[Test/Compatibility] Preload Mockito agent instead of dynamic self-attachment

[seonghobae]

Buyer / release risk

mightyETL supports Java 25. Test/release evidence must not depend on runtime self-attachment that OpenJDK is preparing to disallow by default. The supported build also needs Mockito inline capabilities without sacrificing JaCoCo's startup agent or non-vacuous coverage evidence.

Status: active_pr via #302. No protected develop capability claim is made until the exact PR head integrates.

Corrected RCA from current execution

The original diagnosis was incomplete. The repository did not merely omit a startup Mockito agent; it also deliberately forced Mockito's subclass mock maker in three modules:

• cdc-service/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker
• etl-service/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker
• zuul-gateway/src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker

Each contained mock-maker-subclass. Commit 48d6b75f5dbaad3e9542283532a549df230fe0fe records why: Mockito 5.21.0 was introduced with the subclass maker as a workaround for newer-JDK inline-agent attachment warnings.

That workaround prevents Mockito 5's default inline mock maker from becoming active even when mockito-core is supplied as a startup -javaagent.

Falsified hypotheses and valid RED

1. PR test(build): reproduce Mockito self-attach failure on Java 25 #302 probe 364ce21a4a4737948b4b009a6fbd713c0d6abaa1 added -XX:-EnableDynamicAgentLoading. Hosted tests passed, proving existing tests did not necessarily exercise inline instrumentation.
2. RED head 3692f5e067c9f324768158a71ab9c4dcf0700f5e added a production-boundary final-class mocking contract. Hosted CI 31588232800 failed at that exact contract rather than compilation, dependency resolution, or fixtures.
3. Head 3f90e05c34d345642995d7c6b1907e280a697f3f added the official startup-agent pattern with Surefire late @{argLine} composition and retained -XX:-EnableDynamicAgentLoading. Current-head CI 31589058471 still failed on all hosted OS jobs because the explicit mock-maker-subclass resources continued to select the subclass maker. The Ubuntu synthetic integration used Java 25.0.4; 304 ETL tests passed, JaCoCo analyzed a non-empty bundle of eight owned production classes with all checks met, and CDC then failed exactly because the final class could not be mocked.

The first failing boundary is therefore the repository-owned mock-maker override, not Java-agent loading or JaCoCo composition.

Current root-cause-changing remedy

PR #302 exact head 0732eca77964ad2e94dfd9e978bb29714d98667b removes all three obsolete mock-maker-subclass overrides while retaining:

• Mockito 5.21.0 as an explicit test-JVM startup -javaagent;
• -XX:-EnableDynamicAgentLoading as the fail-closed compatibility probe;
• late @{argLine} composition so JaCoCo continues to own its startup instrumentation argument.

This is test configuration only; no production runtime agent or application behavior is changed.

Fresh exact-head workflows are CI 31591244105, Dependency Review 31591244053, SBOM 31591244012, SAST Semgrep 31591244087, and Security Scan 31591244015. They are pending and therefore not passing evidence yet.

Distinct remedies / feasibility

1. Execute now — remove the obsolete subclass-maker overrides while using startup instrumentation. Smallest remedy that changes the confirmed root cause and restores Mockito 5's inline maker consistently across test modules.
2. Module-local mock-maker-inline override. Technically possible but inferior unless a module-specific need is demonstrated; it would retain unnecessary configuration drift rather than rely on Mockito 5's maintained default.
3. Remove tests that need inline mocking. Rejected unless a design change independently removes the need; weakening the RED would destroy the acceptance boundary.
4. Enable dynamic loading permanently with -XX:+EnableDynamicAgentLoading. Rejected; it preserves the capability JEP 451 is intentionally constraining rather than moving instrumentation authority to JVM startup.
5. Suppress self-attachment warnings. Rejected; warning filtering cannot provide future-JDK compatibility.
6. Replace JaCoCo's argLine. Rejected; it can silently destroy coverage evidence.

Acceptance

Merge is allowed only on one unchanged exact head after all of the following are freshly proven:

1. the final-class Mockito contract passes with -XX:-EnableDynamicAgentLoading still active;
2. no Mockito/Byte Buddy self-attachment warning appears in hosted test logs;
3. Mockito is loaded at JVM startup from the repository's pinned mockito-core version;
4. JaCoCo still receives its startup agent, selects a non-empty owned-production bundle, and meets the repository's zero-missed statement/branch thresholds;
5. the full hosted OS matrix and every current dependency/SBOM/SAST/security gate pass;
6. existing unit/integration behavior is unchanged and no test is skipped or weakened;
7. current-head automated findings are resolved or proven stale/superseded;
8. a qualifying independent non-author formal APPROVED review exists for the unchanged final head;
9. canonical Test Strategy/doctoring/Traceability records the startup-agent authority and rollback interaction when its dedicated documentation writer lane is safe.

References (APA 7th)

Mockito. (2026). Mockito 5.21.0 API: Explicitly setting up instrumentation for inline mocking (Java 21+). https://www.javadoc.io/static/org.mockito/mockito-core/5.21.0/org.mockito/org/mockito/Mockito.html

OpenJDK. (2026, January 9). JEP 451: Prepare to disallow the dynamic loading of agents. https://openjdk.org/jeps/451

[seonghobae]

Protected integration is now complete through merged PR #305. Fresh protected develop@f340d37caba9df0d4aeb88e5d18b78bd8cca4b60 is exactly #305's merge commit. On that protected head, root pom.xml pins Mockito 5.21.0, resolves mockito-core for Maven Surefire startup instrumentation, composes @{argLine} -javaagent:${org.mockito:mockito-core:jar} -XX:-EnableDynamicAgentLoading, and the repository contains both MockitoStartupAgentContractTest and MockitoMockMakerOverrideContractTest. #305's unchanged-head hosted proof completed Ubuntu/macOS/Windows plus dependency review, SBOM, SAST and security, with Java 25 final-class mocking green, a non-empty JaCoCo production bundle, and no Mockito/Byte Buddy self-attachment warning. The three legacy mock-maker-subclass overrides were removed and the repository-wide regression contract prevents their reintroduction. Closing this issue as implemented on protected develop; historical #302 evidence remains superseded rather than transferred.