- Document .NET SDK version mismatch & NuGet.config solution
- Add Release build with Development environment example
- Include stub API key setup for local Host startup
- Explain why Telerik source is included but not used
Closes: Local build failure on machines with preview SDK only
Verified: Both NuGet.config + appsettings prevent NU1507 errors
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
## Changes
### Security Infrastructure
- **Program.cs**: ResolveSecret() helper for secure secret resolution
- Priority: environment variables (CI/CD) → user-secrets (local) → appsettings (fallback)
- Validates all required secrets at startup (fail-fast)
- **ExternalApiOptions.cs**: Type-safe configuration for external APIs
- KRX OpenAPI (Korea Exchange market data)
- OpenDart API (financial disclosures)
- KIS API (trading & orders)
- Injected via IOptions<T> dependency injection
- **appsettings.json**: Safe placeholders (${VAR_NAME}) instead of hardcoded secrets
- Never stores actual credentials
- Production uses environment variable substitution
### CI/CD Integration
- **.gitea/workflows/secrets-injection.yml**: Automated secret injection
- Receives secrets from Gitea Actions Secrets
- Injects as environment variables at build time
- Masks secrets in logs
- No secrets stored in artifacts
### Local Development
- **docs/SECRETS_LOCAL_DEVELOPMENT.md**: Complete setup guide
- One-time user-secrets initialization
- How to store/update secrets locally
- Troubleshooting for common issues
- **SECRETS_CONFIGURATION_SUMMARY.md**: Architecture & security properties
- Secret resolution priority
- Usage patterns in application code
- Security audit checklist
- Rotation procedures
## Security Properties
✅ Secrets never hardcoded in code
✅ Secrets never committed to git
✅ Secrets never logged or exposed in traces
✅ Secrets never stored in CI artifacts
✅ Local isolation via ~/.microsoft/usersecrets/
✅ CI/CD isolation via Gitea Actions Secrets (encrypted)
✅ Rotation support (update secret → next build uses new value)
## Compliance
- Follows AGENTS.md v16.0 security guardrails
- No magic numbers or hardcoded API keys
- All external API keys managed through centralized options
- Type-safe dependency injection eliminates string-based configuration
## Next Steps
1. Local dev: Run `dotnet user-secrets init` and configure
2. CI/CD: Add secrets to Gitea Actions Secrets
3. Verify: `dotnet run` should work without "secret is required" errors
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Strengthen documentation coherence and navigation:
README.md:
- Add 'Developer's Document Guide' section at top
- Link to CLAUDE.md, AGENTS.md, architecture, guardrails, validation gates
- Reference docs/INDEX.md and TECH_DEBT_REGISTER.md
docs/INDEX.md (new):
- Central documentation index with purpose and audience
- Core guides, executive/planning, tech debt, reference docs
- Quick links for first change, architectural decisions, validation
TECH_DEBT_REGISTER.md (new):
- Tech debt tracking per AGENTS.md v16.0
- 8 registered debts (code analysis suppressions, deferred refactoring)
- Impact/Effort matrix with paydown strategy (quarterly 20% target)
- Status tracking with completion history
- How-to guide for resolving debt
CLAUDE.md:
- Update TECH_DEBT_REGISTER reference from 'to be created' to actual link
Result:
- Developers land on README → directed to CLAUDE.md or AGENTS.md
- All docs cross-reference each other for circular navigation
- Tech debt fully visible and tracked with clear paydown roadmap
- docs/INDEX.md provides comprehensive reference point
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
kjh2064