build: migrate from Gradle to Maven

Replace Gradle build with Maven across all modules, examples, and recipes.
Update CI, release, and pitest workflows to use mvn. Switch dependabot
ecosystem from gradle to maven and update .gitignore for target/ outputs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: nficano

.coderabbit.yaml

@@ -1,6 +1,6 @@
 version: 2
 updates:
-  - package-ecosystem: "gradle"
+  - package-ecosystem: "maven"
     directory: "/"
     schedule:
       interval: "weekly"
@@ -9,7 +9,7 @@ updates:
     labels:
       - "dependencies"
     groups:
-      gradle-dependencies:
+      maven-dependencies:
         patterns:
           - "*"
 

.github/dependabot.yml

@@ -47,79 +47,83 @@ jobs:
         with:
           distribution: temurin
           java-version: ${{ matrix.jdk }}
-          cache: gradle
-
-      - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@v6
+          # Built-in Maven cache: keys off pom.xml hashes and restores ~/.m2/repository.
+          cache: maven
 
       - name: Check formatting (Spotless)
         if: ${{ matrix.jdk == '21' }}
-        run: ./gradlew spotlessCheck --no-daemon
+        run: mvn -B -ntp -Darcp.skip.spotless=false spotless:check
 
-      - name: Build
+      - name: Build and test
+        # JDK 25 skips spotless because google-java-format embedded in the pinned
+        # spotless version cannot run against JDK 25's javac internals.
         run: |
           if [[ "${{ matrix.jdk }}" == "21" ]]; then
-            ./gradlew build --no-daemon --stacktrace
+            mvn -B -ntp -Dmaven.javadoc.skip=true verify
           else
-            ./gradlew build --no-daemon --stacktrace \
-              -x spotlessCheck \
-              -x spotlessJavaCheck \
-              -x spotlessJava
+            mvn -B -ntp -Dmaven.javadoc.skip=true -Darcp.skip.spotless=true verify
           fi
 
       - name: Run all runnable examples and recipes
         run: |
-          ./gradlew --no-daemon --stacktrace \
-            :examples:submit-and-stream:run \
-            :examples:cancel:run \
-            :examples:heartbeat:run \
-            :examples:cost-budget:run \
-            :examples:result-chunk:run \
-            :examples:agent-versions:run \
-            :examples:list-jobs:run \
-            :examples:lease-expires-at:run \
-            :examples:idempotent-retry:run \
-            :examples:custom-auth:run \
-            :examples:provisioned-credentials:run \
-            :examples:ack-backpressure:run \
-            :examples:delegate:run \
-            :examples:spring-boot:run \
-            :examples:jakarta:run \
-            :examples:lease-violation:run \
-            :examples:progress:run \
-            :examples:resume:run \
-            :examples:stdio:run \
-            :examples:subscribe:run \
-            :examples:tracing:run \
-            :examples:vendor-extensions:run \
-            :recipes:email-vendor-leases:run \
-            :recipes:mcp-skill:run \
-            :recipes:multi-agent-budget:run \
-            :recipes:stream-resume:run
+          for module in \
+            examples/submit-and-stream \
+            examples/cancel \
+            examples/heartbeat \
+            examples/cost-budget \
+            examples/result-chunk \
+            examples/agent-versions \
+            examples/list-jobs \
+            examples/lease-expires-at \
+            examples/idempotent-retry \
+            examples/custom-auth \
+            examples/provisioned-credentials \
+            examples/ack-backpressure \
+            examples/delegate \
+            examples/spring-boot \
+            examples/jakarta \
+            examples/lease-violation \
+            examples/progress \
+            examples/resume \
+            examples/stdio \
+            examples/subscribe \
+            examples/tracing \
+            examples/vendor-extensions \
+            recipes/email-vendor-leases \
+            recipes/mcp-skill \
+            recipes/multi-agent-budget \
+            recipes/stream-resume
+          do
+            echo "::group::run $module"
+            mvn -B -ntp -pl "$module" -am -Darcp.skip.spotless=true -Dmaven.javadoc.skip=true \
+              -Dmaven.test.skip=true -Dexec.cleanupDaemonThreads=false \
+              exec:java
+            echo "::endgroup::"
+          done
 
       - name: Upload test reports
         if: always()
         uses: actions/upload-artifact@v7
         with:
           name: test-reports-jdk${{ matrix.jdk }}
           path: |
-            **/build/reports/tests/
-            **/build/test-results/
+            **/target/surefire-reports/
+            **/target/site/jacoco/
           if-no-files-found: ignore
           retention-days: 7
 
-      # Jacoco XML reports are emitted to **/build/reports/jacoco/test/
-      # because subprojects apply the jacoco plugin and Test is finalizedBy
-      # jacocoTestReport (see root build.gradle.kts). Upload from the LTS
-      # floor only — coverage is identical across JDKs. Non-blocking.
+      # jacoco-maven-plugin (configured in the parent pom) writes per-module
+      # XML reports to target/site/jacoco/jacoco.xml — the path the Codecov
+      # example-java-maven repo uses. Upload from the LTS floor only; coverage
+      # is identical across JDKs. Non-blocking.
       - name: Upload coverage to Codecov
         if: matrix.jdk == '21'
         # codecov/codecov-action v6.0.1
         uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           fail_ci_if_error: false
           flags: unittests
-          files: "**/build/reports/jacoco/test/jacocoTestReport.xml"
+          files: "**/target/site/jacoco/jacoco.xml"
           token: ${{ secrets.CODECOV_TOKEN }}
 
   javadoc:
@@ -134,17 +138,9 @@ jobs:
         with:
           distribution: temurin
           java-version: "21"
-          cache: gradle
+          cache: maven
       - name: Build javadoc for all published modules
         run: |
-          ./gradlew --no-daemon \
-            :arcp-core:javadoc \
-            :arcp-client:javadoc \
-            :arcp-runtime:javadoc \
-            :arcp:javadoc \
-            :arcp-otel:javadoc \
-            :arcp-runtime-jetty:javadoc \
-            :arcp-middleware-jakarta:javadoc \
-            :arcp-middleware-spring-boot:javadoc \
-            :arcp-middleware-vertx:javadoc \
-            :arcp-tck:javadoc
+          mvn -B -ntp -am -DskipTests -Darcp.skip.spotless=true \
+            -pl arcp-core,arcp-client,arcp-runtime,arcp,arcp-otel,arcp-runtime-jetty,arcp-middleware-jakarta,arcp-middleware-spring-boot,arcp-middleware-vertx,arcp-tck \
+            javadoc:javadoc

.github/workflows/ci.yml

@@ -21,15 +21,17 @@ jobs:
         with:
           distribution: temurin
           java-version: "21"
+          cache: maven
 
-      - uses: gradle/actions/setup-gradle@v6
+      - name: Install dependencies of ${{ matrix.module }}
+        run: mvn -B -ntp -pl ${{ matrix.module }} -am -DskipTests -Darcp.skip.spotless=true install
 
       - name: Run PIT mutation analysis
-        run: ./gradlew :${{ matrix.module }}:pitest --no-daemon --stacktrace
+        run: mvn -B -ntp -pl ${{ matrix.module }} -Darcp.skip.spotless=true org.pitest:pitest-maven:mutationCoverage
 
       - name: Upload mutation report
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: pitest-${{ matrix.module }}
-          path: ${{ matrix.module }}/build/reports/pitest/
+          path: ${{ matrix.module }}/target/pit-reports/

.github/workflows/pitest-nightly.yml

@@ -30,8 +30,12 @@ jobs:
         with:
           distribution: temurin
           java-version: "21"
-
-      - uses: gradle/actions/setup-gradle@v6
+          cache: maven
+          server-id: central
+          server-username: CENTRAL_USERNAME
+          server-password: CENTRAL_PASSWORD
+          gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}
+          gpg-passphrase: GPG_SIGNING_PASSWORD
 
       - name: Configure git for tagging
         run: |
@@ -40,25 +44,26 @@ jobs:
 
       - name: Set release version
         run: |
-          # Replace `version = "x.x.x-SNAPSHOT"` with the supplied release version.
-          sed -i 's|version = ".*"|version = "${{ inputs.version }}"|' build.gradle.kts
-          grep '^[ ]*version =' build.gradle.kts
+          mvn -B -ntp versions:set -DnewVersion=${{ inputs.version }} -DgenerateBackupPoms=false
+          mvn -B -ntp versions:commit || true
 
       - name: Build + test
-        run: ./gradlew build --no-daemon --stacktrace
+        run: mvn -B -ntp verify
 
       - name: Publish to Maven Central
         if: ${{ !inputs.dry_run }}
         env:
           CENTRAL_USERNAME: ${{ secrets.OSSRH_USERNAME }}
           CENTRAL_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
-          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
-          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
-        run: ./gradlew --no-daemon --stacktrace publishAggregationToCentralPortal
+          GPG_SIGNING_PASSWORD: ${{ secrets.GPG_SIGNING_PASSWORD }}
+          # MAVEN_GPG_PASSPHRASE is the env name maven-gpg-plugin reads by
+          # default when no <passphrase> is set in the plugin config.
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSWORD }}
+        run: mvn -B -ntp -Prelease -DskipTests deploy
 
       - name: Local publish (dry run)
         if: ${{ inputs.dry_run }}
-        run: ./gradlew publishToMavenLocal --no-daemon --stacktrace
+        run: mvn -B -ntp install
 
       - name: Tag the release
         if: ${{ !inputs.dry_run }}

.github/workflows/release.yml

@@ -1,10 +1,8 @@
-# Gradle
-.gradle/
-build/
-**/build/
+# Maven
+target/
+**/target/
 bin/
 **/bin/
-!gradle/wrapper/gradle-wrapper.jar
 
 # IDE
 .idea/

.gitignore

@@ -146,7 +146,7 @@ works" is decomposed into multiple binary rows.
 
 ## Tests
 
-Counts after `./gradlew test`:
+Counts after `mvn test`:
 
 | Module | Tests | Status |
 |---|---|---|

CONFORMANCE.md

@@ -58,21 +58,21 @@ than large ones; if a change is big, say so early and we'll help break it down.
 
 ## Development setup
 
-The build targets JDK 21 LTS (`--release 21`) and is driven entirely by the
-bundled Gradle wrapper — do not install Gradle separately. CI runs on Temurin
-21 and 25; either works locally. Clone, point `JAVA_HOME` at a JDK 21+, and
-let the wrapper resolve everything else:
+The build targets JDK 21 LTS (`--release 21`) and runs through Apache Maven
+3.9+. CI runs on Temurin 21 and 25; either works locally. Install Maven (or use
+your IDE's bundled copy), clone, and point `JAVA_HOME` at a JDK 21+:
 
 ```sh
 git clone https://github.com/nficano/arpc.git
 cd arpc/java-sdk
 export JAVA_HOME=$(/usr/libexec/java_home -v 21)   # macOS; use your distro's equivalent
-./gradlew help                                     # bootstraps the wrapper + toolchain
+mvn -version                                       # confirm Maven 3.9+ on JDK 21+
 ```
 
-The build is a multi-module Gradle project (`arcp-core`, `arcp-client`,
+The build is a Maven multi-module reactor (`arcp-core`, `arcp-client`,
 `arcp-runtime`, the `arcp` umbrella, transport adapters, middleware, the TCK,
-and example/recipe projects); `settings.gradle.kts` is the canonical list.
+and example/recipe projects); `pom.xml` at the repo root is the canonical
+`<modules>` list.
 
 ## Tests and conformance
 
@@ -81,13 +81,13 @@ Two layers must pass before a PR merges:
 - **Unit tests** — this SDK's own suite:
 
   ```sh
-  ./gradlew build
+  mvn verify
   ```
 
-  `build` compiles every module, runs Spotless, and executes the JUnit 5 +
-  jqwik suites across all subprojects. Use `./gradlew test` (or
-  `./gradlew :arcp-core:test`) to skip compilation of unrelated modules during
-  iteration.
+  `verify` compiles every module, runs Spotless, and executes the JUnit 5 +
+  jqwik suites across all subprojects. Use `mvn -pl arcp-core test` (with
+  `-am` to also rebuild upstream modules) to skip compilation of unrelated
+  modules during iteration.
 
 - **Conformance** — the SDK's behavior against the reference runtime. New
   protocol-facing code (session negotiation, event sequencing, lease handling,
@@ -97,7 +97,7 @@ Two layers must pass before a PR merges:
   point it at any `Transport` pair — `MemoryTransport.pair()` for the in-process
   reference runtime, or a live WebSocket pair via `arcp-runtime-jetty` +
   `arcp-client`'s `WebSocketTransport.connect(uri)`. Run with
-  `./gradlew :arcp-tck:test`.
+  `mvn -pl arcp-tck -am test`.
 
 CI runs both on every PR. A PR that changes which feature flags the SDK
 negotiates must also update the README feature matrix in the same change.
@@ -107,15 +107,19 @@ negotiates must also update the README feature matrix in the same change.
 Formatting is enforced by [Spotless](https://github.com/diffplug/spotless)
 configured with Google Java Format and unused-import removal. The same JDK 21
 `javac` settings (`-Xlint:all`, `-parameters`, UTF-8) and Javadoc generation
-that CI uses are applied to every `java-library` subproject:
+that CI uses are applied to every library module via the parent POM:
 
 ```sh
-./gradlew spotlessApply           # auto-format
-./gradlew spotlessCheck           # verify (CI gate on JDK 21)
-./gradlew build                   # compile + lint warnings + tests
-./gradlew javadoc                 # Javadoc for the published modules
+mvn spotless:apply                # auto-format
+mvn spotless:check                # verify (CI gate on JDK 21)
+mvn verify                        # compile + lint warnings + tests
+mvn javadoc:javadoc               # Javadoc for the published modules
 ```
 
+The pinned Spotless 2.44.x uses a google-java-format build that can't run
+on JDK 25's javac internals; pass `-Darcp.skip.spotless=true` when iterating
+on JDK 25 locally. CI pins the Spotless gate to JDK 21.
+
 Beyond formatting, the house style is captured in the existing code: records
 for value types, sealed hierarchies (`Message`, `EventBody`, `ArcpException`)
 for exhaustive dispatch, JSpecify `@Nullable` on anything that may return null,
@@ -143,8 +147,8 @@ the changelog. Prefer clarity over cleverness in a library others build on.
 
 Releases are cut by maintainers. The `release` GitHub Actions workflow is
 dispatched manually with a version input; it builds, signs with the project
-PGP key, publishes the aggregated set of `dev.arcp:*` artifacts to Maven
-Central via the `com.gradleup.nmcp` plugin, and pushes a `vX.Y.Z` tag.
+PGP key, publishes the `dev.arcp:*` artifacts to Maven Central via the
+`central-publishing-maven-plugin`, and pushes a `vX.Y.Z` tag.
 Detailed operator steps live in [RELEASING.md](RELEASING.md). The SDK is
 versioned with semantic versioning independently of the protocol version it
 speaks; a protocol version bump is noted in the changelog when the negotiated