Add the 0.15.0 changelog entry

Correctness and supply-chain hygiene: notification ordering and the
graceful-close drain, Jackson/Jetty CVE remediation, the verbatim
Apache-2.0 license and packaged LICENSE/NOTICE, and the build fixes.
No protocol or public API changes - verified: one main-source file
changed since v0.14.0, with no public or protected signature changes.

Author: markpollack

CHANGELOG.md

@@ -5,6 +5,55 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.15.0] - 2026-08-21
+
+Correctness and supply-chain hygiene. No protocol or public API changes: the ACP surface is
+identical to 0.14.0, so this is a drop-in upgrade.
+
+### Fixed
+
+- **Notification ordering.** Incoming notifications were dispatched as independent
+  fire-and-forget subscriptions, so a handler doing any async work could observe them out of
+  order — visible with agents that stream many rapid `session/update` chunks. They are now
+  serialized through a sink drained by `concatMap`, preserving arrival order. Reported and
+  fixed by @ljiro (#13, closes #11).
+- **Notifications lost on graceful close.** Following from the above, `closeGracefully()`
+  completed the notification sink and disposed the drain subscription in the same synchronous
+  block, discarding anything still queued. Because `AcpClient.SyncSpec` wraps every sync
+  `sessionUpdateConsumer` with `subscribeOn(SYNC_HANDLER_SCHEDULER)`, sync clients always have
+  async handlers, so a rapid burst could be lost entirely on close. `closeGracefully()` now
+  waits for the drain to terminate before tearing the session down, bounded by the session's
+  `requestTimeout` so a handler that never completes cannot hang shutdown. `close()` still
+  interrupts immediately — the two methods now differ, as their names imply.
+- Notifications arriving after shutdown has begun are still dropped — a graceful shutdown stops
+  accepting new work while draining what is queued, and JSON-RPC notifications carry no delivery
+  guarantee — but the log severity now distinguishes that expected case (DEBUG) from overflow,
+  zero-subscriber and non-serialized emission, which lose traffic on a live session (ERROR).
+
+### Security
+
+- Jackson 2.21.2 → **2.21.5** and Jetty 12.0.14 → **12.0.37**, clearing 17 known advisories
+  (5 high severity) reported against the published dependency closure. Both reach consumers as
+  compile-scope transitives of `acp-core` and `acp-websocket-jetty`.
+
+### Changed
+
+- **`LICENSE` is now the verbatim Apache License 2.0.** The previous file was a paraphrase: it
+  omitted section 6 (Trademarks) entirely, renumbered the sections that follow, rewrote the
+  section 2 copyright grant, and narrowed the `Licensor` and `Work` definitions. Automated
+  license detection classified the repository as `NOASSERTION` while every published POM
+  declared Apache-2.0.
+- `LICENSE` and a new `NOTICE` are now packaged under `META-INF` in every module artifact.
+- Removed a redundant `<repositories>` declaration from the published parent POM; consumers no
+  longer inherit a repository definition with snapshots enabled.
+
+### Build
+
+- Integration tests now execute. Three `*IT` classes existed, but Surefire's default includes do
+  not match `*IT` and no Failsafe plugin was configured, so `mvn verify` silently skipped them.
+- All GitHub Actions are pinned to commit SHAs.
+- `HandlerExceptionTest` no longer races the async dispatch with a fixed sleep.
+
 ## [0.14.0] - 2026-06-11
 
 Protocol currency: catching up to ACP spec v0.13.6 (June 2026). Supersedes the never-published
@@ -126,3 +175,4 @@ Protocol currency: catching up to ACP spec v0.13.6 (June 2026). Supersedes the n
 - SLF4J 2.0.16
 
 [0.9.0]: https://github.com/agentclientprotocol/java-sdk/releases/tag/v0.9.0
+[0.15.0]: https://github.com/agentclientprotocol/java-sdk/releases/tag/v0.15.0