v1.3.3

• Reduce full CI matrix batching with up to 16 concurrent test jobs while retaining all 48
  JDK/mode/partition combinations. Discover test partitions without resolving the complete
  check task graph while preserving dependency/JDK suite selection and verifying exact legacy
  partition coverage. Refresh read-only test caches from trusted main on pushes and daily by
  downloading external dependency JARs for baseline/latest classpaths, and retain verbose
  per-test output in reports instead of streaming it for successful tests. Distributable Agent
  builds and formal release candidates remain isolated from restored dependency caches.

• SBOM scanning skips unrelated ZIP entry contents, avoiding false byte-limit failures on large
  resources. Nested JARs use bounded temporary files instead of whole-archive heap buffers and are
  hashed during copying in diagnostic mode. Production resolves only loaded artifact origins and
  their exact nested entry chains without hashing artifact contents. Successful parses are reused
  until file attributes change; beacon.security.sbom.cache.seconds no longer triggers periodic
  rescans. Complete periodic
  inventory updates and full local diagnostic scans are preserved. Byte-limit warnings identify
  the affected artifact/entry and distinguish nested archive, metadata, and total read limits;
  failed collections retain the previous inventory.

• Dependency name preserves groupId:artifactId when Maven metadata is available; fallback names
  retain the actual artifact identity instead of shared product titles such as Apache Tomcat.
  A unique filename-matching Maven coordinate identifies the primary artifact in shaded JARs.
  Exclude JDK installation libraries, including Java 8 extension JARs, from application inventory.
  Exported hash now contains the lowercase MD5 of UTF-8 compact JSON [name,version] for
  deduplication, including finding components. Migrate consumers that treated this field as an
  artifact SHA-256; equal coordinates now deduplicate across physical copies. The existing
  name/version/hash field layout and schema version 2 remain unchanged. Local CycloneDX
  content hashes retain their standard SHA-256 meaning.

• Integrated official OTel Java Instrumentation v2.33.1, pinned to d9045e02e0711837d54f0fd058cd55f77742506d, with its SDK and build constraints. Review the root upstream changelog for compatibility and migration notes; Beacon product versioning remains independent.

• Avoid publishing an empty premain dependency list: retry collection every second until the first
  dependency is observed, then use the configured refresh interval. Preserve empty updates when
  previously loaded dependencies disappear. Exclude generated class directories from dependency
  and finding component identities. Recover explicit Manifest coordinates when artifact and
  version agree, without guessing Maven groups from vendor or OSGi names.

• Add a separate GHCR distribution workflow for already published stable Agent JARs, with native
  amd64/arm64 image acceptance, protected promotion, and a Kubernetes init-container smoke test.

• Dependency inventory includes started_at (JVM process start time) and uptime_ms
  (uptime at collection start), obtained from RuntimeMXBean without an additional timer.

• Security schema version 2 exports only request findings and periodic dependency inventory.
  Inventory now defaults to a configurable 300-second collection delay and sends every result,
  even when unchanged; failed collections emit nothing so consumers retain the previous valid list.
  Remove inventory status/error. Findings retain unknown/no_evidence/suspected attack-evidence
  classification; all Security logs use OTel INFO severity.
  Compact finding bodies by removing Resource duplicates, fixed assessment/validation placeholders,
  outcome, redundant span IDs and empty fields. Preserve non-empty evidence, sampling quality,
  stable fingerprints and classification reasons; consumers must accept omitted evidence arrays.
  Remove independent health, summary, diagnostic, loss, and truncated-record events, the diagnostic
  queue, pending-loss reporting, and SBOM history/revision/release identifiers. Production no longer
  retains full local finding representatives or runs the local snapshot timer unless enabled.

• Consumers must support beacon.security.sbom.inventory and complete multipart updates, replace
  evidence_id with occurrence_id, read direct component name/version/hash, and aggregate finding
  counts themselves. application_id is removed; reuse the runtime instance_id. Fingerprint v1
  and finding IDs are unchanged. Exception scopes now require only stable scope.finding_id.
  Sampling omission no longer implies truncation; collection_complete describes observation
  quality. Runtime object names constructed by collectors must also use the UUID directly.
  The pinned schema-v2 contract and collector migration must be adopted before deployment.

Release evidence

• Source commit: d0d1b4e4fb9d270f440f19364dda6e909def6fe0
• Full validation: https://github.com/beacon-observability/beacon-java/actions/runs/41046452319
• Agent SHA-256: 87ed8c71730ac1841f20ba7f8449597ce1baea915b438971648c6847b0ae1ac9
• The attached JAR is the exact candidate tested by this release workflow; the publish job does not rebuild it.