Run 4 hours earlier so results are available before the
ITK dashboard deploys.

The Windows CI on the private security fix repo fails on
checkout of these files since the names are too long

…mpa… (#937)

fix: add no-args constructors to response and request classes for Gson compatibility

Gson's reflective adapter falls back to sun.misc.Unsafe.allocateInstance()
when no no-args constructor is available. This fails in modular environments
like WildFly's JBoss Modules. Adding no-args constructors lets Gson
instantiate these classes directly without Unsafe.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

feat: Creating a website to be deployed with Github Pages

Initial website

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

…ion (#935)

* feat!: add TaskAuthorizationProvider SPI for per-user task authorization

Add an opt-in SPI that lets multi-user deployments control which
authenticated user may read, write, or create tasks. When a CDI bean
implementing TaskAuthorizationProvider is present the SDK wraps the
RequestHandler in an AuthorizationRequestHandlerDecorator that enforces
per-operation checks and records task ownership on creation.

Key additions:
- TaskAuthorizationProvider interface with checkRead/checkWrite/
  checkCreate/isTaskRecorded/recordOwnership contract
- AuthorizationRequestHandlerDecorator that intercepts every
  RequestHandler method and delegates to the provider
- AuthenticatedUser record replacing anonymous User implementations
  across all transports (gRPC, JSON-RPC, REST) and compat-0.3
- User.getAttribute() default method for extensible role/claim access
- Authorization-aware filtering in InMemoryTaskStore.list() and
  JpaDatabaseTaskStore.list() with correct pagination
- Comprehensive test suite covering all transports, multi-version
  dispatching, and the decorator itself
- Security guidance in README and javadoc: fail-closed ownership
  policy, TOCTOU race pitfall, CDI injection requirement

BREAKING CHANGE: TaskStore.list() signature now includes
ServerCallContext to support authorization filtering.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

#950)

When a Quarkus request filter has already activated the CDI request
context before runWithDeferredContextDestruction() is called, the method
previously skipped the deferred-destruction logic and ran the task
directly. This allowed the request filter to call terminate() and
destroy @RequestScoped beans while the ManagedExecutor agent thread was
still running, causing failures when accessing OIDC token credentials.

Now the method always takes ownership of the context lifecycle: it
captures the existing state (or activates a fresh context), deactivates
in the finally block so Arc's terminate() becomes a no-op, and defers
actual destruction to the SSE response endHandler/closeHandler.

This fixes #949

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

… and JSON-RPC transports (#947)

JsonFormat.printer() uses Gson's JsonWriter with HTML escaping enabled by
default, converting <, >, & to Unicode escape sequences. This corrupts
message content containing those characters.

Fix by post-processing JsonFormat output to remove HTML escape sequences in
RestTransport, RestHandler, JSONRPCUtils, and their v0.3 compat counterparts.

This fixes #892

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

This fixes #928

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

…951)

* fix: suppress CancellationException in JDK HTTP client SSE streaming

Filter out CancellationException in both the reactive subscriber's
onError and the CompletableFuture error handler to prevent spurious
error propagation when the HTTP client is closed during an active SSE
stream. Also fix a race between onError and onComplete by using
compareAndSet in onComplete, and remove redundant subscription.cancel()
calls.

This fixes #946

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

* fix: use deferred CDI context destruction for multiversion streaming endpoints

Streaming endpoints in MultiVersionJSONRPCRoutes and MultiVersionRestRoutes
were using runInRequestContext() which destroys the CDI context immediately,
before the async agent thread can access @RequestScoped beans. Switch to
runInRequestContextDeferred() which defers destruction until the SSE response
completes.

Also refactors MultiVersionRestRoutes to deduplicate dispatch methods by
adding a boolean streaming parameter and a runInContext() helper.

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

---------

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>

- Fix null subject handling in server routes: use UnauthenticatedUser
  instead of AuthenticatedUser with empty string when subject is null
- Handle uppercase hex digits in HtmlEscapeUtils unicode unescaping
  (< in addition to <), with tests
- Extract buildPost() in REST transports to serialize the request body
  once instead of twice (once for logging, once for sending)
- Add Message event handling in AuthorizationRequestHandlerDecorator to
  extract taskId from streaming messages
- Remove deprecated A2AClientHTTPError constructors
- Remove unused methods and fields: Utils_v0_3.unmarshalFrom(),
  Utils_v0_3.rethrow(), ServerCallContext.modelConfig,
  RequestContext.Builder getters, AsyncExecutorProducer.logPoolStats()

Signed-off-by: Emmanuel Hugonnet <ehugonne@redhat.com>