diff --git a/.claude/commands/opsx/apply.md b/.claude/commands/opsx/apply.md
index ae14f0f5f..f540757f3 100644
--- a/.claude/commands/opsx/apply.md
+++ b/.claude/commands/opsx/apply.md
@@ -7,6 +7,8 @@ tags: [workflow, artifacts, experimental]
 
 Implement tasks from an OpenSpec change.
 
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
 **Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
@@ -26,6 +28,7 @@ Implement tasks from an OpenSpec change.
    ```
    Parse the JSON to understand:
    - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
    - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
 
 3. **Get apply instructions**
diff --git a/.claude/commands/opsx/archive.md b/.claude/commands/opsx/archive.md
index 5e916083a..c89523193 100644
--- a/.claude/commands/opsx/archive.md
+++ b/.claude/commands/opsx/archive.md
@@ -7,6 +7,8 @@ tags: [workflow, archive, experimental]
 
 Archive a completed change in the experimental workflow.
 
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
 **Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
@@ -26,6 +28,7 @@ Archive a completed change in the experimental workflow.
 
    Parse the JSON to understand:
    - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
    - `artifacts`: List of artifacts with their status (`done` or other)
 
    **If any artifacts are not `done`:**
@@ -48,7 +51,7 @@ Archive a completed change in the experimental workflow.
 
 4. **Assess delta spec sync state**
 
-   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
 
    **If delta specs exist:**
    - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
@@ -63,19 +66,19 @@ Archive a completed change in the experimental workflow.
 
 5. **Perform the archive**
 
-   Create the archive directory if it doesn't exist:
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
    ```bash
-   mkdir -p openspec/changes/archive
+   mkdir -p "<planningHome.changesDir>/archive"
    ```
 
    Generate target name using current date: `YYYY-MM-DD-<change-name>`
 
    **Check if target already exists:**
    - If yes: Fail with error, suggest renaming existing archive or using different date
-   - If no: Move the change directory to archive
+   - If no: Move `changeRoot` to the archive directory
 
    ```bash
-   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
    ```
 
 6. **Display summary**
@@ -94,7 +97,7 @@ Archive a completed change in the experimental workflow.
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
 **Specs:** ✓ Synced to main specs
 
 All artifacts complete. All tasks complete.
@@ -107,7 +110,7 @@ All artifacts complete. All tasks complete.
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
 **Specs:** No delta specs
 
 All artifacts complete. All tasks complete.
@@ -120,7 +123,7 @@ All artifacts complete. All tasks complete.
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
 **Specs:** Sync skipped (user chose to skip)
 
 **Warnings:**
@@ -137,7 +140,7 @@ Review the archive if this was not intentional.
 ## Archive Failed
 
 **Change:** <change-name>
-**Target:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Target:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
 
 Target archive directory already exists.
 
diff --git a/.claude/commands/opsx/explore.md b/.claude/commands/opsx/explore.md
index 1757907e5..95bd0c8c2 100644
--- a/.claude/commands/opsx/explore.md
+++ b/.claude/commands/opsx/explore.md
@@ -11,6 +11,8 @@ Enter explore mode. Think deeply. Visualize freely. Follow the conversation wher
 
 **This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
 
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
 **Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
 - A vague idea: "real-time collaboration"
 - A specific problem: "the auth system is getting unwieldy"
@@ -107,11 +109,10 @@ Think freely. When insights crystallize, you might offer:
 
 If the user mentions a change or you detect one is relevant:
 
-1. **Read existing artifacts for context**
-   - `openspec/changes/<name>/proposal.md`
-   - `openspec/changes/<name>/design.md`
-   - `openspec/changes/<name>/tasks.md`
-   - etc.
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
 
 2. **Reference them naturally in conversation**
    - "Your design mentions using Redis, but we just realized SQLite fits better..."
diff --git a/.claude/commands/opsx/propose.md b/.claude/commands/opsx/propose.md
index 05276f4d0..48152de71 100644
--- a/.claude/commands/opsx/propose.md
+++ b/.claude/commands/opsx/propose.md
@@ -16,6 +16,8 @@ When ready to implement, run /opsx:apply
 
 ---
 
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
 **Input**: The argument after `/opsx:propose` is the change name (kebab-case), OR a description of what the user wants to build.
 
 **Steps**
@@ -33,7 +35,7 @@ When ready to implement, run /opsx:apply
    ```bash
    openspec new change "<name>"
    ```
-   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
+   This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
 
 3. **Get the artifact build order**
    ```bash
@@ -42,6 +44,7 @@ When ready to implement, run /opsx:apply
    Parse the JSON to get:
    - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
    - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
 4. **Create artifacts in sequence until apply-ready**
 
@@ -59,10 +62,10 @@ When ready to implement, run /opsx:apply
         - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
         - `template`: The structure to use for your output file
         - `instruction`: Schema-specific guidance for this artifact type
-        - `outputPath`: Where to write the artifact
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
         - `dependencies`: Completed artifacts to read for context
       - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
       - Apply `context` and `rules` as constraints - but do NOT copy them into the file
       - Show brief progress: "Created <artifact-id>"
 
diff --git a/.claude/commands/opsx/sync.md b/.claude/commands/opsx/sync.md
new file mode 100644
index 000000000..277330cb7
--- /dev/null
+++ b/.claude/commands/opsx/sync.md
@@ -0,0 +1,143 @@
+---
+name: "OPSX: Sync"
+description: Sync delta specs from a change to main specs
+category: Workflow
+tags: [workflow, specs, experimental]
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:sync` (e.g., `/opsx:sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.claude/skills/openspec-apply-change/SKILL.md b/.claude/skills/openspec-apply-change/SKILL.md
index 70fbdb856..05737929d 100644
--- a/.claude/skills/openspec-apply-change/SKILL.md
+++ b/.claude/skills/openspec-apply-change/SKILL.md
@@ -6,11 +6,13 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.3.1"
+  generatedBy: "1.5.0"
 ---
 
 Implement tasks from an OpenSpec change.
 
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
@@ -30,6 +32,7 @@ Implement tasks from an OpenSpec change.
    ```
    Parse the JSON to understand:
    - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
    - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
 
 3. **Get apply instructions**
diff --git a/.claude/skills/openspec-archive-change/SKILL.md b/.claude/skills/openspec-archive-change/SKILL.md
index 12e2f70e9..bb6a8cf55 100644
--- a/.claude/skills/openspec-archive-change/SKILL.md
+++ b/.claude/skills/openspec-archive-change/SKILL.md
@@ -6,11 +6,13 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.3.1"
+  generatedBy: "1.5.0"
 ---
 
 Archive a completed change in the experimental workflow.
 
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
 **Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
 
 **Steps**
@@ -30,6 +32,7 @@ Archive a completed change in the experimental workflow.
 
    Parse the JSON to understand:
    - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
    - `artifacts`: List of artifacts with their status (`done` or other)
 
    **If any artifacts are not `done`:**
@@ -52,7 +55,7 @@ Archive a completed change in the experimental workflow.
 
 4. **Assess delta spec sync state**
 
-   Check for delta specs at `openspec/changes/<name>/specs/`. If none exist, proceed without sync prompt.
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
 
    **If delta specs exist:**
    - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
@@ -67,19 +70,19 @@ Archive a completed change in the experimental workflow.
 
 5. **Perform the archive**
 
-   Create the archive directory if it doesn't exist:
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
    ```bash
-   mkdir -p openspec/changes/archive
+   mkdir -p "<planningHome.changesDir>/archive"
    ```
 
    Generate target name using current date: `YYYY-MM-DD-<change-name>`
 
    **Check if target already exists:**
    - If yes: Fail with error, suggest renaming existing archive or using different date
-   - If no: Move the change directory to archive
+   - If no: Move `changeRoot` to the archive directory
 
    ```bash
-   mv openspec/changes/<name> openspec/changes/archive/YYYY-MM-DD-<name>
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
    ```
 
 6. **Display summary**
@@ -98,7 +101,7 @@ Archive a completed change in the experimental workflow.
 
 **Change:** <change-name>
 **Schema:** <schema-name>
-**Archived to:** openspec/changes/archive/YYYY-MM-DD-<name>/
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
 **Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
 
 All artifacts complete. All tasks complete.
diff --git a/.claude/skills/openspec-explore/SKILL.md b/.claude/skills/openspec-explore/SKILL.md
index 6858d3f69..756b31c0b 100644
--- a/.claude/skills/openspec-explore/SKILL.md
+++ b/.claude/skills/openspec-explore/SKILL.md
@@ -6,7 +6,7 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.3.1"
+  generatedBy: "1.5.0"
 ---
 
 Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
@@ -15,6 +15,8 @@ Enter explore mode. Think deeply. Visualize freely. Follow the conversation wher
 
 **This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
 
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
 ---
 
 ## The Stance
@@ -102,11 +104,10 @@ Think freely. When insights crystallize, you might offer:
 
 If the user mentions a change or you detect one is relevant:
 
-1. **Read existing artifacts for context**
-   - `openspec/changes/<name>/proposal.md`
-   - `openspec/changes/<name>/design.md`
-   - `openspec/changes/<name>/tasks.md`
-   - etc.
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
 
 2. **Reference them naturally in conversation**
    - "Your design mentions using Redis, but we just realized SQLite fits better..."
diff --git a/.claude/skills/openspec-propose/SKILL.md b/.claude/skills/openspec-propose/SKILL.md
index 4b7e20418..0208e030e 100644
--- a/.claude/skills/openspec-propose/SKILL.md
+++ b/.claude/skills/openspec-propose/SKILL.md
@@ -6,7 +6,7 @@ compatibility: Requires openspec CLI.
 metadata:
   author: openspec
   version: "1.0"
-  generatedBy: "1.3.1"
+  generatedBy: "1.5.0"
 ---
 
 Propose a new change - create the change and generate all artifacts in one step.
@@ -20,6 +20,8 @@ When ready to implement, run /opsx:apply
 
 ---
 
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
 **Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
 
 **Steps**
@@ -37,7 +39,7 @@ When ready to implement, run /opsx:apply
    ```bash
    openspec new change "<name>"
    ```
-   This creates a scaffolded change at `openspec/changes/<name>/` with `.openspec.yaml`.
+   This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
 
 3. **Get the artifact build order**
    ```bash
@@ -46,6 +48,7 @@ When ready to implement, run /opsx:apply
    Parse the JSON to get:
    - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
    - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
 
 4. **Create artifacts in sequence until apply-ready**
 
@@ -63,10 +66,10 @@ When ready to implement, run /opsx:apply
         - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
         - `template`: The structure to use for your output file
         - `instruction`: Schema-specific guidance for this artifact type
-        - `outputPath`: Where to write the artifact
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
         - `dependencies`: Completed artifacts to read for context
       - Read any completed dependency files for context
-      - Create the artifact file using `template` as the structure
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
       - Apply `context` and `rules` as constraints - but do NOT copy them into the file
       - Show brief progress: "Created <artifact-id>"
 
diff --git a/.claude/skills/openspec-sync-specs/SKILL.md b/.claude/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 000000000..f4ec05469
--- /dev/null
+++ b/.claude/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,147 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.5.0"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.gemini/commands/opsx/apply.toml b/.gemini/commands/opsx/apply.toml
new file mode 100644
index 000000000..5888fb01e
--- /dev/null
+++ b/.gemini/commands/opsx/apply.toml
@@ -0,0 +1,152 @@
+description = "Implement tasks from an OpenSpec change (Experimental)"
+
+prompt = """
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name (e.g., `/opsx:apply add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using `/opsx:continue`
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! You can archive this change with `/opsx:archive`.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
+"""
diff --git a/.gemini/commands/opsx/archive.toml b/.gemini/commands/opsx/archive.toml
new file mode 100644
index 000000000..078959324
--- /dev/null
+++ b/.gemini/commands/opsx/archive.toml
@@ -0,0 +1,157 @@
+description = "Archive a completed change in the experimental workflow"
+
+prompt = """
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:archive` (e.g., `/opsx:archive add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Prompt user for confirmation to continue
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Spec sync status (synced / sync skipped / no delta specs)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success (No Delta Specs)**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** No delta specs
+
+All artifacts complete. All tasks complete.
+```
+
+**Output On Success With Warnings**
+
+```
+## Archive Complete (with warnings)
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** Sync skipped (user chose to skip)
+
+**Warnings:**
+- Archived with 2 incomplete artifacts
+- Archived with 3 incomplete tasks
+- Delta spec sync was skipped (user chose to skip)
+
+Review the archive if this was not intentional.
+```
+
+**Output On Error (Archive Exists)**
+
+```
+## Archive Failed
+
+**Change:** <change-name>
+**Target:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+
+Target archive directory already exists.
+
+**Options:**
+1. Rename the existing archive
+2. Delete the existing archive if it's a duplicate
+3. Wait until a different date to archive
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use the Skill tool to invoke `openspec-sync-specs` (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
+"""
diff --git a/.gemini/commands/opsx/explore.toml b/.gemini/commands/opsx/explore.toml
new file mode 100644
index 000000000..550cc136c
--- /dev/null
+++ b/.gemini/commands/opsx/explore.toml
@@ -0,0 +1,171 @@
+description = "Enter explore mode - think through ideas, investigate problems, clarify requirements"
+
+prompt = """
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx:explore` is whatever the user wants to think about. Could be:
+- A vague idea: "real-time collaboration"
+- A specific problem: "the auth system is getting unwieldy"
+- A change name: "add-dark-mode" (to explore in context of that change)
+- A comparison: "postgres vs sqlite for this"
+- Nothing (just enter explore mode)
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+If the user mentioned a specific change name, read its artifacts for context.
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When things crystallize, you might offer a summary - but it's optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
+"""
diff --git a/.gemini/commands/opsx/propose.toml b/.gemini/commands/opsx/propose.toml
new file mode 100644
index 000000000..eb644c869
--- /dev/null
+++ b/.gemini/commands/opsx/propose.toml
@@ -0,0 +1,106 @@
+description = "Propose a new change - create it and generate all artifacts in one step"
+
+prompt = """
+Propose a new change - create the change and generate all artifacts in one step.
+
+I'll create a change with artifacts:
+- proposal.md (what & why)
+- design.md (how)
+- tasks.md (implementation steps)
+
+When ready to implement, run /opsx:apply
+
+---
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The argument after `/opsx:propose` is the change name (kebab-case), OR a description of what the user wants to build.
+
+**Steps**
+
+1. **If no input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` to start implementing."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
+"""
diff --git a/.gemini/commands/opsx/sync.toml b/.gemini/commands/opsx/sync.toml
new file mode 100644
index 000000000..e180e2239
--- /dev/null
+++ b/.gemini/commands/opsx/sync.toml
@@ -0,0 +1,140 @@
+description = "Sync delta specs from a change to main specs"
+
+prompt = """
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name after `/opsx:sync` (e.g., `/opsx:sync add-auth`). If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
+"""
diff --git a/.gemini/skills/openspec-apply-change/SKILL.md b/.gemini/skills/openspec-apply-change/SKILL.md
new file mode 100644
index 000000000..05737929d
--- /dev/null
+++ b/.gemini/skills/openspec-apply-change/SKILL.md
@@ -0,0 +1,159 @@
+---
+name: openspec-apply-change
+description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.5.0"
+---
+
+Implement tasks from an OpenSpec change.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **Select the change**
+
+   If a name is provided, use it. Otherwise:
+   - Infer from conversation context if the user mentioned a change
+   - Auto-select if only one active change exists
+   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select
+
+   Always announce: "Using change: <name>" and how to override (e.g., `/opsx:apply <other>`).
+
+2. **Check status to understand the schema**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used (e.g., "spec-driven")
+   - `planningHome`, `changeRoot`, and `actionContext`: planning scope and edit constraints
+   - Which artifact contains the tasks (typically "tasks" for spec-driven, check status for others)
+
+3. **Get apply instructions**
+
+   ```bash
+   openspec instructions apply --change "<name>" --json
+   ```
+
+   This returns:
+   - `contextFiles`: artifact ID -> array of concrete file paths (varies by schema - could be proposal/specs/design/tasks or spec/tests/implementation/docs)
+   - Progress (total, complete, remaining)
+   - Task list with status
+   - Dynamic instruction based on current state
+
+   **Handle states:**
+   - If `state: "blocked"` (missing artifacts): show message, suggest using openspec-continue-change
+   - If `state: "all_done"`: congratulate, suggest archive
+   - Otherwise: proceed to implementation
+
+4. **Read context files**
+
+   Read every file path listed under `contextFiles` from the apply instructions output.
+   The files depend on the schema being used:
+   - **spec-driven**: proposal, specs, design, tasks
+   - Other schemas: follow the contextFiles from CLI output
+
+5. **Show current progress**
+
+   Display:
+   - Schema being used
+   - Progress: "N/M tasks complete"
+   - Remaining tasks overview
+   - Dynamic instruction from CLI
+
+6. **Implement tasks (loop until done or blocked)**
+
+   For each pending task:
+   - Show which task is being worked on
+   - Make the code changes required
+   - Keep changes minimal and focused
+   - Mark task complete in the tasks file: `- [ ]` → `- [x]`
+   - Continue to next task
+
+   **Pause if:**
+   - Task is unclear → ask for clarification
+   - Implementation reveals a design issue → suggest updating artifacts
+   - Error or blocker encountered → report and wait for guidance
+   - User interrupts
+
+7. **On completion or pause, show status**
+
+   Display:
+   - Tasks completed this session
+   - Overall progress: "N/M tasks complete"
+   - If all done: suggest archive
+   - If paused: explain why and wait for guidance
+
+**Output During Implementation**
+
+```
+## Implementing: <change-name> (schema: <schema-name>)
+
+Working on task 3/7: <task description>
+[...implementation happening...]
+✓ Task complete
+
+Working on task 4/7: <task description>
+[...implementation happening...]
+✓ Task complete
+```
+
+**Output On Completion**
+
+```
+## Implementation Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 7/7 tasks complete ✓
+
+### Completed This Session
+- [x] Task 1
+- [x] Task 2
+...
+
+All tasks complete! Ready to archive this change.
+```
+
+**Output On Pause (Issue Encountered)**
+
+```
+## Implementation Paused
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Progress:** 4/7 tasks complete
+
+### Issue Encountered
+<description of the issue>
+
+**Options:**
+1. <option 1>
+2. <option 2>
+3. Other approach
+
+What would you like to do?
+```
+
+**Guardrails**
+- Keep going through tasks until done or blocked
+- Always read context files before starting (from the apply instructions output)
+- If task is ambiguous, pause and ask before implementing
+- If implementation reveals issues, pause and suggest artifact updates
+- Keep code changes minimal and scoped to each task
+- Update task checkbox immediately after completing each task
+- Pause on errors, blockers, or unclear requirements - don't guess
+- Use contextFiles from CLI output, don't assume specific file names
+
+**Fluid Workflow Integration**
+
+This skill supports the "actions on a change" model:
+
+- **Can be invoked anytime**: Before all artifacts are done (if tasks exist), after partial implementation, interleaved with other actions
+- **Allows artifact updates**: If implementation reveals design issues, suggest updating artifacts - not phase-locked, work fluidly
diff --git a/.gemini/skills/openspec-archive-change/SKILL.md b/.gemini/skills/openspec-archive-change/SKILL.md
new file mode 100644
index 000000000..bb6a8cf55
--- /dev/null
+++ b/.gemini/skills/openspec-archive-change/SKILL.md
@@ -0,0 +1,117 @@
+---
+name: openspec-archive-change
+description: Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.5.0"
+---
+
+Archive a completed change in the experimental workflow.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show only active changes (not already archived).
+   Include the schema used for each change if available.
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Check artifact completion status**
+
+   Run `openspec status --change "<name>" --json` to check artifact completion.
+
+   Parse the JSON to understand:
+   - `schemaName`: The workflow being used
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context
+   - `artifacts`: List of artifacts with their status (`done` or other)
+
+   **If any artifacts are not `done`:**
+   - Display warning listing incomplete artifacts
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+3. **Check task completion status**
+
+   Read the tasks file (typically `tasks.md`) to check for incomplete tasks.
+
+   Count tasks marked with `- [ ]` (incomplete) vs `- [x]` (complete).
+
+   **If incomplete tasks found:**
+   - Display warning showing count of incomplete tasks
+   - Use **AskUserQuestion tool** to confirm user wants to proceed
+   - Proceed if user confirms
+
+   **If no tasks file exists:** Proceed without task-related warning.
+
+4. **Assess delta spec sync state**
+
+   Use `artifactPaths.specs.existingOutputPaths` from status JSON to check for delta specs. If none exist, proceed without sync prompt.
+
+   **If delta specs exist:**
+   - Compare each delta spec with its corresponding main spec at `openspec/specs/<capability>/spec.md`
+   - Determine what changes would be applied (adds, modifications, removals, renames)
+   - Show a combined summary before prompting
+
+   **Prompt options:**
+   - If changes needed: "Sync now (recommended)", "Archive without syncing"
+   - If already synced: "Archive now", "Sync anyway", "Cancel"
+
+   If user chooses sync, use Task tool (subagent_type: "general-purpose", prompt: "Use Skill tool to invoke openspec-sync-specs for change '<name>'. Delta spec analysis: <include the analyzed delta spec summary>"). Proceed to archive regardless of choice.
+
+5. **Perform the archive**
+
+   Create an `archive` directory under `planningHome.changesDir` if it doesn't exist:
+   ```bash
+   mkdir -p "<planningHome.changesDir>/archive"
+   ```
+
+   Generate target name using current date: `YYYY-MM-DD-<change-name>`
+
+   **Check if target already exists:**
+   - If yes: Fail with error, suggest renaming existing archive or using different date
+   - If no: Move `changeRoot` to the archive directory
+
+   ```bash
+   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"
+   ```
+
+6. **Display summary**
+
+   Show archive completion summary including:
+   - Change name
+   - Schema that was used
+   - Archive location
+   - Whether specs were synced (if applicable)
+   - Note about any warnings (incomplete artifacts/tasks)
+
+**Output On Success**
+
+```
+## Archive Complete
+
+**Change:** <change-name>
+**Schema:** <schema-name>
+**Archived to:** the archive path derived from `planningHome.changesDir`/YYYY-MM-DD-<name>/
+**Specs:** ✓ Synced to main specs (or "No delta specs" or "Sync skipped")
+
+All artifacts complete. All tasks complete.
+```
+
+**Guardrails**
+- Always prompt for change selection if not provided
+- Use artifact graph (openspec status --json) for completion checking
+- Don't block archive on warnings - just inform and confirm
+- Preserve .openspec.yaml when moving to archive (it moves with the directory)
+- Show clear summary of what happened
+- If sync is requested, use openspec-sync-specs approach (agent-driven)
+- If delta specs exist, always run the sync assessment and show the combined summary before prompting
diff --git a/.gemini/skills/openspec-explore/SKILL.md b/.gemini/skills/openspec-explore/SKILL.md
new file mode 100644
index 000000000..756b31c0b
--- /dev/null
+++ b/.gemini/skills/openspec-explore/SKILL.md
@@ -0,0 +1,289 @@
+---
+name: openspec-explore
+description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.5.0"
+---
+
+Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.
+
+**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features. If the user asks you to implement something, remind them to exit explore mode first and create a change proposal. You MAY create OpenSpec artifacts (proposals, designs, specs) if the user asks—that's capturing thinking, not implementing.
+
+**This is a stance, not a workflow.** There are no fixed steps, no required sequence, no mandatory outputs. You're a thinking partner helping the user explore.
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+---
+
+## The Stance
+
+- **Curious, not prescriptive** - Ask questions that emerge naturally, don't follow a script
+- **Open threads, not interrogations** - Surface multiple interesting directions and let the user follow what resonates. Don't funnel them through a single path of questions.
+- **Visual** - Use ASCII diagrams liberally when they'd help clarify thinking
+- **Adaptive** - Follow interesting threads, pivot when new information emerges
+- **Patient** - Don't rush to conclusions, let the shape of the problem emerge
+- **Grounded** - Explore the actual codebase when relevant, don't just theorize
+
+---
+
+## What You Might Do
+
+Depending on what the user brings, you might:
+
+**Explore the problem space**
+- Ask clarifying questions that emerge from what they said
+- Challenge assumptions
+- Reframe the problem
+- Find analogies
+
+**Investigate the codebase**
+- Map existing architecture relevant to the discussion
+- Find integration points
+- Identify patterns already in use
+- Surface hidden complexity
+
+**Compare options**
+- Brainstorm multiple approaches
+- Build comparison tables
+- Sketch tradeoffs
+- Recommend a path (if asked)
+
+**Visualize**
+```
+┌─────────────────────────────────────────┐
+│     Use ASCII diagrams liberally        │
+├─────────────────────────────────────────┤
+│                                         │
+│      ┌────────┐         ┌────────┐      │
+│      │ State  │────────▶│ State  │      │
+│      │   A    │         │   B    │      │
+│      └────────┘         └────────┘      │
+│                                         │
+│   System diagrams, state machines,      │
+│   data flows, architecture sketches,    │
+│   dependency graphs, comparison tables  │
+│                                         │
+└─────────────────────────────────────────┘
+```
+
+**Surface risks and unknowns**
+- Identify what could go wrong
+- Find gaps in understanding
+- Suggest spikes or investigations
+
+---
+
+## OpenSpec Awareness
+
+You have full context of the OpenSpec system. Use it naturally, don't force it.
+
+### Check for context
+
+At the start, quickly check what exists:
+```bash
+openspec list --json
+```
+
+This tells you:
+- If there are active changes
+- Their names, schemas, and status
+- What the user might be working on
+
+### When no change exists
+
+Think freely. When insights crystallize, you might offer:
+
+- "This feels solid enough to start a change. Want me to create a proposal?"
+- Or keep exploring - no pressure to formalize
+
+### When a change exists
+
+If the user mentions a change or you detect one is relevant:
+
+1. **Resolve and read existing artifacts for context**
+   - Run `openspec status --change "<name>" --json`.
+   - Use `changeRoot`, `artifactPaths`, and `actionContext` from the status JSON.
+   - Read existing files from `artifactPaths.<artifact>.existingOutputPaths`.
+
+2. **Reference them naturally in conversation**
+   - "Your design mentions using Redis, but we just realized SQLite fits better..."
+   - "The proposal scopes this to premium users, but we're now thinking everyone..."
+
+3. **Offer to capture when decisions are made**
+
+    | Insight Type               | Where to Capture               |
+    |----------------------------|--------------------------------|
+    | New requirement discovered | `specs/<capability>/spec.md` |
+    | Requirement changed        | `specs/<capability>/spec.md` |
+    | Design decision made       | `design.md`                  |
+    | Scope changed              | `proposal.md`                |
+    | New work identified        | `tasks.md`                   |
+    | Assumption invalidated     | Relevant artifact              |
+
+   Example offers:
+   - "That's a design decision. Capture it in design.md?"
+   - "This is a new requirement. Add it to specs?"
+   - "This changes scope. Update the proposal?"
+
+4. **The user decides** - Offer and move on. Don't pressure. Don't auto-capture.
+
+---
+
+## What You Don't Have To Do
+
+- Follow a script
+- Ask the same questions every time
+- Produce a specific artifact
+- Reach a conclusion
+- Stay on topic if a tangent is valuable
+- Be brief (this is thinking time)
+
+---
+
+## Handling Different Entry Points
+
+**User brings a vague idea:**
+```
+User: I'm thinking about adding real-time collaboration
+
+You: Real-time collab is a big space. Let me think about this...
+
+      COLLABORATION SPECTRUM
+      ════════════════════════════════════════════
+
+      Awareness          Coordination         Sync
+          │                   │                 │
+          ▼                   ▼                 ▼
+      ┌────────┐         ┌────────┐        ┌────────┐
+      │Presence│         │Cursors │        │  CRDT  │
+      │  "3    │         │ Multi  │        │Conflict│
+      │online" │         │ select │        │  free  │
+      └────────┘         └────────┘        └────────┘
+          │                   │                 │
+       trivial            moderate           complex
+
+      Where's your head at?
+```
+
+**User brings a specific problem:**
+```
+User: The auth system is a mess
+
+You: [reads codebase]
+
+     ┌─────────────────────────────────────────────┐
+     │              CURRENT AUTH FLOW              │
+     └─────────────────────────────────────────────┘
+                        │
+          ┌─────────────┼─────────────┐
+          ▼             ▼             ▼
+     ┌─────────┐  ┌─────────┐  ┌─────────┐
+     │ Google  │  │  GitHub │  │  Email  │
+     │  OAuth  │  │  OAuth  │  │  Magic  │
+     └────┬────┘  └────┬────┘  └────┬────┘
+          │             │             │
+          └─────────────┼─────────────┘
+                        ▼
+                  ┌───────────┐
+                  │  Session  │
+                  └─────┬─────┘
+                        │
+                        ▼
+                  ┌───────────┐
+                  │   Perms   │
+                  └───────────┘
+
+     I see three tangles. Which one's burning?
+```
+
+**User is stuck mid-implementation:**
+```
+User: /opsx:explore add-auth-system
+      The OAuth integration is more complex than expected
+
+You: [reads change artifacts]
+
+     You're on task 4: "Implement OAuth flow"
+
+     Let me trace what's involved...
+
+     [draws diagram, explores options, suggests paths]
+
+     Want to update the design to reflect this?
+     Or add a spike task to investigate?
+```
+
+**User wants to compare options:**
+```
+User: Should we use Postgres or SQLite?
+
+You: Generic answer is boring. What's the context?
+
+User: A CLI tool that tracks local dev environments
+
+You: That changes everything.
+
+     ┌─────────────────────────────────────────────────┐
+     │          CLI TOOL DATA STORAGE                  │
+     └─────────────────────────────────────────────────┘
+
+     Key constraints:
+     • No daemon running
+     • Must work offline
+     • Single user
+
+                  SQLite          Postgres
+     Deployment   embedded ✓      needs server ✗
+     Offline      yes ✓           no ✗
+     Single file  yes ✓           no ✗
+
+     SQLite. Not even close.
+
+     Unless... is there a sync component?
+```
+
+---
+
+## Ending Discovery
+
+There's no required ending. Discovery might:
+
+- **Flow into a proposal**: "Ready to start? I can create a change proposal."
+- **Result in artifact updates**: "Updated design.md with these decisions"
+- **Just provide clarity**: User has what they need, moves on
+- **Continue later**: "We can pick this up anytime"
+
+When it feels like things are crystallizing, you might summarize:
+
+```
+## What We Figured Out
+
+**The problem**: [crystallized understanding]
+
+**The approach**: [if one emerged]
+
+**Open questions**: [if any remain]
+
+**Next steps** (if ready):
+- Create a change proposal
+- Keep exploring: just keep talking
+```
+
+But this summary is optional. Sometimes the thinking IS the value.
+
+---
+
+## Guardrails
+
+- **Don't implement** - Never write code or implement features. Creating OpenSpec artifacts is fine, writing application code is not.
+- **Don't fake understanding** - If something is unclear, dig deeper
+- **Don't rush** - Discovery is thinking time, not task time
+- **Don't force structure** - Let patterns emerge naturally
+- **Don't auto-capture** - Offer to save insights, don't just do it
+- **Do visualize** - A good diagram is worth many paragraphs
+- **Do explore the codebase** - Ground discussions in reality
+- **Do question assumptions** - Including the user's and your own
diff --git a/.gemini/skills/openspec-propose/SKILL.md b/.gemini/skills/openspec-propose/SKILL.md
new file mode 100644
index 000000000..0208e030e
--- /dev/null
+++ b/.gemini/skills/openspec-propose/SKILL.md
@@ -0,0 +1,113 @@
+---
+name: openspec-propose
+description: Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.5.0"
+---
+
+Propose a new change - create the change and generate all artifacts in one step.
+
+I'll create a change with artifacts:
+- proposal.md (what & why)
+- design.md (how)
+- tasks.md (implementation steps)
+
+When ready to implement, run /opsx:apply
+
+---
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: The user's request should include a change name (kebab-case) OR a description of what they want to build.
+
+**Steps**
+
+1. **If no clear input provided, ask what they want to build**
+
+   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:
+   > "What change do you want to work on? Describe what you want to build or fix."
+
+   From their description, derive a kebab-case name (e.g., "add user authentication" → `add-user-auth`).
+
+   **IMPORTANT**: Do NOT proceed without understanding what the user wants to build.
+
+2. **Create the change directory**
+   ```bash
+   openspec new change "<name>"
+   ```
+   This creates a scaffolded change in the planning home resolved by the CLI with `.openspec.yaml`.
+
+3. **Get the artifact build order**
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+   Parse the JSON to get:
+   - `applyRequires`: array of artifact IDs needed before implementation (e.g., `["tasks"]`)
+   - `artifacts`: list of all artifacts with their status and dependencies
+   - `planningHome`, `changeRoot`, `artifactPaths`, and `actionContext`: path and scope context. Use these instead of assuming repo-local paths.
+
+4. **Create artifacts in sequence until apply-ready**
+
+   Use the **TodoWrite tool** to track progress through the artifacts.
+
+   Loop through artifacts in dependency order (artifacts with no pending dependencies first):
+
+   a. **For each artifact that is `ready` (dependencies satisfied)**:
+      - Get instructions:
+        ```bash
+        openspec instructions <artifact-id> --change "<name>" --json
+        ```
+      - The instructions JSON includes:
+        - `context`: Project background (constraints for you - do NOT include in output)
+        - `rules`: Artifact-specific rules (constraints for you - do NOT include in output)
+        - `template`: The structure to use for your output file
+        - `instruction`: Schema-specific guidance for this artifact type
+        - `resolvedOutputPath`: Resolved path or pattern to write the artifact
+        - `dependencies`: Completed artifacts to read for context
+      - Read any completed dependency files for context
+      - Create the artifact file using `template` as the structure and write it to `resolvedOutputPath`
+      - Apply `context` and `rules` as constraints - but do NOT copy them into the file
+      - Show brief progress: "Created <artifact-id>"
+
+   b. **Continue until all `applyRequires` artifacts are complete**
+      - After creating each artifact, re-run `openspec status --change "<name>" --json`
+      - Check if every artifact ID in `applyRequires` has `status: "done"` in the artifacts array
+      - Stop when all `applyRequires` artifacts are done
+
+   c. **If an artifact requires user input** (unclear context):
+      - Use **AskUserQuestion tool** to clarify
+      - Then continue with creation
+
+5. **Show final status**
+   ```bash
+   openspec status --change "<name>"
+   ```
+
+**Output**
+
+After completing all artifacts, summarize:
+- Change name and location
+- List of artifacts created with brief descriptions
+- What's ready: "All artifacts created! Ready for implementation."
+- Prompt: "Run `/opsx:apply` or ask me to implement to start working on the tasks."
+
+**Artifact Creation Guidelines**
+
+- Follow the `instruction` field from `openspec instructions` for each artifact type
+- The schema defines what each artifact should contain - follow it
+- Read dependency artifacts for context before creating new ones
+- Use `template` as the structure for your output file - fill in its sections
+- **IMPORTANT**: `context` and `rules` are constraints for YOU, not content for the file
+  - Do NOT copy `<context>`, `<rules>`, `<project_context>` blocks into the artifact
+  - These guide what you write, but should never appear in the output
+
+**Guardrails**
+- Create ALL artifacts needed for implementation (as defined by schema's `apply.requires`)
+- Always read dependency artifacts before creating a new one
+- If context is critically unclear, ask the user - but prefer making reasonable decisions to keep momentum
+- If a change with that name already exists, ask if user wants to continue it or create a new one
+- Verify each artifact file exists after writing before proceeding to next
diff --git a/.gemini/skills/openspec-sync-specs/SKILL.md b/.gemini/skills/openspec-sync-specs/SKILL.md
new file mode 100644
index 000000000..f4ec05469
--- /dev/null
+++ b/.gemini/skills/openspec-sync-specs/SKILL.md
@@ -0,0 +1,147 @@
+---
+name: openspec-sync-specs
+description: Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.
+license: MIT
+compatibility: Requires openspec CLI.
+metadata:
+  author: openspec
+  version: "1.0"
+  generatedBy: "1.5.0"
+---
+
+Sync delta specs from a change to main specs.
+
+This is an **agent-driven** operation - you will read delta specs and directly edit main specs to apply the changes. This allows intelligent merging (e.g., adding a scenario without copying the entire requirement).
+
+**Store selection:** If the user names a store (a store is a standalone OpenSpec repo registered on this machine) or the work lives in one, run `openspec store list --json` to discover registered store ids, then pass `--store <id>` on the commands that read or write specs and changes (`new change`, `status`, `instructions`, `list`, `show`, `validate`, `archive`, `doctor`, `context`). Other commands do not take the flag. Hints printed by commands already carry the flag; keep it on follow-ups. Without a store, commands act on the nearest local `openspec/` root.
+
+**Input**: Optionally specify a change name. If omitted, check if it can be inferred from conversation context. If vague or ambiguous you MUST prompt for available changes.
+
+**Steps**
+
+1. **If no change name provided, prompt for selection**
+
+   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.
+
+   Show changes that have delta specs (under `specs/` directory).
+
+   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.
+
+2. **Resolve change context**
+
+   Run:
+   ```bash
+   openspec status --change "<name>" --json
+   ```
+
+3. **Find delta specs**
+
+   Use `artifactPaths.specs.existingOutputPaths` from the status JSON as the list of delta spec files.
+
+   Each delta spec file contains sections like:
+   - `## ADDED Requirements` - New requirements to add
+   - `## MODIFIED Requirements` - Changes to existing requirements
+   - `## REMOVED Requirements` - Requirements to remove
+   - `## RENAMED Requirements` - Requirements to rename (FROM:/TO: format)
+
+   If no delta specs found, inform user and stop.
+
+4. **For each delta spec, apply changes to main specs**
+
+   For each repo-local capability delta spec path returned by the CLI:
+
+   a. **Read the delta spec** to understand the intended changes
+
+   b. **Read the main spec** at `openspec/specs/<capability>/spec.md` (may not exist yet)
+
+   c. **Apply changes intelligently**:
+
+      **ADDED Requirements:**
+      - If requirement doesn't exist in main spec → add it
+      - If requirement already exists → update it to match (treat as implicit MODIFIED)
+
+      **MODIFIED Requirements:**
+      - Find the requirement in main spec
+      - Apply the changes - this can be:
+        - Adding new scenarios (don't need to copy existing ones)
+        - Modifying existing scenarios
+        - Changing the requirement description
+      - Preserve scenarios/content not mentioned in the delta
+
+      **REMOVED Requirements:**
+      - Remove the entire requirement block from main spec
+
+      **RENAMED Requirements:**
+      - Find the FROM requirement, rename to TO
+
+   d. **Create new main spec** if capability doesn't exist yet:
+      - Create `openspec/specs/<capability>/spec.md`
+      - Add Purpose section (can be brief, mark as TBD)
+      - Add Requirements section with the ADDED requirements
+
+5. **Show summary**
+
+   After applying all changes, summarize:
+   - Which capabilities were updated
+   - What changes were made (requirements added/modified/removed/renamed)
+
+**Delta Spec Format Reference**
+
+```markdown
+## ADDED Requirements
+
+### Requirement: New Feature
+The system SHALL do something new.
+
+#### Scenario: Basic case
+- **WHEN** user does X
+- **THEN** system does Y
+
+## MODIFIED Requirements
+
+### Requirement: Existing Feature
+#### Scenario: New scenario to add
+- **WHEN** user does A
+- **THEN** system does B
+
+## REMOVED Requirements
+
+### Requirement: Deprecated Feature
+
+## RENAMED Requirements
+
+- FROM: `### Requirement: Old Name`
+- TO: `### Requirement: New Name`
+```
+
+**Key Principle: Intelligent Merging**
+
+Unlike programmatic merging, you can apply **partial updates**:
+- To add a scenario, just include that scenario under MODIFIED - don't copy existing scenarios
+- The delta represents *intent*, not a wholesale replacement
+- Use your judgment to merge changes sensibly
+
+**Output On Success**
+
+```
+## Specs Synced: <change-name>
+
+Updated main specs:
+
+**<capability-1>**:
+- Added requirement: "New Feature"
+- Modified requirement: "Existing Feature" (added 1 scenario)
+
+**<capability-2>**:
+- Created new spec file
+- Added requirement: "Another Feature"
+
+Main specs are now updated. The change remains active - archive when implementation is complete.
+```
+
+**Guardrails**
+- Read both delta and main specs before making changes
+- Preserve existing content not mentioned in delta
+- If something is unclear, ask for clarification
+- Show what you're changing as you go
+- The operation should be idempotent - running twice should give same result
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2952486ad..b9d08ef6c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,7 +23,7 @@ jobs:
       uses: actions/setup-java@v3
       with:
         distribution: 'temurin'
-        java-version: '17'
+        java-version: '25'
 
     - name: Compute PR SNAPSHOT version
       if: github.event_name == 'pull_request'
diff --git a/.github/workflows/cve-scanning-gradle.yml b/.github/workflows/cve-scanning-gradle.yml
index 42cf4e14c..ac8cfb7a1 100644
--- a/.github/workflows/cve-scanning-gradle.yml
+++ b/.github/workflows/cve-scanning-gradle.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Set up JDK 17
         uses: actions/setup-java@v4
         with:
-          java-version: '17'
+          java-version: '25'
           distribution: 'temurin'
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v3
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 2df2a17e2..3f37194df 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -6,6 +6,7 @@ on:
       - "main"
     paths:
       - "docs/**"
+  workflow_dispatch: { }
 
 permissions:
   contents: read
@@ -15,30 +16,71 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: docs
     steps:
-      - name: Checkout
+      - name: Checkout main (4.x docs)
         uses: actions/checkout@v4
+        with:
+          path: main
+
+      - name: Checkout 3.x branch (3.x docs), if it exists
+        id: checkout_3x
+        continue-on-error: true
+        uses: actions/checkout@v4
+        with:
+          ref: 3.x
+          path: 3.x-src
+
       - name: Setup Ruby
         uses: ruby/setup-ruby@ec02537da5712d66d4d50a0f33b7eb52773b5ed1
         with:
           ruby-version: '3.1'
           bundler-cache: true
           cache-version: 0
-          working-directory: '${{ github.workspace }}/docs'
+          working-directory: 'main/docs'
+
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@v4
-      - name: Build with Jekyll
+
+      # Published at the site root: symphony-bdk-java.finos.org/
+      - name: Build 4.x docs with Jekyll
+        working-directory: main/docs
         run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
         env:
           JEKYLL_ENV: production
+
+      # Published under /3.x/: symphony-bdk-java.finos.org/3.x/ — 3.x consumers must never land on 4.x
+      # instructions, so this is a distinct subtree built from the 3.x branch's own docs/, not a copy.
+      - name: Setup Ruby for 3.x docs
+        if: steps.checkout_3x.outcome == 'success'
+        uses: ruby/setup-ruby@ec02537da5712d66d4d50a0f33b7eb52773b5ed1
+        with:
+          ruby-version: '3.1'
+          bundler-cache: true
+          cache-version: 0
+          working-directory: '3.x-src/docs'
+
+      - name: Build 3.x docs with Jekyll
+        if: steps.checkout_3x.outcome == 'success'
+        working-directory: 3.x-src/docs
+        run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}/3.x"
+        env:
+          JEKYLL_ENV: production
+
+      - name: Merge 3.x docs into the published tree
+        if: steps.checkout_3x.outcome == 'success'
+        run: |
+          mkdir -p main/docs/_site/3.x
+          cp -r 3.x-src/docs/_site/. main/docs/_site/3.x/
+
+      - name: Warn if 3.x branch is missing
+        if: steps.checkout_3x.outcome != 'success'
+        run: echo "::warning::'3.x' branch not found — publishing 4.x docs only, without a /3.x/ subtree."
+
       - name: Upload artifact
         uses: actions/upload-pages-artifact@v3
         with:
-          path: "docs/_site/"
+          path: "main/docs/_site/"
 
   deploy:
     environment:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 475c6d628..b0b34de91 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,19 +20,31 @@ jobs:
         id: version
         run: |
           TAG="${{ github.event.release.tag_name }}"
-          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Release tag '$TAG' is not in the expected vMAJOR.MINOR.PATCH format (e.g. v3.3.16)"
+          # vMAJOR.MINOR.PATCH with optional SemVer pre-release (-alpha.1) and build metadata (+build.5)
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
+            echo "::error::Release tag '$TAG' is not in the expected vMAJOR.MINOR.PATCH[-prerelease][+build] format (e.g. v3.3.16 or v4.0.0-alpha.1)"
             exit 1
           fi
           VERSION="${TAG#v}"
+          MAJOR="${VERSION%%.*}"
+          TARGET="${{ github.event.release.target_commitish }}"
+          if [[ "$MAJOR" == "3" && "$TARGET" != "3.x" ]]; then
+            echo "::error::Release tag '$TAG' is a v3.x release but targets '$TARGET' instead of the '3.x' branch"
+            exit 1
+          fi
+          # 4.x is developed on 'next' until GA merges it to 'main'; both branches are valid release sources.
+          if [[ "$MAJOR" != "3" && "$TARGET" != "main" && "$TARGET" != "next" ]]; then
+            echo "::error::Release tag '$TAG' is a v${MAJOR}.x release but targets '$TARGET' instead of 'main' or 'next'"
+            exit 1
+          fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "Releasing $VERSION"
+          echo "Releasing $VERSION (target: $TARGET)"
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v3
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '25'
 
       - name: Publish release to Maven Central
         run: |
diff --git a/CLAUDE.md b/CLAUDE.md
index d2faaed9a..4f09453b5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Requirements
 
-The build runs on Gradle 9.x, which requires a JVM of **17 or higher** to run the Gradle daemon itself. Compilation targets Java 17 via the toolchain declared in `bdk.java-common-conventions` — the daemon JVM and the toolchain JVM are independent, so contributors on a newer daemon JDK still produce Java 17 bytecode.
+The build runs on Gradle 9.x, which requires a JVM of **17 or higher** to run the Gradle daemon itself. Compilation targets **Java 25** via the toolchain declared in `bdk.java-common-conventions` — the daemon JVM and the toolchain JVM are independent, but contributors still need a JDK 25 available for Gradle to provision or locate as the toolchain (it does not need to be the daemon JDK). Java 25 is BDK 4.x's baseline: a hard requirement, not a recommendation — see `docs/migration-4.x.md`.
 
 ## Build & Test Commands
 
@@ -28,8 +28,9 @@ The build runs on Gradle 9.x, which requires a JVM of **17 or higher** to run th
 # Publish to local Maven repository
 ./gradlew publishToMavenLocal
 
-# OWASP dependency vulnerability check (requires NVD_API_KEY env var for reasonable speed)
-./gradlew dependencyCheck
+# OWASP dependency vulnerability check across all modules (requires NVD_API_KEY env var for reasonable speed)
+# `dependencyCheck` alone is ambiguous under Gradle 9 (matches dependencyCheckAggregate/Analyze/Purge/Update)
+./gradlew dependencyCheckAggregate
 
 # Check for dependency updates
 ./gradlew dependencyUpdates
@@ -53,10 +54,10 @@ OBO (On-Behalf-Of) flows are surfaced through `OboServices` / `OboService`, whic
 
 Four Groovy convention plugins used by sub-modules:
 
-- `bdk.java-common-conventions` — Java 17 toolchain, UTF-8, JaCoCo, JUnit Platform, sources+javadoc jars, BOM platform import
+- `bdk.java-common-conventions` — Java 25 toolchain, UTF-8, JaCoCo, JUnit Platform (with an explicit Mockito `-javaagent`, since JVM self-attach is being withdrawn), sources+javadoc jars, BOM platform import
 - `bdk.java-library-conventions` — extends common + `java-library` plugin (used by all published libs)
 - `bdk.java-publish-conventions` — `maven-publish` + `signing`; signing is **only required for release versions** (`isReleaseVersion = !version.endsWith('SNAPSHOT')`)
-- `bdk.java-codegen-conventions` — OpenAPI Generator (Jersey2, Java 8 date library) reading `src/main/resources/api.yaml`; generated sources land in `build/generated/openapi`
+- `bdk.java-codegen-conventions` — OpenAPI Generator (Jersey3, Java 8 date library) reading `src/main/resources/api.yaml`; generated sources land in `build/generated/openapi`
 
 ## Publishing
 
@@ -70,3 +71,7 @@ Releasing is fully driven by publishing a GitHub Release (`.github/workflows/rel
 The `projectVersion` default in the root `build.gradle` stays fixed at `0.0.0-SNAPSHOT` on `main` — the real version is always supplied via `-PprojectVersion` in CI, so there is no version bump to commit.
 
 Credentials are passed as Gradle properties: `-PmavenRepoUsername` and `-PmavenRepoPassword`.
+
+## OpenSpec
+
+- when applying a change, stop after completing a section so that we can clear the session and save tokens
diff --git a/README.md b/README.md
index 8385591da..267f5a6c0 100644
--- a/README.md
+++ b/README.md
@@ -7,16 +7,18 @@
 # Symphony BDK for Java
 
 > [!NOTE]
-> BDK version 3.0: Major change !
+> BDK version 4.0: Major change !
 >
-> The newly introduced BDK version 3.0 relies on Java 17 and SpringBoot 3. This is a major change that allows Symphony to continue to propose the latest security fixes following the end of support of Spring Boot 2 and also to keep up with the latest evolutions of Java.
+> The newly introduced BDK version 4.0 relies on Java 25 and Spring Boot 4. This is a major change that allows Symphony to continue to propose the latest security fixes following the end of support of Spring Boot 3 and also to keep up with the latest evolutions of Java.
 >
-> For the next 6 months Symphony will provide critical security fixes for BDK 2.0 where possible (since Spring gives no guarantees for their packages).
+> For the next 6 months Symphony will provide critical security fixes for BDK 3.x where possible (since Spring gives no guarantees for their packages).
 >
 > Please consider migrating your Bots in the coming months to benefit from the latest features and support.
+> See the [4.x Migration Guide](https://symphony-bdk-java.finos.org/migration-4.x.html) for details.
 
 > [!IMPORTANT]
-> As detailed above, the BDK version 2.0 will stop being supported by Symphony on August 15.
+> Spring Boot 3.x + BDK 4.x is not supported. If your application cannot move to Spring Boot 4 and Java 25 yet, stay
+> on BDK 3.x — its documentation and sources remain available on the [`3.x`](https://github.com/finos/symphony-bdk-java/tree/3.x) branch.
 
 The **official** Symphony BDK for Java helps you to create production-grade Chat Bots and Extension Applications on 
 top of the [Symphony REST APIs](https://developers.symphony.com/restapi/reference). 
@@ -63,12 +65,22 @@ from the root of the source tree. The wrapper script serves as a cross-platform,
 the build system.
 
 ### Before you start
-To build you will need [Git](https://docs.github.com/en/github/getting-started-with-github/set-up-git) and [JDK 8 or later](https://adoptopenjdk.net/).
-Be sure that your `JAVA_HOME` environment variable points to the `jdk1.8+` folder extracted from the JDK download.
+To build you will need [Git](https://docs.github.com/en/github/getting-started-with-github/set-up-git) and [JDK 25 or later](https://adoptium.net/).
+Be sure that your `JAVA_HOME` environment variable points to the JDK 25+ folder extracted from the JDK download.
+
+> `main`'s build toolchain targets Java 25 — required, not recommended, matching what the BDK 4.0.0 release itself
+> requires at runtime (see the [4.x Migration Guide](https://symphony-bdk-java.finos.org/migration-4.x.html)). To
+> build BDK 3.x instead, check out the [`3.x`](https://github.com/finos/symphony-bdk-java/tree/3.x) branch, which
+> still targets Java 17.
 
 ### Build from the Command Line
-To compile, test and build all BDK2.0 jars, use:
+To compile, test and build all BDK jars, use:
+```shell script
+./gradlew
+```
+To compile, test and build BDK 3.x jars:
 ```shell script
+git checkout 3.x
 ./gradlew
 ```
 To compile, test and build legacy jars:
diff --git a/allow-list.xml b/allow-list.xml
index fd9cc3038..c8c62d52e 100644
--- a/allow-list.xml
+++ b/allow-list.xml
@@ -113,4 +113,17 @@
         <packageUrl regex="true">^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$</packageUrl>
         <cve>CVE-2026-54428</cve>
     </suppress>
+    <suppress>
+        <notes><![CDATA[
+          CVE-2026-66299 is a DoS in Apache Tomcat's bundled WebSocket *examples* web application
+          (the chat demo shipped in the full Tomcat distribution). The advisory states explicitly
+          that "users who have followed the security guidance to remove the examples web application
+          are not affected". BDK embeds Tomcat via tomcat-embed-core/tomcat-embed-websocket
+          (Spring Boot's embedded server), which never bundles the examples webapp in the first
+          place — there is nothing to remove. The fix version (11.0.25) was not yet published on
+          Maven Central at suppression time.
+          ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat\.embed/tomcat-embed-(core|websocket)@.*$</packageUrl>
+        <cve>CVE-2026-66299</cve>
+    </suppress>
 </suppressions>
diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle
index f112a6d81..266354131 100644
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -7,25 +7,7 @@ repositories {
 }
 
 dependencies {
-    implementation 'org.openapitools:openapi-generator-gradle-plugin:6.6.0'
+    implementation 'org.openapitools:openapi-generator-gradle-plugin:7.14.0'
     implementation 'de.undercouch:gradle-download-task:5.0.2'
     implementation 'com.github.ben-manes:gradle-versions-plugin:0.54.0'
 }
-
-configurations.all {
-    resolutionStrategy {
-        // owasp-dependencycheck 12.2.2 requires newer versions of several libraries than openapi-generator 6.6.0
-        // provides. Because buildSrc's classpath is the parent classloader for all plugin classloaders, OWASP
-        // inherits buildSrc's older versions via parent-first delegation and fails with NoSuchMethodError.
-        // Force all conflicting libraries to the versions OWASP 12.2.2 requires.
-        force 'com.fasterxml.jackson.core:jackson-databind:2.18.2'
-        force 'com.fasterxml.jackson.core:jackson-core:2.18.2'
-        force 'com.fasterxml.jackson.core:jackson-annotations:2.18.2'
-        force 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.14.0'
-        force 'org.yaml:snakeyaml:1.33'
-        force 'org.apache.commons:commons-lang3:3.20.0'
-        force 'commons-io:commons-io:2.22.0'
-        force 'org.slf4j:slf4j-api:2.0.17'
-        force 'com.google.guava:guava:33.6.0-jre'
-    }
-}
diff --git a/buildSrc/src/main/groovy/bdk.java-codegen-conventions.gradle b/buildSrc/src/main/groovy/bdk.java-codegen-conventions.gradle
index 05fe92da8..a1705fc7b 100644
--- a/buildSrc/src/main/groovy/bdk.java-codegen-conventions.gradle
+++ b/buildSrc/src/main/groovy/bdk.java-codegen-conventions.gradle
@@ -3,8 +3,11 @@ plugins {
 }
 
 dependencies {
-    implementation 'javax.annotation:jsr250-api:1.0'
+    // jersey3 forces useJakartaEe, so the generated @Generated annotation is jakarta.annotation.Generated.
+    implementation 'jakarta.annotation:jakarta.annotation-api'
     implementation 'io.swagger:swagger-annotations'
+    // Generated model classes are annotated with @javax.annotation.Nullable by our custom pojo.mustache
+    // template (JSR-305, never renamed to the jakarta namespace — unrelated to the jersey3/Jakarta EE move).
     implementation 'com.google.code.findbugs:jsr305'
 }
 
@@ -16,7 +19,7 @@ tasks.compileJava.dependsOn tasks.openApiGenerate
 
 openApiGenerate {
     generatorName = 'java'
-    library = 'jersey2'
+    library = 'jersey3'
     outputDir = generatedFolder
     inputSpec = "$projectDir/src/main/resources/api.yaml"
     skipOverwrite = true
@@ -35,3 +38,33 @@ openApiGenerate {
             dateLibrary: "java8"
     ]
 }
+
+// AbstractJavaCodegen.processOpts() hardcodes JsonSerialize/JsonDeserialize/ToStringSerializer as
+// Jackson 2 databind imports (used for Set-typed properties) after any configured importMapping
+// override is applied, so the only way to redirect them is a post-generation rewrite. BDK 4.x is
+// Jackson 3 only (D2/task 6.7) — these must not reintroduce jackson-databind 2 on the classpath.
+tasks.named('openApiGenerate').configure {
+    doLast {
+        fileTree(generatedFolder) { include '**/*.java' }.each { javaFile ->
+            def original = javaFile.text
+            def rewritten = original
+                    .replace('com.fasterxml.jackson.databind.annotation.JsonSerialize', 'tools.jackson.databind.annotation.JsonSerialize')
+                    .replace('com.fasterxml.jackson.databind.annotation.JsonDeserialize', 'tools.jackson.databind.annotation.JsonDeserialize')
+                    .replace('com.fasterxml.jackson.databind.ser.std.ToStringSerializer', 'tools.jackson.databind.ser.std.ToStringSerializer')
+            if (rewritten != original) {
+                javaFile.text = rewritten
+            }
+        }
+        // jersey3 forces useJakartaEe, so upstream imports must all resolve to the jakarta namespace.
+        // pojo.mustache's own @javax.annotation.Nullable is a JSR-305 annotation, applied inline without
+        // an import statement, so it never trips this check.
+        def strayJavaxImports = fileTree(generatedFolder) { include '**/*.java' }.findAll { javaFile ->
+            javaFile.text.readLines().any { it.startsWith('import javax.') }
+        }
+        if (!strayJavaxImports.isEmpty()) {
+            throw new GradleException("Generated sources import javax.* even though library=jersey3 " +
+                    "(useJakartaEe) is set — the Jakarta patch was lost in a template rebase: " +
+                    strayJavaxImports.collect { it.path }.join(', '))
+        }
+    }
+}
diff --git a/buildSrc/src/main/groovy/bdk.java-common-conventions.gradle b/buildSrc/src/main/groovy/bdk.java-common-conventions.gradle
index 2c3cde551..270172524 100644
--- a/buildSrc/src/main/groovy/bdk.java-common-conventions.gradle
+++ b/buildSrc/src/main/groovy/bdk.java-common-conventions.gradle
@@ -11,7 +11,7 @@ repositories {
 
 java {
     toolchain {
-        languageVersion = JavaLanguageVersion.of(17)
+        languageVersion = JavaLanguageVersion.of(25)
     }
     withJavadocJar()
     withSourcesJar()
@@ -40,13 +40,27 @@ jar {
     }
 }
 
+configurations {
+    // Resolves the Mockito agent jar explicitly rather than relying on JVM self-attach, which the
+    // JDK warns about and is scheduled to deny.
+    mockitoAgent
+}
+
 test {
     useJUnitPlatform()
+    doFirst {
+        jvmArgs "-javaagent:${configurations.mockitoAgent.asPath}"
+    }
 }
 
 dependencies {
     implementation platform(project(':symphony-bdk-bom'))
     annotationProcessor platform(project(':symphony-bdk-bom'))
     testAnnotationProcessor platform(project(':symphony-bdk-bom'))
+
+    mockitoAgent platform(project(':symphony-bdk-bom'))
+    mockitoAgent('org.mockito:mockito-core') {
+        transitive = false
+    }
 }
 
diff --git a/buildSrc/src/main/groovy/bdk.java-library-conventions.gradle b/buildSrc/src/main/groovy/bdk.java-library-conventions.gradle
index 6db612bbd..b6eec8fcd 100644
--- a/buildSrc/src/main/groovy/bdk.java-library-conventions.gradle
+++ b/buildSrc/src/main/groovy/bdk.java-library-conventions.gradle
@@ -2,3 +2,33 @@ plugins {
     id 'bdk.java-common-conventions'
     id 'java-library'
 }
+
+// BDK 4.x is Jackson 3 only (design D2): a second databind implementation on a published
+// module's runtime classpath is a rejected outcome, not a fallback, because it lets two HTTP
+// modules serialize the same BDK call differently depending on which one happens to be present.
+tasks.register('verifySingleJacksonDatabind') {
+    group = 'verification'
+    description = 'Fails if the legacy Jackson 2 databind resolves alongside Jackson 3 on the runtime classpath.'
+    def runtimeClasspath = configurations.findByName('runtimeClasspath')
+    if (runtimeClasspath != null) {
+        inputs.files(runtimeClasspath)
+    }
+    doLast {
+        if (runtimeClasspath == null) {
+            return
+        }
+        def legacyDatabind = runtimeClasspath.resolvedConfiguration.resolvedArtifacts.find {
+            it.moduleVersion.id.group == 'com.fasterxml.jackson.core' && it.moduleVersion.id.name == 'jackson-databind'
+        }
+        if (legacyDatabind != null) {
+            throw new GradleException(
+                    "com.fasterxml.jackson.core:jackson-databind resolved on ${project.path}'s runtime classpath " +
+                            "alongside tools.jackson.core:jackson-databind. Find and remove whatever dependency " +
+                            "pulled in the Jackson 2 databind implementation.")
+        }
+    }
+}
+
+tasks.named('check') {
+    dependsOn tasks.named('verifySingleJacksonDatabind')
+}
diff --git a/docs/_config.yml b/docs/_config.yml
index 408a217bb..510896769 100644
--- a/docs/_config.yml
+++ b/docs/_config.yml
@@ -1,4 +1,4 @@
-title: BDK 3.1 for Java 
+title: BDK 4.x for Java
 description: Reference documentation for using the Symphony BDK to build bots
 theme: just-the-docs
 plugins:
@@ -6,5 +6,7 @@ plugins:
 url: https://symphony-bdk-java.finos.org
 color_scheme: symphony
 aux_links:
-  "BDK 3.1 on GitHub":
+  "BDK 4.x on GitHub":
     - "//github.com/finos/symphony-bdk-java/releases"
+  "BDK 3.x docs":
+    - "/3.x/"
diff --git a/docs/configuration.md b/docs/configuration.md
index 2428af49b..b9bde40c2 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -146,7 +146,7 @@ retry:
 The BDK configuration now includes the following properties:
 - The BDK configuration can contain the global properties for `host`, `port`, `context`, `scheme` and the following connection parameters: `connectionTimeout`, `readTimeout`, `connectionPoolMax`, `connectionPoolPerRoute`.
 These global properties can be used by the client configuration by default or can be overridden if
-user specify the dedicated `host`, `port`, `context`, `scheme` or custom connection parameters inside the client configuration. Please note that connection parameters are optional, `connectionPoolMax`, `connectionPoolPerRoute` are used only by Jersey2 connection implementation and in general default values (they are in the example file, but you can avoid specifying them explicitly if you don't want change them) fit most use cases.
+user specify the dedicated `host`, `port`, `context`, `scheme` or custom connection parameters inside the client configuration. Please note that connection parameters are optional, `connectionPoolMax`, `connectionPoolPerRoute` are used only by the Jersey connection implementation and in general default values (they are in the example file, but you can avoid specifying them explicitly if you don't want change them) fit most use cases.
 - `proxy` contains proxy related information. This field is optional.
 If set, it will use the provided `host` (mandatory), `port` (mandatory), `username` and `password`.
 It can be overridden in each of the `pod`, `agent`, `keyManager` and `sessionAuth` fields.
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 0d53dbb1a..e5291058d 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -59,7 +59,7 @@ If you want to use [Maven](https://maven.apache.org/) as build system, you have
         </dependency>
         <dependency>
             <groupId>org.finos.symphony.bdk</groupId>
-            <artifactId>symphony-bdk-http-jersey2</artifactId> <!-- or symphony-bdk-http-webclient -->
+            <artifactId>symphony-bdk-http-jersey</artifactId> <!-- or symphony-bdk-http-webclient -->
             <scope>runtime</scope>
         </dependency>
         <dependency>
@@ -101,7 +101,7 @@ dependencies {
 
     // define dependencies without versions
     implementation 'org.finos.symphony.bdk:symphony-bdk-core'
-    runtimeOnly 'org.finos.symphony.bdk:symphony-bdk-http-jersey2'           //  or symphony-bdk-http-webclient
+    runtimeOnly 'org.finos.symphony.bdk:symphony-bdk-http-jersey'           //  or symphony-bdk-http-webclient
     runtimeOnly 'org.finos.symphony.bdk:symphony-bdk-template-freemarker'    // or symphony-bdk-http-handlebars
 
     // logger configuration
diff --git a/docs/index.md b/docs/index.md
index 8bd9a5b84..de4759566 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -7,16 +7,17 @@ nav_order: 1
 # Symphony BDK Reference Documentation
 
 >
-> ### BDK version 3.0: Major change !
-> 
-> The newly introduced BDK version 3.0 relies on Java 17 and SpringBoot 3. This is a major change that allows Symphony to continue to propose the latest security fixes following the end of support of Spring Boot 2 and also to keep up with the latest evolutions of Java.
-> 
-> For the next 6 months Symphony will provide critical security fixes for BDK 2.0 where possible (since Spring gives no guarantees for their packages).
-> 
-> Please consider migrating your Bots in the coming months to benefit from the latest features and support. 
+> ### BDK version 4.0: Major change !
+>
+> The newly introduced BDK version 4.0 relies on Java 25 and Spring Boot 4. This is a major change that allows Symphony to continue to propose the latest security fixes following the end of support of Spring Boot 3 and also to keep up with the latest evolutions of Java.
+>
+> For the next 6 months Symphony will provide critical security fixes for BDK 3.x where possible (since Spring gives no guarantees for their packages).
+>
+> Please consider migrating your Bots in the coming months to benefit from the latest features and support.
+> See the [4.x Migration Guide](./migration-4.x.html) for details.
 >
 >> ### Note !
->> As detailed above, the BDK version 2.0 will stop being supported by Symphony on August 15.
+>> BDK 3.x documentation remains available at [symphony-bdk-java.finos.org/3.x/](./3.x/).
 >>
 
 This reference guide provides detailed information about the Symphony BDK. It provides a comprehensive documentation
@@ -30,7 +31,8 @@ The reference documentation consists of the following sections:
 | Section                                   | Description                                                           |
 |-------------------------------------------|:---------------------------------------------------------------------:|
 | [Getting Started](./getting-started.html) | Introducing Symphony BDK for beginners                                |
-| [Migration Guide](./migration.html)       | Guide to migrate to Symphony BDK 2.0                                  |
+| [Migration Guide (4.x)](./migration-4.x.html) | Guide to migrate to Symphony BDK 4.0 from 3.x                     |
+| [Migration Guide](./migration.html)       | Guide to migrate to Symphony BDK 2.0 / 3.0                            |
 | [Configuration](./configuration.html)     | Configuration structure, formats, how to load from code               |
 | [Authentication](./authentication.html)   | RSA or certificate authentication, OBO, extension app authentication  |
 | [Datafeed Loop](datafeed.html)            | Receiving real time events                                            |
diff --git a/docs/migration-4.x.md b/docs/migration-4.x.md
new file mode 100644
index 000000000..b1d2c19ce
--- /dev/null
+++ b/docs/migration-4.x.md
@@ -0,0 +1,180 @@
+---
+layout: default
+title: Migration Guide (4.x)
+nav_order: 3.1
+---
+
+# Migration guide to Symphony BDK 4.0 from 3.x
+
+> [!IMPORTANT]
+> **BDK 4.x requires Spring Boot 4.x.** Spring Boot 3.x combined with BDK 4.x is **not supported**. The BDK does not
+> attempt cross-major compatibility through conditional autoconfiguration or runtime version detection — a Spring
+> Boot 3 application must stay on BDK 3.x.
+>
+> **BDK 4.x requires Java 25.** This is a change from BDK 3.x's Java 17 requirement.
+>
+> BDK 3.x will continue to receive critical security fixes for **6 months** after the 4.0.0 release (where possible,
+> since Spring itself gives no support guarantees for superseded package versions). The `3.x` branch remains
+> available on GitHub for the duration of that window. See [Support window](#support-window) below.
+
+This guide covers what changes for a bot or extension application moving from BDK 3.x to BDK 4.x. The underlying
+change is a move from Spring Boot 3.5 to Spring Boot 4 (Spring Framework 7), which brings Jakarta EE 11, Jackson 3,
+Netty 4.2, Tomcat 11 and Micrometer 2 along with it, plus a small number of mechanical, major-only cleanups that
+rode along with the framework move.
+
+## 1. Move to Spring Boot 4 first
+
+BDK 4.x's Spring modules (`symphony-bdk-core-spring-boot-starter`, `symphony-bdk-app-spring-boot-starter`,
+`symphony-bdk-test-spring-boot`) autoconfigure against Spring Boot 4 only. Upgrade your application's Spring Boot
+version to 4.x *before* bumping the BDK version, so that the two migrations aren't debugged together:
+
+```xml
+<dependencyManagement>
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-dependencies</artifactId>
+            <version>4.0.0</version>
+            <type>pom</type>
+            <scope>import</scope>
+        </dependency>
+    </dependencies>
+</dependencyManagement>
+```
+
+If your application cannot move to Spring Boot 4 yet, stay on BDK 3.x — there is no partial-compatibility path.
+
+## 2. Java 25 is required
+
+BDK 4.0.0 requires **Java 25**. Update your `JAVA_HOME`, IDE project SDK, and CI runners accordingly, and update any
+`--release`/toolchain configuration in your own build to target 25.
+
+> :bulb: If you are following the BDK's own development history, intermediate builds during the 4.x migration
+> targeted Java 17 (Spring Boot 4 itself only baselines Java 17). That intermediate state was never released —
+> the Java requirement for the published 4.0.0 artifacts is 25.
+
+## 3. Dependency coordinate rename: `symphony-bdk-http-jersey2` → `symphony-bdk-http-jersey`
+
+The Jersey-based HTTP implementation module has been on Jersey 3.x for some time, so the `jersey2` artifactId no
+longer described what it shipped. The coordinate is renamed in this major, with **no relocation POM or forwarding
+artifact** — a dependency on the old coordinate will fail to resolve rather than silently pulling in an empty jar.
+
+BDK 3.x:
+```xml
+<dependency>
+    <groupId>org.finos.symphony.bdk</groupId>
+    <artifactId>symphony-bdk-http-jersey2</artifactId>
+    <scope>runtime</scope>
+</dependency>
+```
+
+BDK 4.x:
+```xml
+<dependency>
+    <groupId>org.finos.symphony.bdk</groupId>
+    <artifactId>symphony-bdk-http-jersey</artifactId>
+    <scope>runtime</scope>
+</dependency>
+```
+
+If you use `symphony-bdk-http-webclient` instead, no change is needed here.
+
+## 4. `BdkConfigParser`'s `JsonNode` signatures change package
+
+BDK 4.x adopts Jackson 3 (`tools.jackson.*`) instead of Jackson 2 (`com.fasterxml.jackson.*`) on its public API
+surface, to avoid two JSON databind implementations resolving on the same classpath (which would otherwise make the
+same BDK call serialize differently depending on which HTTP module — Jersey or WebClient — is present).
+
+This is visible wherever code calls `BdkConfigParser` directly:
+
+| Method                    | BDK 3.x parameter/return type      | BDK 4.x parameter/return type   |
+|----------------------------|-------------------------------------|----------------------------------|
+| `parse(...)`               | `com.fasterxml.jackson.databind.JsonNode` | `tools.jackson.databind.JsonNode` |
+| `parseJsonNode(...)`       | `com.fasterxml.jackson.databind.JsonNode` | `tools.jackson.databind.JsonNode` |
+| `interpolateProperties(...)` | `com.fasterxml.jackson.databind.JsonNode` | `tools.jackson.databind.JsonNode` |
+
+This only affects applications calling `BdkConfigParser` directly — most bots load configuration via
+`BdkConfigLoader` and never touch this class. If you have hand-written Jackson 2 code elsewhere in your application
+that interacts with BDK-returned `JsonNode` instances, it needs the same package update.
+
+## 5. Nullability annotations: JSR-305 → JSpecify
+
+The BDK's public API used `javax.annotation.Nonnull` / `javax.annotation.Nullable` (JSR-305) for nullability. These
+are replaced with [JSpecify](https://jspecify.dev/) (`org.jspecify.annotations.NonNull` / `Nullable`), which Spring
+Framework 7 itself standardises on.
+
+This is **source-compatible** — nothing in application code needs to change to compile and run. It is visible to:
+- IDE null-checking and static analysis tools that read nullability annotations
+- Any application code that directly imports `com.google.code.findbugs:jsr305` alongside the BDK and expected JSR-305
+  annotations on BDK types
+
+If your application declared its own `@NullMarked` packages against the BDK's previous JSR-305 contract, re-verify
+them against the new JSpecify annotations — JSpecify's package-level defaulting is not identical to JSR-305's.
+
+## 6. BOM constraints removed
+
+`symphony-bdk-bom` no longer constrains the following, because they existed solely to pull versions above what
+Spring Boot 3.5 pinned — versions Spring Boot 4 already supersedes:
+- `io.netty:netty-bom` (Netty 4.1 CVE override)
+- `org.apache.tomcat.embed:tomcat-embed-core` / `tomcat-embed-el` / `tomcat-embed-websocket` (Tomcat 10 CVE overrides)
+- `jakarta.ws.rs:jakarta.ws.rs-api` and `jakarta.validation:jakarta.validation-api` (Jakarta EE 10 pins)
+
+If your application imported `symphony-bdk-bom` specifically to inherit one of these pins, you now inherit Spring
+Boot 4's own choices (Netty 4.2, Tomcat 11, Jakarta EE 11) instead. This is the intended behaviour — re-pin
+explicitly in your own build only if you have a reason to diverge from Spring Boot 4's platform.
+
+## 7. Test dependencies
+
+`symphony-bdk-test-spring-boot` re-exports `spring-boot-starter-test` and `spring-boot-starter-web` as `api`
+dependencies, so applications depending on it for test support inherit Spring Boot 4's test stack — including
+whatever JUnit and Mockito versions Spring Boot 4 manages. Review your test code for any direct dependence on the
+previous JUnit/Mockito versions if you don't otherwise manage them explicitly.
+
+If your application uses `symphony-bdk-test-jupiter` or `symphony-bdk-test-spring-boot` (both bring in Mockito
+through `@SymphonyBdkTest` / `@SymphonyBdkSpringBootTest`), your own test JVM is subject to the same JDK 25
+self-attach restriction the BDK's own build hit: Mockito's inline mock maker can no longer self-attach its agent at
+runtime. Configure your build to pass the Mockito agent explicitly, e.g. in Gradle:
+
+```groovy
+configurations {
+    mockitoAgent
+}
+dependencies {
+    mockitoAgent('org.mockito:mockito-core') { transitive = false }
+}
+test {
+    doFirst {
+        jvmArgs "-javaagent:${configurations.mockitoAgent.asPath}"
+    }
+}
+```
+
+Do not silence the self-attach warning with `-XX:+EnableDynamicAgentLoading` — it only postpones the failure to the
+JDK release that removes self-attach outright.
+
+## 8. Generated API changes: `openapi-generator` 6.6.0 → 7.x
+
+The generated classes under `com.symphony.bdk.gen.api` and `com.symphony.bdk.gen.api.model` were regenerated with
+`openapi-generator` 7.x (`jersey3` library, up from `jersey2`). All 377 classes were diffed between the two
+generator versions; the only consumer-visible change is:
+
+- **21 unreferenced `*AllOf` companion classes no longer exist** (e.g. `MessageAllOf`, `CreateGroupAllOf`,
+  `V2PresenceAllOf`). These were orphaned classes emitted for schemas using `allOf` composition that nothing in the
+  BDK, or any known consumer, ever referenced directly. If your code somehow imported one of these classes by name,
+  it needs to be removed — there is no replacement, because nothing replaced their function.
+
+No other generated class changes shape, method signatures, `equals`/`hashCode`/`toString`, or annotations in any
+consumer-visible way. Fluent builder method names (`addXxxItem`, `putXxxItem`, etc.) and all constructors are
+unchanged.
+
+## Support window
+
+BDK 3.x will receive critical security fixes for **6 months** following the BDK 4.0.0 release, where Symphony is
+able to backport them (Spring itself provides no support guarantee for superseded package versions once a Spring
+Boot major line goes out of support). After that window, BDK 3.x is unsupported.
+
+If your application cannot move to Java 25 within that window, staying on BDK 3.x is the supported option for as
+long as this window remains open — there is no partial 4.x compatibility path that avoids the Java 25 requirement.
+
+The `3.x` branch on GitHub continues to exist after `main` moves to 4.x, and its own documentation remains reachable
+at [symphony-bdk-java.finos.org/3.x/](https://symphony-bdk-java.finos.org/3.x/).
diff --git a/docs/migration.md b/docs/migration.md
index 87e1ae838..ad442e9f1 100644
--- a/docs/migration.md
+++ b/docs/migration.md
@@ -116,7 +116,7 @@ Simply update BDK dependency version to `3.0.0`
     </dependency>
     <dependency>
         <groupId>org.finos.symphony.bdk</groupId>
-        <artifactId>symphony-bdk-http-jersey2</artifactId> <!-- or symphony-bdk-http-webclient -->
+        <artifactId>symphony-bdk-http-jersey</artifactId> <!-- or symphony-bdk-http-webclient -->
         <scope>runtime</scope>
     </dependency>
     <dependency>
@@ -219,7 +219,7 @@ If your project is not framework based, dependencies such as *jersey* and *freem
     </dependency>
     <dependency>
         <groupId>org.finos.symphony.bdk</groupId>
-        <artifactId>symphony-bdk-http-jersey2</artifactId> <!-- or symphony-bdk-http-webclient -->
+        <artifactId>symphony-bdk-http-jersey</artifactId> <!-- or symphony-bdk-http-webclient -->
         <scope>runtime</scope>
     </dependency>
     <dependency>
diff --git a/docs/tech/architecture.md b/docs/tech/architecture.md
index 60da50038..637b9c490 100644
--- a/docs/tech/architecture.md
+++ b/docs/tech/architecture.md
@@ -35,7 +35,7 @@ also provides a utility `com.symphony.bdk.http.api.HttpClient` class helping dev
 > Changing contract would break the build. See [Code Generation](#code-generation).
 
 At the moment, two different implementations have been created for the `com.symphony.bdk.http.api.ApiClient` interface:
-- `com.symphony.bdk.http.jersey2.ApiClientJersey2` contained in module `symphony-bdk-http-jersey2` (default implementation for [Core](#symphony-bdk-core))
+- `com.symphony.bdk.http.jersey2.ApiClientJersey2` contained in module `symphony-bdk-http-jersey` (default implementation for [Core](#symphony-bdk-core))
 - `com.symphony.bdk.http.webclient.ApiClientWebClient` contained in module `symphony-bdk-http-webclient` (default implementation for [Spring Boot](#symphony-bdk-spring))
 
 ### symphony-bdk-template
diff --git a/docs/test.md b/docs/test.md
index 22fae6aad..3a2f550ca 100644
--- a/docs/test.md
+++ b/docs/test.md
@@ -9,6 +9,11 @@ nav_order: 19
 This guide provides information to Symphony BDK Bot developers about how using Symphony BDK Test to build the
 integration tests for the Bots.
 
+> Since BDK 4.0.0, tests run on **Java 25**. Because `@SymphonyBdkTest` and `@SymphonyBdkSpringBootTest` bring in
+> Mockito, and Mockito's inline mock maker can no longer self-attach its agent on JDK 25, your own test build must
+> configure the Mockito agent explicitly via a `-javaagent` JVM argument. See
+> [4.x Migration Guide](./migration-4.x.html) (section 7, "Test dependencies") for the Gradle configuration.
+
 ## Java BDK Bots Integration tests
 
 To create an integration test for a Java BDK Bot application, developer needs to add annotation `@SymphonyBdkTest` on top
diff --git a/openspec/changes/adopt-java-25-baseline/tasks.md b/openspec/changes/adopt-java-25-baseline/tasks.md
deleted file mode 100644
index d8d61010e..000000000
--- a/openspec/changes/adopt-java-25-baseline/tasks.md
+++ /dev/null
@@ -1,63 +0,0 @@
-## 1. Prerequisites
-
-- [ ] 1.1 Confirm `migrate-spring-boot-4` is merged to `next` and `./gradlew build jacocoTestReport jacocoTestCoverageVerification` is green on Java 17 + Spring Boot 4
-- [ ] 1.2 Retrieve the residual JDK 25 failure list recorded by `modernize-build-toolchain` tasks 7.1–7.2; it is the authoritative starting inventory for sections 2 and 4
-- [ ] 1.3 Confirm the Gradle version on `next` can provision a JDK 25 toolchain (recorded in `modernize-build-toolchain` task 7.3)
-- [ ] 1.4 Rebase `next` on `main` so any 3.x fixes landed since `migrate-spring-boot-4` are present
-
-## 2. Toolchain and CI Flip
-
-- [ ] 2.1 Change `JavaLanguageVersion.of(17)` → `of(25)` in `bdk.java-common-conventions.gradle`
-- [ ] 2.2 Confirm no module build file reintroduces its own `sourceCompatibility` / `targetCompatibility`
-- [ ] 2.3 Bump `java-version: '17'` → `'25'` in `.github/workflows/build.yml`
-- [ ] 2.4 Bump `java-version: '17'` → `'25'` in `.github/workflows/cve-scanning-gradle.yml`
-- [ ] 2.5 Bump `java-version: '17'` → `'25'` in `.github/workflows/release.yml`, and align its `actions/setup-java@v3` with the version used by the other workflows
-- [ ] 2.6 Deliberately do **not** add a JDK matrix — Java 25 is a floor, not one option among several (D-note in design Non-Goals)
-- [ ] 2.7 Run `./gradlew build` and record every failure; reconcile against the 1.2 inventory and investigate anything new
-
-## 3. OpenAPI Generator 6.6.0 → 7.x (D2)
-
-- [ ] 3.1 Generate all 5 API specs with 6.6.0 and with 7.x into two separate trees and `diff -r` them
-- [ ] 3.2 Write a summary of every consumer-visible change in the 377 generated classes — signature changes, nullable wrapping, fluent-setter shape, `equals`/`hashCode`/`toString`, enum representation, required-vs-optional constructor parameters. This summary is a deliverable and feeds task 7.2, not a checkpoint
-- [ ] 3.3 Bump `org.openapitools:openapi-generator-gradle-plugin` to 7.x in `buildSrc/build.gradle`, and remove the hand-written transitive override block that exists only because 6.6.0 needed older libraries than `owasp-dependencycheck` 12.2.2
-- [ ] 3.4 Change `library = 'jersey2'` → `'jersey3'` in both places: `bdk.java-codegen-conventions.gradle` and the `apisToGenerate` loop in `symphony-bdk-core/build.gradle`
-- [ ] 3.5 Review 7.x `configOptions`: confirm `dateLibrary: "java8"` and `sortParamsByRequiredFlag: "false"` still exist and mean the same thing; decide whether `useJakartaEe` is now the correct way to get Jakarta output; resolve the fate of `org.openapitools:jackson-databind-nullable:0.2.6` against 7.x's nullable strategy and the Jackson decision from `migrate-spring-boot-4`
-- [ ] 3.6 Re-justify each of the three custom templates (`api.mustache`, `pojo.mustache`, `modelInnerEnum.mustache`) against 7.x upstream — **delete** any whose customization 7.x now handles natively, rather than porting it forward
-- [ ] 3.7 Add an assertion that the generated sources contain no `javax.*` imports, so the Jakarta patch currently living in `pojo.mustache` cannot be lost silently in a template rebase
-- [ ] 3.8 Confirm 7.x's `jersey3` library targets the Jersey version Spring Boot 4 pins (established by `migrate-spring-boot-4` task 1.2) — a mismatch means generated code compiles against a different Jakarta REST generation than the runtime provides
-- [ ] 3.9 Fix the hand-written `symphony-bdk-http-api` invoker seam (`ApiClient`, `ApiResponse`, `Pair`, `TypeReference`) if 7.x changed how generated APIs call into it — `supportingFiles: "false"` means BDK owns these by hand
-- [ ] 3.10 Fix every hand-written call site affected by a changed generated signature
-- [ ] 3.11 Confirm `skipOverwrite = true` and the `globalProperties` block still behave as intended under 7.x
-
-## 4. Test Infrastructure on JDK 25
-
-- [ ] 4.1 Add an explicit Mockito `-javaagent` to the test JVM arguments in `bdk.java-common-conventions.gradle`, resolved from the Mockito artifact (D3)
-- [ ] 4.2 Confirm no `-XX:+EnableDynamicAgentLoading` suppression is used anywhere (D3)
-- [ ] 4.3 Confirm the Lombok version pinned in `symphony-bdk-bom` compiles all 13 Lombok-consuming modules on JDK 25
-- [ ] 4.4 Confirm the 3 ArchUnit architecture tests read class file version 69 — `CoreArchitectureTest`, `SymphonyGroupExtensionArchitectureTest`, `bdk-spring-boot-example/ArchitectureTest`
-- [ ] 4.5 Confirm `jacocoTestCoverageVerification` passes in every module on JDK 25 bytecode; if thresholds shift because of instrumentation counting rather than test changes, adjust them in a dedicated commit naming the JDK
-- [ ] 4.6 Confirm the MapStruct processor and the Spring Boot configuration processor run on JDK 25, and that the generated `UserDetailMapperImpl` is unchanged from the Java 17 build
-
-## 5. Release Pipeline (D5)
-
-- [ ] 5.1 Add a branch guard to `release.yml`: `v3.*` tags must target the `3.x` branch, `v4.*` tags must target `main` — the current `^v[0-9]+\.[0-9]+\.[0-9]+$` regex validates tag shape only, and a mis-targeted release to Maven Central is immutable
-- [ ] 5.2 Verify the CLI distribution still builds and runs on JDK 25: `:symphony-bdk-cli:installDist`, then execute `bin/bdk`
-- [ ] 5.3 Verify `publishToSonatype` and the signing configuration work under the new JDK and Gradle combination
-- [ ] 5.4 Verify `./gradlew dependencyCheck` runs on JDK 25 and review `allow-list.xml` against the Spring Boot 4 dependency set
-
-## 6. Full Verification
-
-- [ ] 6.1 `./gradlew build jacocoTestReport jacocoTestCoverageVerification` green on Java 25 + Spring Boot 4
-- [ ] 6.2 Run the starter smoke tests from `migrate-spring-boot-4` section 2 — they are the check that autoconfiguration still works on the new JDK
-- [ ] 6.3 Build every example module, including `bdk-ai-agent-example` (langchain4j) and `bdk-multi-instances-example`
-- [ ] 6.4 Confirm every published jar's class file version corresponds to Java 25 and that no module targets a different version
-- [ ] 6.5 `./gradlew publishToMavenLocal` and confirm the coordinate set matches what `migrate-spring-boot-4` established
-
-## 7. Documentation and the 3.x Commitment
-
-- [ ] 7.1 State Java 25 as a hard requirement in `docs/migration-4.x.md` and in the README — required, not recommended
-- [ ] 7.2 Add the generated-API change summary from 3.2 to the migration guide, with before/after signatures for anything consumers construct or read directly
-- [ ] 7.3 Document that consumers using `symphony-bdk-test-jupiter` / `symphony-bdk-test-spring-boot` inherit the explicit Mockito agent configuration and must run tests on JDK 25
-- [ ] 7.4 **Record the 3.x support window** in the migration guide and release notes (D1). The guide cannot answer "what if I cannot move to Java 25" without it, and 4.0.0 must not ship without an answer
-- [ ] 7.5 Update `CLAUDE.md` with the Java 25 baseline and the JDK requirement for contributors
-- [ ] 7.6 Confirm the versioned documentation set up by `migrate-spring-boot-4` task 10.3 keeps 3.x docs reachable for consumers who stay on the maintenance line
diff --git a/openspec/changes/migrate-spring-boot-4/design.md b/openspec/changes/archive/2026-08-06-migrate-spring-boot-4/design.md
similarity index 97%
rename from openspec/changes/migrate-spring-boot-4/design.md
rename to openspec/changes/archive/2026-08-06-migrate-spring-boot-4/design.md
index 128749a0e..0fed36862 100644
--- a/openspec/changes/migrate-spring-boot-4/design.md
+++ b/openspec/changes/archive/2026-08-06-migrate-spring-boot-4/design.md
@@ -59,10 +59,10 @@ A second reason: the Jackson decision (D2) is a framework question, not a JDK qu
 
 ### D2 — The Jackson major version is gated on the Jersey provider question; a split classpath is a rejected outcome, not a fallback
 
-**Decision**: Before committing to Jackson 3, determine whether a Jackson 3 JSON provider exists for the Jersey version Spring Boot 4 pins. Then:
+**Decision**:
+Jackson 3 JSON provider (`tools.jackson.jakarta:jackson-jakarta-rs-json-provider`) exists for Jersey 4.0.x (which is pinned by Spring Boot 4), and `jackson-annotations` 3.x retains core annotations under the legacy package name `com.fasterxml.jackson.annotation`.
 
-- **Provider exists** → adopt Jackson 3. Migrate the 22 hand-written `databind`/`core` usages to `tools.jackson.*`, change `BdkConfigParser`'s 3 public `JsonNode` signatures, and rewrite `symphony-bdk-http-jersey`'s `JSON.java` / `RFC3339DateFormat.java` against the Jackson 3 provider.
-- **No provider** → **ship BDK 4.0 on Jackson 2**, explicitly and documented, and revisit in 4.1. Do not adopt Jackson 3 in the Spring-facing modules while leaving the Jersey module on Jackson 2.
+Therefore, we **adopt Jackson 3**. We will migrate the 22 hand-written `databind`/`core` usages to `tools.jackson.*`, change `BdkConfigParser`'s 3 public `JsonNode` signatures, and rewrite `symphony-bdk-http-jersey`'s `JSON.java` / `RFC3339DateFormat.java` against the Jackson 3 provider.
 
 **Rationale**: The tempting middle option is the dangerous one. `symphony-bdk-http-jersey`'s `JSON.java` is a `ContextResolver<ObjectMapper>` — a Jackson 2 construct. If Spring brings Jackson 3 while that module stays on Jackson 2, both are on the classpath and the two HTTP implementations serialize differently:
 
diff --git a/openspec/changes/migrate-spring-boot-4/proposal.md b/openspec/changes/archive/2026-08-06-migrate-spring-boot-4/proposal.md
similarity index 100%
rename from openspec/changes/migrate-spring-boot-4/proposal.md
rename to openspec/changes/archive/2026-08-06-migrate-spring-boot-4/proposal.md
diff --git a/openspec/changes/migrate-spring-boot-4/specs/platform-baseline/spec.md b/openspec/changes/archive/2026-08-06-migrate-spring-boot-4/specs/platform-baseline/spec.md
similarity index 100%
rename from openspec/changes/migrate-spring-boot-4/specs/platform-baseline/spec.md
rename to openspec/changes/archive/2026-08-06-migrate-spring-boot-4/specs/platform-baseline/spec.md
diff --git a/openspec/changes/migrate-spring-boot-4/tasks.md b/openspec/changes/archive/2026-08-06-migrate-spring-boot-4/tasks.md
similarity index 60%
rename from openspec/changes/migrate-spring-boot-4/tasks.md
rename to openspec/changes/archive/2026-08-06-migrate-spring-boot-4/tasks.md
index 14bc5ad87..f90dfa1ab 100644
--- a/openspec/changes/migrate-spring-boot-4/tasks.md
+++ b/openspec/changes/archive/2026-08-06-migrate-spring-boot-4/tasks.md
@@ -1,90 +1,91 @@
 ## 1. Investigation (blocking — resolves the open questions before any code moves)
 
-- [ ] 1.1 Determine where Spring Boot 4 places `@ConditionalOnMissingBean`, `@ConditionalOnProperty`, `@ConditionalOnBean`, `@ConditionalOnExpression`, `@SpringBootApplication`, and the `AutoConfigurations` test helper; record the old → new mapping (25 of 28 references are the three `@ConditionalOn*` annotations, so this sizes section 3)
-- [ ] 1.2 Determine which Jersey version `spring-boot-dependencies:4.x` pins, and whether it implements Jakarta REST 3.1 or 4.0
-- [ ] 1.3 Verify against the published `jackson-annotations` 3.x artifact that `com.fasterxml.jackson.annotation` is retained — this decides whether the generated-code cost is 0 files or 377
-- [ ] 1.4 Determine whether a Jackson 3 JSON provider exists for the Jersey version from 1.2 (the D2 gate)
-- [ ] 1.5 Record the D2 decision — Jackson 3, or ship 4.0 on Jackson 2 — and update this change's scope accordingly. Do not proceed to section 6 until this is written down
-- [ ] 1.6 Confirm the `AutoConfiguration.imports` file path/name is unchanged in Spring Boot 4 (`META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`)
+- [x] 1.1 Determine where Spring Boot 4 places `@ConditionalOnMissingBean`, `@ConditionalOnProperty`, `@ConditionalOnBean`, `@ConditionalOnExpression`, `@SpringBootApplication`, and the `AutoConfigurations` test helper; record the old → new mapping (25 of 28 references are the three `@ConditionalOn*` annotations, so this sizes section 3)
+- [x] 1.2 Determine which Jersey version `spring-boot-dependencies:4.x` pins, and whether it implements Jakarta REST 3.1 or 4.0
+- [x] 1.3 Verify against the published `jackson-annotations` 3.x artifact that `com.fasterxml.jackson.annotation` is retained — this decides whether the generated-code cost is 0 files or 377
+- [x] 1.4 Determine whether a Jackson 3 JSON provider exists for the Jersey version from 1.2 (the D2 gate)
+- [x] 1.5 Record the D2 decision — Jackson 3, or ship 4.0 on Jackson 2 — and update this change's scope accordingly. Do not proceed to section 6 until this is written down
+- [x] 1.6 Confirm the `AutoConfiguration.imports` file path/name is unchanged in Spring Boot 4 (`META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports`)
 
 ## 2. Starter Smoke Tests — written first, against Spring Boot 3.5 (D5)
 
-- [ ] 2.1 Add a smoke test to `symphony-bdk-core-spring-boot-starter` that boots a minimal `@SpringBootApplication` depending only on the starter, and asserts `SymphonyBdk` and the core service beans are present via real autoconfiguration discovery (not `AutoConfigurations`)
-- [ ] 2.2 Add the equivalent smoke test to `symphony-bdk-app-spring-boot-starter`, asserting the app-layer beans, the health indicator, and the circle-of-trust endpoints are wired
-- [ ] 2.3 Add a consumer-perspective test for `symphony-bdk-test-spring-boot` that verifies the re-exported test stack works from a dependent module
-- [ ] 2.4 Confirm all three pass on Spring Boot 3.5.16 before any bump — a smoke test written after the bump proves nothing about whether it would have caught the failure
-- [ ] 2.5 Merge sections 1–2 to `next` and rebase on `main` before continuing
+- [x] 2.1 Add a smoke test to `symphony-bdk-core-spring-boot-starter` that boots a minimal `@SpringBootApplication` depending only on the starter, and asserts `SymphonyBdk` and the core service beans are present via real autoconfiguration discovery (not `AutoConfigurations`)
+- [x] 2.2 Add the equivalent smoke test to `symphony-bdk-app-spring-boot-starter`, asserting the app-layer beans, the health indicator, and the circle-of-trust endpoints are wired
+- [x] 2.3 Add a consumer-perspective test for `symphony-bdk-test-spring-boot` that verifies the re-exported test stack works from a dependent module
+- [x] 2.4 Confirm all three pass on Spring Boot 3.5.16 before any bump — a smoke test written after the bump proves nothing about whether it would have caught the failure
+- [x] 2.5 Merge sections 1–2 to `next` and rebase on `main` before continuing
 
 ## 3. Spring Boot 4 Platform Bump
 
-- [ ] 3.1 Change `symphony-bdk-bom` to `platform('org.springframework.boot:spring-boot-dependencies:4.x')`
-- [ ] 3.2 Remove `platform('io.netty:netty-bom:4.1.136.Final')` and its CVE comment (D3)
-- [ ] 3.3 Remove the three `org.apache.tomcat.embed:tomcat-embed-*:10.1.57` constraints and their CVE comment (D3)
-- [ ] 3.4 Remove `jakarta.ws.rs:jakarta.ws.rs-api:3.1.0` and `jakarta.validation:jakarta.validation-api:3.0.2` from `symphony-bdk-bom`, and the duplicate `jakarta.validation-api:3.0.2` from `symphony-bdk-app-spring-boot-starter/build.gradle` — do this early so EE 11 incompatibilities surface now, not at the end
-- [ ] 3.5 Realign or remove the explicit `jersey-bom` import per 1.2
-- [ ] 3.6 Land 3.2–3.4 as their own commit naming each removed coordinate, matching the BOM-hygiene discipline from `modernize-build-toolchain`
-- [ ] 3.7 Confirm the toolchain in `bdk.java-common-conventions` is still `JavaLanguageVersion.of(17)` — this change must not flip it (D1)
+- [x] 3.1 Change `symphony-bdk-bom` to `platform('org.springframework.boot:spring-boot-dependencies:4.x')`
+- [x] 3.2 Remove `platform('io.netty:netty-bom:4.1.136.Final')` and its CVE comment (D3)
+- [x] 3.3 Remove the three `org.apache.tomcat.embed:tomcat-embed-*:10.1.57` constraints and their CVE comment (D3)
+- [x] 3.4 Remove `jakarta.ws.rs:jakarta.ws.rs-api:3.1.0` and `jakarta.validation:jakarta.validation-api:3.0.2` from `symphony-bdk-bom`, and the duplicate `jakarta.validation-api:3.0.2` from `symphony-bdk-app-spring-boot-starter/build.gradle` — do this early so EE 11 incompatibilities surface now, not at the end
+- [x] 3.5 Realign or remove the explicit `jersey-bom` import per 1.2
+- [x] 3.6 Land 3.2–3.4 as their own commit naming each removed coordinate, matching the BOM-hygiene discipline from `modernize-build-toolchain`
+- [x] 3.7 Confirm the toolchain in `bdk.java-common-conventions` is still `JavaLanguageVersion.of(17)` — this change must not flip it (D1)
 
 ## 4. Autoconfiguration Retargeting
 
-- [ ] 4.1 Update imports in `SymphonyBdkAutoConfiguration` and the rest of `symphony-bdk-core-spring-boot-starter` per the 1.1 mapping
-- [ ] 4.2 Update imports in `SymphonyBdkAppAutoConfiguration` and the rest of `symphony-bdk-app-spring-boot-starter` per the 1.1 mapping
-- [ ] 4.3 Update the 3 `AutoConfigurations` test-helper usages
-- [ ] 4.4 Update both `META-INF/spring/...AutoConfiguration.imports` files if 1.6 found the path changed
-- [ ] 4.5 Retarget starter dependency coordinates for Spring Boot 4's module split: `spring-boot-starter-web`, `-actuator`, `-validation`, `spring-boot-configuration-processor` (app starter); `spring-boot-starter` (core starter); `spring-boot-starter-webflux` (`symphony-bdk-http-webclient`); `spring-boot-starter-web` + `-test` (`symphony-bdk-test-spring-boot`)
-- [ ] 4.6 Fix `SymphonyBdkHealthIndicator` against Actuator / Micrometer 2
-- [ ] 4.7 Fix `CircleOfTrustController` and the app-layer exception handling against Spring Framework 7 MVC
-- [ ] 4.8 Fix `BdkActivityConfig.SlashAnnotationProcessor` if bean-post-processor or `@ConditionalOn*` semantics moved
-- [ ] 4.9 Run the section 2 smoke tests — they are the acceptance criterion for this section, not the unit tests
+- [x] 4.1 Update imports in `SymphonyBdkAutoConfiguration` and the rest of `symphony-bdk-core-spring-boot-starter` per the 1.1 mapping
+- [x] 4.2 Update imports in `SymphonyBdkAppAutoConfiguration` and the rest of `symphony-bdk-app-spring-boot-starter` per the 1.1 mapping
+- [x] 4.3 Update the 3 `AutoConfigurations` test-helper usages
+- [x] 4.4 Update both `META-INF/spring/...AutoConfiguration.imports` files if 1.6 found the path changed
+- [x] 4.5 Retarget starter dependency coordinates for Spring Boot 4's module split: `spring-boot-starter-web`, `-actuator`, `-validation`, `spring-boot-configuration-processor` (app starter); `spring-boot-starter` (core starter); `spring-boot-starter-webflux` (`symphony-bdk-http-webclient`); `spring-boot-starter-web` + `-test` (`symphony-bdk-test-spring-boot`)
+- [x] 4.6 Fix `SymphonyBdkHealthIndicator` against Actuator / Micrometer 2
+- [x] 4.7 Fix `CircleOfTrustController` and the app-layer exception handling against Spring Framework 7 MVC
+- [x] 4.8 Fix `BdkActivityConfig.SlashAnnotationProcessor` if bean-post-processor or `@ConditionalOn*` semantics moved
+- [x] 4.9 Run the section 2 smoke tests — they are the acceptance criterion for this section, not the unit tests
 
 ## 5. Jakarta EE 11 Fallout
 
-- [ ] 5.1 Rebuild and fix any `jakarta.validation` breakage from EE 10 → EE 11 (`@NotBlank` usages in the app starter models)
-- [ ] 5.2 Rebuild and fix `symphony-bdk-http-jersey2`'s `jakarta.ws.rs` usages against the version from 1.2 (24 imports across the module: `Client`, `WebTarget`, `Entity`, `Invocation`, `ClientRequestFilter`, `ClientResponseFilter`, `ContextResolver`, `Provider`, `MultivaluedHashMap`, `Form`, `GenericType`)
-- [ ] 5.3 Fix the `jakarta.servlet.http` usages in the app starter against Servlet 6.1
-- [ ] 5.4 Fix the `jakarta.annotation.PostConstruct` usages
-- [ ] 5.5 Confirm Netty 4.2 and Tomcat 11 cause no runtime breakage in `symphony-bdk-http-webclient` and the app starter — the smoke tests from section 2 are the check
-- [ ] 5.6 Re-run `./gradlew dependencyCheck` against the Spring Boot 4 platform; add only overrides that run genuinely justifies, with fresh comments (D3)
+- [x] 5.1 Rebuild and fix any `jakarta.validation` breakage from EE 10 → EE 11 (`@NotBlank` usages in the app starter models)
+- [x] 5.2 Rebuild and fix `symphony-bdk-http-jersey2`'s `jakarta.ws.rs` usages against the version from 1.2 (24 imports across the module: `Client`, `WebTarget`, `Entity`, `Invocation`, `ClientRequestFilter`, `ClientResponseFilter`, `ContextResolver`, `Provider`, `MultivaluedHashMap`, `Form`, `GenericType`)
+- [x] 5.3 Fix the `jakarta.servlet.http` usages in the app starter against Servlet 6.1
+- [x] 5.4 Fix the `jakarta.annotation.PostConstruct` usages
+- [x] 5.5 Confirm Netty 4.2 and Tomcat 11 cause no runtime breakage in `symphony-bdk-http-webclient` and the app starter — the smoke tests from section 2 are the check
+- [x] 5.6 Re-run `./gradlew dependencyCheck` against the Spring Boot 4 platform; add only overrides that run genuinely justifies, with fresh comments (D3)
 
 ## 6. Jackson — conditional on the D2 decision from 1.5
 
-- [ ] 6.1 *(Jackson 3 only)* Migrate the 22 hand-written `com.fasterxml.jackson.databind` / `.core` usages to `tools.jackson.*`, module by module: `symphony-bdk-config` (`BdkConfigLoader`, `BdkConfigParser`), `symphony-bdk-core` (7 files incl. `JwtHelper`, `AuthSessionImpl`, `MessageParser`, `Message`, `ExtensionService`, `FormReplyActivity`, `FormReplyContext`, `InputTokenizer`), `symphony-bdk-http-jersey` (`JSON`, `RFC3339DateFormat`), the starters, `symphony-group-extension`, `symphony-bdk-cli` (`internal/Json`)
-- [ ] 6.2 *(Jackson 3 only)* Change `BdkConfigParser`'s 3 public `JsonNode` signatures and note them in the migration guide as a breaking API change
-- [ ] 6.3 *(Jackson 3 only)* Rewrite `JSON.java`'s `ContextResolver<ObjectMapper>` against the Jackson 3 provider from 1.4
-- [ ] 6.4 *(Jackson 3 only)* Migrate the 5 test-side databind usages (`MockApiClient`, `JwtHelperTest`, `CircleOfTrustControllerTest`, `SymphonyBdkMockedConfiguration`, the 3 CLI tests)
-- [ ] 6.5 *(Jackson 3 only)* Replace `com.fasterxml.jackson.datatype.jsr310.JavaTimeModule`, `YAMLMapper`, `JavaPropsMapper`, and `jackson-databind-nullable` with their Jackson 3 equivalents; if `org.openapitools:jackson-databind-nullable` has no Jackson 3 release, this feeds back into 1.5
-- [ ] 6.6 *(Jackson 2 only)* Verify Jackson 2 and Spring Boot 4 coexist, and document in the migration guide that BDK 4.0 remains on Jackson 2 with Jackson 3 targeted for 4.1
-- [ ] 6.7 Assert there is exactly one Jackson databind implementation on the runtime classpath — a dependency-verification test, so the split classpath D2 rejects cannot appear later by accident
+- [x] 6.1 *(Jackson 3 only)* Migrate the 22 hand-written `com.fasterxml.jackson.databind` / `.core` usages to `tools.jackson.*`, module by module: `symphony-bdk-config` (`BdkConfigLoader`, `BdkConfigParser`), `symphony-bdk-core` (7 files incl. `JwtHelper`, `AuthSessionImpl`, `MessageParser`, `Message`, `ExtensionService`, `FormReplyActivity`, `FormReplyContext`, `InputTokenizer`), `symphony-bdk-http-jersey` (`JSON`, `RFC3339DateFormat`), the starters, `symphony-group-extension`, `symphony-bdk-cli` (`internal/Json`)
+- [x] 6.2 *(Jackson 3 only)* Change `BdkConfigParser`'s 3 public `JsonNode` signatures and note them in the migration guide as a breaking API change
+- [x] 6.3 *(Jackson 3 only)* Rewrite `JSON.java`'s `ContextResolver<ObjectMapper>` against the Jackson 3 provider from 1.4
+- [x] 6.4 *(Jackson 3 only)* Migrate the 5 test-side databind usages (`MockApiClient`, `JwtHelperTest`, `CircleOfTrustControllerTest`, `SymphonyBdkMockedConfiguration`, the 3 CLI tests)
+- [x] 6.5 *(Jackson 3 only)* Replace `com.fasterxml.jackson.datatype.jsr310.JavaTimeModule`, `YAMLMapper`, `JavaPropsMapper`, and `jackson-databind-nullable` with their Jackson 3 equivalents; if `org.openapitools:jackson-databind-nullable` has no Jackson 3 release, this feeds back into 1.5
+- [x] 6.6 *(Jackson 2 only)* Verify Jackson 2 and Spring Boot 4 coexist, and document in the migration guide that BDK 4.0 remains on Jackson 2 with Jackson 3 targeted for 4.1 — N/A, D2 adopted Jackson 3
+- [x] 6.7 Assert there is exactly one Jackson databind implementation on the runtime classpath — a dependency-verification test, so the split classpath D2 rejects cannot appear later by accident
 
 ## 7. Module Rename: `http-jersey2` → `http-jersey` (D7 — own commit)
 
-- [ ] 7.1 Rename the directory `symphony-bdk-http/symphony-bdk-http-jersey2` → `symphony-bdk-http-jersey` and update `settings.gradle`
-- [ ] 7.2 Update the `symphony-bdk-bom` constraint to the new artifactId
-- [ ] 7.3 Update all consuming modules: `symphony-bdk-core` (test), `symphony-bdk-core-spring-boot-starter`, `symphony-bdk-cli`, `bdk-ai-agent-example`, and any other example
-- [ ] 7.4 Update `docs/` and every code sample referencing the old coordinate
-- [ ] 7.5 Confirm no relocation POM or forwarding artifact is published (D7)
+- [x] 7.1 Rename the directory `symphony-bdk-http/symphony-bdk-http-jersey2` → `symphony-bdk-http-jersey` and update `settings.gradle`
+- [x] 7.2 Update the `symphony-bdk-bom` constraint to the new artifactId
+- [x] 7.3 Update all consuming modules: `symphony-bdk-core` (test), `symphony-bdk-core-spring-boot-starter`, `symphony-bdk-cli`, `bdk-ai-agent-example`, and any other example
+- [x] 7.4 Update `docs/` and every code sample referencing the old coordinate
+- [x] 7.5 Confirm no relocation POM or forwarding artifact is published (D7)
 
 ## 8. JSR-305 → JSpecify (D4 — own commit)
 
-- [ ] 8.1 Add JSpecify to `symphony-bdk-bom`
-- [ ] 8.2 Replace the 52 `javax.annotation.Nonnull` and 30 `javax.annotation.Nullable` usages, module by module — not as a global find-and-replace, because JSpecify's `@NullMarked` defaulting changes what an *unannotated* type means
-- [ ] 8.3 Decide per module whether to apply `@NullMarked` at package level, and verify the resulting contract matches the previous JSR-305 intent
-- [ ] 8.4 Drop `com.google.code.findbugs:jsr305` from modules that only used it for nullability; keep it where `bdk.java-codegen-conventions` requires it for generated code
-- [ ] 8.5 Confirm the 3 ArchUnit architecture tests still pass, and add a rule forbidding `javax.annotation.Nullable`/`Nonnull` so it cannot come back
+- [x] 8.1 Add JSpecify to `symphony-bdk-bom`
+- [x] 8.2 Replace the 52 `javax.annotation.Nonnull` and 30 `javax.annotation.Nullable` usages, module by module — not as a global find-and-replace, because JSpecify's `@NullMarked` defaulting changes what an *unannotated* type means
+- [x] 8.3 Decide per module whether to apply `@NullMarked` at package level, and verify the resulting contract matches the previous JSR-305 intent
+- [x] 8.4 Drop `com.google.code.findbugs:jsr305` from modules that only used it for nullability; keep it where `bdk.java-codegen-conventions` requires it for generated code
+- [x] 8.5 Confirm the 3 ArchUnit architecture tests still pass, and add a rule forbidding `javax.annotation.Nullable`/`Nonnull` so it cannot come back
 
 ## 9. Examples and Verification
 
-- [ ] 9.1 Build `bdk-spring-boot-example` and `bdk-app-spring-boot-example` against Spring Boot 4; fix `ApiExceptionHandler` and the example `ArchitectureTest`
-- [ ] 9.2 Build the non-Spring examples (`bdk-core-examples`, `bdk-multi-instances-example`, `bdk-group-example`, `bdk-ai-agent-example`) — the last one also pulls `langchain4j`, verify no Jackson or Netty conflict
-- [ ] 9.3 Build `symphony-bdk-cli` and verify `installDist` still produces a working `bin/bdk`
-- [ ] 9.4 Full green run of `./gradlew build jacocoTestReport jacocoTestCoverageVerification` on **Java 17** + Spring Boot 4 — the definition of done for this change (D1)
-- [ ] 9.5 Confirm `./gradlew publishToMavenLocal` publishes the expected coordinates, with `symphony-bdk-http-jersey2` absent
+- [x] 9.1 Build `bdk-spring-boot-example` and `bdk-app-spring-boot-example` against Spring Boot 4; fix `ApiExceptionHandler` and the example `ArchitectureTest`
+- [x] 9.2 Build the non-Spring examples (`bdk-core-examples`, `bdk-multi-instances-example`, `bdk-group-example`, `bdk-ai-agent-example`) — the last one also pulls `langchain4j`, verify no Jackson or Netty conflict
+- [x] 9.3 Build `symphony-bdk-cli` and verify `installDist` still produces a working `bin/bdk`
+- [x] 9.4 Full green run of `./gradlew build jacocoTestReport jacocoTestCoverageVerification` on **Java 17** + Spring Boot 4 — the definition of done for this change (D1)
+- [x] 9.5 Confirm `./gradlew publishToMavenLocal` publishes the expected coordinates, with `symphony-bdk-http-jersey2` absent
 
 ## 10. Documentation
 
-- [ ] 10.1 Write `docs/migration-4.x.md` covering all 7 items from the design's migration plan
-- [ ] 10.2 State prominently that BDK 4.x requires Spring Boot 4.x and that Spring Boot 3 + BDK 4 is unsupported (D6)
-- [ ] 10.3 Set up versioned documentation so `symphony-bdk-java.finos.org` serves 3.x and 4.x separately, and 3.x consumers are never shown 4.x instructions
-- [ ] 10.4 Update `docs/extension.md` and any doc referencing the `jersey2` coordinate or JSR-305 annotations
-- [ ] 10.5 Note the Java requirement in the migration guide as **25** (what 4.0.0 actually ships), not the 17 this intermediate state builds against
-- [ ] 10.6 Record the 3.x support window in the migration guide once decided — the guide cannot answer "what if I can't move to Java 25" without it
+- [x] 10.1 Write `docs/migration-4.x.md` covering all 7 items from the design's migration plan
+- [x] 10.2 State prominently that BDK 4.x requires Spring Boot 4.x and that Spring Boot 3 + BDK 4 is unsupported (D6)
+- [x] 10.3 Set up versioned documentation so `symphony-bdk-java.finos.org` serves 3.x and 4.x separately, and 3.x consumers are never shown 4.x instructions
+- [x] 10.4 Update `docs/extension.md` and any doc referencing the `jersey2` coordinate or JSR-305 annotations
+- [x] 10.5 Note the Java requirement in the migration guide as **25** (what 4.0.0 actually ships), not the 17 this intermediate state builds against
+- [x] 10.6 Record the 3.x support window in the migration guide once decided — the guide cannot answer "what if I can't move to Java 25" without it
+- [x] 10.7 Update the `README.md` making sure all prerequisites are correctly specified, and also mention that the `3.x` branch still exists 
diff --git a/openspec/changes/adopt-java-25-baseline/design.md b/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/design.md
similarity index 100%
rename from openspec/changes/adopt-java-25-baseline/design.md
rename to openspec/changes/archive/2026-08-11-adopt-java-25-baseline/design.md
diff --git a/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/generated-api-diff-summary.md b/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/generated-api-diff-summary.md
new file mode 100644
index 000000000..2f526a131
--- /dev/null
+++ b/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/generated-api-diff-summary.md
@@ -0,0 +1,130 @@
+# Generated API diff: openapi-generator 6.6.0/jersey2 → 7.14.0/jersey3
+
+Deliverable for task 3.2 (D2). Feeds migration guide task 7.2. Produced by generating all
+5 `symphony-bdk-core` API specs plus the `symphony-group-extension` spec with both generator
+versions into separate trees and running `diff -r` across all 377 generated classes.
+
+## Method
+
+1. Snapshot of the 6.6.0/jersey2 output (377 `.java` files) taken before touching any build file.
+2. `openapi-generator-gradle-plugin` bumped to 7.14.0 (latest 7.x; the Gradle plugin has not
+   published past 7.14.0 even though the core `openapi-generator` artifact has newer 7.x releases).
+   `library` switched from `jersey2` to `jersey3` in both `bdk.java-codegen-conventions.gradle`
+   and the `apisToGenerate` loop in `symphony-bdk-core/build.gradle`.
+3. Output regenerated into a second tree (356 `.java` files) and diffed against the snapshot,
+   ignoring import-line reordering and the `@Generated` annotation's timestamp/version fields.
+
+## Findings
+
+### 1. Fluent array/map builder methods were about to change casing — fixed
+
+`pojo.mustache` (customized since 2021) calls `add{{nameInCamelCase}}Item` / `put{{nameInCamelCase}}Item`
+for array- and map-typed properties. Between 6.6.0 and 7.14.0, upstream renamed this variable:
+`nameInCamelCase` now means true camelCase (lowercase first letter), and a **new** variable
+`nameInPascalCase` carries the old semantics the method names actually need. Left unported, every
+generated `addXxxItem`/`putXxxItem` method would have been renamed to `addxxxItem`/`putxxxItem`
+(lowercase first letter) — a silent, build-succeeding, binary-incompatible rename of every
+collection-property builder method across the generated model surface.
+
+**Fix applied**: `templates/pojo.mustache` now uses `{{nameInPascalCase}}` in both spots. Confirmed
+by regenerating: zero method-name changes remain anywhere in the 356 common classes.
+
+### 2. 21 dead "AllOf" companion classes are no longer generated
+
+6.6.0 emitted an orphaned `XxxAllOf.java` class for every schema using `allOf` composition
+(e.g. `MessageAllOf`, `CreateGroupAllOf`), even though nothing — not the corresponding model,
+not any other generated class, not any hand-written BDK code — ever referenced them. 7.x's
+improved `allOf` handling stops emitting these. Confirmed via repo-wide grep: no hand-written
+source references any `*AllOf` symbol. **No consumer impact** — removing an unreferenced,
+unreachable public class is not a behavioral change for any caller who could have compiled
+against it.
+
+Removed: `ConnectionRequestMessageAllOf`, `MessageAllOf`, `RoomCreatedMessageAllOf`,
+`RoomDeactivatedMessageAllOf`, `RoomMemberDemotedFromOwnerMessageAllOf`,
+`RoomMemberPromotedToOwnerMessageAllOf`, `RoomReactivatedMessageAllOf`, `SignalAllOf`,
+`UserJoinedRoomMessageAllOf`, `UserLeftRoomMessageAllOf`, `V2MessageAllOf`, `V2PresenceAllOf`,
+`V2RoomSearchCriteriaAllOf`, `V2UserPresenceAllOf` (symphony-bdk-core); `CreateGroupAllOf`,
+`ProfileAllOf`, `ReadGroupAllOf`, `ReadMemberAllOf`, `TypeAllOf`, `UpdateGroupAllOf`
+(symphony-group-extension).
+
+### 3. `@Generated` annotation moves from `javax.annotation` to `jakarta.annotation`
+
+`library=jersey3` unconditionally forces the generator's internal `useJakartaEe` flag (it is not
+optional for this library — Jersey 3 *is* the Jakarta EE JAX-RS generation, confirmed by reading
+`JavaClientCodegen`'s `libJersey3` branch), which retargets the `@Generated` annotation import.
+This broke compilation until the module dependencies were updated (`javax.annotation:jsr250-api:1.0`
+→ `jakarta.annotation:jakarta.annotation-api`, version managed by the Spring Boot 4 platform
+already imported by `symphony-bdk-bom`) in both `bdk.java-codegen-conventions.gradle` and
+`symphony-bdk-core/build.gradle`. Purely a build-time dependency fix; the annotation is
+`RetentionPolicy.SOURCE` and carries no runtime or consumer-visible effect.
+
+### 4. `@javax.annotation.Nullable` is unaffected, correctly
+
+Our `pojo.mustache` hardcodes `@javax.annotation.Nullable` (JSR-305, from
+`com.google.code.findbugs:jsr305`) on every nullable getter/setter. This annotation was **never**
+renamed to the `jakarta` namespace — JSR-305 is unrelated to Jakarta EE/JAX-RS, unlike the
+`@Generated` annotation above. Verified empirically: no `jakarta.annotation.Nullable` class exists
+on any dependency's classpath, so had the template been "fixed" to follow `{{javaxPackage}}` here,
+every generated model would fail to compile. The existing hardcoded `javax` reference is correct
+and was left unchanged.
+
+### 5. Everything else is byte-for-byte identical modulo import order and timestamps
+
+After fix #1, only 2 of the 356 common classes had any further diff, and both are non-functional:
+- `Profile.java` (symphony-group-extension): `@ApiModelProperty(example = ...)` array-example
+  string formatting changed from `[\"Services\"]` to `[Services]` — a Javadoc/Swagger metadata
+  string, not consumer-visible code.
+- `PodCertificate.java`: differs only in the OpenAPI spec description/version comment header,
+  caused by which of two API specs defining an identical `PodCertificate` schema happened to
+  generate last in this run (`skipOverwrite`-driven, pre-existing non-determinism unrelated to
+  the generator version).
+
+## Template re-justification (task 3.6)
+
+- **`pojo.mustache`**: kept, with the one-line `nameInPascalCase` fix above. Still required —
+  upstream's own `libraries/jersey3/pojo.mustache` and base `Java/pojo.mustache` are structurally
+  different from BDK's fluent/no-JsonNullable/no-`toUrlQueryString` model shape; there is no
+  native 7.x equivalent to delete in favor of.
+- **`api.mustache`**: kept unchanged. Regenerated output is identical to 6.6.0's aside from the
+  `@Generated` annotation — BDK's `XxxWithHttpInfo`/`ApiXxxRequest` builder shape has no upstream
+  equivalent to adopt instead.
+- **`modelInnerEnum.mustache`**: kept unchanged. Regenerated output identical to 6.6.0's aside from
+  the `@Generated` annotation.
+
+## Config options (task 3.5)
+
+- `dateLibrary: "java8"` — still a recognized value in 7.14.0; moot in practice since none of the
+  5 BDK API specs currently define a date/time-typed property.
+- `sortParamsByRequiredFlag: "false"` — still a recognized, same-meaning option in 7.14.0.
+- `useJakartaEe` — not set explicitly; not applicable for `library=jersey3`, which forces it to
+  `true` unconditionally regardless of the config option's value.
+- `org.openapitools:jackson-databind-nullable:0.2.11` — kept. Not produced or consumed by the
+  current generation either before or after the bump (no schema triggers the `JsonNullable`
+  wrapper strategy); the dependency exists solely so `symphony-bdk-http-jersey`'s hand-written
+  `JSON.java` can register `JsonNullableJackson3Module` defensively. Unaffected by this change.
+
+## Invoker seam / Jersey version (tasks 3.8–3.11)
+
+- `globalProperties.supportingFiles: "false"` continues to suppress every file the `jersey3`
+  library would otherwise emit into `invokerPackage` (`JSON.java`, `ApiResponse.java`,
+  `AbstractOpenApiSchema.java`) — confirmed empirically: the generated `com/symphony/bdk/http/api`
+  directories are empty. BDK's hand-written `ApiClient`, `ApiResponse`, `Pair`, and `TypeReference`
+  in `symphony-bdk-http-api` are untouched and did not need any change.
+- Generated model/API classes never reference `jakarta.ws.rs`/`javax.ws.rs` types directly (that's
+  confined to supportingFiles this build doesn't generate), so there is no version coupling between
+  openapi-generator's internal "jersey3 library" Jersey pin (3.1.1, used only in its own unused
+  scaffolding) and the actual runtime Jersey version (4.0.0, imported via `symphony-bdk-bom`'s
+  `org.glassfish.jersey:jersey-bom:4.0.0`, matching `migrate-spring-boot-4` task 1.2).
+- `skipOverwrite = true` continues to behave as before: it only matters when a target file already
+  exists on disk from a previous run; a clean `build/generated/openapi` regenerates fully.
+- Full `./gradlew build` (JDK 17, pre-Java-25-flip) is green with the bump applied — no hand-written
+  call site anywhere in the repository needed a change (task 3.10 confirmed by the build passing
+  outright, not just by inspection).
+
+## Consumer-facing summary (for docs/migration-4.x.md, task 7.2)
+
+- 21 unreferenced `*XxxAllOf*` generated classes no longer exist. If your code somehow referenced
+  one directly (unlikely — nothing in BDK itself ever did), it will need to be removed.
+- No other generated class in `com.symphony.bdk.gen.api` / `com.symphony.bdk.gen.api.model` (or the
+  `symphony-group-extension` equivalents) changes shape, method signatures, `equals`/`hashCode`/
+  `toString`, or annotations in any consumer-visible way.
diff --git a/openspec/changes/adopt-java-25-baseline/proposal.md b/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/proposal.md
similarity index 100%
rename from openspec/changes/adopt-java-25-baseline/proposal.md
rename to openspec/changes/archive/2026-08-11-adopt-java-25-baseline/proposal.md
diff --git a/openspec/changes/adopt-java-25-baseline/specs/build-toolchain/spec.md b/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/specs/build-toolchain/spec.md
similarity index 100%
rename from openspec/changes/adopt-java-25-baseline/specs/build-toolchain/spec.md
rename to openspec/changes/archive/2026-08-11-adopt-java-25-baseline/specs/build-toolchain/spec.md
diff --git a/openspec/changes/adopt-java-25-baseline/specs/platform-baseline/spec.md b/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/specs/platform-baseline/spec.md
similarity index 100%
rename from openspec/changes/adopt-java-25-baseline/specs/platform-baseline/spec.md
rename to openspec/changes/archive/2026-08-11-adopt-java-25-baseline/specs/platform-baseline/spec.md
diff --git a/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/tasks.md b/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/tasks.md
new file mode 100644
index 000000000..0acbc99c7
--- /dev/null
+++ b/openspec/changes/archive/2026-08-11-adopt-java-25-baseline/tasks.md
@@ -0,0 +1,110 @@
+## 1. Prerequisites
+
+- [x] 1.1 Confirm `migrate-spring-boot-4` is merged to `next` and `./gradlew build jacocoTestReport jacocoTestCoverageVerification` is green on Java 17 + Spring Boot 4
+  - Confirmed: `symphony-bdk-bom/build.gradle` pins `spring-boot-dependencies:4.0.0`; `./gradlew build jacocoTestReport jacocoTestCoverageVerification` on JDK 17 → BUILD SUCCESSFUL.
+- [x] 1.2 Retrieve the residual JDK 25 failure list recorded by `modernize-build-toolchain` tasks 7.1–7.2; it is the authoritative starting inventory for sections 2 and 4
+  - Retrieved from `openspec/changes/archive/2026-08-05-modernize-build-toolchain/tasks.md` task 7.1–7.2: **zero failures** on a throwaway JDK 25 build with sections 3–6 tooling in place (Gradle 9.6.1, Mockito, ArchUnit, Lombok 1.18.46, `openApiGenerate` all clean). Starting inventory is empty; section 2/4 of this change still re-verify fresh.
+- [x] 1.3 Confirm the Gradle version on `next` can provision a JDK 25 toolchain (recorded in `modernize-build-toolchain` task 7.3)
+  - Confirmed: `gradle-wrapper.properties` pins Gradle 9.6.1 (same version recorded in task 7.3), and a Temurin 25.0.2 JDK is available locally via SDKMAN for toolchain provisioning.
+- [x] 1.4 Rebase `next` on `main` so any 3.x fixes landed since `migrate-spring-boot-4` are present
+  - Confirmed: `next` is 0 commits behind `upstream/main` (11 ahead) — already contains everything from `main`, no rebase needed.
+
+## 2. Toolchain and CI Flip
+
+- [x] 2.1 Change `JavaLanguageVersion.of(17)` → `of(25)` in `bdk.java-common-conventions.gradle`
+  - Done: `buildSrc/src/main/groovy/bdk.java-common-conventions.gradle` toolchain `languageVersion` now `JavaLanguageVersion.of(25)`.
+- [x] 2.2 Confirm no module build file reintroduces its own `sourceCompatibility` / `targetCompatibility`
+  - Confirmed: no `.gradle` file in the repo declares `sourceCompatibility` or `targetCompatibility`.
+- [x] 2.3 Bump `java-version: '17'` → `'25'` in `.github/workflows/build.yml`
+  - Done.
+- [x] 2.4 Bump `java-version: '17'` → `'25'` in `.github/workflows/cve-scanning-gradle.yml`
+  - Done.
+- [x] 2.5 Bump `java-version: '17'` → `'25'` in `.github/workflows/release.yml`, and align its `actions/setup-java@v3` with the version used by the other workflows
+  - Done: `release.yml` now uses `actions/setup-java@v4` (matching `cve-scanning-gradle.yml`) with `java-version: '25'`.
+- [x] 2.6 Deliberately do **not** add a JDK matrix — Java 25 is a floor, not one option among several (D-note in design Non-Goals)
+  - Confirmed: no `matrix` block in `build.yml`; single-JDK CI preserved.
+- [x] 2.7 Run `./gradlew build` and record every failure; reconcile against the 1.2 inventory and investigate anything new
+  - `./gradlew build` on JDK 25 (Temurin 25.0.2, active `sdk`/system default): **BUILD SUCCESSFUL**, 191 actionable tasks, zero failures. Matches the empty 1.2 inventory — nothing new to investigate.
+
+## 3. OpenAPI Generator 6.6.0 → 7.x (D2)
+
+- [x] 3.1 Generate all 5 API specs with 6.6.0 and with 7.x into two separate trees and `diff -r` them
+  - Done: 377 classes snapshotted at 6.6.0/jersey2, regenerated at 7.14.0/jersey3, diffed. See `generated-api-diff-summary.md`.
+- [x] 3.2 Write a summary of every consumer-visible change in the 377 generated classes — signature changes, nullable wrapping, fluent-setter shape, `equals`/`hashCode`/`toString`, enum representation, required-vs-optional constructor parameters. This summary is a deliverable and feeds task 7.2, not a checkpoint
+  - Done: `openspec/changes/adopt-java-25-baseline/generated-api-diff-summary.md`.
+- [x] 3.3 Bump `org.openapitools:openapi-generator-gradle-plugin` to 7.x in `buildSrc/build.gradle`, and remove the hand-written transitive override block that exists only because 6.6.0 needed older libraries than `owasp-dependencycheck` 12.2.2
+  - Done: bumped to 7.14.0 (latest 7.x the Gradle plugin has published); `resolutionStrategy.force` block removed.
+- [x] 3.4 Change `library = 'jersey2'` → `'jersey3'` in both places: `bdk.java-codegen-conventions.gradle` and the `apisToGenerate` loop in `symphony-bdk-core/build.gradle`
+  - Done.
+- [x] 3.5 Review 7.x `configOptions`: confirm `dateLibrary: "java8"` and `sortParamsByRequiredFlag: "false"` still exist and mean the same thing; decide whether `useJakartaEe` is now the correct way to get Jakarta output; resolve the fate of `org.openapitools:jackson-databind-nullable:0.2.6` against 7.x's nullable strategy and the Jackson decision from `migrate-spring-boot-4`
+  - Confirmed both options unchanged in 7.14.0 (verified against `CodegenConstants`/`AbstractJavaCodegen` source). `useJakartaEe` is forced `true` unconditionally by `library=jersey3` (not a config choice). `jackson-databind-nullable:0.2.11` kept as-is — unused by generation either version, retained only for `symphony-bdk-http-jersey`'s `JsonNullableJackson3Module` registration.
+- [x] 3.6 Re-justify each of the three custom templates (`api.mustache`, `pojo.mustache`, `modelInnerEnum.mustache`) against 7.x upstream — **delete** any whose customization 7.x now handles natively, rather than porting it forward
+  - `api.mustache` and `modelInnerEnum.mustache`: kept unchanged, regenerated output identical to 6.6.0 aside from the `@Generated` annotation — no native 7.x equivalent exists for BDK's builder shape. `pojo.mustache`: kept, with one real fix — `nameInCamelCase` → `nameInPascalCase` for `addXxxItem`/`putXxxItem` (upstream renamed the variable's meaning between versions; unported it would have silently lowercased every collection builder method name).
+- [x] 3.7 Add an assertion that the generated sources contain no `javax.*` imports, so the Jakarta patch currently living in `pojo.mustache` cannot be lost silently in a template rebase
+  - Done: `doLast` check added to both `openApiGenerate` (codegen-conventions) and the `apisToGenerate` loop (symphony-bdk-core), failing the build on any `import javax.*` line. `@javax.annotation.Nullable` (JSR-305, inline, no import) correctly does not trip it.
+- [x] 3.8 Confirm 7.x's `jersey3` library targets the Jersey version Spring Boot 4 pins (established by `migrate-spring-boot-4` task 1.2) — a mismatch means generated code compiles against a different Jakarta REST generation than the runtime provides
+  - No coupling exists: generated model/API classes never import `jakarta.ws.rs`/`javax.ws.rs` (confined to `supportingFiles`, which are suppressed). Runtime Jersey version is independently pinned via `symphony-bdk-bom`'s `jersey-bom:4.0.0` import.
+- [x] 3.9 Fix the hand-written `symphony-bdk-http-api` invoker seam (`ApiClient`, `ApiResponse`, `Pair`, `TypeReference`) if 7.x changed how generated APIs call into it — `supportingFiles: "false"` means BDK owns these by hand
+  - No change needed: `api.mustache` output is byte-identical (aside from cosmetics) between versions, so the calling convention into the invoker seam is unchanged. Confirmed empirically — generated `com/symphony/bdk/http/api` dirs remain empty under `supportingFiles: "false"`.
+- [x] 3.10 Fix every hand-written call site affected by a changed generated signature
+  - None found: repo-wide grep for `*AllOf` (the only removed symbols) returns no hand-written hits; full `./gradlew build` is green with no source changes outside the two `buildSrc`/module `build.gradle` files and the one template line.
+- [x] 3.11 Confirm `skipOverwrite = true` and the `globalProperties` block still behave as intended under 7.x
+  - Confirmed: `supportingFiles: "false"` still suppresses all jersey3 supportingFiles; `skipOverwrite` still only affects already-existing output files. Full build green.
+
+## 4. Test Infrastructure on JDK 25
+
+- [x] 4.1 Add an explicit Mockito `-javaagent` to the test JVM arguments in `bdk.java-common-conventions.gradle`, resolved from the Mockito artifact (D3)
+  - Done: added a `mockitoAgent` configuration (resolved from `org.mockito:mockito-core`, versioned via the BOM platform, `transitive = false`) and wired `test { doFirst { jvmArgs "-javaagent:${configurations.mockitoAgent.asPath}" } }` in `bdk.java-common-conventions.gradle`. `doFirst` is required — eager `jvmArgs` in the `test {}` block resolved the configuration before the `dependencies {}` block added to it, failing with "Cannot mutate the dependencies of configuration ... after it was resolved".
+- [x] 4.2 Confirm no `-XX:+EnableDynamicAgentLoading` suppression is used anywhere (D3)
+  - Confirmed: no hits for `EnableDynamicAgentLoading` in the repo.
+- [x] 4.3 Confirm the Lombok version pinned in `symphony-bdk-bom` compiles all 13 Lombok-consuming modules on JDK 25
+  - Confirmed: `./gradlew build jacocoTestCoverageVerification` on Temurin 25.0.2 (active default JDK) is `BUILD SUCCESSFUL`, Lombok 1.18.46 pinned in the BOM unchanged.
+- [x] 4.4 Confirm the 3 ArchUnit architecture tests read class file version 69 — `CoreArchitectureTest`, `SymphonyGroupExtensionArchitectureTest`, `bdk-spring-boot-example/ArchitectureTest`
+  - Confirmed: all 3 pass running on JDK 25 (`./gradlew :symphony-bdk-core:test --tests "*CoreArchitectureTest*" :symphony-bdk-extensions:symphony-group-extension:test --tests "*SymphonyGroupExtensionArchitectureTest*" :symphony-bdk-examples:bdk-spring-boot-example:test --tests "*ArchitectureTest*"` → BUILD SUCCESSFUL).
+- [x] 4.5 Confirm `jacocoTestCoverageVerification` passes in every module on JDK 25 bytecode; if thresholds shift because of instrumentation counting rather than test changes, adjust them in a dedicated commit naming the JDK
+  - Confirmed: every module's `jacocoTestCoverageVerification` passes unchanged on JDK 25 bytecode (JaCoCo 0.8.15 already supports class file 69). No threshold adjustment needed.
+- [x] 4.6 Confirm the MapStruct processor and the Spring Boot configuration processor run on JDK 25, and that the generated `UserDetailMapperImpl` is unchanged from the Java 17 build
+  - Confirmed: `build/generated/sources/annotationProcessor/java/main/.../UserDetailMapperImpl.java` regenerated (`environment: Java 25.0.2 (Eclipse Adoptium)` in the `@Generated` comment) with identical mapping logic to the Java 17 build. Spring Boot configuration processor ran without error as part of the same green build.
+
+## 5. Release Pipeline (D5)
+
+- [x] 5.1 Add a branch guard to `release.yml`: `v3.*` tags must target the `3.x` branch, `v4.*` tags must target `main` — the current `^v[0-9]+\.[0-9]+\.[0-9]+$` regex validates tag shape only, and a mis-targeted release to Maven Central is immutable
+  - Done: `release.yml`'s version-derivation step now checks `github.event.release.target_commitish` — major version `3` must target `3.x`, any other major must target `main`. Also fixed a stale "Set up JDK 17" step name left over from task 2.5's version bump.
+- [x] 5.2 Verify the CLI distribution still builds and runs on JDK 25: `:symphony-bdk-cli:installDist`, then execute `bin/bdk`
+  - Confirmed: `./gradlew :symphony-bdk-cli:installDist` on Temurin 25.0.2 → BUILD SUCCESSFUL; `bin/bdk --help` runs and exits 0 with the expected usage output.
+- [x] 5.3 Verify `publishToSonatype` and the signing configuration work under the new JDK and Gradle combination
+  - Confirmed on JDK 25 without touching the real Sonatype endpoint (no credentials/GPG key available locally, and it's a remote/immutable target): `./gradlew tasks --all` resolves the full `nexus-publish-plugin` 1.3.0 task graph (`publishAllPublicationsToSonatypeRepository` etc.) with no configuration errors; `-PprojectVersion=99.0.0` (a release-shaped version, flips `isReleaseVersion` true) shows `signMavenPublication` correctly enters the task graph ahead of publish, confirming the `signing` plugin still wires up under Gradle 9 / JDK 25. Actual credentialed publish is exercised by the real release workflow in CI, not locally.
+- [x] 5.4 Verify `./gradlew dependencyCheck` runs on JDK 25 and review `allow-list.xml` against the Spring Boot 4 dependency set
+  - `./gradlew dependencyCheck` is now ambiguous under Gradle 9 (candidates: `dependencyCheckAggregate`/`Analyze`/`Purge`/`Update`); the correct multi-module task is `dependencyCheckAggregate` (task 7.5/CLAUDE.md should record this).
+  - First run on JDK 25 surfaced ~130 CVEs across 80 dependencies, none covered by the existing `allow-list.xml` (written for the Spring Boot 3.5.x / Netty 4.1.x dependency set). Nearly all were against major versions `migrate-spring-boot-4` already adopted — Spring Boot 4.0.0/Spring Framework 7.0.1, Netty 4.2.7.Final, Tomcat 11.0.14, Apache HttpComponents 5.x — that this was the first `dependencyCheck` run since. Root cause, not a JDK-25 problem.
+  - Resolved via same-minor patch bumps in `symphony-bdk-bom/build.gradle`: `spring-boot-dependencies` 4.0.0 → 4.0.7 (pulls Spring Framework 7.0.8, cleared all Spring-side CVEs), explicit `netty-bom` 4.2.16.Final (matches the version `mockserver-netty:7.5.0` itself was built against — 4.2.17.Final broke `ApiClientWebClientTest` via `ClientException`, 4.2.16.Final is green), `tomcat-embed-core`/`tomcat-embed-websocket` 11.0.14 → 11.0.24.
+  - Three findings needed a decision beyond same-minor scope (user confirmed): bumped `httpclient5` 5.5.2 → 5.6.4 and `httpcore5`/`httpcore5-h2` 5.3.6 → 5.4.3 (minor bump, real DoS/connection-leak fixes per Apache advisories, ahead of what `spring-boot-dependencies:4.0.7` pins); bumped `bdk-ai-agent-example`'s transitive `opennlp-tools` 2.5.9 → 2.5.11 via `implementation` (CVE-2026-63317 fix — first attempt used `runtimeOnly`, which missed the compileClasspath copy of the transitive dependency); added a documented `allow-list.xml` suppression for CVE-2026-66299 (Tomcat's bundled WebSocket *examples* webapp DoS — inapplicable, Spring Boot's embedded Tomcat never ships that webapp).
+  - Final state: `./gradlew dependencyCheckAggregate` → "Found 0 vulnerabilities"; `./gradlew build` green on JDK 25 with all version changes in place.
+
+## 6. Full Verification
+
+- [x] 6.1 `./gradlew build jacocoTestReport jacocoTestCoverageVerification` green on Java 25 + Spring Boot 4
+  - Confirmed: `./gradlew build jacocoTestReport jacocoTestCoverageVerification` on Temurin 25.0.2 → BUILD SUCCESSFUL, 221 actionable tasks.
+- [x] 6.2 Run the starter smoke tests from `migrate-spring-boot-4` section 2 — they are the check that autoconfiguration still works on the new JDK
+  - Confirmed: `SymphonyBdkCoreSmokeTest`, `SymphonyBdkAppSmokeTest`, `SymphonyBdkSpringBootTestSmokeTest` all pass with `--rerun` on Temurin 25.0.2.
+- [x] 6.3 Build every example module, including `bdk-ai-agent-example` (langchain4j) and `bdk-multi-instances-example`
+  - Confirmed: all 6 modules under `symphony-bdk-examples` build successfully on Temurin 25.0.2.
+- [x] 6.4 Confirm every published jar's class file version corresponds to Java 25 and that no module targets a different version
+  - Confirmed: every BDK-compiled class across all module jars (and BOOT-INF/classes in the two Boot example fat jars) reads class file major version 69 (Java 25). The only version-61 (Java 17) classes found are Spring Boot's own bundled `org/springframework/boot/loader/*` classes inside the fat jars — compiled by the Spring Boot Gradle plugin itself, not BDK code, and expected.
+- [x] 6.5 `./gradlew publishToMavenLocal` and confirm the coordinate set matches what `migrate-spring-boot-4` established
+  - Confirmed: `./gradlew publishToMavenLocal` on Temurin 25.0.2 → BUILD SUCCESSFUL. Published coordinate set under `org.finos.symphony.bdk` matches `migrate-spring-boot-4` task 9.5's expectation, notably with `symphony-bdk-http-jersey2` absent (module is `symphony-bdk-http-jersey`).
+
+## 7. Documentation and the 3.x Commitment
+
+- [x] 7.1 State Java 25 as a hard requirement in `docs/migration-4.x.md` and in the README — required, not recommended
+  - `docs/migration-4.x.md` already stated this (written during `migrate-spring-boot-4`'s archival with the full 4.x plan in view). Fixed the one place that had gone stale now that this change actually flipped the toolchain: `README.md`'s "Before you start" section said JDK 17 and claimed "`main` has not yet moved its build toolchain to 25" — updated to JDK 25, required not recommended, with a pointer to the `3.x` branch for JDK 17 builds.
+- [x] 7.2 Add the generated-API change summary from 3.2 to the migration guide, with before/after signatures for anything consumers construct or read directly
+  - Added `## 8. Generated API changes` to `docs/migration-4.x.md`, condensed from the "Consumer-facing summary" section of `generated-api-diff-summary.md`: the 21 unreferenced `*AllOf` classes removed, and an explicit statement that no other generated class changes shape, signatures, `equals`/`hashCode`/`toString`, or annotations.
+- [x] 7.3 Document that consumers using `symphony-bdk-test-jupiter` / `symphony-bdk-test-spring-boot` inherit the explicit Mockito agent configuration and must run tests on JDK 25
+  - Added to `docs/migration-4.x.md` section 7 ("Test dependencies"): the self-attach restriction consumers hit and the Gradle `-javaagent` configuration to work around it (mirroring D3's fix in `bdk.java-common-conventions`), plus the same warning against `-XX:+EnableDynamicAgentLoading`. Cross-linked from `docs/test.md`'s intro since that's where a consumer building on these test modules is more likely to land first.
+- [x] 7.4 **Record the 3.x support window** in the migration guide and release notes (D1). The guide cannot answer "what if I cannot move to Java 25" without it, and 4.0.0 must not ship without an answer
+  - Already recorded: `docs/migration-4.x.md`'s "Support window" section and `README.md`'s top banner both state the 6-month critical-security-fix window on `3.x` following 4.0.0's release, with the caveat that Spring itself gives no guarantee for superseded packages. There is no static release-notes file in this repo — GitHub release notes are auto-categorized from PR labels via `.github/release.yml` at publish time — so the migration guide and README are the durable, linkable statement of the window that a release description can point to.
+- [x] 7.5 Update `CLAUDE.md` with the Java 25 baseline and the JDK requirement for contributors
+  - Updated the Requirements section (toolchain target 17 → 25, clarified contributors need a JDK 25 available for toolchain provisioning), the `bdk.java-codegen-conventions` description (Jersey2 → Jersey3), the `bdk.java-common-conventions` description (notes the explicit Mockito agent), and the dependency-check command (`dependencyCheck` → `dependencyCheckAggregate`, per task 5.4's finding that the bare task name is now ambiguous under Gradle 9).
+- [x] 7.6 Confirm the versioned documentation set up by `migrate-spring-boot-4` task 10.3 keeps 3.x docs reachable for consumers who stay on the maintenance line
+  - Confirmed, no change needed: `.github/workflows/docs.yml` (from `migrate-spring-boot-4`'s archival commit `baa374a2`) already builds `main`'s docs at the site root and the `3.x` branch's own `docs/` into a `/3.x/` subtree, and `docs/_config.yml` carries a "BDK 3.x docs" aux link to `/3.x/`. This change added no new documentation surface that needs a 3.x equivalent.
diff --git a/openspec/specs/build-toolchain/spec.md b/openspec/specs/build-toolchain/spec.md
index e28d0f123..154da725e 100644
--- a/openspec/specs/build-toolchain/spec.md
+++ b/openspec/specs/build-toolchain/spec.md
@@ -1,7 +1,7 @@
 # Build-Toolchain Specification
 
 ### Requirement: Target Java version declared via a Gradle toolchain
-The build SHALL declare the target Java version through a Gradle Java toolchain in `bdk.java-common-conventions`, not through the project-level `sourceCompatibility` convention. The declared language version SHALL be the single source of truth for every module's target, so that changing the baseline is a one-line change in one file. The JDK running the Gradle daemon SHALL be independent of the declared toolchain version.
+The build SHALL declare the target Java version through a Gradle Java toolchain in `bdk.java-common-conventions`, not through the project-level `sourceCompatibility` convention. For BDK 4.x the declared `languageVersion` SHALL be **25**. The declared language version SHALL be the single source of truth for every module's target, so that changing the baseline is a one-line change in one file. The JDK running the Gradle daemon SHALL be independent of the declared toolchain version.
 
 #### Scenario: Baseline declared in exactly one place
 - **WHEN** the target Java version needs to change
@@ -15,11 +15,15 @@ The build SHALL declare the target Java version through a Gradle Java toolchain
 - **WHEN** any module is compiled
 - **THEN** `-parameters` is passed to `javac` and source encoding is UTF-8, so that Spring constructor binding and Jackson parameter-name resolution continue to work
 
+#### Scenario: Toolchain is provisionable in CI
+- **WHEN** CI runs the build on a runner whose preinstalled JDK does not match the declared toolchain
+- **THEN** Gradle provisions or locates a matching JDK 25 toolchain rather than silently compiling to a different version
+
 ### Requirement: Bytecode-processing tooling supports the target class file version
-Every tool in the build that reads, writes, or instruments bytecode — the Gradle distribution, Byte Buddy, MapStruct's annotation processor, Lombok, JaCoCo, ArchUnit, and the Mockito mock maker — SHALL be at a version that supports the class file version emitted by the declared toolchain. Versions SHALL be pinned explicitly where the build already pins them directly, rather than inherited implicitly from a third-party platform whose upgrade cadence the BDK does not control.
+Every tool in the build that reads, writes, or instruments bytecode — the Gradle distribution, Byte Buddy, MapStruct's annotation processor, Lombok, JaCoCo, ArchUnit, and the Mockito mock maker — SHALL be at a version that supports the class file version emitted by the declared toolchain. Versions SHALL be pinned explicitly where the build already pins them directly, rather than inherited implicitly from a third-party platform whose upgrade cadence the BDK does not control. Test-time bytecode instrumentation SHALL NOT depend on JVM self-attach; agents SHALL be configured explicitly via JVM arguments.
 
-#### Scenario: Build succeeds when the toolchain is raised to a newer JDK
-- **WHEN** the declared toolchain `languageVersion` is temporarily raised to the next Java LTS and `./gradlew build` is run
+#### Scenario: Build succeeds on the declared baseline
+- **WHEN** `./gradlew build` is run with the declared toolchain
 - **THEN** no task fails with an unsupported-class-file-version, unknown-constant-pool, or unsupported-source-release error
 
 #### Scenario: Lombok version is owned by this repository
@@ -30,6 +34,14 @@ Every tool in the build that reads, writes, or instruments bytecode — the Grad
 - **WHEN** the Gradle distribution version changes
 - **THEN** the JaCoCo tool version used for coverage does not change, because it is declared via `jacoco { toolVersion }`
 
+#### Scenario: Mock agent is attached explicitly
+- **WHEN** any module's tests run
+- **THEN** the Mockito agent is supplied as a `-javaagent` JVM argument, and no dynamic-agent-loading suppression flag is used to silence a self-attach warning
+
+#### Scenario: Coverage thresholds are not silently relaxed for instrumentation reasons
+- **WHEN** a JDK or JaCoCo change alters how lines are counted and a `jacocoTestCoverageVerification` minimum no longer passes
+- **THEN** the threshold change is made in a dedicated commit naming the JDK or JaCoCo version, so it cannot be mistaken for a real coverage regression
+
 ### Requirement: Build is free of deprecation warnings that block the next Gradle major
 `./gradlew build --warning-mode all` SHALL complete without emitting Gradle deprecation warnings. This applies to build scripts in every module and to the convention plugins in `buildSrc`.
 
diff --git a/openspec/specs/platform-baseline/spec.md b/openspec/specs/platform-baseline/spec.md
new file mode 100644
index 000000000..5c03b2f8a
--- /dev/null
+++ b/openspec/specs/platform-baseline/spec.md
@@ -0,0 +1,105 @@
+# Platform-Baseline Specification
+
+### Requirement: Supported Spring Boot line
+The BDK's Spring modules SHALL support exactly one Spring Boot major line per BDK major line. BDK 4.x SHALL require Spring Boot 4.x. Spring Boot 3.x combined with BDK 4.x SHALL NOT be supported, and the BDK SHALL NOT attempt cross-major compatibility through conditional autoconfiguration or runtime version detection. The requirement SHALL be stated in the migration guide and in the published documentation.
+
+#### Scenario: Consumer on the matching Spring Boot major
+- **WHEN** a consumer application uses Spring Boot 4.x and imports `symphony-bdk-bom` 4.x
+- **THEN** the BDK starters autoconfigure without the consumer overriding any Spring Boot managed version
+
+#### Scenario: Consumer on the previous Spring Boot major
+- **WHEN** a consumer application uses Spring Boot 3.x
+- **THEN** the documented answer is to stay on BDK 3.x, and no partial-compatibility path is offered
+
+### Requirement: Minimum Java version is declared and enforced by the build
+The BDK SHALL declare a single minimum Java version for all published modules, enforced by the Gradle toolchain and stated in the published documentation. For BDK 4.x that minimum SHALL be **Java 25**. Consumers SHALL NOT need to inspect class files to determine the requirement. The minimum SHALL be stated as a requirement rather than a recommendation, and the BDK SHALL NOT publish artifacts targeting an older Java version for the same major line.
+
+#### Scenario: Published bytecode matches the declared minimum
+- **WHEN** any published module's jar is inspected
+- **THEN** its class file version corresponds to Java 25, and no module targets a different version
+
+#### Scenario: Declared minimum is documented
+- **WHEN** the documentation states the Java requirement for a BDK major line
+- **THEN** it names the version that the released artifacts actually require, not the version an intermediate development state built against
+
+#### Scenario: Consumer on an older Java version
+- **WHEN** a consumer's runtime is Java 17 or Java 21
+- **THEN** BDK 4.x is not usable and the documented answer is the previous major line, not a partial-support path
+
+#### Scenario: Java requirement is stricter than the framework's
+- **WHEN** a consumer is on a Spring Boot version whose own Java baseline is lower than the BDK's
+- **THEN** the BDK's requirement governs, and the documentation states the BDK's Java requirement independently of Spring Boot's
+
+### Requirement: The previous major line has a stated support window
+When a new BDK major line raises the minimum Java version above what a substantial part of the consumer base can run, the previous major line SHALL be maintained as a supported line with a support window stated in writing before the new major is released. The window SHALL be reachable from the migration guide, and the previous line SHALL continue to receive security fixes for its duration.
+
+#### Scenario: Consumer cannot meet the new Java requirement
+- **WHEN** a consumer reads the migration guide and cannot run the required Java version
+- **THEN** the guide names the previous major line as their supported option and states how long it is maintained
+
+#### Scenario: Security fixes on the maintenance line
+- **WHEN** a vulnerability is found in a dependency shared by both lines, within the stated window
+- **THEN** the fix is released on the maintenance line as well as the current line
+
+#### Scenario: Support window is decided before the major ships
+- **WHEN** the new major version is released
+- **THEN** the support window for the previous line is already documented, not deferred to a later decision
+
+### Requirement: Release tag validation matches the branch to the major version
+The release pipeline SHALL verify that a release's target branch corresponds to the major version in its tag. Validating the tag's shape alone SHALL NOT be sufficient, because releases published to the artifact repository cannot be withdrawn.
+
+#### Scenario: Maintenance-line release targets the maintenance branch
+- **WHEN** a release is drafted with a tag for the previous major line
+- **THEN** the workflow fails unless the release targets that line's branch
+
+#### Scenario: Current-line release targets the default branch
+- **WHEN** a release is drafted with a tag for the current major line
+- **THEN** the workflow fails unless the release targets the default branch
+
+#### Scenario: Mis-targeted release is refused before publication
+- **WHEN** a tag's major version and its target branch disagree
+- **THEN** the workflow fails before any artifact is signed or uploaded
+
+### Requirement: Exactly one JSON binding implementation on the runtime classpath
+The BDK SHALL resolve to exactly one JSON databind implementation across all published modules. Two implementations of the same JSON binding library SHALL NOT be simultaneously resolvable, so that a given BDK operation serializes identically regardless of which HTTP implementation module is on the classpath.
+
+#### Scenario: Serialization does not depend on the HTTP module choice
+- **WHEN** the same BDK operation is performed with the Jersey HTTP implementation and with the WebClient HTTP implementation
+- **THEN** the wire representation is identical, because both use the same configured JSON mapper
+
+#### Scenario: A second databind implementation is rejected by the build
+- **WHEN** a dependency change would put two major versions of the JSON databind library on the runtime classpath
+- **THEN** the build fails a dependency-verification check rather than resolving both
+
+### Requirement: Nullability contract expressed in a maintained annotation vocabulary
+Public API nullability SHALL be expressed using JSpecify annotations. The BDK SHALL NOT use `javax.annotation.Nullable` or `javax.annotation.Nonnull` (JSR-305) in hand-written source, because JSR-305 is unmaintained and occupies the `javax.annotation` package, which conflicts with strict dependency analysis and module systems.
+
+#### Scenario: JSR-305 nullability annotations are absent from hand-written source
+- **WHEN** the architecture tests run
+- **THEN** no hand-written class imports `javax.annotation.Nullable` or `javax.annotation.Nonnull`, and the rule fails the build if one is reintroduced
+
+#### Scenario: Nullability defaulting is explicit per module
+- **WHEN** a module applies package-level `@NullMarked`
+- **THEN** the resulting contract for unannotated types has been verified to match the previously expressed JSR-305 intent, rather than being inherited by accident
+
+### Requirement: Published module coordinates name the technology they actually use
+Published artifactIds SHALL NOT name a technology generation the module does not use. When a module's underlying technology generation changes, its coordinate SHALL be corrected at the next major version. Coordinate renames SHALL be listed in the migration guide, and superseded coordinates SHALL NOT be published as relocation or forwarding artifacts.
+
+#### Scenario: Jersey HTTP module coordinate
+- **WHEN** a consumer inspects the dependency tree of the Jersey-based HTTP implementation
+- **THEN** the artifactId does not claim a Jersey major version other than the one actually resolved
+
+#### Scenario: Renamed coordinate is not aliased
+- **WHEN** a consumer depends on a coordinate that a previous major published but this major renamed
+- **THEN** resolution fails outright rather than resolving an empty forwarding artifact, and the migration guide names the replacement
+
+### Requirement: Starter autoconfiguration verified by booting a real application
+Each published Spring Boot starter SHALL have a test that boots a minimal `@SpringBootApplication` depending only on that starter and asserts the expected beans are present, exercising Spring Boot's autoconfiguration discovery mechanism. Tests that assemble a context directly from autoconfiguration classes SHALL NOT be the only verification, because they bypass the discovery mechanism that a framework upgrade can break.
+
+#### Scenario: Autoconfiguration registration is exercised end to end
+- **WHEN** the starter's autoconfiguration is not discovered — because a registration file path, a condition annotation package, or an autoconfiguration class location changed
+- **THEN** the starter smoke test fails, rather than passing because the test constructed the context explicitly
+
+#### Scenario: Re-exported test stack is verified from a consumer's perspective
+- **WHEN** `symphony-bdk-test-spring-boot` re-exports Spring Boot's test starter to consumers
+- **THEN** a test in a dependent module verifies that the re-exported stack works, so breakage is caught in this repository rather than by consumers
diff --git a/settings.gradle b/settings.gradle
index 69a4f4fbf..08a2d91cd 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -11,7 +11,7 @@ include(':symphony-bdk-cli')
 
 // http client
 include(':symphony-bdk-http:symphony-bdk-http-api')
-include(':symphony-bdk-http:symphony-bdk-http-jersey2')
+include(':symphony-bdk-http:symphony-bdk-http-jersey')
 include(':symphony-bdk-http:symphony-bdk-http-webclient')
 
 // template API
diff --git a/symphony-bdk-bom/build.gradle b/symphony-bdk-bom/build.gradle
index c47a8601a..505fbef49 100644
--- a/symphony-bdk-bom/build.gradle
+++ b/symphony-bdk-bom/build.gradle
@@ -5,6 +5,8 @@ plugins {
 }
 
 description = 'Symphony Java BDK Bom (Bill Of Materials)'
+// BDK 4.x requires Spring Boot 4.x. Spring Boot 3.x + BDK 4.x is not supported (D6 in
+// openspec/changes/migrate-spring-boot-4/design.md) — consumers on Spring Boot 3 should stay on BDK 3.x.
 
 javaPlatform {
     allowDependencies()
@@ -16,17 +18,17 @@ repositories {
 
 dependencies {
     // import Spring Boot's BOM
-    api platform('org.springframework.boot:spring-boot-dependencies:3.5.16')
-    // Security override: Spring Boot 3.5.16 pins Netty 4.1.135.Final, vulnerable to
-    // CVE-2026-44891, CVE-2026-55831, CVE-2026-55833 (all fixed in 4.1.136.Final).
-    // This higher constraint wins conflict resolution.
-    api platform('io.netty:netty-bom:4.1.136.Final')
-    // import Jackson's BOM
-    api platform('com.fasterxml.jackson:jackson-bom:2.18.8')
+    api platform('org.springframework.boot:spring-boot-dependencies:4.0.7')
+    // import Jackson 3's BOM. jackson-annotations has no 3.x release (JSTEP-1); the bom pins it at
+    // the matching 2.x version under its legacy com.fasterxml.jackson.core coordinate (D2).
+    api platform('tools.jackson:jackson-bom:3.2.1')
     // import Jersey's BOM
-    api platform('org.glassfish.jersey:jersey-bom:3.1.12')
+    api platform('org.glassfish.jersey:jersey-bom:4.0.0')
     // import Log4j's BOM
     api platform('org.apache.logging.log4j:log4j-bom:2.26.1')
+    // Netty and Tomcat patch releases ahead of what spring-boot-dependencies:4.0.7 pins, for CVE fixes
+    // on the same minor line (Netty 4.2.x, Tomcat 11.0.x) — reviewed as part of adopt-java-25-baseline.
+    api platform('io.netty:netty-bom:4.2.16.Final')
 
     // define all our dependencies versions
     constraints {
@@ -35,7 +37,7 @@ dependencies {
         api "org.finos.symphony.bdk:symphony-bdk-config:$project.version"
         api "org.finos.symphony.bdk:symphony-bdk-extension-api:$project.version"
         api "org.finos.symphony.bdk:symphony-bdk-http-api:$project.version"
-        api "org.finos.symphony.bdk:symphony-bdk-http-jersey2:$project.version"
+        api "org.finos.symphony.bdk:symphony-bdk-http-jersey:$project.version"
         api "org.finos.symphony.bdk:symphony-bdk-http-webclient:$project.version"
         api "org.finos.symphony.bdk:symphony-bdk-core-spring-boot-starter:$project.version"
         api "org.finos.symphony.bdk:symphony-bdk-app-spring-boot-starter:$project.version"
@@ -47,19 +49,18 @@ dependencies {
 
         // External dependencies
 
-        // Security override: Spring Boot 3.5.16 pins Tomcat 10.1.55, vulnerable to
-        // CVE-2026-53434, CVE-2026-55276, CVE-2026-53404, CVE-2026-55955, CVE-2026-55956,
-        // CVE-2026-50229 (fixed in 10.1.56), and CVE-2026-59083, CVE-2026-59084 (fixed in
-        // 10.1.57). This higher constraint wins conflict resolution.
-        api 'org.apache.tomcat.embed:tomcat-embed-core:10.1.57'
-        api 'org.apache.tomcat.embed:tomcat-embed-websocket:10.1.57'
-        api 'org.apache.tomcat.embed:tomcat-embed-el:10.1.57'
-
         // Owned by this repo rather than inherited from spring-boot-dependencies: Lombok lags
         // JDK releases and is used in 13 modules, so its version needs to move independently
         // of the Spring Boot version.
         api 'org.projectlombok:lombok:1.18.46'
 
+        api 'org.glassfish.jersey.connectors:jersey-apache5-connector:4.0.0'
+        // CVE-2026-64607 (httpclient5) and CVE-2026-54399/CVE-2026-54428 (httpcore5) fixes, ahead of
+        // what spring-boot-dependencies:4.0.7 pins (5.5.2 / 5.3.6)
+        api 'org.apache.httpcomponents.client5:httpclient5:5.6.4'
+        api 'org.apache.httpcomponents.core5:httpcore5:5.4.3'
+        api 'org.apache.httpcomponents.core5:httpcore5-h2:5.4.3'
+
         api 'org.apiguardian:apiguardian-api:1.1.2'
 
         api 'org.slf4j:slf4j-api:2.0.9'
@@ -74,14 +75,19 @@ dependencies {
         api 'com.brsanthu:migbase64:2.2'
         api 'io.jsonwebtoken:jjwt-api:0.13.0'
         api 'io.jsonwebtoken:jjwt-impl:0.13.0'
-        api 'io.jsonwebtoken:jjwt-jackson:0.13.0'
         api 'org.bouncycastle:bcpkix-jdk18on:1.79'
+        // Needed by openapi-generator's jersey2 library templates, which emit @javax.annotation.Nullable
+        // on generated model getters/setters (symphony-bdk-core, symphony-group-extension) — confirmed by
+        // inspecting generated sources, not by trusting the generator's changelog.
         api 'com.google.code.findbugs:jsr305:3.0.2'
+        api 'org.jspecify:jspecify:1.0.0'
 
         api 'io.github.resilience4j:resilience4j-retry:2.3.0'
 
         api 'io.swagger:swagger-annotations:1.6.14'
-        api 'org.openapitools:jackson-databind-nullable:0.2.6'
+        // 0.2.11+ is a multi-release jar with a Jackson 3 backend (JsonNullableJackson3Module),
+        // auto-selected when tools.jackson.databind is on the classpath.
+        api 'org.openapitools:jackson-databind-nullable:0.2.11'
 
         api 'org.freemarker:freemarker:2.3.33'
         api 'com.github.jknack:handlebars:4.5.1'
@@ -90,11 +96,10 @@ dependencies {
         api 'info.picocli:picocli:4.7.6'
 
         api 'com.tngtech.archunit:archunit-junit5:1.5.0'
+        api 'org.apache.tomcat.embed:tomcat-embed-core:11.0.24'
+        api 'org.apache.tomcat.embed:tomcat-embed-websocket:11.0.24'
         api 'org.mock-server:mockserver-netty:7.5.0'
         api 'org.assertj:assertj-core:3.27.7'
-
-        api 'jakarta.ws.rs:jakarta.ws.rs-api:3.1.0'
-        api 'jakarta.validation:jakarta.validation-api:3.0.2'
     }
 }
 
diff --git a/symphony-bdk-cli/build.gradle b/symphony-bdk-cli/build.gradle
index c965a35e0..9f3b000bb 100644
--- a/symphony-bdk-cli/build.gradle
+++ b/symphony-bdk-cli/build.gradle
@@ -24,15 +24,14 @@ dependencies {
     implementation project(':symphony-bdk-core')
 
     // self-contained distribution: bundle an HTTP implementation and a logging backend
-    runtimeOnly project(':symphony-bdk-http:symphony-bdk-http-jersey2')
+    runtimeOnly project(':symphony-bdk-http:symphony-bdk-http-jersey')
     runtimeOnly project(':symphony-bdk-template:symphony-bdk-template-freemarker')
 
     // command-line parsing
     implementation 'info.picocli:picocli'
 
     // JSON serialisation of command results
-    implementation 'com.fasterxml.jackson.core:jackson-databind'
-    implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310'
+    implementation 'tools.jackson.core:jackson-databind'
 
     // logging: routed to stderr by the bundled logback.xml; compiled against so verbosity can be tuned
     implementation 'ch.qos.logback:logback-classic'
diff --git a/symphony-bdk-cli/src/main/java/com/symphony/bdk/cli/internal/Json.java b/symphony-bdk-cli/src/main/java/com/symphony/bdk/cli/internal/Json.java
index d45bbd457..ed31ec715 100644
--- a/symphony-bdk-cli/src/main/java/com/symphony/bdk/cli/internal/Json.java
+++ b/symphony-bdk-cli/src/main/java/com/symphony/bdk/cli/internal/Json.java
@@ -1,13 +1,11 @@
 package com.symphony.bdk.cli.internal;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.ObjectWriter;
-import com.fasterxml.jackson.databind.SerializationFeature;
-import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
-
-import java.io.UncheckedIOException;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.ObjectWriter;
+import tools.jackson.databind.SerializationFeature;
+import tools.jackson.databind.cfg.DateTimeFeature;
+import tools.jackson.databind.json.JsonMapper;
 
 /**
  * Shared Jackson serialisation for CLI output.
@@ -18,11 +16,11 @@
  */
 public final class Json {
 
-  private static final ObjectMapper MAPPER = new ObjectMapper()
-      .registerModule(new JavaTimeModule())
-      .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
+  private static final ObjectMapper MAPPER = JsonMapper.builder()
+      .disable(DateTimeFeature.WRITE_DATES_AS_TIMESTAMPS)
       .disable(SerializationFeature.FAIL_ON_EMPTY_BEANS)
-      .setSerializationInclusion(JsonInclude.Include.NON_NULL);
+      .changeDefaultPropertyInclusion(inclusion -> inclusion.withValueInclusion(JsonInclude.Include.NON_NULL))
+      .build();
 
   private static final ObjectWriter PRETTY = MAPPER.writerWithDefaultPrettyPrinter();
   private static final ObjectWriter COMPACT = MAPPER.writer();
@@ -32,19 +30,11 @@ private Json() {
 
   /** Serialise {@code value} as an indented, multi-line JSON document. */
   public static String pretty(Object value) {
-    return write(PRETTY, value);
+    return PRETTY.writeValueAsString(value);
   }
 
   /** Serialise {@code value} as a single-line JSON document (one NDJSON record). */
   public static String compact(Object value) {
-    return write(COMPACT, value);
-  }
-
-  private static String write(ObjectWriter writer, Object value) {
-    try {
-      return writer.writeValueAsString(value);
-    } catch (JsonProcessingException e) {
-      throw new UncheckedIOException(e);
-    }
+    return COMPACT.writeValueAsString(value);
   }
 }
diff --git a/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/CommandTest.java b/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/CommandTest.java
index 60dbaab33..0732d058b 100644
--- a/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/CommandTest.java
+++ b/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/CommandTest.java
@@ -9,8 +9,8 @@
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
 import com.symphony.bdk.core.SymphonyBdk;
 import com.symphony.bdk.core.service.pagination.model.PaginationAttribute;
 import com.symphony.bdk.core.service.health.HealthService;
diff --git a/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/DatafeedReadTest.java b/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/DatafeedReadTest.java
index eed25c10d..aa378b8e0 100644
--- a/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/DatafeedReadTest.java
+++ b/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/DatafeedReadTest.java
@@ -8,7 +8,7 @@
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.databind.ObjectMapper;
 import com.symphony.bdk.core.SymphonyBdk;
 import com.symphony.bdk.core.service.datafeed.DatafeedLoop;
 import com.symphony.bdk.core.service.datafeed.RealTimeEventListener;
diff --git a/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/JsonOutputTest.java b/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/JsonOutputTest.java
index 5292fef0a..f9c45dd88 100644
--- a/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/JsonOutputTest.java
+++ b/symphony-bdk-cli/src/test/java/com/symphony/bdk/cli/JsonOutputTest.java
@@ -4,8 +4,8 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
 import com.symphony.bdk.core.SymphonyBdk;
 import com.symphony.bdk.core.service.session.SessionService;
 import com.symphony.bdk.gen.api.model.UserV2;
diff --git a/symphony-bdk-config/build.gradle b/symphony-bdk-config/build.gradle
index 80d5914b6..c1f22dc75 100644
--- a/symphony-bdk-config/build.gradle
+++ b/symphony-bdk-config/build.gradle
@@ -17,9 +17,9 @@ dependencies {
     implementation 'org.apache.commons:commons-lang3'
     implementation 'org.apache.commons:commons-text'
 
-    api 'com.fasterxml.jackson.core:jackson-databind'
-    api 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml'
-    api 'com.fasterxml.jackson.dataformat:jackson-dataformat-properties'
+    api 'tools.jackson.core:jackson-databind'
+    api 'tools.jackson.dataformat:jackson-dataformat-yaml'
+    api 'tools.jackson.dataformat:jackson-dataformat-properties'
 
     testImplementation 'org.junit.jupiter:junit-jupiter'
     testImplementation 'ch.qos.logback:logback-classic'
diff --git a/symphony-bdk-config/src/main/java/com/symphony/bdk/core/config/BdkConfigLoader.java b/symphony-bdk-config/src/main/java/com/symphony/bdk/core/config/BdkConfigLoader.java
index ecdbe5e88..2f96d00b9 100644
--- a/symphony-bdk-config/src/main/java/com/symphony/bdk/core/config/BdkConfigLoader.java
+++ b/symphony-bdk-config/src/main/java/com/symphony/bdk/core/config/BdkConfigLoader.java
@@ -3,13 +3,13 @@
 import com.symphony.bdk.core.config.exception.BdkConfigException;
 import com.symphony.bdk.core.config.model.BdkConfig;
 
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.json.JsonMapper;
-import com.fasterxml.jackson.dataformat.javaprop.JavaPropsMapper;
 import lombok.Generated;
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+import tools.jackson.dataformat.javaprop.JavaPropsMapper;
 
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
@@ -28,10 +28,12 @@ public class BdkConfigLoader {
   private static final JavaPropsMapper PROPS_MAPPER;
 
   static {
-    JSON_MAPPER = new JsonMapper();
-    PROPS_MAPPER = new JavaPropsMapper();
-    PROPS_MAPPER.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
-    JSON_MAPPER.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+    JSON_MAPPER = JsonMapper.builder()
+        .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+        .build();
+    PROPS_MAPPER = JavaPropsMapper.builder()
+        .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+        .build();
   }
 
   /**
diff --git a/symphony-bdk-config/src/main/java/com/symphony/bdk/core/config/BdkConfigParser.java b/symphony-bdk-config/src/main/java/com/symphony/bdk/core/config/BdkConfigParser.java
index 7e718b412..6a58b057b 100644
--- a/symphony-bdk-config/src/main/java/com/symphony/bdk/core/config/BdkConfigParser.java
+++ b/symphony-bdk-config/src/main/java/com/symphony/bdk/core/config/BdkConfigParser.java
@@ -2,39 +2,38 @@
 
 import com.symphony.bdk.core.config.exception.BdkConfigException;
 
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.json.JsonMapper;
-import com.fasterxml.jackson.databind.node.ObjectNode;
-import com.fasterxml.jackson.databind.node.TextNode;
-import com.fasterxml.jackson.dataformat.yaml.YAMLMapper;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.text.StringSubstitutor;
 import org.apache.commons.text.lookup.StringLookupFactory;
 import org.apiguardian.api.API;
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+import tools.jackson.databind.node.ObjectNode;
+import tools.jackson.databind.node.StringNode;
+import tools.jackson.dataformat.yaml.YAMLMapper;
 
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.nio.charset.StandardCharsets;
-import java.util.Iterator;
 import java.util.stream.Collectors;
 
 @Slf4j
 @API(status = API.Status.INTERNAL)
 class BdkConfigParser {
 
-  private static final ObjectMapper JSON_MAPPER = new JsonMapper();
-  private static final ObjectMapper YAML_MAPPER = new YAMLMapper();
+  private static final ObjectMapper JSON_MAPPER = JsonMapper.builder()
+      .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+      .build();
+  private static final ObjectMapper YAML_MAPPER = YAMLMapper.builder()
+      .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+      .build();
   private final StringSubstitutor envVarStringSubstitutor;
 
-  static {
-    JSON_MAPPER.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
-    YAML_MAPPER.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
-  }
-
   public BdkConfigParser() {
     envVarStringSubstitutor = new StringSubstitutor(StringLookupFactory.INSTANCE.environmentVariableStringLookup());
   }
@@ -56,17 +55,17 @@ public JsonNode parseJsonNode(InputStream inputStream) throws BdkConfigException
     }
     try {
       return JSON_MAPPER.readTree(content);
-    } catch (IOException e) {
+    } catch (JacksonException e) {
       log.debug("Config file is not in JSON format.");
     }
 
     try {
       JsonNode jsonNode = YAML_MAPPER.readTree(content);
-      if (jsonNode.isContainerNode()) {
+      if (jsonNode.isContainer()) {
         log.debug("Config file found in YAML format.");
         return jsonNode;
       }
-    } catch (IOException e) {
+    } catch (JacksonException e) {
       log.debug("Config file is not in YAML format.");
     }
     throw new BdkConfigException("Given InputStream is not valid. Only YAML or JSON are allowed.");
@@ -83,9 +82,8 @@ public void interpolateProperties(JsonNode jsonNode) {
   }
 
   private void interpolatePropertiesInObject(ObjectNode objectNode) {
-    final Iterator<String> fieldNames = objectNode.fieldNames();
-    while (fieldNames.hasNext()) {
-      interpolatePropertyInField(objectNode, fieldNames.next());
+    for (final String field : objectNode.propertyNames()) {
+      interpolatePropertyInField(objectNode, field);
     }
   }
 
@@ -95,7 +93,7 @@ private void interpolatePropertyInField(ObjectNode objectNode, String field) {
       //Start by replacing any java system properties found, then match any remaining keys with environment variables
       final String interpolatedFieldValue =
           envVarStringSubstitutor.replace(StringSubstitutor.replaceSystemProperties(node.asText()));
-      objectNode.set(field, new TextNode(interpolatedFieldValue));
+      objectNode.set(field, new StringNode(interpolatedFieldValue));
     } else if (node.isObject() || node.isArray()) {
       interpolateProperties(node);
     }
diff --git a/symphony-bdk-core/build.gradle b/symphony-bdk-core/build.gradle
index 56a87f99e..54c83a567 100644
--- a/symphony-bdk-core/build.gradle
+++ b/symphony-bdk-core/build.gradle
@@ -49,16 +49,19 @@ dependencies {
     implementation 'com.brsanthu:migbase64'
     implementation 'io.jsonwebtoken:jjwt-api'
     runtimeOnly 'io.jsonwebtoken:jjwt-impl'
-    runtimeOnly 'io.jsonwebtoken:jjwt-jackson'
     implementation 'org.bouncycastle:bcpkix-jdk18on'
-    api 'com.fasterxml.jackson.core:jackson-databind'
+    api 'tools.jackson.core:jackson-databind'
     implementation 'io.github.resilience4j:resilience4j-retry'
     implementation 'io.swagger:swagger-annotations'
+    // Generated model classes are annotated with @javax.annotation.Nullable by our custom pojo.mustache
+    // template (JSR-305, never renamed to the jakarta namespace — unrelated to the jersey3/Jakarta EE move).
     implementation 'com.google.code.findbugs:jsr305'
-    implementation 'javax.annotation:jsr250-api:1.0'
+    implementation 'org.jspecify:jspecify'
+    // jersey3 forces useJakartaEe, so the generated @Generated annotation is jakarta.annotation.Generated.
+    implementation 'jakarta.annotation:jakarta.annotation-api'
     implementation 'jakarta.ws.rs:jakarta.ws.rs-api'
 
-    testImplementation project(':symphony-bdk-http:symphony-bdk-http-jersey2')
+    testImplementation project(':symphony-bdk-http:symphony-bdk-http-jersey')
     testRuntimeOnly project(':symphony-bdk-template:symphony-bdk-template-freemarker')
 
     testCompileOnly 'org.projectlombok:lombok'
@@ -100,7 +103,7 @@ apisToGenerate.each { api, path ->
     def generateTask = tasks.register("generate$api", org.openapitools.generator.gradle.plugin.tasks.GenerateTask) {
         dependsOn downloadTask
         generatorName = 'java'
-        library = 'jersey2'
+        library = 'jersey3'
         outputDir = generatedFolder
         inputSpec = "${layout.buildDirectory.get()}/openapi/$api/${path.split("/")[1]}"
         skipOverwrite = true
@@ -121,6 +124,34 @@ apisToGenerate.each { api, path ->
                 dateLibrary: "java8",
                 sortParamsByRequiredFlag: "false"
         ]
+        // AbstractJavaCodegen.processOpts() hardcodes JsonSerialize/JsonDeserialize/ToStringSerializer
+        // as Jackson 2 databind imports (used for Set-typed properties) after any configured
+        // importMapping override is applied, so the only way to redirect them is a post-generation
+        // rewrite. BDK 4.x is Jackson 3 only (D2/task 6.7) — these must not reintroduce
+        // jackson-databind 2 on the classpath.
+        doLast {
+            fileTree(generatedFolder) { include '**/*.java' }.each { javaFile ->
+                def original = javaFile.text
+                def rewritten = original
+                        .replace('com.fasterxml.jackson.databind.annotation.JsonSerialize', 'tools.jackson.databind.annotation.JsonSerialize')
+                        .replace('com.fasterxml.jackson.databind.annotation.JsonDeserialize', 'tools.jackson.databind.annotation.JsonDeserialize')
+                        .replace('com.fasterxml.jackson.databind.ser.std.ToStringSerializer', 'tools.jackson.databind.ser.std.ToStringSerializer')
+                if (rewritten != original) {
+                    javaFile.text = rewritten
+                }
+            }
+            // jersey3 forces useJakartaEe, so upstream imports must all resolve to the jakarta namespace.
+            // pojo.mustache's own @javax.annotation.Nullable is a JSR-305 annotation, applied inline without
+            // an import statement, so it never trips this check.
+            def strayJavaxImports = fileTree(generatedFolder) { include '**/*.java' }.findAll { javaFile ->
+                javaFile.text.readLines().any { it.startsWith('import javax.') }
+            }
+            if (!strayJavaxImports.isEmpty()) {
+                throw new GradleException("Generated sources import javax.* even though library=jersey3 " +
+                        "(useJakartaEe) is set — the Jakarta patch was lost in a template rebase: " +
+                        strayJavaxImports.collect { it.path }.join(', '))
+            }
+        }
     }
 
     compileJava.dependsOn generateTask
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/OboServices.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/OboServices.java
index 6a93b60bb..51b4dbf25 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/OboServices.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/OboServices.java
@@ -15,7 +15,7 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Entry point for OBO-enabled services.
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/ServiceFactory.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/ServiceFactory.java
index 0390aee0f..dad6b00b9 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/ServiceFactory.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/ServiceFactory.java
@@ -56,7 +56,7 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Factory responsible for creating BDK service instances for Symphony Bdk entry point.
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/SymphonyBdk.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/SymphonyBdk.java
index 4e0e6b6e4..4b367dd48 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/SymphonyBdk.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/SymphonyBdk.java
@@ -38,8 +38,7 @@
 import java.util.List;
 import java.util.Optional;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * BDK entry point.
@@ -76,7 +75,6 @@ public class SymphonyBdk {
   private final MessageSenderOverride messageSenderOverride;
   private final MessageRetrieverOverride messageRetrieverOverride;
 
-
   /**
    * Returns a new {@link SymphonyBdkBuilder} for fluent initialization.
    *
@@ -97,12 +95,12 @@ public static SymphonyBdkBuilder builder() {
    * @throws AuthInitializationException when unable to read/parse a RSA Private Key or a certificate
    * @throws AuthUnauthorizedException authentication issue (e.g. 401)
    */
-  public SymphonyBdk(@Nonnull BdkConfig config) throws AuthInitializationException, AuthUnauthorizedException {
+  public SymphonyBdk(BdkConfig config) throws AuthInitializationException, AuthUnauthorizedException {
     this(config, null, null, Collections.emptyList());
   }
 
   protected SymphonyBdk(
-      @Nonnull BdkConfig config,
+      BdkConfig config,
       @Nullable ApiClientFactory apiClientFactory,
       @Nullable AuthenticatorFactory authenticatorFactory
   ) throws AuthInitializationException, AuthUnauthorizedException {
@@ -110,10 +108,10 @@ protected SymphonyBdk(
   }
 
   protected SymphonyBdk(
-      @Nonnull BdkConfig config,
+      BdkConfig config,
       @Nullable ApiClientFactory apiClientFactory,
       @Nullable AuthenticatorFactory authenticatorFactory,
-      @Nonnull List<Class<? extends BdkExtension>> preRegisteredExtensions
+      List<Class<? extends BdkExtension>> preRegisteredExtensions
   ) throws AuthInitializationException, AuthUnauthorizedException {
 
     this.config = config;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/SymphonyBdkBuilder.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/SymphonyBdkBuilder.java
index 50b341535..e65e5e06a 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/SymphonyBdkBuilder.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/SymphonyBdkBuilder.java
@@ -16,8 +16,7 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Fluent builder for advanced configuration of the {@link SymphonyBdk} entry point.
@@ -45,7 +44,7 @@ public class SymphonyBdkBuilder {
    * @return updated builder.
    * @see com.symphony.bdk.core.config.BdkConfigLoader
    */
-  public SymphonyBdkBuilder config(@Nonnull BdkConfig config) {
+  public SymphonyBdkBuilder config(BdkConfig config) {
     this.config = config;
     return this;
   }
@@ -89,7 +88,7 @@ public SymphonyBdkBuilder authenticatorFactory(@Nullable AuthenticatorFactory au
    * @param extension {@link BdkExtension} class to be registered.
    * @return updated builder.
    */
-  public SymphonyBdkBuilder extension(@Nonnull Class<? extends BdkExtension> extension) {
+  public SymphonyBdkBuilder extension(Class<? extends BdkExtension> extension) {
     this.extensions.add(extension);
     return this;
   }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/HelpCommand.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/HelpCommand.java
index 3d8fe1f4c..7d1d70b47 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/HelpCommand.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/HelpCommand.java
@@ -13,8 +13,6 @@
 import java.util.Objects;
 import java.util.stream.Collectors;
 
-import javax.annotation.Nonnull;
-
 /**
  * A help command listing all the commands that can be performed by an end-user through the chat.
  */
@@ -26,7 +24,7 @@ public class HelpCommand extends SlashCommand {
   private final ActivityRegistry activityRegistry;
   private final MessageService messageService;
 
-  public HelpCommand(@Nonnull ActivityRegistry activityRegistry, @Nonnull MessageService messageService) {
+  public HelpCommand(ActivityRegistry activityRegistry, MessageService messageService) {
     super(HELP_COMMAND, true, false, c -> {}, DEFAULT_DESCRIPTION);
     this.activityRegistry = activityRegistry;
     this.messageService = messageService;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/SlashCommand.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/SlashCommand.java
index 822b8ba47..fba328053 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/SlashCommand.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/SlashCommand.java
@@ -15,8 +15,6 @@
 import java.util.Objects;
 import java.util.function.Consumer;
 
-import javax.annotation.Nonnull;
-
 /**
  * A "slash" command if the most basic action that can be performed by an end-user through the chat.
  */
@@ -37,7 +35,7 @@ public class SlashCommand extends CommandActivity<CommandContext> {
    * @param slashCommandPattern Pattern of the command (ex: '/gif' or 'gif {option} {{@literal @}mention}').
    * @param callback            Callback to be processed when command is detected.
    */
-  public static SlashCommand slash(@Nonnull String slashCommandPattern, @Nonnull Consumer<CommandContext> callback) {
+  public static SlashCommand slash(String slashCommandPattern, Consumer<CommandContext> callback) {
     return slash(slashCommandPattern, true, callback);
   }
 
@@ -49,8 +47,8 @@ public static SlashCommand slash(@Nonnull String slashCommandPattern, @Nonnull C
    * @param callback            Callback to be processed when command is detected.
    * @throws IllegalArgumentException if command name if empty.
    */
-  public static SlashCommand slash(@Nonnull String slashCommandPattern, boolean requiresBotMention,
-      @Nonnull Consumer<CommandContext> callback) {
+  public static SlashCommand slash(String slashCommandPattern, boolean requiresBotMention,
+      Consumer<CommandContext> callback) {
     return new SlashCommand(slashCommandPattern, requiresBotMention, false, callback, "");
   }
 
@@ -62,7 +60,7 @@ public static SlashCommand slash(@Nonnull String slashCommandPattern, boolean re
    * @param description         The summary of the command.
    * @return a {@link SlashCommand} instance.
    */
-  public static SlashCommand slash(@Nonnull String slashCommandPattern, @Nonnull Consumer<CommandContext> callback,
+  public static SlashCommand slash(String slashCommandPattern, Consumer<CommandContext> callback,
       String description) {
     return slash(slashCommandPattern, true, false, callback, description);
   }
@@ -76,8 +74,8 @@ public static SlashCommand slash(@Nonnull String slashCommandPattern, @Nonnull C
    * @param description         The summary of the command.
    * @return a {@link SlashCommand} instance.
    */
-  public static SlashCommand slash(@Nonnull String slashCommandPattern, boolean requiresBotMention,
-      @Nonnull Consumer<CommandContext> callback, String description) {
+  public static SlashCommand slash(String slashCommandPattern, boolean requiresBotMention,
+      Consumer<CommandContext> callback, String description) {
     return new SlashCommand(slashCommandPattern, requiresBotMention, false, callback, description);
   }
 
@@ -91,16 +89,16 @@ public static SlashCommand slash(@Nonnull String slashCommandPattern, boolean re
    * @param description         The summary of the command.
    * @return a {@link SlashCommand} instance.
    */
-  public static SlashCommand slash(@Nonnull String slashCommandPattern, boolean requiresBotMention, boolean isAsync,
-      @Nonnull Consumer<CommandContext> callback, String description) {
+  public static SlashCommand slash(String slashCommandPattern, boolean requiresBotMention, boolean isAsync,
+      Consumer<CommandContext> callback, String description) {
     return new SlashCommand(slashCommandPattern, requiresBotMention, isAsync, callback, description);
   }
 
   /**
    * Default protected constructor, new instances from static methods only.
    */
-  protected SlashCommand(@Nonnull String slashCommandPattern, boolean requiresBotMention, boolean isAsync,
-      @Nonnull Consumer<CommandContext> callback, String description) {
+  protected SlashCommand(String slashCommandPattern, boolean requiresBotMention, boolean isAsync,
+      Consumer<CommandContext> callback, String description) {
     this.slashCommandName = slashCommandPattern;
     this.commandPattern = new SlashCommandPattern(this.slashCommandName);
     this.requiresBotMention = requiresBotMention;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/package-info.java
new file mode 100644
index 000000000..010042daf
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/command/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.activity.command;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/FormReplyActivity.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/FormReplyActivity.java
index 772366bb8..006662308 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/FormReplyActivity.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/FormReplyActivity.java
@@ -6,10 +6,10 @@
 import com.symphony.bdk.core.service.datafeed.RealTimeEventListener;
 import com.symphony.bdk.gen.api.model.V4SymphonyElementsAction;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.json.JsonMapper;
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 
 import java.util.function.Consumer;
 
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/FormReplyContext.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/FormReplyContext.java
index 1016e7ab6..af24b4071 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/FormReplyContext.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/FormReplyContext.java
@@ -4,12 +4,12 @@
 import com.symphony.bdk.gen.api.model.V4Initiator;
 import com.symphony.bdk.gen.api.model.V4SymphonyElementsAction;
 
-import com.fasterxml.jackson.databind.JsonNode;
 import lombok.Getter;
 import lombok.Setter;
 import org.apiguardian.api.API;
+import tools.jackson.databind.JsonNode;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Default implementation of the {@link ActivityContext} handled by the {@link FormReplyActivity}.
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/package-info.java
new file mode 100644
index 000000000..cf6f9a29f
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/form/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.activity.form;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/parsing/InputTokenizer.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/parsing/InputTokenizer.java
index 29bf597dc..7f1eb65e6 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/parsing/InputTokenizer.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/activity/parsing/InputTokenizer.java
@@ -5,14 +5,14 @@
 import com.symphony.bdk.core.service.message.util.EntityTypeEnum;
 import com.symphony.bdk.gen.api.model.V4Message;
 
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.apiguardian.api.API;
 import org.w3c.dom.Document;
 import org.w3c.dom.Node;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
 
 import java.io.ByteArrayInputStream;
 import java.nio.charset.StandardCharsets;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AppAuthSession.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AppAuthSession.java
index 9ad3bbbab..24d3bcbc8 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AppAuthSession.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AppAuthSession.java
@@ -4,7 +4,7 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Extension App Authentication session handle. The {@link AppAuthSession#refresh()} will trigger a re-auth against the API endpoints.
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AuthSession.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AuthSession.java
index 17424846e..882c1c035 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AuthSession.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AuthSession.java
@@ -4,7 +4,7 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Authentication session handle. The {@link AuthSession#refresh()} will trigger a re-auth against the API endpoints.
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AuthenticatorFactory.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AuthenticatorFactory.java
index e97b2a3a2..53cde03b5 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AuthenticatorFactory.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/AuthenticatorFactory.java
@@ -4,8 +4,6 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Factory responsible for creating different authenticators.
  * <ul>
@@ -23,7 +21,6 @@ public interface AuthenticatorFactory {
    * @return a new {@link BotAuthenticator} instance.
    * @throws AuthInitializationException if the authenticator cannot be instantiated.
    */
-  @Nonnull
   BotAuthenticator getBotAuthenticator() throws AuthInitializationException;
 
   /**
@@ -32,7 +29,6 @@ public interface AuthenticatorFactory {
    * @return a new {@link OboAuthenticator} instance.
    * @throws AuthInitializationException if the authenticator cannot be instantiated.
    */
-  @Nonnull
   OboAuthenticator getOboAuthenticator() throws AuthInitializationException;
 
   /**
@@ -41,7 +37,6 @@ public interface AuthenticatorFactory {
    * @return a new {@link ExtensionAppAuthenticator} instance.
    * @throws AuthInitializationException if the authenticator cannot be instantiated.
    */
-  @Nonnull
   ExtensionAppAuthenticator getExtensionAppAuthenticator() throws AuthInitializationException;
 
   /**
@@ -50,6 +45,5 @@ public interface AuthenticatorFactory {
    * @return a new {@link ExtAppAuthenticator} instance.
    * @throws AuthInitializationException if the authenticator cannot be instantiated.
    */
-  @Nonnull
   ExtAppAuthenticator getExtAppAuthenticator() throws AuthInitializationException;
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/BotAuthenticator.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/BotAuthenticator.java
index 224e5cf84..304549b30 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/BotAuthenticator.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/BotAuthenticator.java
@@ -3,8 +3,6 @@
 import com.symphony.bdk.core.auth.exception.AuthUnauthorizedException;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Bot authenticator service.
  */
@@ -16,5 +14,5 @@ public interface BotAuthenticator {
    *
    * @return the authentication session.
    */
-  @Nonnull AuthSession authenticateBot() throws AuthUnauthorizedException;
+  AuthSession authenticateBot() throws AuthUnauthorizedException;
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtAppAuthSession.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtAppAuthSession.java
index 6a275990a..2fdedef5f 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtAppAuthSession.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtAppAuthSession.java
@@ -4,7 +4,7 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Extension App Authentication session handle. The {@link ExtAppAuthSession#refresh()} will trigger a re-auth against the API endpoints.
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtAppAuthenticator.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtAppAuthenticator.java
index b342d2868..3ce107971 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtAppAuthenticator.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtAppAuthenticator.java
@@ -3,8 +3,6 @@
 import com.symphony.bdk.core.auth.exception.AuthUnauthorizedException;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Extension App authenticator service.
  */
@@ -16,5 +14,5 @@ public interface ExtAppAuthenticator {
    *
    * @return the authentication session.
    */
-  @Nonnull ExtAppAuthSession authenticateExtApp() throws AuthUnauthorizedException;
+  ExtAppAuthSession authenticateExtApp() throws AuthUnauthorizedException;
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtensionAppAuthenticator.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtensionAppAuthenticator.java
index 9390ef076..a6e7fbbba 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtensionAppAuthenticator.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/ExtensionAppAuthenticator.java
@@ -8,8 +8,6 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Extension App Authenticator Service.
  */
@@ -23,7 +21,6 @@ public interface ExtensionAppAuthenticator {
    * @return the extension app authentication session.
    * @throws AuthUnauthorizedException when the bot is unauthorized.
    */
-  @Nonnull
   AppAuthSession authenticateExtensionApp(String appToken) throws AuthUnauthorizedException;
 
   /**
@@ -42,7 +39,6 @@ public interface ExtensionAppAuthenticator {
    */
   boolean validateTokens(String appToken, String symphonyToken);
 
-
   /**
    * Validates a JWT against the pod certificate
    *
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/OboAuthenticator.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/OboAuthenticator.java
index 9ec409e01..b8fc8b741 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/OboAuthenticator.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/OboAuthenticator.java
@@ -3,8 +3,6 @@
 import com.symphony.bdk.core.auth.exception.AuthUnauthorizedException;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * On-behalf-of authenticator service.
  */
@@ -17,7 +15,7 @@ public interface OboAuthenticator {
    * @param username Username of the user.
    * @return the authentication session.
    */
-  @Nonnull AuthSession authenticateByUsername(@Nonnull String username) throws AuthUnauthorizedException;
+  AuthSession authenticateByUsername(String username) throws AuthUnauthorizedException;
 
   /**
    * Authenticates on behalf of a particular user using his userId.
@@ -25,5 +23,5 @@ public interface OboAuthenticator {
    * @param userId Id of the user.
    * @return the authentication sessions.
    */
-  @Nonnull AuthSession authenticateByUserId(@Nonnull Long userId) throws AuthUnauthorizedException;
+  AuthSession authenticateByUserId(Long userId) throws AuthUnauthorizedException;
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/AuthInitializationException.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/AuthInitializationException.java
index 63e58dc7c..300deed73 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/AuthInitializationException.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/AuthInitializationException.java
@@ -2,19 +2,17 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Thrown when unable to read/parse a RSA Private Key or a certificate.
  */
 @API(status = API.Status.STABLE)
 public class AuthInitializationException extends Exception {
 
-  public AuthInitializationException(@Nonnull String message) {
+  public AuthInitializationException(String message) {
     super(message);
   }
 
-  public AuthInitializationException(@Nonnull String message, @Nonnull Throwable source) {
+  public AuthInitializationException(String message, Throwable source) {
     super(message, source);
   }
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/AuthUnauthorizedException.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/AuthUnauthorizedException.java
index 8ecdabd68..5cca41d74 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/AuthUnauthorizedException.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/AuthUnauthorizedException.java
@@ -4,8 +4,6 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * When thrown, it means that authentication cannot be performed for several reasons depending on the context :
  * <ul>
@@ -16,11 +14,11 @@
 @API(status = API.Status.STABLE)
 public class AuthUnauthorizedException extends Exception {
 
-  public AuthUnauthorizedException(@Nonnull String message) {
+  public AuthUnauthorizedException(String message) {
     super(message);
   }
 
-  public AuthUnauthorizedException(@Nonnull String message, @Nonnull ApiException source) {
+  public AuthUnauthorizedException(String message, ApiException source) {
     super(message, source);
   }
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/package-info.java
new file mode 100644
index 000000000..48047eae3
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/exception/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.auth.exception;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AbstractBotAuthenticator.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AbstractBotAuthenticator.java
index 832342b44..d4e7870f2 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AbstractBotAuthenticator.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AbstractBotAuthenticator.java
@@ -14,8 +14,6 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Abstract class to factorize the {@link BotAuthenticator} logic between RSA and certificate,
  * especially the retry logic on top of HTTP calls.
@@ -34,8 +32,8 @@ public abstract class AbstractBotAuthenticator implements BotAuthenticator {
   private final boolean agentConfigured;
 
   protected AbstractBotAuthenticator(BdkRetryConfig retryConfig,
-      @Nonnull BdkCommonJwtConfig commonJwtConfig, @Nonnull ApiClient loginApiClient,
-      @Nonnull AgentVersionService agentVersionService, boolean agentConfigured) {
+      BdkCommonJwtConfig commonJwtConfig, ApiClient loginApiClient,
+      AgentVersionService agentVersionService, boolean agentConfigured) {
     kmAuthenticationRetry = new AuthenticationRetry<>(retryConfig);
     podAuthenticationRetry = new AuthenticationRetry<>(retryConfig);
     idmAuthenticationRetry = new AuthenticationRetry<>(retryConfig);
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AbstractOboAuthenticator.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AbstractOboAuthenticator.java
index 2b56e6576..9cf86ae07 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AbstractOboAuthenticator.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AbstractOboAuthenticator.java
@@ -8,8 +8,6 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Abstract class to factorize the {@link OboAuthenticator} logic between RSA and certificate,
  * especially the retry logic on top of HTTP calls.
@@ -26,7 +24,7 @@ protected AbstractOboAuthenticator(BdkRetryConfig retryConfig, String appId) {
     this.authenticationRetry = new AuthenticationRetry<>(retryConfig);
   }
 
-  protected String retrieveOboSessionTokenByUserId(@Nonnull Long userId) throws AuthUnauthorizedException {
+  protected String retrieveOboSessionTokenByUserId(Long userId) throws AuthUnauthorizedException {
     final String appSessionToken = retrieveAppSessionToken();
 
     final String unauthorizedErrorMessage = "Unable to authenticate on-behalf-of user with ID '" + userId + "'. "
@@ -36,7 +34,7 @@ protected String retrieveOboSessionTokenByUserId(@Nonnull Long userId) throws Au
         () -> authenticateAndRetrieveOboSessionToken(appSessionToken, userId), unauthorizedErrorMessage);
   }
 
-  protected String retrieveOboSessionTokenByUsername(@Nonnull String username) throws AuthUnauthorizedException {
+  protected String retrieveOboSessionTokenByUsername(String username) throws AuthUnauthorizedException {
     final String appSessionToken = retrieveAppSessionToken();
 
     final String unauthorizedErrorMessage =
@@ -57,11 +55,11 @@ protected String retrieveAppSessionToken() throws AuthUnauthorizedException {
         this::authenticateAndRetrieveAppSessionToken, unauthorizedErrorMessage);
   }
 
-  protected abstract String authenticateAndRetrieveOboSessionToken(@Nonnull String appSessionToken,
-      @Nonnull Long userId) throws ApiException;
+  protected abstract String authenticateAndRetrieveOboSessionToken(String appSessionToken,
+      Long userId) throws ApiException;
 
-  protected abstract String authenticateAndRetrieveOboSessionToken(@Nonnull String appSessionToken,
-      @Nonnull String username) throws ApiException;
+  protected abstract String authenticateAndRetrieveOboSessionToken(String appSessionToken,
+      String username) throws ApiException;
 
   protected abstract String authenticateAndRetrieveAppSessionToken() throws ApiException;
 
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AppAuthSessionRsaImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AppAuthSessionRsaImpl.java
index 4b268b8ce..0e068e2e2 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AppAuthSessionRsaImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AppAuthSessionRsaImpl.java
@@ -7,7 +7,7 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * {@link AppAuthSession} impl for rsa extension app authentication mode.
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionImpl.java
index f10b07e96..6f80a7cc5 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionImpl.java
@@ -6,16 +6,14 @@
 import com.symphony.bdk.core.service.version.model.AgentVersion;
 import com.symphony.bdk.gen.api.model.Token;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import org.apiguardian.api.API;
+import tools.jackson.core.JacksonException;
 
 import java.time.Duration;
 import java.time.Instant;
 import java.util.Optional;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
+import org.jspecify.annotations.Nullable;
 
 /**
  * {@link AuthSession} impl for regular authentication mode.
@@ -42,8 +40,7 @@ public class AuthSessionImpl implements AuthSession {
   private String authorizationToken;
   private Long authTokenExpirationDate;
 
-
-  public AuthSessionImpl(@Nonnull AbstractBotAuthenticator authenticator) {
+  public AuthSessionImpl(AbstractBotAuthenticator authenticator) {
     this.authenticator = authenticator;
   }
 
@@ -113,7 +110,7 @@ private void refreshExpirationDate() throws AuthUnauthorizedException {
     if (this.authorizationToken != null) {
       try {
         this.authTokenExpirationDate = JwtHelper.extractExpirationDate(authorizationToken);
-      } catch (JsonProcessingException | AuthUnauthorizedException e) {
+      } catch (JacksonException | AuthUnauthorizedException e) {
         throw new AuthUnauthorizedException("Unable to parse the Authorization token received.");
       }
     }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionOboCertImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionOboCertImpl.java
index 519c235b1..f4e7b9a14 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionOboCertImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionOboCertImpl.java
@@ -7,8 +7,7 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * {@link AuthSession} impl for OBO Certificate authentication mode.
@@ -22,13 +21,13 @@ public class AuthSessionOboCertImpl implements AuthSession {
 
   private String sessionToken;
 
-  public AuthSessionOboCertImpl(@Nonnull OboAuthenticatorCertImpl authenticator, @Nonnull Long userId) {
+  public AuthSessionOboCertImpl(OboAuthenticatorCertImpl authenticator, Long userId) {
     this.authenticator = authenticator;
     this.userId = userId;
     this.username = null;
   }
 
-  public AuthSessionOboCertImpl(@Nonnull OboAuthenticatorCertImpl authenticator, @Nonnull String username) {
+  public AuthSessionOboCertImpl(OboAuthenticatorCertImpl authenticator, String username) {
     this.authenticator = authenticator;
     this.username = username;
     this.userId = null;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionOboImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionOboImpl.java
index cadfe5538..84430d181 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionOboImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthSessionOboImpl.java
@@ -6,8 +6,7 @@
 
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * {@link AuthSession} impl for OBO authentication mode.
@@ -26,7 +25,7 @@ public class AuthSessionOboImpl implements AuthSession {
    * @param authenticator
    * @param userId
    */
-  public AuthSessionOboImpl(@Nonnull OboAuthenticatorRsaImpl authenticator, @Nonnull Long userId) {
+  public AuthSessionOboImpl(OboAuthenticatorRsaImpl authenticator, Long userId) {
     this.authenticator = authenticator;
     this.userId = userId;
     this.username = null;
@@ -37,7 +36,7 @@ public AuthSessionOboImpl(@Nonnull OboAuthenticatorRsaImpl authenticator, @Nonnu
    * @param authenticator
    * @param username
    */
-  public AuthSessionOboImpl(@Nonnull OboAuthenticatorRsaImpl authenticator, @Nonnull String username) {
+  public AuthSessionOboImpl(OboAuthenticatorRsaImpl authenticator, String username) {
     this.authenticator = authenticator;
     this.userId = null;
     this.username = username;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthenticatorFactoryImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthenticatorFactoryImpl.java
index b0c34498d..7a26c6239 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthenticatorFactoryImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/AuthenticatorFactoryImpl.java
@@ -25,8 +25,6 @@
 import java.security.GeneralSecurityException;
 import java.security.PrivateKey;
 
-import javax.annotation.Nonnull;
-
 /**
  * Factory class that provides new instances for the main authenticators :
  * <ul>
@@ -42,12 +40,12 @@ public class AuthenticatorFactoryImpl implements AuthenticatorFactory {
   private final ApiClientFactory apiClientFactory;
   private final ExtensionAppTokensRepository extensionAppTokensRepository;
 
-  public AuthenticatorFactoryImpl(@Nonnull BdkConfig bdkConfig, @Nonnull ApiClientFactory apiClientFactory) {
+  public AuthenticatorFactoryImpl(BdkConfig bdkConfig, ApiClientFactory apiClientFactory) {
     this(bdkConfig, apiClientFactory, new InMemoryTokensRepository());
   }
 
-  public AuthenticatorFactoryImpl(@Nonnull BdkConfig bdkConfig, @Nonnull ApiClientFactory apiClientFactory,
-                                  @Nonnull ExtensionAppTokensRepository extensionAppTokensRepository) {
+  public AuthenticatorFactoryImpl(BdkConfig bdkConfig, ApiClientFactory apiClientFactory,
+                                  ExtensionAppTokensRepository extensionAppTokensRepository) {
     this.config = bdkConfig;
     this.apiClientFactory = apiClientFactory;
     this.extensionAppTokensRepository = extensionAppTokensRepository;
@@ -58,7 +56,6 @@ public AuthenticatorFactoryImpl(@Nonnull BdkConfig bdkConfig, @Nonnull ApiClient
    *
    * @return a new {@link BotAuthenticator} instance.
    */
-  @Nonnull
   @Override
   public
   BotAuthenticator getBotAuthenticator() throws AuthInitializationException {
@@ -106,7 +103,6 @@ BotAuthenticator getBotAuthenticator() throws AuthInitializationException {
    *
    * @return a new {@link OboAuthenticator} instance.
    */
-  @Nonnull
   @Override
   public
   OboAuthenticator getOboAuthenticator() throws AuthInitializationException {
@@ -145,7 +141,6 @@ OboAuthenticator getOboAuthenticator() throws AuthInitializationException {
    *
    * @return a new {@link ExtensionAppAuthenticator} instance.
    */
-  @Nonnull
   @Override
   public
   ExtensionAppAuthenticator getExtensionAppAuthenticator() throws AuthInitializationException {
@@ -186,7 +181,6 @@ ExtensionAppAuthenticator getExtensionAppAuthenticator() throws AuthInitializati
    *
    * @return a new {@link ExtAppAuthenticator} instance.
    */
-  @Nonnull
   @Override
   public ExtAppAuthenticator getExtAppAuthenticator() throws AuthInitializationException {
     if (this.config.getApp().isBothCertificateAndRsaConfigured()) {
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/BotAuthenticatorCertImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/BotAuthenticatorCertImpl.java
index eb421dc05..0091254f2 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/BotAuthenticatorCertImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/BotAuthenticatorCertImpl.java
@@ -13,8 +13,6 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Bot authenticator certificate implementation.
  *
@@ -29,13 +27,13 @@ public class BotAuthenticatorCertImpl extends AbstractBotAuthenticator {
   private final String username;
 
   public BotAuthenticatorCertImpl(
-      @Nonnull BdkRetryConfig retryConfig,
-      @Nonnull String username,
-      @Nonnull BdkCommonJwtConfig commonJwtConfig,
-      @Nonnull ApiClient loginClient,
-      @Nonnull ApiClient sessionAuthClient,
-      @Nonnull ApiClient keyAuthClient,
-      @Nonnull AgentVersionService agentVersionService,
+      BdkRetryConfig retryConfig,
+      String username,
+      BdkCommonJwtConfig commonJwtConfig,
+      ApiClient loginClient,
+      ApiClient sessionAuthClient,
+      ApiClient keyAuthClient,
+      AgentVersionService agentVersionService,
       boolean agentConfigured) {
     super(retryConfig, commonJwtConfig, loginClient, agentVersionService, agentConfigured);
     this.sessionAuthClient = sessionAuthClient;
@@ -47,7 +45,6 @@ public BotAuthenticatorCertImpl(
    * {@inheritDoc}
    */
   @Override
-  @Nonnull
   public AuthSession authenticateBot() throws AuthUnauthorizedException {
     AuthSessionImpl authSession = new AuthSessionImpl(this);
     authSession.refresh();
@@ -55,14 +52,12 @@ public AuthSession authenticateBot() throws AuthUnauthorizedException {
   }
 
   @Override
-  @Nonnull
   protected Token retrieveSessionToken() throws AuthUnauthorizedException {
     log.debug("Start retrieving authentication tokens using certificate authentication...");
     return retrieveSessionToken(this.sessionAuthClient);
   }
 
   @Override
-  @Nonnull
   protected String retrieveKeyManagerToken() throws AuthUnauthorizedException {
     log.debug("Start retrieving keyManagerToken using certificate authentication...");
     return retrieveKeyManagerToken(this.keyAuthClient);
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/BotAuthenticatorRsaImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/BotAuthenticatorRsaImpl.java
index ac15322ff..8407307c1 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/BotAuthenticatorRsaImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/BotAuthenticatorRsaImpl.java
@@ -20,8 +20,6 @@
 
 import java.security.PrivateKey;
 
-import javax.annotation.Nonnull;
-
 /**
  * Bot authenticator RSA implementation.
  *
@@ -37,13 +35,13 @@ public class BotAuthenticatorRsaImpl extends AbstractBotAuthenticator {
   private final ApiClient relayApiClient;
 
   public BotAuthenticatorRsaImpl(
-      @Nonnull BdkRetryConfig retryConfig,
-      @Nonnull String username,
-      @Nonnull BdkCommonJwtConfig commonJwtConfig,
-      @Nonnull PrivateKey privateKey,
-      @Nonnull ApiClient loginApiClient,
-      @Nonnull ApiClient relayApiClient,
-      @Nonnull AgentVersionService agentVersionService,
+      BdkRetryConfig retryConfig,
+      String username,
+      BdkCommonJwtConfig commonJwtConfig,
+      PrivateKey privateKey,
+      ApiClient loginApiClient,
+      ApiClient relayApiClient,
+      AgentVersionService agentVersionService,
       boolean agentConfigured
   ) {
     super(retryConfig, commonJwtConfig, loginApiClient, agentVersionService, agentConfigured);
@@ -56,7 +54,7 @@ public BotAuthenticatorRsaImpl(
    * {@inheritDoc}
    */
   @Override
-  public @Nonnull AuthSession authenticateBot() throws AuthUnauthorizedException {
+  public AuthSession authenticateBot() throws AuthUnauthorizedException {
     final AuthSessionImpl authSession = new AuthSessionImpl(this);
     authSession.refresh();
     return authSession;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/ExtensionAppAuthenticatorCertImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/ExtensionAppAuthenticatorCertImpl.java
index 4a133d024..2ea974d70 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/ExtensionAppAuthenticatorCertImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/ExtensionAppAuthenticatorCertImpl.java
@@ -18,8 +18,6 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Extension app authenticator Cert implementation.
  *
@@ -47,7 +45,6 @@ public ExtensionAppAuthenticatorCertImpl(BdkRetryConfig retryConfig, String appI
    * {@inheritDoc}
    */
   @Override
-  @Nonnull
   public AppAuthSession authenticateExtensionApp(String appToken) throws AuthUnauthorizedException {
     AppAuthSession authSession = new AppAuthSessionCertImpl(this, appToken);
     authSession.refresh();
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/ExtensionAppAuthenticatorRsaImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/ExtensionAppAuthenticatorRsaImpl.java
index e45a751cc..e9f700d23 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/ExtensionAppAuthenticatorRsaImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/ExtensionAppAuthenticatorRsaImpl.java
@@ -20,8 +20,6 @@
 
 import java.security.PrivateKey;
 
-import javax.annotation.Nonnull;
-
 /**
  * Extension app authenticator RSA implementation.
  *
@@ -58,9 +56,8 @@ public ExtensionAppAuthenticatorRsaImpl(BdkRetryConfig retryConfig,
   /**
    * {@inheritDoc}
    */
-  @Nonnull
   @Override
-  public AppAuthSession authenticateExtensionApp(@Nonnull String appToken) throws AuthUnauthorizedException {
+  public AppAuthSession authenticateExtensionApp(String appToken) throws AuthUnauthorizedException {
     AppAuthSession authSession = new AppAuthSessionRsaImpl(this, appToken);
     authSession.refresh();
     return authSession;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/OboAuthenticatorCertImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/OboAuthenticatorCertImpl.java
index 9b96c0991..20bb5c313 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/OboAuthenticatorCertImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/OboAuthenticatorCertImpl.java
@@ -10,8 +10,6 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * OBO Certificate authenticator implementation
  *
@@ -31,9 +29,8 @@ public OboAuthenticatorCertImpl(BdkRetryConfig retryConfig, String appId, ApiCli
   /**
    * {@inheritDoc}
    */
-  @Nonnull
   @Override
-  public AuthSession authenticateByUsername(@Nonnull String username) throws AuthUnauthorizedException {
+  public AuthSession authenticateByUsername(String username) throws AuthUnauthorizedException {
     AuthSession authSession = new AuthSessionOboCertImpl(this, username);
     authSession.refresh();
     return authSession;
@@ -42,21 +39,20 @@ public AuthSession authenticateByUsername(@Nonnull String username) throws AuthU
   /**
    * {@inheritDoc}
    */
-  @Nonnull
   @Override
-  public AuthSession authenticateByUserId(@Nonnull Long userId) throws AuthUnauthorizedException {
+  public AuthSession authenticateByUserId(Long userId) throws AuthUnauthorizedException {
     AuthSession authSession = new AuthSessionOboCertImpl(this, userId);
     authSession.refresh();
     return authSession;
   }
 
-  protected String authenticateAndRetrieveOboSessionToken(@Nonnull String appSessionToken,
-      @Nonnull Long userId) throws ApiException {
+  protected String authenticateAndRetrieveOboSessionToken(String appSessionToken,
+      Long userId) throws ApiException {
     return this.authenticationApi.v1AppUserUidAuthenticatePost(userId, appSessionToken).getSessionToken();
   }
 
-  protected String authenticateAndRetrieveOboSessionToken(@Nonnull String appSessionToken,
-      @Nonnull String username) throws ApiException {
+  protected String authenticateAndRetrieveOboSessionToken(String appSessionToken,
+      String username) throws ApiException {
     return this.authenticationApi.v1AppUsernameUsernameAuthenticatePost(username, appSessionToken).getSessionToken();
   }
 
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/OboAuthenticatorRsaImpl.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/OboAuthenticatorRsaImpl.java
index adb087634..21903c6fe 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/OboAuthenticatorRsaImpl.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/OboAuthenticatorRsaImpl.java
@@ -14,8 +14,6 @@
 
 import java.security.PrivateKey;
 
-import javax.annotation.Nonnull;
-
 /**
  * OBO authenticator RSA implementation.
  *
@@ -37,9 +35,8 @@ public OboAuthenticatorRsaImpl(BdkRetryConfig retryConfig, String appId, Private
   /**
    * {@inheritDoc}
    */
-  @Nonnull
   @Override
-  public AuthSession authenticateByUsername(@Nonnull String username) throws AuthUnauthorizedException {
+  public AuthSession authenticateByUsername(String username) throws AuthUnauthorizedException {
     AuthSession authSession = new AuthSessionOboImpl(this, username);
     authSession.refresh();
     return authSession;
@@ -49,19 +46,19 @@ public AuthSession authenticateByUsername(@Nonnull String username) throws AuthU
    * {@inheritDoc}
    */
   @Override
-  public @Nonnull AuthSession authenticateByUserId(@Nonnull Long userId) throws AuthUnauthorizedException {
+  public AuthSession authenticateByUserId(Long userId) throws AuthUnauthorizedException {
     AuthSession authSession = new AuthSessionOboImpl(this, userId);
     authSession.refresh();
     return authSession;
   }
 
-  protected String authenticateAndRetrieveOboSessionToken(@Nonnull String appSessionToken,
-      @Nonnull Long userId) throws ApiException {
+  protected String authenticateAndRetrieveOboSessionToken(String appSessionToken,
+      Long userId) throws ApiException {
     return this.authenticationApi.pubkeyAppUserUserIdAuthenticatePost(appSessionToken, userId).getToken();
   }
 
-  protected String authenticateAndRetrieveOboSessionToken(@Nonnull String appSessionToken,
-      @Nonnull String username) throws ApiException {
+  protected String authenticateAndRetrieveOboSessionToken(String appSessionToken,
+      String username) throws ApiException {
     return this.authenticationApi.pubkeyAppUsernameUsernameAuthenticatePost(appSessionToken, username).getToken();
   }
 
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/package-info.java
new file mode 100644
index 000000000..437957711
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/impl/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.auth.impl;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/jwt/JwtHelper.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/jwt/JwtHelper.java
index 0a526eda4..bd526fe18 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/jwt/JwtHelper.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/jwt/JwtHelper.java
@@ -3,14 +3,13 @@
 import com.symphony.bdk.core.auth.exception.AuthInitializationException;
 import com.symphony.bdk.core.auth.exception.AuthUnauthorizedException;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.node.ObjectNode;
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.JwtException;
 import io.jsonwebtoken.Jwts;
 import io.jsonwebtoken.io.DeserializationException;
 import io.jsonwebtoken.io.Deserializer;
+import io.jsonwebtoken.io.SerializationException;
+import io.jsonwebtoken.io.Serializer;
 import org.apiguardian.api.API;
 import org.bouncycastle.asn1.pkcs.RSAPrivateKey;
 import org.bouncycastle.crypto.params.RSAPrivateCrtKeyParameters;
@@ -18,9 +17,13 @@
 import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
 import org.bouncycastle.util.io.pem.PemObject;
 import org.bouncycastle.util.io.pem.PemReader;
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
+import java.io.OutputStream;
 import java.io.Reader;
 import java.io.StringReader;
 import java.nio.charset.StandardCharsets;
@@ -79,6 +82,7 @@ public class JwtHelper {
    */
   public static String createSignedJwt(String user, long expiration, PrivateKey privateKey) {
     return Jwts.builder()
+        .json(mapperSerializer())
         .subject(user)
         .expiration(new Date(System.currentTimeMillis() + expiration))
         .signWith(privateKey, Jwts.SIG.RS512)
@@ -152,9 +156,9 @@ public static boolean isSkdEnabled(String jwt) {
    *
    * @param jwt to be parsed
    * @return expiration date in seconds
-   * @throws JsonProcessingException if parsing fails
+   * @throws JacksonException if parsing fails
    */
-  public static Long extractExpirationDate(String jwt) throws JsonProcessingException, AuthUnauthorizedException {
+  public static Long extractExpirationDate(String jwt) throws JacksonException, AuthUnauthorizedException {
     String claimsObj = extractDecodedClaims(dropBearer(jwt));
     ObjectNode claims = mapper.readValue(claimsObj, ObjectNode.class);
     if(claims.has(Claims.EXPIRATION) && claims.get(Claims.EXPIRATION).isNumber()) {
@@ -175,6 +179,30 @@ private static String dropBearer(String jwt) {
     return jwt.replace("Bearer ", "");
   }
 
+  private static Serializer<Map<String, ?>> mapperSerializer() {
+    // jjwt auto-discovers a Serializer from the classpath (jjwt-jackson) when none is set here;
+    // supplying our own keeps a single Jackson databind implementation on the classpath (D2).
+    return new Serializer<Map<String, ?>>() {
+      @Override
+      public byte[] serialize(Map<String, ?> map) throws SerializationException {
+        try {
+          return mapper.writeValueAsBytes(map);
+        } catch (JacksonException e) {
+          throw new SerializationException("Unable to serialize JWT claims", e);
+        }
+      }
+
+      @Override
+      public void serialize(Map<String, ?> map, OutputStream out) throws SerializationException {
+        try {
+          mapper.writeValue(out, map);
+        } catch (JacksonException e) {
+          throw new SerializationException("Unable to serialize JWT claims", e);
+        }
+      }
+    };
+  }
+
   @SuppressWarnings("unchecked")
   private static Deserializer<Map<String, ?>> normalizeSubjectDeserializer() {
     // jjwt 0.12+ strictly requires 'sub' to be a String (RFC 7519), but the pod may send it
@@ -184,7 +212,7 @@ private static String dropBearer(String jwt) {
       public Map<String, ?> deserialize(byte[] bytes) throws DeserializationException {
         try {
           return normalize(mapper.readValue(bytes, Map.class));
-        } catch (IOException e) {
+        } catch (JacksonException e) {
           throw new DeserializationException("Unable to deserialize JWT claims", e);
         }
       }
@@ -193,7 +221,7 @@ private static String dropBearer(String jwt) {
       public Map<String, ?> deserialize(Reader reader) throws DeserializationException {
         try {
           return normalize(mapper.readValue(reader, Map.class));
-        } catch (IOException e) {
+        } catch (JacksonException e) {
           throw new DeserializationException("Unable to deserialize JWT claims", e);
         }
       }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/package-info.java
new file mode 100644
index 000000000..a417d8160
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/auth/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.auth;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/client/ApiClientFactory.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/client/ApiClientFactory.java
index 5b5f50563..07c1ba682 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/client/ApiClientFactory.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/client/ApiClientFactory.java
@@ -17,8 +17,6 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Factory responsible for creating {@link ApiClient} instances for each main Symphony's components
  * :
@@ -43,11 +41,11 @@ public class ApiClientFactory {
   private final BdkConfig config;
   private final ApiClientBuilderProvider apiClientBuilderProvider;
 
-  public ApiClientFactory(@Nonnull BdkConfig config) {
+  public ApiClientFactory(BdkConfig config) {
     this(config, ServiceLookup.lookupSingleService(ApiClientBuilderProvider.class));
   }
 
-  public ApiClientFactory(@Nonnull BdkConfig config, @Nonnull ApiClientBuilderProvider apiClientBuilderProvider) {
+  public ApiClientFactory(BdkConfig config, ApiClientBuilderProvider apiClientBuilderProvider) {
     this.config = config;
     this.apiClientBuilderProvider = apiClientBuilderProvider;
   }
@@ -243,7 +241,6 @@ protected void configureProxy(BdkProxyConfig proxyConfig, ApiClientBuilder apiCl
     }
   }
 
-
   /**
    * @deprecated to be removed if we want to move retry to another module
    */
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/client/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/client/package-info.java
new file mode 100644
index 000000000..4c87bd831
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/client/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.client;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/ExtensionService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/ExtensionService.java
index a8d4b7bfe..181802b16 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/ExtensionService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/ExtensionService.java
@@ -1,6 +1,5 @@
 package com.symphony.bdk.core.extension;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
 import com.symphony.bdk.core.SymphonyBdk;
 import com.symphony.bdk.core.auth.AuthSession;
 import com.symphony.bdk.core.client.ApiClientFactory;
@@ -15,6 +14,8 @@
 
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.ObjectMapper;
 
 import java.lang.reflect.InvocationTargetException;
 import java.util.Collections;
@@ -22,8 +23,7 @@
 import java.util.Map;
 import java.util.Optional;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service class for managing extensions.
@@ -46,10 +46,10 @@ public class ExtensionService {
   private boolean capabilitiesExtracted = false;
 
   public ExtensionService(
-      @Nonnull ApiClientFactory apiClientFactory,
+      ApiClientFactory apiClientFactory,
       @Nullable AuthSession botSession,
-      @Nonnull RetryWithRecoveryBuilder<?> retryBuilder,
-      @Nonnull BdkConfig config
+      RetryWithRecoveryBuilder<?> retryBuilder,
+      BdkConfig config
   ) {
     this.apiClientFactory = apiClientFactory;
     this.botSession = botSession;
@@ -208,7 +208,7 @@ public void markCapabilitiesExtracted() {
    *
    * @param bdk the fully constructed {@link SymphonyBdk} instance
    */
-  public void onBdkStarted(@Nonnull SymphonyBdk bdk) {
+  public void onBdkStarted(SymphonyBdk bdk) {
     for (BdkExtension ext : this.extensions.values()) {
       if (ext instanceof BdkAware) {
         ((BdkAware) ext).setBdk(bdk);
@@ -269,7 +269,7 @@ private <C> void injectExtensionConfig(BdkExtensionConfigAware<C> extension) {
     try {
       final C typed = MAPPER.convertValue(rawConfig, extension.getConfigClass());
       extension.setExtensionConfig(typed);
-    } catch (IllegalArgumentException e) {
+    } catch (IllegalArgumentException | JacksonException e) {
       throw new BdkExtensionException(
           "Failed to deserialize extension config key '" + key + "' into "
               + extension.getConfigClass().getName() + " for extension <" + extension.getClass() + ">",
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/MessageRetrieverOverride.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/MessageRetrieverOverride.java
index 2cf330c88..a92c2f290 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/MessageRetrieverOverride.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/MessageRetrieverOverride.java
@@ -11,8 +11,7 @@
 import java.time.Instant;
 import java.util.List;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * SPI for replacing all agent-facing message *read* operations in {@code MessageService}.
@@ -39,14 +38,14 @@
 @API(status = API.Status.EXPERIMENTAL)
 public interface MessageRetrieverOverride {
 
-  List<V4Message> listMessages(@Nonnull AuthSession session, @Nonnull String streamId, @Nonnull Instant since,
+  List<V4Message> listMessages(AuthSession session, String streamId, Instant since,
       @Nullable Instant until, @Nullable PaginationAttribute pagination) throws Exception;
 
-  List<V4Message> searchMessages(@Nonnull AuthSession session, @Nonnull MessageSearchQuery query,
+  List<V4Message> searchMessages(AuthSession session, MessageSearchQuery query,
       @Nullable PaginationAttribute pagination, @Nullable SortDir sortDir) throws Exception;
 
-  List<V4Message> searchMessagesSemantic(@Nonnull AuthSession session, @Nonnull String query,
+  List<V4Message> searchMessagesSemantic(AuthSession session, String query,
       @Nullable String streamId, @Nullable PaginationAttribute pagination) throws Exception;
 
-  V4Message getMessage(@Nonnull AuthSession session, @Nonnull String messageId) throws Exception;
+  V4Message getMessage(AuthSession session, String messageId) throws Exception;
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/MessageSenderOverride.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/MessageSenderOverride.java
index 29acaffd2..11c6fd7e1 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/MessageSenderOverride.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/MessageSenderOverride.java
@@ -12,8 +12,6 @@
 
 import java.util.List;
 
-import javax.annotation.Nonnull;
-
 /**
  * SPI for replacing all agent-facing message operations in {@code MessageService}.
  *
@@ -36,20 +34,20 @@
 @API(status = API.Status.EXPERIMENTAL)
 public interface MessageSenderOverride {
 
-  V4Message send(@Nonnull AuthSession session, @Nonnull String streamId, @Nonnull Message message) throws Exception;
+  V4Message send(AuthSession session, String streamId, Message message) throws Exception;
 
-  V4Message update(@Nonnull AuthSession session, @Nonnull String streamId, @Nonnull String messageId,
-      @Nonnull Message content) throws Exception;
+  V4Message update(AuthSession session, String streamId, String messageId,
+      Message content) throws Exception;
 
-  V4MessageBlastResponse blast(@Nonnull AuthSession session, @Nonnull List<String> streamIds,
-      @Nonnull Message message) throws Exception;
+  V4MessageBlastResponse blast(AuthSession session, List<String> streamIds,
+      Message message) throws Exception;
 
-  List<V4ImportResponse> importMessages(@Nonnull AuthSession session, @Nonnull List<V4ImportedMessage> messages)
+  List<V4ImportResponse> importMessages(AuthSession session, List<V4ImportedMessage> messages)
       throws Exception;
 
-  MessageSuppressionResponse suppressMessage(@Nonnull AuthSession session, @Nonnull String messageId)
+  MessageSuppressionResponse suppressMessage(AuthSession session, String messageId)
       throws Exception;
 
-  byte[] getAttachment(@Nonnull AuthSession session, @Nonnull String streamId, @Nonnull String messageId,
-      @Nonnull String attachmentId) throws Exception;
+  byte[] getAttachment(AuthSession session, String streamId, String messageId,
+      String attachmentId) throws Exception;
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/package-info.java
new file mode 100644
index 000000000..e17bf562b
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/extension/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.extension;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/package-info.java
new file mode 100644
index 000000000..68807ecb7
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/retry/RetryWithRecoveryBuilder.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/retry/RetryWithRecoveryBuilder.java
index 2054915d8..b354412c9 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/retry/RetryWithRecoveryBuilder.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/retry/RetryWithRecoveryBuilder.java
@@ -16,8 +16,6 @@
 import java.util.List;
 import java.util.function.Predicate;
 
-import javax.annotation.Nonnull;
-
 /**
  * Builder class to facilitate the instantiation of a {@link RetryWithRecovery}.
  *
@@ -106,7 +104,7 @@ public static boolean isNetworkIssueOrMinorErrorOrClientError(Throwable t) {
    * located at different level of the list of causes. This method aims to process the list of underlying causes starting
    * from a given root exception.
    */
-  private static boolean hasRootCause(@Nonnull Throwable root, @Nonnull Class<? extends Exception> candidate) {
+  private static boolean hasRootCause(Throwable root, Class<? extends Exception> candidate) {
     Throwable ex = root;
     while (ex != null) {
       if (ex.getClass().equals(candidate)) {
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/retry/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/retry/package-info.java
new file mode 100644
index 000000000..351fbcd70
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/retry/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.retry;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/application/ApplicationService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/application/ApplicationService.java
index 272b1c961..fafda99e5 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/application/ApplicationService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/application/ApplicationService.java
@@ -16,8 +16,6 @@
 
 import java.util.List;
 
-import javax.annotation.Nonnull;
-
 /**
  * Service class for managing the applications and the application entitlements.
  * <p>
@@ -58,7 +56,7 @@ public ApplicationService(ApplicationApi applicationApi, AppEntitlementApi appEn
    * @see <a href="https://developers.symphony.com/restapi/reference/create-app">Create Application</a>
    * @see <a href="https://developers.symphony.com/restapi/reference/create-application-with-an-rsa-public-key">Create Application with an RSA Public Key</a>
    */
-  public ApplicationDetail createApplication(@Nonnull ApplicationDetail applicationDetail) {
+  public ApplicationDetail createApplication(ApplicationDetail applicationDetail) {
     return executeAndRetry("createApplication", applicationApi.getApiClient().getBasePath(),
         () -> applicationApi.v1AdminAppCreatePost(authSession.getSessionToken(), applicationDetail));
   }
@@ -73,7 +71,7 @@ public ApplicationDetail createApplication(@Nonnull ApplicationDetail applicatio
    * @see <a href="https://developers.symphony.com/restapi/reference/update-application">Update Application</a>
    * @see <a href="https://developers.symphony.com/restapi/reference/update-application-with-an-rsa-public-key">Update Application with an RSA Public Key</a>
    */
-  public ApplicationDetail updateApplication(@Nonnull String appId, @Nonnull ApplicationDetail applicationDetail) {
+  public ApplicationDetail updateApplication(String appId, ApplicationDetail applicationDetail) {
     return executeAndRetry("updateApplication",  applicationApi.getApiClient().getBasePath(),
         () -> applicationApi.v1AdminAppIdUpdatePost(authSession.getSessionToken(), appId, applicationDetail));
   }
@@ -84,7 +82,7 @@ public ApplicationDetail updateApplication(@Nonnull String appId, @Nonnull Appli
    * @param appId Id of the application needs to be deleted.
    * @see <a href="https://developers.symphony.com/restapi/reference/delete-application">Delete Application</a>
    */
-  public void deleteApplication(@Nonnull String appId) {
+  public void deleteApplication(String appId) {
     executeAndRetry("deleteApplication",  applicationApi.getApiClient().getBasePath(),
         () -> applicationApi.v1AdminAppIdDeletePost(authSession.getSessionToken(), appId));
   }
@@ -96,7 +94,7 @@ public void deleteApplication(@Nonnull String appId) {
    * @return The detail of the lookup application.
    * @see <a href="https://developers.symphony.com/restapi/reference/get-application">Get Application</a>
    */
-  public ApplicationDetail getApplication(@Nonnull String appId) {
+  public ApplicationDetail getApplication(String appId) {
     return executeAndRetry("getApplication",  applicationApi.getApiClient().getBasePath(),
         () -> applicationApi.v1AdminAppIdGetGet(authSession.getSessionToken(), appId));
   }
@@ -119,7 +117,7 @@ public List<PodAppEntitlement> listApplicationEntitlements() {
    * @return The updated list of entitlements.
    * @see <a href="https://developers.symphony.com/restapi/reference/update-application-entitlements">Update App Entitlements</a>
    */
-  public List<PodAppEntitlement> updateApplicationEntitlements(@Nonnull List<PodAppEntitlement> entitlementList) {
+  public List<PodAppEntitlement> updateApplicationEntitlements(List<PodAppEntitlement> entitlementList) {
     return executeAndRetry("updateApplicationEntitlements", appEntitlementApi.getApiClient().getBasePath(),
         () -> appEntitlementApi.v1AdminAppEntitlementListPost(authSession.getSessionToken(), entitlementList));
   }
@@ -131,7 +129,7 @@ public List<PodAppEntitlement> updateApplicationEntitlements(@Nonnull List<PodAp
    * @return The list of Symphony application entitlements for this user.
    * @see <a href="https://developers.symphony.com/restapi/reference/user-apps">User Apps</a>
    */
-  public List<UserAppEntitlement> listUserApplications(@Nonnull Long userId) {
+  public List<UserAppEntitlement> listUserApplications(Long userId) {
     return executeAndRetry("listUserApplications", appEntitlementApi.getApiClient().getBasePath(),
         () -> appEntitlementApi.v1AdminUserUidAppEntitlementListGet(authSession.getSessionToken(), userId));
   }
@@ -144,8 +142,8 @@ public List<UserAppEntitlement> listUserApplications(@Nonnull Long userId) {
    * @return The updated list of Symphony application entitlements for this user.
    * @see <a href="https://developers.symphony.com/restapi/reference/update-user-apps">Update All User Apps</a>
    */
-  public List<UserAppEntitlement> updateUserApplications(@Nonnull Long userId,
-      @Nonnull List<UserAppEntitlement> userAppEntitlementList) {
+  public List<UserAppEntitlement> updateUserApplications(Long userId,
+      List<UserAppEntitlement> userAppEntitlementList) {
     return executeAndRetry("updateUserApplications", appEntitlementApi.getApiClient().getBasePath(),
         () -> appEntitlementApi.v1AdminUserUidAppEntitlementListPost(authSession.getSessionToken(), userId,
             userAppEntitlementList));
@@ -159,8 +157,8 @@ public List<UserAppEntitlement> updateUserApplications(@Nonnull Long userId,
    * @return The updated list of Symphony application entitlements for this user.
    * @see <a href="https://developers.symphony.com/restapi/reference/partial-update-user-apps">Update User Apps</a>
    */
-  public List<UserAppEntitlement> patchUserApplications(@Nonnull Long userId,
-      @Nonnull List<UserAppEntitlementPatch> userAppEntitlementPatchList) {
+  public List<UserAppEntitlement> patchUserApplications(Long userId,
+      List<UserAppEntitlementPatch> userAppEntitlementPatchList) {
     return executeAndRetry("patchUserApplications", appEntitlementApi.getApiClient().getBasePath(),
         () -> appEntitlementApi.v1AdminUserUidAppEntitlementListPatch(authSession.getSessionToken(), userId,
             userAppEntitlementPatchList));
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/application/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/application/package-info.java
new file mode 100644
index 000000000..1900837b1
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/application/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.application;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/ConnectionService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/ConnectionService.java
index cd0ca7bdb..9a447692c 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/ConnectionService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/ConnectionService.java
@@ -16,8 +16,7 @@
 import java.util.List;
 import java.util.stream.Collectors;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service class for managing connection status.
@@ -64,7 +63,7 @@ public OboConnectionService obo(AuthSession oboSession) {
    * {@inheritDoc}
    */
   @Override
-  public UserConnection getConnection(@Nonnull Long userId) {
+  public UserConnection getConnection(Long userId) {
     return executeAndRetry("getConnection",
         () -> connectionApi.v1ConnectionUserUserIdInfoGet(authSession.getSessionToken(), String.valueOf(userId)));
   }
@@ -89,7 +88,7 @@ public List<UserConnection> listConnections(@Nullable ConnectionStatus status, @
    * {@inheritDoc}
    */
   @Override
-  public UserConnection createConnection(@Nonnull Long userId) {
+  public UserConnection createConnection(Long userId) {
     UserConnectionRequest connectionRequest = new UserConnectionRequest().userId(userId);
     return executeAndRetry("createConnection",
         () -> connectionApi.v1ConnectionCreatePost(authSession.getSessionToken(), connectionRequest));
@@ -99,7 +98,7 @@ public UserConnection createConnection(@Nonnull Long userId) {
    * {@inheritDoc}
    */
   @Override
-  public UserConnection acceptConnection(@Nonnull Long userId) {
+  public UserConnection acceptConnection(Long userId) {
     UserConnectionRequest connectionRequest = new UserConnectionRequest().userId(userId);
     return executeAndRetry("acceptConnection",
         () -> connectionApi.v1ConnectionAcceptPost(authSession.getSessionToken(), connectionRequest));
@@ -109,7 +108,7 @@ public UserConnection acceptConnection(@Nonnull Long userId) {
    * {@inheritDoc}
    */
   @Override
-  public UserConnection rejectConnection(@Nonnull Long userId) {
+  public UserConnection rejectConnection(Long userId) {
     UserConnectionRequest connectionRequest = new UserConnectionRequest().userId(userId);
     return executeAndRetry("rejectConnection",
         () -> connectionApi.v1ConnectionRejectPost(authSession.getSessionToken(), connectionRequest));
@@ -119,7 +118,7 @@ public UserConnection rejectConnection(@Nonnull Long userId) {
    * {@inheritDoc}
    */
   @Override
-  public void removeConnection(@Nonnull Long userId) {
+  public void removeConnection(Long userId) {
     executeAndRetry("removeConnection",
         () -> connectionApi.v1ConnectionUserUidRemovePost(authSession.getSessionToken(), userId));
   }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/OboConnectionService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/OboConnectionService.java
index 078fc5b07..e90bf49b4 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/OboConnectionService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/OboConnectionService.java
@@ -7,8 +7,7 @@
 
 import java.util.List;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service interface exposing OBO-enabled endpoints to manage user connection status.
@@ -24,7 +23,7 @@ public interface OboConnectionService {
    * @return Connection status with the specified user.
    * @see <a href="https://developers.symphony.com/restapi/reference/get-connection">Get Connection</a>
    */
-  UserConnection getConnection(@Nonnull Long userId);
+  UserConnection getConnection(Long userId);
 
   /**
    * List all current connection statuses with external or specified users.
@@ -49,7 +48,7 @@ public interface OboConnectionService {
    * @return Connection status with the specified user.
    * @see <a href="https://developers.symphony.com/restapi/reference#create-connection">Create Connection</a>
    */
-  UserConnection createConnection(@Nonnull Long userId);
+  UserConnection createConnection(Long userId);
 
   /**
    * Accept the connection request from a requesting user.
@@ -59,7 +58,7 @@ public interface OboConnectionService {
    * @return Connection status with the requesting user.
    * @see <a href="https://developers.symphony.com/restapi/reference#accepted-connection">Accept Connection</a>
    */
-  UserConnection acceptConnection(@Nonnull Long userId);
+  UserConnection acceptConnection(Long userId);
 
   /**
    * Reject the connection request from a requesting user.
@@ -69,7 +68,7 @@ public interface OboConnectionService {
    * @return Connection status with the requesting user.
    * @see <a href="https://developers.symphony.com/restapi/reference#reject-connection">Reject Connection</a>
    */
-  UserConnection rejectConnection(@Nonnull Long userId);
+  UserConnection rejectConnection(Long userId);
 
   /**
    * Removes a connection with a user.
@@ -78,5 +77,5 @@ public interface OboConnectionService {
    * @param userId The id of the user with whom we want to remove the connection.
    * @see <a href="https://developers.symphony.com/restapi/reference#remove-connection">Remove Connection</a>
    */
-  void removeConnection(@Nonnull Long userId);
+  void removeConnection(Long userId);
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/package-info.java
new file mode 100644
index 000000000..4358baea9
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/connection/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.connection;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/AbstractDatafeedLoop.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/AbstractDatafeedLoop.java
index 47d4f42a6..a772be633 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/AbstractDatafeedLoop.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/AbstractDatafeedLoop.java
@@ -24,7 +24,7 @@
 import java.util.Optional;
 import java.util.concurrent.atomic.AtomicBoolean;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Base class for implementing the datafeed services. A datafeed services can help a bot subscribe or unsubscribe
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/DatafeedLoopV2.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/DatafeedLoopV2.java
index e8688fe6d..2ca085e1f 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/DatafeedLoopV2.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/DatafeedLoopV2.java
@@ -22,7 +22,7 @@
 import java.util.List;
 import java.util.regex.Pattern;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * A class for implementing the datafeed v2 loop service.
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/package-info.java
new file mode 100644
index 000000000..b9e918544
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/impl/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.datafeed.impl;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/util/RealTimeEventsBinder.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/util/RealTimeEventsBinder.java
index b0560c93e..2ed50ae73 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/util/RealTimeEventsBinder.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/util/RealTimeEventsBinder.java
@@ -13,7 +13,7 @@
 import java.util.function.BiConsumer;
 import java.util.function.Consumer;
 
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Utility class used to attach a method call (defined by a {@link BiConsumer}) to a specific real-time event.
@@ -105,7 +105,6 @@ public int hashCode() {
     }
   }
 
-
   private record OnSymphonyElementsAction(AbstractActivity<V4SymphonyElementsAction, ?> activity,
                                           BiConsumer<V4Initiator, V4SymphonyElementsAction> target)
       implements RealTimeEventListener {
@@ -129,7 +128,6 @@ public int hashCode() {
     }
   }
 
-
   private record OnUserJoinedRoom(AbstractActivity<V4UserJoinedRoom, ?> activity,
                                   BiConsumer<V4Initiator, V4UserJoinedRoom> target) implements RealTimeEventListener {
 
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/util/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/util/package-info.java
new file mode 100644
index 000000000..328284723
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/datafeed/util/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.datafeed.util;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/disclaimer/DisclaimerService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/disclaimer/DisclaimerService.java
index 39cfddc5a..de40915f2 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/disclaimer/DisclaimerService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/disclaimer/DisclaimerService.java
@@ -13,8 +13,6 @@
 
 import java.util.List;
 
-import javax.annotation.Nonnull;
-
 /**
  * Service class for managing disclaimers.
  * <p>
@@ -48,7 +46,7 @@ public DisclaimerService(DisclaimerApi disclaimerApi, AuthSession authSession, R
    * @return  {@link Disclaimer} with disclaimer details
    * @see <a href="https://developers.symphony.com/restapi/reference#disclaimer">Disclaimer</a>
    */
-  public Disclaimer getDisclaimer(@Nonnull String disclaimerId) {
+  public Disclaimer getDisclaimer(String disclaimerId) {
     return executeAndRetry("getDisclaimer",
         () -> this.disclaimerApi.v1AdminDisclaimerDidGet(this.authSession.getSessionToken(), disclaimerId));
   }
@@ -71,7 +69,7 @@ public List<Disclaimer> listDisclaimers() {
    * @return  {@link List} of users for the given disclaimer
    * @see <a href="https://developers.symphony.com/restapi/reference#disclaimer-users">List Disclaimer Users</a>
    */
-  public List<Long> listDisclaimerUsers(@Nonnull String disclaimerId) {
+  public List<Long> listDisclaimerUsers(String disclaimerId) {
     return executeAndRetry("getDisclaimer",
         () -> this.disclaimerApi.v1AdminDisclaimerDidUsersGet(this.authSession.getSessionToken(), disclaimerId));
   }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/disclaimer/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/disclaimer/package-info.java
new file mode 100644
index 000000000..fa3bf01ac
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/disclaimer/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.disclaimer;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/MessageService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/MessageService.java
index 445fd7768..aa2dde536 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/MessageService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/MessageService.java
@@ -53,9 +53,7 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service class for managing messages.
@@ -186,14 +184,14 @@ public TemplateEngine templates() {
    * {@inheritDoc}
    */
   @Override
-  public List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant since,
-      @Nonnull PaginationAttribute pagination) {
+  public List<V4Message> listMessages(V4Stream stream, Instant since,
+      PaginationAttribute pagination) {
     return listMessages(stream.getStreamId(), since, pagination);
   }
 
   @Override
-  public List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant since, Instant until,
-      @Nonnull PaginationAttribute pagination) {
+  public List<V4Message> listMessages(V4Stream stream, Instant since, Instant until,
+      PaginationAttribute pagination) {
     return listMessages(stream.getStreamId(), since, until, pagination);
   }
 
@@ -201,12 +199,12 @@ public List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant s
    * {@inheritDoc}
    */
   @Override
-  public List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant since) {
+  public List<V4Message> listMessages(V4Stream stream, Instant since) {
     return listMessages(stream.getStreamId(), since);
   }
 
   @Override
-  public List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant since, Instant until) {
+  public List<V4Message> listMessages(V4Stream stream, Instant since, Instant until) {
     return listMessages(stream.getStreamId(), since, until);
   }
 
@@ -214,14 +212,14 @@ public List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant s
    * {@inheritDoc}
    */
   @Override
-  public List<V4Message> listMessages(@Nonnull String streamId, @Nonnull Instant since,
-      @Nonnull PaginationAttribute pagination) {
+  public List<V4Message> listMessages(String streamId, Instant since,
+      PaginationAttribute pagination) {
     return listMessages(streamId, since, null, pagination);
   }
 
   @Override
-  public List<V4Message> listMessages(@Nonnull String streamId, @Nonnull Instant since, Instant until,
-      @Nonnull PaginationAttribute pagination) {
+  public List<V4Message> listMessages(String streamId, Instant since, Instant until,
+      PaginationAttribute pagination) {
     return doListMessages(streamId, since, until, pagination);
   }
 
@@ -229,16 +227,16 @@ public List<V4Message> listMessages(@Nonnull String streamId, @Nonnull Instant s
    * {@inheritDoc}
    */
   @Override
-  public List<V4Message> listMessages(@Nonnull String streamId, @Nonnull Instant since) {
+  public List<V4Message> listMessages(String streamId, Instant since) {
     return listMessages(streamId, since, (Instant) null);
   }
 
   @Override
-  public List<V4Message> listMessages(@Nonnull String streamId, @Nonnull Instant since, Instant until) {
+  public List<V4Message> listMessages(String streamId, Instant since, Instant until) {
     return doListMessages(streamId, since, until, null);
   }
 
-  private List<V4Message> doListMessages(@Nonnull String streamId, @Nonnull Instant since, @Nullable Instant until,
+  private List<V4Message> doListMessages(String streamId, Instant since, @Nullable Instant until,
       @Nullable PaginationAttribute pagination) {
     if (retrieverOverride != null) {
       return executeAndRetry("getMessages", messageApi.getApiClient().getBasePath(),
@@ -260,7 +258,7 @@ private List<V4Message> doListMessages(@Nonnull String streamId, @Nonnull Instan
    * @return the list of matching messages
    * @see <a href="https://developers.symphony.com/restapi/reference#?message-search-post">Message Search (using POST)</a>
    */
-  public List<V4Message> searchMessages(@Nonnull MessageSearchQuery query) {
+  public List<V4Message> searchMessages(MessageSearchQuery query) {
     return this.searchMessages(query, null);
   }
 
@@ -272,7 +270,7 @@ public List<V4Message> searchMessages(@Nonnull MessageSearchQuery query) {
    * @return the list of matching messages
    * @see <a href="https://developers.symphony.com/restapi/reference/message-search-post">Message Search (using POST)</a>
    */
-  public List<V4Message> searchMessages(@Nonnull MessageSearchQuery query, @Nullable PaginationAttribute pagination) {
+  public List<V4Message> searchMessages(MessageSearchQuery query, @Nullable PaginationAttribute pagination) {
     return this.searchMessages(query, pagination, null);
   }
 
@@ -285,7 +283,7 @@ public List<V4Message> searchMessages(@Nonnull MessageSearchQuery query, @Nullab
    * @return the list of matching messages
    * @see <a href="https://developers.symphony.com/restapi/reference/message-search-post">Message Search (using POST)</a>
    */
-  public List<V4Message> searchMessages(@Nonnull MessageSearchQuery query, @Nullable PaginationAttribute pagination,
+  public List<V4Message> searchMessages(MessageSearchQuery query, @Nullable PaginationAttribute pagination,
       @Nullable SortDir sortDir) {
     validateMessageSearchQuery(query);
     if (retrieverOverride != null) {
@@ -307,7 +305,7 @@ public List<V4Message> searchMessages(@Nonnull MessageSearchQuery query, @Nullab
     );
   }
 
-  private static void validateMessageSearchQuery(@Nonnull MessageSearchQuery query) {
+  private static void validateMessageSearchQuery(MessageSearchQuery query) {
 
     // checks streamType value among accepted ones
     if (query.getStreamType() != null && !equalsAny(query.getStreamType(), "CHAT", "IM", "MIM", "ROOM", "POST")) {
@@ -327,7 +325,7 @@ private static void validateMessageSearchQuery(@Nonnull MessageSearchQuery query
    * {@inheritDoc}
    */
   @Override
-  public List<V4Message> searchMessagesSemantic(@Nonnull String query) {
+  public List<V4Message> searchMessagesSemantic(String query) {
     return searchMessagesSemantic(query, null, null);
   }
 
@@ -335,7 +333,7 @@ public List<V4Message> searchMessagesSemantic(@Nonnull String query) {
    * {@inheritDoc}
    */
   @Override
-  public List<V4Message> searchMessagesSemantic(@Nonnull String query, @Nullable PaginationAttribute pagination) {
+  public List<V4Message> searchMessagesSemantic(String query, @Nullable PaginationAttribute pagination) {
     return searchMessagesSemantic(query, null, pagination);
   }
 
@@ -343,7 +341,7 @@ public List<V4Message> searchMessagesSemantic(@Nonnull String query, @Nullable P
    * {@inheritDoc}
    */
   @Override
-  public List<V4Message> searchMessagesSemantic(@Nonnull String query, @Nullable String streamId,
+  public List<V4Message> searchMessagesSemantic(String query, @Nullable String streamId,
       @Nullable PaginationAttribute pagination) {
     if (retrieverOverride != null) {
       return executeAndRetry("searchMessagesSemantic", messagesApi.getApiClient().getBasePath(),
@@ -364,7 +362,7 @@ public List<V4Message> searchMessagesSemantic(@Nonnull String query, @Nullable S
    * {@inheritDoc}
    */
   @Override
-  public V4Message send(@Nonnull V4Stream stream, @Nonnull String message) {
+  public V4Message send(V4Stream stream, String message) {
     return send(stream.getStreamId(), message);
   }
 
@@ -372,7 +370,7 @@ public V4Message send(@Nonnull V4Stream stream, @Nonnull String message) {
    * {@inheritDoc}
    */
   @Override
-  public V4Message send(@Nonnull String streamId, @Nonnull String message) {
+  public V4Message send(String streamId, String message) {
     return this.send(toUrlSafeIdIfNeeded(streamId), Message.builder().content(message).build());
   }
 
@@ -380,7 +378,7 @@ public V4Message send(@Nonnull String streamId, @Nonnull String message) {
    * {@inheritDoc}
    */
   @Override
-  public V4Message send(@Nonnull V4Stream stream, @Nonnull Message message) {
+  public V4Message send(V4Stream stream, Message message) {
     return this.send(stream.getStreamId(), message);
   }
 
@@ -388,7 +386,7 @@ public V4Message send(@Nonnull V4Stream stream, @Nonnull Message message) {
    * {@inheritDoc}
    */
   @Override
-  public V4Message send(@Nonnull String streamId, @Nonnull Message message) {
+  public V4Message send(String streamId, Message message) {
     if (senderOverride != null) {
       return this.executeAndRetry("send", messagesApi.getApiClient().getBasePath(),
           () -> wrapOverrideException(() -> senderOverride.send(authSession, streamId, message)));
@@ -416,7 +414,7 @@ public List<String> getAttachmentTypes() {
    */
   @Override
   @API(status = API.Status.EXPERIMENTAL)
-  public V4Message update(@Nonnull V4Message messageToUpdate, @Nonnull Message content) {
+  public V4Message update(V4Message messageToUpdate, Message content) {
     return this.update(messageToUpdate.getStream().getStreamId(), messageToUpdate.getMessageId(), content);
   }
 
@@ -431,7 +429,7 @@ public V4Message update(@Nonnull V4Message messageToUpdate, @Nonnull Message con
    */
   @Override
   @API(status = API.Status.EXPERIMENTAL)
-  public V4Message update(@Nonnull String streamId, @Nonnull String messageId, @Nonnull Message content) {
+  public V4Message update(String streamId, String messageId, Message content) {
     if (senderOverride != null) {
       return this.executeAndRetry("update", messagesApi.getApiClient().getBasePath(),
           () -> wrapOverrideException(() -> senderOverride.update(authSession, streamId, messageId, content)));
@@ -454,7 +452,7 @@ public V4Message update(@Nonnull String streamId, @Nonnull String messageId, @No
    * @return a {@link V4MessageBlastResponse} object containing the details of the sent messages
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#blast-message">Blast Message</a>
    */
-  public V4MessageBlastResponse send(@Nonnull List<String> streamIds, @Nonnull Message message) {
+  public V4MessageBlastResponse send(List<String> streamIds, Message message) {
     if (senderOverride != null) {
       return this.executeAndRetry("sendBlast", messagesApi.getApiClient().getBasePath(),
           () -> wrapOverrideException(() -> senderOverride.blast(authSession, streamIds, message)));
@@ -467,7 +465,7 @@ public V4MessageBlastResponse send(@Nonnull List<String> streamIds, @Nonnull Mes
    * The generated {@link MessagesApi#v4StreamSidMessageCreatePost(String, String, String, String, String, String, File, File)}
    * does not allow to send multiple attachments as well as in-memory files, so we have to "manually" process this call.
    */
-  private V4Message doSendMessage(@Nonnull String streamId, @Nonnull Message message) throws ApiException {
+  private V4Message doSendMessage(String streamId, Message message) throws ApiException {
     final String path =
         "/v4/stream/" + this.messagesApi.getApiClient().escapeString(toUrlSafeIdIfNeeded(streamId)) + "/message/create";
 
@@ -478,7 +476,7 @@ private V4Message doSendMessage(@Nonnull String streamId, @Nonnull Message messa
    * The generated {@link MessagesApi#v4MessageBlastPost(String, List, String, String, String, String, File, File)}
    * does not allow to send multiple attachments as well as in-memory files, so we have to "manually" process this call.
    */
-  private V4MessageBlastResponse doSendBlast(@Nonnull List<String> streamIds, @Nonnull Message message)
+  private V4MessageBlastResponse doSendBlast(List<String> streamIds, Message message)
       throws ApiException {
     final Map<String, Object> form = getForm(message);
     form.put("sids", String.join(",", streamIds));
@@ -535,7 +533,7 @@ private <T> T doSendFormData(String path, Map<String, Object> form, TypeReferenc
    * @return a byte array of attachment encoded in base 64
    * @see <a href="https://developers.symphony.com/restapi/reference#attachment">Attachment</a>
    */
-  public byte[] getAttachment(@Nonnull String streamId, @Nonnull String messageId, @Nonnull String attachmentId) {
+  public byte[] getAttachment(String streamId, String messageId, String attachmentId) {
     if (senderOverride != null) {
       return executeAndRetry("getAttachment", attachmentsApi.getApiClient().getBasePath(),
           () -> wrapOverrideException(() -> senderOverride.getAttachment(authSession, streamId, messageId, attachmentId)));
@@ -552,7 +550,7 @@ public byte[] getAttachment(@Nonnull String streamId, @Nonnull String messageId,
    * @return the list of imported messages
    * @see <a href="https://developers.symphony.com/restapi/reference#import-message-v4">Import Message</a>
    */
-  public List<V4ImportResponse> importMessages(@Nonnull List<V4ImportedMessage> messages) {
+  public List<V4ImportResponse> importMessages(List<V4ImportedMessage> messages) {
     if (senderOverride != null) {
       return executeAndRetry("importMessages", messagesApi.getApiClient().getBasePath(),
           () -> wrapOverrideException(() -> senderOverride.importMessages(authSession, messages)));
@@ -566,7 +564,7 @@ public List<V4ImportResponse> importMessages(@Nonnull List<V4ImportedMessage> me
    * {@inheritDoc}
    */
   @Override
-  public MessageSuppressionResponse suppressMessage(@Nonnull String messageId) {
+  public MessageSuppressionResponse suppressMessage(String messageId) {
     if (senderOverride != null) {
       return executeAndRetry("suppressMessage", messageSuppressionApi.getApiClient().getBasePath(),
           () -> wrapOverrideException(() -> senderOverride.suppressMessage(authSession, messageId)));
@@ -583,7 +581,7 @@ public MessageSuppressionResponse suppressMessage(@Nonnull String messageId) {
    * @return a {@link MessageStatus} instance
    * @see <a href="https://developers.symphony.com/restapi/reference#message-status">Message Status</a>
    */
-  public MessageStatus getMessageStatus(@Nonnull String messageId) {
+  public MessageStatus getMessageStatus(String messageId) {
     return executeAndRetry("getMessageStatus", messageApi.getApiClient().getBasePath(),
         () -> messageApi.v1MessageMidStatusGet(toUrlSafeIdIfNeeded(messageId), authSession.getSessionToken()));
   }
@@ -592,7 +590,7 @@ public MessageStatus getMessageStatus(@Nonnull String messageId) {
    * {@inheritDoc}
    */
   @Override
-  public V4Message getMessage(@Nonnull String messageId) {
+  public V4Message getMessage(String messageId) {
     if (retrieverOverride != null) {
       return executeAndRetry("getMessage", messagesApi.getApiClient().getBasePath(),
           () -> wrapOverrideException(() -> retrieverOverride.getMessage(authSession, messageId)));
@@ -613,7 +611,7 @@ public V4Message getMessage(@Nonnull String messageId) {
    * @return the list of attachments in the stream.
    * @see <a href="https://developers.symphony.com/restapi/reference#list-attachments">List Attachments</a>
    */
-  public List<StreamAttachmentItem> listAttachments(@Nonnull String streamId, @Nullable Instant since,
+  public List<StreamAttachmentItem> listAttachments(String streamId, @Nullable Instant since,
       @Nullable Instant to, @Nullable Integer limit, @Nullable AttachmentSort sort) {
     final String sortDir = sort == null ? AttachmentSort.ASC.name() : sort.name();
 
@@ -629,7 +627,7 @@ public List<StreamAttachmentItem> listAttachments(@Nonnull String streamId, @Nul
    * @return a {@link MessageReceiptDetailResponse} object holding all receipt information.
    * @see <a href="https://developers.symphony.com/restapi/reference#list-message-receipts">List Message Receipts</a>
    */
-  public MessageReceiptDetailResponse listMessageReceipts(@Nonnull String messageId) {
+  public MessageReceiptDetailResponse listMessageReceipts(String messageId) {
     return executeAndRetry("listMessageReceipts", defaultApi.getApiClient().getBasePath(), () ->
         defaultApi.v1AdminMessagesMessageIdReceiptsGet(authSession.getSessionToken(), toUrlSafeIdIfNeeded(messageId), null,
             null));
@@ -644,7 +642,7 @@ public MessageReceiptDetailResponse listMessageReceipts(@Nonnull String messageI
    * (parent, replies, forwards and form replies).
    * @see <a href="https://developers.symphony.com/restapi/reference#message-metadata-relationship">Message Metadata</a>
    */
-  public MessageMetadataResponse getMessageRelationships(@Nonnull String messageId) {
+  public MessageMetadataResponse getMessageRelationships(String messageId) {
     return executeAndRetry("getMessageRelationships", defaultApi.getApiClient().getBasePath(),
         () -> defaultApi.v1AdminMessagesMessageIdMetadataRelationshipsGet(
             authSession.getSessionToken(), ApiUtils.getUserAgent(), toUrlSafeIdIfNeeded(messageId)));
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/OboMessageService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/OboMessageService.java
index 57e49c3d2..66448b11a 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/OboMessageService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/OboMessageService.java
@@ -7,14 +7,12 @@
 import com.symphony.bdk.gen.api.model.V4Stream;
 import com.symphony.bdk.template.api.TemplateEngine;
 
-
 import org.apiguardian.api.API;
 
 import java.time.Instant;
 import java.util.List;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service interface exposing OBO-enabled endpoints to manage messages.
@@ -40,7 +38,7 @@ public interface OboMessageService {
    * @return the list of matching messages in the stream.
    * @see <a href="https://developers.symphony.com/restapi/reference/messages-v4">Messages</a>
    */
-  List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant since, @Nonnull PaginationAttribute pagination);
+  List<V4Message> listMessages(V4Stream stream, Instant since, PaginationAttribute pagination);
 
   /**
    * Get messages from an existing stream. Additionally returns any attachments associated with the message.
@@ -52,7 +50,7 @@ public interface OboMessageService {
    * @return the list of matching messages in the stream.
    * @see <a href="https://developers.symphony.com/restapi/reference/messages-v4">Messages</a>
    */
-  List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant since, Instant until, @Nonnull PaginationAttribute pagination);
+  List<V4Message> listMessages(V4Stream stream, Instant since, Instant until, PaginationAttribute pagination);
 
   /**
    * Get messages from an existing stream with default limit equals 50.
@@ -63,7 +61,7 @@ public interface OboMessageService {
    * @return the list of matching messages in the stream.
    * @see <a href="https://developers.symphony.com/restapi/reference/messages-v4">Messages</a>
    */
-  List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant since);
+  List<V4Message> listMessages(V4Stream stream, Instant since);
 
   /**
    * Get messages from an existing stream with default limit equals 50.
@@ -75,8 +73,7 @@ public interface OboMessageService {
    * @return the list of matching messages in the stream.
    * @see <a href="https://developers.symphony.com/restapi/reference/messages-v4">Messages</a>
    */
-  List<V4Message> listMessages(@Nonnull V4Stream stream, @Nonnull Instant since, Instant until);
-
+  List<V4Message> listMessages(V4Stream stream, Instant since, Instant until);
 
   /**
    * Get messages from an existing stream. Additionally returns any attachments associated with the message.
@@ -87,7 +84,7 @@ public interface OboMessageService {
    * @return the list of matching messages in the stream.
    * @see <a href="https://developers.symphony.com/restapi/reference/messages-v4">Messages</a>
    */
-  List<V4Message> listMessages(@Nonnull String streamId, @Nonnull Instant since, @Nonnull PaginationAttribute pagination);
+  List<V4Message> listMessages(String streamId, Instant since, PaginationAttribute pagination);
 
   /**
    * Get messages from an existing stream. Additionally returns any attachments associated with the message.
@@ -99,7 +96,7 @@ public interface OboMessageService {
    * @return the list of matching messages in the stream.
    * @see <a href="https://developers.symphony.com/restapi/reference/messages-v4">Messages</a>
    */
-  List<V4Message> listMessages(@Nonnull String streamId, @Nonnull Instant since, Instant until, @Nonnull PaginationAttribute pagination);
+  List<V4Message> listMessages(String streamId, Instant since, Instant until, PaginationAttribute pagination);
 
   /**
    * Get messages from an existing stream with default limit equals 50.
@@ -110,7 +107,7 @@ public interface OboMessageService {
    * @return the list of matching messages in the stream.
    * @see <a href="https://developers.symphony.com/restapi/reference/messages-v4">Messages</a>
    */
-  List<V4Message> listMessages(@Nonnull String streamId, @Nonnull Instant since);
+  List<V4Message> listMessages(String streamId, Instant since);
 
   /**
    * Get messages from an existing stream with default limit equals 50.
@@ -122,7 +119,7 @@ public interface OboMessageService {
    * @return the list of matching messages in the stream.
    * @see <a href="https://developers.symphony.com/restapi/reference/messages-v4">Messages</a>
    */
-  List<V4Message> listMessages(@Nonnull String streamId, @Nonnull Instant since, Instant until);
+  List<V4Message> listMessages(String streamId, Instant since, Instant until);
 
   /**
    * Sends a message to the stream ID of the passed {@link V4Stream} object.
@@ -132,7 +129,7 @@ public interface OboMessageService {
    * @return a {@link V4Message} object containing the details of the sent message
    * @see <a href="https://developers.symphony.com/restapi/reference/create-message-v4">Create Message v4</a>
    */
-  V4Message send(@Nonnull V4Stream stream, @Nonnull String message);
+  V4Message send(V4Stream stream, String message);
 
   /**
    * Sends a message to the stream ID passed in parameter.
@@ -142,7 +139,7 @@ public interface OboMessageService {
    * @return a {@link V4Message} object containing the details of the sent message
    * @see <a href="https://developers.symphony.com/restapi/reference/create-message-v4">Create Message v4</a>
    */
-  V4Message send(@Nonnull String streamId, @Nonnull String message);
+  V4Message send(String streamId, String message);
 
   /**
    * Sends a message to the stream ID passed in parameter.
@@ -152,7 +149,7 @@ public interface OboMessageService {
    * @return a {@link V4Message} object containing the details of the sent message
    * @see <a href="https://developers.symphony.com/restapi/reference/create-message-v4">Create Message v4</a>
    */
-  V4Message send(@Nonnull V4Stream stream, @Nonnull Message message);
+  V4Message send(V4Stream stream, Message message);
 
   /**
    * Sends a message to the stream ID passed in parameter.
@@ -162,7 +159,7 @@ public interface OboMessageService {
    * @return a {@link V4Message} object containing the details of the sent message
    * @see <a href="https://developers.symphony.com/restapi/reference/create-message-v4">Create Message v4</a>
    */
-  V4Message send(@Nonnull String streamId, @Nonnull Message message);
+  V4Message send(String streamId, Message message);
 
   /**
    * Update an existing message. The existing message must be a valid social message, that has not been deleted.
@@ -172,7 +169,7 @@ public interface OboMessageService {
    * @return a {@link V4Message} object containing the details of the sent message
    * @see <a href="https://developers.symphony.com/restapi/reference#update-message-v4">Create Update v4</a>
    */
-  V4Message update(@Nonnull V4Message messageToUpdate, @Nonnull Message content);
+  V4Message update(V4Message messageToUpdate, Message content);
 
   /**
    * Update an existing message. The existing message must be a valid social message, that has not been deleted.
@@ -183,7 +180,7 @@ public interface OboMessageService {
    * @return a {@link V4Message} object containing the details of the sent message
    * @see <a href="https://developers.symphony.com/restapi/reference#update-message-v4">Create Update v4</a>
    */
-  V4Message update(@Nonnull String streamId, @Nonnull String messageId, @Nonnull Message content);
+  V4Message update(String streamId, String messageId, Message content);
 
   /**
    * Suppresses a users message based on the messageID pass in parameter.
@@ -192,7 +189,7 @@ public interface OboMessageService {
    * @return a {@link MessageSuppressionResponse} object containing the details of the suppressed message
    * @see <a href="https://developers.symphony.com/restapi/reference/suppress-message">Suppress Message</a>
    */
-  MessageSuppressionResponse suppressMessage(@Nonnull String messageId);
+  MessageSuppressionResponse suppressMessage(String messageId);
 
   /**
    * Retrieves a list of supported file extensions for attachments.
@@ -209,7 +206,7 @@ public interface OboMessageService {
    * @return a {@link V4Message} containing the message's details, null if the message was not found
    * @see <a href="https://developers.symphony.com/restapi/reference#get-message-v1">Get Message v1</a>
    */
-  V4Message getMessage(@Nonnull String messageId);
+  V4Message getMessage(String messageId);
 
   /**
    * Searches for messages using a natural-language semantic query. Unlike the keyword based
@@ -220,7 +217,7 @@ public interface OboMessageService {
    * @return the list of matching messages.
    * @see <a href="https://developers.symphony.com/restapi/reference/semantic-search-messages">Semantic search messages</a>
    */
-  List<V4Message> searchMessagesSemantic(@Nonnull String query);
+  List<V4Message> searchMessagesSemantic(String query);
 
   /**
    * Searches for messages using a natural-language semantic query. Unlike the keyword based
@@ -232,7 +229,7 @@ public interface OboMessageService {
    * @return the list of matching messages.
    * @see <a href="https://developers.symphony.com/restapi/reference/semantic-search-messages">Semantic search messages</a>
    */
-  List<V4Message> searchMessagesSemantic(@Nonnull String query, @Nullable PaginationAttribute pagination);
+  List<V4Message> searchMessagesSemantic(String query, @Nullable PaginationAttribute pagination);
 
   /**
    * Searches for messages using a natural-language semantic query. Unlike the keyword based
@@ -245,6 +242,6 @@ public interface OboMessageService {
    * @return the list of matching messages.
    * @see <a href="https://developers.symphony.com/restapi/reference/semantic-search-messages">Semantic search messages</a>
    */
-  List<V4Message> searchMessagesSemantic(@Nonnull String query, @Nullable String streamId,
+  List<V4Message> searchMessagesSemantic(String query, @Nullable String streamId,
       @Nullable PaginationAttribute pagination);
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/model/Message.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/model/Message.java
index 1cf384a62..9dc7e7178 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/model/Message.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/model/Message.java
@@ -6,9 +6,6 @@
 import com.symphony.bdk.gen.api.model.V4Stream;
 import com.symphony.bdk.template.api.Template;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.json.JsonMapper;
 import lombok.AccessLevel;
 import lombok.Getter;
 import lombok.NoArgsConstructor;
@@ -17,13 +14,15 @@
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.apiguardian.api.API;
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.SerializationFeature;
+import tools.jackson.databind.json.JsonMapper;
 
 import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
 
-import javax.annotation.Nonnull;
-
 /**
  * Message model to be used in {@link com.symphony.bdk.core.service.message.MessageService#send(V4Stream, Message)}
  */
@@ -95,7 +94,11 @@ public static MessageBuilder builder() {
   @API(status = API.Status.STABLE)
   public static class MessageBuilder {
 
-    private static final ObjectMapper MAPPER = new JsonMapper();
+    // Jackson 3 defaults FAIL_ON_EMPTY_BEANS off; re-enable it so a bean with no accessible
+    // properties still surfaces as a MessageCreationException instead of silently sending "{}".
+    private static final ObjectMapper MAPPER = JsonMapper.builder()
+        .enable(SerializationFeature.FAIL_ON_EMPTY_BEANS)
+        .build();
 
     private String version = "2.0";
     private String content;
@@ -111,7 +114,7 @@ public static class MessageBuilder {
      * @param   message    messageML.
      * @return  this builder with the content configured.
      */
-    public MessageBuilder content(@Nonnull String message) {
+    public MessageBuilder content(String message) {
       this.content = message;
       return this;
     }
@@ -123,7 +126,7 @@ public MessageBuilder content(@Nonnull String message) {
      * @param   parameters  parameters to be used in the template.
      * @return  this builder with the content configured.
      */
-    public MessageBuilder template(@Nonnull Template template, @Nonnull Object parameters) {
+    public MessageBuilder template(Template template, Object parameters) {
       this.content = template.process(parameters);
       return this;
     }
@@ -134,7 +137,7 @@ public MessageBuilder template(@Nonnull Template template, @Nonnull Object param
      * @param   template a custom or built-in template.
      * @return  this builder with the content configured.
      */
-    public MessageBuilder template(@Nonnull Template template) {
+    public MessageBuilder template(Template template) {
       return this.template(template, emptyMap());
     }
 
@@ -143,16 +146,16 @@ public MessageBuilder template(@Nonnull Template template) {
      * @param   data Serializable data object.
      * @return  this builder with the data configured.
      */
-    public MessageBuilder data(@Nonnull Object data) {
+    public MessageBuilder data(Object data) {
       try {
         this.data = MAPPER.writeValueAsString(data);
         return this;
-      } catch (JsonProcessingException e) {
+      } catch (JacksonException e) {
         throw new MessageCreationException("Failed to serialize data (" + data.getClass() + ") to Json string", e);
       }
     }
 
-    public MessageBuilder silent(@Nonnull Boolean silent) {
+    public MessageBuilder silent(Boolean silent) {
       this.silent = silent;
       return this;
     }
@@ -176,7 +179,7 @@ public MessageBuilder beta(Boolean beta) {
      * @param filename Filename of the attachment.
      * @return  this builder with the data configured.
      */
-    public MessageBuilder addAttachment(@Nonnull InputStream content, @Nonnull String filename) {
+    public MessageBuilder addAttachment(InputStream content, String filename) {
       this.attachments.add(new Attachment(content, filename));
       return this;
     }
@@ -188,7 +191,7 @@ public MessageBuilder addAttachment(@Nonnull InputStream content, @Nonnull Strin
      * @param filename Filename of the attachment.
      * @return  this builder with the data configured.
      */
-    public MessageBuilder addAttachment(@Nonnull InputStream attachment, @Nonnull InputStream preview, @Nonnull String filename) {
+    public MessageBuilder addAttachment(InputStream attachment, InputStream preview, String filename) {
       this.attachments.add(new Attachment(attachment, filename));
       this.previews.add(new Attachment(preview, "preview-" + filename));
       return this;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/model/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/model/package-info.java
new file mode 100644
index 000000000..3466d813b
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/model/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.message.model;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/package-info.java
new file mode 100644
index 000000000..40ea089c9
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.message;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/util/MessageParser.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/util/MessageParser.java
index 3b0a091be..589cacdd2 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/util/MessageParser.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/message/util/MessageParser.java
@@ -3,12 +3,12 @@
 import com.symphony.bdk.core.service.message.exception.MessageParserException;
 import com.symphony.bdk.gen.api.model.V4Message;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.AccessLevel;
 import lombok.NoArgsConstructor;
 import org.apiguardian.api.API;
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
 
 import java.util.ArrayList;
 import java.util.Collections;
@@ -99,7 +99,7 @@ private static List<String> getTags(V4Message message, EntityTypeEnum type) thro
   private static JsonNode getJsonNode(String data) throws MessageParserException {
     try {
       return MAPPER.readTree(data);
-    } catch (JsonProcessingException e) {
+    } catch (JacksonException e) {
       throw new MessageParserException("Failed to extract payload from message data", e);
     }
   }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/CursorPaginationAttribute.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/CursorPaginationAttribute.java
index bba001093..0144dd8bb 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/CursorPaginationAttribute.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/CursorPaginationAttribute.java
@@ -3,8 +3,6 @@
 import lombok.Getter;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Pagination Attribute model to be used in default pagination methods provided by bdk services class.
  */
@@ -29,7 +27,7 @@ public class CursorPaginationAttribute {
    */
   private final Integer limit;
 
-  public CursorPaginationAttribute(@Nonnull Integer before, @Nonnull Integer after, @Nonnull Integer limit) {
+  public CursorPaginationAttribute(Integer before, Integer after, Integer limit) {
     this.before = before;
     this.after = after;
     this.limit = limit;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/PaginationAttribute.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/PaginationAttribute.java
index e28196cd4..494a139bf 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/PaginationAttribute.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/PaginationAttribute.java
@@ -3,8 +3,6 @@
 import lombok.Getter;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Pagination Attribute model to be used in default pagination methods provided by bdk services class.
  */
@@ -22,7 +20,7 @@ public class PaginationAttribute {
    */
   private final Integer limit;
 
-  public PaginationAttribute(@Nonnull Integer skip, @Nonnull Integer limit) {
+  public PaginationAttribute(Integer skip, Integer limit) {
     this.skip = skip;
     this.limit = limit;
   }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/StreamPaginationAttribute.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/StreamPaginationAttribute.java
index 7b0b1e159..01747853d 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/StreamPaginationAttribute.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/StreamPaginationAttribute.java
@@ -3,8 +3,6 @@
 import lombok.Getter;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 /**
  * Stream Pagination Attribute model to be used in stream pagination methods provided by bdk services class.
  */
@@ -22,7 +20,7 @@ public class StreamPaginationAttribute {
    */
   private final Integer totalSize;
 
-  public StreamPaginationAttribute(@Nonnull Integer chunkSize, @Nonnull Integer totalSize) {
+  public StreamPaginationAttribute(Integer chunkSize, Integer totalSize) {
     this.chunkSize = chunkSize;
     this.totalSize = totalSize;
   }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/package-info.java
new file mode 100644
index 000000000..e41ab2ca3
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/pagination/model/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.pagination.model;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/OboPresenceService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/OboPresenceService.java
index e759e345f..60d26a12e 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/OboPresenceService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/OboPresenceService.java
@@ -7,8 +7,7 @@
 
 import java.util.List;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service interface exposing OBO-enabled endpoints to manage user presence information.
@@ -48,7 +47,7 @@ public interface OboPresenceService {
    * @return Presence info of the looked up user.
    * @see <a href="https://developers.symphony.com/restapi/reference/user-presence-v3">Get User Presence</a>
    */
-  V2Presence getUserPresence(@Nonnull Long userId, @Nullable Boolean local);
+  V2Presence getUserPresence(Long userId, @Nullable Boolean local);
 
   /**
    * Register interest in a list of external users to get their presence info.
@@ -57,7 +56,7 @@ public interface OboPresenceService {
    * @param userIds List of user ids to be registered.
    * @see <a href="https://developers.symphony.com/restapi/reference#register-user-presence-interest">External Presence Interest</a>
    */
-  void externalPresenceInterest(@Nonnull List<Long> userIds);
+  void externalPresenceInterest(List<Long> userIds);
 
   /**
    * Set the presence info of the calling user.
@@ -73,7 +72,7 @@ public interface OboPresenceService {
    * @return Presence info of the calling user.
    * @see <a href="https://developers.symphony.com/restapi/reference#set-presence">Set Presence</a>
    */
-  V2Presence setPresence(@Nonnull PresenceStatus status, @Nullable Boolean soft);
+  V2Presence setPresence(PresenceStatus status, @Nullable Boolean soft);
 
   /**
    * Creates a new stream capturing online status changes ("presence feed") for the company (pod) and returns the ID of
@@ -94,7 +93,7 @@ public interface OboPresenceService {
    * @return The list of user presences has changed since the last presence read.
    * @see <a href="https://developers.symphony.com/restapi/reference#read-presence-feed">Read Presence Feed</a>
    */
-  List<V2Presence> readPresenceFeed(@Nonnull String feedId);
+  List<V2Presence> readPresenceFeed(String feedId);
 
   /**
    * Delete the specified presence feed that was created.
@@ -103,7 +102,7 @@ public interface OboPresenceService {
    * @param feedId The presence feed id to be deleted.
    * @return The id of the deleted presence feed.
    */
-  String deletePresenceFeed(@Nonnull String feedId);
+  String deletePresenceFeed(String feedId);
 
   /**
    * Set the presence state of a another user.
@@ -119,5 +118,5 @@ public interface OboPresenceService {
    *                but the user is currently idle, their status will be represented as AWAY)
    * @return The presence info of the specified user.
    */
-  V2Presence setUserPresence(@Nonnull Long userId, @Nonnull PresenceStatus status, @Nullable Boolean soft);
+  V2Presence setUserPresence(Long userId, PresenceStatus status, @Nullable Boolean soft);
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/PresenceService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/PresenceService.java
index ec99389c8..ec0cd6353 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/PresenceService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/PresenceService.java
@@ -16,8 +16,7 @@
 
 import java.util.List;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service class for managing user presence information.
@@ -83,7 +82,7 @@ public List<V2Presence> listPresences(@Nullable Long lastUserId, @Nullable Integ
    * {@inheritDoc}
    */
   @Override
-  public V2Presence getUserPresence(@Nonnull Long userId, @Nullable Boolean local) {
+  public V2Presence getUserPresence(Long userId, @Nullable Boolean local) {
     return executeAndRetry("getUserPresence",
         () -> presenceApi.v3UserUidPresenceGet(userId, local, authSession.getSessionToken()));
   }
@@ -92,7 +91,7 @@ public V2Presence getUserPresence(@Nonnull Long userId, @Nullable Boolean local)
    * {@inheritDoc}
    */
   @Override
-  public void externalPresenceInterest(@Nonnull List<Long> userIds) {
+  public void externalPresenceInterest(List<Long> userIds) {
     executeAndRetry("externalPresenceInterest",
         () -> presenceApi.v1UserPresenceRegisterPost(authSession.getSessionToken(), userIds));
   }
@@ -101,7 +100,7 @@ public void externalPresenceInterest(@Nonnull List<Long> userIds) {
    * {@inheritDoc}
    */
   @Override
-  public V2Presence setPresence(@Nonnull PresenceStatus status, @Nullable Boolean soft) {
+  public V2Presence setPresence(PresenceStatus status, @Nullable Boolean soft) {
     V2PresenceStatus presenceStatus = new V2PresenceStatus().category(status.name());
     return executeAndRetry("setPresence",
         () -> presenceApi.v2UserPresencePost(authSession.getSessionToken(), soft, presenceStatus));
@@ -120,7 +119,7 @@ public String createPresenceFeed() {
    * {@inheritDoc}
    */
   @Override
-  public List<V2Presence> readPresenceFeed(@Nonnull String feedId) {
+  public List<V2Presence> readPresenceFeed(String feedId) {
     return executeAndRetry("readPresenceFeed",
         () -> presenceApi.v1PresenceFeedFeedIdReadGet(authSession.getSessionToken(), feedId));
   }
@@ -129,7 +128,7 @@ public List<V2Presence> readPresenceFeed(@Nonnull String feedId) {
    * {@inheritDoc}
    */
   @Override
-  public String deletePresenceFeed(@Nonnull String feedId) {
+  public String deletePresenceFeed(String feedId) {
     return executeAndRetry("deletePresenceFeed",
         () -> presenceApi.v1PresenceFeedFeedIdDeletePost(authSession.getSessionToken(), feedId)).getId();
   }
@@ -138,7 +137,7 @@ public String deletePresenceFeed(@Nonnull String feedId) {
    * {@inheritDoc}
    */
   @Override
-  public V2Presence setUserPresence(@Nonnull Long userId, @Nonnull PresenceStatus status, @Nullable Boolean soft) {
+  public V2Presence setUserPresence(Long userId, PresenceStatus status, @Nullable Boolean soft) {
     V2UserPresence userPresence = new V2UserPresence().userId(userId).category(status.name());
     return executeAndRetry("setUserPresence",
         () -> presenceApi.v3UserPresencePost(authSession.getSessionToken(), soft, userPresence));
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/package-info.java
new file mode 100644
index 000000000..0b6a2a676
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/presence/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.presence;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/OboSignalService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/OboSignalService.java
index 13fe93539..6c8c77491 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/OboSignalService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/OboSignalService.java
@@ -12,8 +12,7 @@
 import java.util.List;
 import java.util.stream.Stream;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service interface exposing OBO-enabled endpoints to manage signals information.
@@ -29,7 +28,7 @@ public interface OboSignalService {
    * @return List of signals that the user has created and public signals to which they have subscribed.
    * @see <a href="https://developers.symphony.com/restapi/reference/list-signals">List Signals</a>
    */
-  List<Signal> listSignals(@Nonnull PaginationAttribute pagination);
+  List<Signal> listSignals(PaginationAttribute pagination);
 
   /**
    * Lists signals on behalf of the user with default limit equal 50.
@@ -49,7 +48,7 @@ public interface OboSignalService {
    * @see <a href="https://developers.symphony.com/restapi/reference/list-signals">List Signals</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  Stream<Signal> listAllSignals(@Nonnull StreamPaginationAttribute pagination);
+  Stream<Signal> listAllSignals(StreamPaginationAttribute pagination);
 
   /**
    * Lists paginated stream of signals on behalf of the user with the default chunkSize and totalSize equal 100.
@@ -69,7 +68,7 @@ public interface OboSignalService {
    * @return Details of the specified signal.
    * @see <a href="https://developers.symphony.com/restapi/reference/get-signal">Get Signal</a>
    */
-  Signal getSignal(@Nonnull String id);
+  Signal getSignal(String id);
 
   /**
    * Create a new signal.
@@ -79,7 +78,7 @@ public interface OboSignalService {
    * @return A new created signal object.
    * @see <a href="https://developers.symphony.com/restapi/reference#create-signal">Create Signal</a>
    */
-  Signal createSignal(@Nonnull BaseSignal signal);
+  Signal createSignal(BaseSignal signal);
 
   /**
    * Update an existing signal.
@@ -90,7 +89,7 @@ public interface OboSignalService {
    * @return The updated signal.
    * @see <a href="https://developers.symphony.com/restapi/reference#update-signal">Update Signal</a>
    */
-  Signal updateSignal(@Nonnull String id, @Nonnull BaseSignal signal);
+  Signal updateSignal(String id, BaseSignal signal);
 
   /**
    * Delete an existing signal.
@@ -99,7 +98,7 @@ public interface OboSignalService {
    * @param id  The id of the signal to be deleted.
    * @see <a href="https://developers.symphony.com/restapi/reference#delete-signal">Delete Signal</a>
    */
-  void deleteSignal(@Nonnull String id);
+  void deleteSignal(String id);
 
   /**
    * Subscribe a list of users to a signal.
@@ -112,7 +111,7 @@ public interface OboSignalService {
    * @return The subscription information.
    * @see <a href="https://developers.symphony.com/restapi/reference#subscribe-signal">Subscribe Signal</a>
    */
-  ChannelSubscriptionResponse subscribeUsersToSignal(@Nonnull String id, @Nullable Boolean pushed, @Nullable List<Long> userIds);
+  ChannelSubscriptionResponse subscribeUsersToSignal(String id, @Nullable Boolean pushed, @Nullable List<Long> userIds);
 
   /**
    * Unsubscribe a list of users from a signal.
@@ -123,7 +122,7 @@ public interface OboSignalService {
    * @return The unsubscription information.
    * @see <a href="https://developers.symphony.com/restapi/reference#unsubscribe-signal">Unsubscribe Signal</a>
    */
-  ChannelSubscriptionResponse unsubscribeUsersFromSignal(@Nonnull String id, @Nullable List<Long> userIds);
+  ChannelSubscriptionResponse unsubscribeUsersFromSignal(String id, @Nullable List<Long> userIds);
 
   /**
    * Get the subscribers for a specified signal.
@@ -134,7 +133,7 @@ public interface OboSignalService {
    * @return List of subscribers of the signal.
    * @see <a href="https://developers.symphony.com/restapi/reference#subscribers">Subscribers</a>
    */
-  List<ChannelSubscriber> listSubscribers(@Nonnull String id, @Nonnull PaginationAttribute pagination);
+  List<ChannelSubscriber> listSubscribers(String id, PaginationAttribute pagination);
 
   /**
    * Get the subscribers for a specified signal with default limit equal to 100.
@@ -144,7 +143,7 @@ public interface OboSignalService {
    * @return List of subscribers of the signal.
    * @see <a href="https://developers.symphony.com/restapi/reference#subscribers">Subscribers</a>
    */
-  List<ChannelSubscriber> listSubscribers(@Nonnull String id);
+  List<ChannelSubscriber> listSubscribers(String id);
 
   /**
    * Get the paginated stream of subscribers for a specified signal.
@@ -156,7 +155,7 @@ public interface OboSignalService {
    * @see <a href="https://developers.symphony.com/restapi/reference#subscribers">Subscribers</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  Stream<ChannelSubscriber> listAllSubscribers(@Nonnull String id, @Nonnull StreamPaginationAttribute pagination);
+  Stream<ChannelSubscriber> listAllSubscribers(String id, StreamPaginationAttribute pagination);
 
   /**
    * Get the paginated stream of subscribers for a specified signal with the default chunkSize and totalSize equal to 100.
@@ -167,5 +166,5 @@ public interface OboSignalService {
    * @see <a href="https://developers.symphony.com/restapi/reference#subscribers">Subscribers</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  Stream<ChannelSubscriber> listAllSubscribers(@Nonnull String id);
+  Stream<ChannelSubscriber> listAllSubscribers(String id);
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/SignalService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/SignalService.java
index 7781620cf..a7837f319 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/SignalService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/SignalService.java
@@ -22,8 +22,7 @@
 import java.util.List;
 import java.util.stream.Stream;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service class for managing signal information.
@@ -69,7 +68,7 @@ public OboSignalService obo(AuthSession oboSession) {
    * {@inheritDoc}
    */
   @Override
-  public List<Signal> listSignals(@Nonnull PaginationAttribute pagination) {
+  public List<Signal> listSignals(PaginationAttribute pagination) {
     return executeAndRetry("listSignals",
         () -> signalsApi.v1SignalsListGet(authSession.getSessionToken(), authSession.getKeyManagerToken(),
             pagination.getSkip(), pagination.getLimit()));
@@ -89,7 +88,7 @@ public List<Signal> listSignals() {
    */
   @Override
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<Signal> listAllSignals(@Nonnull StreamPaginationAttribute pagination) {
+  public Stream<Signal> listAllSignals(StreamPaginationAttribute pagination) {
     OffsetBasedPaginatedApi<Signal> api = (offset, limit) -> listSignals(new PaginationAttribute(offset, limit));
     return new OffsetBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
   }
@@ -109,7 +108,7 @@ public Stream<Signal> listAllSignals() {
    * {@inheritDoc}
    */
   @Override
-  public Signal getSignal(@Nonnull String id) {
+  public Signal getSignal(String id) {
     return executeAndRetry("getSignal",
         () -> signalsApi.v1SignalsIdGetGet(authSession.getSessionToken(), id, authSession.getKeyManagerToken()));
   }
@@ -118,7 +117,7 @@ public Signal getSignal(@Nonnull String id) {
    * {@inheritDoc}
    */
   @Override
-  public Signal createSignal(@Nonnull BaseSignal signal) {
+  public Signal createSignal(BaseSignal signal) {
     return executeAndRetry("createSignal",
         () -> signalsApi.v1SignalsCreatePost(authSession.getSessionToken(), authSession.getKeyManagerToken(), signal));
   }
@@ -127,7 +126,7 @@ public Signal createSignal(@Nonnull BaseSignal signal) {
    * {@inheritDoc}
    */
   @Override
-  public Signal updateSignal(@Nonnull String id, @Nonnull BaseSignal signal) {
+  public Signal updateSignal(String id, BaseSignal signal) {
     return executeAndRetry("updateSignal",
         () -> signalsApi.v1SignalsIdUpdatePost(authSession.getSessionToken(), authSession.getKeyManagerToken(), id, signal));
   }
@@ -136,7 +135,7 @@ public Signal updateSignal(@Nonnull String id, @Nonnull BaseSignal signal) {
    * {@inheritDoc}
    */
   @Override
-  public void deleteSignal(@Nonnull String id) {
+  public void deleteSignal(String id) {
     executeAndRetry("deleteSignal",
         () -> signalsApi.v1SignalsIdDeletePost(authSession.getSessionToken(), authSession.getKeyManagerToken(), id));
   }
@@ -145,7 +144,7 @@ public void deleteSignal(@Nonnull String id) {
    * {@inheritDoc}
    */
   @Override
-  public ChannelSubscriptionResponse subscribeUsersToSignal(@Nonnull String id, @Nullable Boolean pushed,
+  public ChannelSubscriptionResponse subscribeUsersToSignal(String id, @Nullable Boolean pushed,
       @Nullable List<Long> userIds) {
     return executeAndRetry("subscribeUsersToSignal",
         () -> signalsApi.v1SignalsIdSubscribePost(authSession.getSessionToken(), authSession.getKeyManagerToken(), id,
@@ -156,7 +155,7 @@ public ChannelSubscriptionResponse subscribeUsersToSignal(@Nonnull String id, @N
    * {@inheritDoc}
    */
   @Override
-  public ChannelSubscriptionResponse unsubscribeUsersFromSignal(@Nonnull String id, @Nullable List<Long> userIds) {
+  public ChannelSubscriptionResponse unsubscribeUsersFromSignal(String id, @Nullable List<Long> userIds) {
     return executeAndRetry("unsubscribeUsersFromSignal",
         () -> signalsApi.v1SignalsIdUnsubscribePost(authSession.getSessionToken(), id, authSession.getKeyManagerToken(),
             userIds));
@@ -166,7 +165,7 @@ public ChannelSubscriptionResponse unsubscribeUsersFromSignal(@Nonnull String id
    * {@inheritDoc}
    */
   @Override
-  public List<ChannelSubscriber> listSubscribers(@Nonnull String id, @Nonnull PaginationAttribute pagination) {
+  public List<ChannelSubscriber> listSubscribers(String id, PaginationAttribute pagination) {
     return executeAndRetry("listSubscribers",
         () -> signalsApi.v1SignalsIdSubscribersGet(authSession.getSessionToken(), id, authSession.getKeyManagerToken(),
             pagination.getSkip(), pagination.getLimit())).getData();
@@ -176,7 +175,7 @@ public List<ChannelSubscriber> listSubscribers(@Nonnull String id, @Nonnull Pagi
    * {@inheritDoc}
    */
   @Override
-  public List<ChannelSubscriber> listSubscribers(@Nonnull String id) {
+  public List<ChannelSubscriber> listSubscribers(String id) {
     return executeAndRetry("listSubscribers",
         () -> signalsApi.v1SignalsIdSubscribersGet(authSession.getSessionToken(), id, authSession.getKeyManagerToken(),
             null, null)).getData();
@@ -187,8 +186,8 @@ public List<ChannelSubscriber> listSubscribers(@Nonnull String id) {
    */
   @Override
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<ChannelSubscriber> listAllSubscribers(@Nonnull String id,
-      @Nonnull StreamPaginationAttribute pagination) {
+  public Stream<ChannelSubscriber> listAllSubscribers(String id,
+      StreamPaginationAttribute pagination) {
     OffsetBasedPaginatedApi<ChannelSubscriber> api =
         (((offset, limit) -> listSubscribers(id, new PaginationAttribute(offset, limit))));
     return new OffsetBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
@@ -199,7 +198,7 @@ public Stream<ChannelSubscriber> listAllSubscribers(@Nonnull String id,
    */
   @Override
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<ChannelSubscriber> listAllSubscribers(@Nonnull String id) {
+  public Stream<ChannelSubscriber> listAllSubscribers(String id) {
     OffsetBasedPaginatedApi<ChannelSubscriber> api =
         (((offset, limit) -> listSubscribers(id, new PaginationAttribute(offset, limit))));
     return new OffsetBasedPaginatedService<>(api, PaginatedService.DEFAULT_PAGINATION_CHUNK_SIZE,
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/package-info.java
new file mode 100644
index 000000000..14b3328bd
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/signal/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.signal;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/OboStreamService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/OboStreamService.java
index a67f90aef..7057ad502 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/OboStreamService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/OboStreamService.java
@@ -15,8 +15,7 @@
 import com.symphony.bdk.gen.api.model.V3RoomSearchResults;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 import java.util.List;
 
 /**
@@ -32,7 +31,7 @@ public interface OboStreamService {
    * @return The created IM
    * @see <a href="https://developers.symphony.com/restapi/reference/create-im-or-mim">Create IM or MIM</a>
    */
-   Stream create(@Nonnull Long... uids);
+   Stream create(Long... uids);
 
   /**
    * Create a new single or multi party instant message conversation between the caller and specified users.
@@ -51,7 +50,7 @@ public interface OboStreamService {
    * @return The created IM or MIM
    * @see <a href="https://developers.symphony.com/restapi/reference/create-im-or-mim">Create IM or MIM</a>
    */
-  Stream create(@Nonnull List<Long> uids);
+  Stream create(List<Long> uids);
 
   /**
    * Create a new chatroom.
@@ -61,7 +60,7 @@ public interface OboStreamService {
    * @return The created chatroom
    * @see <a href="https://developers.symphony.com/restapi/reference/create-room-v3">Create Room V3</a>
    */
-  V3RoomDetail create(@Nonnull V3RoomAttributes roomAttributes);
+  V3RoomDetail create(V3RoomAttributes roomAttributes);
 
   /**
    * {@link StreamService#getStream(String)}
@@ -70,7 +69,7 @@ public interface OboStreamService {
    * @return The information about the stream with the given id.
    * @see <a href="https://developers.symphony.com/restapi/reference/stream-info-v2">Stream Info V2</a>
    */
-  V2StreamAttributes getStream(@Nonnull String streamId);
+  V2StreamAttributes getStream(String streamId);
 
   /**
    * Get information about a particular room.
@@ -79,7 +78,7 @@ public interface OboStreamService {
    * @return The information about the room with the given room id.
    * @see <a href="https://developers.symphony.com/restapi/reference#room-info-v3">Room Info V3</a>
    */
-  V3RoomDetail getRoomInfo(@Nonnull String roomId);
+  V3RoomDetail getRoomInfo(String roomId);
 
   /**
    * {@link StreamService#listStreams(StreamFilter)}
@@ -98,7 +97,7 @@ public interface OboStreamService {
    * @return The list of streams retrieved according to the searching criteria.
    * @see <a href="https://developers.symphony.com/restapi/reference/list-user-streams">List Streams</a>
    */
-  List<StreamAttributes> listStreams(@Nullable StreamFilter filter, @Nonnull PaginationAttribute pagination);
+  List<StreamAttributes> listStreams(@Nullable StreamFilter filter, PaginationAttribute pagination);
 
   /**
    * {@link StreamService#listAllStreams(StreamFilter)}
@@ -120,7 +119,7 @@ public interface OboStreamService {
    */
   @API(status = API.Status.EXPERIMENTAL)
   java.util.stream.Stream<StreamAttributes> listAllStreams(@Nullable StreamFilter filter,
-      @Nonnull StreamPaginationAttribute pagination);
+      StreamPaginationAttribute pagination);
 
   /**
    * Search rooms according to the specified criteria.
@@ -129,7 +128,7 @@ java.util.stream.Stream<StreamAttributes> listAllStreams(@Nullable StreamFilter
    * @return The rooms returned according to the given criteria.
    * @see <a href="https://developers.symphony.com/restapi/reference/search-rooms-v3">Search Rooms V3</a>
    */
-  V3RoomSearchResults searchRooms(@Nonnull V2RoomSearchCriteria query);
+  V3RoomSearchResults searchRooms(V2RoomSearchCriteria query);
 
   /**
    * Search rooms according to the specified criteria.
@@ -139,7 +138,7 @@ java.util.stream.Stream<StreamAttributes> listAllStreams(@Nullable StreamFilter
    * @return The rooms returned according to the given criteria.
    * @see <a href="https://developers.symphony.com/restapi/reference/search-rooms-v3">Search Rooms V3</a>
    */
-  V3RoomSearchResults searchRooms(@Nonnull V2RoomSearchCriteria query, @Nonnull PaginationAttribute pagination);
+  V3RoomSearchResults searchRooms(V2RoomSearchCriteria query, PaginationAttribute pagination);
 
   /**
    * Search rooms and return in a {@link java.util.stream.Stream} according to the specified criteria.
@@ -149,7 +148,7 @@ java.util.stream.Stream<StreamAttributes> listAllStreams(@Nullable StreamFilter
    * @see <a href="https://developers.symphony.com/restapi/reference/search-rooms-v3">Search Rooms V3</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriteria query);
+  java.util.stream.Stream<V3RoomDetail> searchAllRooms(V2RoomSearchCriteria query);
 
   /**
    * Search rooms and return in a {@link java.util.stream.Stream} according to the specified criteria.
@@ -160,8 +159,8 @@ java.util.stream.Stream<StreamAttributes> listAllStreams(@Nullable StreamFilter
    * @see <a href="https://developers.symphony.com/restapi/reference/search-rooms-v3">Search Rooms V3</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriteria query,
-      @Nonnull StreamPaginationAttribute pagination);
+  java.util.stream.Stream<V3RoomDetail> searchAllRooms(V2RoomSearchCriteria query,
+      StreamPaginationAttribute pagination);
 
   /**
    * Update the attributes of an existing chatroom.
@@ -171,7 +170,7 @@ java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriter
    * @return The information of the room after being updated.
    * @see <a href="https://developers.symphony.com/restapi/reference#update-room-v3">Update Room V3</a>
    */
-  V3RoomDetail updateRoom(@Nonnull String roomId, @Nonnull V3RoomAttributes roomAttributes);
+  V3RoomDetail updateRoom(String roomId, V3RoomAttributes roomAttributes);
 
   /**
    * {@link StreamService#addMemberToRoom(Long, String)}
@@ -180,7 +179,7 @@ java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriter
    * @param roomId      The room id
    * @see <a href="https://developers.symphony.com/restapi/reference/add-member">Add Member</a>
    */
-  void addMemberToRoom(@Nonnull Long userId, @Nonnull String roomId);
+  void addMemberToRoom(Long userId, String roomId);
 
   /**
    * {@link StreamService#removeMemberFromRoom(Long, String)}
@@ -189,7 +188,7 @@ java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriter
    * @param roomId      The room id
    * @see <a href="https://developers.symphony.com/restapi/reference/remove-member">Remove Member</a>
    */
-  void removeMemberFromRoom(@Nonnull Long userId, @Nonnull String roomId);
+  void removeMemberFromRoom(Long userId, String roomId);
 
   /**
    * {@link StreamService#share(String, ShareContent)}
@@ -199,7 +198,7 @@ java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriter
    * @return Message contains share content
    * @see <a href="https://developers.symphony.com/restapi/reference/share-v3">Share</a>
    */
-  V2Message share(@Nonnull String streamId, @Nonnull ShareContent content);
+  V2Message share(String streamId, ShareContent content);
 
   /**
    * {@link StreamService#promoteUserToRoomOwner(Long, String)}
@@ -208,7 +207,7 @@ java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriter
    * @param roomId      The room id.
    * @see <a href="https://developers.symphony.com/restapi/reference/promote-owner">Promote Owner</a>
    */
-  void promoteUserToRoomOwner(@Nonnull Long userId, @Nonnull String roomId);
+  void promoteUserToRoomOwner(Long userId, String roomId);
 
   /**
    * {@link StreamService#demoteUserToRoomParticipant(Long, String)}
@@ -217,7 +216,7 @@ java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriter
    * @param roomId      The room id.
    * @see <a href="https://developers.symphony.com/restapi/reference/demote-owner">Demote Owner</a>
    */
-  void demoteUserToRoomParticipant(@Nonnull Long userId, @Nonnull String roomId);
+  void demoteUserToRoomParticipant(Long userId, String roomId);
 
   /**
    * Lists the current members of an existing room.
@@ -226,5 +225,5 @@ java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriter
    * @return List of members in the room with the given room id.
    * @see <a href="https://developers.symphony.com/restapi/reference#room-members">Room Members</a>
    */
-  List<MemberInfo> listRoomMembers(@Nonnull String roomId);
+  List<MemberInfo> listRoomMembers(String roomId);
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/StreamService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/StreamService.java
index a66cdf29a..9d3b39970 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/StreamService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/StreamService.java
@@ -43,8 +43,7 @@
 import java.util.Arrays;
 import java.util.List;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service class for managing streams.
@@ -100,7 +99,7 @@ public OboStreamService obo(AuthSession oboSession) {
    * {@inheritDoc}
    */
   @Override
-  public V2StreamAttributes getStream(@Nonnull String streamId) {
+  public V2StreamAttributes getStream(String streamId) {
     return executeAndRetry("getStreamInfo", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v2StreamsSidInfoGet(toUrlSafeIdIfNeeded(streamId), authSession.getSessionToken()));
   }
@@ -118,7 +117,7 @@ public List<StreamAttributes> listStreams(@Nullable StreamFilter filter) {
    * {@inheritDoc}
    */
   @Override
-  public List<StreamAttributes> listStreams(@Nullable StreamFilter filter, @Nonnull PaginationAttribute pagination) {
+  public List<StreamAttributes> listStreams(@Nullable StreamFilter filter, PaginationAttribute pagination) {
     return executeAndRetry("listStreams", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v1StreamsListPost(authSession.getSessionToken(), pagination.getSkip(), pagination.getLimit(),
             filter));
@@ -141,7 +140,7 @@ public java.util.stream.Stream<StreamAttributes> listAllStreams(@Nullable Stream
   @Override
   @API(status = API.Status.EXPERIMENTAL)
   public java.util.stream.Stream<StreamAttributes> listAllStreams(@Nullable StreamFilter filter,
-      @Nonnull StreamPaginationAttribute pagination) {
+      StreamPaginationAttribute pagination) {
     OffsetBasedPaginatedApi<StreamAttributes> api = (offset, limit) -> listStreams(filter, new PaginationAttribute(offset, limit));
     return new OffsetBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
   }
@@ -150,7 +149,7 @@ public java.util.stream.Stream<StreamAttributes> listAllStreams(@Nullable Stream
    * {@inheritDoc}
    */
   @Override
-  public void addMemberToRoom(@Nonnull Long userId, @Nonnull String roomId) {
+  public void addMemberToRoom(Long userId, String roomId) {
     UserId user = new UserId().id(userId);
     executeAndRetry("addMemberToRoom", roomMembershipApi.getApiClient().getBasePath(),
         () -> roomMembershipApi.v1RoomIdMembershipAddPost(toUrlSafeIdIfNeeded(roomId), authSession.getSessionToken(), user));
@@ -160,7 +159,7 @@ public void addMemberToRoom(@Nonnull Long userId, @Nonnull String roomId) {
    * {@inheritDoc}
    */
   @Override
-  public void removeMemberFromRoom(@Nonnull Long userId, @Nonnull String roomId) {
+  public void removeMemberFromRoom(Long userId, String roomId) {
     UserId user = new UserId().id(userId);
     executeAndRetry("removeMemberFrom", roomMembershipApi.getApiClient().getBasePath(),
         () -> roomMembershipApi.v1RoomIdMembershipRemovePost(toUrlSafeIdIfNeeded(roomId), authSession.getSessionToken(), user));
@@ -170,7 +169,7 @@ public void removeMemberFromRoom(@Nonnull Long userId, @Nonnull String roomId) {
    * {@inheritDoc}
    */
   @Override
-  public V2Message share(@Nonnull String streamId, @Nonnull ShareContent content) {
+  public V2Message share(String streamId, ShareContent content) {
     return executeAndRetry("share", shareApi.getApiClient().getBasePath(),
         () -> shareApi.v3StreamSidSharePost(toUrlSafeIdIfNeeded(streamId), authSession.getSessionToken(), authSession.getKeyManagerToken(), content));
   }
@@ -179,7 +178,7 @@ public V2Message share(@Nonnull String streamId, @Nonnull ShareContent content)
    * {@inheritDoc}
    */
   @Override
-  public void promoteUserToRoomOwner(@Nonnull Long userId, @Nonnull String roomId) {
+  public void promoteUserToRoomOwner(Long userId, String roomId) {
     UserId user = new UserId().id(userId);
     executeAndRetry("promoteUserToOwner", roomMembershipApi.getApiClient().getBasePath(),
         () -> roomMembershipApi.v1RoomIdMembershipPromoteOwnerPost(toUrlSafeIdIfNeeded(roomId), authSession.getSessionToken(),
@@ -190,7 +189,7 @@ public void promoteUserToRoomOwner(@Nonnull Long userId, @Nonnull String roomId)
    * {@inheritDoc}
    */
   @Override
-  public void demoteUserToRoomParticipant(@Nonnull Long userId, @Nonnull String roomId) {
+  public void demoteUserToRoomParticipant(Long userId, String roomId) {
     UserId user = new UserId().id(userId);
     executeAndRetry("demoteUserToParticipant", roomMembershipApi.getApiClient().getBasePath(),
         () -> roomMembershipApi.v1RoomIdMembershipDemoteOwnerPost(toUrlSafeIdIfNeeded(roomId), authSession.getSessionToken(),
@@ -201,7 +200,7 @@ public void demoteUserToRoomParticipant(@Nonnull Long userId, @Nonnull String ro
    * {@inheritDoc}
    */
   @Override
-  public Stream create(@Nonnull Long... uids) {
+  public Stream create(Long... uids) {
     return this.create(Arrays.asList(uids));
   }
 
@@ -209,7 +208,7 @@ public Stream create(@Nonnull Long... uids) {
    * {@inheritDoc}
    */
   @Override
-  public Stream create(@Nonnull List<Long> uids) {
+  public Stream create(List<Long> uids) {
     return executeAndRetry("createStreamByUserIds", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v1ImCreatePost(authSession.getSessionToken(), uids));
   }
@@ -218,7 +217,7 @@ public Stream create(@Nonnull List<Long> uids) {
    * {@inheritDoc}
    */
   @Override
-  public V3RoomDetail create(@Nonnull V3RoomAttributes roomAttributes) {
+  public V3RoomDetail create(V3RoomAttributes roomAttributes) {
     return executeAndRetry("createStream", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v3RoomCreatePost(authSession.getSessionToken(), roomAttributes));
   }
@@ -227,7 +226,7 @@ public V3RoomDetail create(@Nonnull V3RoomAttributes roomAttributes) {
    * {@inheritDoc}
    */
   @Override
-  public V3RoomDetail updateRoom(@Nonnull String roomId, @Nonnull V3RoomAttributes roomAttributes) {
+  public V3RoomDetail updateRoom(String roomId, V3RoomAttributes roomAttributes) {
     if(roomAttributes.getPinnedMessageId() != null) {
       String pinnedMessageId = toUrlSafeIdIfNeeded(roomAttributes.getPinnedMessageId());
       roomAttributes.setPinnedMessageId(pinnedMessageId);
@@ -240,7 +239,7 @@ public V3RoomDetail updateRoom(@Nonnull String roomId, @Nonnull V3RoomAttributes
    * {@inheritDoc}
    */
   @Override
-  public V3RoomDetail getRoomInfo(@Nonnull String roomId) {
+  public V3RoomDetail getRoomInfo(String roomId) {
     return executeAndRetry("getRoomInfo", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v3RoomIdInfoGet(toUrlSafeIdIfNeeded(roomId), authSession.getSessionToken()));
   }
@@ -249,7 +248,7 @@ public V3RoomDetail getRoomInfo(@Nonnull String roomId) {
    * {@inheritDoc}
    */
   @Override
-  public V3RoomSearchResults searchRooms(@Nonnull V2RoomSearchCriteria query) {
+  public V3RoomSearchResults searchRooms(V2RoomSearchCriteria query) {
     return executeAndRetry("searchRooms", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v3RoomSearchPost(authSession.getSessionToken(), null, null, query));
   }
@@ -258,7 +257,7 @@ public V3RoomSearchResults searchRooms(@Nonnull V2RoomSearchCriteria query) {
    * {@inheritDoc}
    */
   @Override
-  public V3RoomSearchResults searchRooms(@Nonnull V2RoomSearchCriteria query, @Nonnull PaginationAttribute pagination) {
+  public V3RoomSearchResults searchRooms(V2RoomSearchCriteria query, PaginationAttribute pagination) {
     return executeAndRetry("searchRooms", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v3RoomSearchPost(authSession.getSessionToken(), pagination.getSkip(),
             pagination.getLimit(), query));
@@ -269,7 +268,7 @@ public V3RoomSearchResults searchRooms(@Nonnull V2RoomSearchCriteria query, @Non
    */
   @Override
   @API(status = API.Status.EXPERIMENTAL)
-  public java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriteria query) {
+  public java.util.stream.Stream<V3RoomDetail> searchAllRooms(V2RoomSearchCriteria query) {
     OffsetBasedPaginatedApi<V3RoomDetail> api =
         (offset, limit) -> searchRooms(query, new PaginationAttribute(offset, limit)).getRooms();
     return new OffsetBasedPaginatedService<>(api, PaginatedService.DEFAULT_PAGINATION_CHUNK_SIZE,
@@ -281,8 +280,8 @@ public java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearc
    */
   @Override
   @API(status = API.Status.EXPERIMENTAL)
-  public java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearchCriteria query,
-      @Nonnull StreamPaginationAttribute pagination) {
+  public java.util.stream.Stream<V3RoomDetail> searchAllRooms(V2RoomSearchCriteria query,
+      StreamPaginationAttribute pagination) {
     OffsetBasedPaginatedApi<V3RoomDetail> api =
         (offset, limit) -> searchRooms(query, new PaginationAttribute(offset, limit)).getRooms();
     return new OffsetBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
@@ -296,7 +295,7 @@ public java.util.stream.Stream<V3RoomDetail> searchAllRooms(@Nonnull V2RoomSearc
    * @return The information of the room after being deactivated or reactivated.
    * @see <a href="https://developers.symphony.com/restapi/reference#de-or-re-activate-room">De/Reactivate Room</a>
    */
-  public RoomDetail setRoomActive(@Nonnull String roomId, @Nonnull Boolean active) {
+  public RoomDetail setRoomActive(String roomId, Boolean active) {
     return executeAndRetry("setRoomActive", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v1RoomIdSetActivePost(toUrlSafeIdIfNeeded(roomId), active, authSession.getSessionToken()));
   }
@@ -317,7 +316,7 @@ public RoomDetail setRoomActive(@Nonnull String roomId, @Nonnull Boolean active)
    * @return The created IM or MIM
    * @see <a href="https://developers.symphony.com/restapi/reference#create-im-or-mim-admin">Create IM or MIM Non-inclusive</a>
    */
-  public Stream createInstantMessageAdmin(@Nonnull List<Long> uids) {
+  public Stream createInstantMessageAdmin(List<Long> uids) {
     return executeAndRetry("createInstantMessageAdmin", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v1AdminImCreatePost(authSession.getSessionToken(), uids));
   }
@@ -330,7 +329,7 @@ public Stream createInstantMessageAdmin(@Nonnull List<Long> uids) {
    * @return  IM information after the update
    * @see <a href="https://developers.symphony.com/restapi/v20.13/reference#update-im">Update IM</a>
    */
-  public V1IMDetail updateInstantMessage(@Nonnull String imId, @Nonnull V1IMAttributes imAttributes) {
+  public V1IMDetail updateInstantMessage(String imId, V1IMAttributes imAttributes) {
     if (imAttributes.getPinnedMessageId() != null) {
       String pinnedMessageId = toUrlSafeIdIfNeeded(imAttributes.getPinnedMessageId());
       imAttributes.setPinnedMessageId(pinnedMessageId);
@@ -346,7 +345,7 @@ public V1IMDetail updateInstantMessage(@Nonnull String imId, @Nonnull V1IMAttrib
    * @return The information about the IM with the given id
    * @see <a href="https://developers.symphony.com/restapi/reference#im-info">IM Info</a>
    */
-  public V1IMDetail getInstantMessageInfo(@Nonnull String imId) {
+  public V1IMDetail getInstantMessageInfo(String imId) {
     return executeAndRetry("getIMInfo", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v1ImIdInfoGet(toUrlSafeIdIfNeeded(imId), authSession.getSessionToken()));
   }
@@ -358,7 +357,7 @@ public V1IMDetail getInstantMessageInfo(@Nonnull String imId) {
    * @param active   Deactivate or activate
    * @return The information of the room after being deactivated or reactivated.
    */
-  public RoomDetail setRoomActiveAdmin(@Nonnull String streamId, @Nonnull Boolean active) {
+  public RoomDetail setRoomActiveAdmin(String streamId, Boolean active) {
     return executeAndRetry("setRoomActiveAdmin", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v1AdminRoomIdSetActivePost(toUrlSafeIdIfNeeded(streamId), active, authSession.getSessionToken()));
   }
@@ -384,7 +383,7 @@ public V2AdminStreamList listStreamsAdmin(@Nullable V2AdminStreamFilter filter)
    * @see <a href="https://developers.symphony.com/restapi/reference#list-streams-for-enterprise-v2">List Streams for Enterprise V2</a>
    */
   public V2AdminStreamList listStreamsAdmin(@Nullable V2AdminStreamFilter filter,
-      @Nonnull PaginationAttribute pagination) {
+      PaginationAttribute pagination) {
     return executeAndRetry("listStreamsAdmin", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v2AdminStreamsListPost(authSession.getSessionToken(), pagination.getSkip(),
             pagination.getLimit(), filter));
@@ -415,7 +414,7 @@ public java.util.stream.Stream<V2AdminStreamInfo> listAllStreamsAdmin(@Nullable
    */
   @API(status = API.Status.EXPERIMENTAL)
   public java.util.stream.Stream<V2AdminStreamInfo> listAllStreamsAdmin(@Nullable V2AdminStreamFilter filter,
-      @Nonnull StreamPaginationAttribute pagination) {
+      StreamPaginationAttribute pagination) {
     OffsetBasedPaginatedApi<V2AdminStreamInfo> api =
         (offset, limit) -> listStreamsAdmin(filter, new PaginationAttribute(offset, limit)).getStreams();
     return new OffsetBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
@@ -429,7 +428,7 @@ public java.util.stream.Stream<V2AdminStreamInfo> listAllStreamsAdmin(@Nullable
    * @return List of member in the stream with the given stream id.
    * @see <a href="https://developers.symphony.com/restapi/reference#stream-members">Stream Members</a>
    */
-  public V2MembershipList listStreamMembers(@Nonnull String streamId) {
+  public V2MembershipList listStreamMembers(String streamId) {
     return executeAndRetry("listStreamMembers", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v1AdminStreamIdMembershipListGet(toUrlSafeIdIfNeeded(streamId), authSession.getSessionToken(), null,
             null));
@@ -444,7 +443,7 @@ public V2MembershipList listStreamMembers(@Nonnull String streamId) {
    * @return List of member in the stream with the given stream id.
    * @see <a href="https://developers.symphony.com/restapi/reference#stream-members">Stream Members</a>
    */
-  public V2MembershipList listStreamMembers(@Nonnull String streamId, @Nonnull PaginationAttribute pagination) {
+  public V2MembershipList listStreamMembers(String streamId, PaginationAttribute pagination) {
     return executeAndRetry("listStreamMembers", streamsApi.getApiClient().getBasePath(),
         () -> streamsApi.v1AdminStreamIdMembershipListGet(toUrlSafeIdIfNeeded(streamId), authSession.getSessionToken(),
             pagination.getSkip(), pagination.getLimit()));
@@ -459,7 +458,7 @@ public V2MembershipList listStreamMembers(@Nonnull String streamId, @Nonnull Pag
    * @see <a href="https://developers.symphony.com/restapi/reference#stream-members">Stream Members</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public java.util.stream.Stream<V2MemberInfo> listAllStreamMembers(@Nonnull String streamId) {
+  public java.util.stream.Stream<V2MemberInfo> listAllStreamMembers(String streamId) {
     OffsetBasedPaginatedApi<V2MemberInfo> api =
         (offset, limit) -> listStreamMembers(toUrlSafeIdIfNeeded(streamId),
             new PaginationAttribute(offset, limit)).getMembers();
@@ -477,8 +476,8 @@ public java.util.stream.Stream<V2MemberInfo> listAllStreamMembers(@Nonnull Strin
    * @see <a href="https://developers.symphony.com/restapi/reference#stream-members">Stream Members</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public java.util.stream.Stream<V2MemberInfo> listAllStreamMembers(@Nonnull String streamId,
-      @Nonnull StreamPaginationAttribute pagination) {
+  public java.util.stream.Stream<V2MemberInfo> listAllStreamMembers(String streamId,
+      StreamPaginationAttribute pagination) {
     OffsetBasedPaginatedApi<V2MemberInfo> api =
         (offset, limit) -> listStreamMembers(toUrlSafeIdIfNeeded(streamId),
             new PaginationAttribute(offset, limit)).getMembers();
@@ -493,12 +492,11 @@ public java.util.stream.Stream<V2MemberInfo> listAllStreamMembers(@Nonnull Strin
    * @see <a href="https://developers.symphony.com/restapi/reference#room-members">Room Members</a>
    */
   @Override
-  public List<MemberInfo> listRoomMembers(@Nonnull String roomId) {
+  public List<MemberInfo> listRoomMembers(String roomId) {
     return executeAndRetry("listRoomMembers", roomMembershipApi.getApiClient().getBasePath(),
         () -> roomMembershipApi.v2RoomIdMembershipListGet(toUrlSafeIdIfNeeded(roomId), authSession.getSessionToken()));
   }
 
-
   private <T> T executeAndRetry(String name, String address, SupplierWithApiException<T> supplier) {
     checkAuthSession(authSession);
     return RetryWithRecovery.executeAndRetry(retryBuilder, name, address, supplier);
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/package-info.java
new file mode 100644
index 000000000..402b4392b
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/stream/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.stream;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/OboUserService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/OboUserService.java
index cf0f86c16..5a9d7d379 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/OboUserService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/OboUserService.java
@@ -10,8 +10,7 @@
 import java.util.List;
 import java.util.stream.Stream;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service interface exposing OBO-enabled endpoints to manage users.
@@ -32,7 +31,7 @@ public interface OboUserService {
    * @return Users found by user ids
    * @see <a href="https://developers.symphony.com/restapi/reference/users-lookup-v3">Users Lookup V3</a>
    */
-  List<UserV2> listUsersByIds(@Nonnull List<Long> uidList, @Nullable Boolean local, @Nullable Boolean active);
+  List<UserV2> listUsersByIds(List<Long> uidList, @Nullable Boolean local, @Nullable Boolean active);
 
   /**
    * {@link UserService#listUsersByIds(List)}
@@ -41,7 +40,7 @@ public interface OboUserService {
    * @return Users found by user ids
    * @see <a href="https://developers.symphony.com/restapi/reference/users-lookup-v3">Users Lookup V3</a>
    */
-  List<UserV2> listUsersByIds(@Nonnull List<Long> uidList);
+  List<UserV2> listUsersByIds(List<Long> uidList);
 
   /**
    * {@link UserService#listUsersByEmails(List, Boolean, Boolean)}
@@ -56,7 +55,7 @@ public interface OboUserService {
    * @return Users found by emails.
    * @see <a href="https://developers.symphony.com/restapi/reference/users-lookup-v3">Users Lookup V3</a>
    */
-  List<UserV2> listUsersByEmails(@Nonnull List<String> emailList, @Nullable Boolean local, @Nullable Boolean active);
+  List<UserV2> listUsersByEmails(List<String> emailList, @Nullable Boolean local, @Nullable Boolean active);
 
   /**
    * {@link UserService#listUsersByEmails(List)}
@@ -65,7 +64,7 @@ public interface OboUserService {
    * @return Users found by emails
    * @see <a href="https://developers.symphony.com/restapi/reference/users-lookup-v3">Users Lookup V3</a>
    */
-  List<UserV2> listUsersByEmails(@Nonnull List<String> emailList);
+  List<UserV2> listUsersByEmails(List<String> emailList);
 
   /**
    * {@link UserService#listUsersByUsernames(List, Boolean)}
@@ -77,7 +76,7 @@ public interface OboUserService {
    * @return Users found by usernames
    * @see <a href="https://developers.symphony.com/restapi/reference/users-lookup-v3">Users Lookup V3</a>
    */
-  List<UserV2> listUsersByUsernames(@Nonnull List<String> usernameList, @Nullable Boolean active);
+  List<UserV2> listUsersByUsernames(List<String> usernameList, @Nullable Boolean active);
 
   /**
    * {@link UserService#listUsersByUsernames(List)}
@@ -86,7 +85,7 @@ public interface OboUserService {
    * @return Users found by usernames
    * @see <a href="https://developers.symphony.com/restapi/reference#users-lookup-v3">Users Lookup V3</a>
    */
-  List<UserV2> listUsersByUsernames(@Nonnull List<String> usernameList);
+  List<UserV2> listUsersByUsernames(List<String> usernameList);
 
   /**
    * {@link UserService#searchUsers(UserSearchQuery, Boolean)}
@@ -98,7 +97,7 @@ public interface OboUserService {
    * @return List of users found by query
    * @see <a href="https://developers.symphony.com/restapi/reference#search-users">Search Users</a>
    */
-  List<UserV2> searchUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local);
+  List<UserV2> searchUsers(UserSearchQuery query, @Nullable Boolean local);
 
   /**
    * {@link UserService#searchUsers(UserSearchQuery, Boolean, PaginationAttribute)}
@@ -111,8 +110,8 @@ public interface OboUserService {
    * @return List of users found by query
    * @see <a href="https://developers.symphony.com/restapi/reference#search-users">Search Users</a>
    */
-  List<UserV2> searchUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local,
-      @Nonnull PaginationAttribute pagination);
+  List<UserV2> searchUsers(UserSearchQuery query, @Nullable Boolean local,
+      PaginationAttribute pagination);
 
   /**
    * {@link UserService#searchAllUsers(UserSearchQuery, Boolean)}
@@ -125,7 +124,7 @@ List<UserV2> searchUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local
    * @see <a href="https://developers.symphony.com/restapi/reference#search-users">Search Users</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  Stream<UserV2> searchAllUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local);
+  Stream<UserV2> searchAllUsers(UserSearchQuery query, @Nullable Boolean local);
 
   /**
    * {@link UserService#searchAllUsers(UserSearchQuery, Boolean, StreamPaginationAttribute)}
@@ -139,8 +138,8 @@ List<UserV2> searchUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local
    * @see <a href="https://developers.symphony.com/restapi/reference#search-users">Search Users</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  Stream<UserV2> searchAllUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local,
-      @Nonnull StreamPaginationAttribute pagination);
+  Stream<UserV2> searchAllUsers(UserSearchQuery query, @Nullable Boolean local,
+      StreamPaginationAttribute pagination);
 
   /**
    * Make a list of users to start following a specific user.
@@ -150,7 +149,7 @@ Stream<UserV2> searchAllUsers(@Nonnull UserSearchQuery query, @Nullable Boolean
    * @param userId      The id of the user to be followed.
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#follow-user">Follow User</a>
    */
-  void followUser(@Nonnull List<Long> followerIds, @Nonnull Long userId);
+  void followUser(List<Long> followerIds, Long userId);
 
   /**
    * Make a list of users to stop following a specific user.
@@ -160,5 +159,5 @@ Stream<UserV2> searchAllUsers(@Nonnull UserSearchQuery query, @Nullable Boolean
    * @param userId      The id of the user to be unfollowed.
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#unfollow-user">Unfollow User</a>
    */
-  void unfollowUser(@Nonnull List<Long> followerIds, @Nonnull Long userId);
+  void unfollowUser(List<Long> followerIds, Long userId);
 }
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/UserService.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/UserService.java
index 291e4ec63..c4aab44bc 100644
--- a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/UserService.java
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/UserService.java
@@ -57,9 +57,7 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
-
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service class for managing users.
@@ -112,7 +110,7 @@ public OboUserService obo(AuthSession oboSession) {
    * {@inheritDoc}
    */
   @Override
-  public List<UserV2> listUsersByIds(@Nonnull List<Long> uidList, @Nullable Boolean local, @Nullable Boolean active) {
+  public List<UserV2> listUsersByIds(List<Long> uidList, @Nullable Boolean local, @Nullable Boolean active) {
     String uids = uidList.stream().map(String::valueOf).collect(Collectors.joining(","));
     V2UserList v2UserList = executeAndRetry("searchUserByIds",
         () -> usersApi.v3UsersGet(uids, null, null, local, active, authSession.getSessionToken()));
@@ -123,7 +121,7 @@ public List<UserV2> listUsersByIds(@Nonnull List<Long> uidList, @Nullable Boolea
    * {@inheritDoc}
    */
   @Override
-  public List<UserV2> listUsersByIds(@Nonnull List<Long> uidList) {
+  public List<UserV2> listUsersByIds(List<Long> uidList) {
     String uids = uidList.stream().map(String::valueOf).collect(Collectors.joining(","));
     V2UserList v2UserList = executeAndRetry("searchUserByIds",
         () -> usersApi.v3UsersGet(uids, null, null, false, null, authSession.getSessionToken()));
@@ -134,7 +132,7 @@ public List<UserV2> listUsersByIds(@Nonnull List<Long> uidList) {
    * {@inheritDoc}
    */
   @Override
-  public List<UserV2> listUsersByEmails(@Nonnull List<String> emailList,
+  public List<UserV2> listUsersByEmails(List<String> emailList,
       @Nullable Boolean local, @Nullable Boolean active) {
     String emails = String.join(",", emailList);
     V2UserList v2UserList = executeAndRetry("searchUserByEmails",
@@ -146,7 +144,7 @@ public List<UserV2> listUsersByEmails(@Nonnull List<String> emailList,
    * {@inheritDoc}
    */
   @Override
-  public List<UserV2> listUsersByEmails(@Nonnull List<String> emailList) {
+  public List<UserV2> listUsersByEmails(List<String> emailList) {
     String emails = String.join(",", emailList);
     V2UserList v2UserList = executeAndRetry("searchUserByEmails",
         () -> usersApi.v3UsersGet( null, emails, null, false, null, authSession.getSessionToken()));
@@ -157,7 +155,7 @@ public List<UserV2> listUsersByEmails(@Nonnull List<String> emailList) {
    * {@inheritDoc}
    */
   @Override
-  public List<UserV2> listUsersByUsernames(@Nonnull List<String> usernameList, @Nullable Boolean active) {
+  public List<UserV2> listUsersByUsernames(List<String> usernameList, @Nullable Boolean active) {
     String usernames = String.join(",", usernameList);
     V2UserList v2UserList = executeAndRetry("searchUserByUsernames",
         () -> usersApi.v3UsersGet(null, null, usernames, true, active, authSession.getSessionToken()));
@@ -168,7 +166,7 @@ public List<UserV2> listUsersByUsernames(@Nonnull List<String> usernameList, @Nu
    * {@inheritDoc}
    */
   @Override
-  public List<UserV2> listUsersByUsernames(@Nonnull List<String> usernameList) {
+  public List<UserV2> listUsersByUsernames(List<String> usernameList) {
     String usernames = String.join(",", usernameList);
     V2UserList v2UserList = executeAndRetry("searchUserByUsernames",
         () -> usersApi.v3UsersGet( null, null, usernames, true, null, authSession.getSessionToken()));
@@ -187,7 +185,7 @@ private List<UserV2> getUsersOrEmpty(V2UserList v2UserList) {
    * {@inheritDoc}
    */
   @Override
-  public List<UserV2> searchUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local) {
+  public List<UserV2> searchUsers(UserSearchQuery query, @Nullable Boolean local) {
     UserSearchResults results = executeAndRetry("searchUsers",
         () -> usersApi.v1UserSearchPost( null, null, local, authSession.getSessionToken(), query));
     return results.getUsers();
@@ -197,8 +195,8 @@ public List<UserV2> searchUsers(@Nonnull UserSearchQuery query, @Nullable Boolea
    * {@inheritDoc}
    */
   @Override
-  public List<UserV2> searchUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local,
-      @Nonnull PaginationAttribute pagination) {
+  public List<UserV2> searchUsers(UserSearchQuery query, @Nullable Boolean local,
+      PaginationAttribute pagination) {
     UserSearchResults results = executeAndRetry("searchUsers",
         () -> usersApi.v1UserSearchPost(pagination.getSkip(), pagination.getLimit(), local, authSession.getSessionToken(), query));
     return results.getUsers();
@@ -209,7 +207,7 @@ public List<UserV2> searchUsers(@Nonnull UserSearchQuery query, @Nullable Boolea
    */
   @Override
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<UserV2> searchAllUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local) {
+  public Stream<UserV2> searchAllUsers(UserSearchQuery query, @Nullable Boolean local) {
     OffsetBasedPaginatedApi<UserV2> api =
         (offset, limit) -> searchUsers(query, local, new PaginationAttribute(offset, limit));
     return new OffsetBasedPaginatedService<>(api, PaginatedService.DEFAULT_PAGINATION_CHUNK_SIZE,
@@ -221,8 +219,8 @@ public Stream<UserV2> searchAllUsers(@Nonnull UserSearchQuery query, @Nullable B
    */
   @Override
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<UserV2> searchAllUsers(@Nonnull UserSearchQuery query, @Nullable Boolean local,
-      @Nonnull StreamPaginationAttribute pagination) {
+  public Stream<UserV2> searchAllUsers(UserSearchQuery query, @Nullable Boolean local,
+      StreamPaginationAttribute pagination) {
     OffsetBasedPaginatedApi<UserV2> api =
         (offset, limit) -> searchUsers(query, local, new PaginationAttribute(offset, limit));
     return new OffsetBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
@@ -232,7 +230,7 @@ public Stream<UserV2> searchAllUsers(@Nonnull UserSearchQuery query, @Nullable B
    * {@inheritDoc}
    */
   @Override
-  public void followUser(@Nonnull List<Long> followerIds, @Nonnull Long userId) {
+  public void followUser(List<Long> followerIds, Long userId) {
     executeAndRetry("followUser",
         () -> userApi.v1UserUidFollowPost(authSession.getSessionToken(), userId,
             new FollowersList().followers(followerIds)));
@@ -242,7 +240,7 @@ public void followUser(@Nonnull List<Long> followerIds, @Nonnull Long userId) {
    * {@inheritDoc}
    */
   @Override
-  public void unfollowUser(@Nonnull List<Long> followerIds, @Nonnull Long userId) {
+  public void unfollowUser(List<Long> followerIds, Long userId) {
     executeAndRetry("unfollowUser",
         () -> userApi.v1UserUidUnfollowPost(authSession.getSessionToken(), userId,
             new FollowersList().followers(followerIds)));
@@ -255,7 +253,7 @@ public void unfollowUser(@Nonnull List<Long> followerIds, @Nonnull Long userId)
    * @return Details of the user.
    * @see <a href="https://developers.symphony.com/restapi/reference/get-user-v2">Get User v2</a>
    */
-  public V2UserDetail getUserDetail(@Nonnull Long userId) {
+  public V2UserDetail getUserDetail(Long userId) {
     return executeAndRetry("getUserDetail",
         () -> userApi.v2AdminUserUidGet(authSession.getSessionToken(), userId));
   }
@@ -278,12 +276,11 @@ public List<V2UserDetail> listUsersDetail() {
    * @return List of retrieved users
    * @see <a href="https://developers.symphony.com/restapi/reference/list-users-v2">List Users V2</a>
    */
-  public List<V2UserDetail> listUsersDetail(@Nonnull PaginationAttribute pagination) {
+  public List<V2UserDetail> listUsersDetail(PaginationAttribute pagination) {
     return executeAndRetry("listUsersDetail",
         () -> userApi.v2AdminUserListGet(authSession.getSessionToken(), pagination.getSkip(), pagination.getLimit()));
   }
 
-
   /**
    * Retrieve all users in the company (pod) and return in a {@link Stream} with default chunk size and total size equals 100.
    *
@@ -305,7 +302,7 @@ public Stream<V2UserDetail> listAllUsersDetail() {
    * @see <a href="https://developers.symphony.com/restapi/reference/list-users-v2">List Users V2</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<V2UserDetail> listAllUsersDetail(@Nonnull StreamPaginationAttribute pagination) {
+  public Stream<V2UserDetail> listAllUsersDetail(StreamPaginationAttribute pagination) {
     OffsetBasedPaginatedApi<V2UserDetail> api = (offset, limit) -> listUsersDetail(new PaginationAttribute(offset, limit));
     return new OffsetBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
   }
@@ -318,7 +315,7 @@ public Stream<V2UserDetail> listAllUsersDetail(@Nonnull StreamPaginationAttribut
    * @see <a href="https://developers.symphony.com/restapi/reference/find-users">Find Users V1</a>
    * @see com.symphony.bdk.core.service.user.constant.UserFeature
    */
-  public List<V2UserDetail> listUsersDetail(@Nonnull UserFilter filter) {
+  public List<V2UserDetail> listUsersDetail(UserFilter filter) {
     List<UserDetail> userDetailList = executeAndRetry("listUsersDetail",
         () -> userApi.v1AdminUserFindPost(authSession.getSessionToken(), null, null, filter));
     return userDetailList.stream()
@@ -335,7 +332,7 @@ public List<V2UserDetail> listUsersDetail(@Nonnull UserFilter filter) {
    * @see <a href="https://developers.symphony.com/restapi/reference/find-users">Find Users V1</a>
    * @see com.symphony.bdk.core.service.user.constant.UserFeature
    */
-  public List<V2UserDetail> listUsersDetail(@Nonnull UserFilter filter, @Nonnull PaginationAttribute pagination) {
+  public List<V2UserDetail> listUsersDetail(UserFilter filter, PaginationAttribute pagination) {
     List<UserDetail> userDetailList = executeAndRetry("listUsersDetail",
         () -> userApi.v1AdminUserFindPost(authSession.getSessionToken(), pagination.getSkip(),
             pagination.getLimit(), filter));
@@ -353,7 +350,7 @@ public List<V2UserDetail> listUsersDetail(@Nonnull UserFilter filter, @Nonnull P
    * @see com.symphony.bdk.core.service.user.constant.UserFeature
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<V2UserDetail> listAllUsersDetail(@Nonnull UserFilter filter) {
+  public Stream<V2UserDetail> listAllUsersDetail(UserFilter filter) {
     OffsetBasedPaginatedApi<V2UserDetail> api = (offset, limit) -> listUsersDetail(filter, new PaginationAttribute(offset, limit));
     return new OffsetBasedPaginatedService<>(api, PaginatedService.DEFAULT_PAGINATION_CHUNK_SIZE,
         PaginatedService.DEFAULT_PAGINATION_TOTAL_SIZE).stream();
@@ -369,8 +366,8 @@ public Stream<V2UserDetail> listAllUsersDetail(@Nonnull UserFilter filter) {
    * @see com.symphony.bdk.core.service.user.constant.UserFeature
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<V2UserDetail> listAllUsersDetail(@Nonnull UserFilter filter,
-      @Nonnull StreamPaginationAttribute pagination) {
+  public Stream<V2UserDetail> listAllUsersDetail(UserFilter filter,
+      StreamPaginationAttribute pagination) {
     OffsetBasedPaginatedApi<V2UserDetail> api = (offset, limit) -> listUsersDetail(filter, new PaginationAttribute(offset, limit));
     return new OffsetBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
   }
@@ -382,7 +379,7 @@ public Stream<V2UserDetail> listAllUsersDetail(@Nonnull UserFilter filter,
    * @param roleId Role Id
    * @see <a href="https://developers.symphony.com/restapi/reference#add-role">Add Role</a>
    */
-  public void addRole(@Nonnull Long userId, @Nonnull StringId roleId) {
+  public void addRole(Long userId, StringId roleId) {
     executeAndRetry("addRole",
         () -> userApi.v1AdminUserUidRolesAddPost(authSession.getSessionToken(), userId, roleId));
   }
@@ -394,7 +391,7 @@ public void addRole(@Nonnull Long userId, @Nonnull StringId roleId) {
    * @param roleId Role Id
    * @see <a href="https://developers.symphony.com/restapi/reference#add-role">Add Role</a>
    */
-  public void addRole(@Nonnull Long userId, @Nonnull RoleId roleId) {
+  public void addRole(Long userId, RoleId roleId) {
     addRole(userId, new StringId().id(roleId.name()));
   }
 
@@ -416,7 +413,7 @@ public List<RoleDetail> listRoles() {
    * @param roleId Role Id
    * @see <a href="https://developers.symphony.com/restapi/reference#remove-role">Remove Role</a>
    */
-  public void removeRole(@Nonnull Long userId, @Nonnull StringId roleId) {
+  public void removeRole(Long userId, StringId roleId) {
     executeAndRetry("removeRole",
         () -> userApi.v1AdminUserUidRolesRemovePost(authSession.getSessionToken(), userId, roleId));
   }
@@ -428,7 +425,7 @@ public void removeRole(@Nonnull Long userId, @Nonnull StringId roleId) {
    * @param roleId Role Id
    * @see <a href="https://developers.symphony.com/restapi/reference#remove-role">Remove Role</a>
    */
-  public void removeRole(@Nonnull Long userId, @Nonnull RoleId roleId) {
+  public void removeRole(Long userId, RoleId roleId) {
     removeRole(userId, new StringId().id(roleId.name()));
   }
 
@@ -439,7 +436,7 @@ public void removeRole(@Nonnull Long userId, @Nonnull RoleId roleId) {
    * @return List of avatar urls of the user
    * @see <a href="https://developers.symphony.com/restapi/reference#user-avatar">User Avatar</a>
    */
-  public List<Avatar> getAvatar(@Nonnull Long userId) {
+  public List<Avatar> getAvatar(Long userId) {
     return executeAndRetry("getAvatar",
         () -> userApi.v1AdminUserUidAvatarGet(authSession.getSessionToken(), userId));
   }
@@ -451,7 +448,7 @@ public List<Avatar> getAvatar(@Nonnull Long userId) {
    * @param image  The avatar image for the user profile picture.The image must be a base64-encoded.
    * @see <a href="https://developers.symphony.com/restapi/reference#update-user-avatar">Update User Avatar</a>
    */
-  public void updateAvatar(@Nonnull Long userId, @Nonnull String image) {
+  public void updateAvatar(Long userId, String image) {
     AvatarUpdate avatarUpdate = new AvatarUpdate().image(image);
     executeAndRetry("updateAvatar",
         () -> userApi.v1AdminUserUidAvatarUpdatePost(authSession.getSessionToken(), userId, avatarUpdate));
@@ -464,7 +461,7 @@ public void updateAvatar(@Nonnull Long userId, @Nonnull String image) {
    * @param image  The avatar image in bytes array for the user profile picture.
    * @see <a href="https://developers.symphony.com/restapi/reference#update-user-avatar">Update User Avatar</a>
    */
-  public void updateAvatar(@Nonnull Long userId, @Nonnull byte[] image) {
+  public void updateAvatar(Long userId, byte[] image) {
     String imageBase64 = Base64.getEncoder().encodeToString(image);
     this.updateAvatar(userId, imageBase64);
   }
@@ -476,7 +473,7 @@ public void updateAvatar(@Nonnull Long userId, @Nonnull byte[] image) {
    * @param imageStream The avatar image input stream for the user profile picture.
    * @see <a href="https://developers.symphony.com/restapi/reference#update-user-avatar">Update User Avatar</a>
    */
-  public void updateAvatar(@Nonnull Long userId, @Nonnull InputStream imageStream) throws IOException {
+  public void updateAvatar(Long userId, InputStream imageStream) throws IOException {
     byte[] bytes = IOUtils.toByteArray(imageStream);
     this.updateAvatar(userId, bytes);
   }
@@ -488,7 +485,7 @@ public void updateAvatar(@Nonnull Long userId, @Nonnull InputStream imageStream)
    * @return Disclaimer assigned to the user.
    * @see <a href="https://developers.symphony.com/restapi/reference#user-disclaimer">User Disclaimer</a>
    */
-  public Disclaimer getDisclaimer(@Nonnull Long userId) {
+  public Disclaimer getDisclaimer(Long userId) {
     return executeAndRetry("getDisclaimer",
         () -> userApi.v1AdminUserUidDisclaimerGet(authSession.getSessionToken(), userId));
   }
@@ -499,7 +496,7 @@ public Disclaimer getDisclaimer(@Nonnull Long userId) {
    * @param userId User Id
    * @see <a href="https://developers.symphony.com/restapi/reference#unassign-user-disclaimer">Unassign User Disclaimer</a>
    */
-  public void removeDisclaimer(@Nonnull Long userId) {
+  public void removeDisclaimer(Long userId) {
     executeAndRetry("removeDisclaimer",
         () -> userApi.v1AdminUserUidDisclaimerDelete(authSession.getSessionToken(), userId));
   }
@@ -511,7 +508,7 @@ public void removeDisclaimer(@Nonnull Long userId) {
    * @param disclaimerId Disclaimer to be assigned
    * @see <a href="https://developers.symphony.com/restapi/reference#update-disclaimer">Update User Disclaimer</a>
    */
-  public void addDisclaimer(@Nonnull Long userId, @Nonnull String disclaimerId) {
+  public void addDisclaimer(Long userId, String disclaimerId) {
     StringId stringId = new StringId().id(disclaimerId);
     executeAndRetry("addDisclaimer",
         () -> userApi.v1AdminUserUidDisclaimerUpdatePost(authSession.getSessionToken(), userId, stringId));
@@ -525,7 +522,7 @@ public void addDisclaimer(@Nonnull Long userId, @Nonnull String disclaimerId) {
    * @return List of delegates assigned to an user.
    * @see <a href="https://developers.symphony.com/restapi/reference#delegates">User Delegates</a>
    */
-  public List<Long> getDelegates(@Nonnull Long userId) {
+  public List<Long> getDelegates(Long userId) {
     return executeAndRetry("getDelegates",
         () -> userApi.v1AdminUserUidDelegatesGet(authSession.getSessionToken(), userId));
   }
@@ -538,8 +535,8 @@ public List<Long> getDelegates(@Nonnull Long userId) {
    * @param actionEnum      Action to be performed
    * @see <a href="https://developers.symphony.com/restapi/reference#update-delegates">Update User Delegates</a>
    */
-  public void udpateDelegates(@Nonnull Long userId, @Nonnull Long delegatedUserId,
-      @Nonnull DelegateAction.ActionEnum actionEnum) {
+  public void udpateDelegates(Long userId, Long delegatedUserId,
+      DelegateAction.ActionEnum actionEnum) {
     DelegateAction delegateAction = new DelegateAction().action(actionEnum).userId(delegatedUserId);
     executeAndRetry("udpateDelegates",
         () -> userApi.v1AdminUserUidDelegatesUpdatePost(authSession.getSessionToken(), userId, delegateAction));
@@ -552,7 +549,7 @@ public void udpateDelegates(@Nonnull Long userId, @Nonnull Long delegatedUserId,
    * @return List of feature entitlements of the user.
    * @see <a href="https://developers.symphony.com/restapi/reference#features">User Features</a>
    */
-  public List<Feature> getFeatureEntitlements(@Nonnull Long userId) {
+  public List<Feature> getFeatureEntitlements(Long userId) {
     return executeAndRetry("getFeatureEntitlements",
         () -> userApi.v1AdminUserUidFeaturesGet(authSession.getSessionToken(), userId));
   }
@@ -564,7 +561,7 @@ public List<Feature> getFeatureEntitlements(@Nonnull Long userId) {
    * @param features List of feature entitlements to be updated
    * @see <a href="https://developers.symphony.com/restapi/reference#update-features">Update User Features</a>
    */
-  public void updateFeatureEntitlements(@Nonnull Long userId, @Nonnull List<Feature> features) {
+  public void updateFeatureEntitlements(Long userId, List<Feature> features) {
     executeAndRetry("updateFeatureEntitlements",
         () -> userApi.v1AdminUserUidFeaturesUpdatePost(authSession.getSessionToken(), userId, features));
   }
@@ -576,7 +573,7 @@ public void updateFeatureEntitlements(@Nonnull Long userId, @Nonnull List<Featur
    * @return Status of the user.
    * @see <a href="https://developers.symphony.com/restapi/reference#user-status">User Status</a>
    */
-  public UserStatus getStatus(@Nonnull Long userId) {
+  public UserStatus getStatus(Long userId) {
     return executeAndRetry("getStatus",
         () -> userApi.v1AdminUserUidStatusGet(authSession.getSessionToken(), userId));
   }
@@ -588,7 +585,7 @@ public UserStatus getStatus(@Nonnull Long userId) {
    * @param status Status to be updated to the user
    * @see <a href="https://developers.symphony.com/restapi/reference#update-user-status">Update User Status</a>
    */
-  public void updateStatus(@Nonnull Long userId, @Nonnull UserStatus status) {
+  public void updateStatus(Long userId, UserStatus status) {
     executeAndRetry("updateStatus",
         () -> userApi.v1AdminUserUidStatusUpdatePost(authSession.getSessionToken(), userId, status));
   }
@@ -600,7 +597,7 @@ public void updateStatus(@Nonnull Long userId, @Nonnull UserStatus status) {
    * @return The list of followers of a specific user with the pagination information.
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#list-user-followers">List User Followers</a>
    */
-  public FollowersListResponse listUserFollowers(@Nonnull Long userId) {
+  public FollowersListResponse listUserFollowers(Long userId) {
     return executeAndRetry("listUserFollowers",
         () -> userApi.v1UserUidFollowersGet(authSession.getSessionToken(), userId, null, null, null));
   }
@@ -613,7 +610,7 @@ public FollowersListResponse listUserFollowers(@Nonnull Long userId) {
    * @return The list of followers of a specific user with the pagination information.
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#list-user-followers">List User Followers</a>
    */
-  public FollowersListResponse listUserFollowers(@Nonnull Long userId, @Nonnull CursorPaginationAttribute pagination) {
+  public FollowersListResponse listUserFollowers(Long userId, CursorPaginationAttribute pagination) {
     return listUserFollowers(userId, pagination.getLimit(), pagination.getBefore().toString(), pagination.getAfter().toString());
   }
 
@@ -625,7 +622,7 @@ public FollowersListResponse listUserFollowers(@Nonnull Long userId, @Nonnull Cu
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#list-user-followers">List User Followers</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<Long> listAllUserFollowers(@Nonnull Long userId) {
+  public Stream<Long> listAllUserFollowers(Long userId) {
     return listAllUserFollowers(userId, new StreamPaginationAttribute(PaginatedService.DEFAULT_PAGINATION_CHUNK_SIZE, PaginatedService.DEFAULT_PAGINATION_CHUNK_SIZE));
   }
 
@@ -638,13 +635,13 @@ public Stream<Long> listAllUserFollowers(@Nonnull Long userId) {
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#list-user-followers">List User Followers</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<Long> listAllUserFollowers(@Nonnull Long userId, @Nonnull StreamPaginationAttribute pagination) {
+  public Stream<Long> listAllUserFollowers(Long userId, StreamPaginationAttribute pagination) {
     CursorBasedPaginatedApi<Long> api =
         (after, limit) -> new FollowerListResponseAdapter(listUserFollowers(userId, limit, null, after));
     return new CursorBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
   }
 
-  private FollowersListResponse listUserFollowers(@Nonnull Long userId, Integer limit, String before, String after) {
+  private FollowersListResponse listUserFollowers(Long userId, Integer limit, String before, String after) {
     return executeAndRetry("listUserFollowers",
         () -> userApi.v1UserUidFollowersGet(authSession.getSessionToken(), userId, limit, before, after));
   }
@@ -656,7 +653,7 @@ private FollowersListResponse listUserFollowers(@Nonnull Long userId, Integer li
    * @return The list of users followed by a specific user with the pagination information.
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#list-user-followers">List User Followers</a>
    */
-  public FollowingListResponse listUsersFollowing(@Nonnull Long userId) {
+  public FollowingListResponse listUsersFollowing(Long userId) {
     return executeAndRetry("listUsersFollowing",
         () -> userApi.v1UserUidFollowingGet(authSession.getSessionToken(), userId, null, null, null));
   }
@@ -669,7 +666,7 @@ public FollowingListResponse listUsersFollowing(@Nonnull Long userId) {
    * @return The list of users followed by a specific user with the pagination information.
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#list-users-followed">List Users Followed</a>
    */
-  public FollowingListResponse listUsersFollowing(@Nonnull Long userId, @Nonnull CursorPaginationAttribute pagination) {
+  public FollowingListResponse listUsersFollowing(Long userId, CursorPaginationAttribute pagination) {
     return listUsersFollowing(userId, pagination.getLimit(), pagination.getBefore().toString(),
         pagination.getAfter().toString());
   }
@@ -682,7 +679,7 @@ public FollowingListResponse listUsersFollowing(@Nonnull Long userId, @Nonnull C
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#list-user-followers">List User Followers</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<Long> listAllUserFollowing(@Nonnull Long userId) {
+  public Stream<Long> listAllUserFollowing(Long userId) {
     return listAllUserFollowing(userId, new StreamPaginationAttribute(PaginatedService.DEFAULT_PAGINATION_CHUNK_SIZE,
         PaginatedService.DEFAULT_PAGINATION_TOTAL_SIZE));
   }
@@ -696,13 +693,13 @@ public Stream<Long> listAllUserFollowing(@Nonnull Long userId) {
    * @see <a href="https://developers.symphony.com/restapi/v20.9/reference#list-user-followers">List User Followers</a>
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<Long> listAllUserFollowing(@Nonnull Long userId, @Nonnull StreamPaginationAttribute pagination) {
+  public Stream<Long> listAllUserFollowing(Long userId, StreamPaginationAttribute pagination) {
     CursorBasedPaginatedApi<Long> api =
         (after, limit) -> new FollowingListResponseAdapter(listUsersFollowing(userId, limit, null, after));
     return new CursorBasedPaginatedService<>(api, pagination.getChunkSize(), pagination.getTotalSize()).stream();
   }
 
-  private FollowingListResponse listUsersFollowing(@Nonnull Long userId, Integer limit, String before, String after) {
+  private FollowingListResponse listUsersFollowing(Long userId, Integer limit, String before, String after) {
     return executeAndRetry("listUsersFollowing",
         () -> userApi.v1UserUidFollowingGet(authSession.getSessionToken(), userId, limit, before, after));
   }
@@ -714,7 +711,7 @@ private FollowingListResponse listUsersFollowing(@Nonnull Long userId, Integer l
    * @return a {@link V2UserDetail} with created user details.
    * @see <a href="https://developers.symphony.com/restapi/reference#create-user-v2">Create User v2</a>
    */
-  public V2UserDetail create(@Nonnull V2UserCreate payload) {
+  public V2UserDetail create(V2UserCreate payload) {
     return executeAndRetry("create",
         () -> userApi.v2AdminUserCreatePost(authSession.getSessionToken(), payload));
   }
@@ -727,7 +724,7 @@ public V2UserDetail create(@Nonnull V2UserCreate payload) {
    * @return {@link V2UserDetail} with updated user details.
    * @see <a href="https://developers.symphony.com/restapi/reference#update-user-v2">Update User v2</a>
    */
-  public V2UserDetail update(@Nonnull Long userId, @Nonnull V2UserAttributes payload) {
+  public V2UserDetail update(Long userId, V2UserAttributes payload) {
     return executeAndRetry("update",
         () -> userApi.v2AdminUserUidUpdatePost(authSession.getSessionToken(), userId, payload));
   }
@@ -743,7 +740,7 @@ public V2UserDetail update(@Nonnull Long userId, @Nonnull V2UserAttributes paylo
    * @return {@link V1AuditTrailInitiatorList} with items and pagination.
    * @see <a href="https://developers.symphony.com/restapi/reference#list-audit-trail-v1">List Audit Trail v1</a>
    */
-  public V1AuditTrailInitiatorList listAuditTrail(@Nonnull Long startTimestamp, Long endTimestamp,
+  public V1AuditTrailInitiatorList listAuditTrail(Long startTimestamp, Long endTimestamp,
       CursorPaginationAttribute pagination, Long initiatorId, String role) {
     String before = pagination != null && pagination.getBefore() != null ? pagination.getBefore().toString() : null;
     String after = pagination != null && pagination.getAfter() != null ? pagination.getAfter().toString() : null;
@@ -764,7 +761,7 @@ public V1AuditTrailInitiatorList listAuditTrail(@Nonnull Long startTimestamp, Lo
    * @return a lazy stream of audit trail actions
    */
   @API(status = API.Status.EXPERIMENTAL)
-  public Stream<V1AuditTrailInitiatorResponse> listAllAuditTrail(@Nonnull Long startTimestamp, Long endTimestamp,
+  public Stream<V1AuditTrailInitiatorResponse> listAllAuditTrail(Long startTimestamp, Long endTimestamp,
       Long initiatorId, String role, Integer chunkSize, Integer maxItems) {
     final CursorBasedPaginatedApi<V1AuditTrailInitiatorResponse> paginatedApi =
         (after, limit) -> new AuditTrailInitiatorListAdapter(listAuditTrail(startTimestamp, endTimestamp, null, after, limit, initiatorId, role));
@@ -772,7 +769,7 @@ public Stream<V1AuditTrailInitiatorResponse> listAllAuditTrail(@Nonnull Long sta
     return new CursorBasedPaginatedService<>(paginatedApi, chunkSize, maxItems).stream();
   }
 
-  private V1AuditTrailInitiatorList listAuditTrail(@Nonnull Long startTimestamp, Long endTimestamp,
+  private V1AuditTrailInitiatorList listAuditTrail(Long startTimestamp, Long endTimestamp,
       String before, String after, Integer limit, Long initiatorId, String role) {
     return executeAndRetry("listAuditTrail",
         () -> auditTrailApi.v1AudittrailPrivilegeduserGet(authSession.getSessionToken(),
@@ -788,7 +785,7 @@ private V1AuditTrailInitiatorList listAuditTrail(@Nonnull Long startTimestamp, L
    * @param until   instant till when the user should be suspended
    * @see <a href="https://developers.symphony.com/restapi/reference#suspend-user-v1">Suspend User Account v1</a>
    */
-  public void suspendUser(@Nonnull Long userId, @Nonnull String reason, @Nonnull Instant until) {
+  public void suspendUser(Long userId, String reason, Instant until) {
     UserSuspension userSuspension = new UserSuspension();
     userSuspension.setSuspended(true);
     userSuspension.setSuspensionReason(reason);
@@ -804,7 +801,7 @@ public void suspendUser(@Nonnull Long userId, @Nonnull String reason, @Nonnull I
    * @param userId  user id to reactivate
    * @see <a href="https://developers.symphony.com/restapi/reference#suspend-user-v1">Suspend User Account v1</a>
    */
-  public void unsuspendUser(@Nonnull Long userId) {
+  public void unsuspendUser(Long userId) {
     UserSuspension userSuspension = new UserSuspension();
     userSuspension.setSuspended(false);
     executeAndRetry("suspendUser",
@@ -816,7 +813,6 @@ private <T> T executeAndRetry(String name, SupplierWithApiException<T> supplier)
     return RetryWithRecovery.executeAndRetry(retryBuilder, name, userApi.getApiClient().getBasePath(), supplier);
   }
 
-
   private static class AuditTrailInitiatorListAdapter implements CursorPaginatedPayload<V1AuditTrailInitiatorResponse> {
 
     private V1AuditTrailInitiatorList payload;
diff --git a/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/package-info.java b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/package-info.java
new file mode 100644
index 000000000..bdab46ca2
--- /dev/null
+++ b/symphony-bdk-core/src/main/java/com/symphony/bdk/core/service/user/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.core.service.user;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/arch/CoreArchitectureTest.java b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/arch/CoreArchitectureTest.java
index 6785bae10..e39a7e131 100644
--- a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/arch/CoreArchitectureTest.java
+++ b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/arch/CoreArchitectureTest.java
@@ -1,6 +1,8 @@
 package com.symphony.bdk.core.arch;
 
+import static com.tngtech.archunit.base.DescribedPredicate.not;
 import static com.tngtech.archunit.core.domain.JavaClass.Predicates.resideInAPackage;
+import static com.tngtech.archunit.core.domain.JavaClass.Predicates.simpleName;
 import static com.tngtech.archunit.lang.conditions.ArchConditions.dependOnClassesThat;
 import static com.tngtech.archunit.lang.conditions.ArchConditions.resideInAnyPackage;
 import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.*;
@@ -28,6 +30,7 @@
  *     <li>Guava usage is not allowed (at the moment). This way we can control when and if we want to import it</li>
  *     <li>usage of System.out and System.err is not allowed</li>
  *     <li>usage of java.util.logging is not allowed</li>
+ *     <li>JSR-305 nullability annotations are not allowed (superseded by JSpecify)</li>
  *   </ul>
  * </p>
  */
@@ -49,11 +52,23 @@ void classes_should_be_annotated_with_api_guardian(JavaClasses classes) {
           .areNotAnonymousClasses()
         .and()
           .areNotPrivate()
+        .and(not(simpleName("package-info")))
         .should()
           .beAnnotatedWith(API.class)
     .check(classes);
   }
 
+  @ArchTest
+  void no_jsr305_nullability_annotations(JavaClasses classes) {
+    noClasses()
+        .that()
+          .resideOutsideOfPackage("com.symphony.bdk.gen..") // generator's jersey2 templates still emit JSR-305
+        .should()
+          .dependOnClassesThat(resideInAPackage("javax.annotation"))
+        .because("JSR-305 is unmaintained; nullability is expressed with JSpecify (@Nullable / @NullMarked)")
+    .check(classes);
+  }
+
   @ArchTest
   void loggers_should_be_private_static_final(JavaClasses classes) {
     fields()
diff --git a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/JwtHelperTest.java b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/JwtHelperTest.java
index 6b6b932e7..ac0565728 100644
--- a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/JwtHelperTest.java
+++ b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/JwtHelperTest.java
@@ -11,12 +11,13 @@
 import com.symphony.bdk.core.auth.jwt.JwtHelper;
 import com.symphony.bdk.core.auth.jwt.UserClaim;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
 import com.migcomponents.migbase64.Base64;
 import io.jsonwebtoken.Jwts;
 import io.jsonwebtoken.SignatureAlgorithm;
 import io.jsonwebtoken.io.DeserializationException;
 import io.jsonwebtoken.io.Deserializer;
+import io.jsonwebtoken.io.SerializationException;
+import io.jsonwebtoken.io.Serializer;
 import lombok.SneakyThrows;
 import lombok.extern.slf4j.Slf4j;
 import org.bouncycastle.asn1.ASN1Encodable;
@@ -25,11 +26,15 @@
 import org.bouncycastle.util.io.pem.PemObject;
 import org.bouncycastle.util.io.pem.PemWriter;
 import org.junit.jupiter.api.Test;
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 
 import java.io.ByteArrayInputStream;
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStreamReader;
+import java.io.OutputStream;
 import java.io.Reader;
 import java.io.StringWriter;
 import java.lang.reflect.Method;
@@ -59,6 +64,8 @@ public class JwtHelperTest {
   private static final String JWT_EXP_INVALID = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.zhWFI4bw81QLE49UnklwMlThgt2ktUOs5M1HKjENgRE.signature";
   public static final String JWT_SKD_ENABLED = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiY2FuVXNlU2ltcGxpZmllZEtleURlbGl2ZXJ5Ijp0cnVlfQ.signature";
 
+  private static final ObjectMapper MAPPER = new JsonMapper();
+
   @Test
   void loadPkcs8PrivateKey() throws GeneralSecurityException {
     final PrivateKey privateKey = JwtHelper.parseRsaPrivateKey(generatePkcs8RsaPrivateKey());
@@ -137,7 +144,7 @@ public void testExtractExpirationDateInvalidJwt() {
 
   @Test
   public void testExtractExpirationDateInvalidParsing() {
-    assertThrows(JsonProcessingException.class, () -> JwtHelper.extractExpirationDate("invalid.common.jwt"));
+    assertThrows(JacksonException.class, () -> JwtHelper.extractExpirationDate("invalid.common.jwt"));
   }
 
   @Test
@@ -298,6 +305,50 @@ public void testNormalizeSubjectDeserializerReaderIOException() {
     }
   }
 
+  @Test
+  @SneakyThrows
+  public void testMapperSerializerByteArray() {
+    // The byte[] overload is unreachable through jjwt's public API (OutputStream is used),
+    // so exercise it directly via reflection to cover both the success and the
+    // JacksonException catch path.
+    Method method = JwtHelper.class.getDeclaredMethod("mapperSerializer");
+    method.setAccessible(true);
+    @SuppressWarnings("unchecked")
+    Serializer<Map<String, ?>> serializer = (Serializer<Map<String, ?>>) method.invoke(null);
+
+    byte[] bytes = serializer.serialize(Map.of("sub", "alice"));
+    assertNotNull(bytes);
+
+    Map<String, Object> unserializable = new java.util.HashMap<>();
+    unserializable.put("bad", new Object() {
+      public String getValue() {
+        throw new IllegalStateException("boom");
+      }
+    });
+    assertThrows(SerializationException.class, () -> serializer.serialize(unserializable));
+  }
+
+  @Test
+  @SneakyThrows
+  public void testMapperSerializerOutputStreamException() {
+    // Exercise the JacksonException catch in the OutputStream overload; the success path is
+    // already covered by testCreateSignedJwt, which goes through jjwt's compact().
+    Method method = JwtHelper.class.getDeclaredMethod("mapperSerializer");
+    method.setAccessible(true);
+    @SuppressWarnings("unchecked")
+    Serializer<Map<String, ?>> serializer = (Serializer<Map<String, ?>>) method.invoke(null);
+
+    Map<String, Object> unserializable = new java.util.HashMap<>();
+    unserializable.put("bad", new Object() {
+      public String getValue() {
+        throw new IllegalStateException("boom");
+      }
+    });
+    try (OutputStream out = new java.io.ByteArrayOutputStream()) {
+      assertThrows(SerializationException.class, () -> serializer.serialize(unserializable, out));
+    }
+  }
+
   @SneakyThrows
   private static String generatePkcs8RsaPrivateKey() {
     final KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
@@ -344,6 +395,7 @@ private String generateJwt(Key key, UserClaim userClaim) {
     Date expiration = new Date(new Date().getTime() + (365L * 1000 * 3600 * 24));
 
     return Jwts.builder()
+        .json(testSerializer())
         .setIssuer("me")
         .setSubject("Bob")
         .setAudience("you")
@@ -355,4 +407,26 @@ private String generateJwt(Key key, UserClaim userClaim) {
         .setId("123")
         .compact();
   }
+
+  private static Serializer<Map<String, ?>> testSerializer() {
+    return new Serializer<Map<String, ?>>() {
+      @Override
+      public byte[] serialize(Map<String, ?> map) throws SerializationException {
+        try {
+          return MAPPER.writeValueAsBytes(map);
+        } catch (JacksonException e) {
+          throw new SerializationException("Unable to serialize JWT claims", e);
+        }
+      }
+
+      @Override
+      public void serialize(Map<String, ?> map, OutputStream out) throws SerializationException {
+        try {
+          MAPPER.writeValue(out, map);
+        } catch (JacksonException e) {
+          throw new SerializationException("Unable to serialize JWT claims", e);
+        }
+      }
+    };
+  }
 }
diff --git a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractBotAuthenticatorTest.java b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractBotAuthenticatorTest.java
index b55d5c0f1..be6ec7e35 100644
--- a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractBotAuthenticatorTest.java
+++ b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractBotAuthenticatorTest.java
@@ -16,7 +16,6 @@
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
-import javax.annotation.Nonnull;
 import java.net.SocketTimeoutException;
 import java.util.Collections;
 
@@ -69,7 +68,6 @@ protected String getBotUsername() {
     }
 
     @Override
-    @Nonnull
     public AuthSession authenticateBot() {
       return mock(AuthSession.class);
     }
diff --git a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractExtensionAppAuthenticatorTest.java b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractExtensionAppAuthenticatorTest.java
index 812dcde9b..448baa5a7 100644
--- a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractExtensionAppAuthenticatorTest.java
+++ b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractExtensionAppAuthenticatorTest.java
@@ -11,7 +11,6 @@
 import jakarta.ws.rs.ProcessingException;
 import org.junit.jupiter.api.Test;
 
-import javax.annotation.Nonnull;
 import java.net.ConnectException;
 import java.net.SocketTimeoutException;
 
@@ -53,7 +52,6 @@ protected String getAuthenticationBasePath() {
       return "localhost.symphony.com";
     }
 
-    @Nonnull
     @Override
     public AppAuthSession authenticateExtensionApp(String appToken) {
       return mock(AppAuthSession.class);
diff --git a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractOboAuthenticatorTest.java b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractOboAuthenticatorTest.java
index f7bd46f43..913ed0827 100644
--- a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractOboAuthenticatorTest.java
+++ b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/auth/impl/AbstractOboAuthenticatorTest.java
@@ -12,7 +12,6 @@
 import org.springframework.http.HttpMethod;
 import org.springframework.web.reactive.function.client.WebClientRequestException;
 
-import javax.annotation.Nonnull;
 import java.net.ConnectException;
 import java.net.SocketTimeoutException;
 import java.net.URI;
@@ -38,13 +37,13 @@ public TestAbstractOboAuthenticator(BdkRetryConfig retryConfig) {
     }
 
     @Override
-    protected String authenticateAndRetrieveOboSessionToken(@Nonnull String appSessionToken, @Nonnull Long userId)
+    protected String authenticateAndRetrieveOboSessionToken(String appSessionToken, Long userId)
         throws ApiException {
       return null;
     }
 
     @Override
-    protected String authenticateAndRetrieveOboSessionToken(@Nonnull String appSessionToken, @Nonnull String username)
+    protected String authenticateAndRetrieveOboSessionToken(String appSessionToken, String username)
         throws ApiException {
       return null;
     }
@@ -59,15 +58,13 @@ protected String getBasePath() {
       return "localhost.symphony.com";
     }
 
-    @Nonnull
     @Override
-    public AuthSession authenticateByUsername(@Nonnull String username) {
+    public AuthSession authenticateByUsername(String username) {
       return mock(AuthSession.class);
     }
 
-    @Nonnull
     @Override
-    public AuthSession authenticateByUserId(@Nonnull Long userId) {
+    public AuthSession authenticateByUserId(Long userId) {
       return mock(AuthSession.class);
     }
   }
diff --git a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/test/MockApiClient.java b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/test/MockApiClient.java
index 867ccf8f7..d50ad50e0 100644
--- a/symphony-bdk-core/src/test/java/com/symphony/bdk/core/test/MockApiClient.java
+++ b/symphony-bdk-core/src/test/java/com/symphony/bdk/core/test/MockApiClient.java
@@ -1,8 +1,5 @@
 package com.symphony.bdk.core.test;
 
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.json.JsonMapper;
 import com.symphony.bdk.http.api.ApiClient;
 import com.symphony.bdk.http.api.Pair;
 import com.symphony.bdk.http.jersey2.ApiClientJersey2;
@@ -14,6 +11,9 @@
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
 import org.mockito.ArgumentMatchers;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
 
 import java.io.UnsupportedEncodingException;
 import java.lang.reflect.ParameterizedType;
@@ -33,10 +33,9 @@
 
 public class MockApiClient {
 
-  private static final ObjectMapper MAPPER = new JsonMapper();
-  static {
-    MAPPER.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
-  }
+  private static final ObjectMapper MAPPER = JsonMapper.builder()
+      .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+      .build();
   private final Client httpClient = mock(Client.class);
   {
     when(this.httpClient.target(anyString())).thenThrow(new MockApiClientException("Calling the mocked ApiClient with wrong path"));
diff --git a/symphony-bdk-examples/bdk-ai-agent-example/build.gradle b/symphony-bdk-examples/bdk-ai-agent-example/build.gradle
index 664283d35..c8914825e 100644
--- a/symphony-bdk-examples/bdk-ai-agent-example/build.gradle
+++ b/symphony-bdk-examples/bdk-ai-agent-example/build.gradle
@@ -13,11 +13,13 @@ dependencies {
     implementation project(':symphony-bdk-core')
 
     runtimeOnly project(':symphony-bdk-template:symphony-bdk-template-freemarker')
-    implementation project(':symphony-bdk-http:symphony-bdk-http-jersey2')
+    implementation project(':symphony-bdk-http:symphony-bdk-http-jersey')
 
     implementation platform("dev.langchain4j:langchain4j-bom:${langchain4jVersion}")
     implementation 'dev.langchain4j:langchain4j'
     implementation 'dev.langchain4j:langchain4j-google-genai'
+    // CVE-2026-63317 fix, ahead of what langchain4j 1.17.2 pulls transitively (2.5.9)
+    implementation 'org.apache.opennlp:opennlp-tools:2.5.11'
 
     runtimeOnly 'ch.qos.logback:logback-classic'
     implementation 'org.slf4j:slf4j-api'
diff --git a/symphony-bdk-examples/bdk-core-examples/build.gradle b/symphony-bdk-examples/bdk-core-examples/build.gradle
index 463082d86..dd49ae9e0 100644
--- a/symphony-bdk-examples/bdk-core-examples/build.gradle
+++ b/symphony-bdk-examples/bdk-core-examples/build.gradle
@@ -11,9 +11,8 @@ dependencies {
     runtimeOnly project(':symphony-bdk-template:symphony-bdk-template-freemarker')
 
     // for advanced configuration of the JerseyClient
-    implementation project(':symphony-bdk-http:symphony-bdk-http-jersey2')
+    implementation project(':symphony-bdk-http:symphony-bdk-http-jersey')
     implementation 'org.glassfish.jersey.core:jersey-client'
-    implementation 'org.glassfish.jersey.media:jersey-media-json-jackson'
     implementation 'org.glassfish.jersey.media:jersey-media-multipart'
 
     runtimeOnly 'ch.qos.logback:logback-classic'
diff --git a/symphony-bdk-examples/bdk-group-example/build.gradle b/symphony-bdk-examples/bdk-group-example/build.gradle
index 8fd144edb..36bc1739c 100644
--- a/symphony-bdk-examples/bdk-group-example/build.gradle
+++ b/symphony-bdk-examples/bdk-group-example/build.gradle
@@ -9,7 +9,7 @@ dependencies {
     implementation project(':symphony-bdk-core')
 
     runtimeOnly project(':symphony-bdk-template:symphony-bdk-template-freemarker')
-    runtimeOnly project(':symphony-bdk-http:symphony-bdk-http-jersey2')
+    runtimeOnly project(':symphony-bdk-http:symphony-bdk-http-jersey')
 
     // import the extension
     implementation project(':symphony-bdk-extensions:symphony-group-extension')
diff --git a/symphony-bdk-examples/bdk-spring-boot-example/src/main/java/com/symphony/bdk/examples/spring/SampleSpringApplication.java b/symphony-bdk-examples/bdk-spring-boot-example/src/main/java/com/symphony/bdk/examples/spring/SampleSpringApplication.java
index 2a4d587e9..92f014615 100644
--- a/symphony-bdk-examples/bdk-spring-boot-example/src/main/java/com/symphony/bdk/examples/spring/SampleSpringApplication.java
+++ b/symphony-bdk-examples/bdk-spring-boot-example/src/main/java/com/symphony/bdk/examples/spring/SampleSpringApplication.java
@@ -2,10 +2,17 @@
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.Bean;
+import tools.jackson.databind.ObjectMapper;
 
 @SpringBootApplication
 public class SampleSpringApplication {
 
+  @Bean
+  public ObjectMapper jacksonObjectMapper() {
+    return new ObjectMapper();
+  }
+
   public static void main(String[] args) {
     SpringApplication.run(SampleSpringApplication.class, args);
   }
diff --git a/symphony-bdk-examples/bdk-spring-boot-example/src/main/java/com/symphony/bdk/examples/spring/api/ApiExceptionHandler.java b/symphony-bdk-examples/bdk-spring-boot-example/src/main/java/com/symphony/bdk/examples/spring/api/ApiExceptionHandler.java
index 3409600d6..0394123cb 100644
--- a/symphony-bdk-examples/bdk-spring-boot-example/src/main/java/com/symphony/bdk/examples/spring/api/ApiExceptionHandler.java
+++ b/symphony-bdk-examples/bdk-spring-boot-example/src/main/java/com/symphony/bdk/examples/spring/api/ApiExceptionHandler.java
@@ -2,8 +2,7 @@
 
 import com.symphony.bdk.http.api.ApiRuntimeException;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.databind.ObjectMapper;
 import lombok.Data;
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.HttpStatus;
@@ -24,7 +23,7 @@ static class ErrorMessage {
   }
 
   @ExceptionHandler(value = ApiRuntimeException.class)
-  public ResponseEntity<ErrorMessage> resourceNotFoundException(final ApiRuntimeException ex) throws JsonProcessingException {
+  public ResponseEntity<ErrorMessage> resourceNotFoundException(final ApiRuntimeException ex) {
     return new ResponseEntity<>(this.objectMapper.readValue(ex.getResponseBody(), ErrorMessage.class), HttpStatus.valueOf(ex.getCode()));
   }
 }
diff --git a/symphony-bdk-extensions/symphony-group-extension/build.gradle b/symphony-bdk-extensions/symphony-group-extension/build.gradle
index 60dee2186..4620146c7 100644
--- a/symphony-bdk-extensions/symphony-group-extension/build.gradle
+++ b/symphony-bdk-extensions/symphony-group-extension/build.gradle
@@ -20,6 +20,7 @@ dependencies {
     annotationProcessor 'org.projectlombok:lombok'
 
     implementation 'org.slf4j:slf4j-api'
+    implementation 'org.jspecify:jspecify'
 
     testImplementation 'org.junit.jupiter:junit-jupiter'
     testImplementation 'org.mockito:mockito-core'
diff --git a/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/SymphonyGroupService.java b/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/SymphonyGroupService.java
index a683a1530..a426ecf87 100644
--- a/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/SymphonyGroupService.java
+++ b/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/SymphonyGroupService.java
@@ -30,8 +30,7 @@
 import java.util.List;
 import java.util.stream.Stream;
 
-import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Service class for managing groups.
@@ -67,7 +66,7 @@ public SymphonyGroupService(RetryWithRecoveryBuilder<?> retryBuilder, ApiClientF
    * @param group the details of the group to be created
    * @return the created group
    */
-  public ReadGroup insertGroup(@Nonnull final CreateGroup group) {
+  public ReadGroup insertGroup(final CreateGroup group) {
     return this.executeAndRetry("groupExt.insertGroup",
         () -> this.groupApi.insertGroup("", group)
     );
@@ -82,7 +81,7 @@ public ReadGroup insertGroup(@Nonnull final CreateGroup group) {
    * @param updateGroup the group fields to be updated
    * @return
    */
-  public ReadGroup updateGroup(@Nonnull String ifMatch, @Nonnull String groupId, @Nonnull UpdateGroup updateGroup) {
+  public ReadGroup updateGroup(String ifMatch, String groupId, UpdateGroup updateGroup) {
     return this.executeAndRetry("groupExt.updateGroup",
         () -> this.groupApi.updateGroup("", ifMatch, groupId, updateGroup)
     );
@@ -97,7 +96,7 @@ public ReadGroup updateGroup(@Nonnull String ifMatch, @Nonnull String groupId, @
    *              The image must be a base64-encoded .jpg, .png, or .gif. Image size limit: 2 MB
    * @return the updated group
    */
-  public ReadGroup updateAvatar(@Nonnull String groupId, @Nonnull byte[] image) {
+  public ReadGroup updateAvatar(String groupId, byte[] image) {
     return this.executeAndRetry("groupExt.updateAvatar",
         () -> this.groupApi.updateAvatar("", groupId, new UploadAvatar().image(image))
     );
@@ -110,7 +109,7 @@ public ReadGroup updateAvatar(@Nonnull String groupId, @Nonnull byte[] image) {
    * @param groupId the ID of the group to retrive
    * @return the group details
    */
-  public ReadGroup getGroup(@Nonnull String groupId) {
+  public ReadGroup getGroup(String groupId) {
     return this.executeAndRetry("groupExt.getGroup",
         () -> this.groupApi.getGroup("", groupId)
     );
@@ -160,7 +159,7 @@ public Stream<ReadGroup> listAllGroups(@Nullable Status status, @Nullable SortOr
    * @param userId The ID of the user to be added into the group
    * @return the updated group
    */
-  public ReadGroup addMemberToGroup(@Nonnull String groupId, @Nonnull Long userId) {
+  public ReadGroup addMemberToGroup(String groupId, Long userId) {
     return this.executeAndRetry("groupExt.addMemberToGroup",
         () -> this.groupApi.addMemberToGroup("", groupId,
             new AddMember().member(new Member().memberId(userId).memberTenant(UserIdUtil.extractTenantId(userId))))
diff --git a/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/auth/OAuthSession.java b/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/auth/OAuthSession.java
index b1263d47a..85e164790 100644
--- a/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/auth/OAuthSession.java
+++ b/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/auth/OAuthSession.java
@@ -17,8 +17,6 @@
 import lombok.Setter;
 import org.apiguardian.api.API;
 
-import javax.annotation.Nonnull;
-
 @API(status = API.Status.INTERNAL)
 public class OAuthSession {
 
@@ -30,9 +28,9 @@ public class OAuthSession {
   private String bearerToken;
 
   public OAuthSession(
-      @Nonnull ApiClient loginClient,
-      @Nonnull AuthSession session,
-      @Nonnull RetryWithRecoveryBuilder<?> retryBuilder
+      ApiClient loginClient,
+      AuthSession session,
+      RetryWithRecoveryBuilder<?> retryBuilder
   ) {
     this.loginClient = loginClient;
     this.session = session;
diff --git a/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/auth/package-info.java b/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/auth/package-info.java
new file mode 100644
index 000000000..05c7bc928
--- /dev/null
+++ b/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/auth/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.ext.group.auth;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/package-info.java b/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/package-info.java
new file mode 100644
index 000000000..ff56d640f
--- /dev/null
+++ b/symphony-bdk-extensions/symphony-group-extension/src/main/java/com/symphony/bdk/ext/group/package-info.java
@@ -0,0 +1,4 @@
+@NullMarked
+package com.symphony.bdk.ext.group;
+
+import org.jspecify.annotations.NullMarked;
diff --git a/symphony-bdk-extensions/symphony-group-extension/src/test/java/com/symphony/bdk/ext/group/SymphonyGroupExtensionArchitectureTest.java b/symphony-bdk-extensions/symphony-group-extension/src/test/java/com/symphony/bdk/ext/group/SymphonyGroupExtensionArchitectureTest.java
index 425da1dce..a70cbe00a 100644
--- a/symphony-bdk-extensions/symphony-group-extension/src/test/java/com/symphony/bdk/ext/group/SymphonyGroupExtensionArchitectureTest.java
+++ b/symphony-bdk-extensions/symphony-group-extension/src/test/java/com/symphony/bdk/ext/group/SymphonyGroupExtensionArchitectureTest.java
@@ -1,6 +1,10 @@
 package com.symphony.bdk.ext.group;
 
+import static com.tngtech.archunit.base.DescribedPredicate.not;
+import static com.tngtech.archunit.core.domain.JavaClass.Predicates.resideInAPackage;
+import static com.tngtech.archunit.core.domain.JavaClass.Predicates.simpleName;
 import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.classes;
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
 
 import com.tngtech.archunit.core.domain.JavaClasses;
 import com.tngtech.archunit.core.importer.ImportOption;
@@ -11,7 +15,11 @@
 /**
  * Validate basic architecture rules using <a href="https://www.archunit.org/getting-started">ArchUnit</a>.
  *
- * Rule currently checked: all classes must be annotated with @API
+ * Rules currently checked:
+ * <ul>
+ *   <li>all classes must be annotated with @API</li>
+ *   <li>JSR-305 nullability annotations are not allowed (superseded by JSpecify)</li>
+ * </ul>
  */
 @AnalyzeClasses(
     packages = "com.symphony.bdk.ext.group",
@@ -31,8 +39,20 @@ void classes_should_be_annotated_with_api_guardian(JavaClasses classes) {
         .resideOutsideOfPackage("com.symphony.bdk.ext.group.gen..") // exclude generated classes
         .and()
         .areNotAnonymousClasses()
+        .and(not(simpleName("package-info")))
         .should()
         .beAnnotatedWith(API.class)
         .check(classes);
   }
+
+  @ArchTest
+  void no_jsr305_nullability_annotations(JavaClasses classes) {
+    noClasses()
+        .that()
+          .resideOutsideOfPackage("com.symphony.bdk.ext.group.gen..") // generator's jersey2 templates still emit JSR-305
+        .should()
+          .dependOnClassesThat(resideInAPackage("javax.annotation"))
+        .because("JSR-305 is unmaintained; nullability is expressed with JSpecify (@Nullable / @NullMarked)")
+        .check(classes);
+  }
 }
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/build.gradle b/symphony-bdk-http/symphony-bdk-http-jersey/build.gradle
similarity index 77%
rename from symphony-bdk-http/symphony-bdk-http-jersey2/build.gradle
rename to symphony-bdk-http/symphony-bdk-http-jersey/build.gradle
index 130379808..9ef82d051 100644
--- a/symphony-bdk-http/symphony-bdk-http-jersey2/build.gradle
+++ b/symphony-bdk-http/symphony-bdk-http-jersey/build.gradle
@@ -3,7 +3,7 @@ plugins {
     id 'bdk.java-publish-conventions'
 }
 
-description = 'Symphony Java BDK Core Http Jersey2'
+description = 'Symphony Java BDK Core Http Jersey'
 
 dependencies {
     constraints {
@@ -18,21 +18,18 @@ dependencies {
     implementation 'org.apiguardian:apiguardian-api'
     implementation 'io.jsonwebtoken:jjwt-api'
     runtimeOnly 'io.jsonwebtoken:jjwt-impl'
-    runtimeOnly 'io.jsonwebtoken:jjwt-jackson'
     implementation 'org.bouncycastle:bcpkix-jdk18on'
     implementation 'commons-io:commons-io'
     implementation 'org.apache.commons:commons-lang3'
     implementation 'io.swagger:swagger-annotations'
-    implementation 'com.fasterxml.jackson.core:jackson-databind'
-    implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jsr310'
-    implementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml'
+    implementation 'tools.jackson.core:jackson-databind'
+    implementation 'tools.jackson.dataformat:jackson-dataformat-yaml'
+    implementation 'tools.jackson.jakarta.rs:jackson-jakarta-rs-json-provider'
     implementation 'org.openapitools:jackson-databind-nullable'
-    implementation 'org.glassfish.jersey.media:jersey-media-json-jackson'
     implementation 'org.glassfish.jersey.core:jersey-client'
     implementation 'org.glassfish.jersey.inject:jersey-hk2'
     implementation 'org.glassfish.jersey.media:jersey-media-multipart'
-    implementation 'org.glassfish.jersey.connectors:jersey-apache-connector'
-    implementation 'com.google.code.findbugs:jsr305'
+    implementation 'org.glassfish.jersey.connectors:jersey-apache5-connector'
     implementation 'com.brsanthu:migbase64'
     implementation 'jakarta.ws.rs:jakarta.ws.rs-api'
     runtimeOnly 'commons-logging:commons-logging'
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2.java b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2.java
similarity index 86%
rename from symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2.java
rename to symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2.java
index cb76cb17d..85fa865a9 100644
--- a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2.java
+++ b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2.java
@@ -10,21 +10,19 @@
 
 import jakarta.ws.rs.client.Client;
 import jakarta.ws.rs.client.ClientBuilder;
-import org.apache.http.config.Registry;
-import org.apache.http.config.RegistryBuilder;
-import org.apache.http.conn.socket.ConnectionSocketFactory;
-import org.apache.http.conn.socket.PlainConnectionSocketFactory;
-import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
-import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
+import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
+import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
+import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactoryBuilder;
 import org.apiguardian.api.API;
 import org.glassfish.jersey.SslConfigurator;
-import org.glassfish.jersey.apache.connector.ApacheClientProperties;
-import org.glassfish.jersey.apache.connector.ApacheConnectorProvider;
+import org.glassfish.jersey.apache5.connector.Apache5ClientProperties;
+import org.glassfish.jersey.apache5.connector.Apache5ConnectorProvider;
 import org.glassfish.jersey.client.ClientConfig;
 import org.glassfish.jersey.client.ClientProperties;
 import org.glassfish.jersey.client.HttpUrlConnectorProvider;
-import org.glassfish.jersey.jackson.JacksonFeature;
 import org.glassfish.jersey.media.multipart.MultiPartFeature;
+import tools.jackson.jakarta.rs.json.JacksonJsonProvider;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
@@ -249,26 +247,24 @@ protected ClientConfig createClientConfig(SSLContext sslContext) {
     // turn off compliance validation to be able to send payloads with DELETE calls
     clientConfig.property(ClientProperties.SUPPRESS_HTTP_COMPLIANCE_VALIDATION, true);
 
-    SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslContext);
-    Registry<ConnectionSocketFactory> registry = RegistryBuilder.<ConnectionSocketFactory>create()
-        .register("https", sslConnectionSocketFactory)
-        .register("http", new PlainConnectionSocketFactory())
+    SSLConnectionSocketFactory sslSocketFactory = SSLConnectionSocketFactoryBuilder.create()
+        .setSslContext(sslContext)
         .build();
 
-    // By default PoolingHttpClientConnectionManager, if not configured, has 20 connection in the
-    // pool BUT only 2 max connection per route.
-    final PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager(registry);
-    connectionManager.setMaxTotal(this.connectionPoolMax);
-    connectionManager.setDefaultMaxPerRoute(this.connectionPoolPerRoute);
-    clientConfig.property(ApacheClientProperties.CONNECTION_MANAGER, connectionManager);
-    clientConfig.connectorProvider(new ApacheConnectorProvider());
+    final PoolingHttpClientConnectionManager connectionManager = PoolingHttpClientConnectionManagerBuilder.create()
+        .setSSLSocketFactory(sslSocketFactory)
+        .setMaxConnTotal(this.connectionPoolMax)
+        .setMaxConnPerRoute(this.connectionPoolPerRoute)
+        .build();
+    clientConfig.property(Apache5ClientProperties.CONNECTION_MANAGER, connectionManager);
+    clientConfig.connectorProvider(new Apache5ConnectorProvider());
     return clientConfig;
   }
 
   @API(status = API.Status.EXPERIMENTAL)
   protected void configureJackson(ClientConfig clientConfig) {
     clientConfig.register(new JSON());
-    clientConfig.register(JacksonFeature.class);
+    clientConfig.register(JacksonJsonProvider.class);
   }
 
   @API(status = API.Status.EXPERIMENTAL)
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderProviderJersey2.java b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderProviderJersey2.java
similarity index 100%
rename from symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderProviderJersey2.java
rename to symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientBuilderProviderJersey2.java
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2.java b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2.java
similarity index 99%
rename from symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2.java
rename to symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2.java
index dabe9f929..688334844 100644
--- a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2.java
+++ b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2.java
@@ -18,8 +18,8 @@
 import jakarta.ws.rs.core.GenericType;
 import jakarta.ws.rs.core.MediaType;
 import jakarta.ws.rs.core.Response;
-import org.apache.http.NoHttpResponseException;
-import org.apache.http.conn.ConnectTimeoutException;
+import org.apache.hc.core5.http.NoHttpResponseException;
+import org.apache.hc.client5.http.ConnectTimeoutException;
 import org.apiguardian.api.API;
 import org.glassfish.jersey.media.multipart.FormDataBodyPart;
 import org.glassfish.jersey.media.multipart.FormDataContentDisposition;
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2RequestLogFilter.java b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2RequestLogFilter.java
similarity index 100%
rename from symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2RequestLogFilter.java
rename to symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/ApiClientJersey2RequestLogFilter.java
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/JSON.java b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/JSON.java
new file mode 100644
index 000000000..a84c4081a
--- /dev/null
+++ b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/JSON.java
@@ -0,0 +1,50 @@
+package com.symphony.bdk.http.jersey2;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import jakarta.ws.rs.ext.ContextResolver;
+import org.apiguardian.api.API;
+import org.openapitools.jackson.nullable.JsonNullableJackson3Module;
+import tools.jackson.databind.DeserializationFeature;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.cfg.DateTimeFeature;
+import tools.jackson.databind.cfg.EnumFeature;
+import tools.jackson.databind.json.JsonMapper;
+
+import java.text.DateFormat;
+
+
+@API(status = API.Status.INTERNAL)
+public class JSON implements ContextResolver<ObjectMapper> {
+
+  private ObjectMapper mapper;
+
+  public JSON() {
+    this.mapper = buildMapper(new RFC3339DateFormat());
+  }
+
+  /**
+   * Set the date format for JSON (de)serialization with Date properties.
+   * @param dateFormat Date format
+   */
+  public void setDateFormat(DateFormat dateFormat) {
+    this.mapper = buildMapper(dateFormat);
+  }
+
+  private static ObjectMapper buildMapper(DateFormat dateFormat) {
+    return JsonMapper.builder()
+        .changeDefaultPropertyInclusion(inclusion -> inclusion.withValueInclusion(JsonInclude.Include.NON_NULL))
+        .configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false)
+        .configure(DeserializationFeature.FAIL_ON_INVALID_SUBTYPE, false)
+        .disable(DateTimeFeature.WRITE_DATES_AS_TIMESTAMPS)
+        .enable(EnumFeature.WRITE_ENUMS_USING_TO_STRING)
+        .enable(EnumFeature.READ_ENUMS_USING_TO_STRING)
+        .defaultDateFormat(dateFormat)
+        .addModule(new JsonNullableJackson3Module())
+        .build();
+  }
+
+  @Override
+  public ObjectMapper getContext(Class<?> type) {
+    return this.mapper;
+  }
+}
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/RFC3339DateFormat.java b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/RFC3339DateFormat.java
new file mode 100644
index 000000000..4404c66de
--- /dev/null
+++ b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/java/com/symphony/bdk/http/jersey2/RFC3339DateFormat.java
@@ -0,0 +1,55 @@
+package com.symphony.bdk.http.jersey2;
+
+import org.apiguardian.api.API;
+
+import java.text.DateFormat;
+import java.text.FieldPosition;
+import java.text.NumberFormat;
+import java.text.ParsePosition;
+import java.time.OffsetDateTime;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.util.Calendar;
+import java.util.Date;
+import java.util.GregorianCalendar;
+import java.util.Locale;
+import java.util.TimeZone;
+
+/**
+ * Formats dates as RFC 3339 (ISO 8601 with a fixed UTC offset), always including milliseconds.
+ *
+ * <p>Jackson 3 dropped the {@code ISO8601DateFormat} / {@code ISO8601Utils} helpers this class
+ * used to delegate to, so formatting and parsing are implemented directly on top of {@code java.time}.</p>
+ */
+@API(status = API.Status.INTERNAL)
+public class RFC3339DateFormat extends DateFormat {
+
+  private static final DateTimeFormatter FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ss.SSS'Z'");
+
+  public RFC3339DateFormat() {
+    final Calendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"), Locale.ROOT);
+    calendar.setLenient(false);
+    this.calendar = calendar;
+    final NumberFormat numberFormat = NumberFormat.getIntegerInstance(Locale.ROOT);
+    numberFormat.setGroupingUsed(false);
+    this.numberFormat = numberFormat;
+  }
+
+  @Override
+  public StringBuffer format(Date date, StringBuffer toAppendTo, FieldPosition fieldPosition) {
+    toAppendTo.append(FORMATTER.format(date.toInstant().atOffset(ZoneOffset.UTC)));
+    return toAppendTo;
+  }
+
+  @Override
+  public Date parse(String source, ParsePosition pos) {
+    try {
+      final OffsetDateTime parsed = OffsetDateTime.parse(source, DateTimeFormatter.ISO_OFFSET_DATE_TIME);
+      pos.setIndex(source.length());
+      return Date.from(parsed.toInstant());
+    } catch (java.time.format.DateTimeParseException e) {
+      pos.setErrorIndex(pos.getIndex());
+      return null;
+    }
+  }
+}
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/resources/META-INF/services/com.symphony.bdk.http.api.ApiClientBuilderProvider b/symphony-bdk-http/symphony-bdk-http-jersey/src/main/resources/META-INF/services/com.symphony.bdk.http.api.ApiClientBuilderProvider
similarity index 100%
rename from symphony-bdk-http/symphony-bdk-http-jersey2/src/main/resources/META-INF/services/com.symphony.bdk.http.api.ApiClientBuilderProvider
rename to symphony-bdk-http/symphony-bdk-http-jersey/src/main/resources/META-INF/services/com.symphony.bdk.http.api.ApiClientBuilderProvider
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/src/test/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2Test.java b/symphony-bdk-http/symphony-bdk-http-jersey/src/test/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2Test.java
similarity index 100%
rename from symphony-bdk-http/symphony-bdk-http-jersey2/src/test/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2Test.java
rename to symphony-bdk-http/symphony-bdk-http-jersey/src/test/java/com/symphony/bdk/http/jersey2/ApiClientBuilderJersey2Test.java
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/src/test/java/com/symphony/bdk/http/jersey2/ApiClientJersey2Test.java b/symphony-bdk-http/symphony-bdk-http-jersey/src/test/java/com/symphony/bdk/http/jersey2/ApiClientJersey2Test.java
similarity index 100%
rename from symphony-bdk-http/symphony-bdk-http-jersey2/src/test/java/com/symphony/bdk/http/jersey2/ApiClientJersey2Test.java
rename to symphony-bdk-http/symphony-bdk-http-jersey/src/test/java/com/symphony/bdk/http/jersey2/ApiClientJersey2Test.java
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/JSON.java b/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/JSON.java
deleted file mode 100644
index 4e7de4a12..000000000
--- a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/JSON.java
+++ /dev/null
@@ -1,45 +0,0 @@
-package com.symphony.bdk.http.jersey2;
-
-import com.fasterxml.jackson.annotation.JsonInclude;
-import com.fasterxml.jackson.databind.DeserializationFeature;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.fasterxml.jackson.databind.SerializationFeature;
-import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
-import jakarta.ws.rs.ext.ContextResolver;
-import org.apiguardian.api.API;
-import org.openapitools.jackson.nullable.JsonNullableModule;
-
-import java.text.DateFormat;
-
-
-@API(status = API.Status.INTERNAL)
-public class JSON implements ContextResolver<ObjectMapper> {
-
-  private final ObjectMapper mapper;
-
-  public JSON() {
-    this.mapper = new ObjectMapper();
-    this.mapper.setSerializationInclusion(JsonInclude.Include.NON_NULL);
-    this.mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
-    this.mapper.configure(DeserializationFeature.FAIL_ON_INVALID_SUBTYPE, false);
-    this.mapper.disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);
-    this.mapper.enable(SerializationFeature.WRITE_ENUMS_USING_TO_STRING);
-    this.mapper.enable(DeserializationFeature.READ_ENUMS_USING_TO_STRING);
-    this.mapper.setDateFormat(new RFC3339DateFormat());
-    this.mapper.registerModule(new JavaTimeModule());
-    this.mapper.registerModule(new JsonNullableModule());
-  }
-
-  /**
-   * Set the date format for JSON (de)serialization with Date properties.
-   * @param dateFormat Date format
-   */
-  public void setDateFormat(DateFormat dateFormat) {
-    mapper.setDateFormat(dateFormat);
-  }
-
-  @Override
-  public ObjectMapper getContext(Class<?> type) {
-    return this.mapper;
-  }
-}
diff --git a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/RFC3339DateFormat.java b/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/RFC3339DateFormat.java
deleted file mode 100644
index 7087784bd..000000000
--- a/symphony-bdk-http/symphony-bdk-http-jersey2/src/main/java/com/symphony/bdk/http/jersey2/RFC3339DateFormat.java
+++ /dev/null
@@ -1,20 +0,0 @@
-package com.symphony.bdk.http.jersey2;
-
-import com.fasterxml.jackson.databind.util.ISO8601DateFormat;
-import com.fasterxml.jackson.databind.util.ISO8601Utils;
-import org.apiguardian.api.API;
-
-import java.text.FieldPosition;
-import java.util.Date;
-
-@API(status = API.Status.INTERNAL)
-public class RFC3339DateFormat extends ISO8601DateFormat {
-
-  // Same as ISO8601DateFormat but serializing milliseconds.
-  @Override
-  public StringBuffer format(Date date, StringBuffer toAppendTo, FieldPosition fieldPosition) {
-    String value = ISO8601Utils.format(date, true);
-    toAppendTo.append(value);
-    return toAppendTo;
-  }
-}
diff --git a/symphony-bdk-http/symphony-bdk-http-webclient/src/main/java/com/symphony/bdk/http/webclient/ApiClientWebClient.java b/symphony-bdk-http/symphony-bdk-http-webclient/src/main/java/com/symphony/bdk/http/webclient/ApiClientWebClient.java
index 8c5458e64..4e562ebbc 100644
--- a/symphony-bdk-http/symphony-bdk-http-webclient/src/main/java/com/symphony/bdk/http/webclient/ApiClientWebClient.java
+++ b/symphony-bdk-http/symphony-bdk-http-webclient/src/main/java/com/symphony/bdk/http/webclient/ApiClientWebClient.java
@@ -183,7 +183,7 @@ public <T> ApiResponse<T> invokeAPI(
   @SuppressWarnings("unchecked")
   private <T> Mono<ApiResponse<T>> toApiResponse(TypeReference<T> returnType, ClientResponse response) {
     Map<String, List<String>> headers = response
-        .headers().asHttpHeaders().entrySet()
+        .headers().asHttpHeaders().headerSet()
         .stream()
         .collect(Collectors.toMap(
             Map.Entry::getKey,
diff --git a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/build.gradle b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/build.gradle
index 419424ca4..e0aec4409 100644
--- a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/build.gradle
+++ b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/build.gradle
@@ -27,6 +27,7 @@ dependencies {
     api 'org.springframework.boot:spring-boot-starter'
     api 'org.springframework.boot:spring-boot-starter-web'
     api 'org.springframework.boot:spring-boot-starter-actuator'
+    api 'org.springframework.boot:spring-boot-health'
     implementation project(':symphony-bdk-spring:symphony-bdk-core-spring-boot-starter')
 
     compileOnly 'org.projectlombok:lombok'
@@ -36,13 +37,13 @@ dependencies {
     implementation 'org.apiguardian:apiguardian-api'
     implementation 'org.springframework.boot:spring-boot-configuration-processor'
     implementation 'org.springframework.boot:spring-boot-starter-validation'
-    implementation 'jakarta.validation:jakarta.validation-api:3.0.2'
 
     testCompileOnly 'org.projectlombok:lombok'
     testAnnotationProcessor 'org.projectlombok:lombok'
 
     testImplementation 'org.junit.jupiter:junit-jupiter'
     testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
+    testImplementation 'org.springframework.boot:spring-boot-starter-webmvc-test'
 
     testImplementation coreProject.sourceSets.test.output
     testImplementation('org.springframework.boot:spring-boot-starter-test') {
diff --git a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/main/java/com/symphony/bdk/app/spring/service/SymphonyBdkHealthIndicator.java b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/main/java/com/symphony/bdk/app/spring/service/SymphonyBdkHealthIndicator.java
index 46a5ff4fd..afee42ef2 100644
--- a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/main/java/com/symphony/bdk/app/spring/service/SymphonyBdkHealthIndicator.java
+++ b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/main/java/com/symphony/bdk/app/spring/service/SymphonyBdkHealthIndicator.java
@@ -6,13 +6,13 @@
 import com.symphony.bdk.gen.api.model.V3HealthStatus;
 import com.symphony.bdk.http.api.ApiRuntimeException;
 
-import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.extern.slf4j.Slf4j;
 import org.apiguardian.api.API;
-import org.springframework.boot.actuate.health.AbstractHealthIndicator;
-import org.springframework.boot.actuate.health.Health;
-import org.springframework.boot.actuate.health.Status;
+import org.springframework.boot.health.contributor.AbstractHealthIndicator;
+import org.springframework.boot.health.contributor.Health;
+import org.springframework.boot.health.contributor.Status;
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.ObjectMapper;
 
 import java.util.Map;
 
@@ -53,7 +53,7 @@ protected void doHealthCheck(Health.Builder builder) throws Exception {
       try {
         V3Health health = MAPPER.readValue(e.getResponseBody(), V3Health.class);
         buildHealthDetail(builder, health);
-      } catch (JsonProcessingException exception) {
+      } catch (JacksonException exception) {
         log.debug("Failed to parse the health check failure response body, assume the global health state is down.", e);
         buildHealthDownDetail(builder);
       }
diff --git a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/SymphonyBdkAppSmokeTest.java b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/SymphonyBdkAppSmokeTest.java
new file mode 100644
index 000000000..d4c7b6a32
--- /dev/null
+++ b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/SymphonyBdkAppSmokeTest.java
@@ -0,0 +1,27 @@
+package com.symphony.bdk.app.spring;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import com.symphony.bdk.app.spring.auth.CircleOfTrustController;
+import com.symphony.bdk.app.spring.config.BdkExtAppControllerConfig;
+import com.symphony.bdk.app.spring.service.SymphonyBdkHealthIndicator;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.context.ApplicationContext;
+
+@SpringBootTest(classes = TestApplication.class)
+public class SymphonyBdkAppSmokeTest {
+
+  @Autowired
+  private ApplicationContext context;
+
+  @Test
+  void shouldAutoConfigureAppServices() {
+    assertThat(context.getBean(SymphonyBdkAppAutoConfiguration.class)).isNotNull();
+    assertThat(context.getBean(BdkExtAppControllerConfig.class)).isNotNull();
+    assertThat(context.getBean(CircleOfTrustController.class)).isNotNull();
+    assertThat(context.getBean(SymphonyBdkHealthIndicator.class)).isNotNull();
+  }
+}
diff --git a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/SymphonyBdkMockedConfiguration.java b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/SymphonyBdkMockedConfiguration.java
index 74460bcd6..026b8e839 100644
--- a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/SymphonyBdkMockedConfiguration.java
+++ b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/SymphonyBdkMockedConfiguration.java
@@ -1,14 +1,19 @@
 package com.symphony.bdk.app.spring;
 
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
 
+import com.symphony.bdk.core.auth.AuthSession;
 import com.symphony.bdk.core.auth.ExtensionAppAuthenticator;
+import com.symphony.bdk.core.service.session.SessionService;
+import com.symphony.bdk.gen.api.model.UserV2;
 
 import com.symphony.bdk.core.config.model.BdkExtAppConfig;
 import com.symphony.bdk.spring.SymphonyBdkCoreProperties;
 
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
 
 @Configuration
 public class SymphonyBdkMockedConfiguration {
@@ -19,6 +24,19 @@ public ExtensionAppAuthenticator extensionAppAuthenticator() {
   }
 
   @Bean
+  public AuthSession botSession() {
+    return mock(AuthSession.class);
+  }
+
+  @Bean
+  public SessionService sessionService() {
+    SessionService sessionService = mock(SessionService.class);
+    when(sessionService.getSession()).thenReturn(new UserV2().displayName("BotMention"));
+    return sessionService;
+  }
+
+  @Bean
+  @Primary
   public SymphonyBdkCoreProperties coreProperties() {
     SymphonyBdkCoreProperties properties = new SymphonyBdkCoreProperties();
     BdkExtAppConfig appConfig = new BdkExtAppConfig();
diff --git a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/auth/CircleOfTrustControllerTest.java b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/auth/CircleOfTrustControllerTest.java
index 06c9d71be..02851aa0d 100644
--- a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/auth/CircleOfTrustControllerTest.java
+++ b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/auth/CircleOfTrustControllerTest.java
@@ -18,11 +18,14 @@
 import com.symphony.bdk.core.config.model.BdkExtAppConfig;
 import com.symphony.bdk.spring.SymphonyBdkCoreProperties;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.databind.ObjectMapper;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
+import org.springframework.boot.test.context.TestConfiguration;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Import;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.mock.web.MockCookie;
@@ -31,8 +34,17 @@
 import org.springframework.test.web.servlet.MockMvc;
 
 @WebMvcTest(CircleOfTrustController.class)
+@Import(CircleOfTrustControllerTest.TestConfig.class)
 public class CircleOfTrustControllerTest {
 
+  @TestConfiguration
+  static class TestConfig {
+    @Bean
+    public ObjectMapper objectMapper() {
+      return new ObjectMapper();
+    }
+  }
+
   @Autowired
   private ObjectMapper objectMapper;
 
diff --git a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/service/SymphonyBdkHealthIndicatorTest.java b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/service/SymphonyBdkHealthIndicatorTest.java
index 8de389019..e8f758a7e 100644
--- a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/service/SymphonyBdkHealthIndicatorTest.java
+++ b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/java/com/symphony/bdk/app/spring/service/SymphonyBdkHealthIndicatorTest.java
@@ -15,8 +15,8 @@
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.boot.actuate.health.Health;
-import org.springframework.boot.actuate.health.Status;
+import org.springframework.boot.health.contributor.Health;
+import org.springframework.boot.health.contributor.Status;
 
 import java.util.Collections;
 import java.util.Map;
diff --git a/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/resources/privatekey.pem b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/resources/privatekey.pem
new file mode 100644
index 000000000..15537c6b9
--- /dev/null
+++ b/symphony-bdk-spring/symphony-bdk-app-spring-boot-starter/src/test/resources/privatekey.pem
@@ -0,0 +1,46 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAlgwR4BGFLAA/64iDNeoBl1WPKEQbANU2k7AHOyj5FvPDS3pIO5GJ7imK
+OW4TbX+66CSq2ENmERRPR/ozdTaMWtoLeSS2foPQlWMg4lF4xOcSo3VnSK80Gjb1F0r7tBtC
+VRhpXInaogexSpVXxgopkiWr1QCBESRFLCmuVLnXYegPSuNjA/SYCdBEX5YJ6V9jWjjH2+8n
+2VE5+avPoVTFFlWXpM4G3xb5SCtb/MNw/9kOrJO71nRjnlNEKpIIbslx6hAaLDpDOMprqWrQ
+aGKbwcIzDZmVshGgBk+LJi8xARB3Yoki7+yz3KBJk11+3JE/34oQN63mL3eVbD4+lubArDNE
+vsNYf6/xSvYG3wmDpzH59dodrBhtd/zw0+8nLAA2qQCrsOs5Yz2Nqcfu/gxc0BQIsIAXAtTu
+l9gURc7ZCEKUWaxYfEBcEqiEtBvw72wYgC3v4JvfWFcd2Z5UzE9N3xsqePScs/PowtyWZOkC
+Nxv/dyeThNt/t+OXL40hYW8oEKX1HCyBThYo2JtT7N+P0U235rSukdwLZiN+hwZUYzM27T8s
+fwoV2r9zsolkjL/HYMF8qlkSjDZduTlhf3h+dkRVP1ANwPDCSdBEPCS+VWGblfA1VdLCYmLi
+MSIlnIz8RdPnXOcuzeVDuuBiBxLYdGgnWXWEo3OLzzjhDjKiX58CAwEAAQKCAgBGKECXZznA
+WCGLDJplNBQoYW39YtLJcegB6BWJeN/29mVDPlrV13gJrsydi7VzxnxrHPHxCpqHs9paCkfT
+L30y4a7pptvZjeKSZvYyO+vfDTguy69OUfVnqHiyunG0ReafCToCdcaPak9gUzHmPEwxtIGC
+p6ixjib1vktv/DET60BzQJzEdbI9LG87zli2EM7QmaoBUPJt70fPUKFViuBYUA8GlPqrhv9p
+2jQ5nFySlDgDQ1RZsrP9jGtcCEn/GxuzWHIUae2SeTsbzQDDPhAb6aSbYEuZJhqPuNOUOA6O
+s9dOcFawnhl/OEcOq3GsyhF2gQSSNDJj0WNBaF01i5Fcei1YaQG4z2GZmrbn0nJVHe0o/JZq
+LBXJbhOnYwq6fLEydS5KgbHtOcZDFNpzOvWYteM2kB2gDB4n1at6j/os1A0HQBg8QdceONue
+i0OVE0MTob2CaIj7SB6PciX5yRPh+WdNXY6TlrRlhjaMxbS5NQB3XnbH9qbE04gmRaRuJgPS
+B9W8wLEP0z+1QgKAHcQkwYCeS3UdN24uiboCNLBGccPZirqITCdDCy5hLl/VyFY9EoZLs6IC
+Jwzcusrnj2nCq5rJ7k3Qfzw1jMEmCggJaQwqy/1Z9NhLdyq79kVfpVnZoXxopFwOiMFIZQB9
+grm1aTy43+UYJi4MjHQAmpweuQKCAQEA3fGbyPvAtWIKOW6RaVzuIHeGt33hrqbc5lS4cw5x
+mVuhMu9g5sOnGtMHF4r1egXj/qGK5r7VBQPmFmFHGzGe46KFs6OU/7PwD5OSbYfmFjLiSE0J
+4KwuXhfsML8A3+QeUKaYsQDqQvgq9xcuiIrWAX2W502Khdr97+2w++41y7vN6ig+584AFRDt
+3qLNs05jism5+Mld7oWT5itmwqo9I7ntxd2kzwjmeMWNQAlevsjl5kffdji/g6UVyFO6DkuZ
+uB9w/toHStV7Qwng5RQ1yfsSAvegJ9PB6d8uD6Wc0JYlMVZEHdzwSsew6NNkiflFE8LoAGPc
+HHKllpPtl/7wAwKCAQEArRI4Ec/HDFE9PfLAHjMB4dAJpk8qZCl9tR1egVm4T0hPvTim3lo5
+lf9KyM5MlJJS52nMvX3nzjX3fcBTj4hCmMhQKCE68e5rS+iSzJOXHgFt1h77Z/ipFyzP1vQ9
+gypV2p6v08MTqFXFITiTwBoWfms3UeQpl09vAMuSuCzQiibHHkhJE6EDTDowtv8MpA/iMIbm
+ofOu+1IXg5I8GnDNx9Km2M4awv65qKfX77b1XEfxp/D6n4BExgtn9Cbwi5isogT0OmWiobeI
+j1PQSmHnxtUKOozd6JntuqqUuHraemmpV2+8tSFJUzUX25isJgway5kuyytBKxYZUFujZLjl
+NQKCAQAjw+iH1dHzKM5e/Otf4ELbZoeGEDoLDAay81oZ6Gzz+qkabSrfZQ4Lq5AMAi+Wr1ZT
+VTLuBjiLq1orpxdvUWq6YhlLnoPHRPbde7lv/yNb1m1Sm1+JHhYGwbIlFNKOQdOEyaP3eh9G
+FXnPAaRVCpJ8AQINWhiFg4nCXTpVDskKgMQpBL1GW5L10hmS9AdT6sDtv55Bcim54zq3L61K
+l2Zs2Gxxo0sItfV15tfhRuFGu1cY6eIfyftKupKtCpkD7rjhy+dImlfsfkRzxCbCo6QbXWNE
+qSTc5inshzOD//sqPdfWgIFPkqgCVPW0P0SHW2z/Rzxdu7nft7XpcwMpqEKDAoIBAAIOpGH5
+0UjhMlQpLYVuX8haW7MBX+Se5aKgfb4V3e37Uw9RvBIKioKw7Sej5B8j+h5MEKXz+CxoUc/J
+2HRtTzVXtDQ16Oh1SAs38X7DBlnR9IdGCQD8YK4o1zOb5ZtIhoq5tidTO0mV82jorkDrTnck
+OR0dFC17QTuGL/FGfxgVS+qdO1kjYdGnI2sZbwIIOk0PXXBxYBQWrrbepx49VwTYCSmskX7d
+3kEV9aggyZvWMxYm9COvN6IPAqZRTCysnOi0HF8RVDSN5O6nNWOc9E9VuvBlOkIIil3cpzXm
+J/Cqjtu+NUUF50Q47laq4uj03eCrqnW5xuWHNrfQzwlkdT0CggEBAK22NJ3CUFYKmJjxavG6
+CA6xSq9RNJgWKihAlx8q4sNfKpCI5lOE+FXGnFKgh6toc7uB0lG0ZoPawqFd7u5+3J2cP6/A
+6gDNWBwusYbFex9llZcofGs3swRMii5uJGUVJ6hk9HiAbIN/4Gd4cifiqewHgMn/KovJNtaB
+2ZLiui2XqwqmKXvQ3Bdos3DGgJ9lNsM4jPgSSTIj6jK8RdG89J8WhERCn+/MXDYa7HDfwoL8
+T+01BY5WLyzchpYcGwLy9Wol1RkAhkZBHJM8yDMWjd1ViTJY1BHrLO2H/joLuFb7llTwtMhW
+1bzZX/Crl+F/YodtHcAeYDIcmVvSlQnVd7k=
+-----END RSA PRIVATE KEY-----
\ No newline at end of file
diff --git a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/build.gradle b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/build.gradle
index f73a4131f..5a7350e36 100644
--- a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/build.gradle
+++ b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/build.gradle
@@ -28,7 +28,7 @@ jacocoTestCoverageVerification {
 dependencies {
     api project(':symphony-bdk-core')
     api project(':symphony-bdk-http:symphony-bdk-http-api')
-    implementation project(':symphony-bdk-http:symphony-bdk-http-jersey2')
+    implementation project(':symphony-bdk-http:symphony-bdk-http-jersey')
 
     api project(':symphony-bdk-template:symphony-bdk-template-api')
     implementation project(':symphony-bdk-template:symphony-bdk-template-freemarker')
@@ -40,11 +40,11 @@ dependencies {
     implementation 'org.apiguardian:apiguardian-api'
     implementation 'org.springframework.boot:spring-boot-starter'
     implementation 'org.springframework.boot:spring-boot-configuration-processor'
-    implementation 'com.fasterxml.jackson.core:jackson-databind'
-    implementation 'com.google.code.findbugs:jsr305'
+    implementation 'tools.jackson.core:jackson-databind'
 
     testCompileOnly 'org.projectlombok:lombok'
     testAnnotationProcessor 'org.projectlombok:lombok'
+    testImplementation 'org.jspecify:jspecify'
     testImplementation 'org.junit.jupiter:junit-jupiter'
     testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
 
diff --git a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/SymphonyBdkCoreSmokeTest.java b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/SymphonyBdkCoreSmokeTest.java
new file mode 100644
index 000000000..8fdccdf5e
--- /dev/null
+++ b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/SymphonyBdkCoreSmokeTest.java
@@ -0,0 +1,29 @@
+package com.symphony.bdk.spring;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import com.symphony.bdk.core.service.health.HealthService;
+import com.symphony.bdk.core.service.message.MessageService;
+import com.symphony.bdk.core.service.stream.StreamService;
+import com.symphony.bdk.core.service.user.UserService;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.context.ApplicationContext;
+
+@SpringBootTest(classes = TestApplication.class)
+public class SymphonyBdkCoreSmokeTest {
+
+  @Autowired
+  private ApplicationContext context;
+
+  @Test
+  void shouldAutoConfigureCoreServices() {
+    assertThat(context.getBean(SymphonyBdkAutoConfiguration.class)).isNotNull();
+    assertThat(context.getBean(HealthService.class)).isNotNull();
+    assertThat(context.getBean(UserService.class)).isNotNull();
+    assertThat(context.getBean(StreamService.class)).isNotNull();
+    assertThat(context.getBean(MessageService.class)).isNotNull();
+  }
+}
diff --git a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/SymphonyBdkMockedConfiguration.java b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/SymphonyBdkMockedConfiguration.java
index fcdf2acd8..c23f2178e 100644
--- a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/SymphonyBdkMockedConfiguration.java
+++ b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/SymphonyBdkMockedConfiguration.java
@@ -6,15 +6,13 @@
 import com.symphony.bdk.gen.api.model.UserV2;
 import com.symphony.bdk.http.api.ApiClient;
 
-import com.fasterxml.jackson.databind.ObjectMapper;
+import tools.jackson.databind.ObjectMapper;
 import lombok.SneakyThrows;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
-import javax.annotation.Nonnull;
-
 import static com.symphony.bdk.core.auth.JwtHelperTest.JWT;
 
 /**
@@ -66,7 +64,7 @@ public static class ApiClientFactoryMock extends ApiClientFactory {
     @Qualifier("loginMockApiClient")
     private MockApiClient loginApiClient;
 
-    public ApiClientFactoryMock(@Nonnull BdkConfig config) {
+    public ApiClientFactoryMock(BdkConfig config) {
       super(config);
     }
 
diff --git a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventListenerAsyncTest.java b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventListenerAsyncTest.java
index a669ef945..30129c01e 100644
--- a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventListenerAsyncTest.java
+++ b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventListenerAsyncTest.java
@@ -19,7 +19,6 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.context.TestConfiguration;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.event.ApplicationEventMulticaster;
diff --git a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventListenerTest.java b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventListenerTest.java
index 5c509125a..ec7e16b0d 100644
--- a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventListenerTest.java
+++ b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventListenerTest.java
@@ -26,7 +26,6 @@
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import org.springframework.test.context.junit.jupiter.SpringExtension;
diff --git a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventsDispatcherTest.java b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventsDispatcherTest.java
index be00406e8..1d7ee71b5 100644
--- a/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventsDispatcherTest.java
+++ b/symphony-bdk-spring/symphony-bdk-core-spring-boot-starter/src/test/java/com/symphony/bdk/spring/events/RealTimeEventsDispatcherTest.java
@@ -29,7 +29,6 @@
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.test.context.bean.override.mockito.MockitoSpyBean;
 import org.springframework.test.context.junit.jupiter.SpringExtension;
 
diff --git a/symphony-bdk-test/symphony-bdk-test-spring-boot/build.gradle b/symphony-bdk-test/symphony-bdk-test-spring-boot/build.gradle
index 42d2debfd..8598d6851 100644
--- a/symphony-bdk-test/symphony-bdk-test-spring-boot/build.gradle
+++ b/symphony-bdk-test/symphony-bdk-test-spring-boot/build.gradle
@@ -22,4 +22,6 @@ dependencies {
         exclude group: 'junit', module: 'junit'
         exclude group: 'org.mockito'
     }
+
+    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
 }
diff --git a/symphony-bdk-test/symphony-bdk-test-spring-boot/src/test/java/com/symphony/bdk/test/spring/SymphonyBdkSpringBootTestSmokeTest.java b/symphony-bdk-test/symphony-bdk-test-spring-boot/src/test/java/com/symphony/bdk/test/spring/SymphonyBdkSpringBootTestSmokeTest.java
new file mode 100644
index 000000000..80d90bab1
--- /dev/null
+++ b/symphony-bdk-test/symphony-bdk-test-spring-boot/src/test/java/com/symphony/bdk/test/spring/SymphonyBdkSpringBootTestSmokeTest.java
@@ -0,0 +1,21 @@
+package com.symphony.bdk.test.spring;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import com.symphony.bdk.core.service.message.MessageService;
+import com.symphony.bdk.test.spring.annotation.SymphonyBdkSpringBootTest;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+
+@SymphonyBdkSpringBootTest
+public class SymphonyBdkSpringBootTestSmokeTest {
+
+  @Autowired
+  private MessageService messageService;
+
+  @Test
+  void testStackWorks() {
+    assertThat(messageService).isNotNull();
+  }
+}
diff --git a/symphony-bdk-test/symphony-bdk-test-spring-boot/src/test/java/com/symphony/bdk/test/spring/TestApplication.java b/symphony-bdk-test/symphony-bdk-test-spring-boot/src/test/java/com/symphony/bdk/test/spring/TestApplication.java
new file mode 100644
index 000000000..3534f3b2f
--- /dev/null
+++ b/symphony-bdk-test/symphony-bdk-test-spring-boot/src/test/java/com/symphony/bdk/test/spring/TestApplication.java
@@ -0,0 +1,7 @@
+package com.symphony.bdk.test.spring;
+
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class TestApplication {
+}
diff --git a/templates/pojo.mustache b/templates/pojo.mustache
index d3fe39470..084d10e86 100644
--- a/templates/pojo.mustache
+++ b/templates/pojo.mustache
@@ -121,7 +121,7 @@ public class {{classname}} {{#parent}}extends {{{parent}}} {{/parent}}{{#vendorE
   }
   {{#isArray}}
 
-  public {{classname}} add{{nameInCamelCase}}Item({{{items.datatypeWithEnum}}} {{name}}Item) {
+  public {{classname}} add{{nameInPascalCase}}Item({{{items.datatypeWithEnum}}} {{name}}Item) {
     {{#vendorExtensions.x-is-jackson-optional-nullable}}
     if (this.{{name}} == null || !this.{{name}}.isPresent()) {
       this.{{name}} = JsonNullable.<{{{datatypeWithEnum}}}>of({{{defaultValue}}});
@@ -146,7 +146,7 @@ public class {{classname}} {{#parent}}extends {{{parent}}} {{/parent}}{{#vendorE
   {{/isArray}}
   {{#isMap}}
 
-  public {{classname}} put{{nameInCamelCase}}Item(String key, {{{items.datatypeWithEnum}}} {{name}}Item) {
+  public {{classname}} put{{nameInPascalCase}}Item(String key, {{{items.datatypeWithEnum}}} {{name}}Item) {
     {{#vendorExtensions.x-is-jackson-optional-nullable}}
     if (this.{{name}} == null || !this.{{name}}.isPresent()) {
       this.{{name}} = JsonNullable.<{{{datatypeWithEnum}}}>of({{{defaultValue}}});