)]}' { "log": [ { "commit": "b99abf5b1469eb25381dc6e0468fa4f3b3136c25", "tree": "453d534aaf686d55978a8db9e87b79eb89413b20", "parents": [ "88e14844d7a73869782a44073fe23b7ded29cd51" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 10:17:29 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 10:17:29 2026 -1000" }, "message": "Fix Java-isms and incorrect LOC claim\n\n- Replace \"servlet container\" with \"web server\" (httpd is not a\n servlet container)\n- Remove incorrect 25K LOC claim for axis2_json_reader.c (actual: 719)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "88e14844d7a73869782a44073fe23b7ded29cd51", "tree": "c0a525310533b8430ceeab1f6d14a8ce290d1da3", "parents": [ "8e4d5f5ec4064ff3086249874e2ba6a9ff17b591" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 10:13:12 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 10:13:12 2026 -1000" }, "message": "Fix incorrect path for http_transport_utils.c\n\nFile is in util/ subdirectory, not common/.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8e4d5f5ec4064ff3086249874e2ba6a9ff17b591", "tree": "128f22f2976833acc5a1ffdde126ed50038d387b", "parents": [ "3773ff22389c8a977a65e48de5169098ec6d3b55" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 10:02:26 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 10:02:26 2026 -1000" }, "message": "Address Gemini review: add HTTP/2 receiver, util/, MIME paths\n\n- Add axis2_http2_msg_recv.c to JSON scan targets (fills gap from\n samples/ path removal)\n- Add core util/ library (allocator, string, hash) as scan area —\n foundational code where vulnerabilities have widespread impact\n- Add MIME/attachment file paths to integer overflow section\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3773ff22389c8a977a65e48de5169098ec6d3b55", "tree": "1ec42dfbf478322f166110255369f94303957813", "parents": [ "d97a7accd7b0d33e8af6f2d9f873d5f4f36ee2a0" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:59:22 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:59:22 2026 -1000" }, "message": "Remove samples/ paths from JSON scan guidance\n\nSample code paths mislead the scanner into treating samples/ as\nhigh-priority framework code. The descriptive text is sufficient\nto guide the scan toward the relevant vulnerability patterns.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d97a7accd7b0d33e8af6f2d9f873d5f4f36ee2a0", "tree": "8a95e155c8365d8f7ae66bd44d41e8cf88f28a29", "parents": [ "3be922f31cc538d5d3af6f26fd60d7cef1176c9e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:54:22 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:54:22 2026 -1000" }, "message": "Rewrite AGENTS.md to prioritize HTTP/2 and JSON scan areas\n\nModern deployments use HTTP/2 with pure JSON, not HTTP/1.1 with SOAP.\nReorder scan priorities: HTTP/2 transport handler, JSON processing,\nand memory safety in stream management are now items 1-4. Legacy\nHTTP/1.1 parsing and XML parser hardening moved to items 6-7 as\nsecondary concerns. Added missing HTTP/2 key files: h2 handler,\nsender, receiver, and JSON-RPC native dispatch.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3be922f31cc538d5d3af6f26fd60d7cef1176c9e", "tree": "bdf5628ffebd67ffa7979a7abaed0a6d227acdbc", "parents": [ "5292b2bad40e39d74861bd3a7939f83ddb7a9046" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:46:53 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:46:53 2026 -1000" }, "message": "Add safety comment to http_header.c sprintf usage\n\nDocument why sprintf is safe here (heap buffer sized from measured\ninput lengths) and note the snprintf consideration if the interface\never changes.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5292b2bad40e39d74861bd3a7939f83ddb7a9046", "tree": "8f48db5ca6ff9bc9c6b4a2e9f20b7e4a5203a5a9", "parents": [ "c6bb51aec46e25f4e292943660e16cd816f2dbcf" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:45:02 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:45:02 2026 -1000" }, "message": "Correct http_header.c sprintf assessment: not a buffer overflow\n\nThe sprintf() in axis2_http_header_to_external_form() writes to a heap\nbuffer allocated to the exact measured size (line 148-149). This is not\nan unbounded stack overflow. Downgrade from \"known issue\" to normal\naudit item.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "c6bb51aec46e25f4e292943660e16cd816f2dbcf", "tree": "db92c4385fa492d4ce15aba912529d1eb1ddb072", "parents": [ "029fb1089805388df590d83d53e3a62626158d91" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:36:15 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:36:15 2026 -1000" }, "message": "Address Gemini review findings for Glasswing threat model\n\n- Clarify schema complexity DoS risk in WSDL/XSD parsing\n- Distinguish use-after-free from memory leak in scan guidance\n- Use generic stress test description instead of sample app terminology\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "029fb1089805388df590d83d53e3a62626158d91", "tree": "5d08a29191ba0886d5404e1974cac66d404dc457", "parents": [ "241dc4c40ac19bc6e262f180d16d111bcb07fb86" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:29:15 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Jun 01 09:29:15 2026 -1000" }, "message": "Add security threat model and AGENTS.md for Glasswing scan\n\nASF Security Team\u0027s Glasswing program requires a security/threat model\nand AGENTS.md before running AI-driven vulnerability scans. Documents\nroles, trust levels, security boundaries, C-specific memory safety\nconcerns (buffer overflows, format strings, integer overflows),\nattack surface, OSS-Fuzz integration, and dependency versions.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "241dc4c40ac19bc6e262f180d16d111bcb07fb86", "tree": "ae7a6dd640a9e13b13081631db9ef7d4388bfcfe", "parents": [ "e3ebde7a023596686fecd7fbff66cc7c7a0e9792" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu May 28 11:50:14 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu May 28 11:51:12 2026 -1000" }, "message": "Fix download links: add missing /core/ in path\n\nThe 2.0.0 download URLs were missing /core/ in the path segment.\nArtifacts live at downloads.apache.org/axis/axis2/c/core/2.0.0/\nnot downloads.apache.org/axis/axis2/c/2.0.0/.\n\nFixes downloads.md (site source) and release-process.md (template\ninstructions that caused the original error).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "e3ebde7a023596686fecd7fbff66cc7c7a0e9792", "tree": "55a6a5ca7bb20d33625874f5659c02c00a2389f1", "parents": [ "0b281fd5efd1459371ab78ccf80a2eb4d165dc36", "f65993140d943232a3ab2c3a036795ac9f6d7b31" ], "author": { "name": "robertlazarski", "email": "58150512+robertlazarski@users.noreply.github.com", "time": "Sun May 17 11:28:07 2026 -1000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Sun May 17 11:28:07 2026 -1000" }, "message": "Merge pull request #3 from apache/infrastructure-ruleset-bot/default-branch-protection\n\n[INFRA] Set up default rulesets for default and release branches" }, { "commit": "f65993140d943232a3ab2c3a036795ac9f6d7b31", "tree": "55a6a5ca7bb20d33625874f5659c02c00a2389f1", "parents": [ "0b281fd5efd1459371ab78ccf80a2eb4d165dc36" ], "author": { "name": "The Apache Software Foundation", "email": "root-asf-gitbox-commits@apache.org", "time": "Fri May 15 13:55:36 2026 -0500" }, "committer": { "name": "The Apache Software Foundation", "email": "root-asf-gitbox-commits@apache.org", "time": "Fri May 15 13:55:36 2026 -0500" }, "message": "Set up default protection ruleset for default and release branches" }, { "commit": "0b281fd5efd1459371ab78ccf80a2eb4d165dc36", "tree": "684cbd9435a72ffbe0ac49060eaf43bcea173959", "parents": [ "fb40242aad0f41eee3c9b9e58e3ec6682cfba5ea" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu May 07 09:45:36 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu May 07 09:45:36 2026 -1000" }, "message": "Fix VaR percentile indexing and variance numerical stability\n\nAddress findings from Gemini quant review:\n\n1. CRITICAL (statistical-validity): VaR percentile indexing used\n floor(p*N) which selects position 10 for p\u003d0.01, N\u003d1000 — the\n 11th-worst outcome, not the 10th. Changed to ceil(p*N)-1 which\n matches the standard quantile definition: exactly floor(p*N)\n observations are strictly below the VaR level. Applied to both\n the fixed idx_5/idx_1 and caller-specified percentiles.\n\n2. HIGH (numerical-stability): Replaced one-pass variance formula\n (sum_sq/N - mean^2) with two-pass algorithm. The one-pass\n formula suffers catastrophic cancellation when std_dev \u003c\u003c mean\n (common for low-vol strategies). Two-pass computes mean first,\n then sum of squared deviations — numerically stable and the\n extra pass over final_values[] is negligible vs the simulation.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "fb40242aad0f41eee3c9b9e58e3ec6682cfba5ea", "tree": "be1afed59b41ef0e54365fa8186686f5b2aebc04", "parents": [ "6e577eb77c91db209d6707e7e09a6aa32ae83d28" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu May 07 09:39:14 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu May 07 09:39:14 2026 -1000" }, "message": "Fix Merton jump-diffusion: validate lambda*dt and remove dead code\n\nAddress findings from Gemini code review:\n\n1. HIGH: Add fail-fast validation for jump_intensity. When lambda*dt\n exceeds 0.1, the Bernoulli approximation for the Poisson jump\n process breaks down (at lambda*dt \u003e\u003d 1, every step gets a\n deterministic jump). The service now rejects such requests with\n a clear error message rather than producing silently wrong VaR.\n\n2. LOW: Remove unused jump_lambda_dt variable from the drift\n compensation scope — the same value is computed in the inner\n loop scope where it is actually needed.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6e577eb77c91db209d6707e7e09a6aa32ae83d28", "tree": "84fe057fa9f1e5f140dbc98411499106890e8a03", "parents": [ "aa0d09d84192e6b2c457703ebc721b3981b05ad0" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu May 07 09:34:23 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu May 07 09:34:23 2026 -1000" }, "message": "Add Merton (1976) jump-diffusion model to Monte Carlo simulation\n\nThe Monte Carlo service now supports two stochastic models, selected\nvia the \"model\" JSON parameter:\n\n- \"gbm\" (default): Geometric Brownian Motion — constant vol, continuous\n paths. The existing textbook baseline, unchanged.\n\n- \"merton\": Merton jump-diffusion — GBM plus a compound Poisson jump\n process that captures fat tails and discontinuities (crashes, gaps)\n that GBM systematically understates.\n\n S(t+dt) \u003d S(t) * exp((μ − σ²/2 − λk)*dt + σ√dt*Z) * J\n where J \u003d exp(μ_J + σ_J * W) with probability λ*dt per step.\n The −λk drift correction preserves E[S(T)] \u003d S(0)*exp(μ*T).\n\nNew request fields (all optional with defaults):\n model: \"gbm\" | \"merton\" (default: \"gbm\")\n jump_intensity: jumps per year, Poisson λ (default: 1.0)\n jump_mean: mean log-jump size (default: -0.03)\n jump_vol: std dev of log-jump size (default: 0.05)\n\nResponse now includes \"model\" field echoing which model was used.\n\nThe Merton overhead is ~15-20% vs pure GBM due to one additional\nuniform random draw per step for the Poisson jump test. Branch\nprediction makes the common \"no jump\" path nearly free.\n\nReference: Merton, R. (1976). \"Option pricing when underlying stock\nreturns are discontinuous.\" J. Financial Economics, 3(1-2): 125-144.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "aa0d09d84192e6b2c457703ebc721b3981b05ad0", "tree": "44561d38ea32de0b0444a690dcd174d4475185de", "parents": [ "997d8372c11f89d0e17e60fb95567aa06a1afab1" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 27 08:42:44 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 27 08:42:44 2026 -1000" }, "message": "docs: Fix fork/waitpid error handling in IPC example\n\nThe send_intent_broadcast_secure example in HTTP2_ANDROID.md was\nmissing fork() failure check and waitpid() error handling. The actual\nKanaha Camera implementation (camera_control_service.c) handles both\ncorrectly — update the doc example to match.\n\nFound by Gemini 2.5 Pro code review.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "997d8372c11f89d0e17e60fb95567aa06a1afab1", "tree": "86655e3765c88a480e5b9425f7c3138f99cffe78", "parents": [ "eca205fa1b7fa596c4a44f1dc37554cb65419c5f" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 27 08:30:37 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 27 08:30:37 2026 -1000" }, "message": "docs: Add Kanaha Audio (AudioSearchService) to HTTP2_ANDROID.md\n\nDocument the second registered Android service alongside\nCameraControlService. Add registered services table showing both\nservices with their licenses and IPC methods. Distinguish Kanaha\nCamera (GPL, Intent IPC) from Kanaha Audio (Apache 2.0, direct call).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "eca205fa1b7fa596c4a44f1dc37554cb65419c5f", "tree": "6b25c1a9bcc5e24edf18fc4c441851b2e52ab427", "parents": [ "9584cb809a84b4c42aa8681bd935cd95f235ab47" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 27 08:30:24 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 27 08:30:24 2026 -1000" }, "message": "Add AudioSearchService to Android static service registry\n\nRegister audio_search_service_invoke_json as a weak symbol in the\nJSON-RPC message receiver, alongside CameraControlService. When\nKanaha Audio links against the framework, its strong symbol overrides\nthe weak default — the same dispatch pattern used for camera control.\n\nThis enables a second showcase service (audio keyword search via\nwhisper.cpp) to demonstrate multi-service dispatch through the\nweak symbol registry on Android.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9584cb809a84b4c42aa8681bd935cd95f235ab47", "tree": "de00ed76409e7fb0c852e8a76c082c32244767bd", "parents": [ "ba8052a1f3b2e0f689d880219f09c1ae441944a6" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 20 18:58:36 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 20 18:58:36 2026 -1000" }, "message": "Add inline comments explaining data flow and memory ownership\n\nDocument the parsing pipeline (extract → tokenize → classify →\nparse JSON → Phase 1 top-level prune → Phase 2 nested prune →\nre-serialize → cleanup), memory ownership contract, why strtok_r\nis mandatory under mod_h2, and the two-phase delete pattern for\njson_object iteration safety.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ba8052a1f3b2e0f689d880219f09c1ae441944a6", "tree": "a97a665f56e2377c29e5a5c75d935ce7cbef6a9d", "parents": [ "d83455a5cf2ed6dc57d79abadcb72dfd0d33b9d2" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 20 18:49:26 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 20 18:49:26 2026 -1000" }, "message": "Add nested dot-notation field filtering to ?fields\u003d query parameter\n\nExtends finbench_filter_json_response to support paths like\n?fields\u003dstatus,results.ticker,results.ops — walks into nested JSON\nobjects and arrays to filter at any depth. Previously only top-level\nkeys were filterable.\n\nKey changes:\n- Dot-notation parsing splits \"container.subfield\" into a two-phase\n filter: prune top-level keys, then prune inside each container\n- Array support: if the container is a JSON array of objects, each\n element is filtered independently\n- Heap-allocated fields buffer (was fixed 2048-byte stack buffer) with\n 64KB DoS cap to prevent silent truncation of long query strings\n- goto-based cleanup ensures fields_buf and json_object are freed on\n all paths (success, OOM, parse failure)\n- Graceful degradation: on any failure, returns unfiltered response\n\nMirrors and extends Axis2/Java FieldFilteringMessageFormatter which\nprovides the same ?fields\u003d parameter on the Java side.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d83455a5cf2ed6dc57d79abadcb72dfd0d33b9d2", "tree": "26cb0abf32419fb39c9811abf071ca93257cbf4a", "parents": [ "f4b9108a0ec04c8e6cd52128be5f37aad18f7b97" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 15:40:39 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 15:40:39 2026 -1000" }, "message": "Fix sprintf → snprintf in JSON error response, TODO on read loop bug\n\nsprintf → snprintf: the JSON error response formatter used sprintf\nwithout bounds checking. Changed to snprintf(json_response, buffer_size, ...)\nmatching the safer pattern used in axis2_json_secure_fault.c.\n\nTODO added to the request body read loop documenting a pre-existing\ninteger underflow bug (size_t wraps to SIZE_MAX when buffer is exactly\nfull). The fix requires restructuring the while(1) loop to grow the\nbuffer BEFORE reading, which touches a critical code path shared by\nall JSON services. Deferred to a dedicated commit with its own testing.\n\nBoth findings from gemini-2.5-pro review of the query string fix commit.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f4b9108a0ec04c8e6cd52128be5f37aad18f7b97", "tree": "4097a84896c4943c003730415d3ab6c222bbdeee", "parents": [ "a713417c4c7954cbe255fb3e1416bf6c0e13d1ad" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 15:32:53 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 15:32:53 2026 -1000" }, "message": "Fix JSON processor to preserve query string from HTTP request\n\nThe JSON request processor in axis2_apache2_request_processor_json_impl.c\nused request-\u003euri (path only, no query string) while the SOAP worker in\napache2_worker.c has always used request-\u003eunparsed_uri (path + query).\nThis inconsistency meant ?fields\u003d and any other query parameters were\nsilently stripped before reaching JSON service handlers.\n\nChanged two references from request-\u003euri to request-\u003eunparsed_uri:\n - Line 513: service_path for logging and routing\n - Line 661: request_uri passed to transport_utils → msg_ctx endpoint ref\n\nWhen no query string is present, unparsed_uri \u003d\u003d uri — zero behavior\nchange for existing services. Verified: Kanaha CameraControlService and\nall other JSON services use POST with JSON body and no query parameters.\n\nThis unblocks ?fields\u003d response field filtering in the financial\nbenchmark service and any future query-parameter-based features.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a713417c4c7954cbe255fb3e1416bf6c0e13d1ad", "tree": "4e9e8fde1d57a9cf9d495a1bbacf0d76a2af6f85", "parents": [ "fefb0b5f8497d9fb6076ef3beb72fb0c82f378ac" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 14:36:03 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 14:45:19 2026 -1000" }, "message": "Address Gemini pro round 2: trailing whitespace trim, const correctness\n\n HIGH: field names with trailing whitespace (e.g., \"?fields\u003dstatus,\n calc_time_us \") now have both leading AND trailing spaces stripped.\n Without this, strcmp against the JSON key would fail and the field\n would be incorrectly excluded.\n\n LOW: op_qname declared const, unnecessary cast removed. The return\n value of axis2_op_get_qname is const; casting it away was a\n const-correctness violation.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "fefb0b5f8497d9fb6076ef3beb72fb0c82f378ac", "tree": "9b6fe4073b5bcbc1219b5c4cee9108e31978084a", "parents": [ "469a2ef04de301020890554bc74955793d9bdf94" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 14:32:33 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 14:45:19 2026 -1000" }, "message": "Address Gemini pro review: thread safety, info hygiene, dynamic alloc\n\nFixes four findings from gemini-2.5-pro code review of the C field\nfiltering implementation and HTTP2_AXIS2_DOT_XML.md comparison doc:\n\n CRITICAL: strtok → strtok_r for thread safety under mod_h2\n multi-threaded Apache workers. Concurrent ?fields\u003d requests\n would have shared strtok\u0027s static buffer.\n\n CRITICAL: removed /home/robert/repos/... absolute paths and\n internal staging hostname from HTTP2_AXIS2_DOT_XML.md. Replaced with\n relative paths and generic references.\n\n MEDIUM: del_keys array changed from fixed char*[256] to dynamic\n AXIS2_MALLOC sized from json_object_object_length(). Prevents\n silent truncation that could leak excluded fields on responses\n with 256+ keys.\n\n MEDIUM: added doc comparison section covering streaming and field\n filtering architecture differences between Axis2/Java (pluggable\n MessageFormatter pipeline, true streaming) and Axis2/C (per-service\n json-c tree, post-build filtering). Includes parity table and\n reusability path for future framework-level C support.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "469a2ef04de301020890554bc74955793d9bdf94", "tree": "17d2934aaf267cb8ad0d261ef83188f887072e5b", "parents": [ "2c639a599374d8ae546ec657d62ae479d7c59f18" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 14:18:10 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 17 14:18:10 2026 -1000" }, "message": "Add ?fields\u003d response field filtering to C financial benchmark service\n\nPorts the field selection feature from Axis2/Java\u0027s\nFieldFilteringMessageFormatter to the C financial benchmark service.\nCallers add ?fields\u003dstatus,portfolio_variance to any service URL and\nthe response includes only those fields.\n\nImplementation approach (simpler than Java due to json-c tree model):\n - finbench_extract_fields_param(): parses ?fields\u003d from request URI\n - finbench_filter_json_response(): re-parses the JSON response via\n json-c, deletes unwanted keys from the json_object tree, then\n re-serializes. The cost of parsing a ~1 KB response is negligible.\n - route_operation() now accepts fields_csv parameter; filtering is\n applied once after the operation returns, before the response is\n sent to the client.\n - Error/fault responses bypass filtering (unknown operation returns\n before the filter step).\n\nWhen no ?fields\u003d parameter is present, zero overhead — the response\nstring passes through unchanged.\n\nMaintains parity with the Axis2/Java FieldFilteringMessageFormatter\ndeployed on stg-rapi02.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2c639a599374d8ae546ec657d62ae479d7c59f18", "tree": "479d07c332a1007abd7b5f69a6be2c44b67a1dbc", "parents": [ "3b537884c0287d8b0aecbb7ed99c44efa174c8ab" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Apr 16 03:59:15 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Apr 16 03:59:15 2026 -1000" }, "message": "Link to Axis2/Java parity implementation from C financial sample\n\nAdds @see reference to the Java equivalent (FinancialBenchmarkService.java\nin axis-axis2-java-core) from the C financial_benchmark_service.h header.\nBoth implementations maintain identical financial calculations, API\ncontracts, and edge-case handling — the cross-link makes the parity\nrelationship discoverable.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3b537884c0287d8b0aecbb7ed99c44efa174c8ab", "tree": "45a55b44ec6b88bcddf6d5ee77dad5cd22bb7abc", "parents": [ "f86133929e51c19dd89c4bfa7328c782a1aaa169" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 15 14:52:23 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 15 14:52:23 2026 -1000" }, "message": "Generalize MCP client references in docs and samples\n\nReplaces narrative mentions of specific MCP client products (Claude\nDesktop, Cursor) with vendor-neutral terminology (\"an MCP client\",\n\"stdio-based MCP client\", \"the MCP host\") across docs and sample\nsource/build files. Concrete configuration examples are kept since\nthey are load-bearing setup instructions, but framed consistently as\n\"Example MCP client config (path varies by client; Claude Desktop\u0027s\n~/.config/claude/claude_desktop_config.json shown)\" so the product\nname appears once per file as a concrete example rather than being\nimplied as a default or required client.\n\nThe MCP protocol name itself is retained (it is a public specification\nat modelcontextprotocol.io) — only gratuitous product-name mentions\nare scrubbed.\n\nReviewed with gemini-2.5-pro (vendor-neutrality, documentation utility,\ninformation-preservation, consistency, fresh-leak checks all passed).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f86133929e51c19dd89c4bfa7328c782a1aaa169", "tree": "75783a4d57f93840975daaa685bc60a7d4f5b0bf", "parents": [ "3c0da9df0873195cc351206780c12b910d476e0e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 15 14:39:35 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 15 14:39:35 2026 -1000" }, "message": "Expand educational commentary on financial benchmark C samples\n\nPorts the quant-focused documentation depth added to the Axis2/Java\nsample so that the C implementation is equally useful as reading\nmaterial for a C/systems programmer learning portfolio risk math.\n\nHeader-level additions (financial_benchmark_service.h):\n - Portfolio Variance section now explains covariance / correlation\n structure, time-basis consistency, and the non-PSD matrix edge case.\n - Monte Carlo section now covers the GBM update rule, Itô drift\n correction intuition, VaR sign convention, CVaR / floor(p*N)\n estimator detail, PRNG reproducibility scope, and the two\n documented numerical edge cases (exp() cap, variance clamp).\n - Scenario Analysis section now documents the per-asset formulas\n (expected return, upside, downside, weighted value), the\n upside/downside asymmetry rationale, and the three-way\n upside_downside_ratio semantics (finite / Infinity / NaN) plus\n the JSON serialization caveat for Infinity/NaN tokens.\n - Field-level comments in each request struct now specify units,\n defaults, valid ranges, and frequency / time-basis expectations.\n\nImplementation-level additions (financial_benchmark_service.c):\n - finbench_calculate_portfolio_variance: formula, basis warning,\n weight-normalization edge case, numerical edge case (non-PSD).\n - finbench_run_monte_carlo: model + intuition, Itô correction why,\n numerical edge cases (including the deliberate C-vs-Java exp()\n cap divergence), reproducibility scope, performance framing.\n - finbench_calculate_scenarios: three-step pipeline description\n with fail-fast rationale and formulas.\n - Inline comment above CVaR_95 loop now spells out the estimator\n choice and reconciliation caveats.\n - Inline comment above var_95/var_99/cvar_95 response assignments\n restates the positive-loss sign convention explicitly.\n\nReviewed with gemini-2.5-pro (math correctness, doc-matches-code,\nsignal-to-noise, open-source tone, and C hygiene checks all passed).\nOne precision adjustment applied per pro review: the VaR sign-convention\ntext now correctly describes negative VaR as a meaningful profit\nindicator rather than \"meaningless\".\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3c0da9df0873195cc351206780c12b910d476e0e", "tree": "6fdb618f041f243452adc91e59d9f489efc61a71", "parents": [ "cfd0d376d89e3161e615e56eed43576c4c222242" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 15 14:06:38 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 15 14:06:38 2026 -1000" }, "message": "Port quant-correctness fixes from Axis2/Java financial samples\n\nBrings the C financial benchmark service up to the same behavioral\ncontract as the Axis2/Java sample so that callers targeting either\nlanguage get the same (correct) result for the same input.\n\nSeven fixes applied:\n\n - Monte Carlo median now correctly averages the two central elements\n for even n_simulations (matches NumPy/R sample-median behavior; a\n single-index approximation produced small reconciliation differences).\n - Variance accumulator (sumSq/N - mean^2) is now clamped to 0.0 before\n sqrt to prevent NaN propagation from floating-point cancellation\n on near-constant samples.\n - finbench_run_monte_carlo now fail-fasts on initial_value \u003c\u003d 0\n (GBM is undefined for non-positive starting values) and also on\n out-of-range n_simulations, n_periods, and negative volatility.\n - Scenario analysis now enforces FINBENCH_MAX_SCENARIOS per asset\n with a specific error message rather than silently truncating the\n input. A new n_scenarios_requested field on the asset struct records\n the raw JSON count before capping so the validator can detect\n overflow without risking fixed-array out-of-bounds writes.\n - Scenario analysis now fail-fasts on current_price \u003c\u003d 0 (return is\n undefined) and on missing or empty scenarios array, rather than\n silently skipping the asset and quietly omitting a holding from\n the result.\n - upside_downside_ratio now returns INFINITY for all-upside portfolios\n (downside near zero, upside positive) and NaN for the zero-zero case,\n rather than 0.0 (which falsely implied \"no upside\").\n\nThe existing C-side exp() overflow cap in the GBM inner loop is left\nunchanged; Axis2/Java deliberately does NOT clamp exp() overflow in its\nequivalent code path. Both choices are defensible — C caps defensively\nto keep the response well-formed; Java lets NaN propagate as an alarm\nfor extreme inputs. The divergence is intentional and documented.\n\nReviewed with gemini-2.5-pro from a senior buy-side quant perspective\n(math/behavioral correctness, C-correctness including fixed-array\nbounds and err-buf handling, validation completeness all passed).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "cfd0d376d89e3161e615e56eed43576c4c222242", "tree": "2d452d1f1b7fb08a76fdd4d92122c978692d28c1", "parents": [ "d63a16909aec3604d908404420e7427929077b4e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 15 13:57:17 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 15 13:57:17 2026 -1000" }, "message": "Scrub internal deployment references from public docs and samples\n\nRemoves leaked internal codenames (DPT v2, rapi-mcp, Claude Desktop) and\nan internal test hostname (penguin.alphatheory.local) from seven files\nahead of the 2.0.1 release. These appeared in Apache-published sample\ndocs, httpd config references, and service catalog header comments.\n\nReplacement hostnames use RFC 2606 reserved example.com. All rewordings\npreserve the original technical meaning using generic, public-facing\nterminology (e.g., \"typical portfolio correlation calculations\",\n\"common optimization pattern in portfolio analytics code\").\n\nReviewed with gemini-2.5-pro (completeness, semantic preservation,\nfresh-leak, RFC 2606 / reserved-TLD conformance checks all passed).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "d63a16909aec3604d908404420e7427929077b4e", "tree": "7a0f61704fc3470ecdd77f7389c65100ce075420", "parents": [ "161835698b13313d7ce2a7fa985030e299e42aed" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 14 11:04:49 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 14 11:04:49 2026 -1000" }, "message": "Address Gemini review: size_t for lengths, strict write check\n\nTwo findings from Gemini 2.5 Pro review:\n\n1. CRITICAL — int truncation on strlen() return: json_len, offset,\n total_written were int (32-bit signed). For responses \u003e2GB,\n strlen() returns size_t (64-bit unsigned) which truncates to\n negative int, causing infinite loop or buffer over-read.\n Fix: all size/offset variables changed to size_t, format\n specifiers changed to %zu.\n\n2. HIGH — partial write treated as success: small-response path\n checked (written \u003e 0) but axutil_stream_write() can return less\n than requested bytes. Fix: check (written \u003d\u003d json_len) for exact\n match. Chunked path already handled partial writes correctly\n via the offset loop.\n" }, { "commit": "161835698b13313d7ce2a7fa985030e299e42aed", "tree": "46ce0e7f9e77b5ad7019200e2e8bcb8a4014af0d", "parents": [ "fc2b942e5b58bf99ff688eb9b1ca4039d23cdce2" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 14 10:55:14 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 14 10:55:14 2026 -1000" }, "message": "Add streaming JSON message formatter for Axis2/C\n\nC equivalent of the Java MoshiStreamingMessageFormatter /\nJSONStreamingMessageFormatter (AXIS2-6103). Writes JSON responses\nin 64KB chunks with axutil_stream_flush() between each, causing\nApache httpd + mod_h2 to emit HTTP/2 DATA frames incrementally.\n\nPrevents reverse proxy 502 Bad Gateway on large JSON responses.\nSmall responses (\u003c\u003d64KB) skip chunking — written in one call.\n\nFiles:\n- axis2_json_streaming_msg_formatter.h: header with AXIS2_JSON_STREAMING_FLUSH_INTERVAL\n- axis2_json_streaming_msg_formatter.c: implementation\n\nGemini review finding addressed: return AXIS2_FAILURE (not SUCCESS)\nwhen JSON_RESPONSE property is missing from MessageContext.\n\nAlso updated:\n- bigdata-h2-service/README.md: streaming formatter section\n- docs/userguide/json-httpd-h2-userguide.md: streaming formatter section\n with ap_rwrite/ap_rflush flow diagram\n" }, { "commit": "fc2b942e5b58bf99ff688eb9b1ca4039d23cdce2", "tree": "fb9e991bac3b436498602748bffd2411ffaede93", "parents": [ "99c4f62e551dac857bad1adb7a55e2c2b39fcb8e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Apr 12 06:27:41 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Apr 12 10:13:58 2026 -1000" }, "message": "Raise FINBENCH_MAX_ASSETS from 2000 to 3000\n\nEnterprise portfolio management systems commonly have 2000+ assets\nper department. The previous 2000 cap would reject valid large\nportfolios. 3000 provides growth margin.\n\nAt 3000 assets the covariance matrix payload is ~135 MB —\nreachable via MCP stdio (no payload limit) but exceeds the HTTP\n50MB LimitRequestBody for portfolioVariance.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "99c4f62e551dac857bad1adb7a55e2c2b39fcb8e", "tree": "59a5fe53700be938d683f915107be7d6de62d94b", "parents": [ "05e662f024366d89bf69bfbf236a19b675cdb88a" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Apr 12 04:43:46 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sun Apr 12 04:43:46 2026 -1000" }, "message": "Add fuzz target for Financial Benchmark Service (OSS-Fuzz)\n\nNew fuzz target fuzz_finbench.c exercises the complete\nrequest-\u003ecompute-\u003eresponse path for all three operations:\n\n- portfolioVariance: O(n²) covariance matrix, weight normalization,\n negative variance sqrt guard\n- monteCarlo: GBM exp() overflow guard, percentile clamping,\n CVaR div-by-zero guard, xorshift128+ PRNG\n- scenarioAnalysis: hash table key management, probability\n validation, O(n) vs O(1) benchmark paths\n\nCaps n_simulations\u003d100 and n_periods\u003d50 during fuzzing to avoid\nburning CPU on compute while still exercising all code paths.\n\nSubmitted to Google OSS-Fuzz for 24/7 continuous fuzzing on\nGoogle infrastructure alongside the existing transport-layer\nfuzz targets (JSON parser, HTTP headers, URL parser, XML parser).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "05e662f024366d89bf69bfbf236a19b675cdb88a", "tree": "f23f81e4742cbd184c08e94435b6f92e33abf51d", "parents": [ "684d1a190b137bd1bd3281a2486a5063f4850799" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 19:50:26 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 19:50:26 2026 -1000" }, "message": "Add stock Ubuntu 22.04 apache2.conf as reference\n\nThe docs/userguide/ directory now has both Apache config models:\n- httpd.conf — standalone custom build (/usr/local/apache2)\n- apache2.conf — Ubuntu/Debian system Apache (/etc/apache2/)\n + axis2-services.conf adds Axis2/C as a site\n\nThe apache2.conf is the unmodified Ubuntu 22.04 default. Axis2/C\nconfig lives entirely in axis2-services.conf, installed by\ndeploy-localhost.sh. This file is included for documentation\ncompleteness — new contributors on Ubuntu need to understand the\nsplit config model (apache2.conf + sites-available/*.conf).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "684d1a190b137bd1bd3281a2486a5063f4850799", "tree": "5db5a2381acb6c40dad7415d39e125c55e46d19b", "parents": [ "f3f034f7893ce17ecab57b8b99ca899c10d79eb4" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 19:46:12 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 19:46:12 2026 -1000" }, "message": "Raise FinancialBenchmarkService limit to 50MB; document payload sizes\n\nThe 10MB Apache LimitRequestBody blocked portfolioVariance at ~670\nassets (realistic floats produce ~10.9 MB at 700 assets). Raised\nto 50MB to match BigDataH2Service — supports up to ~1200 assets\nover HTTP. The FINBENCH_MAX_ASSETS\u003d2000 code cap is reachable only\nvia MCP stdio (no payload limit).\n\nUpdated both axis2-services.conf (Debian/Ubuntu site config) and\nhttpd.conf (standalone reference config).\n\nAdded payload size table to MCP_EXAMPLES.md documenting the O(n²)\ngrowth: 500 assets \u003d 6 MB, 1000 \u003d 22 MB, 2000 \u003d 89 MB.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "f3f034f7893ce17ecab57b8b99ca899c10d79eb4", "tree": "476dbe0e58498168cda2fcefc78814d58b42b6f5", "parents": [ "ff3eb44990245b1fa0497e157cec55a00a598591" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 19:03:30 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 19:03:30 2026 -1000" }, "message": "Document pandemic stress test results (Feb-Apr 2020 market data)\n\nStress-tested financial benchmark service with real FIS market data\nfrom the COVID-19 crash: 5 tickers, 62 trading days, JPM vol 89.6%,\ncorrelations 0.54-0.95. 14 tests including:\n\n- Pandemic-era portfolio variance and Monte Carlo 1M sims\n- Extreme edge case: 80% vol, -50% return, 1M simulations\n- Scale: 500-asset (273 us) and 1000-asset (950 us) portfolios\n- Edge cases: zero vol, 200% vol, 1 sim, empty/malformed JSON\n- Concurrency: 20 parallel requests\n- Memory: 500 sequential requests, no RSS growth\n- MCP stdio: extreme params via tools/call\n\nZero crashes, zero Inf/NaN, zero memory leaks, Apache stable\nthroughout. Tested on Ubuntu 22.04 / Apache httpd / HTTPS+HTTP2.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ff3eb44990245b1fa0497e157cec55a00a598591", "tree": "9dbe541787db5308ad554cf8e6c7ed920ed03cf0", "parents": [ "23f05e6343e50154eb7f4a3418c1a3fdbfeeb663" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 16:50:27 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 16:50:27 2026 -1000" }, "message": "Harden financial benchmark: size_t cast, exp() overflow guard\n\nFixes from Gemini code review (gemini-2.5-pro):\n\n1. Monte Carlo allocation: cast n_simulations to size_t before\n multiplying by sizeof(double) to prevent integer overflow on\n 32-bit platforms (e.g., 1M sims × 8 bytes). The portfolio\n variance allocation already had this cast (line 231).\n\n2. GBM exp() overflow guard: cap the exponent at 709.0 (near\n DBL_MAX threshold for exp()) to prevent Inf propagation through\n Monte Carlo statistics. Extreme volatility + random shock can\n produce exponents that overflow double precision.\n\nNot fixed (already correct):\n- Hash key use-after-free: code already uses axutil_strdup() for\n stable per-entry key copies (line 1440), freed after hash (1462)\n- Percentile out-of-bounds: already clamped (line 928)\n- CVaR division by zero: already guarded (line 916)\n- Weight normalization div-by-zero: already checked (line 466)\n- Variance negative clamp: already done (line 524)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "23f05e6343e50154eb7f4a3418c1a3fdbfeeb663", "tree": "506d51b5c3b43836256c47800301f2bb2af22401", "parents": [ "147c8ace1e6743e16fd8ecb6a71161620df89552" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 16:17:33 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Sat Apr 11 16:17:33 2026 -1000" }, "message": "Add C vs Java MCP feature comparison; fix proprietary service name\n\nNew section \"Feature Comparison: C vs Java MCP\" documents:\n- Feature parity on MCP essentials (initialize/tools/list/tools/call)\n- Where C wins: startup (\u003c100ms vs 1-3s), memory (30MB vs 512MB+),\n throughput (150K vs 73K MC sims/sec), Android/edge/IoT support\n- Where Java wins: auto-schema from types, Spring Boot integration\n- Design intent: static struct array is the C idiom for tool catalogs,\n not a limitation vs Java reflection\n\nAlso replaced proprietary service name in demo section.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "147c8ace1e6743e16fd8ecb6a71161620df89552", "tree": "210ffa024c2a24c019ee6e72c4f91c6d6c114924", "parents": [ "49fd109358476e3bcf26f3f7f1ab8ec7d42bbb14" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Apr 09 08:14:47 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Apr 09 08:14:47 2026 -1000" }, "message": "Update transport note: both C and Java now use HTTPS/HTTP2\n\nAxis2/Java on WildFly and Tomcat negotiates HTTP/2 via ALPN on port\n8443, matching Axis2/C on Apache httpd with mod_h2. Verified on\nWildFly 32, WildFly 39, and Tomcat 11.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "49fd109358476e3bcf26f3f7f1ab8ec7d42bbb14", "tree": "42eb59521c3da8a10ed49b01962a2f069ab1eff7", "parents": [ "30c568b90710881d73738e1527f27af46ec9e178" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Apr 09 06:36:34 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Apr 09 06:36:34 2026 -1000" }, "message": "Clarify monteCarlo as VaR (Value at Risk) in MCP architecture doc\n\nAdd \u0027VaR\u0027 and \u0027GBM\u0027 qualifiers to monteCarlo references so readers\nunfamiliar with the term understand it is a risk calculation, not\na generic simulation.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "30c568b90710881d73738e1527f27af46ec9e178", "tree": "8cdf1f8159ba4aa00df33fb88f61dd92c920151b", "parents": [ "832b8b5de3e15596619424baaef70b68e3f98565" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Apr 09 05:18:06 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Thu Apr 09 05:18:06 2026 -1000" }, "message": "Remove unneeded doc\n" }, { "commit": "832b8b5de3e15596619424baaef70b68e3f98565", "tree": "0d57976264ef94b953a36610be002040c2ab1267", "parents": [ "9beba25717733de1f23bb1abf0a3a2f24d46396c" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 13:13:14 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 13:13:14 2026 -1000" }, "message": "Apply Gemini review: replace BLUF with Summary\n\nMilitary jargon not appropriate for open-source documentation.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9beba25717733de1f23bb1abf0a3a2f24d46396c", "tree": "e43a99b6a6a24d04204b633ce6a848ef782791ab", "parents": [ "dde8fb9c9a7eb2efddaa961d89fc81e00d7e7336" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 13:08:26 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 13:08:26 2026 -1000" }, "message": "Add MCP stdio pairs for all curl examples, replace localhost with 10.10.10.10\n\nEvery HTTP/2 curl command now has a paired MCP stdio equivalent showing the\nJSON-RPC tools/call format. Added pairs for scenarioAnalysis, all three\nlive demos (stress-test, pre-trade risk, convergence), and the real market\ndata session. Also replaced remaining localhost references with 10.10.10.10\nfor consistency and added transport/timing note clarifying that server-side\ncalcTimeUs is transport-independent (HTTPS vs HTTP does not affect comparison).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "dde8fb9c9a7eb2efddaa961d89fc81e00d7e7336", "tree": "539501b0d462909ba46ac73e813b60f21fe538ad", "parents": [ "e91eb7e4b2459d8c8b6556ac00f1a84f7f43856e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 12:41:03 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 12:41:03 2026 -1000" }, "message": "Replace fictional MCP conversations with live demos backed by real curl output\n\nThe \"What This Looks Like in Practice\" section had three fictional\nassistant conversations with made-up data. Replace with three live demos\nrun on 2026-04-08: stress-test (baseline→stressed correlations→MC),\npre-trade risk (6-asset European vs Japanese candidate comparison), and\nconvergence analysis (1K→1M paths). Every response is a real JSON output\nwith real calc_time_us and simulations_per_second values.\n\nAlso add WILDFLY32_DEPLOY_STATE.md with measured Axis2/Java performance\nnumbers from WildFly 32 deployment (portfolioVariance, monteCarlo).\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "e91eb7e4b2459d8c8b6556ac00f1a84f7f43856e", "tree": "2518fa367338ae15aadc6727c5eed15606508e78", "parents": [ "aa1593e49ccbdd0b294c36223f9a6bfab11f7e56" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 09:52:07 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 09:52:07 2026 -1000" }, "message": "Add live session with real market data to MCP_EXAMPLES.md\n\nReal end-to-end pipeline run on 2026-04-08: fetched 1 year of daily\ncloses for MSFT/AAPL/AMZN/JPM/JNJ, computed covariance matrix from\n254 daily returns, ran portfolio variance and 100K Monte Carlo VaR\non Axis2/C. All real numbers, real correlations, real risk metrics.\n\nKey results: portfolio vol 19.8% (28% diversification benefit from JNJ),\n95% VaR $218K, 99% VaR $317K, 66% probability of profit, computed in\n1.08 seconds. Market data provider URLs sanitized for open source.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "aa1593e49ccbdd0b294c36223f9a6bfab11f7e56", "tree": "3709530820ddcf4f635f32db58e225d31fa415d5", "parents": [ "5e24d3e2d056df923cac0ef26ff747d6b898521d" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 09:42:03 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 09:42:03 2026 -1000" }, "message": "Add embedded AI assistant vision to MCP_EXAMPLES.md\n\nNew section showing how MCP tools power an AI assistant embedded in a\nportfolio management platform — chat-based interface where PMs ask\nportfolio questions and get real-time computed answers with interactive\nvisualizations. Describes the building blocks (streaming SSE, artifact\nrendering, conversation persistence, permission scoping) and connects\nto Axis2/C\u0027s computation speed as the enabler for interactive analysis.\n\nFramed generically for open source while demonstrating the production\npattern of embedded financial AI assistants.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5e24d3e2d056df923cac0ef26ff747d6b898521d", "tree": "4c6a3c2ad93709fb1ce338f2abd2a8190dbc49e7", "parents": [ "bb7aadfced4232ec7d578b25979fdcd47bcb10b6" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 09:30:54 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 09:30:54 2026 -1000" }, "message": "Expand MCP_EXAMPLES.md with discovery, conversations, and iteration demos\n\nThe previous version read like an API reference with curl commands. A\nskeptical audience thinks \"I can do this in 3 lines of Python.\" The MCP\nvalue proposition is different:\n\n- Discovery: show the actual tools/list schema that Claude reads — the AI\n discovers capabilities without documentation, SDKs, or code generation\n- Conversational iteration: 3 example conversations showing stress-testing\n a portfolio (3 chained calls), discovery-driven analysis (AI summarizes\n available tools from schema), and parameter sensitivity exploration\n (AI designs a convergence study from an implicit question)\n- The \"6th step\" problem: the quant who wrote the script is in a meeting\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "bb7aadfced4232ec7d578b25979fdcd47bcb10b6", "tree": "a14910df111101724fc7021f94493e8cf51ab456", "parents": [ "878a50eb78ec7134da2bf60f935f655abeb2109a" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 08:29:23 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 08:29:23 2026 -1000" }, "message": "Apply Gemini review: remove sudo, qualify perf claims, add auth note\n\n- Remove sudo from Claude Desktop SSH example (security risk)\n- Qualify performance comparisons with \"typically\" instead of absolutes\n- Clarify calc_time_us: 0 means sub-microsecond\n- Clarify ops_per_second is matrix multiply-accumulate throughput\n- Note MCP response truncation in example\n- Change comparison table to \"measured vs typical\" instead of specific\n runtime estimates\n- Add note that production use should require JWT authentication\n- Clarify 48 MB is RSS under load\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "878a50eb78ec7134da2bf60f935f655abeb2109a", "tree": "a08b28b8f38edbbd5d672249185133f26e3aaa15", "parents": [ "b978e5f19160d7e708d998050394216817ccb116" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 08:18:38 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 08:18:38 2026 -1000" }, "message": "Add MCP_EXAMPLES.md — financial services demo with performance numbers\n\nPractical guide for data scientists and quants showing:\n- Portfolio variance (500 assets in 269us, 929M ops/sec)\n- Monte Carlo VaR (92K sims/sec, linear scaling to 100K+)\n- Scenario analysis with hash lookup benchmarks\n- Side-by-side HTTP/2 JSON and MCP stdio examples\n- Claude Desktop configuration for local and remote servers\n- Performance comparison table vs Python/JavaScript runtimes\n\nBenchmarked on a lightly-loaded CI/CD VM (4 vCPU AMD EPYC 7542, 64GB RAM),\nnot dedicated compute hardware. All numbers are wall-clock time including\nHTTP/2 framing, TLS, and JSON serialization.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b978e5f19160d7e708d998050394216817ccb116", "tree": "17b6abc87a6d8f96eb85019abd6a4825f7be48a9", "parents": [ "da31a741cecbb49e25048a16ab4732df3d719095" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 07:19:24 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 07:19:24 2026 -1000" }, "message": "Support GET requests with no body in JSON processor (e.g., /metadata)\n\nGET requests to JSON service endpoints (like /metadata) have no request\nbody. The JSON processor rejected these with 400 \"No request data received\".\n\nNow GET requests without a body receive an empty JSON object \"{}\" so the\nservice handler can still execute and return its response. POST/PUT\nrequests without a body still return 400 as before.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "da31a741cecbb49e25048a16ab4732df3d719095", "tree": "93a1961f9d594adfafa8a14a7777aefc4b30c3b2", "parents": [ "91a2e3be4135c569b061e0898b5ce2a985e18557" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 06:38:28 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 06:38:28 2026 -1000" }, "message": "Apply Gemini review: error fallback, doc return types, get_instance note\n\n- Change _invoke_json fallback from 200 \"Service loaded\" to 500 error\n response with LOG_ERROR — prevents masking misconfigured services\n- Add explicit return types (axis2_char_t*) to _process_json_only\n signature in HTTP2_ANDROID.md\n- Add note to HTTP2_JSON_DEBUG.md Problem 5 that services can avoid the\n axis2_get_instance signature trap by not exporting it at all (like\n bigdata-h2-service, login-service, testws-service)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "91a2e3be4135c569b061e0898b5ce2a985e18557", "tree": "a10bcd8b82bb9af9f337bc89d2b0285130542943", "parents": [ "398c626d01c5096d5bc7b76324c95c4477dbfffa" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 06:29:10 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 06:29:10 2026 -1000" }, "message": "Wire _invoke_json dispatch in JsonRpcMessageReceiver for server-side services\n\nThe msg_recv loaded the service .so via axutil_class_loader_create_dll but\nnever called its _invoke_json function — it returned a hardcoded \"Service\nloaded correctly\" placeholder instead. The dlsym-based dispatch\n(try_json_direct_service_loading) was only in the fallback path for when\nthe class loader failed.\n\nNow when the class loader succeeds, the msg_recv uses dlsym(RTLD_DEFAULT)\nto find \u003cserviceclass\u003e_invoke_json and calls it with the 4-param server-side\nsignature (svc, env, json_request, msg_ctx). Falls back to placeholder only\nif the function is not found.\n\nUpdate HTTP2_SERVICES_DOT_XML.md step 6 to document the actual dispatch\nmechanism (dlsym + 4-param signature).\n\nUpdate HTTP2_ANDROID.md to explain the 2-param (Android/json_object*) vs\n4-param (server-side/char*) invoke signature discrepancy and why each\nplatform needs different signatures.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "398c626d01c5096d5bc7b76324c95c4477dbfffa", "tree": "ff8e35c78afb3096e122acf0cd608e4371f3c6c3", "parents": [ "b4e34b024285fa7d22fb21935878fb37d4c7d68e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 05:46:26 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 05:46:26 2026 -1000" }, "message": "Add Problems 9-10 to debug guide, fix deploy test operation name\n\n- Problem 9: NULL transport descriptor segfault on request path (distinct\n from Problem 4 init-time failure — both must be fixed)\n- Problem 10: \"Operation Not Found\" when URL operation doesn\u0027t match\n services.xml\n- Fix deploy-localhost.sh: use portfolioVariance (a real operation) instead\n of benchmark (doesn\u0027t exist in services.xml)\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b4e34b024285fa7d22fb21935878fb37d4c7d68e", "tree": "ba000c3a245365e642809b832634e9dcb72bb07f", "parents": [ "9a9227b07c1bcbfae743c796cb46a529de0f06de" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 05:33:10 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 05:33:10 2026 -1000" }, "message": "Fix request-path segfault when transport descriptors are NULL in HTTP/2 mode\n\nIn HTTP/2 mode, transportReceiver/transportSender are commented out in\naxis2.xml (Apache httpd handles transport). axis2_conf_get_transport_in()\nreturns NULL, and axis2_transport_in_desc_get_recv() segfaults on it\nduring request processing in apache2_worker.c.\n\nAdd NULL guard around the in_desc-\u003ereceiver access. Update\nHTTP2_APACHE2_WORKER.md to document that in_desc/out_desc may be NULL\nin HTTP/2 mode and all usage must be guarded.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9a9227b07c1bcbfae743c796cb46a529de0f06de", "tree": "99aaac5d269ca61f2b5e04dc16b3543409309c21", "parents": [ "8ed68f4e79ce6cefa3cfa6d63372c21736a52446" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 04:57:04 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 04:57:04 2026 -1000" }, "message": "Add HTTP2_JSON_DEBUG.md — deployment debugging guide from live session\n\nDocuments 8 real problems encountered deploying Axis2/C HTTP/2 JSON services\non Ubuntu 22.04 with packaged Apache, including:\n\n- Missing vhost config (site not enabled)\n- OCSP stapling with self-signed certs\n- Transport sender/receiver not needed in HTTP/2 mode\n- axis2_get_instance signature mismatch causing segfaults\n- json-c version incompatibility\n- Packaged vs source-built Apache path differences\n- GDB/coredumpctl backtrace procedures for systemd services\n- Post-restart health check race conditions\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8ed68f4e79ce6cefa3cfa6d63372c21736a52446", "tree": "b780478a166af7994d8d4f5d4a0b7114201b0e93", "parents": [ "9545838bcd2f8ac60aa02f0c1b02c834c57b1c50" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 04:45:26 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 04:45:26 2026 -1000" }, "message": "Fix segfault: axis2_get_instance signature mismatch in FinancialBenchmarkService\n\nThe class loader (axutil_class_loader_create_dll) calls axis2_get_instance\nwith the CREATE_FUNCT signature: int func(void **inst, const axutil_env_t *env).\nBut FinancialBenchmarkService exported it as: axis2_svc_t* func(const axutil_env_t *env).\n\nThis caused \u0026obj (a void**) to be misinterpreted as env, and the real env\npointer to land in an unused parameter slot. axis2_svc_create then segfaulted\ntrying to dereference garbage as the allocator.\n\nFix both axis2_get_instance and axis2_remove_instance to match the expected\nCREATE_FUNCT/DELETE_FUNCT typedefs from axutil_dll_desc.h. Add detailed\ncomments explaining the correct signatures to prevent future regressions.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9545838bcd2f8ac60aa02f0c1b02c834c57b1c50", "tree": "b4dd11f4bdaf3bd8ff129dd56a15a338c429cbba", "parents": [ "35c457ce556ca8a914dac362f951f263c378de53" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 02:33:37 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 02:33:37 2026 -1000" }, "message": "Apply Gemini review: fix doc path, update https transport comments\n\n- Fix doc reference: HTTP2_CONDITIONAL_COMPILATION.md -\u003e docs/HTTP2_CONDITIONAL_COMPILATION.md\n- Add consistent HTTP/2 mode comments to https transport receiver and sender\n blocks (same treatment as http blocks)\n- Fix https sender: move SSL params inside the commented transportSender element\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "35c457ce556ca8a914dac362f951f263c378de53", "tree": "8481d6bce0620932f01934bccf9ede26fa77f2eb", "parents": [ "1c580747b8e6aaf791b01eff3761a2a308649a6d" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 02:29:53 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 02:29:53 2026 -1000" }, "message": "Comment out HTTP/1.1 transport in axis2.xml for HTTP/2 mode\n\nThe HTTP/1.1 sender/receiver libs (libaxis2_http_sender.so,\nlibaxis2_http_receiver.so) are intentionally not built in HTTP/2 mode\n(see HTTP2_CONDITIONAL_COMPILATION.md). But axis2.xml still referenced\nthem, causing conf_builder to fail with \"Transport sender is NULL\" and\ncrashing Apache worker processes.\n\nComment out transportSender and transportReceiver in the source-controlled\naxis2.xml (samples/server/axis2.xml). In HTTP/2 mode Apache httpd handles\nall transport via mod_axis2 with runtime detection — no standalone\ntransport libs are needed (see HTTP2_AXIS2_DOT_XML.md).\n\nAlso improves Makefile.am comments to cross-reference axis2.xml.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "1c580747b8e6aaf791b01eff3761a2a308649a6d", "tree": "5d49ee17727dc126e1206d34ebf9b0aeeaa07bce", "parents": [ "242e86e9f09f92f4670ade1d07b205e1b0de7cac" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 02:29:10 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 02:29:10 2026 -1000" }, "message": "Revert \"Fix HTTP/2 build: always build http sender/receiver transport libs\"\n\nThis reverts commit 242e86e9f09f92f4670ade1d07b205e1b0de7cac.\n" }, { "commit": "242e86e9f09f92f4670ade1d07b205e1b0de7cac", "tree": "7a451f886972d06dfdc7aba73e3a50c46d27e5bc", "parents": [ "0a6b054563b1082e2bf5c011f882f20c53b2ed08" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 02:10:39 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Wed Apr 08 02:10:39 2026 -1000" }, "message": "Fix HTTP/2 build: always build http sender/receiver transport libs\n\nThe Makefile.am excluded sender/ and receiver/ subdirs when WITH_NGHTTP2\nwas enabled, assuming HTTP/2 mode wouldn\u0027t need them. But axis2.xml still\nreferences axis2_http_sender and axis2_http_receiver for transport init —\nwithout libaxis2_http_sender.so, mod_axis2 worker creation fails with\n\"Transport sender is NULL for transport http\" and Apache crashes.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "0a6b054563b1082e2bf5c011f882f20c53b2ed08", "tree": "5d49ee17727dc126e1206d34ebf9b0aeeaa07bce", "parents": [ "a187df5b286d689b2220499be5fb71f65c3cb093" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 16:22:12 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 16:22:12 2026 -1000" }, "message": "Apply Gemini review findings: retry health check, add restart reminder\n\n- Replace single sleep 2 + systemctl check with 5-attempt retry loop in\n deploy-localhost.sh for slower systems where Apache takes longer to crash.\n- Add Apache restart reminder in build scripts\u0027 source-built Apache path.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a187df5b286d689b2220499be5fb71f65c3cb093", "tree": "f904039847f0a803ac5b540f55af11934e79a282", "parents": [ "9481f36006827deb30bfb56d8cc31b570c4975b3" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 16:20:08 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 16:20:08 2026 -1000" }, "message": "Guard Apache module install in build scripts for source-built vs packaged Apache\n\nThe service build scripts unconditionally tried to install the Axis2/C module\nand config to /usr/local/apache2/ — a path that only exists with source-built\nApache. On Debian/Ubuntu with packaged Apache, this caused tee errors and\n\"module not found\" warnings (the deploy script + axis2-services.conf handle\nmodule loading for packaged Apache).\n\nNow the module/config block only runs when /usr/local/apache2 is detected.\nOtherwise it prints a note pointing to deploy-localhost.sh. Also fixes\nunbound $AXIS2C_HOME under set -euo pipefail by using ${AXIS2C_HOME:-}.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9481f36006827deb30bfb56d8cc31b570c4975b3", "tree": "a2bb14bb98dda652569401884ecc9559bd8d92ea", "parents": [ "a7362640d1fae635f4d58391d3e0cba89a315c74" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 16:06:48 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 16:06:48 2026 -1000" }, "message": "Disable OCSP stapling for self-signed certs, harden deploy health check\n\nSelf-signed certificates have no OCSP responder, causing Apache SSL errors\n(AH02604) that can prevent startup. Disable SSLUseStapling across all configs.\n\nAdd post-restart health check to deploy-localhost.sh: Apache can pass configtest\nbut crash at runtime when Axis2 worker init fails (e.g., missing transport libs).\nThe script now waits 2s, verifies Apache is still running, and dumps error/axis2\nlogs with automatic rollback on failure. Verification step also shows listening\nports and HTTP status codes for clearer diagnostics.\n\nCo-Authored-By: Claude Opus 4.6 (1M context) \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a7362640d1fae635f4d58391d3e0cba89a315c74", "tree": "8c447e1be3d43efe6f70d2bd09995d2752794c1f", "parents": [ "d41c6c94e263af44711aba5fc9b40cca8be7165f" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 15:44:54 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 15:44:54 2026 -1000" }, "message": "fix Ubuntu 22-04 install of json samples\n" }, { "commit": "d41c6c94e263af44711aba5fc9b40cca8be7165f", "tree": "7e6bac9a90d4127db72eb34643d4b8ba061f5b85", "parents": [ "88ff815ef64f6d5931eb2ff1ad994df448b074ac" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 15:38:18 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 15:38:18 2026 -1000" }, "message": "add deploy script for samples\n" }, { "commit": "88ff815ef64f6d5931eb2ff1ad994df448b074ac", "tree": "124e0f46fa1fd85f651c26bdbe379d5560510a19", "parents": [ "697530355a72c5d35c5e3e665d4c26a7c9ed69dc" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 15:21:18 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 15:21:18 2026 -1000" }, "message": "Add docs/userguide/axis2-services.conf for Ubuntu 22-04 with packaged apache2\n" }, { "commit": "697530355a72c5d35c5e3e665d4c26a7c9ed69dc", "tree": "dcb4b34a936e4dc0ec563d1f5e60e9dc9e29db55", "parents": [ "9a9f53001fe8fe5ce663934bc8ce091660a615c3" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 09:54:26 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 09:54:26 2026 -1000" }, "message": "Fix mod_h2 vs mod_http2 naming in Ubuntu HTTP/2 diagnostic + build script\n\ndocs/userguide/json-httpd-h2-userguide.md:\n- Diagnostic script checked for mod_h2.so but Ubuntu 22.04+ ships\n mod_http2.so — caused false \"compile from source\" recommendation on\n systems that already have HTTP/2 available\n- Fix Tests 2/3/recommendation to check both mod_http2.so and mod_h2.so\n- a2enmod call updated: try \u0027http2\u0027 first (Ubuntu 22.04 name), fall back\n to \u0027h2\u0027 (older distros)\n- IfModule guard changed from mod_h2.c to mod_http2.c in site config\n- Verified platform updated: Ubuntu 22.04 LTS / Apache 2.4.52\n- \"When to use source compilation\" note no longer cites Ubuntu 25.10\n\nbuild_financial_service.sh:\n- Add missing source files to gcc invocation:\n financial_benchmark_service_handler.c (D1 HTTP entry points)\n mcp_catalog_handler.c (D1 MCP catalog endpoint)\n axis2_json_secure_fault.c (D2 secure error responses)\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "9a9f53001fe8fe5ce663934bc8ce091660a615c3", "tree": "3f57768df4114b504e93e106c7b63b41b326e5a7", "parents": [ "3915982cca5c13941a88bd138e18e8121c43df6a" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:56:36 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:56:36 2026 -1000" }, "message": "Apply Gemini D2 review findings\n\nMajor:\n- mcp_catalog_handler.c: capture json_cstr length eagerly into json_len\n before axutil_strdup/json_object_put so the log message does not use\n a pointer into freed json-c memory; add (axis2_char_t *) cast on the\n axutil_strdup void* return value.\n\nMinor:\n- financial_benchmark_service_handler.c: replace raw axutil_strdup error\n string in process_json_only() with axis2_json_secure_fault() for\n consistent correlation-ID error surface.\n- axis2_json_secure_fault.c: add #include \u003cstdlib.h\u003e explicitly; update\n fallback PRNG comment to note clock() returns (clock_t)-1 (not 0) on\n POSIX failure, and document the non-thread-safe characteristic.\n\n(Finding 6 — AXIS2_LOG_INFO missing AXIS2_LOG_SI — confirmed false\npositive: AXIS2_LOG_INFO maps to axutil_log_impl_log_info which takes\n(log, format, ...) with no file/line args, unlike AXIS2_LOG_WARNING/ERROR.)\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3915982cca5c13941a88bd138e18e8121c43df6a", "tree": "45b8a1c6bf1775cccdf91e58e0ad1254bd4f83e0", "parents": [ "dd7438516a9c5ad5c22cbde98b9cdeadf71700e0" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:54:21 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:54:21 2026 -1000" }, "message": "Apply Gemini review findings — C mcp_catalog_handler + D1 handler wiring\n\nCritical:\n- mcp_catalog_check_and_respond: return AXIS2_FALSE (not AXIS2_TRUE) when\n mcp_catalog_generate_json returns NULL; previously told caller a response\n was ready but *out_json was NULL.\n\nMajor:\n- mcp_catalog_check_and_respond: add !env guard before AXIS2_LOG_DEBUG\n dereference; change strstr path match to suffix match (strcmp on tail\n of path) to prevent path-confusion info-disclosure via embedded subpath.\n- financial_benchmark_service_handler.c: remove redundant outer strstr\n (mcp_catalog_check_and_respond is now the sole path gatekeeper); use\n catalog_json ? strlen(catalog_json) : 0u in log call for null safety.\n\nMinor:\n- mcp_catalog_handler.c: add #include \u003cstdio.h\u003e (snprintf guarantee);\n drop unnecessary (axutil_qname_t *) non-const casts on svc_qname and\n op_qname (axutil_qname_get_localpart accepts const).\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "dd7438516a9c5ad5c22cbde98b9cdeadf71700e0", "tree": "0716208b984f37ef249971fa71833848b5e5bd23", "parents": [ "0ca7d8d030cc0c046ce1b9e08c4b237f266b34cc" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:52:27 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:52:27 2026 -1000" }, "message": "D2 fix: eliminate static-string cast in axis2_json_secure_fault\n\nThe original code returned (axis2_char_t*)(uintptr_t)FAULT_ALLOC_FALLBACK\non OOM — a static string that the caller would free via AXIS2_FREE,\ncausing undefined behaviour.\n\nFix: on json-c OOM or axutil_strdup failure, build a minimal JSON\nerror via snprintf into a stack buffer and axutil_strdup that instead.\nThe returned pointer is always heap-allocated and safe to AXIS2_FREE.\nReturns NULL only when env itself is NULL or on total memory exhaustion\n(documented in the header).\n\nAlso updated the header doc to reflect NULL-on-NULL-env contract.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "0ca7d8d030cc0c046ce1b9e08c4b237f266b34cc", "tree": "23d6246c37e73f3d72e58172c38500a5a6bb9801", "parents": [ "98b59588a4bc35b3c393ddc6dc5786b2e1698dc2" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:51:32 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:51:32 2026 -1000" }, "message": "D2 secure JSON fault responses with /dev/urandom correlation IDs\n\nNew module: axis2_json_secure_fault.{h,c}\n - axis2_json_corr_id_generate(): reads 8 bytes from /dev/urandom,\n encodes as 16-char lowercase hex (e.g. \"e1a2b3c4d5e6f7a8\").\n Falls back to XOR-mixed clock/time/pid when /dev/urandom is\n unavailable (Android SELinux, embedded targets).\n - axis2_json_secure_fault(): returns heap-allocated JSON:\n {\"status\":\"ERROR\",\"correlation_id\":\"\u003cid\u003e\",\"error\":\"\u003csafe_msg\u003e\"}\n All values go through json_object_new_string() — no injection risk.\n Returns a static fallback string (never NULL) on OOM.\n\nmcp_catalog_handler.c: conf\u003d\u003dNULL, json_object OOM, axutil_strdup OOM,\n and serialisation failure paths all emit a correlation ID to the log\n and return axis2_json_secure_fault() instead of NULL / bare {\"tools\":[]}.\n\nfinancial_benchmark_service_handler.c: route_operation() \"no operation\"\n and \"unknown operation\" paths use axis2_json_secure_fault(); the\n operation name is no longer echoed in the response body (prevents\n client-side operation enumeration).\n\nMakefile.am: axis2_json_secure_fault.c added to SOURCES,\n axis2_json_secure_fault.h to include_HEADERS and EXTRA_DIST.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "98b59588a4bc35b3c393ddc6dc5786b2e1698dc2", "tree": "473dbbde5853f084afb87412d25d4c810bd06354", "parents": [ "3221735572074efb8d05444d6e15fac50997205c" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:23:44 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:23:44 2026 -1000" }, "message": "D1 MCP catalog intercept wired into financial_benchmark_service_handler\n\n* financial_benchmark_service_handler.c: at the top of the invoke function,\n check the incoming request URI (via axis2_msg_ctx_get_to) for\n MCP_CATALOG_PATH (\"/_mcp/openapi-mcp.json\"). On match, fetch\n axis2_conf_t via conf_ctx and return mcp_catalog_generate_json()\n output directly (caller frees via AXIS2_FREE).\n\n* financial_benchmark_service.c: renamed the json_object* invoke\n function to finbench_dispatch_json_obj() (file-local static) to\n eliminate the duplicate symbol that would have prevented the\n handler.c entry point from linking.\n\n* Makefile.am: add financial_benchmark_service_handler.c to\n libfinancial_benchmark_service_la_SOURCES so the handler entry\n points (axis2_get_instance, financial_benchmark_service_invoke_json,\n axis2_remove_instance) are compiled into the service library.\n\nAccessible at: GET /services/FinancialBenchmarkService/_mcp/openapi-mcp.json\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "3221735572074efb8d05444d6e15fac50997205c", "tree": "14c32d9d3cf1844c34429fea78e8bfb072ea646a", "parents": [ "5f799e551dd927e1256fdd308cdcb9f084ec59d0" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:15:19 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 06:15:19 2026 -1000" }, "message": "financial-benchmark: address Gemini review findings on services.xml schemas\n\nF1 (Major): generateTestData mcpIdempotent corrected to true — pure\n deterministic function, same input always produces same output\nF2 (Major): scenarioAnalysis assets array gains minItems:1, maxItems:2000;\n scenario_prices and probabilities gain minItems:2\nF3 (Major): scenario_prices and probabilities descriptions now explicitly\n state they must have equal length (cross-property constraint)\nF4 (Major): weights description corrected — states exact n_assets length\n required and clarifies normalize_weights\u003dfalse means caller ensures sum\u003d1\nF5 (Major): normalize_weights description fixed — previously implied\n unconditional normalisation contradicting the boolean flag semantics\nF6 (Minor): metadata mcpInputSchema gains additionalProperties:false since\n the operation accepts no body fields\nF7 (Minor): monteCarlo mcpIdempotent changed to false — PRNG seeded from\n time() when random_seed absent, so unseeded calls are non-deterministic;\n comment documents when idempotency holds\nF10 (Nit): scenarioAnalysis position_size type changed integer→number with\n description noting fractional positions unsupported by C implementation\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "5f799e551dd927e1256fdd308cdcb9f084ec59d0", "tree": "74c4370ab5de721f457a46907158e6479daf345e", "parents": [ "96391b602c9a4f9a52d694322010d52c224118c9" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 03:11:32 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 03:11:32 2026 -1000" }, "message": "financial-benchmark: D1 — MCP catalog HTTP handler (mcp_catalog_handler.c)\n\nNew files:\n- src/mcp_catalog_handler.h — public API with MCP_CATALOG_PATH constant,\n mcp_catalog_generate_json(), mcp_catalog_check_and_respond()\n- src/mcp_catalog_handler.c — dynamic service introspection via Axis2/C\n configuration APIs; matches Java OpenApiSpecGenerator.generateMcpCatalogJson()\n\nBehaviour:\n- Walks axis2_conf_get_all_svcs() at request time (same as Java)\n- Two-level parameter lookup: axis2_op_get_param() \u003e axis2_svc_get_param()\n for mcpDescription, mcpInputSchema, mcpReadOnly, mcpDestructive,\n mcpIdempotent, mcpOpenWorld\n- mcpInputSchema: json_tokener_parse() validates the services.xml value;\n logs WARN and uses empty baseline on parse failure (matches Java fallback)\n- System service filter: Version, AdminService, __ prefix, *AdminService*\n- Auth flag: services with \"login\" in name or \"adminconsole\" → requiresAuth\u003dfalse\n- tickerResolveEndpoint: reads global axis2_conf_get_param(\"mcpTickerResolveService\")\n- JSON safety: all string values through json_object_new_string() — no\n manual string concatenation for JSON values\n- mcp_catalog_check_and_respond(): strstr match on /_mcp/openapi-mcp.json,\n suitable for integration at the top of any service handler\u0027s invoke()\n\nMakefile.am: adds mcp_catalog_handler.c to libfinancial_benchmark_service_la\nand mcp_catalog_handler.h to include_HEADERS / EXTRA_DIST.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "96391b602c9a4f9a52d694322010d52c224118c9", "tree": "b95e20200505ba9b46682ff2b75860d4e172556d", "parents": [ "050a4b15b58d4da73ed86a4e4e0629e4c64ba2e9" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 03:03:57 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Tue Apr 07 03:03:57 2026 -1000" }, "message": "financial-benchmark: B1 — mcpInputSchema + MCP annotations for all 5 operations\n\nPopulates Option 1 (static declaration) mcpInputSchema parameters for all\nfive FinancialBenchmarkService operations in services.xml:\n\n- portfolioVariance: required [n_assets, weights, covariance_matrix]; typed\n integer/array properties; normalize_weights boolean; request_id string\n- monteCarlo: required [n_simulations, n_periods, initial_value,\n expected_return, volatility]; range constraints; optional random_seed\n- scenarioAnalysis: nested asset object schema with required sub-fields\n (asset_id, current_price, scenario_prices, probabilities, position_size);\n use_hash_lookup boolean\n- metadata: empty properties (GET operation, no request body)\n- generateTestData: single required n_assets integer\n\nEach operation also gains mcpDescription (natural language), mcpReadOnly,\nand mcpIdempotent parameters for MCP 2025-03-26 annotation hints.\n\nThese parameters are consumed by the D1 Axis2/C MCP catalog handler\n(mcp_catalog_handler.c, forthcoming) via axis2_op_get_param().\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "050a4b15b58d4da73ed86a4e4e0629e4c64ba2e9", "tree": "45b9439870513d71c4bab42b38fd5b9f95f93226", "parents": [ "8e22f33b924d13960d1a918e0686aefdf22ecd8f" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 14:27:37 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 14:27:37 2026 -1000" }, "message": "financial-benchmark: apply Gemini review fixes to C1 MCP transport\n\nCRITICAL — Mixed allocator usage:\n Replace getline()/free() with a custom mcp_read_line() helper that uses\n AXIS2_MALLOC/AXIS2_FREE exclusively. getline() uses stdlib malloc which\n is undefined behavior when Axis2/C uses a custom pool or debug allocator.\n Removed now-unused \u003cstdlib.h\u003e include.\n\nHIGH — Unbounded memory / DoS:\n mcp_read_line() enforces MAX_MCP_REQUEST_BYTES (16 MB) per line. Oversized\n input is drained and returns a JSON-RPC error instead of exhausting RAM.\n (16 MB accommodates the largest portfolioVariance requests: 500-asset\n covariance matrix ~ 2 MB, with headroom for future growth.)\n\nMEDIUM — Fragile tool catalog loop:\n mcp_handle_tools_list() now iterates to the NULL sentinel instead of\n using the FINBENCH_MCP_N_TOOLS macro. Adding a tool to the array is\n sufficient — no separate count to keep in sync.\n\nLOW — Fragile json_object_to_json_string usage:\n mcp_handle_tools_call() now axutil_strdup()s the args JSON string before\n passing it to finbench_*_json_only(). json_object_to_json_string() returns\n a pointer to json-c\u0027s internal buffer, valid only until the next call on\n any object. The stable copy prevents silent corruption if a future log\n statement calls the same function. AXIS2_FREE()d on all exit paths.\n\nLOW — Remove FINBENCH_MCP_N_TOOLS magic number:\n Replaced with MAX_MCP_REQUEST_BYTES and MCP_LINE_INITIAL_CAP constants\n (both needed for the CRITICAL fix). The loop no longer needs the count.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8e22f33b924d13960d1a918e0686aefdf22ecd8f", "tree": "29cb658866471484cf4f95813eb5564a42167981", "parents": [ "7ad47e26b0a4d10fa50a58b44bc196c464a26f7e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 14:11:00 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 14:11:00 2026 -1000" }, "message": "docs: update MCP.md — C1 stdio complete\n\nMark C1 as done: finbench_mcp.c + finbench_mcp_main.c implemented.\nUpdate next-steps to point at C2 (HTTP/SSE) and Java B1 (transport-mcp).\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "7ad47e26b0a4d10fa50a58b44bc196c464a26f7e", "tree": "765236c648d40e001437d51c01afb59a71697430", "parents": [ "b4f4beb47ab77a238959e88447b0dbfc247317d8" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 14:03:00 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 14:03:00 2026 -1000" }, "message": "financial-benchmark: C1 — MCP stdio transport (JSON-RPC 2.0)\n\nImplements C1 from docs/MCP.md: stdio MCP mode for the financial benchmark\nservice. Claude Desktop launches the binary as a subprocess; it reads\nJSON-RPC 2.0 requests from stdin and writes responses to stdout.\n\nNew files:\n src/finbench_mcp.h — Public API: finbench_run_mcp_stdio(env)\n src/finbench_mcp.c — JSON-RPC 2.0 loop, tool catalog, dispatch\n src/finbench_mcp_main.c — Standalone entry point (axutil_env_create_all)\n\nMCP protocol:\n initialize → protocolVersion, capabilities, serverInfo\n tools/list → static catalog: portfolioVariance, monteCarlo, scenarioAnalysis\n tools/call → thin wrapper around finbench_*_json_only(); result in content[0].text\n notifications (no \"id\") → silently consumed, no response (JSON-RPC 2.0 rule)\n\nDesign notes:\n - getline() for dynamic line buffer (large portfolioVariance requests can be 2MB+)\n - Axis2/C log output written to FINBENCH_LOG_FILE (default: /tmp/finbench_mcp.log)\n so stdout is clean for JSON-RPC responses\n - Tool input schemas use snake_case field names matching the C service\n - static const tool catalog — no reflection, no overhead (C1/C2 pattern from MCP.md)\n\nClaude Desktop config (~/.config/claude/claude_desktop_config.json):\n {\"mcpServers\":{\"axis2c-financial\":\n {\"command\":\"/usr/local/axis2c/bin/financial-benchmark-mcp\"}}}\n\nAlso:\n Makefile.am: add financial-benchmark-mcp bin_PROGRAMS target (links .c directly)\n build_financial_service.sh: add MCP binary build step + install + smoke-test instructions\n financial_benchmark_service_handler.c: route scenarioAnalysis to\n finbench_scenario_json_only() (was a NOT_IMPLEMENTED stub — implementation\n has been complete in financial_benchmark_service.c since the previous commit)\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "b4f4beb47ab77a238959e88447b0dbfc247317d8", "tree": "d8758a35ed9f15e542785aada247b3de7267783d", "parents": [ "aa16a21e87db21bdd48810cd1dbca5fd4763d01c" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 13:32:55 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 13:32:55 2026 -1000" }, "message": "financial-benchmark: apply Gemini 2.5 Pro code review fixes\n\nThree issues found and fixed:\n\nMEDIUM — NaN propagation from floating-point cancellation in portfolio\nvariance O(n²) sum. For numerically near-zero portfolios, the\naccumulation Σ w_i*w_j*σ_ij can yield a small negative result\n(-1e-17) due to cancellation, causing sqrt() to return NaN. Clamp\nvariance to 0.0 before sqrt. Also store sqrt(variance) in a local\n\u0027volatility\u0027 variable to avoid calling sqrt() twice.\n\nLOW — Magic number 8 used in three places for the percentile array\nbounds. Added FINBENCH_MAX_PERCENTILES \u003d 8 to the header and replaced\nall three occurrences in the struct definitions and parsing code.\n\nLOW — Double computation of sqrt(variance) in the portfolio variance\nresponse population. Stored result in \u0027volatility\u0027 local variable and\nused it for both portfolio_volatility and annualized_volatility.\n\nNote: Gemini flagged var_95/var_99 as unpopulated (HIGH severity) but\nthis was a false positive — both fields are still assigned at their\noriginal location in the populate-response block.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "aa16a21e87db21bdd48810cd1dbca5fd4763d01c", "tree": "ed7570e883497e844f442a564645fb85a1f1ebf3", "parents": [ "908d2101bd7aae605d2b7b57739f13c26039b3dd" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 13:26:37 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 13:26:37 2026 -1000" }, "message": "docs: update MCP.md — Java A1/A2/A3 complete, C1 unblocked\n\nReflects completed Java milestones:\n- A1 (/openapi-mcp.json endpoint) ✅\n- A2 (axis2-mcp-bridge stdio JAR + mTLS port 8443) ✅\n- A3 (end-to-end: Claude Desktop → bridge → mTLS → BigDataH2Service) ✅\n\nC1 is now unblocked. The JSON-RPC 2.0 handshake is validated against\na real client; the C port translates proven behavior. Updated the C1\n\"When\" from \"after A2 is validated\" to \"Now — A2 is validated.\"\n\nAdded note that neither implementation needs an MCP SDK — just\njson-c (C) or Jackson + stdlib HttpClient (Java).\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "908d2101bd7aae605d2b7b57739f13c26039b3dd", "tree": "d8ece30f7f5a4c77f6a86eac7ba33730ee877dd9", "parents": [ "99d9b9e0b6abb66f4d10292d2adc5adbd937bdc5" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 13:25:11 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 13:25:11 2026 -1000" }, "message": "financial-benchmark: improve API for Python quant developers\n\nFive targeted improvements addressing the expectations of Python\nquantitative developers who probe APIs with bad inputs immediately:\n\nnormalize_weights (portfolioVariance):\n New bool field. When true, rescales weights in-place to sum to 1.0,\n enabling callers to pass unnormalized exposures (e.g., notional\n position values) without a client-side preprocessing step. When false\n (default), weights that deviate from 1.0 by more than 1e-4 return a\n descriptive error that names the actual sum and hints at the option.\n Response adds weight_sum and weights_normalized fields for auditability.\n\nn_periods_per_year (portfolioVariance + monteCarlo):\n New int field (default 252) controlling annualization.\n portfolioVariance: annualized_volatility \u003d σ × sqrt(n_periods_per_year)\n monteCarlo: GBM time step dt \u003d 1/n_periods_per_year.\n Previously hardcoded to 252; now callers can pass 260 (some fixed-\n income conventions), 365 (crypto), 12 (monthly factor models), etc.\n\npercentiles array (monteCarlo):\n New float[] field (default [0.01, 0.05]). Each value p in (0,1)\n produces a VaR entry: initial_value - sorted_final_values[p × n_sims].\n Response adds percentile_vars: [{percentile, var}, ...] array.\n Fixed var_95/var_99 fields are still always populated for compatibility.\n Up to 8 percentile levels supported.\n\nprob_tolerance (scenarioAnalysis):\n New float field (default 1e-4, clamped to [1e-10, 0.1]).\n Previously hardcoded as a preprocessor constant. Now callers with\n externally-sourced probability data can loosen the tolerance without\n modifying the service. Error message now prints the actual tolerance\n used, making the validation contract explicit.\n\nBetter parse error messages (all three json_only entry points):\n Previously returned generic \"Failed to parse request\". Now each\n operation returns a field-level description of required and optional\n parameters with their types and defaults.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "99d9b9e0b6abb66f4d10292d2adc5adbd937bdc5", "tree": "f820483e08b4fe8f325ab634e40189e855241d0e", "parents": [ "a507465ab6447b8aa1c07feff12f7094f365868a" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 07:12:41 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 07:12:41 2026 -1000" }, "message": "Add MCP development plan for Axis2/C\n\nDocuments the Java-first-then-C-port strategy for MCP support:\n- Java reference implementation proves the protocol (A1→A2→B1)\n- C port follows the same sequence used for HTTP/2\n- C1: stdio MCP mode in financial-benchmark-service (~500 lines)\n- C2: HTTP/SSE endpoint via Apache httpd for Penguin demo (~800 lines)\n- C3: axis2-transport-mcp C module (Apache graduation milestone)\n\nIncludes static tool catalog design (mcp_tools[] struct array),\nisatty() mode detection rationale, relationship to Java schemas,\nand the dual-runtime demo deliverable: Claude Desktop connecting\nto a $20 Android phone and an enterprise Java server via the same\nMCP protocol.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "a507465ab6447b8aa1c07feff12f7094f365868a", "tree": "5b88c36395b57cd5039da33b37ce9f774a0c3873", "parents": [ "ecc9b4751f7b07897a778c146de6da39c4d35cc5" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 07:03:20 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 07:03:20 2026 -1000" }, "message": "Address Gemini code review findings\n\nFix MEDIUM bugs:\n- portfolioVariance: weights_provided \u003d\u003d 0 (missing \"weights\" key) was\n bypassing dimension validation via the \"\u003e 0\" guard, silently returning\n variance\u003d0 as SUCCESS. Now explicitly rejects missing weights and\n missing covariance_matrix with descriptive errors — same guard applied\n to both required fields.\n\nFix LOW issues:\n- Add explicit #include \u003cinttypes.h\u003e for PRId64; previously worked via\n transitive inclusion on glibc/NDK but non-conforming per C99 standard.\n- scenarioAnalysis: log AXIS2_LOG_ERROR when hash_keys allocation fails\n so silent benchmark degradation is visible in the service log rather\n than producing unexplained zero hash timing in the response.\n- Fix comment direction error: tolerance 1e-4 is \"looser than machine\n epsilon\" not \"tighter than financial rounding error (~1e-6)\".\n\nCompiles clean under -Wall -Wextra.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ecc9b4751f7b07897a778c146de6da39c4d35cc5", "tree": "5047cf8bf2bbdb90b80a3447e40f96260cb5cfed", "parents": [ "822e34b7dec6460fd092c6071147dcd893fbc009" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 06:55:28 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 06:55:28 2026 -1000" }, "message": "Add array dimension validation to portfolioVariance\n\npyRAPI (the Python RAPI client) makes clear that quants will probe edge\ncases: sending n_assets\u003d500 with a 100-element weights array or a\n100-element covariance matrix previously silently zero-filled the rest,\nproducing a mathematically meaningless variance with no error signal.\n\nChanges:\n- Add weights_provided and matrix_elements_provided tracking fields to\n finbench_portfolio_variance_request_t (populated during JSON parse)\n- Validate dimensions in finbench_calculate_portfolio_variance() before\n any computation: weights.length must equal n_assets; matrix element\n count must equal n_assets² (checked for both flat and 2D input formats)\n- Error response names the mismatch explicitly: actual count, expected\n count, and the correct format to use\n- Header updated accordingly; compiles clean under -Wall -Wextra\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "822e34b7dec6460fd092c6071147dcd893fbc009", "tree": "c16c03cc8119bb0903394359890670dd735f9bd0", "parents": [ "2e93124f2cc6d25366f1ff7780d4a46290ec8949" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 06:35:02 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 06:35:02 2026 -1000" }, "message": "Add probability-sum validation to scenarioAnalysis\n\nWithout this check, scenario probabilities that do not sum to 1.0\nsilently produce incorrect expected-return figures. A hostile or\nskeptical audience (Python programmers, financial quants) will test\nmalformed input immediately — returning wrong numbers without any\nerror is the kind of silent failure that damages credibility.\n\nValidation runs before any computation (Step 1). Each asset\u0027s\nprobability array is summed and checked against 1.0 within a 1e-4\ntolerance (tight enough to catch bad data, loose enough to accommodate\nlegitimate floating-point representation differences in JSON-encoded\nprobabilities). On failure: returns HTTP 200 with status\u003dFAILED, a\ndescriptive error naming the asset index, asset_id, actual probability\nsum, and expected count — plus an AXIS2_LOG_ERROR entry.\n\nTolerance rationale documented in code: 1e-4 is tighter than typical\nfinancial rounding error (~1e-6) but looser than machine epsilon.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "2e93124f2cc6d25366f1ff7780d4a46290ec8949", "tree": "2be92e4f31a11a1b569a644c05762fd392031c1a", "parents": [ "32a5a5ca6e10be390f91cdfc8a4a8f436cc2bde2" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 06:28:09 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 06:28:09 2026 -1000" }, "message": "Fix axutil_hash key aliasing bug in scenarioAnalysis\n\naxutil_hash_set with AXIS2_HASH_KEY_STRING stores the key pointer — it\ndoes not copy the string. The build loop was reusing a single 32-byte\nstack buffer (key_buf) for all n_assets entries, causing every hash\nentry to point to the same buffer holding only the last asset_id.\nAll lookups except the last entry would fail, making hash_found always\n\u003c\u003d 1 regardless of n_assets.\n\nFix: allocate a per-entry key string (axutil_strdup) into a hash_keys[]\narray before passing to axutil_hash_set. Free all keys after\naxutil_hash_free.\n\nAlso:\n- Split hash timing into hash_build_us + hash_lookup_us so the reported\n speedup compares lookup-only cost (the amortized steady-state case),\n not build+lookup combined\n- Remove unused weight_sum variable in finbench_generate_test_portfolio_json\n- Build now clean under -Wall -Wextra\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "32a5a5ca6e10be390f91cdfc8a4a8f436cc2bde2", "tree": "8162f91e683e662bb9e1ce6581904f6d2acd3445", "parents": [ "dd7ebbd8a0dde66a501415370a0d574e7d113f0a" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 06:19:30 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Mon Apr 06 06:19:30 2026 -1000" }, "message": "Implement scenarioAnalysis and fix benchmark docs\n\n- financial_benchmark_service.c: Implement scenarioAnalysis operation\n with dual O(n)/O(1) benchmark: linear scan vs axutil_hash lookup,\n financial metrics (expected return, upside/downside, U/D ratio)\n- financial_benchmark_service.c: Update comparison_note strings to\n reflect real enterprise production numbers (16-32GB/server)\n- README.md: Replace straw-man Java comparison with accurate enterprise\n production context (70+ WildFly servers, 16-32GB minimum); remove\n company-specific references per Apache project conventions\n- json-httpd-h2-userguide.md: Fix markdown code fence at line 508\n (unclosed block caused heading to render inside code block)\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "dd7ebbd8a0dde66a501415370a0d574e7d113f0a", "tree": "3269767aad3c59d43aed8c3940bb5a35f2b49688", "parents": [ "af8a278733889bb110f85e7a397a8ec144f998d8" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 13:28:23 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 13:28:23 2026 -1000" }, "message": "Release: document core-staging workflow matching Axis2/Java pattern\n\n- Step 4.2: commit MkDocs build to core-staging/ (not core/) so vote\n email can link to temporary preview URL, matching Axis2/Java practice\n- Vote email template: use core-staging/ URL\n- Step 7: document post-vote promotion of core-staging → core and\n deletion of core-staging directory\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "af8a278733889bb110f85e7a397a8ec144f998d8", "tree": "54025dc3096dbc7009d9949c50cc34c82e29074d", "parents": [ "6511eddb007b3ea6631f60174d732a7e4c5cf41c" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 13:15:00 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 13:15:00 2026 -1000" }, "message": "Release: update vote email template in release-process.md\n\nMatch the concise Axis2/Java vote format with brief context paragraph,\ngit tag, distributions, and site link. Remove the old verbose format\nwith the stale core-staging URL.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6511eddb007b3ea6631f60174d732a7e4c5cf41c", "tree": "aa977fa4faaeb5f6a30426c0a458ab03896d5f51", "parents": [ "0016e93ba7c96bcf6340f7d309c669f9be9cfb54" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 13:09:44 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 13:09:44 2026 -1000" }, "message": "Release: update downloads page and release-process docs for 2.0.0\n\n- docs/downloads.md: add Current Release 2.0.0 section with\n dist.apache.org download links, SHA-512, ASC, and KEYS URL\n- docs/community/release-process.md: fix Step 4.1 SVN dev path\n (remove /core/ suffix that doesn\u0027t exist), update Step 4.2 to\n document actual MkDocs build + rsync workflow replacing the\n old core-staging approach, fix Step 7 to match new site workflow\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "0016e93ba7c96bcf6340f7d309c669f9be9cfb54", "tree": "e073c964699bbeaf51bf2b180200a5e072111690", "parents": [ "edc2d48c64d6eefd0c2bec154842c70aac4d2ab8" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 13:01:24 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 13:01:24 2026 -1000" }, "message": "Release: strip build artifacts from dist tarball\n\n- Add *.gcda and *.gcno removal to dist-hook (GCC coverage data from\n prior builds was being included in the source tarball)\n- Strip copied gtest-all.cc and gtest_main.cc from submodule gtest dirs\n (axiom/gtest, util/gtest, neethi/gtest, guththila/gtest generate these\n locally during make; CLEANFILES handles clean but dist-hook is needed\n to ensure they don\u0027t appear in the release tarball)\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "edc2d48c64d6eefd0c2bec154842c70aac4d2ab8", "tree": "e50025850484efe38c0b4a4e8051110f59a9ab2a", "parents": [ "240b03da9cf206a61246671f3d55046a06d35d4c" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 12:57:21 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 12:57:21 2026 -1000" }, "message": "Release: fix make dist failures in samples/user_guide\n\n- configure.ac: move all samples/user_guide Makefiles to unconditional\n AC_CONFIG_FILES; samples/Makefile.am lists user_guide unconditionally\n so configure must always generate its Makefile (and DIST_SUBDIRS\n requires all service subdirs to also have Makefiles for make dist)\n- samples/user_guide/Makefile.am: remove stale bigdata-h2-service/README.md\n and financial-benchmark-service/test/ files from EXTRA_DIST\n- samples/user_guide/financial-benchmark-service/Makefile.am: remove\n nonexistent test/ files from EXTRA_DIST\n- Add README.md for bigdata-h2-service, login-service, testws-service\n (referenced in conf_DATA and EXTRA_DIST but not previously created)\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "240b03da9cf206a61246671f3d55046a06d35d4c", "tree": "0088251235f49cf3cdd57dc3d11975662e80fc9a", "parents": [ "8f496529725cc56cb85b905943a1e7c7642500f9" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 12:37:22 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 12:37:22 2026 -1000" }, "message": "Release: fix make dist failures for 2.0.0 tarball\n\n- configure.ac: make gtest/Makefile conditional on --with-gtest;\n without it, GTEST_DIR is empty causing invalid rule paths\n- Makefile.am: strip gtest/ from dist tarball via dist-hook;\n gtest is a local system dependency (libgtest-dev), not bundled\n- gtest/Makefile: add stub with distdir target so automake\n DIST_SUBDIRS traversal succeeds when gtest is not configured\n- .gitignore: add !gtest/Makefile exception to track stub\n- tools/codegen/native/Makefile.am: fix EXTRA_DIST to list actual\n existing .md files (removed stale SESSION_STATE.md, build/)\n- tools/codegen/native/test/Makefile.am: fix EXTRA_DIST build/ -\u003e output/\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "8f496529725cc56cb85b905943a1e7c7642500f9", "tree": "401418e1f7bcf1a0f5ad9e652f576db0401ba0e2", "parents": [ "6a7cb86413c7f54e3cf465b50935b1b7cce7824f" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:59:21 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:59:21 2026 -1000" }, "message": "Remove obsolete 2009 release_process file\n\nThis file documented the Axis2/C 1.7.0 release process from 2009.\nIt is entirely superseded by docs/community/release-process.md and\ncontains practices now forbidden by ASF policy (MD5 checksums, binary\ndistributions via people.apache.org, Maven 1.0.2 for site generation).\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "6a7cb86413c7f54e3cf465b50935b1b7cce7824f", "tree": "26aa19208fe03f8956d0dcf21057116b6c39d0cd", "parents": [ "df61d42e8b9ca271512553ee5ff0063cc831a163" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:59:11 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:59:11 2026 -1000" }, "message": "Fix doc version references and remove obsolete TCP/libcurl flags\n\n- doxygenconf: update PROJECT_NUMBER from 1.7.0 to 2.0.0\n- downloads.md: correct branch name from main/trunk to master,\n update example tag from v1.7.0 to v2.0.0\n- release-process.md: remove --enable-tcp\u003dyes from build example\n (TCP transport removed in 2.0.0)\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "df61d42e8b9ca271512553ee5ff0063cc831a163", "tree": "8f8fe311f6d30ab27dbf9844ae97d76b937a2e31", "parents": [ "ab82cfff5fe8f95477981978902821a46946bd8e" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:58:35 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:58:35 2026 -1000" }, "message": "Fix INSTALL: remove libcurl references (removed in 2.0.0)\n\nlibcurl-based client transport was removed in 2.0.0. Remove libcurl\npackages from apt/yum/dnf install examples, remove --enable-libcurl\nfrom the configure example, and remove the Windows build section\ndescribing ENABLE_LIBCURL.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "ab82cfff5fe8f95477981978902821a46946bd8e", "tree": "906ce1008173d9b71fa7fdffc2189e5c9a071c43", "parents": [ "805490e0ddf8271e8aa22bf1a605d2aa84eb81a7" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:58:09 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:58:09 2026 -1000" }, "message": "Fix build_for_dist.sh for 2.0.0 release\n\nRemove --enable-tcp\u003dyes (TCP transport removed in 2.0.0).\nUpdate samples include path from axis2-1.7.0 to axis2-2.0.0.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "805490e0ddf8271e8aa22bf1a605d2aa84eb81a7", "tree": "827e9e6fe0ce1fb9baa16937026fde4da314d137", "parents": [ "aa31ab03bc47d3806dffa45ccf6d6b848c12da6b" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:57:43 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:57:43 2026 -1000" }, "message": "Fix NEWS: remove removed features from key features list\n\nRemove TCP transport, libcurl-based client transport, and CGI interface\nfrom the key features list -- these were removed in 2.0.0 and must not\nbe advertised as supported. Add all three to the Removed section.\n\nAlso remove libcurl debug logging from Improvements (feature removed)\nand renumber the key features list for sequential consistency.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" }, { "commit": "aa31ab03bc47d3806dffa45ccf6d6b848c12da6b", "tree": "72af8a1103a914aff777872cd29f18f12d066508", "parents": [ "65f5ccbbd75d416716e1250a67cd50cb6a48b860" ], "author": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:56:18 2026 -1000" }, "committer": { "name": "Robert Lazarski", "email": "robertlazarski@gmail.com", "time": "Fri Apr 03 11:56:18 2026 -1000" }, "message": "Update NOTICE copyright year to 2026\n\nASF policy requires the copyright year range to reflect the current year.\nUpdated from 2005-2012 to 2005-2026 for the 2.0.0 release.\n\nCo-Authored-By: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n" } ], "next": "65f5ccbbd75d416716e1250a67cd50cb6a48b860" }