<version>1.2.3</version>

<version>2.0.0</version>

DependencyGraph(base) + UpgradeRequest + Policy
  -> DependencyGraph(candidate)
  -> GraphDiff
  -> SourceImpact
  -> VerificationReport
  -> RiskVerdict
  -> PR

Project:
  payment-orchestrator

Build:
  Maven multi-module
  Java 17
  JUnit 5
  Spring-like application, tetapi case study tidak bergantung pada Spring

Upgrade request:
  Upgrade com.acme:fraud-client from 1.8.7 to 2.1.0

Known breaking changes:
  - FraudClient.check(TransactionRequest) diganti menjadi FraudGateway.assess(FraudAssessmentRequest)
  - FraudResult.getScore() berubah dari int 0..100 menjadi RiskScore value object
  - FraudResult.isBlocked() diganti menjadi decision() == Decision.BLOCK
  - Timeout default berubah dari 500ms ke 2s
  - Package com.acme.fraud.client.* pindah ke com.acme.fraud.api.*

Every dependency upgrade is guilty until verified.

pom.xml direct dependency
pom.xml property
parent pom
imported BOM
<dependencyManagement>
plugin dependency
profile-specific dependency
module-specific dependency

<properties>
  <fraud-client.version>1.8.7</fraud-client.version>
</properties>

<dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>com.acme</groupId>
      <artifactId>fraud-client</artifactId>
      <version>${fraud-client.version}</version>
    </dependency>
  </dependencies>
</dependencyManagement>

<dependencies>
  <dependency>
    <groupId>com.acme</groupId>
    <artifactId>fraud-client</artifactId>
  </dependency>
</dependencies>

public record DependencyCoordinate(
    String groupId,
    String artifactId,
    String version,
    String classifier,
    String type,
    String scope
) {}

public record UpgradeRequest(
    String repositoryId,
    String baseRef,
    DependencyCoordinate from,
    DependencyCoordinate to,
    UpgradeReason reason,
    UpgradeRiskMode riskMode,
    List<String> allowedModules,
    List<String> forbiddenPaths,
    VerificationProfile verificationProfile
) {}

public enum UpgradeReason {
    SECURITY_FIX,
    PLATFORM_STANDARDIZATION,
    FEATURE_REQUIRED,
    END_OF_LIFE,
    FRAMEWORK_MIGRATION,
    MANUAL_REQUEST
}

public enum UpgradeRiskMode {
    PATCH_ONLY,
    MINOR_ALLOWED,
    MAJOR_WITH_REPAIR,
    SECURITY_EMERGENCY,
    ANALYSIS_ONLY
}

public record DependencyGraphSnapshot(
    String repoId,
    String commitSha,
    String module,
    List<ResolvedDependency> resolvedDependencies,
    List<DependencyDeclaration> declarations,
    List<BomImport> bomImports,
    List<ParentPom> parents,
    String rawTreeArtifactUri
) {}

public record DependencyGraphDiff(
    DependencyGraphSnapshot before,
    DependencyGraphSnapshot after,
    List<DependencyVersionChange> versionChanges,
    List<ResolvedDependency> added,
    List<ResolvedDependency> removed,
    List<PotentialConflict> conflicts
) {}

public record SourceImpactReport(
    List<SymbolReference> directApiReferences,
    List<CompilationError> compileErrorsAfterUpgrade,
    List<TestFailure> testFailuresAfterUpgrade,
    List<ConfigImpact> configImpacts,
    List<RiskNote> unresolvedRisks
) {}

Dependency declaration changed at root pom property fraud-client.version.
Resolved graph changed in modules payment-core and payment-service.
17 source references were impacted.
13 repaired deterministically/agentically.
4 were skipped because they belong to forbidden module legacy-adapter.
Compile passed. Unit tests passed. Integration tests not run by policy.

policy:
  dependencyUpgrade:
    maxDirectDependenciesPerRun: 1
    allowMajorUpgradeWithoutApproval: false
    requireBaselineVerification: true
    requireDependencyGraphDiff: true
    requireLicenseScan: true
    requireVulnerabilityScan: true
    allowedScopes:
      - compile
      - runtime
      - test
    forbiddenArtifacts:
      - groupId: "javax.servlet"
        artifactId: "javax.servlet-api"
        reason: "managed by platform"

APPROVED_FOR_ANALYSIS
APPROVED_FOR_PATCH
REQUIRES_APPROVAL
BLOCKED

APPROVED_FOR_ANALYSIS -> human approval -> APPROVED_FOR_PATCH

mvn -q -DskipTests compile
mvn -q test
mvn -q dependency:tree -DoutputFile=target/agent/dependency-tree-before.txt

verificationProfile:
  baseline:
    commands:
      - name: compile-all
        argv: ["mvn", "-q", "-DskipTests", "compile"]
        timeoutSeconds: 900
      - name: unit-test-affected-later
        strategy: defer
      - name: dependency-tree
        argv: ["mvn", "-q", "dependency:tree", "-DoutputFile=target/agent/dependency-tree-before.txt"]
        timeoutSeconds: 300

{
  "baselineStatus": "PASSED",
  "commitSha": "abc123",
  "commands": [
    { "name": "compile-all", "status": "PASSED", "durationMs": 412000 },
    { "name": "dependency-tree", "status": "PASSED", "artifact": "artifact://..." }
  ]
}

BASELINE_FAILED_UNRELATED
BASELINE_FAILED_RELATED_TO_TARGET
BASELINE_FAILED_INFRA

1. direct dependency version in module pom
2. property used by dependency version
3. dependencyManagement in parent/root pom
4. imported BOM version
5. parent POM version
6. profile-specific declaration
7. plugin dependency declaration

{
  "coordinate": "com.acme:fraud-client",
  "effectiveVersion": "1.8.7",
  "declarationKind": "PROPERTY",
  "file": "pom.xml",
  "propertyName": "fraud-client.version",
  "currentValue": "1.8.7",
  "candidateValue": "2.1.0",
  "affectedModules": ["payment-core", "payment-service"]
}

diff --git a/pom.xml b/pom.xml
--- a/pom.xml
+++ b/pom.xml
@@ -18,7 +18,7 @@
   <properties>
     <java.version>17</java.version>
-    <fraud-client.version>1.8.7</fraud-client.version>
+    <fraud-client.version>2.1.0</fraud-client.version>
   </properties>

mvn -q -DskipTests compile dependency:tree -DoutputFile=target/agent/dependency-tree-after.txt

Apa dependency langsung yang berubah?
Apa transitive dependency yang ikut berubah?
Apakah ada artifact baru?
Apakah ada artifact hilang?
Apakah ada versi turun/downgrade?
Apakah ada scope berubah?
Apakah ada duplicate class risk?
Apakah ada dependency conflict yang sebelumnya tidak ada?

{
  "directChange": {
    "coordinate": "com.acme:fraud-client",
    "from": "1.8.7",
    "to": "2.1.0"
  },
  "transitiveChanges": [
    {
      "coordinate": "com.acme:fraud-model",
      "from": "1.3.0",
      "to": "2.0.1",
      "risk": "MAJOR_VERSION_CHANGE"
    },
    {
      "coordinate": "com.fasterxml.jackson.core:jackson-databind",
      "from": "2.14.2",
      "to": "2.15.4",
      "risk": "MINOR_VERSION_CHANGE"
    }
  ],
  "removed": [],
  "added": [
    {
      "coordinate": "com.acme:fraud-spi:2.1.0",
      "scope": "compile"
    }
  ]
}

{
  "riskLevel": "HIGH",
  "reasons": [
    "Direct dependency major version upgrade",
    "Public API source references found",
    "Default timeout behavior changed",
    "Transitive major upgrade com.acme:fraud-model 1.x -> 2.x"
  ],
  "allowedMode": "SUPERVISED_PR",
  "requiresHumanReview": true
}

LOW       -> autonomous PR possible
MEDIUM    -> supervised PR, strict verifier
HIGH      -> draft PR, human review mandatory
CRITICAL  -> analysis-only unless explicit approval

lexical search     -> cepat, recall tinggi
symbol index       -> import/type/method reference
compiler errors    -> authoritative untuk source incompatibility
test failure       -> behavioral signal

com.acme.fraud.client
FraudClient
FraudResult
getScore(
isBlocked(
TransactionRequest

{
  "directApiReferences": [
    {
      "file": "payment-core/src/main/java/acme/payment/FraudCheckService.java",
      "line": 17,
      "symbol": "FraudClient",
      "kind": "TYPE_REFERENCE"
    },
    {
      "file": "payment-core/src/main/java/acme/payment/FraudCheckService.java",
      "line": 44,
      "symbol": "FraudResult.isBlocked",
      "kind": "METHOD_CALL"
    }
  ],
  "testReferences": [
    {
      "file": "payment-core/src/test/java/acme/payment/FraudCheckServiceTest.java",
      "symbol": "FraudClient"
    }
  ]
}

[ERROR] FraudCheckService.java:[12,28] package com.acme.fraud.client does not exist
[ERROR] FraudCheckService.java:[21,19] cannot find symbol: class FraudClient
[ERROR] FraudCheckService.java:[44,21] cannot find symbol: method isBlocked()
[ERROR] FraudCheckService.java:[45,28] bad operand types for binary operator '>='
  first type:  RiskScore
  second type: int

{
  "errors": [
    {
      "file": "payment-core/src/main/java/acme/payment/FraudCheckService.java",
      "line": 12,
      "type": "MISSING_PACKAGE",
      "message": "package com.acme.fraud.client does not exist",
      "likelyCause": "Package renamed in fraud-client 2.x"
    },
    {
      "file": "payment-core/src/main/java/acme/payment/FraudCheckService.java",
      "line": 44,
      "type": "MISSING_METHOD",
      "symbol": "FraudResult.isBlocked",
      "likelyReplacement": "FraudResult.decision() == Decision.BLOCK"
    }
  ]
}

1. release notes/changelog
2. migration guide
3. generated compile errors
4. source code/javadoc dari dependency bila tersedia
5. examples/test fixtures
6. manually supplied prompt contract

migrationContract:
  dependency:
    groupId: com.acme
    artifactId: fraud-client
    fromRange: "[1.0.0,2.0.0)"
    toRange: "[2.0.0,3.0.0)"

  rules:
    - id: package-rename
      from: "com.acme.fraud.client"
      to: "com.acme.fraud.api"
      type: import-rewrite

    - id: client-type
      from: "FraudClient"
      to: "FraudGateway"
      type: type-rewrite
      notes: "Constructor/injection may differ by module. Prefer existing bean if available."

    - id: blocked-decision
      from: "result.isBlocked()"
      to: "result.decision() == Decision.BLOCK"
      type: expression-rewrite

    - id: risk-score
      from: "result.getScore() >= N"
      to: "result.score().value() >= N"
      type: expression-rewrite
      guard: "Only if value() returns same scale 0..100. Otherwise ask for review."

  configChanges:
    - from: "fraud.timeout-ms"
      to: "fraud.client.timeout-ms"
      defaultChanged:
        from: 500
        to: 2000
      policy: "Preserve old effective behavior unless task explicitly requests new default."

import com.acme.fraud.client.* -> import com.acme.fraud.api.*
FraudResult.isBlocked()       -> FraudResult.decision() == Decision.BLOCK
result.getScore()             -> result.score().value() when context confirms 0..100
config fraud.timeout-ms       -> fraud.client.timeout-ms preserving value

-import com.acme.fraud.client.FraudClient;
-import com.acme.fraud.client.FraudResult;
+import com.acme.fraud.api.Decision;
+import com.acme.fraud.api.FraudGateway;
+import com.acme.fraud.api.FraudResult;

 public final class FraudCheckService {
-  private final FraudClient fraudClient;
+  private final FraudGateway fraudGateway;

-  public FraudCheckService(FraudClient fraudClient) {
-    this.fraudClient = fraudClient;
+  public FraudCheckService(FraudGateway fraudGateway) {
+    this.fraudGateway = fraudGateway;
   }

   public FraudDecision check(Transaction transaction) {
-    FraudResult result = fraudClient.check(toRequest(transaction));
-    if (result.isBlocked()) {
+    FraudResult result = fraudGateway.assess(toAssessmentRequest(transaction));
+    if (result.decision() == Decision.BLOCK) {
       return FraudDecision.blocked();
     }
-    if (result.getScore() >= 80) {
+    if (result.score().value() >= 80) {
       return FraudDecision.review();
     }

Fix the build.

Repair compile errors in payment-core/src/main/java/acme/payment/FraudCheckService.java caused by fraud-client 2.x migration.
Allowed files:
- payment-core/src/main/java/acme/payment/FraudCheckService.java
- payment-core/src/test/java/acme/payment/FraudCheckServiceTest.java
- payment-core/src/main/resources/application.yml

Migration rules:
- FraudClient -> FraudGateway
- FraudClient.check(TransactionRequest) -> FraudGateway.assess(FraudAssessmentRequest)
- FraudResult.isBlocked() -> FraudResult.decision() == Decision.BLOCK
- FraudResult.getScore() -> FraudResult.score().value() only if preserving 0..100 scale

Do not change unrelated payment behavior.
Do not relax tests.
Run compile verifier after patch.

agenticRepair:
  maxIterations: 4
  maxFilesPerIteration: 5
  maxAddedLines: 300
  forbiddenActions:
    - skip-tests
    - delete-tests
    - broad-formatting
    - change-public-api-without-approval

- assertEquals(FraudDecision.BLOCKED, decision);
+ assertNotNull(decision);

testPolicy:
  disallowAssertionWeakening: true
  disallowTestDeletion: true
  disallowDisabledTests: true
  requireBehavioralEquivalenceNote: true

- when(fraudClient.check(any())).thenReturn(FraudResult.blocked(95));
+ when(fraudGateway.assess(any())).thenReturn(
+     FraudResult.of(Decision.BLOCK, RiskScore.of(95))
+ );

  FraudDecision decision = service.check(transaction);
  assertEquals(FraudDecision.BLOCKED, decision);

@Disabled baru
Assumption baru
assertTrue(true)
assertNotNull menggantikan assertion spesifik
penghapusan test file
perubahan threshold tanpa alasan

fraud-client 1.x default timeout = 500ms
fraud-client 2.x default timeout = 2000ms

 fraud:
-  timeout-ms: 500
+  client:
+    timeout-ms: 500

Runtime behavior note:
- fraud-client 2.x changes default timeout from 500ms to 2000ms.
- This PR preserves the previous effective timeout by migrating config key `fraud.timeout-ms` to `fraud.client.timeout-ms` with value 500.

API compatibility repair
Runtime behavior preservation
Intentional behavior adoption
Unknown behavior risk

Upgrade request
Before dependency tree
After dependency tree
POM diff
Source diff
Verification report

1. Apakah target dependency benar berubah ke versi yang diminta?
2. Apakah hanya satu direct dependency yang diubah?
3. Apakah transitive changes dijelaskan?
4. Apakah ada downgrade tidak disengaja?
5. Apakah ada artifact baru high-risk?
6. Apakah scope berubah?
7. Apakah dependency test-only bocor ke compile/runtime?
8. Apakah public API project sekarang mengekspos dependency baru?

{
  "verdict": "PASS_WITH_NOTES",
  "notes": [
    "Target dependency upgraded correctly",
    "Transitive major upgrade com.acme:fraud-model included",
    "No dependency scope expansion detected",
    "Runtime timeout default preserved via config migration"
  ],
  "requiresHumanAttention": [
    "fraud-spi added as compile dependency; reviewer should confirm expected"
  ]
}

pom.xml
module pom.xml files
source files with direct API references
test files with direct API references
config files containing migrated config keys
migration evidence artifacts, if committed by policy

unrelated service classes
large formatting-only changes
generated code without generator command evidence
CI config unrelated to build failure
README mass rewrite
lock/config file with no explanation

Review whether this diff stays within the dependency upgrade boundary.
The task is upgrading com.acme:fraud-client 1.8.7 -> 2.1.0.
Allowed change types:
- Maven declaration/version update
- source repairs caused by fraud-client API changes
- test fixture updates caused by fraud-client API changes
- config key migration for fraud-client timeout
Reject if:
- unrelated business logic changed
- tests were weakened
- broad formatting hides semantic changes
- dependency scope expanded without explanation
Return structured verdict.

## Summary
Upgrades `com.acme:fraud-client` from `1.8.7` to `2.1.0`.

## Why
Requested dependency upgrade: SECURITY_FIX / PLATFORM_STANDARDIZATION.

## Dependency graph impact
- Direct dependency changed: `com.acme:fraud-client 1.8.7 -> 2.1.0`
- Transitive changes:
  - `com.acme:fraud-model 1.3.0 -> 2.0.1`
  - `com.acme:fraud-spi 2.1.0` added
- No dependency scope expansion detected.

## Source changes
- Migrated `FraudClient` usage to `FraudGateway`.
- Replaced `FraudResult.isBlocked()` with `decision() == Decision.BLOCK`.
- Replaced score access with `score().value()` where scale preservation was verified.
- Updated affected tests without weakening assertions.

## Runtime behavior
- Preserved previous effective timeout of 500ms by migrating config key.

## Verification
- Baseline compile before change: PASS
- Baseline dependency tree captured: PASS
- Compile after upgrade: PASS
- Unit tests affected modules: PASS
- Diff boundary judge: PASS_WITH_NOTES

## Reviewer notes
Please confirm that added transitive dependency `com.acme:fraud-spi` is expected for fraud-client 2.x.

public final class DependencyUpgradeOrchestrator {

  public RunResult run(UpgradeRequest request) {
    PolicyDecision policy = policyGate.evaluate(request);
    if (!policy.canAnalyze()) {
      return RunResult.blocked(policy.reason());
    }

    Workspace workspace = repositoryIngestion.prepare(request.repositoryId(), request.baseRef());

    VerificationReport baseline = verifier.runBaseline(workspace, request.verificationProfile());
    if (!baseline.passed()) {
      return RunResult.analysisOnly("Baseline failed", baseline);
    }

    DependencyGraphSnapshot before = dependencyAnalyzer.snapshot(workspace);
    VersionDeclaration declaration = dependencyAnalyzer.locateDeclaration(workspace, request.from());

    Patch versionPatch = pomEditor.updateVersion(declaration, request.to().version());
    patchService.apply(workspace, versionPatch);

    DependencyGraphSnapshot after = dependencyAnalyzer.snapshot(workspace);
    DependencyGraphDiff graphDiff = dependencyAnalyzer.diff(before, after);

    RiskAssessment risk = riskClassifier.classify(request, graphDiff);
    if (!policy.canPatch(risk)) {
      return RunResult.analysisOnly("Risk requires approval", graphDiff, risk);
    }

    RepairLoopResult repair = repairLoop.repairUntilCompilePasses(workspace, request, graphDiff);
    VerificationReport tests = verifier.runTests(workspace, request.verificationProfile());

    JudgeReport judge = judge.evaluate(workspace, request, graphDiff, repair, tests);

    if (!judge.allowsPr()) {
      return RunResult.failed("Judge rejected diff", judge);
    }

    PullRequestDraft pr = prBuilder.build(request, graphDiff, repair, tests, judge);
    return RunResult.prReady(pr);
  }
}

[ ] Baseline status diketahui.
[ ] Target dependency declaration ditemukan dengan provenance.
[ ] Patch versi minimal dan benar.
[ ] Dependency graph before/after tersimpan sebagai artifact.
[ ] Transitive changes diringkas.
[ ] Compile verifier pass setelah upgrade/repair.
[ ] Test verifier dijalankan sesuai profile.
[ ] Tidak ada test weakening yang terdeteksi.
[ ] Runtime config impact dinyatakan.
[ ] Diff boundary judge pass.
[ ] PR body menyebut unresolved risk.

create table dependency_upgrade_reports (
  id uuid primary key,
  run_id uuid not null,
  target_group_id text not null,
  target_artifact_id text not null,
  from_version text not null,
  to_version text not null,
  declaration_kind text not null,
  declaration_file text not null,
  before_tree_artifact_id uuid not null,
  after_tree_artifact_id uuid not null,
  graph_diff_artifact_id uuid not null,
  risk_level text not null,
  created_at timestamptz not null default now()
);

{
  "eventType": "DependencyUpgradeGraphDiffCreated",
  "runId": "...",
  "target": "com.acme:fraud-client",
  "from": "1.8.7",
  "to": "2.1.0",
  "riskLevel": "HIGH",
  "directChanges": 1,
  "transitiveChanges": 12,
  "artifactUri": "artifact://runs/.../dependency-graph-diff.json"
}

payment-parent
  payment-api
  payment-core
  payment-service

fraud-client-v1
fraud-client-v2

mvn install

task:
  type: DEPENDENCY_UPGRADE
  dependency: com.acme:fraud-client
  from: 1.8.7
  to: 2.1.0
  mode: MAJOR_WITH_REPAIR

1. Agent mengubah versi di lokasi yang benar.
2. Agent menghasilkan dependency graph diff.
3. Agent memperbaiki compile error.
4. Agent tidak mengubah file unrelated.
5. Agent memperbarui test tanpa melemahkan assertion.
6. Agent menghasilkan PR body evidence-oriented.

Dependency upgrade = graph transition + source repair + runtime risk management.

Apa yang berubah?
Kenapa berubah?
Apa dampaknya?
Apa yang diverifikasi?
Apa risiko yang tersisa?