fix(OPENFRAM-002-19): CU-86akeeczr TenantIdRequiredDebeziumEventValidator marked @Primary but lacks a tenant-isolation feature guard

[flamingo]

Closes findings from rule OPENFRAM-002-19 — TenantIdRequiredDebeziumEventValidator marked @primary but lacks a tenant-isolation feature guard.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟡 70 medium	TenantIdRequiredDebeziumEventValidator marked @primary but lacks a tenant-isolation feature guard	openframe-stream-service-core/src/main/java/com/openframe/stream/handler/TenantIdRequiredDebeziumEventValidator.java:8

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 4f0d6344-55d4-49de-bc86-cac2510f432f

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akeeczr OpenFrame lib batch review findings sweep 2 (13 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff.

[flamingo]

🦩 🟠 TenantIdRequiredDebeziumEventValidator marked @primary but lacks a tenant-isolation feature guard

Added @ConditionalOnProperty(name = "openframe.tenant-isolation.enabled", havingValue = "true") import and annotation to TenantIdRequiredDebeziumEventValidator so the bean (and its @Primary override) only registers when tenant isolation is enabled, preventing it from unconditionally dropping events lacking tenantId on shared/management-plane deployments. Unverified: whether another DebeziumEventValidator bean exists to serve as the default when this one is disabled — a complete fix would require confirming a non-tenant-scoped fallback validator is present in the application context.

🤖 Prompt for AI agents

In openframe-stream-service-core/src/main/java/com/openframe/stream/handler/TenantIdRequiredDebeziumEventValidator.java around line 8, review and complete this code-review fix: TenantIdRequiredDebeziumEventValidator marked @Primary but lacks a tenant-isolation feature guard.
What the draft fix changed: Added `@ConditionalOnProperty(name = "openframe.tenant-isolation.enabled", havingValue = "true")` import and annotation to `TenantIdRequiredDebeziumEventValidator` so the bean (and its `@Primary` override) only registers when tenant isolation is enabled, preventing it from unconditionally dropping events lacking tenantId on shared/management-plane deployments. Unverified: whether another `DebeziumEventValidator` bean exists to serve as the default when this one is disabled — a complete fix would require confirming a non-tenant-scoped fallback validator is present in the application context.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 70 medium — react 👍/👎 to teach the reviewer

[michaelassraf]

Task linked: CU-86akeeczr OpenFrame lib batch review findings sweep 2 (12 PRs)