feat: Make provider credentials auditable and adapter-specific

[StatPan]

Closes #169

[StatPan]

Check

Self-review packet for ticket #169 and PR #170.

• PR readiness: blocked
• Finish ready: false
• Blockers: checks_pending
• Diff summary: 7 files changed, +474/-18
  • .env.example: +5/-0
  • README.md: +24/-0
  • internal/cli/cli.go: +43/-17
  • internal/cli/credential_audit.go: +221/-0
  • internal/cli/credential_audit_test.go: +84/-0
  • internal/cli/credentials.go: +95/-0
  • internal/cli/source_candidate_verify.go: +2/-1
• Acceptance mapping candidates:
  • Provider-specific keys are never substituted with a data.go.kr key. -> manual verification required
  • auth check or a focused audit command reports value-free credential-group readiness and its source contract. -> internal/cli/credential_audit.go, internal/cli/credential_audit_test.go, internal/cli/credentials.go, internal/cli/source_candidate_verify.go
  • An explicit bounded live audit writes a redacted receipt and classifies auth, approval, quota, input, provider, and unknown outcomes without treating operation parameters as a key failure. -> internal/cli/credential_audit.go, internal/cli/credential_audit_test.go
  • Tests prove precedence, absence, redaction, and each classification boundary with fake HTTP. -> manual verification required
  • Documentation tells operators how to run the audit without exposing credential values. -> internal/cli/credential_audit.go, internal/cli/credential_audit_test.go, internal/cli/credentials.go
• Risk areas: Go runtime code changed, documentation changed
• Full diff: gh pr diff 170 --repo StatPan/datapan-cli

Reviewer notes:

• Findings: none recorded by this self-review command.
• Test gaps: verify local and CI evidence before finish.
• Recommended action: continue normal review/check/finish flow.

Context:

• Ticket: Make provider credentials auditable and adapter-specific #169
• Status: In review
• Linked PR: feat: Make provider credentials auditable and adapter-specific #170
• Blockers: checks_pending
• Next: wait for required checks to finish or fix failing checks

[StatPan]

Check

Self-review packet for ticket #169 and PR #170.

• PR readiness: ready_for_finish
• Finish ready: true
• Diff summary: 7 files changed, +474/-18
  • .env.example: +5/-0
  • README.md: +24/-0
  • internal/cli/cli.go: +43/-17
  • internal/cli/credential_audit.go: +221/-0
  • internal/cli/credential_audit_test.go: +84/-0
  • internal/cli/credentials.go: +95/-0
  • internal/cli/source_candidate_verify.go: +2/-1
• Acceptance mapping candidates:
  • Provider-specific keys are never substituted with a data.go.kr key. -> manual verification required
  • auth check or a focused audit command reports value-free credential-group readiness and its source contract. -> internal/cli/credential_audit.go, internal/cli/credential_audit_test.go, internal/cli/credentials.go, internal/cli/source_candidate_verify.go
  • An explicit bounded live audit writes a redacted receipt and classifies auth, approval, quota, input, provider, and unknown outcomes without treating operation parameters as a key failure. -> internal/cli/credential_audit.go, internal/cli/credential_audit_test.go
  • Tests prove precedence, absence, redaction, and each classification boundary with fake HTTP. -> manual verification required
  • Documentation tells operators how to run the audit without exposing credential values. -> internal/cli/credential_audit.go, internal/cli/credential_audit_test.go, internal/cli/credentials.go
• Risk areas: Go runtime code changed, documentation changed
• Full diff: gh pr diff 170 --repo StatPan/datapan-cli

Reviewer notes:

• Findings: none recorded by this self-review command.
• Test gaps: verify local and CI evidence before finish.
• Recommended action: continue normal review/check/finish flow.

Context:

• Ticket: Make provider credentials auditable and adapter-specific #169
• Status: In review
• Linked PR: feat: Make provider credentials auditable and adapter-specific #170
• Blockers: none
• Next: merge when policy checks pass

[StatPan]

Check

Independent acceptance review

Verdict: approve. Scope is limited to #169; no #171 changes.

• Provider selection: credentialForOperation resolves OpenDART and Seoul Open Data only from their declared groups; the focused fake-env test proves a data.go.kr key is not substituted.
• Readiness: auth check --json and doctor --json expose only group IDs, accepted/selected environment-variable names, presence, and live_verified:false; no credential values or hashes are emitted.
• Bounded audit: auth audit requires --live, one ref, one operation, and a receipt path. It makes at most one request, and missing auth/input ends before HTTP. Fake HTTP cases cover verified, approval-required, rate-limited, credential-invalid, input-required, provider-unavailable, and unknown.
• Redaction: receipt structure excludes URLs, parameter values, response bodies, credential values, and hashes. Focused test redacts an echoed credential; a scrubbed-environment CLI run wrote a missing-auth receipt with request_budget=0 and attempted=false.
• Local verification: go test ./..., go vet ./..., go build ./cmd/datapan, diff whitespace check, and six GitHub CI/Registry Journey checks passed.

Current execution has no configured data.go.kr, OpenDART, or Seoul Open Data credential, so no provider request was made and no successful live validation is claimed. This is compliant with the task completion boundary: absent groups are explicit rather than successful.

Context:

• Ticket: Make provider credentials auditable and adapter-specific #169
• Status: In review
• Linked PR: feat: Make provider credentials auditable and adapter-specific #170
• Blockers: none
• Next: merge when policy checks pass