fix(etl): keep connector lifecycle diagnostics out of logs

[seonghobae]

Purpose

Fix #175 test-first. Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 serialized third-party target-connector exception objects to ordinary logs when open cleanup or shutdown close failed. Provider exceptions can contain endpoints, tokens, request fragments, storage paths, account/workspace identifiers, or other deployment-sensitive diagnostics.

This remains a direct-develop, bounded Draft. It changes the target-connector lifecycle logging boundary, focused regression tests, and source-local security doctoring only. Nothing here is implemented_on_develop before protected integration.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/target-connector-safe-logs-622e5e6;
• behavior RED head: 6f9feda67deb8c8c8d9373ce863fd0190051537b;
• behavior GREEN predecessor: 5f2c92004d8ede691fe866055450fb3a3ff77833;
• documentation RED predecessor: f1461b03a70752f56e9113ef5ea02c5f41f7fcce;
• first documentation GREEN candidate: cc20453800e596f7982dc3984764aeb765733c73;
• exact current source head: 3bc42f17b1a21850a646bebebf0001516f54cbdb;
• current synthetic merge preview: 88268208321d1bc1c1df1f727c47abc1c4c03f63;
• GitHub mergeability: true;
• Draft: true;
• current formal reviews: none;
• unresolved review threads: zero.

Every check/review from a predecessor head or base is historical and does not transfer.

RCA

• Immediate cause: TargetConnectorDispatcher called log.warn(..., cleanupFailure) and log.error(..., exception).
• Technical root cause: lifecycle failure classification was coupled to provider exception transport.
• Control failure: existing lifecycle tests verified cleanup/close ordering but did not assert log confidentiality or require source-backed confidentiality doctoring.

TDD / remediation evidence

RED 1 — provider diagnostics reached ordinary logs

Fail-first 6f9feda67deb8c8c8d9373ce863fd0190051537b added the lifecycle-log assertions before production changed. Hosted CI reached the intended ETL logging boundary and proved that close/open-cleanup failures exported credential-bearing provider diagnostics and exception stack traces. The tests also proved the original failed-open exception retained cleanup causality through suppressed state and that shutdown remained best-effort.

GREEN 1 — bounded lifecycle classifications

The smallest production correction removes exception-object transport from the two ordinary log calls while preserving connector ID, lifecycle classification, suppressed-exception causality, cleanup ordering, close continuation, open-state bookkeeping, and exception propagation. No regex masking or logging-framework weakening is introduced.

RED 2 — missing source-backed doctoring

Predecessor f1461b03a70752f56e9113ef5ea02c5f41f7fcce added a permanent documentation contract requiring docs/doctoring/target-connector-diagnostic-confidentiality.md with CWE-532, OWASP Logging Cheat Sheet, suppressed-exception, connector-ID, connection-string, purpose-bound-observability and APA 7 evidence. CI reached that exact contract after the behavior tests were green and failed because the doctoring artifact was absent.

GREEN 2 — exact current head

cc20453800e596f7982dc3984764aeb765733c73 added the source-local doctoring. Its first hosted CI run isolated one literal documentation-contract mismatch: the prose rendered the OWASP title with Markdown between OWASP and Logging Cheat Sheet, so the required canonical name did not occur contiguously. Production behavior and the logging regressions remained green.

Exact current head 3bc42f17b1a21850a646bebebf0001516f54cbdb changes only that wording to the canonical literal OWASP Logging Cheat Sheet. The documentation now records data minimization / purpose-bound observability rather than blanket masking, retained causal suppressed exceptions, finite connector-ID metadata, avoidance of regex-only masking, and APA 7 references to CWE-532 and current OWASP logging guidance.

Current workflow evidence

All exposed pull-request workflow aggregates for exact current source head 3bc42f17b1a21850a646bebebf0001516f54cbdb are terminal-success:

• CI 31350291551: success;
• Dependency Review 31350291554: success;
• CycloneDX SBOM 31350291535: success;
• SAST Semgrep 31350291550: success;
• Security Scan 31350291537: success.

This is not merge authorization. The protected pull-request workflows execute GitHub's synthetic merge preview rather than accepted literal-source execution, the shared protected JaCoCo control remains vacuous until #162/#164 or equivalent integration, and the hard scanner-completeness gap tracked by #196 remains a separate acceptance property. A green aggregate cannot change the revision or dependency graph actually examined.

Scope / shared prerequisites

This PR does not alter connector registry/scaffold decisions in #153/#156/#158/#163/#203, CDC diagnostics #170–#174, database schema, connector payloads, target capability architecture #202, or exception propagation contracts. Shared #160/#164, literal-source controls, scanner completeness, and review governance remain separate controls.

Merge boundary

Keep Draft. Merge only after the unchanged exact source head has accepted literal-source deterministic/security evidence, complete same-revision vulnerability/dependency evidence, non-vacuous owned-production coverage, zero valid unresolved review findings, every required repository/security gate, and qualifying independent non-author approval where governance requires it. No predecessor-head, synthetic-merge, status-only, incomplete-scanner, skipped-required, or other-PR evidence transfers.

Summary by CodeRabbit

• 개선 사항
  • 대상 커넥터의 정리 및 종료 실패 로그에서 예외 세부 정보와 민감한 값이 노출되지 않도록 개선했습니다.
  • 커넥터 종료는 일부 실패가 발생해도 가능한 범위에서 계속 처리됩니다.
• 문서
  • 진단 로그의 기밀성 기준, 데이터 최소화 원칙 및 안전한 진단 지침을 문서화했습니다.
• 테스트
  • 로그 기밀성, 예외 처리, 이벤트 순서 및 최선 노력 방식의 종료 동작을 검증하는 테스트를 추가했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 26c5c94c-4ae3-444f-894c-c4cc2bf18aa2

📥 Commits

Reviewing files that changed from the base of the PR and between 622e5e6 and 3bc42f1.

📒 Files selected for processing (4)

• docs/doctoring/target-connector-diagnostic-confidentiality.md
• etl-service/src/main/java/com/xtrmetl/etl/connector/TargetConnectorDispatcher.java
• etl-service/src/test/java/com/xtrmetl/etl/connector/TargetConnectorDiagnosticConfidentialityDocumentationTest.java
• etl-service/src/test/java/com/xtrmetl/etl/connector/TargetConnectorDispatcherLoggingTest.java

---

📝 Walkthrough

Walkthrough

대상 커넥터의 정리 및 종료 실패 로그에서 예외 객체 출력을 제거했습니다. 예외 전파와 suppressed 예외 처리는 유지했습니다. 로그 기밀성, 수명주기 동작, 문서 정책을 검증하는 테스트와 문서를 추가했습니다.

Changes

대상 커넥터 진단 기밀성

Layer / File(s)	Summary
Dispatcher 로그 경계 etl-service/src/main/java/com/xtrmetl/etl/connector/TargetConnectorDispatcher.java	정리 실패와 종료 실패 로그에서 예외 객체를 제거하고 커넥터 ID만 기록합니다. 기존 예외 처리 흐름은 유지합니다.
기밀성 회귀 계약 etl-service/src/test/java/com/xtrmetl/etl/connector/TargetConnectorDispatcherLoggingTest.java, etl-service/src/test/java/com/xtrmetl/etl/connector/TargetConnectorDiagnosticConfidentialityDocumentationTest.java, docs/doctoring/target-connector-diagnostic-confidentiality.md	열기·정리·종료 실패의 예외 의미, 로그 비노출 조건, 수명주기 순서, best-effort 종료 및 관련 문서 기준을 검증합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• #173: 다른 커넥터 구성 요소에서 예외 세부 정보와 민감한 식별자의 운영 로그 노출을 제한하는 목표가 본 변경과 유사합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 커넥터 수명주기 진단 정보를 일반 로그에서 제외하는 핵심 변경을 명확하고 간결하게 설명합니다.
Linked Issues check	✅ Passed	구현과 테스트는 예외 정보 제거, 커넥터 ID 유지, 예외 인과관계와 종료 계속 처리를 포함한 이슈 #175의 요구사항을 충족합니다.
Out of Scope Changes check	✅ Passed	변경 사항은 이슈 #175의 운영 코드 수정, 회귀 테스트 및 관련 보안 문서 범위에 포함됩니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/target-connector-safe-logs-622e5e6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.