Repository navigation
Add Java / Spring Boot implementation with contract and CI coverage #67
Description
Approved scope
The maintainer approved the Java / Spring Boot implementation plan in the development chat on 2026-09-17, including TDD, review, quality gates, one PR, exact-head CI verification, squash merge and post-merge checks.
Fresh baseline: 2a515cf8d839d5a81c356f8a1ef0b9e376666d92. No open PRs were present. Main CI 35172561157 and Pages 35173146745 succeeded.
Add java-spring-boot under apps/java-spring-boot/ using Java 25, Spring Boot 4.1, Spring MVC/Tomcat and JDBC/PostgreSQL/HikariCP. Use a checksum-verified Gradle wrapper, strict dependency locking and artifact verification; select and verify exact published patch/build versions during implementation.
Registration is separate from official cohort activation. Preserve eight-stack-v1, frozen historical cohorts, existing eight implementations and all published result/history bytes. No official benchmark, publication, new cohort, release/tag, credentials or repository-protection changes are authorized by this issue. #52 stays deferred; #59 remains pending the next separately authorized justified official run.
Acceptance criteria
- Implement the unchanged shared HTTP/JSON contract, parameterized live SQL with signed BIGINT boundaries and sanitized failures, and uncached direct-recursive Fibonacci(30).
- Tests precede implementation; record failing and passing evidence for new behavior.
- Fix Java, Gradle, direct/transitive dependency versions and container digests; validation never regenerates locks or verification metadata.
- Run a non-root single JVM under the common 1 CPU / 512 MiB settings with a maximum-ten connection pool, finite startup/failure behavior and graceful SIGTERM cleanup.
- Verify the actual production container against PostgreSQL, changed fixture rows, boundaries/errors, concurrency, process/resource/network constraints and cleanup; no performance publication.
- Extend registry projections and metadata parsing without invoking Java/Gradle on unrelated language jobs. Existing official-version selection and historical data remain unchanged.
- Add a Java-only CI toolchain path, acceptance and common contract coverage; retain all existing gates and fail-closed
requiredaggregation. - Update English/Japanese documentation to distinguish nine registered implementations from eight officially measured implementations.
- Pass applicable/full CI gates, review the exact final PR head, squash merge and verify post-merge CI and ordinary Pages.
Execution
Use one branch feat/add-java-spring-boot and one PR. Any temporary non-publishing development workflow must remain read-only, be restricted to this owned branch, and be removed before merge. A temporary workflow is development evidence, not an official measurement or final CI substitute.
Follow-up cohort activation and justified official measurement/publication require a separate decision. JVM warm-up suitability must be considered there; do not silently alter the existing common five-second warm-up.
Completion evidence — 2026-09-17
Implemented and squash-merged in #69. Final reviewed head: ad0d02bcf0323153f7228ad5c28319f27ada22eb. Actual merge/main commit: 9b92c74cba34bd5a4bfc389075b9bef135131034. Both share the exactly reviewed tree 5916fff3612e03ea882b2938dbcbf9b4eee741c9; the merge parent is the freshly verified main 6e25eb07759bd6eed4de9ab9ee3d1dd35562932b.
- PR CI 35194319804: all 13 jobs succeeded on the final head.
- Main CI 35196871135: all 13 jobs succeeded on the merge commit, including all nine implementations, shared checks, non-publishing smoke, retained Axum diagnostic and fail-closed
requiredaggregation. The Java job reran actual production/PostgreSQL acceptance, 22 native tests, 38 contract-runner tests and 14 live HTTP checks successfully. - Ordinary Pages 35197629301: automatic build and deploy succeeded for the exact merge SHA. The deployment log confirms artifact
10486941394and the correctpages_build_version. Downloaded archive SHA-256e3133fccf5a0a752643f365350c82635ff3e6dde4c98373c01d0b684c8311083was verified; all 10 packaged files match a fresh build from the reviewed tree.
The existing latest official result, all three historical reports, generated README result blocks and original eight application directories are unchanged. No official run or new result publication was performed. Both temporary Java development files were removed before merge; local-only planning/investigation paths remain ignored and untracked.
Verification limits: actual ARM64 acceptance was not run; direct public HTTP/CDN/browser verification was unavailable because this environment could not retrieve/resolve the Pages host. Exact deployed artifact bytes and successful deployment are verified, not a live-browser session. Supplementary local full-contract and whole-site replays timed out and are not reported as passes; the corresponding hosted CI suites passed. Review was self-review, not independent approval. Detailed evidence and the preserved red/green history are recorded in #69 and the existing comments. #52 remains deferred and #59 remains open.
Activity
tappe9 commentedon Sep 17, 2026
Execution evidence and tooling adaptation
Initial baseline local shared checks ran 174 tests: 173 passed; the sole failure was the Go module gate attempting an unavailable network toolchain download. Main CI remains the independently fetched successful baseline; no baseline gate is being weakened.
Test-first registration/metadata/CI tests failed in all three expected assertions before implementation. Read-only development run
35185291659onc1bf47f1fa02ad8f6e64e46d106db539fb7b5a70verified the exact Temurin/Gradle distribution and wrapper checksums, generated the candidate strict lock and verification metadata, and then recorded 21 compile errors for deliberately absent production Java classes. No production Java existed in that run. The earlier bootstrap failure was an incompatible Gradle resolution flag combination, corrected while retaining strict locking.The local execution transport subsequently stopped responding after the build-kit download. Continue Java/container verification on GitHub-hosted runners rather than claiming unexecuted local tests. To import the generated wrapper/lock files without manually retranscribing binary bytes, use a separate temporary object-import job: only this job has
contents: write, it reads the exact immutable development artifact, verifies the known wrapper checksum, posts Git blobs for an explicit six-file allowlist, and emits their identities. It does not execute application/dependency code, create commits or update any ref. Tests remain read-only. Branch updates remain explicit connector actions and main still requires the approved review/CI/merge sequence.This replaces the initial blanket read-only restriction for that temporary object-import step only; it is not a new result publisher, credential, App or protection mechanism. All temporary development jobs must be removed before merge. No official measurement, publication, cohort or historical result change is authorized or performed.
tappe9 commentedon Sep 17, 2026
Integration verification in progress
Committed wrapper/lock/checksum evidence is now on the feature branch. The temporary bootstrap importer has been removed. Locked Java tests and
installDistpassed with the committed files. Six fail-closed acceptance-helper regressions also passed after the missing-harness red run; actual Docker acceptance is the next gate, not yet a completion claim.Use the same non-executing Git-object import pattern only for a fixed fifteen-file registry/CI/formatting allowlist generated in the read-only test job. This substitutes for the unavailable local editor: the preparation script operates on a disposable checkout, checks exact source anchors, regenerates registry projections, records its complete patch and rejects unrelated file edits. A separate short-lived job may create Git blobs from that same-run artifact but executes no checkout/dependency code and creates no commit or ref. Review and connector branch updates remain explicit. Remove the temporary preparation script and workflow before final CI/merge.
The public Temurin release confirms ARM64 JDK archive SHA-256
69df11a02cfa3ef7d7ca645e03edce6778ec090e100f6ae2b42097865730ac52. Because the available digest-pinned Temurin images predate the selected hotfix, replace their JDK/JRE directories with exact checksum-verified 25.0.4.1+1 archives rather than silently downgrading or using mutable tags. AMD64 container behavior will be tested first; merely adding ARM64 archive pins is not evidence of a successful ARM64 execution.Static extraction from the committed lock currently reports Boot 4.1.1, Tomcat 11.0.24, PostgreSQL JDBC 42.7.13, HikariCP 7.0.2, Jackson databind 3.1.5 and Gradle 9.7.1. The lock itself is the authority, not earlier candidate-version notes. No official cohort, measurement, publication, protection or result change is part of this work.