Misc cleanup

AGENTS.md

@@ -1,6 +1,6 @@
 # nomyo4J — Agent Instructions
 
-Java port of the NOMYO Python client. Hybrid encryption (RSA-4096 + AES-256-GCM) for secure API communication.
+Java 25 port of the NOMYO Python client. Hybrid encryption (RSA-4096 + AES-256-GCM) for secure API communication.
 
 ## Build & Run
 
@@ -16,27 +16,26 @@ mvn test -Dtest=ClassName   # single test class
 - **`SecureChatCompletion`** — high-level OpenAI-compatible surface (`create()`, `acreate()`)
 - **`Constants`** — all protocol/crypto constants (version, algorithms, timeouts)
 - **`SecureMemory`** — Java 25 FFM `SecureBuffer` for locked/zeroed memory
-- **`errors/`** — exception hierarchy, all `extends Exception` (checked)
+- **`errors/`** — 9 exception classes, all `extends Exception` (checked), all `extends APIError`
 - **`util/`** — `Pass2Key` (PBKDF2 + AES-GCM), `PEMConverter`, `Splitter`
+- **`EncryptedRequest`** — wire format model with Gson `@SerializedName` annotations
 
-## Critical: This is a partial/in-progress port
+## Stubbed methods (check before implementing)
 
-Many methods are stubbed with `UnsupportedOperationException`. Before implementing, check `TRANSLATION_REFERENCE.md` for the Python reference. Stubbed methods:
+- `SecureMemory.lock()` — always returns `false` (FFM doesn't support locking)
+- `SecureMemory.unlock()` — always returns `false`
+- `SecureMemory.initMemoryLocking()` — always returns `false`
 
-- `SecureCompletionClient.fetchServerPublicKey()` — GET `/pki/public_key`
-- `SecureCompletionClient.encryptPayload()` / `doEncrypt()` — hybrid encryption
-- `SecureCompletionClient.decryptResponse()` — response decryption
-- `SecureCompletionClient.sendSecureRequest()` (3 overloads) — full request lifecycle
-- `SecureCompletionClient.ensureKeys()` — key init (partial DCL implemented)
-- `SecureCompletionClient.close()` — resource cleanup
-- `SecureChatCompletion.create()` / `acreate()` — return `null`, stubbed
-- `SecureMemory` lock/unlock — always returns `false`
+## Dependencies
 
-**No JSON library** (Jackson/Gson) in `pom.xml` — needed for wire format serialization.
+- **Gson** (2.13.2) — JSON serialization, in `pom.xml`
+- **Lombok** (1.18.44, `provided` scope) — annotation processor configured in maven-compiler-plugin
+- **JUnit Jupiter** (5.12.1, `test` scope)
+- **Maven Surefire** (3.5.0)
 
 ## Key files
 
-- `TRANSLATION_REFERENCE.md` — **primary documentation**. Cross-language spec derived from Python reference. Read before implementing any method.
+- `TRANSLATION_REFERENCE.md` — **primary documentation**. Cross-language spec from Python reference. Read before implementing any method.
 - `client_keys/` — contains real RSA keys. **Gitignored.** Do not commit.
 - `Main.java` — entry point is `static void main()` — **not `public static void main(String[])`**. Cannot run standalone.
 
@@ -45,7 +44,12 @@ Many methods are stubbed with `UnsupportedOperationException`. Before implementi
 - Package: `ai.nomyo`
 - Lombok: `@Getter` on fields, `@Setter` on static flags
 - Tests: `@TestMethodOrder(OrderAnnotation.class)`, `@DisplayName` on every test
-- Error classes: checked exceptions with `status_code` and `error_details`
-- Key files: `PosixFilePermissions.OWNER_READ` only (mode 400)
-- RSA: 4096-bit, exponent 65537, OAEP-SHA256 padding
-- Protocol constants in `Constants.java` — marked "never change"
+- Error classes: checked exceptions with `statusCode` and `errorDetails` (immutable, via `Collections.unmodifiableMap`)
+- Key files: `PosixFilePermissions.fromString("rw-------")` for private, `"rw-r--r--"` for public
+- RSA: 4096-bit, exponent 65537, OAEP-SHA256 (MGF1 with SHA-256)
+- Protocol constants in `Constants.java` — marked "never change" (downgrade detection)
+- `SecureChatCompletion.acreate()` is a sync alias, not async — delegates to `create()`
+- Streaming is explicitly rejected with `IllegalArgumentException`
+- `SecureCompletionClient.ValueError` — inner class, maps to Python `ValueError`
+- Retry: 429/500/502/503/504 + network errors, exponential backoff 2^(attempt-1)s, default 2 retries
+- All HTTP endpoints use `application/octet-stream` content type for encrypted payloads