fix(cdc): fail closed on duplicate connector registry IDs

[seonghobae]

Purpose

Fix #200 test-first from protected develop@622e5e6c3d534f230c390f10e3832efadfc01825. CDC connector IDs are execution/discovery authority selectors, but both source and target registries historically used unconditional Map.put, so a later connector with the same ID silently replaced the earlier registration.

This direct-develop Draft changes only CDC source/target registry identity validation plus focused tests. It does not alter MySQL/SQL Server discovery retirement (#158/#163), target-SPI capability architecture (#202), connector credentials, or provider support claims.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/cdc-duplicate-connector-ids-622e5e6;
• fail-first source head: f2683286c4a768ead11da0895a511ab2bec9af88;
• implementation GREEN head: 28b01de58d0c24cec864ef63bd9b9f3697c936d1;
• exact current source head: 1ba5527effcc4605b44d53effd0dfb3be3618164;
• current synthetic merge preview: 45769b73c0b910eab09264e92ea87cf0291062e8;
• GitHub mergeability: true;
• Draft: true.

Every check/review from a predecessor source head is historical and does not transfer.

RCA / RED

Registry register(...) methods used byId.put(id, connector), making identity uniqueness an accidental map behavior rather than a validated authority invariant. RED f268328... added CdcRegistryIdentityTest first. CI 31349125275 on synthetic merge 2cc52ed... ran the real registry code and all four new duplicate/blank-ID assertions failed because no exception was thrown.

GREEN + defensive-branch coverage

28b01de58d0c24cec864ef63bd9b9f3697c936d1 makes both registries fail closed on null/blank/duplicate IDs using bounded validation and putIfAbsent, preserves deterministic unique registration order, keeps the empty source-registry PostgreSQL fallback, and documents the public identity contract.

A later test-only commit 1ba5527effcc4605b44d53effd0dfb3be3618164 adds explicit null-source/null-target regression coverage for the newly introduced defensive branches. No production semantics changed after the implementation GREEN.

Current-head CI 31350073782 completed successfully on the hosted matrix. Dependency Review 31350073785, CycloneDX SBOM 31350073797, and SAST Semgrep 31350073795 also succeeded.

Current Security Scan RCA

Security Scan 31350073774 is failed, not merely incomplete. Hard Trivy job 93339083060 checked out synthetic merge 45769b73c0b910eab09264e92ea87cf0291062e8 and reported the six inherited protected-base Jackson findings for jackson-databind: CVE-2026-54515, CVE-2026-59889, and GHSA-mhm7-754m-9p8w at both root and etl-service dependency views. Shared remediation #160 remains the correction owner; duplicating that BOM change or suppressing the findings in this registry PR is rejected.

The same Trivy run also printed Dependency version cannot be determined. Child dependencies will not be found.. Issue #196 independently records that even a zero-findings result with this warning would be incomplete security evidence. Here the scan is already hard-failed on real inherited findings.

The current protected source-executing workflows remain synthetic-merge based, and inherited JaCoCo can still analyze zero ETL production classes (#162/#164). Source identity, vulnerability findings/completeness, and coverage non-vacuity are separate gates.

Review / scope

Formal reviews are absent and unresolved review threads were zero at the latest refresh. This PR validates registry identity only; #202 separately owns the mismatch between live CDC target product paths and unwired canonical target write(...) adapters.

Merge boundary

Keep Draft. Do not merge until the shared Jackson baseline is accepted/integrated and this unchanged behavior is freshly revalidated against the resulting live base; the exact source then needs accepted literal-source CI/security evidence, complete same-revision dependency/vulnerability evidence, non-vacuous owned-production coverage, every required dependency/SBOM/SAST/security gate, zero valid unresolved findings, and qualifying independent non-author approval where governance requires it. No predecessor-head, other-PR, incomplete-scanner, status-only or synthetic-merge-only evidence transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d879abf3-1f37-4f3a-b1f7-0e1fefb9ce16

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by current-base replacement #306; unique behavior and regression coverage are preserved without rewriting this stale branch.

Fresh preservation proof:

• this PR remains at 1ba5527effcc4605b44d53effd0dfb3be3618164, while protected develop is 502d1e2136f18b7dea3baa792559128dc87fec39;
• fix(cdc): fail closed on duplicate connector registry IDs #201 changes exactly CdcSourceRegistry.java, CdcTargetRegistry.java, and CdcRegistryIdentityTest.java;
• test(cdc): replay connector identity RED on current develop #306 current head 88c2dbb516a18702308c161770ef96d87e19dd76 changes the same three paths on the current protected ancestry;
• the six null/blank/duplicate identity tests are preserved verbatim in test(cdc): replay connector identity RED on current develop #306;
• both production registries preserve the same fail-closed semantics and exact exception messages using null checks, blank-ID rejection, and putIfAbsent duplicate rejection; the replacement also retains equivalent public Javadoc for those authority contracts;
• fix(cdc): fail closed on duplicate connector registry IDs #201 has no formal reviews and no unresolved review threads, so no independent review artifact is discarded.

Closing #201 as a stale-base duplicate. Checks/reviews from #201 do not transfer to #306; #306 must satisfy its own exact-head gates.