fix(java): java sdk gaps

[pratyush618]

Fixes the last four medium-severity findings from the Java SDK audit list.

• Zero defer overrides task delay: EnqueueDecision.defer(Duration.ZERO) (e.g. deferUntil of a past instant) documents "enqueue now", but withDelay short-circuited on non-positive delays and silently kept the task's baked-in delayMs. The delay is now always applied, clamped to non-negative. Regression test asserts a 60s-delay task deferred by zero schedules immediately.
• Gzip codec javadoc: the class doc told readers to place GzipCodec after a signing codec — since codecs decode in reverse, that order decompresses attacker-controlled bytes before verifying integrity. Corrected to match the (already-correct) test and annotation-driven ordering.
• Primitive handler payloads rejected at compile time: a void handle(int payload) task handler generated new TypeReference<int>() {} — invalid Java surfacing as a cryptic javac error in the generated companion. The processor now reports a clear diagnostic on the offending method.
• In-memory backend FIFO: claimNext picked an arbitrary job among equal priorities (hash-map iteration order), diverging from production's priority DESC, scheduled_at ASC. Jobs now carry a monotonic sequence and ties break FIFO. Regression test runs five same-priority jobs on a single-thread worker and asserts enqueue order.

./gradlew build green across all subprojects.

Summary by CodeRabbit

• Bug Fixes

  • Prevents invalid Java generation by rejecting task handlers that use primitive payload types.
  • Ensures zero delay means “enqueue now,” even when a task has its own built-in delay.
  • Improves job ordering so same-priority work runs predictably in enqueue order.

• Documentation

  • Clarified delay behavior and codec ordering guidance.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes add a compile-time validation rejecting primitive payload types in @TaskHandler methods, update DefaultTaskito.withDelay to always override delay with a clamped non-negative value (making Duration.ZERO mean enqueue-now), fix GzipCodec ordering documentation, and add deterministic FIFO tie-breaking to InMemoryQueueBackend's job claiming logic via a new enqueueSeq field, with corresponding tests.

Changes

Core behavior changes and tests

Layer / File(s)	Summary
Reject primitive payload types sdks/java/processor/.../TaskHandlerProcessor.java	Validation now emits a compile error when the handler payload parameter is a primitive type instead of a boxed reference type.
Zero-defer overrides task delay sdks/java/src/main/.../DefaultTaskito.java, sdks/java/src/test/.../EnqueueDecisionTest.java	withDelay clamps delay to non-negative and always rebuilds EnqueueOptions with the computed value, so Duration.ZERO now overrides any baked-in task delay; a new test verifies immediate scheduling.
Deterministic FIFO dequeue ordering sdks/java/test-support/src/main/.../InMemoryQueueBackend.java, sdks/java/test-support/src/test/.../InMemoryQueueBackendTest.java	Adds enqueueSeq to JobRec, uses it for job id generation in enqueueOne/retryDead, and introduces claimsBefore comparator (priority, then scheduledAt, then enqueueSeq) used in claimNext; new test verifies same-priority jobs run in enqueue order.
GzipCodec ordering doc fix sdks/java/src/main/.../GzipCodec.java	Javadoc corrected to recommend placing GzipCodec before signing/encryption codecs rather than after.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Test as EnqueueDecisionTest
  participant Taskito as DefaultTaskito
  participant Options as EnqueueOptions
  Test->>Taskito: enqueue task (delayMs baked-in) with defer(Duration.ZERO)
  Taskito->>Taskito: withDelay clamps delay to 0
  Taskito->>Options: rebuild options with delayMs=0
  Taskito-->>Test: job scheduled immediately

Loading

Possibly related PRs

• ByteVeda/taskito#351: Introduces a two-sided payload codec chain composition model directly related to the GzipCodec ordering fix in this PR.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title is too generic and does not describe the actual Java SDK fixes in this PR.	Use a specific title naming the main change, such as fixes for defer behavior, codec docs, payload validation, and FIFO ordering.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/java-audit-mediums

---

_{Comment @coderabbitai help to get the list of available commands.}