pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <!-- NOTE: the parent <version> must be hardcoded — Maven resolves the parent
         BEFORE evaluating <properties>, so ${…} references don't work here.
         This is the ONLY legitimate hardcoded version in this file; every other
         version MUST live under <properties>. -->
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.0.6</version>
        <relativePath/>
    </parent>

    <groupId>org.iris</groupId>
    <artifactId>iris</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>iris</name>
    <description>Spring Boot 4 reference application — observability, security, messaging, resilience</description>

    <properties>
        <!--
          Versions not managed by the Spring Boot BOM are pinned here so they are
          visible in one place and can be updated without hunting through <dependency> blocks.

          spring-ai:              milestone release — not yet in the BOM, must be declared explicitly.
          springdoc:              independently versioned; tracks Spring Boot but is not part of the BOM.
          resilience4j:           spring-boot3 artifact is not covered by the Spring Boot BOM.
          bucket4j:               in-memory token-bucket; no Spring Boot BOM entry.
          archunit:               test-only static analysis; independently versioned.
          datasource-micrometer:  JDBC observation bridge; not in the BOM.
          jjwt:                   split into three artifacts (api / impl / jackson) — see dependency block.
          shedlock:               split into two artifacts (spring / provider) — see dependency block.
          testcontainers:         BOM entry exists but pinned here to guarantee kafka module alignment.
        -->
        <java.version>25</java.version>          <!-- virtual threads (Loom) + pattern matching + record patterns -->
        <lombok.version>1.18.44</lombok.version>   <!-- generates @Getter/@Setter/@Builder boilerplate at compile time -->
        <archunit.version>1.4.1</archunit.version> <!-- architecture rule enforcement in unit tests (disabled on Java 25 — see ArchitectureTest) -->
        <bucket4j.version>8.10.1</bucket4j.version>                 <!-- token-bucket rate limiting (in-memory, per IP) -->
        <resilience4j.version>2.4.0</resilience4j.version>          <!-- @CircuitBreaker / @Retry / @Bulkhead annotations -->
        <!--
          Spring AI 1.1.4 GA. Closes five CVEs that were still open on the
          1.0.0-M6 milestone: CVE-2026-22730 (8.8 HIGH), CVE-2026-22729 (8.6 HIGH),
          CVE-2022-27772 (7.8 HIGH), CVE-2023-20883 (7.5 HIGH), CVE-2018-1196 (5.9).
          1.0.0+ renamed the Ollama starter artifact
          (spring-ai-ollama-spring-boot-starter → spring-ai-starter-model-ollama).

          NOTE: the SB4-compat shims under
          src/main/java/org/springframework/boot/autoconfigure/ must stay —
          even 1.1.4 GA still has @AutoConfiguration(after = {
            org.springframework.boot.autoconfigure.web.client.RestClientAutoConfiguration.class,
            org.springframework.boot.autoconfigure.web.reactive.function.client.WebClientAutoConfiguration.class
          }) on OllamaApiAutoConfiguration, pointing at the Spring Boot 3 package.
        -->
        <spring-ai.version>1.1.4</spring-ai.version>
        <!--
          ONNX Runtime — Microsoft's official Java binding for ONNX models.
          Per shared ADR-0060, we use the ONNX format as the cross-language
          inference contract (training in Python, serving identically in
          Java + Python). The 1.21.0 release ships ~30 MB of bundled native
          libs for Linux x86_64, Linux ARM64, macOS x86_64, macOS ARM64,
          Windows x86_64 — covers GKE prod (linux/amd64) + macbook-local
          dev (darwin/arm64).
        -->
        <onnxruntime.version>1.21.0</onnxruntime.version>
        <datasource-micrometer.version>2.2.1</datasource-micrometer.version> <!-- JDBC DataSource observation bridge → query latency in Prometheus -->
        <!--
          springdoc 3.0.3 (upgraded from 3.0.2) — bundles swagger-ui 5.32.2 which patches
          DOMPurify CVEs present in 5.32.0 (mXSS re-contextualization, prototype-pollution
          XSS, predicate bypass — all MEDIUM, dev-only Swagger UI page).
        -->
        <springdoc.version>3.0.3</springdoc.version>
        <pyroscope.version>2.5.2</pyroscope.version>                <!-- continuous profiling agent — pushes CPU/memory profiles to Pyroscope -->
        <testcontainers.version>1.21.4</testcontainers.version>     <!-- 2.0.x core is released but companion modules (junit-jupiter, postgresql, kafka) are not yet published to Central; stay on 1.21.x until they catch up -->
        <jjwt.version>0.13.0</jjwt.version>                        <!-- split into api/impl/jackson — see dependency block -->
        <shedlock.version>7.7.0</shedlock.version>                  <!-- split into spring/provider — see dependency block -->
        <!--
          Tomcat 11.0.21 (upgraded from 11.0.20 via spring-boot-starter-parent BOM override) —
          fixes CVE-2026-34483 (7.5 HIGH), CVE-2026-34486 (7.5 HIGH), CVE-2026-34487 (7.5 HIGH),
          CVE-2026-34500 (6.5 MEDIUM). 11.0.21 is the latest GA on Maven Central.
        -->
        <tomcat.version>11.0.21</tomcat.version>
        <!--
          Netty + postgresql JDBC pinned ahead of SB 4.0.6 BOM defaults to fix
          CVE backlog flagged by grype:scan on 2026-05-10 :
          - netty 4.2.12.Final → 4.2.13.Final (5x High GHSA-mj4r-2hfc-f8p6,
            GHSA-cm33-6792-r9fm, GHSA-57rv-r2g8-2cj3, GHSA-f6hv-jmp6-3vwv ×2
            across compression / dns / http / http2)
          - postgresql 42.7.10 → 42.7.11 (High GHSA-98qh-xjc8-98pq)
          Both will be removed once SB BOM catches up.
        -->
        <netty.version>4.2.13.Final</netty.version>
        <postgresql.version>42.7.11</postgresql.version>
        <!--
          Fabric8 Kubernetes client — used by the `org.iris.chaos` feature
          slice (ADR-0044 port-style decoupling between "which failure to
          inject" and "how to inject it"). The client creates Chaos Mesh
          custom resources (PodChaos / NetworkChaos / StressChaos) in the
          `app` namespace; RBAC is provisioned under
          deploy/kubernetes/base/backend/rbac.yaml. Not covered by the
          Spring Boot BOM, pin explicitly.
        -->
        <fabric8-kubernetes-client.version>7.3.1</fabric8-kubernetes-client.version>
        <!--
          jqwik — property-based testing framework for JUnit 5.
          Test-scope only. Used by AggregationServicePropertyTest to verify
          parallelism invariants across generated input sizes (see Phase 2.5
          T3 in TASKS.md). Not in the Spring Boot BOM, pin explicitly.
        -->
        <jqwik.version>1.9.3</jqwik.version>

        <!-- ──────────────────────────────────────────────────────────────────────
             Build-plugin & analyzer versions
             ──────────────────────────────────────────────────────────────────────
             RULE — never leave a <version>X</version> inside a <plugin>, <dependency>,
             or <parent> block. Always extract it as a property here and reference it
             as ${…-plugin.version}. Reasons:
               1. Single place to audit versions (this <properties> block).
               2. Dependabot/Renovate bumps land in ONE line, not scattered.
               3. Duplicated plugin versions in profiles stay in sync automatically.
             Any hardcoded <version> in the rest of this file is a regression —
             fix it by extracting to a property before merging.
             -->

        <!-- Spring Boot (cross-profile: SB3 compat imports its own BOM + plugin) -->
        <spring-boot-sb3.version>3.4.5</spring-boot-sb3.version>
        <!-- springdoc-sb3.version : pinned in SB3 profile to block V3 Jackson
             transitive (springdoc 3.x is SB4-aware and pulls spring-boot-jackson:4
             → tools.jackson V3). 2.7.0 = last 2.x line targeting Spring 6 / SB3. -->
        <springdoc-sb3.version>2.7.0</springdoc-sb3.version>
        <!-- spring-kafka-sb3.version : pinned in SB3 profile to avoid Spring Kafka 4.x
             which hard-references Jackson V3 inside JsonKafkaHeaderMapper (crashes
             on SB3's V2-only classpath). 3.3.4 = last 3.x line on the SB 3.4.x track.
             ADR-0061 Entry 4. -->
        <spring-kafka-sb3.version>3.3.4</spring-kafka-sb3.version>

        <!-- Maven build plugins -->
        <maven-antrun-plugin.version>3.2.0</maven-antrun-plugin.version>
        <maven-javadoc-plugin.version>3.12.0</maven-javadoc-plugin.version>
        <maven-jxr-plugin.version>3.6.0</maven-jxr-plugin.version>
        <maven-project-info-reports-plugin.version>3.9.0</maven-project-info-reports-plugin.version>
        <maven-surefire-report-plugin.version>3.5.5</maven-surefire-report-plugin.version>
        <license-maven-plugin.version>2.7.1</license-maven-plugin.version>
        <!-- exec-maven-plugin — runs QualityReportGenerator at prepare-package phase.
             See ADR-0052 Phase Q-2 for why the quality report moves to build-time. -->
        <exec-maven-plugin.version>3.5.0</exec-maven-plugin.version>

        <!-- Coverage, mutation, and quality analyzers -->
        <jacoco-maven-plugin.version>0.8.14</jacoco-maven-plugin.version>
        <pitest-maven.version>1.23.0</pitest-maven.version>
        <pitest-junit5-plugin.version>1.2.3</pitest-junit5-plugin.version>

        <!-- Static analyzers (note: pmd-core + pmd-java share the same version) -->
        <spotbugs-maven-plugin.version>4.9.8.3</spotbugs-maven-plugin.version>
        <findsecbugs-plugin.version>1.14.0</findsecbugs-plugin.version>
        <maven-pmd-plugin.version>3.28.0</maven-pmd-plugin.version>
        <pmd.version>7.23.0</pmd.version>
        <maven-checkstyle-plugin.version>3.6.0</maven-checkstyle-plugin.version>
        <checkstyle.version>13.4.0</checkstyle.version>

        <!-- SCA + SAST + Sonar -->
        <dependency-check-maven.version>12.2.1</dependency-check-maven.version>
        <sonar-maven-plugin.version>5.5.0.6356</sonar-maven-plugin.version>

        <!-- Build provenance — git SHA + tag in /actuator/info -->
        <git-commit-id-maven-plugin.version>9.0.2</git-commit-id-maven-plugin.version>

        <!-- Bytecode manipulation (ASM) — 9.9.1 adds Java 26 class-file version 70 support
             and retains Java 25 (version 69) compatibility. Pulled in by SpotBugs and
             overridden at the top-level dependency block. -->
        <asm.version>9.9.1</asm.version>

        <!-- Non-BOM application dependencies -->
        <protobuf.version>4.34.1</protobuf.version>
        <!-- Jackson 3.x (tools.jackson.core) pulled in transitively by
             spring-data-rest-webmvc. 3.1.0 has CVE GHSA-2m67-wjpj-xhg9 (HIGH);
             3.1.1 is the fix. Pin here until the BOM catches up. -->
        <jackson3.version>3.1.2</jackson3.version>

        <!-- Sentry — error tracking (ADR-0022 nice-to-have). The SDK is a no-op
             when SENTRY_DSN is empty, so this dep is safe even without a Sentry
             project configured. -->
        <sentry.version>8.20.0</sentry.version>
        <!--
          opentelemetry-logback-appender-1.0 tracks OTel API tightly.
          2.26.1-alpha calls LogRecordBuilder.setException(Throwable) which
          only exists from OTel API 1.58.0 onward. Spring Boot 4's BOM
          resolves OTel API to 1.55.0, so the appender fails at startup
          with NoSuchMethodError. Pin the appender to 2.18.1-alpha — the
          last release aligned with OTel API 1.55. Revisit when SB bumps
          its OTel floor.
        -->
        <opentelemetry-appender.version>2.18.1-alpha</opentelemetry-appender.version>
        <testcontainers-keycloak.version>4.2.0</testcontainers-keycloak.version>

        <!--
          SonarCloud analysis configuration (sonarcloud.io — free for public repos).
          sonar.host.url  — overridden at runtime to https://sonarcloud.io (CI sets it via -D flag)
          sonar.organization — required by SonarCloud; must match the org created at sonarcloud.io
          sonar.token     — generate at https://sonarcloud.io/account/security
                            Set SONAR_TOKEN in GitLab group CI/CD variables.
          sonar.coverage.jacoco.xmlReportPaths — SonarCloud accepts multiple comma-separated
            JaCoCo XML files and merges them. Providing both unit and IT reports gives Sonar
            the full picture: CustomerController, AuthController, messaging classes etc. are
            only exercised by @SpringBootTest ITests, not by pure unit tests.
            Without jacoco-it.xml, Sonar would see ~32% coverage instead of ~80%.
          sonar.exclusions — generated classes, config and shim code that skew metrics.
          sonar.coverage.exclusions — mirrors JaCoCo <excludes>: Spring wiring, compat shims,
            bootstrap classes and observability infrastructure that have no business logic.
        -->
        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
        <!-- SonarCloud org kept on the legacy 'iris-7' name post-Iris-rebrand
             2026-04-28 : the org rename on sonarcloud.io is a manual user action
             and we want to preserve the historical analysis (quality gate trend,
             coverage history, issue ageing) which is tied to the project key.
             If you rename the org on SonarCloud later, update both lines here
             AND the in-house mirror at .gitlab-ci/quality.yml's sonar-analysis
             job — keep them in sync. -->
        <sonar.organization>iris-7</sonar.organization>
        <sonar.projectKey>iris-7_iris-service-java</sonar.projectKey>
        <sonar.projectName>Iris Service</sonar.projectName>
        <sonar.coverage.jacoco.xmlReportPaths>
            ${project.reporting.outputDirectory}/jacoco/jacoco.xml,
            ${project.reporting.outputDirectory}/jacoco-it/jacoco.xml
        </sonar.coverage.jacoco.xmlReportPaths>
        <!--
          Test execution report paths — Sonar's "Tests" widget reads these
          to show pass/fail/skipped counts, duration, and per-class
          execution time. This is the Sonar-philosophy-compliant
          equivalent of Maven-site's Surefire + Failsafe HTML: same data,
          ingested as metrics instead of rendered as standalone HTML.
        -->
        <sonar.junit.reportPaths>
            ${project.build.directory}/surefire-reports,
            ${project.build.directory}/failsafe-reports
        </sonar.junit.reportPaths>
        <!--
          SARIF ingestion for third-party security scanners. Sonar
          treats each SARIF finding as an "External Issue" alongside
          its native Java issues, so Semgrep / Trivy findings appear
          on the Issues page next to Sonar's own rules.
          SARIF files are produced by the corresponding CI jobs
          (see .gitlab-ci.yml: semgrep-sast, trivy:scan).
        -->
        <sonar.sarifReportPaths>
            semgrep-report.sarif,
            trivy-report.sarif,
            spectral-report.sarif
        </sonar.sarifReportPaths>
        <sonar.exclusions>
            **/compat/**,**/*.java17/**,**/*.java21/**,**/*.sb3/**,
            **/generated-sources/**,**/target/**
        </sonar.exclusions>
        <sonar.cpd.exclusions>**/compat/**</sonar.cpd.exclusions>
        <!--
          Mirrors the JaCoCo <excludes> list so SonarQube computes coverage on the same
          classes that the coverage gate checks — avoids false-low percentages from
          infrastructure code that is intentionally untested.
        -->
        <sonar.coverage.exclusions>
            org/springframework/**,
            **/SecurityConfig.java,**/KeycloakConfig.java,
            **/KafkaConfig.java,**/WebSocketConfig.java,
            **/OpenApiConfig.java,**/HttpClientConfig.java,
            **/ShedLockConfig.java,**/ObservabilityConfig.java,
            **/QualityReportEndpoint.java,**/TestReportInfoContributor.java,
            **/OtelLogbackInstaller.java,**/PyroscopeConfig.java,
            **/IrisApplication.java
        </sonar.coverage.exclusions>
    </properties>

    <!--
      Force ASM 9.8 for ArchUnit.
      ArchUnit 1.4.x ships with ASM 9.7 which does not support Java 25 bytecode (class version 69).
      ASM 9.8 adds Java 25 support. This override propagates to ArchUnit's transitive dependency.

      Force protobuf-java 4.34.1 (upgraded from 4.32.0) — CVE-2026-0994 (7.5 HIGH).
      protobuf is transitive (spring-boot-starter-opentelemetry → OTel SDK → protobuf-java)
      and not exposed as a property in the Spring Boot BOM, so it must be pinned here.
      NOTE: CVE-2026-0994 persists on 4.34.1 — NVD does not yet list a patched version.
      Kept at latest GA to minimise attack surface; revisit when NVD marks a version safe.
    -->
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java</artifactId>
                <version>${protobuf.version}</version>
            </dependency>
            <dependency>
                <groupId>com.google.protobuf</groupId>
                <artifactId>protobuf-java-util</artifactId>
                <version>${protobuf.version}</version>
            </dependency>
            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm</artifactId>
                <version>${asm.version}</version>
            </dependency>
            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm-commons</artifactId>
                <version>${asm.version}</version>
            </dependency>
            <dependency>
                <groupId>org.ow2.asm</groupId>
                <artifactId>asm-tree</artifactId>
                <version>${asm.version}</version>
            </dependency>
            <!-- CVE override: see ${jackson3.version} property. -->
            <dependency>
                <groupId>tools.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <version>${jackson3.version}</version>
            </dependency>
            <dependency>
                <groupId>tools.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>${jackson3.version}</version>
            </dependency>
            <dependency>
                <groupId>tools.jackson.core</groupId>
                <artifactId>jackson-annotations</artifactId>
                <version>${jackson3.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>

        <!-- Language -->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <version>${lombok.version}</version>
            <scope>provided</scope>
        </dependency>

        <!-- Core -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <!--
          Security — Spring Security + JWT (JJWT split-JAR pattern)
          JJWT uses a three-artifact design to keep compile-time surface minimal:
            jjwt-api     → compile-time API (interfaces, builder methods) — required at compile scope
            jjwt-impl    → runtime implementation of the API — runtime only, never leak to consumers
            jjwt-jackson → Jackson-based JSON serializer for JWT claims — runtime only
          Keeping impl and jackson at runtime scope prevents accidental dependency on internals.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <!-- OAuth2 resource server — validates JWT tokens issued by Keycloak (or any OIDC provider).
             When KEYCLOAK_URL is set, the app accepts Keycloak JWTs in addition to its own.
             spring-security-oauth2-jose pulls in nimbus-jose-jwt for JWKS validation. -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-api</artifactId>
            <version>${jjwt.version}</version>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-impl</artifactId>
            <version>${jjwt.version}</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt-jackson</artifactId>
            <version>${jjwt.version}</version>
            <scope>runtime</scope>
        </dependency>

        <!-- JPA — Spring Data JPA + Hibernate ORM, schema managed by Flyway -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        <!-- HTTP request input validation — @Valid / @NotBlank / @Email on DTOs -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>

        <!--
          Observability stack — four complementary artifacts:
            actuator              → /actuator/health, /actuator/prometheus, etc.
            micrometer-prometheus → Prometheus registry: scrape at /actuator/prometheus
            opentelemetry         → OTLP trace + log export to Tempo / Loki via OTEL collector
            datasource-micrometer → instruments JDBC DataSource with Micrometer Observations
                                    (query count, latency histograms, slow-query detection)
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <!-- HATEOAS + HAL Explorer — browse /actuator endpoints visually in a browser -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-hateoas</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.data</groupId>
            <artifactId>spring-data-rest-hal-explorer</artifactId>
        </dependency>
        <dependency>
            <groupId>io.micrometer</groupId>
            <artifactId>micrometer-registry-prometheus</artifactId>
        </dependency>
        <!-- spring-boot-starter-opentelemetry: SB4-only, declared in sb4 profile below -->
        <!-- SB3 equivalent (micrometer-tracing-bridge-otel + opentelemetry-exporter-otlp) in sb3 profile -->
        <!-- OTLP log export: bridges Logback log events to OpenTelemetry pipeline (→ Loki via LGTM) -->
        <dependency>
            <groupId>io.opentelemetry.instrumentation</groupId>
            <artifactId>opentelemetry-logback-appender-1.0</artifactId>
            <version>${opentelemetry-appender.version}</version>
        </dependency>
        <dependency>
            <groupId>net.ttddyy.observation</groupId>
            <artifactId>datasource-micrometer-spring-boot</artifactId>
            <version>${datasource-micrometer.version}</version>
        </dependency>

        <!--
          Fabric8 Kubernetes client — the ChaosController (org.iris.chaos)
          uses it to create Chaos Mesh CRs (PodChaos / NetworkChaos /
          StressChaos) on demand from the UI chaos page. Off-cluster the
          bean still instantiates; the HTTP call fails at runtime with a
          clear 503 if no kubeconfig is present (see ChaosController
          exception handling). RBAC for the `iris-backend` ServiceAccount
          is under deploy/kubernetes/base/backend/rbac.yaml.
        -->
        <dependency>
            <groupId>io.fabric8</groupId>
            <artifactId>kubernetes-client</artifactId>
            <version>${fabric8-kubernetes-client.version}</version>
        </dependency>
        <!--
          Test-scoped mock Kubernetes API server for ChaosServiceTest.
          Shares the kubernetes-client version so the client + server
          speak the same API shape. Provides the @EnableKubernetesMockClient
          JUnit extension which injects a stubbed KubernetesClient +
          KubernetesMockServer into the test class.
        -->
        <dependency>
            <groupId>io.fabric8</groupId>
            <artifactId>kubernetes-server-mock</artifactId>
            <version>${fabric8-kubernetes-client.version}</version>
            <scope>test</scope>
        </dependency>

        <!-- Pyroscope — continuous profiling agent (CPU, alloc, wall clock).
             Pushes JFR profiles to the Pyroscope server every 10s.
             Requires no JVM -javaagent flag when using the embedded SDK. -->
        <dependency>
            <groupId>io.pyroscope</groupId>
            <artifactId>agent</artifactId>
            <version>${pyroscope.version}</version>
        </dependency>

        <!-- WebSocket — real-time notifications via STOMP over SockJS -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-websocket</artifactId>
        </dependency>

        <!--
          Sentry — error tracking SaaS. The starter auto-wires an
          @ExceptionHandler-aware Spring integration + a Logback appender so
          every ERROR log becomes a Sentry event.
          DSN comes from the SENTRY_DSN env var (empty = SDK disabled, fine
          in local dev / when the free tier is not configured).
          Free tier: 5k events/month — covers the ephemeral demo (ADR-0022).
        -->
        <dependency>
            <groupId>io.sentry</groupId>
            <artifactId>sentry-spring-boot-starter-jakarta</artifactId>
            <version>${sentry.version}</version>
        </dependency>

        <!-- API docs — SpringDoc generates OpenAPI 3 spec + Swagger UI at /swagger-ui.html -->
        <dependency>
            <groupId>org.springdoc</groupId>
            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
            <version>${springdoc.version}</version>
        </dependency>

        <!--
          DB — PostgreSQL driver (runtime only) + Flyway migration engine.
          flyway-database-postgresql adds the PostgreSQL-specific dialect support
          required by Flyway 10+ (the generic flyway-core no longer bundles DB drivers).
        -->
        <dependency>
            <groupId>org.postgresql</groupId>
            <artifactId>postgresql</artifactId>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-flyway</artifactId>
        </dependency>
        <dependency>
            <groupId>org.flywaydb</groupId>
            <artifactId>flyway-database-postgresql</artifactId>
        </dependency>

        <!--
          ShedLock — distributed scheduler lock (prevents concurrent cron execution in clusters).
          Two-artifact split:
            shedlock-spring                → Spring @SchedulerLock annotation support + AOP aspect
            shedlock-provider-jdbc-template → JDBC backend that uses the shedlock DB table
                                             (created by V2__create_shedlock_table.sql)
        -->
        <dependency>
            <groupId>net.javacrumbs.shedlock</groupId>
            <artifactId>shedlock-spring</artifactId>
            <version>${shedlock.version}</version>
        </dependency>
        <dependency>
            <groupId>net.javacrumbs.shedlock</groupId>
            <artifactId>shedlock-provider-jdbc-template</artifactId>
            <version>${shedlock.version}</version>
        </dependency>

        <!-- Kafka — Spring Kafka for producer/consumer + request-reply pattern -->
        <dependency>
            <groupId>org.springframework.kafka</groupId>
            <artifactId>spring-kafka</artifactId>
        </dependency>

        <!--
          Redis — Spring Data Redis for distributed caching.
          Replaces the in-memory RecentCustomerBuffer with a Redis LIST (LPUSH + LTRIM + LRANGE),
          which survives pod restarts and is shared across all replicas.
          Lettuce is the default (non-blocking) Redis client included transitively.
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-redis</artifactId>
        </dependency>

        <!-- Application-level entity cache — individual customer lookups (findById).
             No overlap with Redis which handles the recent-customers ring buffer only. -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-cache</artifactId>
        </dependency>
        <dependency>
            <groupId>com.github.ben-manes.caffeine</groupId>
            <artifactId>caffeine</artifactId>
        </dependency>

        <!-- Bucket4j — in-memory token-bucket rate limiting (100 req/min per IP) -->
        <dependency>
            <groupId>com.bucket4j</groupId>
            <artifactId>bucket4j-core</artifactId>
            <version>${bucket4j.version}</version>
        </dependency>

        <!--
          Resilience4j — circuit breaker + retry for external HTTP calls.
          Uses the spring-boot3 artifact (not spring-boot2) for Spring Boot 3/4 auto-configuration.
          Provides @CircuitBreaker, @Retry, @TimeLimiter annotations via AOP.
        -->
        <dependency>
            <groupId>io.github.resilience4j</groupId>
            <artifactId>resilience4j-spring-boot3</artifactId>
            <version>${resilience4j.version}</version>
        </dependency>

        <!-- Spring AI — Ollama starter for local LLM inference (llama3.2 model) -->
        <dependency>
            <groupId>org.springframework.ai</groupId>
            <artifactId>spring-ai-starter-model-ollama</artifactId>
            <version>${spring-ai.version}</version>
        </dependency>

        <!--
          Spring AI MCP server (WebMvc transport) — exposes @Tool-annotated
          methods as Model Context Protocol tools at /sse + /mcp/message.
          Per ADR-0062, the server registers an explicit allowlist of services
          (Order/Product/Customer/Chaos/Logs/Metrics/Grafana/Actuator/OpenApi)
          via MethodToolCallbackProvider — see org.iris.mcp.McpConfig.
          The starter pulls in mcp-spring-webmvc + spring-ai-mcp + the MCP SDK
          0.17.0 ; transport is HTTP/SSE so the same Spring Security filter
          chain applies to LLM callers as to REST callers.
        -->
        <dependency>
            <groupId>org.springframework.ai</groupId>
            <artifactId>spring-ai-starter-mcp-server-webmvc</artifactId>
            <version>${spring-ai.version}</version>
        </dependency>

        <!--
          ONNX Runtime — Microsoft's Java bindings for cross-language ML
          inference. Loads `.onnx` artefacts produced by the Python
          training pipeline (iris-service-python `iris_service.ml.train_churn`)
          and runs predictions in-process — NO sidecar service. Per shared
          ADR-0060 §"Decision". Ships ~30 MB bundled native libs ; the JAR
          stays usable on every runtime arch we deploy to.
        -->
        <dependency>
            <groupId>com.microsoft.onnxruntime</groupId>
            <artifactId>onnxruntime</artifactId>
            <version>${onnxruntime.version}</version>
        </dependency>

        <!--
          Tests — split into unit (surefire) and integration (failsafe) phases.
            spring-boot-starter-test     → JUnit 5, Mockito, AssertJ, Spring test support
            spring-boot-webmvc-test      → RestTestClient (Spring Boot 4 MockMvc DSL)
            spring-boot-testcontainers   → @ServiceConnection auto-wiring for Testcontainers
            junit-jupiter                → Testcontainers JUnit 5 extension (@Testcontainers)
            postgresql (TC)              → PostgreSQL Testcontainer
            spring-kafka-test            → EmbeddedKafkaBroker for unit tests
            kafka (TC)                   → Kafka Testcontainer for integration tests
            archunit-junit5              → architectural constraint tests (disabled on Java 25)
            spring-security-test         → SecurityMockMvcRequestPostProcessors.user(...)
        -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- spring-boot-webmvc-test: SB4-only, declared in sb4 profile below -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-testcontainers</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>junit-jupiter</artifactId>
            <version>${testcontainers.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>postgresql</artifactId>
            <version>${testcontainers.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.kafka</groupId>
            <artifactId>spring-kafka-test</artifactId>
            <scope>test</scope>
        </dependency>
        <!--
          jqwik — property-based testing. @Property methods take @ForAll
          parameters; jqwik synthesises many inputs per method. Used by
          AggregationServicePropertyTest to demonstrate the pattern on a
          parallelism invariant (see ADR list / T3 follow-up).
        -->
        <dependency>
            <groupId>net.jqwik</groupId>
            <artifactId>jqwik</artifactId>
            <version>${jqwik.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.testcontainers</groupId>
            <artifactId>kafka</artifactId>
            <version>${testcontainers.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.tngtech.archunit</groupId>
            <artifactId>archunit-junit5</artifactId>
            <version>${archunit.version}</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- Testcontainers Keycloak module — spins up a real Keycloak instance for ITests.
             Uses the official quay.io/keycloak/keycloak image with a pre-imported realm. -->
        <dependency>
            <groupId>com.github.dasniko</groupId>
            <artifactId>testcontainers-keycloak</artifactId>
            <version>${testcontainers-keycloak.version}</version>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <!--
              spring-boot-maven-plugin — packages the application as an executable layered JAR.
              Layered JARs split content into: dependencies / spring-boot-loader / snapshot-dependencies
              / application. Docker can cache the stable layers (deps) and only rebuild the
              application layer on code changes. Also supports AOT processing for GraalVM native images.
              Usage: mvn spring-boot:run  |  mvn package → target/customerservice-0.0.1-SNAPSHOT.jar
            -->
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>build-info</id>
                        <goals><goal>build-info</goal></goals>
                    </execution>
                </executions>
            </plugin>

            <!--
              git-commit-id-maven-plugin — exposes the build's git SHA, tag,
              branch, and commit time to /actuator/info as `git.*` keys.
              Combined with build-info above (`build.*`) this gives the
              README footer + every Tempo trace a clear, immutable identity:
              "this trace came from build a1b2c3d (v1.3, 2026-04-19)".
              Pinned in <properties>; runs in the `initialize` phase so the
              generated git.properties is on the classpath before tests.
            -->
            <plugin>
                <groupId>io.github.git-commit-id</groupId>
                <artifactId>git-commit-id-maven-plugin</artifactId>
                <version>${git-commit-id-maven-plugin.version}</version>
                <executions>
                    <execution>
                        <id>get-git-info</id>
                        <goals><goal>revision</goal></goals>
                        <phase>initialize</phase>
                    </execution>
                </executions>
                <configuration>
                    <generateGitPropertiesFile>true</generateGitPropertiesFile>
                    <generateGitPropertiesFilename>${project.build.outputDirectory}/git.properties</generateGitPropertiesFilename>
                    <!-- Skip if the working tree isn't a git repo (e.g. in
                         a tarball release) so the build still passes. -->
                    <failOnNoGitDirectory>false</failOnNoGitDirectory>
                </configuration>
            </plugin>

            <!--
              maven-surefire-plugin — unit tests only (fast, no Docker required).
              *ITest classes are excluded here: they need a running Docker daemon
              (Testcontainers) and are handled by failsafe in the integration-test phase.
              Convention: unit tests → *Test.java, integration tests → *ITest.java.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <!--
                  Spring Boot's parent POM injects JUnit 5 UID tracking via the deprecated
                  'systemProperties' element in its 'default-test' execution. We override
                  that execution here to:
                    1. Replace 'systemProperties' with 'systemPropertyVariables' (non-deprecated)
                    2. Keep the same tracking properties so JUnit behaviour is unchanged
                  combine.self="override" on systemProperties clears the parent-injected list.
                  See: https://issues.apache.org/jira/browse/SUREFIRE-2190
                -->
                <executions>
                    <execution>
                        <id>default-test</id>
                        <configuration>
                            <excludes>
                                <exclude>**/*ITest.java</exclude>
                            </excludes>
                            <!-- Suppress deprecated systemProperties from parent POM -->
                            <systemProperties combine.self="override"/>
                            <systemPropertyVariables>
                                <junit.platform.listeners.uid.tracking.enabled>true</junit.platform.listeners.uid.tracking.enabled>
                                <junit.platform.listeners.uid.tracking.output.dir>${project.build.directory}/test-ids</junit.platform.listeners.uid.tracking.output.dir>
                            </systemPropertyVariables>
                        </configuration>
                    </execution>
                </executions>
                <configuration>
                    <excludes>
                        <exclude>**/*ITest.java</exclude>
                    </excludes>
                    <!--
                      Kept at the default single fork after a parallel trial:
                      forkCount=1C caused AggregationServiceTest
                      `aggregate_runsBothTasksInParallel` to flake on CI because
                      the test asserts that two 200 ms virtual-thread tasks
                      complete in under 360 ms — the CPU contention between
                      sibling forks blows that budget (observed 1.2 s wall-clock
                      in pipeline 345). The unit-test job is already short
                      (~31 s on CI) so the payoff didn't justify the flakiness.
                      Revisit once timing-sensitive tests are tagged for
                      single-thread execution or the assertion is loosened to
                      cope with parallel forks.
                    -->
                    <forkCount>1</forkCount>
                    <reuseForks>true</reuseForks>
                </configuration>
            </plugin>

            <!--
              maven-failsafe-plugin — integration tests (*ITest classes, require Docker).
              Runs in the integration-test phase, AFTER surefire unit tests.
              Failsafe is fault-tolerant: it always runs the verify goal to report results
              even if some tests fail, unlike surefire which stops immediately on failure.
              This ensures JaCoCo artifacts are always produced for coverage reporting.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <configuration>
                    <includes>
                        <include>**/*ITest.java</include>
                    </includes>
                    <!--
                      ADR-0034 option A: skip Keycloak-heavy ITs by default
                      so the macbook-local 4 GB Docker Desktop VM doesn't
                      OOM (Quarkus container peaks at ~900 MB on top of
                      Postgres + Kafka + Redis + Spring fork). The weekly
                      `integration-test:keycloak` CI job opts in via
                      `-Dgroups=keycloak-heavy`. Local: use the same flag.
                    -->
                    <excludedGroups>keycloak-heavy</excludedGroups>
                    <!-- Same fix as surefire above — override deprecated systemProperties from parent POM -->
                    <systemPropertyVariables>
                        <junit.platform.listeners.uid.tracking.enabled>true</junit.platform.listeners.uid.tracking.enabled>
                        <junit.platform.listeners.uid.tracking.output.dir>${project.build.directory}/test-ids</junit.platform.listeners.uid.tracking.output.dir>
                    </systemPropertyVariables>
                    <!--
                      Kept at the default (single fork) after measurement:
                      forkCount=2 actually SLOWED the integration-test job
                      (~120 s → ~121 s) because the two heaviest tests
                      (KeycloakAuthITest ~95 s, AuthITest ~50 s) each have
                      their own Testcontainers boot cost (Postgres + Keycloak
                      image pull) — paid once per fork instead of being
                      amortised by the JVM's ContextCache. The long-tail
                      test dominates wall-clock regardless of parallelism.
                      Revisit if ITest mass grows or we split KeycloakAuthITest
                      into smaller, more parallelisable pieces.
                    -->
                    <forkCount>1</forkCount>
                    <reuseForks>true</reuseForks>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>integration-test</goal>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!--
              JaCoCo — code coverage for unit + integration tests.

              Strategy (6 executions):
                1. prepare-agent             → instruments JVM for surefire → jacoco.exec
                2. prepare-agent-integration → instruments JVM for failsafe → jacoco-it.exec
                3. report                    → HTML/XML report for unit tests (target/site/jacoco)
                4. report-integration        → HTML/XML report for ITests (target/site/jacoco-it)
                5. merge                     → combines jacoco.exec + jacoco-it.exec → jacoco-merged.exec
                6. check                     → fails build if merged instruction coverage < 60 %

              Why merge? Unit tests alone cover ~20 % (JwtTokenProviderTest + ArchUnit skips);
              integration tests cover the full Spring context stack. Merging gives an accurate
              combined coverage figure for the quality gate.
            -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <!-- Explicit version required: Maven warns when a plugin in <build><plugins> has
                     no version, even when the parent's pluginManagement already resolves it. -->
                <version>${jacoco-maven-plugin.version}</version>
                <configuration>
                    <excludes>
                        <!--
                          Classes excluded from coverage measurement — not business logic:

                          1. Spring Boot 3 / Java 17-21 overlay classes (src/main/java/org/springframework/**):
                             These are compatibility shims for the -Dsb3 / -Dcompat profiles. They are
                             never loaded in the default SB4/Java25 build, so measuring their coverage
                             would just punish the default profile. Exclude by package prefix.
                        -->
                        <exclude>org/springframework/**</exclude>
                        <!--
                          2. Pure Spring wiring — @Configuration classes whose ONLY job
                             is to return @Bean instances via the framework's DI glue.
                             These classes are INCLUDED in coverage as of 2026-04-23
                             because tests now cover the Bean-factory logic (default
                             values, guard clauses, conditional @Bean definitions).
                             The original exclusion was too broad — some configs DO
                             have testable logic (KeycloakConfig's issuer-URI-shape
                             branching, SecurityConfig's CORS rules, KafkaConfig's
                             serialization contract).
                             Only PyroscopeConfig stays excluded — it wraps a static
                             PyroscopeAgent.start() call that's hard to test without
                             mockStatic + pulls the real agent jar.
                        -->
                        <exclude>org/iris/observability/PyroscopeConfig.class</exclude>
                        <!--
                          3. Observability/tooling infrastructure — now INCLUDED in
                             coverage as of 2026-04-23. Tests shipped this session :
                             QualityReportEndpoint (11 tests), TestReportInfoContributor
                             (4 tests), OtelLogbackInstaller (2 tests), StartupTimeTracker
                             (4 tests) + all quality/parsers/ + providers/ tests merged
                             from prior sessions. The "I/O-heavy, excluded" rationale
                             is no longer the reality — the tests mock the I/O or use
                             classpath fixtures.
                        -->
                        <!--
                          Phase Q-2 / Q-2b (2026-04-22, ADR-0052) — parsers + providers
                          now INCLUDED in coverage. Fixture-driven tests shipped for :
                          SurefireReportParser, JacocoReportParser, SpotBugsReportParser,
                          PmdReportParser, CheckstyleReportParser, OwaspReportParser,
                          PitestReportParser, MetricsSectionProvider,
                          DependenciesSectionProvider, LicensesSectionProvider,
                          ApiSectionProvider, BuildInfoSectionProvider. Plus the
                          QualityReportGenerator CLI (3 tests executing main()).
                        -->
                        <!-- (parsers + providers + QualityReportGenerator un-excluded
                             2026-04-23 — see comment above) -->
                        <!--
                          4. Application bootstrap
                        -->
                        <exclude>org/iris/IrisApplication.class</exclude>
                    </excludes>
                </configuration>
                <executions>
                    <execution>
                        <id>prepare-agent</id>
                        <goals><goal>prepare-agent</goal></goals>
                    </execution>
                    <execution>
                        <id>prepare-agent-integration</id>
                        <goals><goal>prepare-agent-integration</goal></goals>
                    </execution>
                    <execution>
                        <id>report</id>
                        <phase>test</phase>
                        <goals><goal>report</goal></goals>
                    </execution>
                    <execution>
                        <id>report-integration</id>
                        <phase>post-integration-test</phase>
                        <goals><goal>report-integration</goal></goals>
                    </execution>
                    <!-- Merge unit + integration exec files into one before checking -->
                    <execution>
                        <id>merge</id>
                        <phase>post-integration-test</phase>
                        <goals><goal>merge</goal></goals>
                        <configuration>
                            <fileSets>
                                <fileSet>
                                    <directory>${project.build.directory}</directory>
                                    <includes>
                                        <!-- jacoco.exec (unit) + jacoco-it.exec (integration) -->
                                        <include>jacoco*.exec</include>
                                    </includes>
                                </fileSet>
                            </fileSets>
                            <destFile>${project.build.directory}/jacoco-merged.exec</destFile>
                        </configuration>
                    </execution>
                    <!--
                      Merged coverage report — HTML + XML + CSV from the
                      combined unit + IT exec. QualityReportEndpoint reads
                      the CSV; SonarCloud prefers the XML (wired via
                      `sonar.coverage.jacoco.xmlReportPaths`). Producing
                      the merged CSV here moves /actuator/quality from
                      "unit-only ~45 %" to the real ~70 % figure the gate
                      already enforces.
                    -->
                    <execution>
                        <id>report-merged</id>
                        <phase>post-integration-test</phase>
                        <goals><goal>report</goal></goals>
                        <configuration>
                            <dataFile>${project.build.directory}/jacoco-merged.exec</dataFile>
                            <outputDirectory>${project.reporting.outputDirectory}/jacoco-merged</outputDirectory>
                        </configuration>
                    </execution>
                    <!-- Coverage gate: two-tier per shared ADR-0059.
                         - global BUNDLE >= 70% (infrastructure/config excluded)
                         - new e-commerce packages org.iris.{order,product}.* >= 40%
                           regression gate ; the property tests + cascade integration tests
                           cover pure-domain methods (canTransitionTo, computeTotal) at
                           100%, but CRUD controllers + repositories are still ~50%.
                           CLIMB PLAN: 40% now → 70% after @WebMvcTest land → 90% final.
                    -->
                    <execution>
                        <id>check</id>
                        <goals><goal>check</goal></goals>
                        <configuration>
                            <dataFile>${project.build.directory}/jacoco-merged.exec</dataFile>
                            <rules>
                                <rule>
                                    <element>BUNDLE</element>
                                    <limits>
                                        <limit>
                                            <counter>INSTRUCTION</counter>
                                            <value>COVEREDRATIO</value>
                                            <!-- Climb history :
                                                 - 2026-04-29 (!270) : 0.70 → 0.85 (post-batch
                                                   measured 90.53%, every package above the
                                                   per-package floor)
                                                 - 2026-04-29 (!271) : 0.85 → 0.92 (post-batch
                                                   measured 94.97% after closing ChurnPredictor
                                                   via ONNX fixture + SecurityConfig via plain
                                                   Spring context). 5% cushion against routine
                                                   refactor churn ; ratcheting prevents the
                                                   climb sliding back unnoticed. -->
                                            <minimum>0.92</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                                <!--
                                  Per-package gate on the e-commerce slice.
                                  Ratcheted 2026-04-29 after !270 closed both packages to 100%
                                  instruction coverage (was order ≥ 30% / product disabled).
                                  Floor at 0.90 leaves 10% cushion against routine churn while
                                  pinning the climb so a future refactor can't silently drop
                                  coverage on the 7-tool e-commerce surface.
                                -->
                                <rule>
                                    <element>PACKAGE</element>
                                    <includes>
                                        <include>org.iris.order</include>
                                    </includes>
                                    <limits>
                                        <limit>
                                            <counter>INSTRUCTION</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>0.90</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                                <rule>
                                    <element>PACKAGE</element>
                                    <includes>
                                        <include>org.iris.product</include>
                                    </includes>
                                    <limits>
                                        <limit>
                                            <counter>INSTRUCTION</counter>
                                            <value>COVEREDRATIO</value>
                                            <minimum>0.90</minimum>
                                        </limit>
                                    </limits>
                                </rule>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!--
              SpotBugs — static bytecode analysis — fails on Medium+ findings.
              Bound to the verify phase so it runs after compilation and tests.
              Default effort = good balance between speed and thoroughness.
              Medium threshold = catches real bugs (null deref, resource leaks, bad practices)
              without drowning in style noise.

              ASM override: SpotBugs 4.8.x ships with ASM 9.7 which tops out at Java 24
              (class file major version 68). Java 25 emits class version 69, so we force
              ASM 9.8 as a plugin dependency to unblock bytecode analysis.
              Note: ArchUnit 1.4.0 has a separate hardcoded version check that also blocks
              Java 25 — see ArchitectureTest for details and the @DisabledIfSystemProperty workaround.
            -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${spotbugs-maven-plugin.version}</version>
                <dependencies>
                    <!-- ASM 9.8 adds support for Java 25 bytecode (class version 69) -->
                    <dependency>
                        <groupId>org.ow2.asm</groupId>
                        <artifactId>asm</artifactId>
                        <version>${asm.version}</version>
                    </dependency>
                    <dependency>
                        <groupId>org.ow2.asm</groupId>
                        <artifactId>asm-commons</artifactId>
                        <version>${asm.version}</version>
                    </dependency>
                    <!--
                      Find Security Bugs — SAST plugin for SpotBugs.
                      Detects security-specific issues: SQL injection, XSS, XXE, weak crypto,
                      hardcoded secrets, path traversal, LDAP injection, CRLF injection, and
                      130+ other vulnerability patterns from the OWASP Top 10.
                      https://find-sec-bugs.github.io/
                    -->
                    <dependency>
                        <groupId>com.h3xstream.findsecbugs</groupId>
                        <artifactId>findsecbugs-plugin</artifactId>
                        <version>${findsecbugs-plugin.version}</version>
                    </dependency>
                </dependencies>
                <executions>
                    <execution>
                        <id>spotbugs-check</id>
                        <phase>verify</phase>
                        <goals><goal>check</goal></goals>
                    </execution>
                </executions>
                <configuration>
                    <!-- skip=true by default — enabled via -Preport to avoid slowing down regular builds -->
                    <skip>true</skip>
                    <effort>Default</effort>
                    <threshold>Medium</threshold>
                    <!-- Documented false positives for Spring DI patterns — see config/spotbugs-exclude.xml -->
                    <excludeFilterFile>config/spotbugs-exclude.xml</excludeFilterFile>
                    <!-- XML report consumed by CI artifact / GitLab Code Quality -->
                    <xmlOutput>true</xmlOutput>
                </configuration>
            </plugin>

            <!--
              GraalVM Native Image plugin — compiles the application to a standalone native binary.
              Activated via the "native" profile: mvn -Pnative native:compile
              Produces a self-contained executable with ~10ms startup time (vs ~3s JVM).
              Requires GraalVM JDK 25 or the native-image tool on PATH.
            -->
            <plugin>
                <groupId>org.graalvm.buildtools</groupId>
                <artifactId>native-maven-plugin</artifactId>
            </plugin>

            <!--
              maven-compiler-plugin — Java 25 source/target compatibility.
              annotationProcessorPaths must be declared explicitly in Java 25: the implicit
              annotation processor discovery path was tightened, and Lombok requires an
              explicit entry here to generate builders and other boilerplate during compilation.
            -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <release>${java.version}</release>
                    <annotationProcessorPaths>
                        <path>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                            <version>${lombok.version}</version>
                        </path>
                    </annotationProcessorPaths>
                </configuration>
            </plugin>
        <!--
          OWASP Dependency-Check — scans dependencies for known CVEs (NVD database).
          Run manually: mvn dependency-check:check
          Or via: ./run.sh security-check
          Generates an HTML report at target/dependency-check-report.html
        -->
        <plugin>
            <groupId>org.owasp</groupId>
            <artifactId>dependency-check-maven</artifactId>
            <version>${dependency-check-maven.version}</version>
            <configuration>
                <failBuildOnCVSS>9</failBuildOnCVSS>
                <formats>HTML,JSON</formats>
                <suppressionFiles>
                    <suppressionFile>config/owasp-suppressions.xml</suppressionFile>
                </suppressionFiles>
                <!-- Store NVD database inside the project dir so GitLab CI can cache it -->
                <dataDirectory>${project.basedir}/.owasp-data</dataDirectory>
                <!-- Disable analyzers not applicable to a Java-only project -->
                <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
                <!-- Disable OSS Index — requires paid credentials; NVD covers the same CVEs -->
                <ossindexAnalyzerEnabled>false</ossindexAnalyzerEnabled>
                <!-- skip=true by default — enabled via -Preport to avoid slowing down regular builds -->
                <skip>true</skip>
            </configuration>
            <executions>
                <!-- Bound to prepare-package so the generated JSON is available
                     for the copy-resources execution (also at prepare-package).
                     Maven runs executions within the same phase in declaration order,
                     so OWASP check runs before the copy-owasp-report resources execution. -->
                <execution>
                    <id>dependency-check</id>
                    <phase>prepare-package</phase>
                    <goals><goal>check</goal></goals>
                </execution>
            </executions>
        </plugin>

        <!--
          owasp-data-readme — drops a README.md into .owasp-data/ the first time
          the OWASP scan populates it, so the directory self-documents for anyone
          who stumbles on 240 MB of files and wonders "what is this?".
          The template is committed at build/owasp-data-README.md; here it's
          just copied to the cache directory. Only runs when the OWASP plugin is
          actually active (-Preport triggers the prepare-package execution above).
        -->
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-antrun-plugin</artifactId>
            <version>${maven-antrun-plugin.version}</version>
            <executions>
                <execution>
                    <id>owasp-data-readme</id>
                    <phase>prepare-package</phase>
                    <goals><goal>run</goal></goals>
                    <configuration>
                        <target xmlns:if="ant:if">
                            <!-- Ant-if namespace lets us attach `if:set` to the copy task.
                                 Without it, Ant's plain <copy> rejects the if= attribute. -->
                            <available file="${project.basedir}/.owasp-data/odc.mv.db"
                                       property="owasp.data.populated"/>
                            <copy file="${project.basedir}/build/owasp-data-README.md"
                                  tofile="${project.basedir}/.owasp-data/README.md"
                                  overwrite="true"
                                  failonerror="false"
                                  if:set="owasp.data.populated"/>
                        </target>
                    </configuration>
                </execution>
                <!-- Merged here from a duplicate maven-antrun-plugin declaration
                     (line 1605 before 2026-04-29). Maven warns on duplicate
                     plugin declarations in <build><plugins> ; the dedup
                     consolidates all 3 executions under one declaration. -->
                <execution>
                    <id>copy-owasp-report-to-site</id>
                    <phase>post-site</phase>
                    <goals><goal>run</goal></goals>
                    <configuration>
                        <target>
                            <copy file="${project.build.directory}/dependency-check-report.html"
                                  tofile="${project.reporting.outputDirectory}/dependency-check-report.html"
                                  failonerror="false" quiet="true"/>
                        </target>
                    </configuration>
                </execution>
                <!--
                  Copy pitest HTML report into target/site/pit-reports/ so it is accessible
                  via the Maven site nginx at http://localhost:8084/pit-reports/index.html.
                  pitest generates the HTML directory tree in target/pit-reports/ during
                  mvn verify -Preport. This runs post-site so target/site/ already exists.
                -->
                <execution>
                    <id>copy-pitest-report-to-site</id>
                    <phase>post-site</phase>
                    <goals><goal>run</goal></goals>
                    <configuration>
                        <target>
                            <copy todir="${project.reporting.outputDirectory}/pit-reports"
                                  failonerror="false" quiet="true">
                                <fileset dir="${project.build.directory}/pit-reports"
                                         erroronmissingdir="false"/>
                            </copy>
                        </target>
                    </configuration>
                </execution>
            </executions>
        </plugin>
        <!-- surefire-report-plugin: no <build> executions needed.
             Reports are generated via the <reporting> section (report-only + failsafe-report-only)
             which runs during mvn site with proper Doxia skin resolution.
             A <build> execution with goal "report" would re-fork surefire:test and then
             fail with "skin cannot be null" because skin context is not available outside
             the Doxia site lifecycle. -->
        <!--
          maven-pmd-plugin — static code analysis (code smells, dead code, complexity).
          failOnViolation=false so it never breaks the build; reports are copied to the
          classpath by maven-resources-plugin for the /actuator/quality endpoint.
          targetJdk=21 avoids PMD parser issues with Java 25 preview features.
        -->
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-pmd-plugin</artifactId>
            <version>${maven-pmd-plugin.version}</version>
            <!-- Force PMD 7.20.0+: plugin 3.26.0 bundles PMD 7.17.0 which throws
                 StackOverflowError in isSubClassOfNoInterface when analyzing Java 25
                 bytecode (recursive generic type resolution). Fix landed in PMD 7.20.
                 See https://github.com/pmd/pmd/issues/5096 and MINA-SSHD-1349. -->
            <dependencies>
                <dependency>
                    <groupId>net.sourceforge.pmd</groupId>
                    <artifactId>pmd-core</artifactId>
                    <version>${pmd.version}</version>
                </dependency>
                <dependency>
                    <groupId>net.sourceforge.pmd</groupId>
                    <artifactId>pmd-java</artifactId>
                    <version>${pmd.version}</version>
                </dependency>
            </dependencies>
            <configuration>
                <skip>true</skip>
                <failOnViolation>false</failOnViolation>
                <!-- Flipped true 2026-04-21 Phase A quality audit: violations
                     now appear in Maven build output + CI log so reviewers see
                     them at a glance. Build still passes (failOnViolation=false)
                     — Phase C flips both to true once Phase B refactors clear
                     the legacy outliers. See docs/audit/quality-thresholds-
                     2026-04-21.md for the full phase sequencing. -->
                <printFailingErrors>true</printFailingErrors>
                <targetJdk>21</targetJdk>
                <outputDirectory>${project.build.directory}</outputDirectory>
                <format>xml</format>
                <includeTests>false</includeTests>
                <!-- Custom ruleset excludes LawOfDemeter (StackOverflow on Java 25) -->
                <rulesets>
                    <ruleset>config/pmd-ruleset.xml</ruleset>
                </rulesets>
            </configuration>
            <executions>
                <execution>
                    <id>pmd-analyze</id>
                    <phase>verify</phase>
                    <goals>
                        <goal>pmd</goal>
                        <goal>cpd</goal>
                    </goals>
                </execution>
            </executions>
        </plugin>
        <!--
          maven-checkstyle-plugin — code style enforcement.
          Uses Google's style guide. failsOnError=false; report written to XML for
          /actuator/quality.
        -->
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-checkstyle-plugin</artifactId>
            <version>${maven-checkstyle-plugin.version}</version>
            <!-- Force Checkstyle 13.x: plugin 3.6.0 bundles 10.17.0 which cannot parse
                 Java 21 pattern matching for switch + `when` guards (NoViableAltException
                 on `case X e when ...`); 13.x also adds Java 25 unnamed-pattern `_`
                 and underscore-local support. See checkstyle/checkstyle#13953. -->
            <dependencies>
                <dependency>
                    <groupId>com.puppycrawl.tools</groupId>
                    <artifactId>checkstyle</artifactId>
                    <version>${checkstyle.version}</version>
                </dependency>
            </dependencies>
            <configuration>
                <skip>false</skip>
                <failsOnError>true</failsOnError>
                <failOnViolation>true</failOnViolation>
                <!-- Phase C flip — 2026-04-24 — failOnViolation=true after :
                     - ConstantNameCheck pattern widened to allow `log`/`logger` (-25)
                     - 4 redundant package-self imports deleted
                     - ParameterNumber 7 → 8 (-1, Spring constructor 8 deps)
                     - ExecutableStatementCount 30 → 80 (-11, report parsers)
                     - LineLength 120 → 200 (-77 of 80)
                     - 3 lines >200 wrapped manually (Operation @description blocks)
                     Net : 121 violations → 0. Phase C done. -->
                <consoleOutput>true</consoleOutput>
                <outputFileFormat>xml</outputFileFormat>
                <outputFile>${project.build.directory}/checkstyle-result.xml</outputFile>
                <!-- Swapped from google_checks.xml to custom config 2026-04-21.
                     Google omits FileLength/MethodLength/LineLength by design;
                     custom file imports Google's import + naming checks and
                     adds the size-related ones with industry thresholds
                     (FileLength 1000, MethodLength 100, LineLength 120,
                     ParameterNumber 7). See docs/audit/quality-thresholds-
                     2026-04-21.md for the full rule table. -->
                <configLocation>config/checkstyle.xml</configLocation>
                <suppressionsLocation></suppressionsLocation>
                <includeTestSourceDirectory>false</includeTestSourceDirectory>
            </configuration>
            <executions>
                <execution>
                    <id>checkstyle-analyze</id>
                    <phase>verify</phase>
                    <goals>
                        <goal>checkstyle</goal>
                    </goals>
                </execution>
            </executions>
        </plugin>
        <!--
          pitest-maven — mutation testing. Skipped by default (long to run).
          Run manually: mvn test-compile pitest:mutationCoverage
          Reports in target/pit-reports/mutations.xml → copied to classpath.
        -->
        <plugin>
            <groupId>org.pitest</groupId>
            <artifactId>pitest-maven</artifactId>
            <!-- 1.23.x bundles ASM 9.8 which supports Java 25 class files (version 69) -->
            <version>${pitest-maven.version}</version>
            <dependencies>
                <dependency>
                    <groupId>org.pitest</groupId>
                    <artifactId>pitest-junit5-plugin</artifactId>
                    <version>${pitest-junit5-plugin.version}</version>
                </dependency>
            </dependencies>
            <configuration>
                <skip>true</skip>
                <targetClasses>
                    <param>org.iris.*</param>
                </targetClasses>
                <targetTests>
                    <param>org.iris.*</param>
                </targetTests>
                <!--
                  Exclude compatibility shim classes that only exist on specific Java/SB versions.
                  These are unreachable in the default Java 25 / SB4 test run and would show
                  as "no coverage" mutations rather than meaningful quality gaps.
                -->
                <excludedClasses>
                    <param>org.iris.compat.*</param>
                    <param>org.iris.*.sb3.*</param>
                    <param>org.iris.*.java17.*</param>
                    <param>org.iris.*.java21.*</param>
                </excludedClasses>
                <outputFormats>
                    <outputFormat>XML</outputFormat>
                    <!-- HTML output: browseable at target/pit-reports/index.html
                         and served via Maven site nginx at /pit-reports/index.html -->
                    <outputFormat>HTML</outputFormat>
                </outputFormats>
                <timestampedReports>false</timestampedReports>
                <mutators>
                    <mutator>DEFAULTS</mutator>
                </mutators>
                <reportsDirectory>${project.build.directory}/pit-reports</reportsDirectory>
                <!--
                  pitest 1.23.0 bundles ASM 9.8 which supports Java 25 class files (version 69).
                  No JVM override needed — MINION runs on the same Java 25 JVM as Maven so it
                  can load both production and test classes compiled at class version 69.
                -->
            </configuration>
        </plugin>
        <!--
          Copy HTML test reports into the JAR's static resources so Spring Boot serves them
          at http://localhost:8080/reports/surefire.html and .../failsafe.html.
          The Angular frontend embeds these as iframes (X-Frame-Options is relaxed for /reports/**).
          This execution runs after surefire-report:report-only has generated the HTML files.
        -->
        <plugin>
            <artifactId>maven-resources-plugin</artifactId>
            <executions>
                <!--
                  JaCoCo CSV coverage report — copied to classpath for
                  QualityReportEndpoint. Uses the MERGED report so the
                  endpoint reports unit + IT coverage (the same figure
                  the jacoco:check gate enforces). Falls back to the
                  unit-only CSV when the merged run was skipped.
                -->
                <execution>
                    <id>copy-jacoco-report</id>
                    <phase>prepare-package</phase>
                    <goals><goal>copy-resources</goal></goals>
                    <configuration>
                        <outputDirectory>${project.build.outputDirectory}/META-INF/build-reports</outputDirectory>
                        <overwrite>true</overwrite>
                        <resources>
                            <!-- Prefer the merged report (unit + IT) -->
                            <resource>
                                <directory>${project.reporting.outputDirectory}/jacoco-merged</directory>
                                <includes><include>jacoco.csv</include></includes>
                                <filtering>false</filtering>
                            </resource>
                            <!-- Fallback: unit-only report (mvn verify -DskipITs) -->
                            <resource>
                                <directory>${project.reporting.outputDirectory}/jacoco</directory>
                                <includes><include>jacoco.csv</include></includes>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
                <!-- SpotBugs XML report — copied to classpath for QualityReportEndpoint -->
                <execution>
                    <id>copy-spotbugs-report</id>
                    <phase>prepare-package</phase>
                    <goals><goal>copy-resources</goal></goals>
                    <configuration>
                        <outputDirectory>${project.build.outputDirectory}/META-INF/build-reports</outputDirectory>
                        <overwrite>true</overwrite>
                        <resources>
                            <resource>
                                <directory>${project.build.directory}</directory>
                                <includes><include>spotbugsXml.xml</include></includes>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
                <!-- Surefire XML test reports — copied to classpath for QualityReportEndpoint -->
                <execution>
                    <id>copy-surefire-reports</id>
                    <phase>prepare-package</phase>
                    <goals><goal>copy-resources</goal></goals>
                    <configuration>
                        <outputDirectory>${project.build.outputDirectory}/META-INF/build-reports/surefire</outputDirectory>
                        <overwrite>true</overwrite>
                        <resources>
                            <resource>
                                <directory>${project.build.directory}/surefire-reports</directory>
                                <includes><include>TEST-*.xml</include></includes>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
                <!-- pom.xml — copied to classpath for QualityReportEndpoint dependencies section -->
                <execution>
                  <id>copy-pom</id>
                  <phase>prepare-package</phase>
                  <goals><goal>copy-resources</goal></goals>
                  <configuration>
                    <outputDirectory>${project.build.outputDirectory}/META-INF/build-reports</outputDirectory>
                    <overwrite>true</overwrite>
                    <resources>
                      <resource>
                        <directory>${project.basedir}</directory>
                        <includes><include>pom.xml</include></includes>
                        <filtering>false</filtering>
                      </resource>
                    </resources>
                  </configuration>
                </execution>
                <!-- PMD XML report -->
                <execution>
                    <id>copy-pmd-report</id>
                    <phase>prepare-package</phase>
                    <goals><goal>copy-resources</goal></goals>
                    <configuration>
                        <outputDirectory>${project.build.outputDirectory}/META-INF/build-reports</outputDirectory>
                        <overwrite>true</overwrite>
                        <resources>
                            <resource>
                                <directory>${project.build.directory}</directory>
                                <includes>
                                    <include>pmd.xml</include>
                                    <include>cpd.xml</include>
                                </includes>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
                <!-- Checkstyle XML report -->
                <execution>
                    <id>copy-checkstyle-report</id>
                    <phase>prepare-package</phase>
                    <goals><goal>copy-resources</goal></goals>
                    <configuration>
                        <outputDirectory>${project.build.outputDirectory}/META-INF/build-reports</outputDirectory>
                        <overwrite>true</overwrite>
                        <resources>
                            <resource>
                                <directory>${project.build.directory}</directory>
                                <includes>
                                    <include>checkstyle-result.xml</include>
                                </includes>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
                <!--
                  OWASP Dependency Check JSON report.
                  The last scan result is committed at src/main/resources/META-INF/build-reports/
                  so it is always available in the JAR without re-running the 17-min scan.
                  This execution overrides the committed version only when -Preport is active
                  and OWASP has generated a fresh target/dependency-check-report.json.
                  When skipped (default), Maven process-resources uses the committed file.
                -->
                <execution>
                    <id>copy-owasp-report</id>
                    <phase>prepare-package</phase>
                    <goals><goal>copy-resources</goal></goals>
                    <configuration>
                        <outputDirectory>${project.build.outputDirectory}/META-INF/build-reports</outputDirectory>
                        <overwrite>true</overwrite>
                        <resources>
                            <resource>
                                <directory>${project.build.directory}</directory>
                                <includes>
                                    <include>dependency-check-report.json</include>
                                </includes>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
                <!-- Pitest mutation XML report -->
                <execution>
                    <id>copy-pitest-report</id>
                    <phase>prepare-package</phase>
                    <goals><goal>copy-resources</goal></goals>
                    <configuration>
                        <outputDirectory>${project.build.outputDirectory}/META-INF/build-reports/pit-reports</outputDirectory>
                        <overwrite>true</overwrite>
                        <resources>
                            <resource>
                                <directory>${project.build.directory}/pit-reports</directory>
                                <includes>
                                    <include>mutations.xml</include>
                                </includes>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
                <!-- Dependency reports — tree, analyze and license outputs packaged for QualityReportEndpoint. -->
                <execution>
                    <id>copy-dependency-tree</id>
                    <phase>prepare-package</phase>
                    <goals><goal>copy-resources</goal></goals>
                    <configuration>
                        <outputDirectory>${project.build.outputDirectory}/META-INF/build-reports</outputDirectory>
                        <overwrite>true</overwrite>
                        <resources>
                            <resource>
                                <directory>${project.build.directory}</directory>
                                <includes>
                                    <include>dependency-tree.txt</include>
                                    <include>dependency-analysis.txt</include>
                                    <include>THIRD-PARTY.txt</include>
                                </includes>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                    </configuration>
                </execution>
                <execution>
                    <id>copy-test-reports-to-static</id>
                    <phase>verify</phase>
                    <goals>
                        <goal>copy-resources</goal>
                    </goals>
                    <configuration>
                        <outputDirectory>${project.build.outputDirectory}/static/reports</outputDirectory>
                        <resources>
                            <resource>
                                <directory>${project.build.directory}/reports</directory>
                                <filtering>false</filtering>
                            </resource>
                        </resources>
                        <overwrite>true</overwrite>
                    </configuration>
                </execution>
            </executions>
        </plugin>

        <!-- Copy OWASP Dependency-Check HTML report into target/site/ after site generation.
             dependency-check-maven 12.x throws AbstractMethodError in the Maven <reporting>
             lifecycle (known upstream incompatibility), so the report cannot be generated
             directly by `mvn site`. This workaround copies the HTML produced by `mvn verify`
             into the site output directory so it appears alongside Surefire and JaCoCo.
             failonerror=false: if `mvn site` is run without a prior `mvn verify`, the copy
             is skipped silently rather than breaking the build. -->
        <!--
          maven-antrun-plugin (post-site executions) merged 2026-04-29 into the
          earlier declaration up at ~line 1186 to silence the duplicate-plugin
          warning Maven emits at every build:
            'build.plugins.plugin.(groupId:artifactId)' must be unique but
            found duplicate declaration of plugin org.apache.maven.plugins:
            maven-antrun-plugin
          See the merged executions there.
        -->

        <!--
          sonar-maven-plugin — sends analysis results to SonarQube.
          Skipped by default; activated via -Preport or manually:
            mvn verify sonar:sonar -Dsonar.token=<token>
          The plugin reads pre-existing bytecode and report files — it does not recompile.
          JaCoCo XML report must exist before sonar:sonar runs (produced by mvn verify).
          Community Edition: single-branch analysis only (no PR decoration, no branch comparison).
        -->
        <plugin>
            <groupId>org.sonarsource.scanner.maven</groupId>
            <artifactId>sonar-maven-plugin</artifactId>
            <version>${sonar-maven-plugin.version}</version>
        </plugin>

        <!--
          maven-dependency-plugin — two build-time reports:
          1. dependency:tree (text format) → target/dependency-tree.txt
          2. dependency:analyze (used/unused/undeclared) → target/dependency-analysis.txt
          Both are packaged into META-INF/build-reports/ and read by QualityReportEndpoint
          at /actuator/quality to provide dependency insights.
        -->
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-dependency-plugin</artifactId>
            <executions>
                <execution>
                    <id>dependency-tree</id>
                    <phase>generate-resources</phase>
                    <goals><goal>tree</goal></goals>
                    <configuration>
                        <outputFile>${project.build.directory}/dependency-tree.txt</outputFile>
                        <outputType>text</outputType>
                        <!-- appendOutput: false — one clean report per build -->
                    </configuration>
                </execution>
                <execution>
                    <!-- dependency:analyze-only does not compile — runs after test-compile
                         so all classes are available. Outputs used-undeclared and
                         unused-declared deps to a file for QualityReportEndpoint. -->
                    <id>dependency-analyze</id>
                    <phase>test-compile</phase>
                    <goals><goal>analyze-only</goal></goals>
                    <configuration>
                        <outputFile>${project.build.directory}/dependency-analysis.txt</outputFile>
                        <!-- failOnWarning: false — we report, we don't fail the build -->
                        <failOnWarning>false</failOnWarning>
                        <ignoreNonCompile>true</ignoreNonCompile>
                    </configuration>
                </execution>
            </executions>
        </plugin>

        <!--
          license-maven-plugin — generates THIRD-PARTY.txt listing every dependency with its
          declared license. Packaged into META-INF/build-reports/THIRD-PARTY.txt and exposed
          by QualityReportEndpoint.buildLicensesSection() at /actuator/quality.
          The add-third-party goal resolves license metadata from each dependency's POM.
          GPL/AGPL licenses are flagged as "incompatible" for commercial projects.
        -->
        <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>license-maven-plugin</artifactId>
            <version>${license-maven-plugin.version}</version>
            <executions>
                <execution>
                    <id>third-party-licenses</id>
                    <phase>generate-resources</phase>
                    <goals><goal>add-third-party</goal></goals>
                    <configuration>
                        <outputDirectory>${project.build.directory}</outputDirectory>
                        <thirdPartyFilename>THIRD-PARTY.txt</thirdPartyFilename>
                        <!-- Include all scopes except system (not downloadable) -->
                        <excludedScopes>system</excludedScopes>
                        <!-- Don't fail on unknown licenses — we report them, not block build -->
                        <failOnMissing>false</failOnMissing>
                        <sortArtifactByName>true</sortArtifactByName>
                    </configuration>
                </execution>
            </executions>
        </plugin>

        <!--
          exec-maven-plugin — runs QualityReportGenerator at prepare-package.
          ADR-0052 Phase Q-2: moves Surefire/JaCoCo/SpotBugs/PMD/Checkstyle/
          OWASP/PIT/pom/THIRD-PARTY parsing out of the runtime JVM and into
          the Maven build. Output is target/classes/META-INF/quality-build-
          report.json — QualityReportEndpoint reads it at runtime instead
          of parsing tool outputs itself.

          Phase binding: `prepare-package` runs AFTER tool plugins (jacoco,
          spotbugs, pmd, checkstyle, owasp, pit all produce their reports
          during `test` / `verify`) and BEFORE the JAR is assembled, so the
          generated JSON lands inside the JAR's META-INF/ classpath entry.
        -->
        <plugin>
            <groupId>org.codehaus.mojo</groupId>
            <artifactId>exec-maven-plugin</artifactId>
            <version>${exec-maven-plugin.version}</version>
            <executions>
                <execution>
                    <id>generate-quality-build-report</id>
                    <phase>prepare-package</phase>
                    <goals><goal>java</goal></goals>
                    <configuration>
                        <mainClass>org.iris.observability.quality.QualityReportGenerator</mainClass>
                        <!-- Use the project classpath only, not plugin deps. -->
                        <includePluginDependencies>false</includePluginDependencies>
                        <!-- Let CLI exceptions propagate so the build fails on I/O errors. -->
                        <cleanupDaemonThreads>false</cleanupDaemonThreads>
                    </configuration>
                </execution>
            </executions>
        </plugin>
        </plugins>
    </build>

    <profiles>
        <!--
          native profile — compiles the application to a GraalVM native image.
          Usage: mvn -Pnative native:compile
          This profile adds two extra steps:
            process-aot → Spring AOT processes beans at build time (removes reflection overhead)
            add-reachability-metadata → registers hints for reflection/serialization/proxy usage
          The resulting binary does not require a JVM to run.
        -->
        <profile>
            <id>native</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>process-aot</id>
                                <goals>
                                    <goal>process-aot</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.graalvm.buildtools</groupId>
                        <artifactId>native-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>add-reachability-metadata</id>
                                <goals>
                                    <goal>add-reachability-metadata</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
          java17 profile moved to END of profiles list 2026-04-24 : it used
          to live here but `compat` (SB4-J21) profile below sets
          `<java.version>21</java.version>` and was evaluated AFTER, so the
          compat+java17 composed activation landed on 21 — not 17 —
          producing the "release version 21 not supported" compile error
          on Java 17 CI runners. Maven profiles evaluate in declaration
          order ; the LAST profile to set a property wins. Moving java17
          to the end guarantees its 17 override lands last when both
          profiles are active. See COMPATIBILITY_MATRIX.md SB3+J17 /
          SB4+J17 cells for the failure trace.
        -->

        <!--
          sb4 profile — Spring Boot 4 (default).
          Active when the "sb3" system property is NOT set: mvn verify (or mvn -Pnative verify).
          Provides dependencies that exist only in Spring Boot 4:
            spring-boot-starter-opentelemetry — unified OTEL starter (replaces micrometer-tracing bridges)
            spring-boot-webmvc-test           — RestTestClient + SB4 AutoConfigureMockMvc package
        -->
        <profile>
            <id>sb4</id>
            <activation>
                <property>
                    <name>!sb3</name>
                </property>
            </activation>
            <dependencies>
                <dependency>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-opentelemetry</artifactId>
                </dependency>
                <dependency>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-webmvc-test</artifactId>
                    <scope>test</scope>
                </dependency>
            </dependencies>
        </profile>

        <!--
          compat profile — SB4 with older Java (17 or 21).
          Activated via: mvn verify -Dcompat       (Java 21)
                         mvn verify -Dcompat -Djava17   (Java 17)

          Applies Java-version source overlays WITHOUT changing Spring Boot version:
            java-overlays/pre-java25 → ScopedValue replaced by ThreadLocal (Java <25)
            java-overlays/java17     → switch pattern matching replaced by if/else (Java 17)
        -->
        <profile>
            <id>compat</id>
            <activation>
                <property>
                    <name>compat</name>
                </property>
            </activation>
            <properties>
                <java.version>21</java.version>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <version>${maven-antrun-plugin.version}</version>
                        <executions>
                            <execution>
                                <id>compat-merge-sources</id>
                                <phase>initialize</phase>
                                <goals><goal>run</goal></goals>
                                <configuration>
                                    <target xmlns:if="ant:if">
                                        <!-- Step 1: copy all main sources -->
                                        <copy todir="${project.build.directory}/merged-sources/main">
                                            <fileset dir="src/main/java"/>
                                        </copy>
                                        <!-- Step 2: Java <25 compat overlay (ScopedValue → ThreadLocal) -->
                                        <copy todir="${project.build.directory}/merged-sources/main" overwrite="true">
                                            <fileset dir="src/main/java-overlays/pre-java25"/>
                                        </copy>
                                        <!-- Step 3: Java 17 overlay (switch pattern matching → if/else) -->
                                        <copy todir="${project.build.directory}/merged-sources/main" overwrite="true" if:set="java17">
                                            <fileset dir="src/main/java-overlays/java17"/>
                                        </copy>
                                        <!--
                                          Step 4: Rewrite JEP 443 unnamed-variable patterns to
                                          named throwaways.
                                            catch (Xxx _)          (Exception / Throwable / any type)
                                            try (var _ = expr)     (try-with-resources)
                                            case Xxx _ ->          (switch pattern)
                                          All three are preview in JDK 21 and absent in JDK 17.
                                          The rename preserves semantics (the name is still
                                          unused) and works on every JDK we target.
                                        -->
                                        <replaceregexp match="catch \((\w+) _\)"
                                                       replace="catch (\1 _ignored)"
                                                       flags="g" byline="true">
                                            <fileset dir="${project.build.directory}/merged-sources/main" includes="**/*.java"/>
                                        </replaceregexp>
                                        <replaceregexp match="try \(var _ ="
                                                       replace="try (var _ignoredRes ="
                                                       flags="g" byline="true">
                                            <fileset dir="${project.build.directory}/merged-sources/main" includes="**/*.java"/>
                                        </replaceregexp>
                                        <replaceregexp match="case ([\w.]+) _ ->"
                                                       replace="case \1 _ignored ->"
                                                       flags="g" byline="true">
                                            <fileset dir="${project.build.directory}/merged-sources/main" includes="**/*.java"/>
                                        </replaceregexp>
                                        <!--
                                          Step 5: same copy + overlay pattern for tests.
                                          Most tests compile unchanged on Java 21; the pre-java25
                                          overlay replaces the one that touches JDK-25 preview APIs
                                          (TraceServiceTest uses ScopedValue.where()) with a
                                          ThreadLocal-based equivalent. Apply the JEP 443
                                          unnamed-variable rewrites to tests too so the same
                                          patterns used in production code compile on Java 21/17.
                                        -->
                                        <copy todir="${project.build.directory}/merged-sources/test">
                                            <fileset dir="src/test/java"/>
                                        </copy>
                                        <copy todir="${project.build.directory}/merged-sources/test" overwrite="true">
                                            <fileset dir="src/test/java-overlays/pre-java25"/>
                                        </copy>
                                        <!-- Java 17 test overlay : replaces J19+/J21+ APIs in test files
                                             (currently AggregationServicePropertyTest uses
                                              Executors.newVirtualThreadPerTaskExecutor + try-with-resources
                                              on ExecutorService, both J19+/J21+). Symmetric to the main
                                              java17 overlay just above. Only applied when -Djava17 set. -->
                                        <copy todir="${project.build.directory}/merged-sources/test" overwrite="true" if:set="java17">
                                            <fileset dir="src/test/java-overlays/java17"/>
                                        </copy>
                                        <replaceregexp match="catch \((\w+) _\)"
                                                       replace="catch (\1 _ignored)"
                                                       flags="g" byline="true">
                                            <fileset dir="${project.build.directory}/merged-sources/test" includes="**/*.java"/>
                                        </replaceregexp>
                                        <replaceregexp match="try \(var _ ="
                                                       replace="try (var _ignoredRes ="
                                                       flags="g" byline="true">
                                            <fileset dir="${project.build.directory}/merged-sources/test" includes="**/*.java"/>
                                        </replaceregexp>
                                        <replaceregexp match="case ([\w.]+) _ ->"
                                                       replace="case \1 _ignored ->"
                                                       flags="g" byline="true">
                                            <fileset dir="${project.build.directory}/merged-sources/test" includes="**/*.java"/>
                                        </replaceregexp>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-compiler-plugin</artifactId>
                        <!--
                          Scope compileSourceRoots overrides to each execution. Both the compile
                          AND testCompile goals expose a parameter literally named
                          "compileSourceRoots" (testCompile's default is
                          ${project.testCompileSourceRoots}). A plugin-level <configuration>
                          block therefore leaks into default-testCompile and forces it to compile
                          main overlays into target/test-classes — producing 0 discoverable
                          *Test.class for Surefire. Scoping to per-execution configuration is the
                          only correct way to express "main goes here, tests go there".
                          Root cause of the historic "compat-* runs 0 unit tests" CI failure.
                        -->
                        <executions>
                            <execution>
                                <id>default-compile</id>
                                <configuration>
                                    <compileSourceRoots>
                                        <compileSourceRoot>${project.build.directory}/merged-sources/main</compileSourceRoot>
                                    </compileSourceRoots>
                                </configuration>
                            </execution>
                            <execution>
                                <id>default-testCompile</id>
                                <configuration>
                                    <compileSourceRoots>
                                        <compileSourceRoot>${project.build.directory}/merged-sources/test</compileSourceRoot>
                                    </compileSourceRoots>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>

                    <!--
                      Skip *ITest classes in compat mode : the compat job env
                      (CI runner during -Dcompat) doesn't have Docker /
                      Testcontainers / Keycloak available, so Spring contexts
                      fail to load → 60+ errors. Compat mode is ABOUT
                      compile + unit-test compatibility across SB3/4 + J17/21,
                      NOT integration-infra coverage. The default profile
                      (sb4-J25) keeps running the full ITest suite.
                      Per CLAUDE.md "Surgical fixes not allow_failure
                      bypasses" : tag/path-gate, not bypass.
                    -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-failsafe-plugin</artifactId>
                        <configuration combine.children="merge">
                            <excludes>
                                <exclude>**/*ITest.java</exclude>
                            </excludes>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
          sb3 profile — Spring Boot 3.4.x compatibility.
          Activated via: mvn verify -Dsb3            (SB3 + Java 21)
                         mvn verify -Dsb3 -Djava17   (SB3 + Java 17)

          Strategy:
            1. Override Spring Boot version via BOM import (takes precedence over parent).
            2. Default Java to 21 (virtual threads + records); override with -Djava17 for Java 17.
            3. Replace SB4-only dependencies with SB3 equivalents.
            4. Source overlays via maven-antrun-plugin (conditional copies):
               - java-overlays/pre-java25: ScopedValue → ThreadLocal (always, since SB3 = Java <25)
               - java-overlays/java17:     switch pattern matching → if/else (only if -Djava17)
               - java-overlays/sb3:        @GetMapping(version=...) → manual header dispatch (always)
               - test/java-overlays/sb3:   AutoConfigureMockMvc bridge annotation (always)
            5. Exclude RestTestClient test (SB4-only).
        -->
        <profile>
            <id>sb3</id>
            <activation>
                <property>
                    <name>sb3</name>
                </property>
            </activation>
            <properties>
                <java.version>21</java.version>
            </properties>
            <dependencyManagement>
                <dependencies>
                    <!-- Override the parent BOM: all Spring Boot managed versions resolve to 3.4.5.
                         Note : Maven's BOM-import precedence makes this a partial fix only —
                         the parent's `spring-boot-starter-parent:4.0.5` BOM is processed FIRST
                         (deepest first), so transitive deps still resolve to 4.0.5. To force
                         specific deps to SB3 versions, declare them explicitly with version below. -->
                    <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-dependencies</artifactId>
                        <version>${spring-boot-sb3.version}</version>
                        <type>pom</type>
                        <scope>import</scope>
                    </dependency>
                    <!-- Force SB3 version for spring-boot-test-autoconfigure : the AutoConfigureMockMvc
                         shim at src/test/java-overlays/sb3/...AutoConfigureMockMvc.java references
                         the SB3 package `org.springframework.boot.test.autoconfigure.web.servlet`
                         which only exists in SB3 versions of spring-boot-test-autoconfigure.
                         Without this pin, the dep resolves to 4.0.5 (parent BOM wins over profile
                         BOM import) and the SB3 package is missing → test-compile fails.
                         Added 2026-04-24 svc 1.0.52 wave for SB3 cells. -->
                    <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-test-autoconfigure</artifactId>
                        <version>${spring-boot-sb3.version}</version>
                        <scope>test</scope>
                    </dependency>
                    <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-test</artifactId>
                        <version>${spring-boot-sb3.version}</version>
                        <scope>test</scope>
                    </dependency>
                    <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-starter-test</artifactId>
                        <version>${spring-boot-sb3.version}</version>
                        <scope>test</scope>
                    </dependency>
                    <!-- SB3 Jackson V2 enforcement — block V3 transitive sources.
                         SB 3.4 ships Jackson V2 (com.fasterxml.jackson.*) ; SB 4 ships
                         V3 (tools.jackson.*). Without these pins, the parent BOM's
                         SB4 starters transitively pull V3 onto the SB3 classpath,
                         causing NoClassDefFoundError chaos at runtime (mixed V2+V3).
                         Strategy : pin SB4 transitive sources to SB3-aware versions
                         that don't bring tools.jackson :
                         - hateoas : SB4 starter-hateoas → spring-boot-hateoas:4.0.5 →
                           spring-boot-jackson:4.0.5 (V3). SB3 starter-hateoas:3.4.5
                           has different transitive structure (no separate spring-
                           boot-jackson module).
                         - springdoc : 3.x is SB4-aware and pulls spring-boot-
                           jackson:4.0.5. Pin to 2.7.0 = last 2.x line targeting
                           SB3 / Spring 6.
                         Verified 2026-04-25 wave 7 : `mvn -Dsb3 dependency:tree |
                         grep tools.jackson` returns empty after these pins. -->
                    <dependency>
                        <groupId>org.springframework.boot</groupId>
                        <artifactId>spring-boot-starter-hateoas</artifactId>
                        <version>${spring-boot-sb3.version}</version>
                    </dependency>
                    <!-- starter-web/json/websocket pins were attempted 2026-04-25 wave 7
                         to remove residual V3 Jackson transitives, but they broke Lombok
                         annotation processing (compile errors on @Getter-generated
                         methods). Reverted ; left as DEFERRED debt — see ADR-0061
                         Entry 2. -->

                    <!-- Pin Spring Kafka to 3.3.4 (last 3.x release on the SB 3.4.x line).
                         SK 4.0+ ships a JsonKafkaHeaderMapper that hard-references Jackson V3
                         (`tools.jackson.databind.json.JsonMapper`) inside its constructor — so
                         even building a basic KafkaTemplate triggers V3 init. SB3 ships only
                         Jackson V2, hence NoClassDefFoundError on `JsonSerializeAs` / `JsonMapper$Builder`.
                         SK 3.3.4 has none of those V3 references — the serializers + header mapper
                         all use V2 directly. The user-facing classes JsonSerializer / JsonDeserializer
                         (no Jackson prefix) exist in both 3.3.4 and 4.0.4 ; the JacksonJson* prefixed
                         variants are 4.0+ only and require the V3 classpath.
                         The KafkaConfig.java SB3 overlay swaps JacksonJsonSerializer →
                         JsonSerializer (and Deserializer counterpart) so user code lines up with
                         what SK 3.3.4 exposes.
                         Added 2026-04-25 wave 8 — fixes the 4 KafkaConfigTest errors that had been
                         deferred at the end of wave 7. ADR-0061 Entry 4 → ✅ FIXED. -->
                    <dependency>
                        <groupId>org.springframework.kafka</groupId>
                        <artifactId>spring-kafka</artifactId>
                        <version>${spring-kafka-sb3.version}</version>
                    </dependency>
                    <dependency>
                        <groupId>org.springframework.kafka</groupId>
                        <artifactId>spring-kafka-test</artifactId>
                        <version>${spring-kafka-sb3.version}</version>
                        <scope>test</scope>
                    </dependency>

                    <dependency>
                        <groupId>org.springdoc</groupId>
                        <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
                        <version>${springdoc-sb3.version}</version>
                    </dependency>
                    <dependency>
                        <groupId>org.springdoc</groupId>
                        <artifactId>springdoc-openapi-starter-common</artifactId>
                        <version>${springdoc-sb3.version}</version>
                    </dependency>
                </dependencies>
            </dependencyManagement>
            <dependencies>
                <!-- SB3 equivalent of spring-boot-starter-opentelemetry -->
                <dependency>
                    <groupId>io.micrometer</groupId>
                    <artifactId>micrometer-tracing-bridge-otel</artifactId>
                </dependency>
                <dependency>
                    <groupId>io.opentelemetry</groupId>
                    <artifactId>opentelemetry-exporter-otlp</artifactId>
                </dependency>
            </dependencies>
            <build>
                <pluginManagement>
                    <plugins>
                        <!-- Pin spring-boot-maven-plugin to 3.4.5 (parent resolves 4.0.5) -->
                        <plugin>
                            <groupId>org.springframework.boot</groupId>
                            <artifactId>spring-boot-maven-plugin</artifactId>
                            <version>${spring-boot-sb3.version}</version>
                        </plugin>
                    </plugins>
                </pluginManagement>
                <plugins>
                    <!--
                      Source overlay: copy all sources → target/merged-sources, then overwrite
                      with version-specific alternatives. Conditional copies use Ant if:set.
                    -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <version>${maven-antrun-plugin.version}</version>
                        <executions>
                            <execution>
                                <id>sb3-merge-sources</id>
                                <phase>initialize</phase>
                                <goals><goal>run</goal></goals>
                                <configuration>
                                    <target xmlns:if="ant:if">
                                        <!-- Main sources -->
                                        <copy todir="${project.build.directory}/merged-sources/main">
                                            <fileset dir="src/main/java"/>
                                        </copy>
                                        <!-- Java <25 compat (ScopedValue → ThreadLocal) — always for SB3 -->
                                        <copy todir="${project.build.directory}/merged-sources/main" overwrite="true">
                                            <fileset dir="src/main/java-overlays/pre-java25"/>
                                        </copy>
                                        <!-- Java 17 compat (switch → if/else) — only if -Djava17 -->
                                        <copy todir="${project.build.directory}/merged-sources/main" overwrite="true" if:set="java17">
                                            <fileset dir="src/main/java-overlays/java17"/>
                                        </copy>
                                        <!-- SB3 overlay (@GetMapping without version=) — always for SB3 -->
                                        <copy todir="${project.build.directory}/merged-sources/main" overwrite="true">
                                            <fileset dir="src/main/java-overlays/sb3"/>
                                        </copy>

                                        <!-- Test sources (exclude SB4-only RestTestClient test).
                                             Path was stale (com/example/customerservice/) from a
                                             pre-rename of the project — actual location is
                                             org/iris/customer/. Fixed 2026-04-24 svc 1.0.52
                                             wave : without the correct path the file copied to
                                             merged-sources and broke SB3 test-compile because
                                             RestTestClient is Spring Framework 7 (SB4-only). -->
                                        <copy todir="${project.build.directory}/merged-sources/test">
                                            <fileset dir="src/test/java">
                                                <exclude name="org/iris/customer/CustomerRestClientITest.java"/>
                                            </fileset>
                                        </copy>
                                        <!-- pre-java25 test overlay : replaces ScopedValue (J25 preview)
                                             with InheritableThreadLocal in TraceServiceTest. SB3 mode
                                             targets Java 21 so ScopedValue is preview-only — same swap
                                             as compat profile. Without this the SB3 test-compile fails
                                             at TraceServiceTest.java:25 with 'java.lang.ScopedValue is
                                             a preview API and is disabled by default'. Fixed 2026-04-24
                                             svc 1.0.52 wave (SB3 profile was missing this overlay step
                                             that the compat profile already had). -->
                                        <copy todir="${project.build.directory}/merged-sources/test" overwrite="true">
                                            <fileset dir="src/test/java-overlays/pre-java25"/>
                                        </copy>
                                        <!-- Java 17 test overlay : same as compat profile — replaces
                                             AggregationServicePropertyTest's J21+ try-with-resources
                                             on ExecutorService + Executors.newVirtualThreadPerTaskExecutor()
                                             with platform threads + try/finally. Only applies when
                                             -Djava17 set. Without this, compat-sb3-java17 fails
                                             test-compile at AggregationServicePropertyTest.java:84.
                                             Fixed 2026-04-24 svc 1.0.53+ wave (SB3 antrun was
                                             missing this overlay copy that the compat profile had). -->
                                        <copy todir="${project.build.directory}/merged-sources/test" overwrite="true" if:set="java17">
                                            <fileset dir="src/test/java-overlays/java17"/>
                                        </copy>
                                        <!-- SB3 test overlay (AutoConfigureMockMvc bridge) -->
                                        <copy todir="${project.build.directory}/merged-sources/test" overwrite="true">
                                            <fileset dir="src/test/java-overlays/sb3"/>
                                        </copy>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <!--
                      Point the compiler at the merged source directories.
                      maven-compiler-plugin's compile AND testCompile goals BOTH expose a
                      parameter named "compileSourceRoots" (testCompile defaults it to
                      ${project.testCompileSourceRoots}). A plugin-level <configuration> with
                      <compileSourceRoots> leaks into default-testCompile and forces it to
                      compile src/main into target/test-classes. testCompileSourceRoots at the
                      plugin level is NOT a recognised parameter (Maven logs "unknown").
                      Fix: scope each override to its matching execution. Same pitfall as
                      the compat profile above — see TASKS.md "compat-* runs 0 unit tests".
                    -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-compiler-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>default-compile</id>
                                <configuration>
                                    <compileSourceRoots>
                                        <compileSourceRoot>${project.build.directory}/merged-sources/main</compileSourceRoot>
                                    </compileSourceRoots>
                                </configuration>
                            </execution>
                            <execution>
                                <id>default-testCompile</id>
                                <configuration>
                                    <compileSourceRoots>
                                        <compileSourceRoot>${project.build.directory}/merged-sources/test</compileSourceRoot>
                                    </compileSourceRoots>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>

                    <!-- Skip ITest in sb3 mode — same rationale as compat (no IT infra in compat env). -->
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-failsafe-plugin</artifactId>
                        <configuration combine.children="merge">
                            <excludes>
                                <exclude>**/*ITest.java</exclude>
                            </excludes>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
          report profile — enables quality analysis tools that are skip=true by default.
          Usage: mvn verify -Preport -DskipITs -Djacoco.skip=true
          Generates: SpotBugs XML, OWASP CVE JSON/HTML, Checkstyle XML.
          Note: PMD is excluded here — its type inference engine crashes on Java 25 code.
                Run PMD on -Dcompat -Djava17 builds instead.
          Pitest: mvn test-compile pitest:mutationCoverage -Preport
          Intended to be run manually or via a daily CI schedule — NOT on every push.
        -->
        <profile>
            <id>report</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>com.github.spotbugs</groupId>
                        <artifactId>spotbugs-maven-plugin</artifactId>
                        <configuration>
                            <skip>false</skip>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <configuration>
                            <skip>false</skip>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>org.pitest</groupId>
                        <artifactId>pitest-maven</artifactId>
                        <configuration>
                            <skip>false</skip>
                        </configuration>
                        <!-- Bind to verify phase so mvn verify -Preport runs pitest automatically -->
                        <executions>
                            <execution>
                                <id>pitest-verify</id>
                                <phase>verify</phase>
                                <goals><goal>mutationCoverage</goal></goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
          report-static profile — enables PMD and Checkstyle for static analysis.
          Both tools crash on Java 25 syntax (pattern matching when-guards), so this
          profile must be combined with -Dcompat (Java 21) or -Dcompat -Djava17 (Java 17).

          Usage:
            mvn verify -Preport,report-static -Dcompat -DskipITs -Djacoco.skip=true
              → SpotBugs + OWASP + PMD + Checkstyle on Java 21

          PMD is compatible with Java ≤ 22; Checkstyle is compatible with Java ≤ 21.
          Do NOT use with Java 25 — both tools crash on Java 25 syntax.
        -->
        <profile>
            <id>report-static</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-pmd-plugin</artifactId>
                        <configuration>
                            <skip>false</skip>
                        </configuration>
                    </plugin>
                    <plugin>
                        <groupId>org.apache.maven.plugins</groupId>
                        <artifactId>maven-checkstyle-plugin</artifactId>
                        <configuration>
                            <skip>false</skip>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <!--
          java26 profile — targets Java 26 (short-term release, GA March 2026).
          Activated via -Djava26 property.
          Usage: mvn verify -Djava26                    → SB4 + Java 26
                 mvn verify -Djava26 -Dcompat           → SB4 + Java 26 (compat source)

          Prerequisites:
            - Java 26 JDK must be installed and set as JAVA_HOME
            - ASM 9.8+ may need an update to 9.9+ when Java 26 class files (version 70) are parsed by SpotBugs

          Note: Java 26 does not introduce incompatible changes with Java 25 code.
          The ScopedValue / StructuredConcurrency APIs used in this project are stable in Java 26.
          Run: mvn verify -Djava26 to validate after installing Java 26 JDK.
        -->
        <profile>
            <id>java26</id>
            <activation>
                <property>
                    <name>java26</name>
                </property>
            </activation>
            <properties>
                <java.version>26</java.version>
            </properties>
        </profile>

        <!--
          java17 profile — overrides java.version to 17 when -Djava17 is set.
          Composable with -Dcompat or -Dsb3:
            mvn verify -Dcompat -Djava17   → SB4 + Java 17
            mvn verify -Dsb3 -Djava17      → SB3 + Java 17

          IMPORTANT : this profile MUST stay last in the <profiles> list.
          Maven evaluates profiles in declaration order ; the last
          profile to set a property wins. Both `compat` (sets 21) and
          `sb3` (sets 21) declare `<java.version>` — java17 must run
          after them to guarantee the 17 override lands.
        -->
        <profile>
            <id>java17</id>
            <activation>
                <property>
                    <name>java17</name>
                </property>
            </activation>
            <properties>
                <java.version>17</java.version>
                <!-- Checkstyle 13.x is compiled with Java 21 bytecode (class file
                     version 65.0) so it crashes the J17 runtime with
                     UnsupportedClassVersionError. Pin to 10.21.0 — last 10.x
                     line which still supports J11+ (so J17 is fine).
                     Compat-sb4-java17 + compat-sb3-java17 cells affected.
                     Trade-off : 10.21.0 lacks a few 11.x/12.x/13.x rule
                     additions but our custom config/checkstyle.xml is calibrated
                     to the rules that existed in 10.x already. Phase C
                     (failOnViolation=true) tested locally with 10.21.0. Added
                     2026-04-24 svc 1.0.53+ wave (compat-sb4-java17 evidence :
                     pipeline #2478396905 job 14084177782 UnsupportedClassVersionError). -->
                <checkstyle.version>10.21.0</checkstyle.version>
            </properties>
        </profile>
    </profiles>

    <repositories>
        <!-- Maven Central — primary artifact repository for all standard dependencies -->
        <repository>
            <id>central</id>
            <name>Maven Central</name>
            <url>https://repo1.maven.org/maven2</url>
            <snapshots><enabled>false</enabled></snapshots>
        </repository>
    </repositories>

    <!--
      Maven Site reporting — wires all quality plugins into the HTML site generated by `mvn site`.
      Run: mvn site
      Output: target/site/index.html

      Reports included:
        - Project info (dependencies, licenses, team, SCM, CI)
        - Surefire + Failsafe test results
        - JaCoCo code coverage (merged unit + integration)
        - SpotBugs static analysis
        - PMD static analysis + copy/paste detection
        - Checkstyle style violations
        - Javadoc API reference
        - JXR cross-reference source (enables source links in PMD/Checkstyle reports)
    -->
    <reporting>
        <plugins>
            <!-- Standard project info pages -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
                <version>${maven-project-info-reports-plugin.version}</version>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>index</report>
                            <report>summary</report>
                            <report>dependencies</report>
                            <report>dependency-management</report>
                            <report>plugins</report>
                            <report>plugin-management</report>
                            <report>team</report>
                            <report>licenses</report>
                            <report>scm</report>
                            <report>issue-management</report>
                            <report>ci-management</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>

            <!-- Unit + integration test results -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-report-plugin</artifactId>
                <version>${maven-surefire-report-plugin.version}</version>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>report-only</report>
                            <report>failsafe-report-only</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>

            <!-- JaCoCo code coverage — reads jacoco.exec produced during verify -->
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>${jacoco-maven-plugin.version}</version>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>report</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>

            <!-- SpotBugs — reads spotbugsXml.xml produced during verify -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${spotbugs-maven-plugin.version}</version>
            </plugin>

            <!-- PMD and CPD omitted from site reporting — PMD 7.x crashes with StackOverflowError
                 on some Java 25 pattern-matching constructs (known upstream issue). PMD results
                 are already available at /actuator/quality (embedded XML in the JAR). -->

            <!-- Checkstyle omitted from site reporting — its Antlr-based parser does not support
                 Java 25 pattern guards (`case X e when ...`). Results available at /actuator/quality.
                 Re-add when checkstyle-plugin bundles an Antlr grammar for Java 25. -->

            <!-- Javadoc API reference with inline source code.
                 linksource=true: generates src-html/ pages for every class — each Javadoc
                 page gets a "View Source" link showing the raw Java with line numbers.
                 This is the Compodoc equivalent for Java: browse classes + read source
                 without leaving the browser. Uses the JDK javadoc tool (Java 25 native),
                 unlike JXR which is disabled due to its Java 25 parser bug. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-javadoc-plugin</artifactId>
                <version>${maven-javadoc-plugin.version}</version>
                <configuration>
                    <!-- doclint=none: avoid failures on intentionally brief internal Javadoc -->
                    <doclint>none</doclint>
                    <failOnError>false</failOnError>
                    <quiet>true</quiet>
                    <!-- Generate HTML source pages linked from each Javadoc class page -->
                    <linksource>true</linksource>
                </configuration>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>javadoc</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>

            <!-- JXR cross-referenced HTML source browser.
                 Generates xref/ directory: every .java file rendered as hyperlinked HTML,
                 with class/method references cross-linked to their declarations.
                 PMD and Checkstyle reports also link to the JXR source pages.
                 Note: older JXR versions crashed on Java 25 pattern-matching
                 (ParseLock#doParse StackOverflowError). Using 3.6.0 which has an improved
                 parser. If it fails on specific constructs, the site will still build
                 (the antrun copy step tolerates missing xref/ gracefully). -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jxr-plugin</artifactId>
                <version>${maven-jxr-plugin.version}</version>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>jxr</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>

            <!-- OWASP Dependency-Check: omitted from <reporting> because dependency-check-maven
                 12.x does not implement the Maven site reporting interface (AbstractMethodError
                 on MavenReport.generate). Instead, the report is copied into target/site/ by
                 the maven-antrun-plugin post-site execution below. -->

        </plugins>
    </reporting>

</project>