fix(supply-chain): retire unsafe Replit Zipkin bootstrap

[seonghobae]

Purpose

Advance #168 with a bounded supply-chain/operability repair from protected develop@622e5e6c3d534f230c390f10e3832efadfc01825. The protected Replit configuration executed a tracked opaque root zipkin.jar, piped mutable https://zipkin.io/quickstart.sh into a shell, and allowed overlapping service-start authorities.

Status: active_pr. This PR remains Draft; nothing here is implemented_on_develop until protected integration.

Exact current identity

• base branch / live tip: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/replit-zipkin-bootstrap-supply-chain-622e5e6;
• exact source head: 50426b24de3c51a112f608fbdb8c3a86f4fc4a8d;
• current synthetic merge preview: 9e7b280f1fcc6718f4252a3f725a204aaa587f6c;
• mergeable: true;
• Draft: true;
• formal reviews: none;
• unresolved review threads: zero.

Every predecessor-head check/review/approval is historical after a head/base change.

TDD / RCA

RED 1 — unsafe bootstrap authority

Fail-first 45d9a5ac09c791ab4ac87ec24e659e86547b0815 added only RepositoryRuntimeSupplyChainTest. Hosted CI failed on all three OS lanes specifically because .replit executed java -jar zipkin.jar and used mutable curl ... | bash; the test reached the repository runtime boundary rather than a fixture/setup error.

GREEN 1

9c62b78853b847a9590503718e016decfe02d0c1 removed Replit Zipkin JAR execution, mutable remote-shell bootstrap, obsolete Replit-only Zipkin publication, and changed the surviving service-start wait boundary to Eureka 8761.

RED 2 / GREEN 2 — competing service starts

5333bbb12a21746a480cc89a86ffbdabe4b85064 required the top-level Project run button to delegate exactly one microservice topology, Run Microservices; 71c3ea4813075905b796b59f73ee0cf46cf8513d removed duplicate top-level service delegates.

The first Windows run then exposed a test parser defect rather than a product defect: the parser searched an LF-only marker while checkout materialized CRLF. Exact current source head 50426b24de3c51a112f608fbdb8c3a86f4fc4a8d normalizes CRLF/lone CR to LF only inside that structural test. It does not change product/runtime semantics.

Current hosted evidence

For exact source head 50426b24de3c51a112f608fbdb8c3a86f4fc4a8d, every exposed aggregate workflow is now terminal-success:

• CI 31337937439;
• Dependency Review 31337937448;
• CycloneDX SBOM 31337937434;
• SAST Semgrep 31337937464;
• Security Scan 31337937440.

This is not literal-source acceptance evidence: current protected PR workflows still execute GitHub's generated pull-request merge revision. Aggregate green cannot change the revision actually checked out. The shared JaCoCo defect also remains separately owned by #162/#164; a tree that can report Analyzed bundle 'etl-service' with 0 classes is not accepted as 100% owned-production coverage evidence.

No formal review or unresolved review thread exists on this unchanged head; CodeRabbit Draft-skip/status evidence is not a qualifying independent approval.

Bounded scope / remaining #168 work

This PR intentionally leaves docker-compose.yml to #167. The root tracked zipkin.jar also remains for now because protected README.md still documents an execution path involving that artifact while canonical docs PR #149 is concurrently owned by another writer. Deleting it here would knowingly race the documentation authority and break a documented path.

Full #168 closure remains: remove the opaque tracked JAR once the canonical documentation/runtime lane is safe, reconcile supported startup/provenance guidance, and add a machine-checkable contract preventing opaque executable reintroduction. Do not invent a checksum/version, substitute another unpinned download, suppress scanner visibility, or add a fake collector.

Merge boundary

Keep Draft. Merge only after accepted source-identity controls, non-vacuous coverage, current security/dependency/SBOM/SAST evidence, zero valid unresolved findings, applicable qualifying independent non-author approval, and branch protection/rulesets all pass on the unchanged exact head. No old-head/base evidence transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7d7bb7ea-12c8-4a2e-9d11-7dee10878878

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}