Security API/SPI: identity types, authentication records, authorization contracts, and the sealed verification-source family

Extension API for the REST framework: interfaces, annotations, lifecycle hooks, middleware

Event bus service dispatch with contract-first interfaces and resilience policies

Workflow runtime core: plan model, DSL, registry, public WorkflowOperations facade, generic transactional SPIs, side-effect recorder SPI, contract annotations. SQL-free.

Backend-agnostic Micrometer metrics core: registry provider SPI, composite assembly, and bootstrap contributor

JAX-RS routing runtime: route registration, method invocation, error pipeline, response handling

Default security runtime: authorization engine, action registry, in-memory policy resolvers, security event emitter, and Dagger modules

Provider-neutral programmatic cache API, SPI, and runtime contracts

Programmatic rate-limit API, policy model, typed keys, and the local Bucket4j engine

Authentication, authorization, and security context bridging for the REST framework

Public lifecycle and extension API for Model Context Protocol servers