…type, WebFlux on Jetty, 0.80.0

…19 roster

Add protocol-conformance/, a standalone audit tier outside the reactor:
the 21 stable v1 pages, stable schema and licence retained byte-exact
from agent-client-protocol@2797d331 with SHA-256 sums; the JSON-RPC 2.0
page ACP incorporates by reference; a reviewed manifest that locates
every requirement verbatim in those bytes; and the generated roster of
240 derived testing requirements with a coverage ledger accounting for
every RFC 2119 keyword occurrence, schema description and reviewed prose
sentence. scripts/import-spec.py regenerates and checks all of it
deterministically. No harness, inference or judgment yet.

…and capture

Add the standalone audit project under protocol-conformance/: a roster
loader that refuses any digest drift before execution, an ACP audit
context that prepends protocol instructions to the producer's generated
roster prompt while preserving native invocation facts, replay and live
backends with immutable run capture, a demo that builds the Rfc2119Jury
publicly and votes once, and prepare/run scripts proven locally.

Offline tests over the real 240-item roster with synthetic answers pin
the response semantics: the complete roster reaches one execution
unchanged; CANNOT_DETERMINE abstains; NOT_APPLICABLE is accepted only
where a condition is declared; malformed, duplicate, missing or
undeclared answers are instrument errors; replay without a genuine
recording is refused. The producer's 1 MiB V6 bound cannot hold a
240-item full-text verdict (about 1.7 MB measured), so the complete
verdict is retained as a portable document with the refusal recorded.
No live run, no recording, no conformance judgment.

…er the 1 MiB bound

The producer refuses a single V6 document above 1 MiB and the 240-item
full-text verdict is about 1.7 MB. RetainedVerdicts now writes root.json
plus contiguous part-NN.json slices, each a complete V6 roster verdict
under the bound with the producer's own collective rule, and reads them
back through the producer's codec into a Verdict that equals the one
voted; manifest.json records slices and digests. The portable fallback
is gone. Offline tests cover the 240-item parts path, a refused run, a
single-document small verdict, and equality after reassembly.

Run acp-v1-2797d331-r1-5bb2cf6-001 is the first whole-roster audit of
this SDK: one investigative agent (claude-fable-5-1, 28 minutes, 85 tool
calls) answered all 240 derived stable ACP v1 requirements exactly once.
The bridge's in-memory native capture refused the agent's snapshot above
its 1 MiB bound after the answers were given, so the verbatim response
is recovered from the CLI's own session transcript by a committed script
with provenance.
Replayed through the jury: 193 PASS, 6 FAIL, 39 CANNOT_DETERMINE,
2 NOT_APPLICABLE, 0 protocol errors, conclusion FAIL. The raw recording
(request, response, session transcript, V6 parts) is kept out of this
branch because the transcript carries the judge's local environment; its
results are published as a summary under protocol-conformance/results/.

For future live runs the native snapshot is written to the run directory
by AcpNativeCapture instead of being bounded in memory, the CLI trace and
transcript are archived next to the run, and --retain-in-run stores a
replayed verdict inside its recording once.

Found by the whole-roster conformance audit (run acp-v1-2797d331-r1-
5bb2cf6-001), confirmed by two independent cold reviews, and each
reproduced by a failing test before the fix.

Client: initialize fails with AcpVersionException and closes the
connection when the agent answers a protocol version this SDK does not
speak; authenticate refuses a terminal method id; session/new, load,
resume and fork refuse HTTP and SSE MCP servers unless the agent
advertised mcpCapabilities.http/.sse; session/prompt refuses image,
audio and embedded-resource blocks unless the matching prompt capability
was advertised; session/cancel answers every pending
session/request_permission of that session with the cancelled outcome
and stops its handler.

Agent: a boolean session config option is sent only to a client that
advertised session.configOptions.boolean; otherwise it is omitted from
session answers, set_config_option answers and config_option_update,
with a warning naming it.

New: AcpVersionException; NegotiatedCapabilities.requireMcpHttp,
requireMcpSse, requireEmbeddedContext; InboundRequests.answer and
AcpClientSession.cancelPermissionRequests. Javadoc that said "the SDK
does not check" now says what is checked. The config-options
integration test advertises the capability it relies on; the scheduler
hygiene scan skips the standalone protocol-conformance tier.

…ermission request

The Java client SDK now answers a pending session/request_permission with
the cancelled outcome as part of cancel() and stops its handler, so the
perm.cancelled step's timestamp, taken after the cancel completed inside
that handler, was never recorded. Record it before sending; the handler's
own answer is no longer used.

Run acp-v1-2797d331-r1-44f2a09-002 judges the fixed SDK: 209 PASS,
3 FAIL, 24 CANNOT_DETERMINE, 3 NOT_APPLICABLE, 1 item unanswered by the
judge, conclusion FAIL. All six items fixed after run 001 now PASS. The
three new FAILs are items run 001 abstained on (path absoluteness of
application-supplied cwd and additionalDirectories; elicitationId
uniqueness), unadjudicated. This run was captured by the hardened path:
native response on disk, CLI trace and transcript archived, verdict
retained as four V6 parts inside the run. As for run 001 the raw
recording is kept out of this branch; the summary is published under
protocol-conformance/results/.

Replay now takes the subject commit from the recording's run.json, so
the regenerated request always matches the one answered; the replay
regression compares the replayed verdict item for item with the verdict
retained in the recording, and treats an item the judge left unanswered
as part of the recorded outcome rather than as a refused replay.

The release workflow refuses any SNAPSHOT left in a pom.xml after
versions:set, and the standalone audit tier is not in the reactor, so
its 0.18.0-SNAPSHOT pin would fail the release. Tag v0.18.0 contains
the audited producer b7d2d88; the run 002 replay passes on it.

Stable ACP v1 requires the client's cwd and every additionalDirectories
entry to be absolute paths (session setup). The client sent whatever
the application passed. session/new, load, resume and fork now fail
with IllegalArgumentException without sending.

Absolute is checked by form, POSIX or Windows (drive, UNC, device), not
with Path.isAbsolute(): the agent may run on another host and OS. Found
by the conformance audit run 002 (ACP-V1-SETUP-CWD-ABSOLUTE,
ACP-V1-SETUP-ADDITIONAL-DIRS-ABSOLUTE); SessionPathConformanceTest failed
6 of 13 cases on the previous code.

…ication's

ACP-V1-ELIC-AGENT-UNIQUE-ELICITATION-ID moves from sdk to application
responsibility (item revision 2), by maintainer decision after run 002
judged it FAIL: the application chooses the id and alone knows when a
URL elicitation stops being outstanding, since completion is optional.
A narrow SDK guard against a duplicate id in flight is planned later.

The roster revision becomes acp-v1-2797d331-r2. Runs 001 and 002 stay
as recorded at r1 and replay only from their own commit.

…ast passing commits

The nightly cross-SDK and framework smoke runs went red on unchanged SDK
code as the peers' main branches moved: Rust 69e103f -> e7e3750 (10-07,
the interop program no longer builds), Python f235530 -> bdb9ac7
(10-12, cells time out), TypeScript 1726f28 -> c2b1a86 (10-20, no
dist/acp.js, so every framework cell fails in prepare). At the pinned
commits every cell passes locally. Kotlin stays on master.

…t results of runs 001 and 002

AUDIT-REPORT.md explains the whole-specification audit: the 240-item
roster derived from stable ACP v1, the single investigative jury vote,
the six findings of run 001 and their fixes, run 002, and the decisions
on its open items (two path checks fixed, elicitationId uniqueness left
to the application in roster r2, boolean options still omitted).

results/run-001.md and run-002.md list every roster item with the
status the jury recorded and the judge's reason. The raw recordings stay
local and are ignored: their session transcripts carry the environment
of the machine the judge ran on. The CHANGELOG links the report.