fix(cdc): align secure DDL validation object default

[seonghobae]

Purpose

Advance #233 test-first from exact protected develop@622e5e6c3d534f230c390f10e3832efadfc01825. The deployable CDC configuration and public Spring metadata say whitelist is the secure DDL-validation default, while XtrmetlProperties.Replica historically initialized the same setting to none.

This remains a direct-develop, bounded Draft. It changes only the focused default contract and the Java configuration-object default. It does not enable DDL replication, remove explicit operator none, change allowed/blocked prefixes, alter DDL parser/execution semantics, touch application.yml, or claim repository-wide coverage.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/cdc-secure-ddl-default-622e5e6;
• fail-first source head: 13ad1e93d0d1b0856d5981763c56df5e53347f85;
• exact current GREEN source: 4d2cb4f4920f07acfb492e801e7aef9b571aa1ad;
• current synthetic merge preview: 23cc083a4097fd78cbf9660574370d562ef8e9e2;
• GitHub mergeability: true;
• Draft: true;
• formal reviews: none;
• unresolved review threads: zero.

Every check/review from the fail-first head is development evidence only after this source movement and does not transfer as current-head acceptance evidence.

RED — hosted production-boundary proof

The fail-first commit added only XtrmetlPropertiesSecurityDefaultTest. CI run 31381860308, macOS job 93433599405, checked out GitHub synthetic merge 0054ef4eb120b6612edbce2ef805197e30eb0090 (Merge 13ad1e93... into 622e5e6...). Production and tests compiled normally. ETL completed 275/275 green, then CDC ran 107 tests with exactly one failure and zero errors/skips:

XtrmetlPropertiesSecurityDefaultTest.replicaDdlRemainsDisabledAndUsesWhitelistValidationByDefault — expected whitelist, actual none.

The independent ddlEnabled=false assertion passed. This is valid RED at the intended production configuration-object boundary rather than a setup/import/dependency failure. It also confirms current protected CI still executes a synthetic merge, so the result is development evidence rather than literal-source acceptance proof.

GREEN candidate and current hosted evidence

Exact current source head 4d2cb4f4920f07acfb492e801e7aef9b571aa1ad applies the smallest root-cause correction proven by RED:

• XtrmetlProperties.Replica.ddlValidationMode now defaults to whitelist;
• DDL application remains disabled by default;
• explicit operator configuration of another supported mode, including none, remains available;
• deployable YAML and Spring metadata are unchanged because they already declare whitelist;
• source documentation records that the positive allow-list is the object default while DDL execution remains opt-in.

All exposed workflow aggregates associated with this exact source head completed successfully:

• CI 31382157648: success;
• Dependency Review 31382157779: success;
• CycloneDX SBOM 31382157706: success;
• SAST Semgrep 31382157672: success;
• Security Scan 31382157698: aggregate success.

CI macOS job 93434513847 checked out synthetic merge 23cc083a4097fd78cbf9660574370d562ef8e9e2, not literal source. It ran ETL 275/275 green, the new CDC default contract 1/1 green, CDC 107/107 green and completed the full reactor successfully. The same log still reports Analyzed bundle 'etl-service' with 0 classes before declaring coverage checks met, so this is not accepted non-vacuous 100% coverage evidence.

Security Scan hard Trivy job 93434514015 likewise checked out synthetic merge 23cc083... and printed Dependency version cannot be determined. Child dependencies will not be found. before reporting zero CRITICAL/HIGH/MEDIUM findings. Therefore the aggregate Security Scan remains incomplete/non-passing for mightyETL acceptance under #196 despite its green conclusion. The scanner also continues to encounter the tracked 82 MB zipkin.jar, whose retirement is separately owned by #168/#169.

Shared evidence boundary

This bounded correction does not repair the protected JaCoCo zero-class false-green (#162/#164), repository-wide coverage scope (#205), hard scanner dependency-resolution completeness (#196), literal-source workflow controls (#121/central dependencies), Maven resource reproducibility (#217), or tracked Zipkin artifact retirement (#168/#169). Those remain independent acceptance properties and their evidence does not transfer into this PR.

Merge boundary

Keep Draft. Protected merge requires the unchanged exact source head to have accepted literal-source deterministic/security evidence, complete same-revision dependency/vulnerability evidence, non-vacuous applicable owned-production coverage, every current required gate, zero valid unresolved findings, and qualifying independent formal approval where governance requires it. Synthetic merge, predecessor-head, status-only, skipped-required, incomplete-scanner, queued or pending evidence is not passing.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: dff3bd89-ba19-4c9e-b56b-17358e5e538d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by protected develop integration through #296. Fresh protected develop@f340d37caba9df0d4aeb88e5d18b78bd8cca4b60 contains the same secure object default (ddlValidationMode = "whitelist") and the same focused XtrmetlPropertiesSecurityDefaultTest contract, with DDL execution still disabled by default. The old branch therefore has no unique product/test behavior left to integrate; its historical checks/reviews remain historical and are not transferred.