Bump org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.61

[dependabot]

Bumps org.atmosphere:atmosphere-runtime from 3.1.0 to 4.0.61.

Release notes

Sourced from org.atmosphere:atmosphere-runtime's releases.

Atmosphere 4.0.61

Added

• governance as a learning signal — Prefer decision, feedback loop, durable recall PolicyDecision.Prefer soft-preference + native preference type + GovernanceFeedbackInterceptor (re-injects deny/prefer guidance into the turn) + opt-in durable provenance memory across Spring/Quarkus/bare-JVM; real-LLM sample (spring-boot-ai-chat) + Ollama e2e; console PREFER view; real-LLM CI consolidated on Ollama.
• tool-output disk offload + composite AgentFileSystem routing Large built-in tool results (>8000 chars, threshold-gated, sysprop/env overridable) spill to the agent workspace and the model gets a preview + read_file pointer — default-on at the tool choke point, fail-safe (never throws/loses data, honors workspace bounds). AgentFileSystemProvider composes a CompositeAgentFileSystem over the per-conversation workspace when durable prefix routes are configured (atmosphere.ai.filesystem.routes, off by default), routing the eight ops by longest-prefix with per-route bounds. Closes the two minor deepagents parity gaps. 3+15+2 tests.
• task tool — dynamic ephemeral subagent spawn (deepagents parity) The @​Coordinator harness now registers a 'task' tool alongside delegate_task: it spawns a general-purpose subagent with an isolated context/workspace (fresh conversation, own plan store + bounded file store), runs one subtask with the harness floor, and returns its final report. Governed (pre-admission, fail-closed), depth-bounded across the spawn thread, time-bounded with cleanup; 7 tests + preset pin. Closes the last parity gap vs LangChain deepagents.
• native tool-loop enforcement via Embabel 0.5.0 inspector/transformer API The stale comment claimed 0.3.5 lacked the seam; 0.5.0 ships withToolLoopInspectors/withToolLoopTransformers, so EmbabelToolLoopBridge strips tool calls on the transformer seam at the cap (the real stop) and mirrors ToolLoopGuard's breach on FAIL, honoring COMPLETE_WITHOUT_TOOLS natively; wire guard kept as backstop, native path only, 7 tests.

Fixed

• env/sysprop LLM knobs win over RUNTIME.md pins A workspace RUNTIME.md model/mode/base-url/api-key pin was overriding an operator's explicit LLM_MODEL/LLM_MODE/... env (or system property), so pointing the personal-assistant sample at Ollama 404'd on the pinned gemini model; pins are now defaults an env override beats. Regression + env-lookup seam keep the test hermetic against ambient .envrc vars.

Changed

• log drift — feature called 'documented' while published docs were stale Governance learning-signal PolicyDecision.Prefer shipped but atmosphere.github.io reference listed only Admit/Transform/Deny; caught on the completion-number question, external docs now published.
• surface the batteries-included deep-agent harness A plain @​Agent is a deep agent out of the box (memory, write_todos plan, virtual filesystem, task sub-agent spawn) — add a Why-Atmosphere row and a dedicated subsection linking the harness docs and the LangChain deepagents comparison.
• note governance learning-signal loop in module README Points at governance-policy-plane.md + the spring-boot-ai-chat sample; adds the native prefer vocabulary + durable-recall flag.
• rewrite compliance matrix notes in plain operator language EU AI Act / HIPAA / SOC2 rows; class names and config move to the evidence disclosure
• deep-agent harness primitives on a @​Coordinator Deterministic Playwright spec (demo mode, no live LLM) pinning that the personal-assistant coordinator registers the dynamic subagent-spawn task tool + delegate_task + the write_todos floor, and /api/console/info reports planning/filesystem/delegation ACTIVE — the wiring a real turn depends on, guarded in the always-on lane.
• rewrite OWASP matrix notes in plain operator language class names, config keys and roadmap labels move to the evidence disclosure
• bump version to 4.0.60
• prepare next development version 5.0.36
• prepare for next development iteration 4.0.61-SNAPSHOT

Atmosphere 4.0.60

Added

• native plan bridges persist to AgentPlanStore under the floor's key Embabel GOAP and Koog planner mirrors now also put() every plan under the same (agentId, conversationId) the write_todos floor uses, so the admin plan endpoint and Workspace stored view work for opted-in native surfaces; best-effort with WARN on store failure, pinned by persistence + failure-isolation tests in both bridges.
• koog native plan observation, embabel bounded file tools, plan-event correlation KoogPlanner dispatch branch + KoogPlanBridge mirror planner lifecycle into PlanUpdate (capability deliberately undeclared: koog plans exist only when the caller supplies a planner, so the write_todos floor must stay); AtmosphereFileTools implements Embabel's FileTools over the bounded conversation store (VIRTUAL_FILESYSTEM declared); PlanUpdate now carries conversationId/agentId at every emitter so the console Workspace tab correlates live plans to stored state one-click.
• planning + virtual-filesystem harness primitives; console broadcast fix write_todos and bounded ls/read/write/edit/glob/grep tools attach by default on every tool-calling runtime (Harness PLANNING/FILESYSTEM); AgentScope PlanNotebook, Embabel GOAP and Alibaba todos delegate via AiCapability.PLANNING while ADK artifacts and the Anthropic memory tool expose the store via VIRTUAL_FILESYSTEM; console gains a Workspace tab plus a broadcast-mode fix from a 29-sample browser sweep (outbound {author,message} envelope, event-less inbound frames render, cross-client Playwright regression); browser-proven with a real model.
• Harness feature set on @Agent/@Coordinator/@​AiEndpoint replaces the deep-agent boolean @​Agent and @​Coordinator are batteries-included by default (harness() = {ALL}; empty array opts down to a bare loop) while a bare @​AiEndpoint opts in per endpoint; the app-wide atmosphere.ai.harness.enabled flag is tri-state with explicit false as a kill switch beating every annotation; user-facing config keys and the console runtime-truth block rename deep-agent to harness; HTTP + Playwright e2e pin default-on, opt-in and kill-switch on booted apps.
• deep-agent harness on @​Agent(deepAgent) + wired @​SandboxTool @​Agent(deepAgent=true) — or atmosphere.ai.deep-agent.enabled app-wide — attaches long-term memory, a prompt-cache default, selectable compaction and fleet delegation with per-primitive runtime-truth at /api/console/info; @​SandboxTool routes a tool method through a framework-owned Sandbox; fixed the built-in runtime model fallback so LTM fact extraction works (browser-proven cross-session recall); Spring/Quarkus/servlet parity; personal-assistant + coding-agent samples converted.
• @​Command slash commands work on @​AiEndpoint, not only @​Agent New AiHandlerDecorator SPI lets atmosphere-agent wrap any @​AiEndpoint that declares @​Command methods with the same command router the @​Agent path uses; rag-chat console /sources is now an instant KB listing instead of falling through to the LLM.
• honor @​AgentScope on @​Agent classes and lint their scope posture
• client-reachable durable crash-resume via X-Atmosphere-Run-Id reconnect
• lead quarkus-ai-chat with @​Agent instead of @​AiEndpoint
• lead spring-boot-ai-chat with @​Agent instead of @​AiEndpoint
• lead spring-boot-channels-chat with @​Agent instead of @​AiEndpoint
• add atmosphere-ai-spring-boot-starter for one-dependency @​Agent apps
• durable agent runs with deterministic replay across runtimes
• auto-wire default CheckpointStore and ContextProvider beans in-memory defaults via @​ConditionalOnMissingBean with startup warnings; all six families now self-wire
• prove atmosphere-admin-bundle self-wires the six families
• add kotlin-dsl-chat proving the Kotlin DSL + coroutine extensions
• prove Spring AI setChatClient + defaultAdvisors + per-request advisors
• deliver audio input to the runtime via stream(message, parts) MultiModalChat forwards audio: prompts as Content.Audio input; delivery test asserts the runtime context carries the audio part
• add @​AiEndpoint(broadcastReply) to fan one reply out to a room
• add passivation-agent sample proving pause/resume Snapshots a paused conversation to a CheckpointStore and resumes it from the restored history; PassivationDeliveryTest asserts the round-trip.
• gate a money-moving refund tool behind @​RequiresApproval

... (truncated)

Changelog

Sourced from org.atmosphere:atmosphere-runtime's changelog.

[4.0.61] - 2026-07-07

Added

• governance as a learning signal — Prefer decision, feedback loop, durable recall PolicyDecision.Prefer soft-preference + native preference type + GovernanceFeedbackInterceptor (re-injects deny/prefer guidance into the turn) + opt-in durable provenance memory across Spring/Quarkus/bare-JVM; real-LLM sample (spring-boot-ai-chat) + Ollama e2e; console PREFER view; real-LLM CI consolidated on Ollama.
• tool-output disk offload + composite AgentFileSystem routing Large built-in tool results (>8000 chars, threshold-gated, sysprop/env overridable) spill to the agent workspace and the model gets a preview + read_file pointer — default-on at the tool choke point, fail-safe (never throws/loses data, honors workspace bounds). AgentFileSystemProvider composes a CompositeAgentFileSystem over the per-conversation workspace when durable prefix routes are configured (atmosphere.ai.filesystem.routes, off by default), routing the eight ops by longest-prefix with per-route bounds. Closes the two minor deepagents parity gaps. 3+15+2 tests.
• task tool — dynamic ephemeral subagent spawn (deepagents parity) The @​Coordinator harness now registers a 'task' tool alongside delegate_task: it spawns a general-purpose subagent with an isolated context/workspace (fresh conversation, own plan store + bounded file store), runs one subtask with the harness floor, and returns its final report. Governed (pre-admission, fail-closed), depth-bounded across the spawn thread, time-bounded with cleanup; 7 tests + preset pin. Closes the last parity gap vs LangChain deepagents.
• native tool-loop enforcement via Embabel 0.5.0 inspector/transformer API The stale comment claimed 0.3.5 lacked the seam; 0.5.0 ships withToolLoopInspectors/withToolLoopTransformers, so EmbabelToolLoopBridge strips tool calls on the transformer seam at the cap (the real stop) and mirrors ToolLoopGuard's breach on FAIL, honoring COMPLETE_WITHOUT_TOOLS natively; wire guard kept as backstop, native path only, 7 tests.

Fixed

• env/sysprop LLM knobs win over RUNTIME.md pins A workspace RUNTIME.md model/mode/base-url/api-key pin was overriding an operator's explicit LLM_MODEL/LLM_MODE/... env (or system property), so pointing the personal-assistant sample at Ollama 404'd on the pinned gemini model; pins are now defaults an env override beats. Regression + env-lookup seam keep the test hermetic against ambient .envrc vars.

Changed

• log drift — feature called 'documented' while published docs were stale Governance learning-signal PolicyDecision.Prefer shipped but atmosphere.github.io reference listed only Admit/Transform/Deny; caught on the completion-number question, external docs now published.
• surface the batteries-included deep-agent harness A plain @​Agent is a deep agent out of the box (memory, write_todos plan, virtual filesystem, task sub-agent spawn) — add a Why-Atmosphere row and a dedicated subsection linking the harness docs and the LangChain deepagents comparison.
• note governance learning-signal loop in module README Points at governance-policy-plane.md + the spring-boot-ai-chat sample; adds the native prefer vocabulary + durable-recall flag.
• rewrite compliance matrix notes in plain operator language EU AI Act / HIPAA / SOC2 rows; class names and config move to the evidence disclosure
• deep-agent harness primitives on a @​Coordinator Deterministic Playwright spec (demo mode, no live LLM) pinning that the personal-assistant coordinator registers the dynamic subagent-spawn task tool + delegate_task + the write_todos floor, and /api/console/info reports planning/filesystem/delegation ACTIVE — the wiring a real turn depends on, guarded in the always-on lane.
• rewrite OWASP matrix notes in plain operator language class names, config keys and roadmap labels move to the evidence disclosure
• bump version to 4.0.60
• prepare next development version 5.0.36
• prepare for next development iteration 4.0.61-SNAPSHOT

[4.0.60] - 2026-07-06

Added

• native plan bridges persist to AgentPlanStore under the floor's key Embabel GOAP and Koog planner mirrors now also put() every plan under the same (agentId, conversationId) the write_todos floor uses, so the admin plan endpoint and Workspace stored view work for opted-in native surfaces; best-effort with WARN on store failure, pinned by persistence + failure-isolation tests in both bridges.
• koog native plan observation, embabel bounded file tools, plan-event correlation KoogPlanner dispatch branch + KoogPlanBridge mirror planner lifecycle into PlanUpdate (capability deliberately undeclared: koog plans exist only when the caller supplies a planner, so the write_todos floor must stay); AtmosphereFileTools implements Embabel's FileTools over the bounded conversation store (VIRTUAL_FILESYSTEM declared); PlanUpdate now carries conversationId/agentId at every emitter so the console Workspace tab correlates live plans to stored state one-click.
• planning + virtual-filesystem harness primitives; console broadcast fix write_todos and bounded ls/read/write/edit/glob/grep tools attach by default on every tool-calling runtime (Harness PLANNING/FILESYSTEM); AgentScope PlanNotebook, Embabel GOAP and Alibaba todos delegate via AiCapability.PLANNING while ADK artifacts and the Anthropic memory tool expose the store via VIRTUAL_FILESYSTEM; console gains a Workspace tab plus a broadcast-mode fix from a 29-sample browser sweep (outbound {author,message} envelope, event-less inbound frames render, cross-client Playwright regression); browser-proven with a real model.
• Harness feature set on @Agent/@Coordinator/@​AiEndpoint replaces the deep-agent boolean @​Agent and @​Coordinator are batteries-included by default (harness() = {ALL}; empty array opts down to a bare loop) while a bare @​AiEndpoint opts in per endpoint; the app-wide atmosphere.ai.harness.enabled flag is tri-state with explicit false as a kill switch beating every annotation; user-facing config keys and the console runtime-truth block rename deep-agent to harness; HTTP + Playwright e2e pin default-on, opt-in and kill-switch on booted apps.
• deep-agent harness on @​Agent(deepAgent) + wired @​SandboxTool @​Agent(deepAgent=true) — or atmosphere.ai.deep-agent.enabled app-wide — attaches long-term memory, a prompt-cache default, selectable compaction and fleet delegation with per-primitive runtime-truth at /api/console/info; @​SandboxTool routes a tool method through a framework-owned Sandbox; fixed the built-in runtime model fallback so LTM fact extraction works (browser-proven cross-session recall); Spring/Quarkus/servlet parity; personal-assistant + coding-agent samples converted.
• @​Command slash commands work on @​AiEndpoint, not only @​Agent New AiHandlerDecorator SPI lets atmosphere-agent wrap any @​AiEndpoint that declares @​Command methods with the same command router the @​Agent path uses; rag-chat console /sources is now an instant KB listing instead of falling through to the LLM.
• honor @​AgentScope on @​Agent classes and lint their scope posture
• client-reachable durable crash-resume via X-Atmosphere-Run-Id reconnect
• lead quarkus-ai-chat with @​Agent instead of @​AiEndpoint
• lead spring-boot-ai-chat with @​Agent instead of @​AiEndpoint
• lead spring-boot-channels-chat with @​Agent instead of @​AiEndpoint
• add atmosphere-ai-spring-boot-starter for one-dependency @​Agent apps
• durable agent runs with deterministic replay across runtimes
• auto-wire default CheckpointStore and ContextProvider beans in-memory defaults via @​ConditionalOnMissingBean with startup warnings; all six families now self-wire
• prove atmosphere-admin-bundle self-wires the six families
• add kotlin-dsl-chat proving the Kotlin DSL + coroutine extensions
• prove Spring AI setChatClient + defaultAdvisors + per-request advisors
• deliver audio input to the runtime via stream(message, parts) MultiModalChat forwards audio: prompts as Content.Audio input; delivery test asserts the runtime context carries the audio part
• add @​AiEndpoint(broadcastReply) to fan one reply out to a room
• add passivation-agent sample proving pause/resume Snapshots a paused conversation to a CheckpointStore and resumes it from the restored history; PassivationDeliveryTest asserts the round-trip.
• gate a money-moving refund tool behind @​RequiresApproval

... (truncated)

Commits

• 9401046 release: Atmosphere 4.0.61
• f03e7fe docs(harness): log drift — feature called 'documented' while published docs w...
• ff67d37 docs(readme): surface the batteries-included deep-agent harness
• dcf704d docs(ai): note governance learning-signal loop in module README
• 5dadd85 docs(ai): rewrite compliance matrix notes in plain operator language
• 8399777 test(e2e): deep-agent harness primitives on a @​Coordinator
• 134d9cd feat(ai): governance as a learning signal — Prefer decision, feedback loop, d...
• ce015a3 feat(ai): tool-output disk offload + composite AgentFileSystem routing
• 94650ae feat(coordinator): task tool — dynamic ephemeral subagent spawn (deepagents p...
• 1462909 docs(ai): rewrite OWASP matrix notes in plain operator language
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #3321.