fix(cdc): keep stop failure diagnostics out of API responses

[seonghobae]

Purpose

Close bounded confidentiality/control-boundary defects in the CDC start/stop API without changing Debezium lifecycle semantics. Protected stop failures historically returned raw IOException diagnostics, while runtime failures during start() escaped the controller entirely. Database, offset-store, filesystem, broker, provider, or credential-adjacent diagnostics are not part of the public API contract.

This remains a direct-develop, two-file Draft limited to CdcController and its test. It does not overlap #139's CdcService acknowledgement work, #141's graceful-stop completion decision, #170's slot probe, #171's DDL logging, or #190's service-log diagnostics.

Exact current identity

• protected/live base: develop@622e5e6c3d534f230c390f10e3832efadfc01825;
• branch: fix/cdc-stop-safe-error-622e5e6;
• original stop fail-first head: 574b61152dd4bb8a6904fec3cdfa36e7cd9c382f;
• stop GREEN head: b00077e9afdd857566cd6c60e1f433117aa147fe;
• follow-on start fail-first head: 3a872c9eba23efc38bbbeb5ce3814d83788e0a2f;
• exact current GREEN head: 69dcccfe0a608e79ec1fea4098747943ab5aa86c;
• current synthetic merge preview: 3aeb454e5e95b068344bf2a1388f078de9419dbb;
• GitHub mergeability: true;
• Draft: true.

Every gate/review from a predecessor source head is historical and does not transfer.

RCA / TDD

Stop diagnostic leak

Historical controller code appended IOException.getMessage() to the HTTP 500 body. RED 574b611... injects a credential-bearing JDBC shutdown diagnostic and requires stable body CDC process could not be stopped; hosted CI failed at that exact boundary. GREEN b00077e... removes exception-derived response text without changing stop/lifecycle semantics.

Start runtime failure boundary

Fresh source inspection then found startCdc() invoked cdcService.start() with no failure boundary. CdcService.start() can surface runtime startup/configuration failures; a sensitive provider/configuration exception therefore escaped the controller entirely. This disproved the narrower hypothesis of another getMessage() concatenation: the actual defect was an absent runtime exception boundary.

RED 3a872c9eba23efc38bbbeb5ce3814d83788e0a2f makes cdcService.start() throw an IllegalStateException carrying a credential-bearing PostgreSQL URL and requires HTTP 500 with stable body CDC process could not be started. CI 31350143839, macOS job 93339265195, executed synthetic merge b6891ba37ea2da9f7331f35ec6e2f2e06444c3c7; CDC ran 107 tests with exactly the new start test erroring because the raw runtime exception escaped CdcController.startCdc.

GREEN 69dcccfe0a608e79ec1fea4098747943ab5aa86c catches RuntimeException around startup, returns only the stable public error, deliberately does not catch Error, and adds beginner-readable Javadoc to both start/stop control methods.

Current-head hosted verification

For exact source head 69dcccfe0a608e79ec1fea4098747943ab5aa86c:

• CI 31350324069: aggregate success on macOS/Ubuntu/Windows;
• Dependency Review 31350324095: success;
• CycloneDX SBOM 31350324056: success;
• SAST Semgrep 31350324063: success;
• Security Scan 31350324057: aggregate success, not accepted as complete security evidence.

CI macOS job 93339740489 checked out synthetic merge 3aeb454e5e95b068344bf2a1388f078de9419dbb, not literal source head. It ran ETL 275/275 green, CdcControllerTest 7/7 green, CDC 107/107 green, gateway tests green and completed the full reactor successfully. The same log reproduces the protected JaCoCo false-green: report and check each say Analyzed bundle 'etl-service' with 0 classes followed by coverage checks met (#162/#164).

Hard Trivy job 93339740495 also checked out synthetic merge 3aeb454e... and printed Dependency version cannot be determined. Child dependencies will not be found. before returning zero CRITICAL/HIGH/MEDIUM findings. #196 owns this scanner-completeness defect. A zero-findings SARIF with explicitly incomplete Maven dependency resolution is non-passing under mightyETL acceptance despite the aggregate green conclusion.

Source identity, scanner dependency-graph completeness, inherited dependency remediation (#160), and coverage non-vacuity are independent shared controls. None is patched or suppressed in this controller-only PR.

Review / merge boundary

Formal review/threads must be freshly re-read before any ready/merge transition. Keep Draft. Do not merge until the unchanged exact source head has accepted literal-source CI/security evidence, complete same-revision dependency/vulnerability evidence with no #196 incompleteness, non-vacuous owned-production coverage under #162/#164 or equivalent accepted repair, every current required dependency/SBOM/SAST/security gate passes, zero valid unresolved review findings remain, and qualifying independent non-author approval exists where governance requires it. No predecessor-head, other-PR, status-only, skipped-required, incomplete-scanner or synthetic-merge-only evidence transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 080af8ed-9fc5-4411-bc00-59c2c93e4261

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}