fix(ops): rebuild CDC safe observability on live develop

[seonghobae]

Rebuilds stale CDC observability PR #212 from exact protected develop@942d164ceb7af497bb28a95f842db96429d1bdc4 without rewriting predecessor history. Issue #182 remains the product owner. Keep Draft.

Exact current identity

• protected/live base: develop@942d164ceb7af497bb28a95f842db96429d1bdc4 (fresh comparison: identical);
• branch: repair/cdc-safe-observability-942d164;
• fail-first source: 373b36174ec12d84ff5b155521c47dc3d8f46ed7;
• exact current GREEN source: 099fe8a142134e72d4558eea6d5cc10e5fbe2628;
• Draft / mergeable: true / true;
• formal reviews: none;
• unresolved inline review threads: zero;
• only this open PR currently targets the branch.

Every check/review from another head/base is historical and does not transfer.

TDD / bounded implementation

The fail-first contract reaches the deployable CDC configuration boundary and requires the ordinary base profile not to force 100% tracing, application DEBUG, or Spring Web DEBUG. Protected source violated that contract.

The current bounded implementation changes only the CDC observability profile authority:

• removes management.tracing.sampling.probability: 1.0 from base application.yml;
• removes forced com.xtrmetl: DEBUG and Spring Web DEBUG from the base profile;
• preserves root/debezium logging, Zipkin destination and CDC product configuration;
• adds opt-in application-local.yml activated by profile local to restore the historical developer-verbose sampling/logging settings;
• keeps the permanent base/local separation test.

The exact current diff is limited to application.yml, new application-local.yml, and CdcObservabilityProfileContractTest. No Compose/Replit, CDC lifecycle/diagnostic source, authentication, dependency/POM, canonical-documentation, or cross-repository path is changed.

Current hosted evidence

All exposed workflow aggregates associated with exact current source 099fe8a142134e72d4558eea6d5cc10e5fbe2628 are terminal-success:

• CI 31461034493;
• Dependency Review 31461034467;
• CycloneDX SBOM 31461034489;
• SAST Semgrep 31461034543;
• Security Scan 31461034522.

These are development/merge-preview results, not protected merge authority. Current repository acceptance still treats GitHub synthetic-merge-only source execution, incomplete Maven vulnerability materialization (#196), vacuous/partial coverage authority (#162/#164/#205), stale/predecessor evidence, and absent qualifying independent review as non-passing dimensions.

Old #212 is already closed after this live-base replacement preserved its bounded three-file behavior; no #212 checks/reviews transfer.

Merge boundary

Keep Draft. Merge only on an unchanged exact source/current base after accepted literal-source deterministic/security evidence, complete same-revision dependency/vulnerability evidence, applicable non-vacuous 100% owned-production coverage, every required current gate, zero valid unresolved findings, and qualifying independent non-author formal APPROVED review where governance requires it. No synthetic-only, predecessor/stale, queued/pending/skipped-required, status-only, incomplete-scanner, author-only or absent-review evidence is passing.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 65e993df-a97a-428f-a8d1-d83b984e3f82

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}