Merge remote-tracking branch 'upstream/main' into cursor/spike-spdd-dice-projection-17f4

Author: jmjava

.github/workflows/export-seed.yml

@@ -29,10 +29,10 @@ jobs:
       - name: Checkout guide
         uses: actions/checkout@v4
 
-      - name: Set up JDK 21
+      - name: Set up JDK 25
         uses: actions/setup-java@v4
         with:
-          java-version: '21'
+          java-version: '25'
           distribution: 'temurin'
           cache: maven
 

.github/workflows/maven.yml

@@ -20,13 +20,20 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
+    # The pom targets Java 21 bytecode but the toolchain builds on 21 through 25.
+    # Testing on both proves that stays true; 25 is the JDK the container image runs.
+    strategy:
+      fail-fast: false
+      matrix:
+        java: ['21', '25']
+
     steps:
       - uses: actions/checkout@v4
 
-      - name: Set up JDK 21
+      - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v4
         with:
-          java-version: '21'
+          java-version: ${{ matrix.java }}
           distribution: 'temurin'
           cache: maven
 
@@ -58,10 +65,11 @@ jobs:
         run: mvn -U -B jacoco:report
         continue-on-error: true
 
-      # Publish test results as check run annotations
+      # Publish test results as check run annotations.
+      # Only from the 25 leg - two legs would race to create the same check run.
       - name: Publish Test Results
         uses: dorny/test-reporter@v1
-        if: always() && github.ref == 'refs/heads/main'
+        if: always() && github.ref == 'refs/heads/main' && matrix.java == '25'
         with:
           name: Test Results
           path: target/surefire-reports/*.xml
@@ -73,16 +81,17 @@ jobs:
         uses: actions/upload-artifact@v4
         if: always()
         with:
-          name: test-reports
+          name: test-reports-java${{ matrix.java }}
           path: |
             target/surefire-reports/
             target/site/jacoco/
           retention-days: 14
 
-      # Upload coverage to Codecov (optional - requires CODECOV_TOKEN secret)
+      # Upload coverage to Codecov (optional - requires CODECOV_TOKEN secret).
+      # One leg only - both produce identical coverage.
       - name: Upload Coverage to Codecov
         uses: codecov/codecov-action@v4
-        if: always()
+        if: always() && matrix.java == '25'
         continue-on-error: true
         with:
           files: target/site/jacoco/jacoco.xml

Dockerfile

@@ -2,7 +2,7 @@
 # Uses jammy (not alpine) because ONNX Runtime needs libstdc++
 # Expects guide-app.jar to be pre-built and placed in this directory
 
-FROM eclipse-temurin:21-jre-jammy
+FROM eclipse-temurin:25-jre-jammy
 
 RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
 
@@ -19,9 +19,20 @@ COPY guide-app.jar app.jar
 
 EXPOSE 1337
 
+# Both flags below require the JDK 25 base image pinned above:
+# --enable-native-access exists from JDK 22, --sun-misc-unsafe-memory-access from JDK 23.
+# The jar itself is Java 21 bytecode and runs on any JRE 21+, but if you drop this image
+# back to a 21 JRE you must remove these two lines or the JVM will refuse to start.
+#
+# --enable-native-access: ONNX Runtime and DJL tokenizers call System::load; without this
+#   JDK 25 warns, and a future JDK will refuse the call outright.
+# --sun-misc-unsafe-memory-access=allow: Netty still uses sun.misc.Unsafe memory access,
+#   which JDK 25 warns about on first use. Drop this once Netty no longer needs it.
 ENTRYPOINT ["java", \
   "-XX:+UseContainerSupport", \
   "-XX:MaxRAMPercentage=75.0", \
   "-XX:+UseG1GC", \
   "-XX:+ParallelRefProcEnabled", \
+  "--enable-native-access=ALL-UNNAMED", \
+  "--sun-misc-unsafe-memory-access=allow", \
   "-jar", "app.jar"]

README.md

@@ -439,8 +439,8 @@ The Dockerfile uses a multi-stage build that compiles the application from sourc
 - ⚠️ First build takes ~2-3 minutes (Maven compilation inside Docker)
 
 The build process:
-1. Stage 1: Uses `maven:3.9.9-eclipse-temurin-21` to compile the application
-2. Stage 2: Uses lightweight `eclipse-temurin:21-jre-jammy` runtime image with the compiled JAR
+1. Stage 1: Uses `maven:3.9-eclipse-temurin-25` to compile the application
+2. Stage 2: Uses lightweight `eclipse-temurin:25-jre-jammy` runtime image with the compiled JAR
 
 This approach ensures consistency across environments and simplifies onboarding for new contributors.
 
@@ -553,6 +553,11 @@ export OPENAI_API_KEY=sk-your-key-here
 
 2. **Neo4j**: See the [Local vs CI Testing](#local-vs-ci-testing) section below.
 
+3. **A JDK between 21 and 25**. The build targets Java 21 bytecode, so the resulting jar
+   runs on any JRE 21+, but it builds on anything up to 25 — CI runs the suite on both 21
+   and 25. If you raise `<java.version>` in the pom, note that Kotlin must be 2.3.0+ to
+   target 25 at all, and the `codegen-gradle` Kotlin version has to move with it.
+
 ### Local vs CI Testing
 
 The test suite uses Neo4j, which can be provided in two ways:

codegen-gradle/build.gradle.kts

@@ -1,7 +1,8 @@
 // Gradle build for Drivine KSP code generation
 //
 // Why: Maven's third-party KSP plugin (kotlin-maven-symbol-processing) hasn't been
-// updated for Kotlin 2.2.0 yet. This Gradle build is a workaround to generate Drivine DSL code.
+// updated for current Kotlin releases yet. This Gradle build is a workaround to generate Drivine DSL code.
+// Keep the Kotlin version here in sync with ${kotlin.version} in the parent pom.
 //
 // How it works:
 // 1. This Gradle build runs KSP on the domain classes
@@ -11,8 +12,8 @@
 // To run code generation: ./gradlew kspKotlin
 
 plugins {
-    kotlin("jvm") version "2.2.0"
-    id("com.google.devtools.ksp") version "2.2.20-2.0.4"
+    kotlin("jvm") version "2.3.21"
+    id("com.google.devtools.ksp") version "2.3.10"
 }
 
 group = "com.embabel.guide"

codegen-gradle/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.12.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

pom.xml

@@ -17,10 +17,13 @@
     <description>Embabel chatbot</description>
 
     <properties>
+        <!-- Bytecode target, NOT the build JDK. The toolchain (Kotlin 2.3.x, Gradle 9.x,
+             JaCoCo 0.8.15) builds on JDK 21 through 25; keeping the target at 21 means the
+             artifact runs on any JRE 21+. Raise this only when dropping Java 21 support. -->
         <java.version>21</java.version>
         <embabel-agent.version>1.0.0-RC1-SNAPSHOT</embabel-agent.version>
         <spring-ai.version>1.1.1</spring-ai.version>
-        <kotlin.version>2.2.0</kotlin.version>
+        <kotlin.version>2.3.21</kotlin.version>
     </properties>
 
     <dependencies>
@@ -51,7 +54,7 @@
         <dependency>
             <groupId>org.drivine</groupId>
             <artifactId>drivine4j-spring-boot-starter</artifactId>
-            <version>0.0.46</version>
+            <version>0.0.59</version>
         </dependency>
 
         <!-- Chat session storage with autoconfiguration -->
@@ -366,7 +369,7 @@
             <plugin>
                 <groupId>org.jacoco</groupId>
                 <artifactId>jacoco-maven-plugin</artifactId>
-                <version>0.8.12</version>
+                <version>0.8.15</version>
                 <executions>
                     <execution>
                         <id>prepare-agent</id>

src/main/kotlin/com/embabel/hub/integrations/LlmProvider.kt

@@ -1,5 +1,9 @@
 package com.embabel.hub.integrations
 
+import com.embabel.agent.api.models.AnthropicModels
+import com.embabel.agent.api.models.DeepSeekModels
+import com.embabel.agent.api.models.OpenAiModels
+
 /**
  * Supported LLM providers for BYOK (Bring Your Own Key).
  * Each provider defines default models for each role in the Guide app.
@@ -12,18 +16,18 @@ enum class LlmProvider(
     val validationModel: String = chatModel,
 ) {
     OPENAI(
-        chatModel = "gpt-4.1",
-        classifierModel = "gpt-4.1-mini",
-        narratorModel = "gpt-4.1-mini",
-        summarizerModel = "gpt-4.1-nano",
-        validationModel = "gpt-4.1-nano",
+        chatModel = OpenAiModels.GPT_41,
+        classifierModel = OpenAiModels.GPT_41_MINI,
+        narratorModel = OpenAiModels.GPT_41_MINI,
+        summarizerModel = OpenAiModels.GPT_41_NANO,
+        validationModel = OpenAiModels.GPT_41_NANO,
     ),
     ANTHROPIC(
-        chatModel = "claude-sonnet-4-6",
-        classifierModel = "claude-haiku-4-5",
-        narratorModel = "claude-haiku-4-5",
-        summarizerModel = "claude-haiku-4-5",
-        validationModel = "claude-haiku-4-5",
+        chatModel = AnthropicModels.CLAUDE_SONNET_4_6,
+        classifierModel = AnthropicModels.CLAUDE_HAIKU_4_5,
+        narratorModel = AnthropicModels.CLAUDE_HAIKU_4_5,
+        summarizerModel = AnthropicModels.CLAUDE_HAIKU_4_5,
+        validationModel = AnthropicModels.CLAUDE_HAIKU_4_5,
     ),
     MISTRAL(
         chatModel = "mistral-large-latest",
@@ -33,10 +37,10 @@ enum class LlmProvider(
         validationModel = "mistral-small-latest",
     ),
     DEEPSEEK(
-        chatModel = "deepseek-chat",
-        classifierModel = "deepseek-chat",
-        narratorModel = "deepseek-chat",
-        summarizerModel = "deepseek-chat",
+        chatModel = DeepSeekModels.DEEPSEEK_V4_PRO,
+        classifierModel = DeepSeekModels.DEEPSEEK_V4_FLASH,
+        narratorModel = DeepSeekModels.DEEPSEEK_V4_FLASH,
+        summarizerModel = DeepSeekModels.DEEPSEEK_V4_FLASH,
     ),
 
 }