[CDC privacy] Bound replication-slot details in Actuator health output

[seonghobae]

Product / privacy gap

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 has CdcEngineHealthIndicator.health() attach the entire ReplicationSlotProbe.probeConfiguredSlot() map as the replicationSlot health detail. The probe map can contain slot names, LSN positions and provider/driver-derived diagnostics on the protected baseline. Spring Boot may hide component details by default, but deployments can legitimately enable health details for operators; the health contributor itself should therefore remain safe under that supported configuration rather than depending on presentation defaults.

This is distinct from #170, which sanitizes ReplicationSlotProbe failure diagnostics. Even after #170, the health boundary should publish only purpose-bound health state rather than transport every probe field by default. The source path for this slice is CdcEngineHealthIndicator plus its focused tests; #170 remains owner of the probe implementation.

RCA

• Immediate cause: builder.withDetail("replicationSlot", slot) forwards the complete probe map.
• Technical root cause: low-level diagnostic/probe representation and public Actuator health representation share the same object without a disclosure policy.
• Control failure: existing health tests assert status/running/source type but never assert confidentiality or a finite health-detail schema.
• Impact: when health details are enabled, infrastructure identifiers, LSNs, and provider-derived text can become part of an otherwise routine readiness/status response. It also makes the public health schema expand automatically whenever the probe gains a field.

Bounded remediation

Create a fixed health projection rather than forwarding the probe map. Preserve the existing replicationSlot detail key, but include only purpose-bound finite fields such as availability/found/active state, numeric lag measurements where present, and a stable known error classification. Do not copy slot names, LSN positions, plugin/type names, raw message text, exception/provider diagnostics, arbitrary future probe fields, credentials, endpoints, principals, or payload values.

The indicator may continue using the full in-process probe map to derive the existing finite slotWarning classifications; this change concerns disclosure, not probe semantics.

TDD acceptance

1. RED test injects a realistic probe map containing slot name, restart/flush LSN, provider diagnostic text, arbitrary future sensitive field and valid state/lag fields through the real CdcEngineHealthIndicator.health() boundary.
2. Before production change, the test proves those raw details are currently republished.
3. GREEN keeps replicationSlot present with bounded state/lag/error classification and preserves existing UP/DOWN/idle and slot-warning semantics.
4. No raw message, slot name, LSN, plugin/type, arbitrary map field or exception-derived text appears in health details.
5. Touched public constructor/health behavior has beginner-readable Javadoc.
6. Focused/full CDC and reactor tests pass, with current dependency/SBOM/SAST/security evidence; accepted non-vacuous owned-production coverage and exact-source/review gates are still required before protected integration.

Relationship: #170 probe diagnostic confidentiality; #182 production-safe observability defaults; #159 canonical security/operability traceability.