fix(cdc): keep row replica diagnostics out of logs

[seonghobae]

Purpose

Fix #173 test-first. Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 logs raw replicated row IDs and parser exception stack traces from ProcessedDataReplicaApplier. The replication computation needs the actual business values, but ordinary logs and propagated failure text do not.

Exact current identity

• base: develop@622e5e6c3d534f230c390f10e3832efadfc01825
• branch: fix/processed-data-replica-safe-logs-622e5e6
• behavior RED head: 7226732f8852c62c5b741bc997975a18c27f105e
• behavior GREEN head: cd21cb36405ee2f3c2cf88ba223223bf00580afb
• doctoring RED head: 8986887ca7d3802b02115feedf3425862009c755
• exact current head: e2be226f1844fa9980b7311aa70dba15041d0c87
• current synthetic merge preview: 0feca61c0e385c5cb88b43000eaffd40438ba796
• Draft: true

Every gate/review from a predecessor head is historical and does not transfer.

RCA

• Immediate cause: missing/null-data paths interpolated row id in error logs and exception messages; malformed value/key paths passed caught parser exceptions to SLF4J.
• Technical root cause: replication correctness classification was conflated with raw business/event diagnostic transport.
• Control failure: existing functional tests did not assert confidentiality of ordinary observability.

TDD evidence

Behavior RED — 7226732f8852c62c5b741bc997975a18c27f105e

CI run 31343633170, macOS job 93321403212, reached the intended production boundary and failed exactly the four new logging tests: missing/null rows exposed identifiers; malformed value/key JSON exported JsonParseException and parser stack diagnostics. The malformed-key path still reached the expected JDBC upsert. There were no setup/import/fixture failures. The job executed the PR merged tree, so this is valid merged-tree RED behavior evidence rather than literal-source acceptance proof.

Behavior GREEN — cd21cb36405ee2f3c2cf88ba223223bf00580afb

The smallest production correction keeps JDBC row ID/data use unchanged, removes row IDs from missing/null-data logs and thrown messages, replaces parser-exception transport with stable finite classifications, preserves malformed-key fallback, and adds beginner-readable public Javadoc to apply(...).

CI 31343752793 completed successfully on the current behavior source: the new four-test logging suite passed and the full reactor built successfully. Dependency Review 31343752781, SBOM 31343752799, SAST 31343752775, and Security Scan 31343752790 also completed successfully on that predecessor head. Those results became historical after the documentation head advanced.

Doctoring RED -> GREEN

After behavior GREEN, 8986887ca7d3802b02115feedf3425862009c755 added only CdcDiagnosticConfidentialityDocumentationTest. CI 31343915344, macOS job 93322184921, ran the repaired behavior tests green and failed exactly because docs/doctoring/cdc-diagnostic-confidentiality.md did not yet exist.

Exact current head e2be226f1844fa9980b7311aa70dba15041d0c87 adds that source-local doctoring without modifying the canonical #149 documentation branch. It records purpose-bound diagnostic minimization, CWE-532, current OWASP Logging Cheat Sheet guidance, parser/driver/row-ID boundaries, no regex-only masking rule, active-PR traceability, and APA 7 references.

For this exact current head:

• CI 31344106318: success;
• Dependency Review 31344106341: success;
• CycloneDX SBOM 31344106344: success;
• SAST Semgrep 31344106304: success;
• Security Scan 31344106316: failure solely in Trivy.

Trivy job 93322704338 completed the scan and reported the six inherited protected-base Jackson findings (CVE-2026-54515, CVE-2026-59889, GHSA-mhm7-754m-9p8w, each resolved through root/ETL dependency resolution). The branch does not change Maven dependencies. Shared PR #160 owns the root cause; duplicating its BOM change or suppressing Trivy here is rejected. Classification: defer_until_trigger until #160 integrates and this unchanged feature is regenerated/revalidated against the resulting protected base.

Protected CI and hard Trivy still check out the GitHub PR synthetic merge, not the literal source head. The inherited JaCoCo gate can also analyze zero classes until #164 integrates. Neither aggregate result is promoted to literal-source/non-vacuous release evidence.

Scope / shared prerequisites

This PR does not alter CDC acknowledgement (#139), graceful stop (#141), DDL application semantics (#171), replication-slot status (#170), CDC stop API response (#172), masking policy, database schema, or connector payload processing. Shared Jackson remediation #160, non-vacuous coverage #164, literal-source controls, and independent approval remain separate controls.

Keep Draft. Do not suppress inherited advisories or copy shared control-plane fixes into this bounded feature. After #160/#164 and source-identity controls integrate, regenerate every affected current-base/current-head gate and review; predecessor evidence does not transfer.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f31fbf57-b2ae-41a3-8988-b99c580bb069

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}