Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.47

[dependabot]

Bumps org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.47.

Release notes

Sourced from org.atmosphere:atmosphere-runtime's releases.

Atmosphere 4.0.47

Added

• Native Anthropic Messages API runtime in a new atmosphere-anthropic module (1195845304). AnthropicMessagesClient posts directly to https://api.anthropic.com/v1/messages, parses the SSE stream (message_start, content_block_start, content_block_delta with text_delta and input_json_delta, message_delta carrying usage.input_tokens/output_tokens, message_stop), and drives the tool_use → tool_result loop through the shared ToolExecutionHelper.executeWithApproval (max five rounds, cancellation-aware). AnthropicAgentRuntime is registered via ServiceLoader at priority 100 — same posture as every other framework runtime — and inherits executeWithOuterRetry so it claims PER_REQUEST_RETRY honestly alongside TEXT_STREAMING, SYSTEM_PROMPT, STRUCTURED_OUTPUT, TOOL_CALLING, TOOL_APPROVAL, TOKEN_USAGE, CONVERSATION_MEMORY, BUDGET_ENFORCEMENT, CONFIDENCE_SCORES, and PASSIVATION. isAvailable() returns true only when anthropic.api.key (system property or AiConfig.LlmSettings) is present, satisfying Correctness Invariant #5 (Runtime Truth). The capability snapshot, capability matrix, and modules/ai/README.md prose were regenerated in the same commit; runtime count is now ten.
• LangChain4j 1.15.0 parity (9e72c6c6f7): tool-error fallback in ToolExecutionHelper.executeWithApproval wraps null/blank exception messages with the throwable's simple class name so NPEs surface as {"error":"NullPointerException"} to the model instead of opaque {"error":"null"}. Custom HTTP headers on OpenAiCompatibleClient carry proxy / per-tenant / tracing metadata (Helicone, OpenRouter, …); reserved names (Authorization, Content-Type, Accept) are filtered at request-build time. AgentFleet.vote(...) adds consensus dispatch — fans every call out in parallel and returns the result whose normalized text (strip().toLowerCase(Locale.ROOT)) is shared by the most peers, with deterministic insertion-order tie-breaking and a synthetic "vote" failure when every peer fails.
• JFR observability, declarative tool permissions, first-run sub-agent guard, and episodic memory (63e34f11a4):
  • JFR events under org.atmosphere.ai.jfr — AiCallEvent, AgentTurnEvent, ToolInvocationEvent, SubAgentDispatchEvent, EpisodicMemoryAccessEvent, SessionLifecycleEvent, AiErrorEvent — emitted by JfrAiMetrics. CompositeAiMetrics lets JFR coexist with Micrometer (and any other backend) instead of one replacing the other.
  • ToolPermissionPolicy SPI with the PropertiesToolPermissionPolicy reference impl: declarative ALLOW/DENY rules layered on top of the existing @RequiresApproval annotation gate. Reachable from ToolExecutionHelper so every runtime inherits it.
  • First-run sub-agent dispatch guard in DefaultAgentFleet — the bootstrap pass sequences the first call through every peer individually before the parallel fan-out path is unlocked, so a

... (truncated)

Changelog

Sourced from org.atmosphere:atmosphere-runtime's changelog.

[4.0.47] - 2026-05-21

Added

• Native Anthropic Messages API runtime in a new atmosphere-anthropic module (1195845304). AnthropicMessagesClient posts directly to https://api.anthropic.com/v1/messages, parses the SSE stream (message_start, content_block_start, content_block_delta with text_delta and input_json_delta, message_delta carrying usage.input_tokens/output_tokens, message_stop), and drives the tool_use → tool_result loop through the shared ToolExecutionHelper.executeWithApproval (max five rounds, cancellation-aware). AnthropicAgentRuntime is registered via ServiceLoader at priority 100 — same posture as every other framework runtime — and inherits executeWithOuterRetry so it claims PER_REQUEST_RETRY honestly alongside TEXT_STREAMING, SYSTEM_PROMPT, STRUCTURED_OUTPUT, TOOL_CALLING, TOOL_APPROVAL, TOKEN_USAGE, CONVERSATION_MEMORY, BUDGET_ENFORCEMENT, CONFIDENCE_SCORES, and PASSIVATION. isAvailable() returns true only when anthropic.api.key (system property or AiConfig.LlmSettings) is present, satisfying Correctness Invariant #5 (Runtime Truth). The capability snapshot, capability matrix, and modules/ai/README.md prose were regenerated in the same commit; runtime count is now ten.
• LangChain4j 1.15.0 parity (9e72c6c6f7): tool-error fallback in ToolExecutionHelper.executeWithApproval wraps null/blank exception messages with the throwable's simple class name so NPEs surface as {"error":"NullPointerException"} to the model instead of opaque {"error":"null"}. Custom HTTP headers on OpenAiCompatibleClient carry proxy / per-tenant / tracing metadata (Helicone, OpenRouter, …); reserved names (Authorization, Content-Type, Accept) are filtered at request-build time. AgentFleet.vote(...) adds consensus dispatch — fans every call out in parallel and returns the result whose normalized text (strip().toLowerCase(Locale.ROOT)) is shared by the most peers, with deterministic insertion-order tie-breaking and a synthetic "vote" failure when every peer fails.
• JFR observability, declarative tool permissions, first-run sub-agent guard, and episodic memory (63e34f11a4):
  • JFR events under org.atmosphere.ai.jfr — AiCallEvent, AgentTurnEvent, ToolInvocationEvent, SubAgentDispatchEvent, EpisodicMemoryAccessEvent, SessionLifecycleEvent, AiErrorEvent — emitted by JfrAiMetrics. CompositeAiMetrics lets JFR coexist with Micrometer (and any other backend) instead of one replacing the other.
  • ToolPermissionPolicy SPI with the PropertiesToolPermissionPolicy reference impl: declarative ALLOW/DENY rules layered on top of the existing @RequiresApproval annotation gate. Reachable from ToolExecutionHelper so every runtime inherits it.
  • First-run sub-agent dispatch guard in DefaultAgentFleet — the bootstrap pass sequences the first call through every peer individually before the parallel fan-out path is unlocked, so a

... (truncated)

Commits

• cf9007e release: Atmosphere 4.0.47
• a562ecb docs(drift): log AnthropicAgentRuntime PER_REQUEST_RETRY under-claim caught b...
• f25a470 docs: changelog + README — Anthropic runtime, LC4j 1.15 parity, JFR/permissio...
• 1195845 feat(anthropic): native Anthropic Messages API runtime — SSE streaming + tool...
• 9e72c6c feat(ai,coordinator): LC4j 1.15.0 parity — tool-error fallback, customHeaders...
• df19027 test(integration): widen GrpcWasyncTransportTest status-poll to 20s for JDK 2...
• 63e34f1 feat(ai): JFR observability, ToolPermissionPolicy, first-run subagent guard, ...
• 38565e4 fix(coding-agent): case-insensitive README probe + drop dual config
• c1e4d72 chore(cli): bump version to 4.0.46
• 2d45e65 chore(js): prepare next development version 5.0.26
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #3164.