feat: seed repo with Java SDK RFC, roadmap, and harness foundation

.changeset/README.md

@@ -0,0 +1,32 @@
+# Changesets
+
+This folder is managed by `@changesets/cli`. Per [D18](../ROADMAP.md#confirmed-decisions), this repo uses the same release-notes workflow as `@adcp/sdk`.
+
+## When to add a changeset
+
+Add a changeset whenever your PR changes adopter-visible behavior on any of the eight published artifacts (`adcp`, `adcp-server`, `adcp-testing`, `adcp-spring-boot-starter`, `adcp-cli`, `adcp-reactor`, `adcp-mutiny`, `adcp-kotlin`).
+
+You don't need a changeset for:
+
+- Test-only changes
+- Internal refactors with no public-API impact
+- `docs:` commits that don't touch generated docs
+- `chore:` / `ci:` commits
+
+The `changeset-check` workflow on PRs is informational for borderline cases — when in doubt, add one.
+
+## How to add a changeset
+
+```bash
+npx changeset
+```
+
+Pick the affected artifacts, pick a bump level (`patch` / `minor` / `major`), and write a short user-facing summary. Commit the generated `.changeset/*.md` file with your PR.
+
+## Versioning
+
+Maven Central releases are produced from accumulated changesets. The first publish is **at v0.3 alpha** (per [D6](../ROADMAP.md#confirmed-decisions)); v0.1 and v0.2 ship as local Gradle artifacts only. SDK semver is independent of AdCP spec major (per RFC §Versioning).
+
+## More
+
+[Changesets docs](https://github.com/changesets/changesets) · [Common questions](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "restricted",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": ["adcp-sdk-java-tools"]
+}

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default owners — every PR requests review from both.
+* @bokelley @MichielDean

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -0,0 +1,53 @@
+name: Bug report
+description: Report a defect in the SDK
+labels: ["bug"]
+body:
+  - type: input
+    id: sdk-version
+    attributes:
+      label: SDK version
+      description: Either a published `org.adcontextprotocol:adcp:X.Y.Z` coordinate or a commit SHA if you're on `main`.
+      placeholder: e.g. 0.1.0-SNAPSHOT (commit abc1234)
+    validations:
+      required: true
+  - type: input
+    id: jdk-version
+    attributes:
+      label: JDK version
+      description: Output of `java -version`. We baseline on JDK 21 per D2.
+      placeholder: e.g. openjdk 21.0.11
+    validations:
+      required: true
+  - type: input
+    id: framework
+    attributes:
+      label: Framework / runtime
+      description: Spring Boot, Quarkus, plain JVM, etc. Include the version.
+      placeholder: e.g. Spring Boot 3.4.4 / plain JVM
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: Symptom you observed. Stack trace if you have one.
+    validations:
+      required: true
+  - type: textarea
+    id: what-expected
+    attributes:
+      label: What you expected
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Minimal reproduction
+      description: |
+        Smallest code (or `./gradlew` invocation) that demonstrates the bug. The bar: a maintainer should be able to paste it into a fresh checkout and reproduce in under 5 minutes.
+      render: java
+    validations:
+      required: true
+  - type: textarea
+    id: notes
+    attributes:
+      label: Anything else
+      description: Context, hypotheses, related issues, anything that might help.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,14 @@
+blank_issues_enabled: false
+contact_links:
+  - name: AdCP protocol questions
+    url: https://adcontextprotocol.org/
+    about: Questions about the protocol itself (not the Java SDK) belong on the protocol site.
+  - name: Working group discussion
+    url: https://adcontextprotocol.slack.com
+    about: Design discussion, RFCs, and cross-SDK coordination happen in the AdCP Slack.
+  - name: TypeScript SDK
+    url: https://github.com/adcontextprotocol/adcp-client
+    about: Bugs or questions about the TypeScript SDK belong there, not here.
+  - name: Python SDK
+    url: https://github.com/adcontextprotocol/adcp-client-python
+    about: Bugs or questions about the Python SDK belong there, not here.

.github/ISSUE_TEMPLATE/track-claim.yml

@@ -0,0 +1,61 @@
+name: Claim a track
+description: Volunteer to own one of the 14 tracks from ROADMAP.md
+title: "[track:<id>] <your name> claims <track name>"
+labels: ["track-claim"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for offering to help build this SDK. Read [`ROADMAP.md`](https://github.com/adcontextprotocol/adcp-sdk-java/blob/main/ROADMAP.md) first — it covers the 14 tracks and their dependencies. Skim the [21 confirmed decisions](https://github.com/adcontextprotocol/adcp-sdk-java/blob/main/ROADMAP.md#confirmed-decisions) — they override the RFC where they differ.
+  - type: input
+    id: track
+    attributes:
+      label: Track ID
+      description: One of the 14 track IDs from ROADMAP.md (e.g. `signing`, `codegen`, `transport`, `spring`, `cli`, `kotlin`, `docs`, etc.)
+      placeholder: e.g. signing
+    validations:
+      required: true
+  - type: textarea
+    id: experience
+    attributes:
+      label: Relevant experience
+      description: |
+        Anything that informs whether this is a good fit — records, sealed types, Jackson, Spring Boot, RFC 9421 / JOSE signing, MCP, ad tech protocols, JVM publishing, etc. Be concrete; "5 years building publisher-facing JVM services with Spring Boot 3 + Postgres" beats "experienced Java developer."
+    validations:
+      required: true
+  - type: input
+    id: availability
+    attributes:
+      label: Estimated availability
+      description: Hours per week you can commit. Honest numbers help us plan dependencies.
+      placeholder: e.g. 10 hrs/week
+    validations:
+      required: true
+  - type: dropdown
+    id: milestone
+    attributes:
+      label: First milestone you're committing to
+      description: The track may span several; pick the one you're aiming at first.
+      options:
+        - v0.1 alpha (M+2)
+        - v0.2 alpha (M+4)
+        - v0.3 alpha (M+6)
+        - v0.4 beta (M+9)
+        - v1.0 GA (M+12)
+    validations:
+      required: true
+  - type: dropdown
+    id: wg-sync
+    attributes:
+      label: Can you attend the AdCP working-group sync?
+      options:
+        - "Yes — regularly"
+        - "Sometimes"
+        - "No — async only"
+    validations:
+      required: true
+  - type: textarea
+    id: questions
+    attributes:
+      label: Open questions before you start
+      description: Anything you'd want clarified before claiming.

.github/pull_request_template.md

@@ -0,0 +1,31 @@
+<!--
+Thanks for your PR. Before it's mergeable:
+
+1. The AAO IPR Bot will ask you to comment `I have read the IPR Policy` on
+   your first PR ever to an AAO repo. One-time per contributor across all
+   AAO repos.
+2. CI (`build`, `IPR Policy / Signature`, `commitlint`, `changeset-check`)
+   must be green.
+3. One code-owner approving review (per D21).
+4. PR title and commits follow Conventional Commits.
+5. If the change touches public surface, add a changeset via `npx changeset`.
+-->
+
+## Summary
+
+<!-- Two or three sentences. Why is this change happening, not what changed (the diff says what). -->
+
+## Tracks / decisions touched
+
+<!-- ROADMAP.md track IDs and D-numbers this PR affects. e.g. `signing`, D11. -->
+
+## Test plan
+
+<!--
+Bulleted checklist. What you ran to verify, what you'd want a reviewer to run.
+At minimum: `./gradlew build` green.
+-->
+
+- [ ] `./gradlew build` green
+- [ ] New tests added for new behavior
+- [ ] Public API surface change → changeset added

.github/workflows/changeset-check.yml

@@ -0,0 +1,39 @@
+name: changeset-check
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check for changeset
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Skip for release PRs
+        if: github.head_ref == 'changeset-release/main'
+        run: echo "Release PR — changeset not required"
+
+      - name: Checkout code
+        if: github.head_ref != 'changeset-release/main'
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        if: github.head_ref != 'changeset-release/main'
+        uses: actions/setup-node@v5
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: Install dependencies
+        if: github.head_ref != 'changeset-release/main'
+        run: npm ci
+
+      - name: Check for changeset
+        if: github.head_ref != 'changeset-release/main'
+        run: npx changeset status --since=origin/main

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: build
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: ./gradlew build (JDK 21)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: '21'
+          distribution: 'temurin'
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          # Wrapper-validation guards against a tampered gradle-wrapper.jar
+          # — the standard supply-chain check for OSS Java repos.
+          validate-wrappers: true
+
+      - name: Install cosign
+        # Schema-bundle fetcher (per D4) shells out to `cosign verify-blob`
+        # against the AdCP release workflow's Sigstore signature. Building
+        # the adcp module triggers fetchSchemaBundle → cosign.
+        uses: sigstore/cosign-installer@v3
+
+      - name: Build all modules
+        run: ./gradlew build --stacktrace

.github/workflows/commitlint.yml

@@ -0,0 +1,35 @@
+name: Lint Commit Messages
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Validate PR title follows conventional commits
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          echo "$PR_TITLE" | npx commitlint --config commitlint.config.js
+
+      - name: Validate all commits in PR
+        run: |
+          npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

.github/workflows/ipr-agreement.yml

@@ -0,0 +1,26 @@
+name: IPR Agreement
+
+# Delegates to the reusable workflow in adcontextprotocol/adcp. Signatures
+# land in the central ledger at adcontextprotocol/adcp:signatures/ipr-signatures.json.
+# See https://github.com/adcontextprotocol/adcp/blob/main/governance/ipr-bot-setup.md
+# for the GitHub App configuration and how to rotate / revoke credentials.
+#
+# Per D19 (ROADMAP §Confirmed decisions): this repo replicates the same IPR
+# pattern installed on adcp / adcp-client / adcp-client-python / adcp-go.
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  pull-requests: write
+  statuses: write
+
+jobs:
+  check:
+    uses: adcontextprotocol/adcp/.github/workflows/ipr-check-callable.yml@main
+    secrets:
+      IPR_APP_ID: ${{ secrets.IPR_APP_ID }}
+      IPR_APP_PRIVATE_KEY: ${{ secrets.IPR_APP_PRIVATE_KEY }}