fix(cdc): fail closed on blank DDL validation mode

[seonghobae]

Security / data-integrity defect

Protected develop@942d164ceb7af497bb28a95f842db96429d1bdc4 maps a blank or null xtrmetl.replica.ddl-validation-mode to NONE. Because NONE bypasses both allow-list and block-list policy, an explicitly blank configuration can silently disable the documented positive allow-list and admit destructive replicated DDL. Explicit none remains a separate intentional opt-out and is not changed by this slice.

RCA

• immediate cause: DdlValidationMode.from() returns NONE for null/blank input;
• root cause: malformed/missing constructor input is conflated with the explicit NONE enum mode;
• impact: when replicated DDL execution is enabled, a blank configuration changes policy from the documented whitelist default to unrestricted mode without an explicit none choice.

TDD state — isolated RED only

Exact current head 735af4f1f66f9b403321a20dcd736adeca001d4c contains only the focused production-boundary regression test. A transient third assertion against the XtrmetlProperties whitelist default was removed because active PR #234 already owns that separate defect. SchemaChangeReplicaValidationModeTest now has exactly two cases: blank and null validation-mode constructor input must fail closed with IllegalArgumentException.

Hosted CI run 31440725288 reached the real SchemaChangeReplicaApplier boundary and reproduced exactly those two failures: production threw no exception for either blank or null input. ETL completed successfully first; no setup/import/fixture/dependency failure is being mistaken for RED. The run used GitHub's synthetic merge checkout, so it is causal development evidence rather than literal-source acceptance proof.

Writer-lease boundary

Fresh writer inspection found active Draft PR #171 at exact head 977797d133570662f9f9111705100263cd7aee7b also changes SchemaChangeReplicaApplier.java for DDL diagnostic confidentiality. Its work is unique and must not be raced or overwritten. Therefore this PR remains intentionally test-only RED in the current invocation; the production GREEN is deferred until #171's source lane clears or integrates, after which the defect must be re-read from the then-current protected source before any implementation.

No gate is weakened, no central workflow is changed, and no evidence from #171/#234 transfers here. Keep Draft. Before any production mutation or merge, re-resolve the live protected base, exact target source blob and active-writer state, then require a fresh narrow GREEN, literal-source exact-head/current-base CI and security proof, non-vacuous applicable owned-production coverage, complete dependency-scanner evidence, zero valid unresolved findings, and qualifying independent non-author formal approval.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0fa24cc9-76a7-4f4e-a825-945f2f665aa3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}