[stevehu]

Migrate AWS Lambda mapper paths to Jackson 3 through the lightweight shared mapper policy, without adding config dependencies to mapper-only modules.

CI pins policy f0d2100f972eec765b2b276e7ace38922394f0a6 and qualified core 97b2359b92ed3e1d05cac04f2da8760aa954e49d. The complete prerequisite closure is checked in at ci/jackson3-source-refs.json, initialized from successful run manifests. Missing/malformed pins fail before resolution; default CI performs no default-head or migration-branch lookup. Explicit replay overrides merge into the complete map and remain subject to core/prerequisite qualification. Core tests reuse verified evidence; other prerequisites and full consumer suites remain enabled. The source-origin audit covers NetworkNT releases and snapshots, with only the explicit digest-pinned validator release exception.

Core-pin adoption used merged light-4j #2826 and its reviewed acceptance record. Producer 40371926971, forced renewal 40371900445 and normal reuse 40373717464 passed for the exact core/policy/prerequisite tuple. No open core branch or obsolete policy pin is used.

Validation: all seven workflows pass manifest completeness, partial replay-merge, no-head-lookup, YAML, shell syntax and whitespace checks. The distribution result producer/enforcer was exercised with success, failure and wrong-source-SHA cases. Current source test job run 40405024131 passed on 86a8fa4efc12c82fad4311ae28acb49bc59f6197: 66 tests, 2 skipped, zero failures/errors. Downloaded reports exactly match every prerequisite SHA in the manifest and show zero source-origin audit failures. No release, deployment, consumer merge or draft promotion.

[stevehu]

Reviewed the diff at f6ad8c7 and read the changed modules. I did not run the build or tests.

1. custom-runtime and lambda-interceptor now take a compile dependency on com.networknt:config only to call Jackson2Defaults. Neither used config before. Every Lambda package and native image using them now carries config's transitive set (classic snakeyaml, snakeyaml-engine, encoder, decryptor). These modules exist to stay small, so it may be worth hosting the profile somewhere lighter or building the few overrides locally.
2. The PR shows only pre-commit.ci. The "local suites pass" claim rests on the author's logs, and a CLEAN merge state here reflects the absence of required build checks. The prerequisites are unpublished snapshots at unchanged 2.4.2-SNAPSHOT coordinates, so a source-build workflow like the Kafka PRs got would let others verify it.

[stevehu]

Review of head d68d2b3. I read the diff since my last review and ran nothing; test is green.

My earlier points look addressed. The Java changes are the rename to JacksonDefaults, and the workflow now pins the reviewed policy and core SHAs, resolves yaml-rule and http-client from the qualified evidence, and uses the shared audit script. No new points from me.

[stevehu]

Review of head 86a8fa4. I read the diff since my last review and ran nothing; test is green.

The new ci/jackson3-source-refs.json pins the complete prerequisite closure by SHA, and the workflow checks that the keys are exactly the expected set and that the core SHA matches the pinned candidate before merging in any source_refs override. No new points from me.

[stevehu]

Full-diff review of head 86a8fa4 (no commits since my last comment). I read the diff and the sources and ran nothing; test is green and the PR is mergeable. I found no blockers.

I checked the JacksonDefaults rename, the tools.jackson imports (including TextNode to StringNode in RequestValidator), the new runtime compatibility tests (event wire shape, builder binding with a null primitive, permissive binding with trailing tokens) and the validation regression tests (handled malformed body, stable messages, 405 on an unsupported method).

Two minor points, neither a regression:

1. Duplicated permissive mapper. Runtime builds JacksonDefaults.builder().disable(FAIL_ON_UNKNOWN_PROPERTIES).build() as a private static, and light-lambda-native repeats it in Main and TestUtils; the compatibility tests read the private field by reflection. A policy change has to be made in several places and the tests break silently on a rename. A small shared factory with a package-visible accessor would remove both.
2. Pre-existing, not introduced here. SchemaValidator.doValidate calls ((ObjectNode) schema).set(COMPONENTS_FIELD, jsonNode), mutating the caller's schema and attaching one shared components tree. If callers reuse a cached schema node across concurrent requests, two validations can mutate the same ObjectNode, which Jackson trees do not support. I did not verify whether callers share nodes; copying the schema first would remove the question.