DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
Contents
- APISIX
- Apache AsterixDB
- Apache Cassandra
- Apache Fineract
- [Testing] Add unit tests for ApiParameterHelper in fineract-core[GSoC 2026] [POC] Standardize and Harden Transaction Idempotency for Savings and Loans
- Apache NuttX
- Apache Wayang
- Mahout
- Beam
- DolphinScheduler
- SkyWalking
- IoTDB
- Seata
- CloudStack
- Apache Grails
- Apache Fory
- HugeGraph
- Airflow
- Apache HTTP Server
- Spark
...
New command processing infrastructure
Background and Motivation
Fineract accumulated some technical debt over the years. One area that is implicated is type-safety of internal and external facing APIs, the most prominent of which is Fineract's REST API. In general the package layout of the project reflects a more or less classic layered architecture (REST API, data transfer/value objects, business logic services, storage/repositories). The project predates some of the more modern frameworks and best practices that are available today and on occasions the data structures that are exchanged offer some challenges (e.g. generic types). Fineract's code base reflects that, especially where JSON de-/serialization is involved. Nowadays, this task would be simply delegated to the Jackson framework, but when Fineract (Mifos) started the decision was made to use Google's GSON library and create handcrafted helper classes to deal with JSON parsing. While this provided a lot of flexibility this approach had some downsides:
- the lowest common denominator is the string type (aka JSON blob); this is where we lose the type information
- the strings are transformed into JSONObjects; a little bit better than raw strings, but barely more than a hash map
- a ton of "magic" strings are needed to get/set values
- this approach makes refactoring unnecessarily more difficult
- to be able to serve an OpenAPI descriptor (as JSON and YAML) we had to re-introduce the type information at the REST API level with dummy classes that contain only the specified attributes; those classes are only used with the Swagger annotations and no were else
- some developers skipped the layered architecture and found it too tedious to maintain DTOs and JSON helper classes, and as a result just passed JSONObjects right to the business logic layer
- now the business logic is unnecessarily aware of how Fineract communicates to the outside world and makes replacing/enhancing the communication protocol (e.g. with GRPC) pretty much impossible
The list doesn't end here, but in the end things boil down to two main points:
- poor developer experience: boilerplate code and missing type safety cost more time
- bugs: the more code the more likely errors get introduced, especially when type safety is missing and we have to rely on runtime errors (vs. compile time).
There has been already some preparatory work done concerning type safety, but until now we avoided dealing with the real source of this issue. Fineract's architectures devises read from write requests ("CQRS", https://martinfowler.com/bliki/CQRS.html) for improved scalability.
The read requests are not that problematic, but all write requests pass through a component/service that is called "SynchronousCommandProcessingService. As the name suggests the execution of business logic is synchronous (mostly) due to this part of the architecture. This is not necessarily a problem (not immediately at least), but it's nevertheless a central bottleneck in the system. Even more important: this service is responsible to route incoming commands to their respective handler classes which in turn execute functions on one or more business logic services. The payload of these commands are obviously not always the same... which is the main reason why we decided to use the lowest common denominator to be able to handle these various types and rendered all payloads as strings. This compromise bubbles now up in the REST API and the business logic layers (and actually everything in between).
Over the years we've also added additional features (e.g. idempotency guarantees for incoming write requests) that make it now very hard to reason about the execution flow. Testing the performance impact of such additions to the critical execution path even can't be properly measured. Note: the current implementation of idempotency relies on database lookups (quite often, for each incoming request) and none of those queries are cached. If we wanted to store already processed requests (IDs) in a faster system (let's Redis) then this can't be done without major refactoring.
In conclusion, if we really want to fix those issues that are not only cosmetic and affect the performance and the developer experience equally then we urgently need to fix the way how we process write requests aka commands.
Target Personas
- developers
- integrators
- end users
- BaaS
Goals
- new command processing will run independently next to the legacy mechanics
- self contained
- fully tested
- ensure that the REST API is 100% backward compatible
- try to contain the migration and make it as easy as possible for the community to integrate those changes
- introduce types where needed and migrate the (old) JAX-RS REST resource classes to Spring Web MVC (better performance and better testability)
- introduce DTOs if not already available and make sure if they exist that they are not outdated
- assemble one DTO as command payload from all incoming REST API parameters (headers, query/path paramters, request bodies)
- annotate attributes in the DTOs with Jakarta Validation annotations to enforce constraints on their values
- wired REST API to the new command processing, one service at a time/pull request
- take a non-critical service (like document management) and migrate it to the new command processing mechanics from top (REST API) to bottom (business logic service)
- refactor command handlers to new internal API
- make sure that the business service logic classes/functions take only one DTO request input parameter (aka don't let a function have 12 input parameters of type string...)
- when all integration tests run successfully then remove all legacy boilerplate code that is not used anymore
- make an ordered list of modules/features (easiest, lowest hanging fruit first)
- maintain at least the same performance as the current implementation
- optional: improve performance if it can be done in a reasonable time frame
- optional: improve resilience if it can be done in a reasonable time frame
Non-Goals
- current command processing will stay untouched, will run independently of new infrastructure
- don't try cleaning up the storage layer; that's a separate effort for later (type safe queries, query peformance, clean entity classes)
- maker-checker is tightly coupled in the current command processing implementation upstream; this is a separate concern for a separate proposal (domains: security, workflow)
- doesn't need to be optimized for speed immediately
- no changes in the integration tests
Proposed API Changes
Command Wrapper
Class contains some generic attributes like:
- username
- tenant ID
- timestamp
The actual payload (aka command input parameters) are defined as a generic parameter "payload". It is expected that the modules implement classes that introduce the payload types and inherit from the abstract command class.
Command Processing Service
Three performance levels are configurable via application.properties
- synchronously (required): this is pretty much as we do right now (use virtual threads optionally)
- asynchronously (optional): with executor service and completable futures (use virtual threads optionally)
- non-blocking (optional): high performance LMAX Disruptor non-blocking implementation
These different performance level implementations need to be absolute drop-in replacements (for each other). It is expected that more performant implementations need more testing due to increased complexity and possible unforeseen side effects (thread local variables, transactions). In case any problems show up we can always roll back to the required default implementation (synchronous).
NOTE: we should consider providing a command processing implementation based on Apache Camel once this concept is approved and we migrated already a couple of services. They are specialized for exactly this kind of use cases and have more dedicated people working on it's implementation. Could give more flexibility without us needing to maintain code.
Middlewares
TBD
Command Handlers
TBD
References to users (aka AppUser)
Keep things lightweight and only reference users by their user names.f
Risks
TBD
- feature creep
ETA
A first prototype of the a new command processing component is ready for evaluation. There is also an initial smoke test (JMH) available.
You can try it out with the following instructions (it's still in a private repository, but will be published soon as an official PR):
git clone git@github.com:vidakovic/fineract.git
cd fineract
git checkout feature/FINERACT-2169
./gradlew :fineract-command:build
./gradlew :fineract-command:jmh
Diagrams
TBD
Related Jira Tickets
[
Testing] Add unit tests for ApiParameterHelper in fineract-coreThere is currently no unit test coverage for the ApiParameterHelper utility class. I have implemented a new test suite using JUnit 5 to cover core methods like extractFieldsForResponseIfProvided.
Verification: Successfully ran locally with 1/1 tests passed (100% success rate)
[GSoC 2026] [POC] Standardize and Harden Transaction Idempotency for Savings and Loans
Goal: Standardize idempotency enforcement to prevent replay attacks in core financial modules. Implementation Strategy (Addressing James Dailey's feedback):
- Opt-In Architecture: New logic will be behind a Global Configuration flag. Default remains legacy behavior to ensure 100% backward compatibility.
- Phased Approach: Audit existing m_portfolio_command_source usage and bridge gaps in the Savings module first.
- Testing: Implementation of integration tests simulating network failures/retries.
Loan Origination POC
Note: GSOC applicants - this is a "draft concept". Do not work on your proposal until we kick off the process at Fineract for evaluating. We may significantly edit this concept or create new ones to replace it.
No one should work on this specific ticket unless assigned - the GSOC candidate we choose will be assigned this ticket.
For more information, you should be reviewing emails on this subject and following the Wiki pages.
https://lists.apache.org/list.html?dev@fineract.apache.org
https://cwiki.apache.org/confluence/display/FINERACT/GSOC+Program+at+Fineract
LOAN ORIGINATION CONTEXT
Fineract has some loan origination functionality but it is not robust enough for many operations. Several vendors, working with Fineract have created new Loan Origination plug ins.
There is also a major enhancement underway that would build out a full Loan Origination flow by supporting the backend needs of data storage for such LOS. See ticket https://issues.apache.org/jira/browse/FINERACT-2418 .
The GSOC student would be expected to propose something as a POC (proof of concept) that would either - use the developed Fienract backend solution, or build a new component outside of Fineract to create the flows that would demonstrate the LOS functionality.
That is, this is a moving target, and we would need different proposals from prospective candidates to explore the area of Loan Origination. This may require expertise in risk assessment, loan origination models and business acumen. There will not be much more explanation that this available. The student would be expected to be a self starter.
The mentor for this would need to be an expert at risk modeling, understand Loan Origination, and support a conceptual basis that may involve some things internal to Fineract and some processing elements outside of Fineract. Please comment below if you are an existing Fineract contributor with this expertise.
To try to illustrate: one possible GSOC Proposal archtype we could accept would be a survey of Loan Origination Models, their strengths and weaknesses and to identify commonalities for the community to focus on. This would thus be a Requirements exercise and may help identify future roadmap concepts. In this case, the code to be developed may just expose a few APIs into different screen flows. Thus, perhaps FIGMA flows (or similar) connecting to a set of APIs on the backend.
If those new LOS APIs are existing in June 2026 (ticket 2418 resolved), then those APIs are to be used. if they are NOT there in Fineract, then the student would be requested to create a fork and to implement the POC outside of the main Dev branch.
I welcome additions to this write up. jdailey
Create a new backend for front end component POC
Note: GSOC applicants - this is a "draft concept". Do not work on your proposal until we kick off the process at Fineract for evaluating. We may significantly edit this concept or create new ones to replace it.
No one should work on this specific ticket unless assigned - the GSOC candidate we choose will be assigned this ticket.
For more information, you should be reviewing emails on this subject and following the Wiki pages.
https://lists.apache.org/list.html?dev@fineract.apache.org
https://cwiki.apache.org/confluence/display/FINERACT/GSOC+Program+at+Fineract
Build a
simple self-service front end that talks to the Self-Service APIWe need a new, user-friendly front end app that connects to our Backend for Front end (Self-Service API component) This will be the “customer portal” experience where users can log in, see their accounts, and check recent activity. It should be straightforward, easy to use, and a good reference example for others to build on.
Functionality needed would include:
- Login
- Check balances
- Transfer between accounts owned by the same customer.
- Submit application for a new loan
Testing end to end required.
Solid UI design
Modern app framework
Documentation
Self-Service API Component that Connects to Apache Fineract
When the project removed self-service APIs in 2025, it did so understanding that we would need an outside component to make that connection as part of an overall solution.
This project is to create - as a Proof of Concept (POC) - a new dedicated Self-Service API component or service that integration with Fineract backend. It will need to expose APIs to consumer facing applications for typical activities like viewing account balances, transaction initiation, loan application, etc.
The idea is for GSOC candidates to propose a design and build the POC.
Minimal criteria include testing, authentication methodology, documentation.
Not included in this GSOC would be the end consumer APP, although that may be undertaken by another project and coordination would be needed.
BI connector and demonstration
Note: GSOC applicants - this is a "draft concept". Do not work on your proposal until we kick off the process at Fineract for evaluating. We may significantly edit this concept or create new ones to replace it.
No one should work on this specific ticket unless assigned - the GSOC candidate we choose will be assigned this ticket.
For more information, you should be reviewing emails on this subject and following the Wiki pages.
https://lists.apache.org/list.html?dev@fineract.apache.org
https://cwiki.apache.org/confluence/display/FINERACT/GSOC+Program+at+Fineract
Build a Self-Service API Component that Connects to Apache Fineract
When the project removed self-service APIs in 2025, it did so understanding that we would need an outside component to make that connection as part of an overall solution.
This project is to create - as a Proof of Concept (POC) - a new dedicated Self-Service API component or service that integration with Fineract backend. It will need to expose APIs to consumer facing applications for typical activities like viewing account balances, transaction initiation, loan application, etc.
The idea is for GSOC candidates to propose a design and build the POC.
Minimal criteria include testing, authentication methodology, documentation.
The idea is to create a connector and a demonstration of analytics that would consume and organize data from Fineract.
For example, create a way to pull data out of Fineract and make it easy to use in common analytics such as Power BI or Tableau or, better yet, an open source variant. The data should probably go to a Data Warehouse.
Start by proposing and exploring different options and write up the pros and cons.
Create a demonstration project that takes into account security, levels of access, and security of PII data if it existsNot included in this GSOC would be the end consumer APP, although that may be undertaken by another project and coordination would be needed.
BI connector and demonstration
[Testing] Add unit tests for ApiParameterHelper in fineract-core
There is currently no unit test coverage for the ApiParameterHelper utility class. I have implemented a new test suite using JUnit 5 to cover core methods like extractFieldsForResponseIfProvided.
Verification: Successfully ran locally with 1/1 tests passed (100% success rate)
Front end application MVP (POC)
Note: GSOC applicants - this is a "draft concept". Do
Note: GSOC applicants - this is a "draft concept". Donot work on your proposal until we kick off the process at Fineract for evaluating. We may significantly edit this concept or create new ones to replace it.
No one should work on this specific ticket unless assigned - the GSOC candidate we choose will be assigned this ticket.
For more information, you should be reviewing emails on this subject and following the Wiki pages.
https://lists.apache.org/list.html?dev@fineract.apache.org
https://cwiki.apache.org/confluence/display/FINERACT/GSOC+Program+at+Fineract
The idea is to create a connector and a demonstration of analytics that would consume and organize data from Fineract.
For example, create a way to pull data out of Fineract and make it easy to use in common analytics such as Power BI or Tableau or, better yet, an open source variant. The data should probably go to a Data Warehouse.
Start by proposing and exploring different options and write up the pros and cons.
Build a simple self-service front end that talks to the Self-Service API
We need a new, user-friendly front end app that connects to our Backend for Front end (Self-Service API component) This will be the “customer portal” experience where users can log in, see their accounts, and check recent activity. It should be straightforward, easy to use, and a good reference example for others to build on.
Functionality needed would include:
- Login
- Check balances
- Transfer between accounts owned by the same customer.
- Submit application for a new loan
Testing end to end required.
Solid UI design
Modern app framework
Documentation Create a demonstration project that takes into account security, levels of access, and security of PII data if it exists.
...
Apache Airflow Contribution & Verification Agent Skills
Background
Apache Airflow’s Breeze environment is the de facto way to reproduce CI, run tests, and verify changes locally. It encapsulates complex tooling (Docker, integrations, static checks, tests, system verification) behind a single, consistent developer interface.
However, modern AI coding tools (e.g. Claude Code, Gemini CLI, GitHub Copilot–style agents) currently treat Airflow’s repo like any generic Python project. They rarely:
- Understand whether they are running inside or outside Breeze.
- Choose the correct commands for host vs. container.
- Follow the same workflows that Airflow contributors actually use (e.g. prek, breeze shell, breeze start-airflow).
We already expose some information through docs (e.g. AGENTS.md), but this mostly inflates the context window rather than giving agents a structured, machine-usable interface to Breeze.
This project aims to bridge that gap by creating an “Airflow Breeze Contribution / Contribution Verification” AI skill (final name TBD) that systematically encodes common contribution workflows and makes them reliably executable and testable by AI agents.
Goal
The overarching goal is to make AI tools:
Breeze-aware: able to detect whether they are running inside or outside Breeze and act accordingly.
In practice, this means that for a typical contributor PR, an AI agent can:
- Run the right static checks.
- Run the right subset of tests in Breeze.
- Spin up Airflow and verify system behavior for a Dag representing the change (nice-to-have).
- Do all of the above while respecting host/container boundaries.
Additionally, the solution should be consistency-focused, meaning that we want to keep Breeze CLI as the single source of truth for agent skills. This can be achieved by auto-syncing CLI docstrings and behaviors into the AI skill using existing tooling (e.g. prek), ensuring that the skill definitions always reflect the current state of the Breeze CLI.
Core Tasks
1. Environment Awareness & Detection
- Design and implement a simple, robust mechanism for the agent skills to detect:
- “Host” vs “inside Breeze container”.
- Relevant environment variables, markers, or file paths that indicate context.
- Encode decision logic for when to run:
- Host-only commands (e.g. breeze shell, breeze start-airflow, git operations).
- Container-only commands (e.g. pytest, airflow ...).
- Provide a clear API/contract that AI tools can call to query current context and get recommended commands.
Note: Maybe we need to add some explicit markers, files in the repo, or write a small helper script that can be called to determine context in a reliable way. Or maybe we can rely on existing environment variables or filesystem cues. This is an open design question to explore.
2. Modeling Core Contributor Workflows as Skills
Based on the three scenarios described, define and implement skills that represent common contribution flows:
Scenario 1: Static checks pass
- Stage changes (git add ...).
- Run prek.
- Collect and surface failures in a structured way so that an agent can fix them.
Scenario 2: Unit tests in Breeze
- Start or attach to a Breeze container with breeze shell or breeze exec.
- Run pytest with a targeted module/test path (not the whole suite).
- Then the agent can inspect results and decide on next steps (e.g. fix code, exit Breeze).
3. Syncing with Breeze CLI as Source of Truth (via prek)
- Investigate existing Breeze CLI docstrings and structure.
- Define a mapping from Breeze commands (and their docstrings) to skill definitions, paths, and parameters.
- Implement a prek hook that:
- Generates or updates the agent skills definition files from Breeze CLI docstrings.
- Fails when drift is detected (e.g. a command changed but the skill spec was not updated).
- Integrate these checks into existing static check pipelines so the skills stay in sync automatically.
4. Evaluation & Test Harness
- Design a testable user scenario or “exam” that simulates a typical contribution workflow (e.g. fixing a simple bug, adding a small feature) to verify that the added skills work as intended.
- Add unit tests for any additional scripts or helper functions created.
5. Documentation & Developer Guide
- Add or extend documentation (e.g. AGENTS.md, Breeze docs) to:
- Describe the new Breeze-aware skills.
- Show example workflows for human contributors and AI tools.
- Document how other tools can integrate with the skills (e.g. path to spec file, key commands).
Advanced Tasks (Optional / Stretch Goals)
Scenario: System behavior verification
- Write a Dag representing the feature/bugfix being contributed (or use an existing one).
- Run breeze start-airflow (with --integration when needed).
- Trigger the Dag via CLI (instead of UI) and wait for completion.
- Inspect logs/status to determine success/failure from the TaskInstance logs.
- Inspect logs/status from all the component services (scheduler, api-server, triggerer, etc) to determine if there are any underlying issues.
- The agent can then decide to fix code, fix the Dag, or exit Breeze based on the results.
Expected Outcome
By the end of the project, we expect:
- A Breeze-aware AI skill that can:
- Detect host vs. container context.
- Choose appropriate commands and environment transitions.
- The AI toolings will be "smart-enough" to handle the core workflows for contributions, including:
- Static checks with prek.
- Targeted unit tests in Breeze.
- Continue iterating based on results (e.g. fix code, fix tests, exit).
- A sync mechanism (likely using prek) that:
- Keeps Breeze CLI and the skill definitions in sync.
- Fails CI when they diverge, ensuring Breeze remains the single source of truth.
- Initial evaluation “exam(s)” and test harnesses that:
- Verify that an implementation of the skill behaves correctly on at least the core scenarios.
- Updated documentation explaining how contributors and AI tools can make use of the new capability.
A successful project will make it much easier for future AI tooling (IDEs, CLIs, bots) to interact with Breeze in a reliable and Airflow-native way, increasing contributor productivity and lowering the barrier to entry.
Recommended Skills
- Programming & Tooling
- Solid Python skills (CLI tools, packaging, basic testing).
- Familiarity with Docker and containerized development environments.
- Experience with writing or using CLIs and handling subprocesses.
- Dev Workflow & CI
- Understanding of typical open source contribution workflows (git, PRs, static checks, unit tests, pre-commit).
- Exposure to CI systems and concepts of reproducible environments.
- AI/Agents
- Interest in or experience with AI coding assistants, Agent Skills, tool-calling, or agent frameworks.
- Comfort reasoning about what “smart enough” means in terms of concrete, testable behaviors.
- Airflow/Breeze (Nice to Have)
- Basic knowledge of Apache Airflow concepts (Dags, tasks, operators).
- Prior use of Breeze for development or testing is a plus, but not strictly required.
Motivation to work at the intersection of developer experience, tooling, and AI is more important than prior deep expertise in all of these areas.
Mentors
Jason Liu (GitHub: @jason810496, Slack: Zhe-You(Jason) Liu)Jarek Potiuk (GitHub: @potiuk, Slack: Jarek Potiuk)- #gsoc Slack Channel in Apache Airflow workspace: https://apache-airflow.slack.com/archives/CSC0FLNJF
Learning Materials
- Airflow Breeze documentation: https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst
- Recent Airflow Dev Mailing List discussion regarding Agent Skills/ Agents:
- Airflow prek (pre-commit) hooks entrypoint: https://github.com/apache/airflow/blob/main/.pre-commit-config.yaml
- Modern Python monorepo for Apache Airflow (by Jarek): https://medium.com/apache-airflow/modern-python-monorepo-for-apache-airflow-part-1-1fe84863e1e1
- pre-commit: https://pre-commit.com/
- prek: https://github.com/j178/prek
Tracked GitHub Issue
Apache HTTP Server
httpd server Improve a prototype of mod_h3 using openssl and nghttp3
OpenSSL 3.2+ brought native QUIC to the world’s most popular security library, yet integration into established web servers remains experimental. This project aims to stabilize the openssl-h3-examples repository and, crucially, advance the development of a prototype Apache httpd module (mod_h3). The work will focus on solving the architectural mismatch between Apache’s TCP-based workers and QUIC’s UDP-based streams, using OpenSSL and nghttp3.
Spark
SPIP Client-Side Metadata Caching for Spark Connect
This SPIP proposes adding a client-side schema cache for Spark Connect DataFrames.
Currently, every call to df.columns or df.schema triggers a synchronous gRPC analysis request to the server. While these are local and near-instant in Spark Classic, in Connect they average 277 ms on standard cloud setups (like AWS t3.medium). This makes iterative work extremely slow; we've measured a 13-second lag for 50 metadata calls in a typical ETL pipeline.
This delay is forcing developers to use a "Shadow Schema" pattern, where they manually track column names in local lists to avoid the RPC overhead. Since Spark DataFrames are immutable, we can fix this by caching the resolved schema on the client after the first request. Our POC shows this reduces the 13-second lag to about 250 ms (a 51× speedup) without breaking the core Spark Connect model.
I have followed the official SPIP template for the detailed breakdown below.
SIP
https://docs.google.com/document/d/1xTvL5YWnHu1jfXvjlKk2KeSv8JJC08dsD7mdbjjo9YE/edit?tab=t.0
Benchmark - https://docs.google.com/document/d/1ebX8CtTHN3Yf3AWxg7uttzaylxBLhEv-T94svhZg_uE/edit?tab=t.0