06-12
    # "permitted calls in half-open 10 (Resilience4j ofDefaults 보존)"
    type: int
    default: 10
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: outbound-contract:cb-permitted-half-open-configurable

  - name: APP_OUTBOUND_HTTP_RESPONSE_SIZE_LIMIT
    # source: feature-outbound-http-client-baseline 2026-05-22
    # "response size limit default = 10MB streaming threshold"
    type: data_size
    default: 10MB
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-outbound-http-client-baseline
    validation: spring_data_size
    compatibility_impact: behavior-change
    required_test: outbound-contract:response-size-streaming

  # === Tracing / Observability (feature-distributed-tracing-contract) ===

  - name: OTEL_EXPORTER_OTLP_ENDPOINT
    # source: feature-distributed-tracing-contract 2026-05-22
    # "Micrometer Tracing + OpenTelemetry exporter를 기본 기준으로 둠"
    type: url
    default: null
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-distributed-tracing-contract
    validation: url_or_empty
    compatibility_impact: additive
    required_test: tracing-contract:exporter-endpoint-resolvable

  - name: APP_TRACING_ENABLED
    # source: feature-distributed-tracing-contract 2026-05-22
    # "tracing disabled profile에서도 envelope meta.traceId와 log traceId는 유지"
    type: boolean
    default: true
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-distributed-tracing-contract
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: tracing-contract:meta-traceid-when-disabled

  - name: APP_TRACING_SAMPLE_RATE
    # source: feature-distributed-tracing-contract 2026-05-22
    # "trace sampling rate default = prod 1%, staging 10%, dev/local 100%"
    # D-1 ISSUE-1 fix (2026-06-16): blank = per-profile resolver 기본값 사용.
    # TracingSampleRateResolver SSOT (prod=0.01/staging=0.10/dev·local=1.0).
    # TracingSamplingEnvironmentPostProcessor bridges resolved rate to
    # management.tracing.sampling.probability.
    type: string
    default: ""
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-distributed-tracing-contract
    validation: float_between_0_and_1_or_blank
    compatibility_impact: behavior-change
    required_test: tracing-contract:sample-rate-per-profile

  # === Log management (feature-log-management-contract) ===

  # APP_LOG_LEVEL (single key) replaced by the 5 granular APP_LOG_LEVEL_* rows below
  # (root / app / spring / web / sql) — as built by feature-log-management-contract.

  - name: APP_LOG_LEVEL_ROOT
    # source: feature-log-management-contract — root logger level
    type: enum
    default: INFO
    allowed_values: [TRACE, DEBUG, INFO, WARN, ERROR, OFF]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: log-contract:root-level

  - name: APP_LOG_LEVEL_APP
    # source: feature-log-management-contract — application package level
    type: enum
    default: INFO
    allowed_values: [TRACE, DEBUG, INFO, WARN, ERROR, OFF]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: log-contract:app-level

  - name: APP_LOG_LEVEL_SPRING
    # source: feature-log-management-contract — Spring framework package level
    type: enum
    default: INFO
    allowed_values: [TRACE, DEBUG, INFO, WARN, ERROR, OFF]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: log-contract:spring-level

  - name: APP_LOG_LEVEL_WEB
    # source: feature-log-management-contract — web/MVC package level
    type: enum
    default: INFO
    allowed_values: [TRACE, DEBUG, INFO, WARN, ERROR, OFF]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: log-contract:web-level

  - name: APP_LOG_LEVEL_SQL
    # source: feature-log-management-contract — JPA/JDBC SQL package level (DEBUG prints SQL)
    type: enum
    default: WARN
    allowed_values: [TRACE, DEBUG, INFO, WARN, ERROR, OFF]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: log-contract:sql-level

  - name: APP_LOG_FILE_ENABLED
    # source: feature-log-management-contract — rolling JSON file appender toggle
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: log-contract:file-appender-toggle

  - name: APP_LOG_FILE_PATH
    # source: feature-log-management-contract — file path (relative to bootRun cwd or absolute)
    type: string
    default: logs/ca-skeleton.json
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: non_empty_string
    compatibility_impact: behavior-change
    required_test: log-contract:file-path-set

  - name: APP_LOG_FILE_MAX_SIZE
    # source: feature-log-management-contract — per-file rolling size cap
    type: data_size
    default: 100MB
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: spring_data_size
    compatibility_impact: behavior-change
    required_test: log-contract:file-max-size

  - name: APP_LOG_FILE_MAX_HISTORY
    # source: feature-log-management-contract — number of rolled archives to retain
    type: int
    default: 14
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: log-contract:file-max-history

  - name: APP_LOG_FILE_TOTAL_SIZE_CAP
    # source: feature-log-management-contract — total size cap across rolled files
    type: data_size
    default: 3GB
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: spring_data_size
    compatibility_impact: behavior-change
    required_test: log-contract:file-total-size-cap

  - name: APP_LOG_ASYNC_ENABLED
    # source: feature-log-management-contract — AsyncAppender wrap for non-blocking I/O
    type: boolean
    default: true
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: log-contract:async-appender-toggle

  - name: APP_LOG_ASYNC_QUEUE_SIZE
    # source: feature-log-management-contract — in-memory queue depth before back-pressure
    type: int
    default: 512
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: log-contract:async-queue-size

  - name: APP_LOG_ASYNC_DISCARDING_THRESHOLD
    # source: feature-log-management-contract — remaining-capacity floor below which
    #         TRACE/DEBUG/INFO events drop (WARN/ERROR always kept). 0 = never drop.
    type: int
    default: 20
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: non_negative_int
    compatibility_impact: behavior-change
    required_test: log-contract:async-discarding-threshold

  - name: APP_LOG_JSON_TIMEZONE
    # source: feature-log-management-contract — IANA timezone for JSON encoder timestamps
    type: string
    default: UTC
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: non_empty_string
    compatibility_impact: behavior-change
    required_test: log-contract:json-timezone

  - name: APP_LOG_JSON_TIMESTAMP_PATTERN
    # source: feature-log-management-contract — JSON encoder timestamp pattern (ISO 8601 default)
    type: string
    default: "yyyy-MM-dd'T'HH:mm:ss.SSSXXX"
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: non_empty_string
    compatibility_impact: behavior-change
    required_test: log-contract:json-timestamp-pattern

  - name: APP_LOG_JSON_INCLUDE_CALLER_DATA
    # source: feature-log-management-contract — include file/method/line (significant perf cost)
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: log-contract:json-include-caller-data

  - name: APP_LOG_JSON_LOGGER_NAME_LENGTH
    # source: feature-log-management-contract — logger name abbreviation (0 = full name)
    type: int
    default: 0
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: non_negative_int
    compatibility_impact: behavior-change
    required_test: log-contract:json-logger-name-length

  - name: APP_LOG_SAMPLING_RATE
    # source: feature-log-management-contract 2026-05-22
    # "log sampling(prod 10%) > trace sampling(prod 1%)" + Sampling Policy 표 (prod 10%, staging/dev/local 100%)
    type: string
    default: "1.0"
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-log-management-contract
    validation: float_between_0_and_1
    compatibility_impact: behavior-change
    required_test: log-contract:sample-rate-per-profile

  # === Privacy: user_principal pseudonymization (feature-data-retention-privacy-contract) ===

  - name: APP_PRIVACY_PSEUDONYMIZATION_SALT
    # source: feature-data-retention-privacy-contract — "pseudonymization key = HMAC-SHA-256
    #         with rotating salt (90d)". Consumed by feature-log-management-contract (DRIFT-6)
    #         to record user_principal in pseudonymized form. secret 분류로 secrets-classification.yaml에서 owns.
    type: string
    default: null
    allowed_values: null
    classification: secret
    required: false
    reload_policy: restart-only
    owner_branch: feature-data-retention-privacy-contract
    validation: must_not_be_local_dev_sentinel_in_prod
    compatibility_impact: breaking
    required_test: secrets-contract:pseudonymization-salt-rotation

  # === Security / CORS / JWT (feature-security-operational-baseline) ===

  - name: APP_SECURITY_CORS_ORIGINS
    # source: feature-security-operational-baseline 2026-05-22
    # "allowlist origin은 env-driven runtime configuration의 APP_SECURITY_CORS_ORIGINS로 주입"
    type: csv_list
    default: null
    allowed_values: null
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: csv_of_origins_no_wildcard_with_credentials
    compatibility_impact: behavior-change
    required_test: security-contract:cors-allowlist

  - name: APP_SECURITY_CORS_ENABLED
    # source: feature-security-operational-baseline — CORS filter master toggle
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: security-contract:cors-enabled-toggle

  - name: APP_SECURITY_CORS_ALLOWED_METHODS
    # source: feature-security-operational-baseline — allowed methods
    #         (empty -> sensible method defaults in CorsSettings)
    type: csv_list
    default: null
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: csv_of_http_methods_or_empty
    compatibility_impact: behavior-change
    required_test: security-contract:cors-allowed-methods

  - name: APP_SECURITY_CORS_ALLOWED_HEADERS
    # source: feature-security-operational-baseline — allowed request headers ("*" = any)
    type: csv_list
    default: "*"
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: csv_non_empty
    compatibility_impact: behavior-change
    required_test: security-contract:cors-allowed-headers

  - name: APP_SECURITY_CORS_ALLOW_CREDENTIALS
    # source: feature-security-operational-baseline 2026-05-22
    # "CORS는 allowlist default, credentials false default" / "wildcard with credentials forbidden"
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: forbid_true_with_wildcard_origin
    compatibility_impact: behavior-change
    required_test: security-contract:cors-credentials-policy

  - name: APP_SECURITY_CORS_MAX_AGE
    # source: feature-security-operational-baseline 2026-05-22
    # "preflight max-age 600s default"
    type: duration
    default: 600s
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: spring_duration_shorthand
    compatibility_impact: behavior-change
    required_test: security-contract:cors-preflight-max-age

  - name: APP_SECURITY_JWT_ISSUER
    # source: feature-security-operational-baseline 2026-05-22
    # "issuer mismatch | 401 | AUTH_ISSUER_MISMATCH"
    type: url
    default: null
    allowed_values: null
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: url_required
    compatibility_impact: behavior-change
    required_test: security-contract:jwt-issuer-set

  - name: APP_SECURITY_JWT_AUDIENCE
    # source: feature-security-operational-baseline 2026-05-22
    # "audience mismatch | 401 | AUTH_AUDIENCE_MISMATCH"
    type: csv_list
    default: null
    allowed_values: null
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: csv_non_empty
    compatibility_impact: behavior-change
    required_test: security-contract:jwt-audience-set

  - name: APP_SECURITY_JWT_JWKS_URI
    # source: feature-security-operational-baseline 2026-05-22
    # "JWKS refresh interval = 10분, on-demand refresh on unknown kid"
    type: url
    default: null
    allowed_values: null
    classification: public-config
    required: true
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: url_required
    compatibility_impact: behavior-change
    required_test: security-contract:jwks-uri-resolvable

  - name: APP_SECURITY_JWT_CLOCK_SKEW
    # source: feature-security-operational-baseline 2026-05-22
    # "JWT clock skew tolerance = 60s (Spring Security JwtTimestampValidator leeway)"
    type: duration
    default: 60s
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-security-operational-baseline
    validation: spring_duration_shorthand
    compatibility_impact: behavior-change
    required_test: security-contract:jwt-clock-skew-applied

  - name: APP_SECURITY_JWT_SIGNING_KEY
    # source: feature-security-operational-baseline 2026-05-22
    # "JWT signing key rotation의 운영 관측 (JWKS refresh, kid mismatch 분류)"
    # secret 분류 — owner: secrets-classification.yaml
    type: string
    default: null
    allowed_values: null
    classification: secret
    required: false
    reload_policy: restart-only
    owner_branch: feature-secrets-config-source-contract
    validation: must_not_be_local_dev_sentinel_in_prod
    compatibility_impact: breaking
    required_test: secrets-contract:jwt-signing-key-rotation-overlap

  # === Tenant context (feature-tenant-context-policy) ===

  - name: APP_TENANT_ENABLED
    # source: feature-tenant-context-policy 2026-05-22
    # "skeleton core는 multi-tenancy 미지원이 기본이며 tenant header는 기본 거부"
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-tenant-context-policy
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: tenant-contract:disabled-rejects-header

  # === Rate limit / Idempotency (feature-rate-limit-idempotency-contract) ===

  - name: APP_RATE_LIMIT_ENABLED
    # source: feature-rate-limit-idempotency-contract — "rate limit과 idempotency를 API/runtime 운영 표면에 포함"
    type: boolean
    default: true
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-rate-limit-idempotency-contract
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: rate-limit-contract:enabled-by-default

  - name: APP_RATE_LIMIT_CLIENT_IP_MODE
    # source: feature-rate-limit-idempotency-contract — rate-limit client IP source policy.
    # Use forwarded-headers-trusted only behind an ingress/LB that overwrites X-Forwarded-For.
    type: enum
    default: remote-addr-only
    allowed_values: [remote-addr-only, forwarded-headers-trusted]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-rate-limit-idempotency-contract
    validation: enum_in_allowed_values
    compatibility_impact: behavior-change
    required_test: rate-limit-contract:client-ip-mode

  - name: APP_IDEMPOTENCY_TTL
    # source: feature-rate-limit-idempotency-contract 2026-05-22
    # "idempotency TTL default = 24h. long-running use case는 use case 선언으로 72h까지 override 가능"
    type: duration
    default: 24h
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-rate-limit-idempotency-contract
    validation: spring_duration_shorthand_le_72h
    compatibility_impact: behavior-change
    required_test: idempotency-contract:ttl-applied

  # === Cache / Redis (feature-cache-consistency-contract + integration-adapter-templates) ===

  - name: APP_CACHE_REDIS_ENABLED
    # source: feature-integration-adapter-templates 2026-05-22
    # "Redis | disabled optional module | cache consistency" + Adapter Template Defaults 표
    type: boolean
    default: false
    allowed_values: [true, false]
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-integration-adapter-templates
    validation: boolean_strict
    compatibility_impact: behavior-change
    required_test: adapter-contract:redis-disabled-default

  - name: APP_CACHE_REDIS_HOST
    # source: feature-cache-consistency-contract — Redis adapter (활성화 시 endpoint 필요)
    type: string
    default: null
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-cache-consistency-contract
    validation: non_empty_string_when_redis_enabled
    compatibility_impact: behavior-change
    required_test: cache-contract:redis-host-when-enabled

  - name: APP_CACHE_REDIS_PORT
    # source: feature-cache-consistency-contract — Redis adapter endpoint
    type: int
    default: 6379
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-cache-consistency-contract
    validation: port_range_1_65535
    compatibility_impact: behavior-change
    required_test: cache-contract:redis-port-bound

  - name: APP_CACHE_DEFAULT_TTL
    # source: feature-cache-consistency-contract 2026-05-22
    # "TTL | explicit per key family | no-cache for sensitive data | immortal cache forbidden"
    type: duration
    default: 300s
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-cache-consistency-contract
    validation: spring_duration_shorthand_non_zero
    compatibility_impact: behavior-change
    required_test: cache-contract:default-ttl-bounded

  - name: APP_CACHE_NEGATIVE_TTL
    # source: feature-cache-consistency-contract 2026-05-22
    # "negative cache 정책 = 존재하지 않는 row는 짧은 TTL(60s) 캐싱 허용"
    type: duration
    default: 60s
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-cache-consistency-contract
    validation: spring_duration_shorthand
    compatibility_impact: additive
    required_test: cache-contract:negative-ttl-bounded

  # === Messaging / Kafka (feature-domain-event-outbox-contract + integration-adapter-templates) ===

  - name: APP_MESSAGING_BROKER
    # source: messaging multi-broker redesign 2026-06-16 — single active broker selection
    # (app.messaging.broker=<brokerId>); blank = messaging disabled. Replaces the former
    # Kafka-binary APP_MESSAGING_KAFKA_ENABLED. Adding a broker is new files only.
    type: string
    default: null
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-integration-adapter-templates
    validation: none
    compatibility_impact: behavior-change
    required_test: adapter-contract:messaging-broker-selection

  - name: APP_MESSAGING_KAFKA_BROKERS
    # source: feature-domain-event-outbox-contract — "Kafka는 optional integration adapter"
    #         (broker 활성화 시 endpoint 필요)
    type: csv_list
    default: null
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-integration-adapter-templates
    validation: csv_of_host_port_when_kafka_enabled
    compatibility_impact: behavior-change
    required_test: adapter-contract:kafka-brokers-when-enabled

  # === Notification adapters (feature-integration-adapter-templates) ===

  - name: APP_NOTIFICATION_SLACK_PROVIDER
    # source: notification provider-SPI redesign 2026-06-16 — single active Slack provider
    # selection (app.notification.slack.provider=<id>, e.g. webhook); blank = Slack disabled.
    # Replaces the former provider-binary APP_NOTIFICATION_SLACK_ENABLED.
    type: string
    default: null
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-integration-adapter-templates
    validation: none
    compatibility_impact: behavior-change
    required_test: adapter-contract:notification-slack-provider-selection

  - name: APP_NOTIFICATION_EMAIL_PROVIDER
    # source: notification provider-SPI redesign 2026-06-16 — single active email provider
    # selection (app.notification.email.provider=<id>, e.g. google-email); blank = email disabled.
    # Replaces the former provider-binary APP_NOTIFICATION_GOOGLE_EMAIL_ENABLED.
    type: string
    default: null
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-integration-adapter-templates
    validation: none
    compatibility_impact: behavior-change
    required_test: adapter-contract:notification-email-provider-selection

  # === File / Upload (feature-file-resource-handling-contract) ===

  - name: APP_FILE_UPLOAD_MAX_SIZE
    # source: feature-file-resource-handling-contract 2026-05-22
    # "Spring spring.servlet.multipart.max-file-size 10MB"
    type: data_size
    default: 10MB
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-file-resource-handling-contract
    validation: spring_data_size_le_10MB_by_default
    compatibility_impact: behavior-change
    required_test: file-contract:upload-size-enforced

  - name: APP_FILE_UPLOAD_GLOBAL_REQUEST_MAX_SIZE
    # source: feature-file-resource-handling-contract 2026-05-22
    # "global request size 12MB"
    type: data_size
    default: 12MB
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-file-resource-handling-contract
    validation: spring_data_size
    compatibility_impact: behavior-change
    required_test: file-contract:global-request-size-enforced

  # === Runtime / Lifecycle (feature-runtime-health-lifecycle-contract + container-runtime) ===

  # APP_SHUTDOWN_TIMEOUT superseded by APP_SERVER_SHUTDOWN_TIMEOUT (HTTP server section,
  # owner feature-env-driven-runtime-configuration). The k8s terminationGracePeriod
  # alignment requirement (feature-container-runtime-contract) now applies to
  # APP_SERVER_SHUTDOWN_TIMEOUT.

  # === Async executor (feature-background-job-async-contract) ===

  - name: APP_ASYNC_EXECUTOR_CORE_SIZE
    # source: feature-background-job-async-contract 2026-05-22
    # "executor pool sizing default = core=10, max=50, queue=200"
    type: int
    default: 10
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-background-job-async-contract
    validation: positive_int
    compatibility_impact: behavior-change
    required_test: async-contract:executor-core-size

  - name: APP_ASYNC_EXECUTOR_MAX_SIZE
    # source: feature-background-job-async-contract 2026-05-22
    # "core=10, max=50, queue=200"
    type: int
    default: 50
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-background-job-async-contract
    validation: positive_int_ge_core
    compatibility_impact: behavior-change
    required_test: async-contract:executor-max-size

  - name: APP_ASYNC_EXECUTOR_QUEUE_CAPACITY
    # source: feature-background-job-async-contract 2026-05-22
    # "queue=200" + "unbounded queue forbidden"
    type: int
    default: 200
    allowed_values: null
    classification: public-config
    required: false
    reload_policy: restart-only
    owner_branch: feature-background-job-async-contract
    validation: positive_int_bounded
    compatibility_impact: behavior-change
    required_test: async-contract:executor-queue-bounded