Demo/dev pr md

[coutMinh]

Last year i lost u, :<

[bitdive-review]

BitDive Runtime Review - PR #1604

PR: #1604
Branch: demo/dev-pr-md -> main
Method: BitDive runtime trace comparison + direct HTTP verification + targeted code inspection
Verdict: APPROVE
Confidence: High — all runtime-traceable services confirmed stable

Summary

This PR is a large CI/CD and documentation overhaul (291 files: Jenkinsfiles, ArgoCD configs, GitHub Actions, Docker, frontend, markdown). The only production Java change is a single @SuppressWarnings("unchecked") annotation on backoffice-bff/SecurityConfig.userAuthoritiesMapperForKeycloak() — a compiler directive with zero runtime behavioral impact.

Four trace-paired runtime scenarios across product, location, customer, and inventory services all show zero contract divergence with clean baselines. No behavioral regression was introduced. Frontend changes (17 production files) are not JVM-traceable and were not runtime-verified.

Runtime Verification Matrix

Area	Result	Behavior Δ	Meaning	Evidence
backoffice-bff SecurityConfig	Stable	compiler annotation · zero runtime impact · no bytecode change	No behavioral risk from the only prod Java change	code inspection
Product listing	Stable	zero contract drift (200 · 4 steps · 3 SQL)	Core catalog path unchanged	before / after
Location countries	Stable	zero contract drift (200 · 249 nodes · 1 SQL)	Reference-data path unchanged	before / after
Customer guest-user create	Stable	zero contract drift (200 · 4 steps · 0 SQL · email random only)	Guest creation path unchanged	before / after
Inventory warehouses	Stable	zero contract drift (200 · 3 nodes · 1 SQL)	Warehouse query path unchanged	before / after
Media deploy canary	Stable	HTTP 200 v3/api-docs	Service deployed and responsive	HTTP only

How to read BitDive evidence

Behavior Δ (matrix) and the red/green diff blocks inside each Change are the contract summary.
Evidence links open the full BitDive share: call tree · SQL · writes · downstream · first divergence.

• Trace pair — full JVM trees compared before/after
• HTTP only — status/body verified; no JVM tree
• Code only — source inspection only
• Replay — see Replay section when present

Review scope and validation coverage

storefront / backoffice canaries
  -> product   -> ProductController.getProductsByMultiQuery()      [stable]
  -> location  -> CountryController.getCountries()                [stable]
  -> customer  -> CustomerController.createGuestUser()           [stable]
  -> inventory -> WarehouseController.getWarehouses()            [stable]
  -> media     -> v3/api-docs deploy canary                       [HTTP stable]

production Java change
  -> backoffice-bff -> SecurityConfig.userAuthoritiesMapperForKeycloak()  [compiler annotation]

Behavior	Scenario	Evidence	Status
Maven compilation	customer, location, payment, product, inventory, media	Build verified	Compiled
Product list	GET storefront products	Trace pair	Stable
Location countries	GET storefront countries	Trace pair	Stable
Guest user create	POST storefront guest-user	Trace pair	Stable
Warehouse list	GET backoffice warehouses	Trace pair	Stable
Media canary	GET v3/api-docs	HTTP only	Deployed
SecurityConfig annotation	@SuppressWarnings on mapper bean	Code only	Zero runtime impact

Out of scope: CI/CD YAML (Jenkins, ArgoCD, GitHub Actions), Docker files, frontend production files (not JVM-traceable), K8s Helm charts.

Change #1 - backoffice-bff SecurityConfig compiler annotation

The only production Java source file changed in this PR is backoffice-bff/src/main/java/com/yas/backofficebff/config/SecurityConfig.java. The diff is exactly one added line: @SuppressWarnings("unchecked") on the userAuthoritiesMapperForKeycloak() bean method. This suppresses a compiler warning about an unchecked cast in the authorities mapper — it has no effect on generated bytecode behavior.

Behavior contract

# SecurityConfig.userAuthoritiesMapperForKeycloak() — compile-time only
  @Bean
  @Override
+ @SuppressWarnings("unchecked")
  public GrantedAuthoritiesMapper userAuthoritiesMapperForKeycloak() {
      // method body unchanged

No runtime contract change. HTTP, SQL, downstream REST, and data layers are unaffected.

Change #2 - stable flows (no collateral regression)

All four trace-paired scenarios show CLEAN/CLEAN baselines with zero contract divergence:

Flow	Before steps	After steps	Divergence	Latency
Product list	4 nodes, 3 SQL	4 nodes, 3 SQL	timestamp noise only	29.8ms → 36.8ms
Location countries	249 nodes, 1 SQL	249 nodes, 1 SQL	none	132.8ms → 595.6ms (cold-start)
Guest user create	4 nodes, 0 SQL	4 nodes, 0 SQL	random email (expected)	comparable
Inventory warehouses	3 nodes, 1 SQL	3 nodes, 1 SQL	none	171.4ms → 1252.4ms (cold-start)

Latency increases on location and inventory are cold-start effects after head redeploy, not behavioral regressions. The product-list warm request (36.8ms vs baseline 29.82ms) confirms normal operation once JIT-warmed.

Trace evidence

Trace	HTTP	SQL	Downstream	Result
before product	200	3 queries	MediaService.getMedia()	clean
after product	200	3 queries	MediaService.getMedia()	zero drift
before location	200	1 query	none	clean
after location	200	1 query	none	zero drift
before guest-user	200	0 queries	none	clean
after guest-user	200	0 queries	none	zero drift
before warehouses	200	1 query	none	clean
after warehouses	200	1 query	none	zero drift

Follow-Ups

Type	Item
Non-blocking	Frontend production files (17 files) are not JVM-traceable — human review recommended for UI changes
Informational	GitHub branch protection blocks merge (mergeStateStatus=BLOCKED) — requires human merge action

Recommendation

Approve. The only production Java change is a @SuppressWarnings compiler annotation with zero runtime impact. All four trace-paired services (product, location, customer, inventory) confirm zero behavioral regression with clean baselines. The PR is safe to merge from a runtime behavior perspective.