feat(domain,json)!: BPMN-aligned sealed domain model and process JSON v2

[emaarco]

What

Redesigns the process JSON and the domain model against BPMN 2.0 / bpmn-moddle, and unblocks #73 and #74.

The old properties slot held exactly one facet per node, so a multi-instance service task with an I/O mapping was literally unrepresentable — which is why both features land here rather than before.

• ADR 017 — sealed, BPMN-aligned FlowNodeDefinition. Sub-processes own their children and their own sequence flows; typed facets (TaskImplementation, EventDefinitionInstance[], MultiInstanceDefinition, IoMapping, EngineExtension) replace the untyped maps.
• ADR 018 — schema-versioned JSON v2: real containment, sequence-flow relations, multi-trigger events, root-element registries keyed by their own id.

Impact

• Breaking: the process JSON format. Migration guide: docs/changelog/v6.md.
• Breaking: custom validation rules that cast context.model to BpmnModel / MergedBpmnModel — those types are gone (see below).
• Generated Kotlin/Java Process API is unchanged except for models declaring a root element nothing references — those now emit one extra constant and are reported by a new rule. Measured against the merge-base over every fixture × 3 engines × 2 languages: 4 of 16 files, one constant each.

Also in here

Five defects found while validating the redesign, each with a failing test first:

• Dangling references after a merge — extraction keyed registries by id, merging by name, so two same-named bpmn:Message elements collapsed into one and left a messageRef pointing at nothing.
• Under-reported validation — serviceTasks deduplicated by implementation reference (empty when unconfigured), so N unimplemented tasks produced one violation.
• isExecutable on merged models was hardcoded true, and the JSON paths don't filter.
• Correlation key on the wrong entity — zeebe:subscription belongs to the bpmn:Message, not to each referencing event.
• Compensation activityRef repeated the event's own id.

Structure

adapter/outbound/engine was split by class kind (reader/, extractor/, utils/) with two of them importing each other; it is now split by problem — bpmn/, dialect/, xml/ — and EngineModelExtractor takes a dialect instead of being subclassed per engine.

BpmnModel and MergedBpmnModel differed only in whether variants were present, and every consumer asked exactly that. They collapse into one ProcessModel with isMerged. The four root-element registries move behind a RootElements value object, and BpmnModelApi.engine becomes targetEngine — distinct from ProcessModel.detectedEngine, which is what EngineMismatchRule compares it against.

Deliberately not done

VariableMapping is a code-generation ABI expressed as a domain interface, but moving it forces a decision on whether "will the generated API collide?" is a domain or an adapter rule. Likewise, root-element names are still copied onto the node tree because the correlation rules match on names rather than …Ref. Both are recorded in ADR 017 — they deserve their own ADR, not a release.

Verification

./gradlew clean build green · 387 tests, 0 failures · coverage gate green · architecture tests green under --rerun-tasks.

Generated JSON is validated against the published schema on every run, for every fixture and engine, plus a reference-integrity check. Coverage for #73/#74 spans all three engines at both the extraction and JSON layers; both guards were verified to fail under mutation.

Closes #58
Closes #73
Closes #74

[github-actions]

Test Coverage

Module	Line Coverage
bpmn-to-code-core	97.6% (2155/2209 lines)
bpmn-to-code-gradle	25.7% (29/113 lines)
bpmn-to-code-maven	62.2% (28/45 lines)
bpmn-to-code-web	95.6% (196/205 lines)
bpmn-to-code-testing	93.7% (164/175 lines)
bpmn-to-code-runtime	98.0% (48/49 lines)