Provide a released cross-language governed transport for mightyETL stock-data acquisition

[seonghobae]

Consumer and owner boundary

User requested stock-data collection in CWL libraries on 2026-09-07. The consumer implementation is being added to ContextualWisdomLab/mightyETL as a Java provider ACL in the existing ETL host, rooted at develop@e550688c80f0dcf4677c0fbe50bd3341429106fb. EgressWeave owns outbound policy/transport, not stock-field semantics. The consumer has no default HTTP client, credential resolution, network fallback, or copied owner source.

Live owner inspection found a Python HTTPX library on protected main and no native Rust binding in the root inventory. OriginWeave's protected README explicitly marks HTTP adapters unshipped, and its release listing was empty. These observations do not imply every private deployment is absent; they mean the consumer cannot truthfully select a verified immutable cross-language release from the evidence available.

Required transport contract

A host-supplied StockDataTransport.fetchPage(PageRequest) receives a fixed secret-free endpoint, immutable public query, page number and opaque credential reference. It returns status, media type and an owned response stream. Initial endpoint: https://apis.data.go.kr/1160100/service/GetStockSecuritiesInfoService/getStockPriceInfo. Only GET is needed. Public parameters are basDt or beginBasDt/endBasDt, optional isinCd, pageNo, numOfRows, and resultType=xml. The transport, not the consumer, resolves the approved FSC service key and encodes it exactly once as serviceKey.

Implement the reusable cross-language authority in this owner (Rust runtime preferred), with a released client/API/ABI contract. Keep acquisition denied until a concrete approved binding exists. Do not implement provider-specific stock models here, install a Python workaround into the Java consumer, or depend on a mutable sibling branch.

RED/GREEN acceptance

• Missing credential authority, wrong endpoint/method, insecure TLS, nonpublic DNS or rebound address: zero connection/body disclosure.
• Approved DNS answers must actually bind the socket; no validate-then-resolve TOCTOU. Redirects and ambient proxies are off for this profile.
• Provider key absent from logs, exception chains/suppressed errors, request formatting, telemetry, provenance and output artifacts.
• Bound connect/read/write/pool inactivity, DNS, streamed body bytes and decompression; preserve explicit user cancellation. This ordinary data-download profile is not an LLM model-duration policy.
• GET requests sequential within a collection; enforce provider/account-wide rate/concurrency budgets across collectors. A 429 or failed authentication cannot trigger key/proxy rotation or HTML scraping fallback.
• Always close the response on malformed media, over-limit data, parser failure, cancellation and success. No partial successful batch on transport failure.
• Unit hostile cases followed by actual keyed FSC retrieval of a known published reference day; distinguish delayed-daily data from realtime quotes.
• Independent review, exact-head CI/security, provenance/SBOM and immutable release coordinates; only then adopt the release in mightyETL and run owner/consumer conformance at exact revisions.

Official provider reference: Financial Services Commission. (n.d.). 금융위원회_주식시세정보. Public Data Portal. https://www.data.go.kr/data/15094808/openapi.do (accessed 2026-09-07). The portal states next-business-day publication after 13:00, not realtime. Primary wire-guide verification and service approval remain explicit live-release gates.

This is a real dependency gap, not a claim that the stock collector is operationally ready. No owner source has been modified or release created by this issue.

[seonghobae]

Consumer implementation is now published: ContextualWisdomLab/mightyETL#333 at 06ccc7f688eef135ff13bf105076f62f2879abfd (Draft).

The exact port is etl-service/src/main/java/com/xtrmetl/etl/stock_data/StockDataTransport.java; its published blob 87194645577c3f17e09d82273ec3d97a08941ead matches the locally tested source. PageRequest.sourceEndpoint() is fixed and secret-free, publicParameters() is immutable, credentialReference() is opaque, and PageResponse transfers stream ownership. Collector entrypoint: FscStockDataSource.collectStockData.

The consumer intentionally has no concrete network implementation, so this owner issue is a real functional prerequisite, not optional post-release hardening. Implement/review/release the shared authority here, then adopt its immutable contract and prove actual keyed FSC retrieval in the consumer. A port/test double or an owner issue alone must not be reported as live stock-crawling support.

Consumer evidence: local 245 unit assertions and warning-free Java compilation/Javadoc; GitHub CI 34115900752 Java 25 reactor succeeded for the exact head/base test merge on Ubuntu/Windows/macOS. This evidence does not transfer to future transport code or prove production network safety.