[ancongui]

Current source: a2469ed673590cc7c9ac5610adae0354dc807109.

Issuer-bound OPA rules denied authenticated requests because the outgoing policy subject omitted the validated principal issuer. Project the issuer when present, preserving the original four fields for legacy principals without an issuer. Claims, attributes, headers and request context do not supply the subject issuer.

Validation: 13 direct-source adapter cases pass, including three new request-serialization regressions; Root independently repeats all 13. Four offline evaluations of exact adapter request input pass against the unchanged terminal/domain Rego policies. Full latest-head reactor CI and the rebuilt signed consumer journey remain pending. No authentication, policy, financial acceptance or release is inferred from the offline checks.

The existing orchestration REST switch now also gates the workflow management controller. Setting firefly.orchestration.rest.enabled=false removes its HTTP surface while retaining workflow engine, registry, services, signals and timers. Four real Spring reactive-context regressions pass, including the maintained failing case; default/true behavior and the independent engine switch are preserved. Root independently repeats all four, and strict production compilation matches. No workflow management operation, financial service or release is qualified by these configuration tests.

The observability environment postprocessor now preserves the host application's effective auto-configuration exclusion list using Spring Boot Binder. Previously, indexed YAML exclusions could disappear when tracing bridge exclusions were added, unexpectedly activating database auto-configuration in stateless applications. Four new controls cover indexed YAML, property-source precedence, comma-separated compatibility and disabled tracing; all twelve existing controls remain passing. Root independently repeats all sixteen and the strict production-only class matches. An explicit full-source aggregate of the existing organization Domain Main now starts and serves its real current-controller metadata with zero cleanup errors. Original Domain SDK generation, current-head hosted CI and coordinated released-artifact adoption remain separate work.

The preceding persistence block wraps four diagnostic correlation String fields in cache/event-sourced persistence and adds twelve regression controls. Independent validation passes190 selected cases, strict137-unit production compilation into157 matching classes, AST preservation of all13 log templates/levels and23 actual CodeSource bindings. Stored keys/state/events/projections/MDC/results and Throwable identity remain unchanged.

Current-head hosted checks and CodeQL closure are pending. Preceding a1bb source passes all11 hosted checks; exact-merge Java analysis2036572469 reports37medium/zero high with15 target closures and four newly reported persistence diagnostics. This source correction covers those four, but their closure requires actual new-head analysis.

This draft improves framework runtime integration, bounded transaction support, SDK generation compatibility, and diagnostic handling while preserving application overrides and default-off generator options.

The combined changes cover durable JDBC Batch execution and process recovery, persistent TCC acknowledgement choices, CQRS type resolution, scoped idempotency, startup metadata discovery, scalar-enum R2DBC criteria, UTC auditing, cryptographic account-number generation, and AES configuration compatibility. Boot 4 OAuth client wiring uses production modules, JWT tenant projection and policy decisions remain explicit, and nullable SDK serialization uses the existing Jackson builder. Restricted HTML rendering and offline schema validation retain their documented limits.

Diagnostics use the shared kernel LogFields helper. The preceding diagnostic block updates four starter-data production files and adds twelve regression cases. String diagnostic fields are escaped only inside logger calls. Synchronous job diagnostics report payload presence and response class without traversing maps or formatting request/response bodies. Five message templates change to describe these reduced diagnostics. Persistence values, metrics tags, events, MDC, responses, exception propagation, and Throwable identity remain unchanged.

Validation is scoped to the exact source and execution:

• The preceding starter-data block passes 80 selected regression cases and a production-only compile of 80 source units into 126 classes. Root independently repeats both. Production class bytes match the full test compile, and AST checks preserve non-logging source bytes, log levels, and the disclosed template boundary.
• Earlier original Maven qualification covers the bounded R2DBC reactor: five modules, 25 XML suites, 192 cases and twelve packaged JARs. This remains evidence for its recorded source; later logging edits do not retrospectively acquire that full-reactor result.
• The preceding public e4a13ca head passes all eleven applicable hosted checks, including Docker, library installation and maintained examples. Its exact-head Java analysis reports 55 medium and zero high findings, with nine targeted findings removed and no new finding IDs. The preceding7665c0a9 head passes all eleven applicable hosted checks, including Docker, full reactor/library installation and maintained standalone examples. Java analysis2035231439 on merge57095da4 reports48 medium and zero high findings; exactly seven targeted IDs are removed with no new IDs. This hosted result is separate from released artifacts and owner adoption.

Current artifact availability, coordinated releases, owner adoption, native and live-provider integrations, broader financial journeys, and consumer acceptance remain separate work. This draft does not claim those outcomes.