fix(cdc): remove SQL Server scaffold from production discovery

[seonghobae]

Purpose

Advance #153 with one bounded CDC connector decision: stop auto-discovering the nonfunctional SQL Server Debezium scaffold as a Spring production source until a maintained SQL Server CDC implementation exists. Keep the reference type available for explicit design/tests without advertising a runtime source that cannot start.

Nothing here is implemented_on_develop before protected integration.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/remove-sqlserver-cdc-scaffold-discovery;
• fail-first head: 652e696db6622cebd11926cf326d9ea4b68e00e7;
• exact current source head: d96d1c815511dffe8d48fa9d8b6eb0c92b353304;
• current synthetic merge preview: da327fbbe3f542477a34581279afe8f704a283ff;
• Draft / mergeable: true / true.

Every predecessor-head/base check, review, approval or synthetic merge is historical and does not transfer.

RCA / production boundary

Protected SqlServerDebeziumCdcSource extends AbstractScaffoldCdcSource, whose runtime start path refuses operation, while the class was annotated as a Spring component. Production discovery could therefore advertise a source that cannot start. A real SQL Server source additionally needs a maintained Debezium SQL Server dependency, SQL Server CDC prerequisites, offset/schema-history lifecycle, restart/recovery, credential validation, operations guidance and realistic integration evidence.

The smallest safe correction is removal from Spring production discovery, not invention of those missing dependencies/credentials/behaviors.

TDD / implemented boundary

Fail-first 652e696db6622cebd11926cf326d9ea4b68e00e7 requires SqlServerDebeziumCdcSource to have no Spring @Component marker while preserving explicit construction of the reference type.

The subsequent branch:

• removes only automatic Spring component registration;
• documents SQL Server as reference-only and configured use as unknown_source_type;
• records the fail-closed production boundary in CHANGELOG.md;
• keeps MySQL (fix(cdc): remove MySQL scaffold from production discovery #158), Qlik (fix(connectors): remove Qlik scaffold from production registry #156), Databricks and Snowflake decisions separate.

Fresh exact-current-head aggregate state

For exact source head d96d1c815511dffe8d48fa9d8b6eb0c92b353304 all exposed pull-request aggregates are terminal-success:

• Dependency Review 31317797366: success;
• CycloneDX SBOM 31317797360: success;
• SAST Semgrep 31317797356: success;
• CI 31317797409: success;
• Security Scan 31317797370: success.

CodeRabbit has already been explicitly requested multiple times on this PR; one request hit provider chat rate limiting. Do not spam the unchanged head merely to produce another status. Provider/reviewer latency is local to that review lane.

Aggregate green is not merge authorization. Current protected PR workflows still execute GitHub's generated integration source rather than accepted literal source, protected JaCoCo remains a vacuous evidence path until #162/#164 integrates, and #196 requires Maven dependency/vulnerability evidence to fail closed when Trivy reports unresolved BOM-managed versions. Source identity, vulnerability-graph completeness and non-vacuous coverage remain independent acceptance dimensions.

Scope / merge boundary

Keep Draft until the unchanged exact source head has accepted literal-source deterministic/security evidence, complete same-revision dependency/vulnerability evidence, non-vacuous owned-production coverage, zero valid unresolved review findings, all required repository/security gates and qualifying independent non-author formal approval where governance requires it. Do not suppress inherited security findings, copy unrelated workflow controls into this feature branch, or claim SQL Server support before a separately reviewed production implementation exists.

Issue #153 remains the broader connector-lifecycle authority; no evidence from #156/#158 or future Databricks/Snowflake work transfers to this PR.

[coderabbitai]

📝 Walkthrough

Walkthrough

SQL Server Debezium CDC 소스의 Spring 자동 등록을 제거했습니다. 등록되지 않은 소스 사용은 unknown_source_type으로 처리됩니다. 관련 테스트와 CDC 문서를 갱신했습니다.

Changes

SQL Server Debezium 비활성화

Layer / File(s)	Summary
소스 자동 등록 제거 및 검증 cdc-service/src/main/java/com/xtrmetl/cdc/spi/SqlServerDebeziumCdcSource.java, cdc-service/src/test/java/com/xtrmetl/cdc/spi/CdcSourceRegistryTest.java, CHANGELOG.md	SqlServerDebeziumCdcSource에서 @Component를 제거했습니다. 해당 클래스가 Spring 컴포넌트로 등록되지 않는지 테스트합니다. sqlserver-debezium 사용은 unknown_source_type으로 거부됩니다.
CDC 소스 상태 문서화 docs/cdc/any-to-any-cdc.md, CHANGELOG.md	mysql-debezium을 discovery-only로, sqlserver-debezium을 reference-only로 구분했습니다. SQL Server 소스의 운영 사용 조건과 비등록 상태를 기록했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 SQL Server 스캐폴드를 운영 검색 대상에서 제외하는 변경의 핵심을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/remove-sqlserver-cdc-scaffold-discovery

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 0 minutes and 45 seconds before sending another message.

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

docs/cdc/any-to-any-cdc.md (1)

90-91: 🗄️ Data Integrity & Integration | 🔵 Trivial

설치 가능한 CDC 실행 테스트로 unknown_source_type 동작을 보여주세요.

현재 스토커는 describeConfigured에서 sqlserver-debezium을 unknown_source_type으로 처리하고 CdcSourceFactoryTest가 예시 입력을 검증하지만, 예제는 postgres-debezium, mysql-debezium, oracle-debezium을 사용합니다. 활성화 설정, 기본 프로덕션 레지스트리, 예시 sqlserver-debezium 입력/응답을 함께 커버하는 실행 테스트가 필요합니다.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/cdc/any-to-any-cdc.md` around lines 90 - 91, 추가 실행 테스트에서 활성화 설정과 기본 프로덕션
레지스트리를 사용해 `sqlserver-debezium` 예시 입력이 `describeConfigured`를 통해
`unknown_source_type` 응답을 반환하는지 검증하세요. `CdcSourceFactoryTest`의 기존 예시 검증도 해당 SQL
Server 시나리오를 포함하도록 확장하고, docs/cdc/any-to-any-cdc.md 90-91 및 CHANGELOG.md 19의 관련
설명을 이 테스트 동작과 일치하도록 갱신하세요.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/cdc/any-to-any-cdc.md`:
- Line 90: 등록 타입 표 앞뒤에 빈 줄을 추가해 Markdown 표가 주변 문단과 분리되도록 수정하세요. 해당 표의 기존 내용과 정렬은
유지하고, markdownlint-cli2의 MD058 경고가 발생하지 않게 하세요.

---

Nitpick comments:
In `@docs/cdc/any-to-any-cdc.md`:
- Around line 90-91: 추가 실행 테스트에서 활성화 설정과 기본 프로덕션 레지스트리를 사용해 `sqlserver-debezium`
예시 입력이 `describeConfigured`를 통해 `unknown_source_type` 응답을 반환하는지 검증하세요.
`CdcSourceFactoryTest`의 기존 예시 검증도 해당 SQL Server 시나리오를 포함하도록 확장하고,
docs/cdc/any-to-any-cdc.md 90-91 및 CHANGELOG.md 19의 관련 설명을 이 테스트 동작과 일치하도록
갱신하세요.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fca66700-1d59-46c7-849e-1945387bc446

📥 Commits

Reviewing files that changed from the base of the PR and between 622e5e6 and 754cce2.

📒 Files selected for processing (4)

• CHANGELOG.md
• cdc-service/src/main/java/com/xtrmetl/cdc/spi/SqlServerDebeziumCdcSource.java
• cdc-service/src/test/java/com/xtrmetl/cdc/spi/CdcSourceRegistryTest.java
• docs/cdc/any-to-any-cdc.md

[seonghobae]

@coderabbitai review

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 18 minutes and 46 seconds before sending another message.

[seonghobae]

Fresh exact-state correction (2026-08-09): the PR body is now stale. Live source head is d96d1c815511dffe8d48fa9d8b6eb0c92b353304, not 754cce280d71b1745c8514a661e304fd208ccfee, on unchanged develop@622e5e6c3d534f230c390f10e3832efadfc01825. The current diff also includes the production-visible CdcSourceFactoryTest contract proving configured sqlserver-debezium remains unregistered and returns unknown_source_type, rather than only the annotation-level discovery assertion.

All five workflow aggregates associated with live head d96d1c815511dffe8d48fa9d8b6eb0c92b353304 have completed successfully: CI 31317797409, Dependency Review 31317797366, CycloneDX SBOM 31317797360, SAST Semgrep 31317797356, and Security Scan 31317797370. These replace the queued states recorded in the body. They still do not make the PR merge-eligible: the protected workflow generation used here predates accepted literal-source scanner/CI controls, the shared durable-job coverage gate is only being made non-vacuous by #164, and no qualifying independent non-author formal approval exists. The branch moved during this invocation, so this loop is keeping source/ref mutation frozen on #163 and is not racing its active writer.

[seonghobae]

Fresh exact-head reconciliation after the branch moved under its active writer; this supersedes the PR body's queued-gate snapshot without changing source/ref state.

• live source head: d96d1c815511dffe8d48fa9d8b6eb0c92b353304 over unchanged develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• current synthetic merge: da327fbbe3f542477a34581279afe8f704a283ff;
• Draft=true, mergeable=true;
• formal review state: one CodeRabbit COMMENTED, no qualifying APPROVED; all inline threads are resolved;
• the current-head commit d96d1c... directly addresses CodeRabbit's executable sqlserver-debezium -> unknown_source_type request and the MD058 table-spacing finding by extending CdcSourceFactoryTest and the product document;
• current-head Dependency Review 31317797366, CycloneDX SBOM 31317797360, SAST Semgrep 31317797356, CI 31317797409, and Security Scan 31317797370 are terminal-success.

Those aggregate greens are not yet accepted release/merge evidence. CI macOS job 93255755599 checked out GitHub synthetic merge da327fb..., not literal source d96d1c.... The merged tree itself is functionally healthy (275 ETL tests, 107 CDC tests, 3 gateway tests, all green), but the same job still reports Analyzed bundle 'etl-service' with 0 classes followed by All coverage checks have been met. Thus current coverage proof is vacuous under the shared protected configuration and remains blocked on #162/#164, independently of this SQL Server retirement slice.

Disposition: source-local SQL Server retirement/review findings are currently addressed; do not rerun unchanged aggregate CI, claim literal-source proof, or promote this Draft until the shared non-vacuous coverage/source-identity controls and qualifying independent approval are satisfied on the resulting exact head/base. This loop keeps source/ref writes frozen for this branch for the remainder of the invocation because live branch movement was observed.