feat(security): add standalone directory credential registry

[seonghobae]

Objective

Advance issue #319 with a standalone, provider-neutral local credential-store adapter on top of the exact #344 credential-registry contract. The adapter resolves purpose-scoped, versioned key material without making raw environment variables the long-lived runtime authority.

Exact stack state

• parent feat(security): define provider-neutral credential registry contract #344 exact head: f7335f979eca75b125199760b4f7dc538733b8b0;
• child exact head: 7fe3fb8124bded7f8449ac741fd1339192d0bc5f;
• independently resolved protected main: 55d7ae8647208e301f282350f076eeddaba61d11;
• this child remains intentionally stacked on feat(security): define provider-neutral credential registry contract #344 and Draft so the verified parent identity is not moved.

RED -> GREEN evidence

• RED head f52132c8c55e37bbf2e2e4c9c4d92fbb5cf9ab84: CI run 31422870920, Maven job 93567572945, exact-head checkout verified and testCompile failed at the intentionally missing DirectoryCredentialRegistry production type.
• implementation head 4a46161a2bab0a090c5af8bd4fec23ee1273e765: all 508 tests passed with zero failures/errors/skips, but CI correctly failed the exact 100% branch-coverage gate with one uncovered metadata-validation branch at DirectoryCredentialRegistry.java:111.
• final head 7fe3fb8124bded7f8449ac741fd1339192d0bc5f: exact-head CI run 31423352276 completed successfully. Maven test job 93569129336, buyer-readiness job 93569129423, and Maven merge-compatibility job 93569129500 all succeeded; exact-head fuzz run 31423352066 also succeeded.

The adapter now requires:

• purpose metadata at <root>/<credential>/purpose;
• an exact active version at <root>/<credential>/active-version;
• bounded opaque key bytes at <root>/<credential>/versions/<version>.key;
• safe credential/version identifiers;
• fail-closed handling of missing, blank, malformed, mismatched, non-canonical, empty, oversized, or symlinked registry state;
• defensive secret snapshots through the feat(security): define provider-neutral credential registry contract #344 contract, without raw-key logging or rendering.

Scope boundary

This slice is a read-only standalone adapter foundation. It does not migrate TenantAccessService, ArtifactLinkService, Spring configuration, production bootstrap, or #313 ProductionAuthReadinessConfig; it does not implement credential writes, automatic rotation windows, distributed cache, encryption/KMS custody, or a vendor-specific secret-manager adapter. Environment/config HMAC authority remains an open production gap until later migration slices route runtime consumers through the registry.

Security Scan/SAST evidence is not inferred from the stacked PR because those workflows were not returned for this exact child head; absent evidence is not passing evidence. Before any eventual protected-main merge, integrate #344 first, rebuild/reconcile this unique child delta onto the new exact protected base, and regenerate every required base-sensitive CI/security/review gate. No raw key material may enter logs, exceptions, PR metadata, telemetry, SBOM, or provenance.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c9dd8ff8-bdfb-4fc4-8021-fdeb041a613a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}