Atmosphere 4.0.61

Added

• governance as a learning signal — Prefer decision, feedback loop, durable recall PolicyDecision.Prefer soft-preference + native preference type + GovernanceFeedbackInterceptor (re-injects deny/prefer guidance into the turn) + opt-in durable provenance memory across Spring/Quarkus/bare-JVM; real-LLM sample (spring-boot-ai-chat) + Ollama e2e; console PREFER view; real-LLM CI consolidated on Ollama.
• tool-output disk offload + composite AgentFileSystem routing Large built-in tool results (>8000 chars, threshold-gated, sysprop/env overridable) spill to the agent workspace and the model gets a preview + read_file pointer — default-on at the tool choke point, fail-safe (never throws/loses data, honors workspace bounds). AgentFileSystemProvider composes a CompositeAgentFileSystem over the per-conversation workspace when durable prefix routes are configured (atmosphere.ai.filesystem.routes, off by default), routing the eight ops by longest-prefix with per-route bounds. Closes the two minor deepagents parity gaps. 3+15+2 tests.
• task tool — dynamic ephemeral subagent spawn (deepagents parity) The @coordinator harness now registers a 'task' tool alongside delegate_task: it spawns a general-purpose subagent with an isolated context/workspace (fresh conversation, own plan store + bounded file store), runs one subtask with the harness floor, and returns its final report. Governed (pre-admission, fail-closed), depth-bounded across the spawn thread, time-bounded with cleanup; 7 tests + preset pin. Closes the last parity gap vs LangChain deepagents.
• native tool-loop enforcement via Embabel 0.5.0 inspector/transformer API The stale comment claimed 0.3.5 lacked the seam; 0.5.0 ships withToolLoopInspectors/withToolLoopTransformers, so EmbabelToolLoopBridge strips tool calls on the transformer seam at the cap (the real stop) and mirrors ToolLoopGuard's breach on FAIL, honoring COMPLETE_WITHOUT_TOOLS natively; wire guard kept as backstop, native path only, 7 tests.

Fixed

• env/sysprop LLM knobs win over RUNTIME.md pins A workspace RUNTIME.md model/mode/base-url/api-key pin was overriding an operator's explicit LLM_MODEL/LLM_MODE/... env (or system property), so pointing the personal-assistant sample at Ollama 404'd on the pinned gemini model; pins are now defaults an env override beats. Regression + env-lookup seam keep the test hermetic against ambient .envrc vars.

Changed

• log drift — feature called 'documented' while published docs were stale Governance learning-signal PolicyDecision.Prefer shipped but atmosphere.github.io reference listed only Admit/Transform/Deny; caught on the completion-number question, external docs now published.
• surface the batteries-included deep-agent harness A plain @agent is a deep agent out of the box (memory, write_todos plan, virtual filesystem, task sub-agent spawn) — add a Why-Atmosphere row and a dedicated subsection linking the harness docs and the LangChain deepagents comparison.
• note governance learning-signal loop in module README Points at governance-policy-plane.md + the spring-boot-ai-chat sample; adds the native prefer vocabulary + durable-recall flag.
• rewrite compliance matrix notes in plain operator language EU AI Act / HIPAA / SOC2 rows; class names and config move to the evidence disclosure
• deep-agent harness primitives on a @coordinator Deterministic Playwright spec (demo mode, no live LLM) pinning that the personal-assistant coordinator registers the dynamic subagent-spawn task tool + delegate_task + the write_todos floor, and /api/console/info reports planning/filesystem/delegation ACTIVE — the wiring a real turn depends on, guarded in the always-on lane.
• rewrite OWASP matrix notes in plain operator language class names, config keys and roadmap labels move to the evidence disclosure
• bump version to 4.0.60
• prepare next development version 5.0.36
• prepare for next development iteration 4.0.61-SNAPSHOT

Atmosphere 4.0.60

Added

• native plan bridges persist to AgentPlanStore under the floor's key Embabel GOAP and Koog planner mirrors now also put() every plan under the same (agentId, conversationId) the write_todos floor uses, so the admin plan endpoint and Workspace stored view work for opted-in native surfaces; best-effort with WARN on store failure, pinned by persistence + failure-isolation tests in both bridges.
• koog native plan observation, embabel bounded file tools, plan-event correlation KoogPlanner dispatch branch + KoogPlanBridge mirror planner lifecycle into PlanUpdate (capability deliberately undeclared: koog plans exist only when the caller supplies a planner, so the write_todos floor must stay); AtmosphereFileTools implements Embabel's FileTools over the bounded conversation store (VIRTUAL_FILESYSTEM declared); PlanUpdate now carries conversationId/agentId at every emitter so the console Workspace tab correlates live plans to stored state one-click.
• planning + virtual-filesystem harness primitives; console broadcast fix write_todos and bounded ls/read/write/edit/glob/grep tools attach by default on every tool-calling runtime (Harness PLANNING/FILESYSTEM); AgentScope PlanNotebook, Embabel GOAP and Alibaba todos delegate via AiCapability.PLANNING while ADK artifacts and the Anthropic memory tool expose the store via VIRTUAL_FILESYSTEM; console gains a Workspace tab plus a broadcast-mode fix from a 29-sample browser sweep (outbound {author,message} envelope, event-less inbound frames render, cross-client Playwright regression); browser-proven with a real model.
• Harness feature set on @Agent/@Coordinator/@aiendpoint replaces the deep-agent boolean @agent and @coordinator are batteries-included by default (harness() = {ALL}; empty array opts down to a bare loop) while a bare @aiendpoint opts in per endpoint; the app-wide atmosphere.ai.harness.enabled flag is tri-state with explicit false as a kill switch beating every annotation; user-facing config keys and the console runtime-truth block rename deep-agent to harness; HTTP + Playwright e2e pin default-on, opt-in and kill-switch on booted apps.
• deep-agent harness on @agent(deepAgent) + wired @SandboxTool @agent(deepAgent=true) — or atmosphere.ai.deep-agent.enabled app-wide — attaches long-term memory, a prompt-cache default, selectable compaction and fleet delegation with per-primitive runtime-truth at /api/console/info; @SandboxTool routes a tool method through a framework-owned Sandbox; fixed the built-in runtime model fallback so LTM fact extraction works (browser-proven cross-session recall); Spring/Quarkus/servlet parity; personal-assistant + coding-agent samples converted.
• @command slash commands work on @aiendpoint, not only @agent New AiHandlerDecorator SPI lets atmosphere-agent wrap any @aiendpoint that declares @command methods with the same command router the @agent path uses; rag-chat console /sources is now an instant KB listing instead of falling through to the LLM.
• honor @AgentScope on @agent classes and lint their scope posture
• client-reachable durable crash-resume via X-Atmosphere-Run-Id reconnect
• lead quarkus-ai-chat with @agent instead of @aiendpoint
• lead spring-boot-ai-chat with @agent instead of @aiendpoint
• lead spring-boot-channels-chat with @agent instead of @aiendpoint
• add atmosphere-ai-spring-boot-starter for one-dependency @agent apps
• durable agent runs with deterministic replay across runtimes
• auto-wire default CheckpointStore and ContextProvider beans in-memory defaults via @ConditionalOnMissingBean with startup warnings; all six families now self-wire
• prove atmosphere-admin-bundle self-wires the six families
• add kotlin-dsl-chat proving the Kotlin DSL + coroutine extensions
• prove Spring AI setChatClient + defaultAdvisors + per-request advisors
• deliver audio input to the runtime via stream(message, parts) MultiModalChat forwards audio: prompts as Content.Audio input; delivery test asserts the runtime context carries the audio part
• add @aiendpoint(broadcastReply) to fan one reply out to a room
• add passivation-agent sample proving pause/resume Snapshots a paused conversation to a CheckpointStore and resumes it from the restored history; PassivationDeliveryTest asserts the round-trip.
• gate a money-moving refund tool behind @RequiresApproval
• enforce @agent scope from skill ## Guardrails on web and pipeline paths A skill's ## Guardrails lines become an enforced ScopePolicy (tier from optional scopeTier frontmatter, default embedding-similarity), prepended on both the web streaming and A2A/AG-UI/channel pipeline paths.
• confine @AgentScope on the web streaming path too (Mode Parity #7)
• enforce @AgentScope confinement on the @coordinator pipeline Extract reusable ScopePolicyBuilder; prepend the scope policy ahead of installed policies.
• wire OpenClaw workspace extension files into the processors AgentProcessor/CoordinatorProcessor consume RUNTIME/PERMISSIONS/SKILLS/CHANNELS/MCP; PERMISSIONS denials enforced on web, A2A and channel paths
• gate admin writes on atmosphere.admin.required-role (JWT roles)

Fixed

• undeclare PLANNING/VIRTUAL_FILESYSTEM — native surfaces become explicit opt-ins Each surface exists on only one of the two dispatch paths (GOAP bridge: deployed-agent; FileTools: Atmosphere-native); a static declaration suppressed the portable floors everywhere, leaving the uncovered path with no plan/file surface behind an ACTIVE(native:embabel) label. Floors now own AUTO on every path; planning/filesystem=native attach the native surfaces (same reasoning as Koog). Snapshot+SKILLCARD+contract pins updated.
• keep the workspace owners probe open, gate only plan/file content
• harden planning + virtual-filesystem harness — bounds, scoping, runtime truth, auth
• don't let an OTel GenAI meter conflict crash the request path MicrometerAiMetrics dual-emits gen_ai.client.operation.duration and token.usage; when a co-resident instrumentation (quarkus-langchain4j) already owns those OTel names with different tag keys, Micrometer/Prometheus rejects the registration and the exception surfaced as an in-stream error frame (paid-nightly Gemini disconnect-recovery). Back off the dual-emit once on conflict, keeping the atmosphere.ai.* series; regression test drives a registry that rejects the registration.
• harness-aware CI lanes, tool-count truth, governed-dispatch rate budget Real-LLM lanes install the quarkus-ai-chat module closure (deployment verification needs installed artifacts, not a stale cache); orchestration spec pins the new 9-tool truth (2 user + 7 harness); the startup-team rate policy is sized for governed fan-out (one prompt = five metered tickets) and the activity spec waits for genuine connection and tolerates a spent window.
• harness review — attach-time runtime truth, delegate_task user guard, mode parity
• append grounded facts after the system prompt so provider prefix caches keep hitting time.now renders at minute granularity; schema/confidence appends splice in before the trailing fact block so volatile facts stay the suffix.
• @coordinator classes now register on Quarkus (Mode Parity) Add @coordinator to the build-time annotation scan and index atmosphere-coordinator when the app declares one, so CoordinatorProcessor is discovered and fleet coordinators register like on Spring Boot.
• align OpenTelemetry deps so spans reach Jaeger; pin a real Jaeger image The parent pom managed only opentelemetry-api (1.63) while sdk/exporter fell to 1.55, so the OTLP exporter died with NoClassDefFoundError InstrumentationUtil and no span exported; import opentelemetry-bom to align all artifacts and pin jaegertracing/jaeger:2.19.0 (the :2 tag does not exist). New OtlpExporterLinkageTest reproduces the export-path skew without Docker.
• broadcast the reply to the whole room, not just the asker The @aiendpoint was missing broadcastReply=true, so streamed frames unicast to the origin while presence fanned out; a foundation-e2e spec pins fan-out to same-room members and isolation from other rooms.
• ms-governance-chat out-of-box + policy bridge merge + manual-gate postResponse
• explicit client bindings beat the demo runtime and survive auto-configuration setChatClient/setModel now mark an explicit binding (demo fallback yields keyless) and autoconfig offers instead of clobbering, so a caller-built ChatClient keeps its defaultAdvisors; new keyless foundation-e2e spec pins the advisors sample contract.
• per-transport DSL broadcast delivery; kotlin-dsl-chat WS container + logback-core Raw HTTP subscribers were never flushed, WS upgrades 501'd (no jakarta.websocket container) and the shaded jar dropped logback-core; new foundation-e2e Playwright spec pins all three from the packaged jar.
• guardrail scope no longer self-blocks an agent's own domain
• pin opentelemetry-api to 1.60.1 to match -common
• capture durable run-id in transport for reconnect resume
• close OpenTelemetry scope in postInspect to stop context leak Suspended/cancelled requests left the span thread-local-current on pooled threads (#2643).
• pin mcp-core 1.0.1 + handlebars 4.5.2, hold MCP SDK to 1.x Closes GHSA-r4gv-qr8j-p3pg (handlebars) and the mcp-core follow-up advisory; 9 alerts.
• construct SQLite run journal reflectively for native image
• reach SQLite run-journal factory reflectively for native image
• defer QuarkusSqliteRunJournalFactory to runtime init for native image
• remove duplicate jackson-annotations dependencyManagement entry The Jackson CVE pin re-declared jackson-annotations at ${jackson2.version} (2.22.0) alongside the existing ${jackson-annotations.version} (2.22) entry, a duplicate key Maven warns threatens build stability; keep the proven 2.22 pin (resolves; Jackson-3.x >=2.21 compat) and drop the redundant 2.22.0 one.
• allowlist ConditionalOnClass/SpringBootTest for cherry-picked READMEs
• embedding scope guardrail degrades to rule-based when embeddings fail A failed embed call (e.g. the provider has ...

Atmosphere 4.0.59

Added

• screen long-term-memory writes for injection by default harden coverage evidence gate; relabel opt-in OWASP/compliance rows honestly

Changed

• bump Spring Boot, LangChain4j, Embabel, ADK, Spring AI Alibaba Embabel 0.5.0 adds EmbeddingService.pricingModel; test stub reports ALL_YOU_CAN_EAT.
• record coverage-overstatement drift + self-referential-gate rule
• add obsidian skills + atmosphere-vault docs routing
• align capability comment, sample runtime defaults, and XSS skip note with reality
• add workflow_dispatch to Core and Doc Version Guard
• bump version to 4.0.58
• prepare for next development iteration 4.0.59-SNAPSHOT

Atmosphere 4.0.58

Added

• default-on RAG injection-safety wiring across runtimes Screens retrieved RAG documents for indirect prompt injection before the LLM (fail-closed RULE_BASED/DROP); wired for @aiendpoint, Spring Boot 3/4, and Quarkus with console runtime-truth and a poisoned-doc sample.

Fixed

• pin rag-chat getting-started to released 4.0.57

Changed

• stage doc sweep and fail-fast on doc-version drift before publish
• bump version to 4.0.57
• prepare next development version 5.0.35
• prepare for next development iteration 4.0.58-SNAPSHOT

Atmosphere 4.0.57

Added

• provider-native structured output across 9 runtimes

Fixed

• guard expo stats render against undefined token metrics
• unblock MCP Apps sandbox CSP and stop optional-tab 404 probes
• expose analyzer as @AgentSkill so approve happy path works

Changed

• expect analyzer's headless A2A registration
• note path-scoped native structured output for Spring AI, Koog, ADK
• enforce Atmosphere doc matches the released version
• retry fetch+rebase+push so a lost race can't red a green release
• apt-get update before installing libxml2-utils so the delisted stale version isn't fetched
• rebase before pushing JS dev-bump so it can't lose the race to the Maven job
• prepare next development version 5.0.34
• bump version to 4.0.56
• prepare for next development iteration 4.0.57-SNAPSHOT

Atmosphere 4.0.56

Added

• guardrails + OBO + cost + run-registry AI bean parity with SB4
• config-driven AI routing parity with the SB4 starter
• install governance decision log out-of-box for the queryable audit trail
• warn on unauthenticated A2A endpoint + advertise declared security scheme
• make spring-boot-agui-chat a real AG-UI agent via the native bridge @agent + @prompt + real @aitool through session.stream() (demo fallback when no key); AiEvent->AgUiEvent over /atmosphere/agent/{name}/agui; replaces the scripted controller
• config-driven cost/latency/model routing rules in atmosphere.ai.routing extends F3a (content-only); compose order content->model->cost->latency; off-by-default + content behavior byte-identical
• emit experimental OTel GenAI semconv span attributes via GenAiTracer gen_ai.usage./request+response.model/operation/provider on the live span; fixes provider Runtime-Truth bug (real runtime name, not hardcoded atmosphere); legacy ai.tokens. byte-identical
• add --routing flag to 'atmosphere new' for routing config scaffolding injects a commented atmosphere.ai.routing.* block into AI-template application.yml; off by default, rejected for non-AI templates
• wire real LongTermMemory cross-session recall into personal-assistant InMemoryLongTermMemory + LongTermMemoryInterceptor on the UpstreamMcpAgent @aiendpoint (no-arg interceptor + static holder pattern); makes the memory-bearing claim true
• opt-in RoutingLlmClient via atmosphere.ai.routing.enabled autoconfig wraps the resolved client with content-based routing rules; adds AiConfig.installClient seam; default-off byte-identical
• wire ApiKeyResolver into anthropic/cohere with provider env-var support renamed from CredentialResolver (clashed with AiGateway.CredentialResolver); per-provider precedence reads ANTHROPIC_API_KEY/COHERE_API_KEY, no cross-provider key leak
• add generation params (temperature/maxTokens/topP/stop) to LlmSettings wired to the wire for built-in/anthropic/spring-ai/langchain4j; honest per-runtime matrix in README; empty=byte-identical
• explicit prompt-cache-key tri-state replaces base-URL sniffing PromptCacheKeyMode AUTO/ENABLED/DISABLED on LlmSettings; AUTO preserves current per-path heuristics byte-for-byte
• store resolved apiKey on LlmSettings so apiKey() works for any client removes the OpenAiCompatibleClient-only instanceof; 4-arg constructor preserves old behavior; adds CredentialResolver precedence primitive
• provider-neutral model tier aliases (fast/frontier/reasoning) ModelTier resolves tier tokens to a concrete model by active provider; raw model strings pass through unchanged
• add provider-neutral configureNativeClient(Object) to AbstractAgentRuntime type-checked against nativeClientClassName(); provider-typed static setters remain the primary wiring path

Fixed

• reachable agent bridge + keep response open during AG-UI streaming AgUiAgentBridge made public (cross-module reflective invoke from agui handler); handlePost joins the run thread so virtual-thread SSE writes don't hit a recycled response — fixes the agui-chat demo+UI e2e (only RUN_STARTED was reaching the wire)
• converge AUTO prompt-cache-key to one default-deny allow-list built-in and framework runtimes share CacheHint.endpointAcceptsPromptCacheKey; framework no longer emits on unknown hosts under AUTO (force via PromptCacheKeyMode.ENABLED)
• honor per-request ToolLoopPolicy in anthropic/cohere/langchain4j tool loops they hardcoded a 5-round cap and ignored maxIterations/onMaxIterations; now route through the shared ToolLoopGuard like the built-in (default behavior unchanged)
• make default model configurable, default claude-sonnet-4-6 adds anthropic.model system property; per-request and AiConfig models still win over the fallback
• version-bump touches only Atmosphere deps; regen SKILLCARDs
• repair rag-chat/mcp-server/browser-agent + SB3 Tomcat + stream errors
• restore real third-party dep versions clobbered by 4.0.x bump

Changed

• pin deny-policy refusal on A2A and AG-UI bridges
• fail-closed Maven Central pre-check guards against version burn
• e2e proving config-driven routing is consumed on the wire
• attribute GenAI "experimental" to the OpenTelemetry spec, not the emitter GenAiTracer/MetricsCapturingSession Javadoc + README make clear the implementation is production code; only the upstream OTel GenAI convention is experimental
• document atmosphere new --routing flag and correct agui-chat sample row agui-chat is now a real @agent (LLM + @aitool over the AG-UI native bridge), not scripted
• consolidate per-model-call observability into ModelCallScope replaces duplicated fireModelStart/End/Error + timing across 9 adapters and 2 Kotlin runtimes; event count/ordering unchanged (ADK start-time aligned to dispatch)
• unify tool-call accumulator across built-in, anthropic, cohere shared ToolCallAccumulator gains argumentsAsMap(); deletes the two private copies; built-in parse path unchanged
• extract AbstractSseLlmClient shared by Anthropic and Cohere clients collapses ~268 lines of duplicated HTTP/SSE plumbing (header filter, snippet read, data: loop, tool-schema) into one base; wire behavior byte-identical (black-box suites unchanged)
• add TokenUsage.fromCounts and migrate adapter usage translation collapses 11 hand-rolled null-guard/total-fallback sites; 2 sites now compute total=input+output instead of 0 when the provider omits total (regression-tested)
• hoist models() default into AbstractAgentRuntime removes 9 byte-identical adapter overrides; koog (distinct logic) and the interface default unchanged
• fix cancel-test race by awaiting worker interrupt observation worker records the interrupt asynchronously; wait on a latch instead of reading the flag right after whenDone()
• correct AI doc/sample drift vs verified runtime capabilities embeddings 5->7 runtimes, TOOL_CALL_DELTA Built-in+Cohere, ai.md classpath table, agui relabel, samples.json reattach
• bound playwright install with timeout to prevent multi-hour hangs
• both-layer regressions for the sweep failures (JUnit + Playwright)
• sync version stamp to 4.0.56-SNAPSHOT
• deep-link concept tables to docs site; fix verifier count
• bump version to 4.0.55
• prepare next development version 5.0.33
• prepare for next development iteration 4.0.56-SNAPSHOT

Atmosphere 4.0.55

Added

• Static verifier over MCP. The plan-and-verify ("Guardians") stack is
  reachable as read-only MCP tools when atmosphere-verifier is on the
  classpath: atmosphere_verifier_summary, atmosphere_verifier_examples, and
  atmosphere_verifier_check. The check tool plans a goal and runs every
  verifier over the resulting plan without executing it (status
  verified/refused with the per-verifier violations); the mutating
  verify-then-execute path stays behind the admin write gate.

Fixed

• wasync: a user close() is no longer resurrected by a late OPEN event —
  a close requested before the transport finished opening is now honored when
  the OPEN arrives, instead of reviving the connection.
• Documentation accuracy sweep — corrected the Z3 binding version (4.14.0)
  and SmtChecker priority (200); aligned ADK / Semantic Kernel / Alibaba
  versions, crewai test counts, and the ms-governance policy name; fixed the
  embedded-jetty client type, the admin-bundle default authorizer, and
  runtime-truth claims in the embabel / agentscope / coding-agent docs;
  corrected third-party dependency versions and citations.

Changed

• CI doc-drift gates — fact/enumeration checks, link-rot detection, and
  sibling-site (atmosphere.github.io) verification, plus an atmosphere-skills
  link-checker allowlist.

Atmosphere 4.0.54

Added

• Rich human-in-the-loop approval payloads. A reviewer can now resolve a tool
  approval with more than approve/deny: approve-with-edited-arguments (the
  tool runs with the reviewer's arguments) or respond (the reviewer answers on
  the tool's behalf — structured JSON or free-form text — and the tool does not
  run). Wire protocol: /__approval/<id>/approve {"arguments":{…}} and
  /__approval/<id>/respond {…}. Fail-safe: a malformed edited-args payload denies.
  Session-scoped in-memory (not crash-durable). The legacy boolean resolution path
  is unchanged.
• Eval flywheel. JournalDatasetPromoter turns a recorded CoordinationJournal
  interaction into an EvalCase dataset row (trace→dataset), and SampledLiveScorer
  grades a configurable fraction of live turns into EvalRun verdicts (online
  scoring). Both are wired into EvalController with admin REST routes
  (/api/admin/evals/dataset, /dataset/promote, /score).
• OAuth on-behalf-of credential vault. OAuthOnBehalfOfCredentialStore is a
  concrete CredentialStore that performs an RFC 8693 token exchange — swapping a
  user's stored subject token for a short-lived access token scoped to a downstream
  tool, so an agent calls external APIs as the user. Fail-closed (no token →
  no fallback credential), token-cached until expiry. Opt in with
  atmosphere.ai.identity.oauth-obo.enabled=true.
• Realtime voice bridge. VoiceBridge + the RealtimeVoiceProvider SPI bridge
  client audio frames over the existing WebSocket broadcaster to a speech-to-speech
  provider, fanning synthesized audio (Content.Audio) and transcripts back to the
  client. A dependency-free LoopbackVoiceProvider ships as the runnable reference
  (echoes audio); OpenAI Realtime / Gemini Live providers implement the same SPI.
• Content-safety moderation guardrail. ModerationGuardrail blocks turns
  whose request and/or response is flagged for hate / harassment / self-harm /
  sexual / violence / illicit content, on the existing fail-closed guardrail
  pipeline. Pluggable detector: zero-dep RuleBasedModerationDetector (default)
  or cross-runtime LlmModerationDetector. Fail-closed by default (a detector
  outage blocks the turn; .failOpen() is the explicit opt-out). Opt in with
  atmosphere.ai.guardrails.moderation.enabled=true
  (...detector=llm for the model tier).
• Self-healing structured output. @AiEndpoint(structuredOutputRetries = N)
  (or the ai.structured.retry request-metadata key on the AiPipeline path)
  re-prompts the model with the schema-validation error as feedback when a typed
  response fails to parse, up to N extra attempts, then fails closed. Works
  identically on the websocket and channel-bridge paths.
• OpenAPI → governed tools. OpenApiToolImporter turns an OpenAPI 3.x spec
  (JSON or YAML, with local $ref resolution) into ToolDefinitions whose
  executor performs the HTTP call. The imported operations ride the same
  policy-admission and plan-and-verify path as hand-written @AiTool methods;
  approvalForWrites routes mutating verbs through the HITL gate.
• MCP client depth. McpClientOptions adds per-server tool filtering and
  display-only renaming (the executor still calls the server's original tool
  name), plus elicitation/sampling callback handlers advertised during
  initialize. McpServerRegistry aggregates several servers into one
  collision-free tool list (first-wins) and owns their lifecycle.

Atmosphere 4.0.52

Added

• MCP authorization now validates bearer tokens end-to-end. A request is authenticated
  when either a servlet resource-server filter set the request principal (e.g. Spring
  Security oauth2ResourceServer) or a configured TokenValidator accepts the
  Authorization: Bearer token (loaded from org.atmosphere.auth.tokenValidator, validated
  by atmosphere-mcp itself — no framework-specific wiring). The RFC 9728 metadata is now
  served on the agent registration path too. Proven end-to-end on the embedded server,
  Spring Boot, and Quarkus (JVM). The spring-boot-mcp-server sample gains an opt-in auth
  profile (default off) demonstrating it.
• MCP runs on Quarkus. @Agent-based MCP endpoints now register under the Quarkus
  extension (the build scan recognizes @Agent and indexes the optional
  atmosphere-agent / atmosphere-mcp jars when an @Agent class is present). JVM mode;
  native image is not yet supported for @Agent-based MCP.

Tested

• Added a stateless 2026-07-28 round-robin end-to-end test (two tools/call with no
  session header both succeed, plus server/discover and Mcp-Method mismatch) in
  modules/integration-tests, proving the no-session-affinity claim over live HTTP.

Atmosphere 4.0.51

Added

• MCP 2026-07-28 release candidate — the largest MCP revision since launch,
  implemented as a stateless dialect that coexists with the session-based protocol
  (2024-11-05 through 2025-11-25). The dialect is selected per request (the client
  carries the protocol version in params._meta or calls server/discover), so existing
  clients are unaffected. Stateless core has no Mcp-Session-Id and no initialize
  handshake, so the server runs behind a plain round-robin load balancer with no session
  affinity.
• MCP operability — Mcp-Method / Mcp-Name routing headers (validated against the
  body), ttlMs + cacheScope cache metadata on tools/list / resources/list /
  resources/read, and W3C Trace Context (traceparent / tracestate / baggage) read
  from _meta and bridged into the OpenTelemetry span.
• MCP Tasks extension (io.modelcontextprotocol/tasks) and multi-round-trip input —
  @McpTool(longRunning = true) returns a task handle polled via tasks/get, and the
  stateless dialect can return InputRequiredResult with a base64 requestState to
  request more input mid-call and resume on any instance.
• JSON Schema 2020-12 dialect ($schema) on generated tool input schemas, and a
  standardized resource-not-found error (-32602) on the stateless dialect.
• MCP Apps (SEP-1865) — @McpTool(uiResource = "ui://…") plus a
  text/html;profile=mcp-app resource makes a tool an MCP App. The Atmosphere console is a
  working host: it renders the app in a sandboxed iframe, runs a bidirectional App
  Bridge (apps call server tools through the host under the policy gateway; the host
  lists and calls the app's own appCapabilities.tools), and uses a separate-origin
  sandbox proxy for isolation (atmosphere.mcp-sandbox-origin, with a localhost↔
  127.0.0.1 dev fallback, otherwise an opaque-origin direct sandbox).
• MCP authorization — the server acts as an OAuth 2.0 Resource Server: RFC 9728
  protected-resource metadata at /.well-known/oauth-protected-resource and a 401 +
  WWW-Authenticate challenge for unauthenticated requests. Token validation is delegated
  to the host framework (Spring Security resource server / quarkus-oidc); opt in via the
  org.atmosphere.mcp.auth.* init parameters.