diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1f67175..02821a1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ name: Release to Maven Central
# The parent must ship: module poms take their groupId from it, and Central rejects a
# bundle whose module coordinates cannot be resolved. samples is excluded from deployment
# via maven.deploy.skip, but the release gate still builds and tests the full main reactor
-# (main has no vendor-jar dependency; the Eastcom adapter exists only on the dev branch).
+# (main has no vendor-jar dependency; vendor-specific adapters remain outside this release branch).
on:
push:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3782f27..65923e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,20 @@
## [Unreleased]
+## [0.0.8] — 2026-09-13
+
+- Scope task lifecycle callbacks to each `sendTask` invocation so concurrent workflow executions
+ cannot overwrite or receive one another's protocol events.
+- Cancel pending task polls and acknowledgement timers when an invocation, subscription, client or
+ transport finishes; this prevents delayed callbacks from surviving resource shutdown.
+- Track raw transport activity separately from decoded Notification-T business events. Standard SSE
+ comment heartbeats refresh `heartbeat().lastEventAt()` without increasing `eventCount`; use the
+ new `lastBusinessEventAt()` accessor for business-event liveness.
+- Add configurable connection/read deadlines to `LoadPsop`, and reject ambiguous simultaneous
+ `credentialsConfigPath` and inline `credentialsConfig` configuration.
+- Clarify `DefaultExtensionSender` ownership: its public constructor owns the supplied transport;
+ callers that share a transport must use `DefaultExtensionSender.nonOwning(...)`.
+
## [0.0.7] — 2026-09-13
- Set the source-build version to `0.0.7-SNAPSHOT`. Maven Central version `0.0.6` was published from the same source
@@ -84,4 +98,4 @@
- Keep documentation host-neutral; sample class and AgentCard identifiers remain unchanged.
Published Maven artifacts use the version selected by the release tag. The default source-build
-`revision=0.0.7-SNAPSHOT` is not a Maven Central release version.
+`revision=0.0.8-SNAPSHOT` is not a Maven Central release version.
diff --git a/README.md b/README.md
index 9e66d9f..2511aa5 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ subscription remains open until the host-defined terminal event, explicit cancel
### 1. Add Maven dependency
-The current engine release is `0.0.7` on [Maven Central](https://repo.maven.apache.org/maven2/net/openan/workflow/sdk/).
+The current engine release is `0.0.8` on [Maven Central](https://repo.maven.apache.org/maven2/net/openan/workflow/sdk/).
A2A-T SDK `1.1.0` is published to Maven Central. Maven resolves it automatically; no SDK source checkout or local SDK
build is required. The engine depends only on
@@ -51,7 +51,7 @@ upgrade guidance.
net.openan.workflow.sdk
workflow-engine
- 0.0.7
+ 0.0.8
```
@@ -61,7 +61,7 @@ For Spring Boot server-side integration:
net.openan.workflow.sdk
spring-boot-starter
- 0.0.7
+ 0.0.8
```
diff --git a/docs/en/BUSINESS_CALLBACKS.md b/docs/en/BUSINESS_CALLBACKS.md
index c448b93..04e23ba 100644
--- a/docs/en/BUSINESS_CALLBACKS.md
+++ b/docs/en/BUSINESS_CALLBACKS.md
@@ -1,6 +1,6 @@
# Business callback integration contract
-Initial-release API; A2A-T SDK `1.1.0`, A2A Java `1.2.0.Final`. The engine owns DAG scheduling, standard A2A envelopes,
+Release `0.0.8` API; A2A-T SDK `1.1.0`, A2A Java `1.2.0.Final`. The engine owns DAG scheduling, standard A2A envelopes,
auth, transport and task waiting. The host owns content, schemas, templates, semantic validation and any LLM calls.
The business contracts are independent of the transport runtime.
diff --git a/docs/en/DEVELOPER_GUIDE.md b/docs/en/DEVELOPER_GUIDE.md
index 64d6cd9..1a66b1b 100644
--- a/docs/en/DEVELOPER_GUIDE.md
+++ b/docs/en/DEVELOPER_GUIDE.md
@@ -11,11 +11,11 @@ Add to your `pom.xml`:
net.openan.workflow.sdk
workflow-engine
- 0.0.7
+ 0.0.8
```
-Version `0.0.7` is published to Maven Central and contains the APIs documented in this guide.
+Version `0.0.8` is published to Maven Central and contains the APIs documented in this guide.
The engine pulls in A2A protocol transports and a2a-t-core only. Host agents generating A2A-T content explicitly add
a2a-t-client; dispatched-agent services that validate received content also add a2a-t-server.
diff --git a/docs/en/INTEGRATION_GUIDE.md b/docs/en/INTEGRATION_GUIDE.md
index 4b1502b..8804919 100644
--- a/docs/en/INTEGRATION_GUIDE.md
+++ b/docs/en/INTEGRATION_GUIDE.md
@@ -22,11 +22,11 @@ callbacks own A2A-T generation, semantic validation, schemas and any LLM calls.
net.openan.workflow.sdk
workflow-engine
-0.0.7
+0.0.8
```
-Version `0.0.7` is published to Maven Central and contains the APIs documented in this guide.
+Version `0.0.8` is published to Maven Central and contains the APIs documented in this guide.
## 4. Quick Start
@@ -227,7 +227,7 @@ configuration without modifying system properties. Never log plaintext or the ke
**Encrypt a password**
-Build the jar with `mvn -pl workflow-engine -am -Drevision=0.0.7 package`; commands below run from the repository root.
+Build the jar with `mvn -pl workflow-engine -am "-Drevision=0.0.8" package`; commands below run from the repository root.
`set` is Windows cmd syntax (PowerShell: `$env:A2AT_CRED_KEY='...'`). This CLI needs only the SDK jar and JDK.
Use disposable example values here: command-line passwords/keys can appear in shell history and process listings.
For production, obtain secrets securely in the host and use the Java encryption API.
@@ -235,10 +235,10 @@ For production, obtain secrets securely in the host and use the Java encryption
```bash
# Option 1: set env var first
set A2AT_CRED_KEY=4f8a2b1c3d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
-java -cp workflow-engine/target/workflow-engine-0.0.7.jar dev.openan.workflow.engine.client.CredentialCrypto "Admin@123"
+java -cp workflow-engine/target/workflow-engine-0.0.8.jar dev.openan.workflow.engine.client.CredentialCrypto "Admin@123"
# Option 2: pass key as second argument
-java -cp workflow-engine/target/workflow-engine-0.0.7.jar dev.openan.workflow.engine.client.CredentialCrypto "Admin@123" 4f8a2b1c3d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
+java -cp workflow-engine/target/workflow-engine-0.0.8.jar dev.openan.workflow.engine.client.CredentialCrypto "Admin@123" 4f8a2b1c3d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
```
Output:
@@ -254,7 +254,7 @@ Paste the output into the `value` field of the credentials JSON.
1. Generate a new key: `openssl rand -hex 32`
2. Update the host secret store / explicit `credentialEncryptionKey`, or its OS/JVM `A2AT_CRED_KEY`
3. Re-encrypt all passwords:
- `java -cp workflow-engine/target/workflow-engine-0.0.7.jar dev.openan.workflow.engine.client.CredentialCrypto "plaintext" new-key`
+ `java -cp workflow-engine/target/workflow-engine-0.0.8.jar dev.openan.workflow.engine.client.CredentialCrypto "plaintext" new-key`
4. Update the `enc:...` results in the credentials JSON file
> The `.env` file should not be committed to version control. Add it to `.gitignore`.
diff --git a/docs/zh/BUSINESS_CALLBACKS.md b/docs/zh/BUSINESS_CALLBACKS.md
index 1562d87..03629d7 100644
--- a/docs/zh/BUSINESS_CALLBACKS.md
+++ b/docs/zh/BUSINESS_CALLBACKS.md
@@ -1,6 +1,6 @@
# 业务回调集成契约
-首发 API，A2A-T SDK `1.1.0`，A2A Java `1.2.0.Final`。 引擎负责 DAG、标准 A2A 信封、认证、传输和任务等待；宿主负责消息内容、schema、模板、语义校验和
+`0.0.8` API，A2A-T SDK `1.1.0`，A2A Java `1.2.0.Final`。 引擎负责 DAG、标准 A2A 信封、认证、传输和任务等待；宿主负责消息内容、schema、模板、语义校验和
LLM。业务契约独立于具体传输实现。
## 1. 回调接口
diff --git a/docs/zh/DEVELOPER_GUIDE.md b/docs/zh/DEVELOPER_GUIDE.md
index 33c2aa5..5c0e76f 100644
--- a/docs/zh/DEVELOPER_GUIDE.md
+++ b/docs/zh/DEVELOPER_GUIDE.md
@@ -10,11 +10,11 @@
net.openan.workflow.sdk
workflow-engine
- 0.0.7
+ 0.0.8
```
-`0.0.7` 已发布到 Maven Central，包含本文说明的接口。
+`0.0.8` 已发布到 Maven Central，包含本文说明的接口。
引擎会传递性引入 A2A 协议 SDK（`a2a-java-sdk-client`，含 REST、JSON-RPC、gRPC 传输） 和最小 A2A-T 核心（`a2a-t-core`）。生成 A2A-T 内容的宿主智能体显式依赖 a2a-t-client，校验接收内容的被调度智能体服务另引入 a2a-t-server。
diff --git a/docs/zh/INTEGRATION_GUIDE.md b/docs/zh/INTEGRATION_GUIDE.md
index fd95652..af8e81b 100644
--- a/docs/zh/INTEGRATION_GUIDE.md
+++ b/docs/zh/INTEGRATION_GUIDE.md
@@ -20,11 +20,11 @@ A2A-T 工作流执行引擎是一个 Java SDK，用于基于 A2A 协议和 A2A-T
net.openan.workflow.sdk
workflow-engine
-0.0.7
+0.0.8
```
-`0.0.7` 已发布到 Maven Central，包含本文说明的接口。
+`0.0.8` 已发布到 Maven Central，包含本文说明的接口。
## 4. 快速上手
@@ -217,17 +217,17 @@ A2AT_CRED_KEY=4f8a2b1c3d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
**加密密码**
-先执行 `mvn -pl workflow-engine -am -Drevision=0.0.7 package`，以下命令在仓库根目录运行，仅需 SDK jar 和 JDK。
+先执行 `mvn -pl workflow-engine -am "-Drevision=0.0.8" package`，以下命令在仓库根目录运行，仅需 SDK jar 和 JDK。
`set` 是 Windows cmd 语法，PowerShell 应使用 `$env:A2AT_CRED_KEY='...'`。
以下参数仅用于演示；命令行口令/密钥可能进入终端历史和进程参数。生产应由集成方安全读取密钥并调用 Java 加密 API。
```bash
# 方式一：先设置环境变量
set A2AT_CRED_KEY=4f8a2b1c3d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
-java -cp workflow-engine/target/workflow-engine-0.0.7.jar dev.openan.workflow.engine.client.CredentialCrypto "Admin@123"
+java -cp workflow-engine/target/workflow-engine-0.0.8.jar dev.openan.workflow.engine.client.CredentialCrypto "Admin@123"
# 方式二：密钥作为第二个参数
-java -cp workflow-engine/target/workflow-engine-0.0.7.jar dev.openan.workflow.engine.client.CredentialCrypto "Admin@123" 4f8a2b1c3d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
+java -cp workflow-engine/target/workflow-engine-0.0.8.jar dev.openan.workflow.engine.client.CredentialCrypto "Admin@123" 4f8a2b1c3d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b
```
输出：
@@ -242,7 +242,7 @@ enc:uHQcTeKZMVNRM9Ga:o5vm4weRozBXBs04phrLq7j7+/yRVyDsrw==
1. 生成新密钥：`openssl rand -hex 32`
2. 更新集成方密钥存储及显式 `credentialEncryptionKey`，或 OS/JVM 的 `A2AT_CRED_KEY`；引擎不自动加载 `.env`
-3. 用新密钥重新加密所有密码：`java -cp workflow-engine/target/workflow-engine-0.0.7.jar dev.openan.workflow.engine.client.CredentialCrypto "明文密码" 新密钥`
+3. 用新密钥重新加密所有密码：`java -cp workflow-engine/target/workflow-engine-0.0.8.jar dev.openan.workflow.engine.client.CredentialCrypto "明文密码" 新密钥`
4. 将新的 `enc:...` 结果更新到凭证 JSON 文件
> `.env` 文件不应提交到版本库，建议加入 `.gitignore`。
diff --git a/pom.xml b/pom.xml
index cec6a13..5f3b0e0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -48,7 +48,7 @@
- 0.0.7-SNAPSHOT
+ 0.0.8-SNAPSHOT
17
UTF-8
1.2.0.Final