# KBX v22 Validation Report

## Static governance performed in this package

- 33 configuration keys / environment-variable uniqueness
- TypeScript ↔ C# configuration catalog Source SHA parity
- Secret settings cannot contain defaults and generated secret examples are blank
- KRX / OPENDART / KIS provider credential keys are represented in the central configuration catalog
- Required/conditional-required/enum/integer-range/URI runtime validation contracts
- Production `predeploy` migration and HTTPS policy
- Production Debug logging prohibition in the reference policy
- Test environment live-provider network prohibition
- direct `Environment.GetEnvironmentVariable()` usage outside Shared/Configuration prohibited
- destructive SQL migration guard
- immutable artifact / Staging → Production promotion contract
- Gitea release-readiness workflow contract
- all pre-existing KBX v21 governance gates
- `@kbx/contracts` strict TypeScript compile

## Host repository mandatory gates

이 Starter 환경에서는 실제 운영 배포를 성공했다고 주장하지 않는다. 실제 제품 Repository에서 다음을 수행한다.

1. .NET 10 restore/build/xUnit
2. Host startup에서 `KbxConfigurationStartupValidator.ValidateOrThrow()` 실행
3. 실제 Secret Store/User Secrets/환경변수 바인딩 검증
4. DbUp 001~014를 ephemeral PostgreSQL에 적용
5. Staging/Production DB migration dry-run 및 backup/restore rehearsal
6. Production startup에서 schema auto-apply가 발생하지 않는지 검증
7. 동일 build artifact SHA가 Staging → Production으로 승격되는지 검증
8. Serilog/OTel 구성 후 non-secret configuration fingerprint와 contract version이 운영 로그/배포기록에 남는지 확인
9. KRX/OPENDART/KIS가 disabled이면 credential 미설정 상태에서도 정상기동하는지 확인
10. Provider enabled 시 credential missing/placeholder가 startup에서 차단되는지 확인
11. Vite/Vitest/Playwright 및 canonical scenario smoke
12. Gitea release-readiness workflow를 실제 runner에서 실행
