docs(events): point the Community over Code card at the Spring Boot 4 build

[adityamparikh]

The Community over Code 2026 hackathon card (published at https://adityamparikh.github.io/solr-mcp/) now points at a build of the Spring Boot 4.1 / Spring AI 2.0 line (#23), which also carries everything on main: ghcr.io/adityamparikh/solr-mcp:coc2026, the native :coc2026-native-stdio / :coc2026-native-http images, and the JAR on the fork's coc2026 release. This updates the card to describe what that build does.

Changes

• Tools: fifteen instead of twelve. The toolbox table gains list-aliases, create-alias and delete-alias, and the indexing rows describe the current inputs (JSON array, Solr's CSV handler, Solr update XML).
• Step 3:
  • The CSV, XML and Markdown samples come from main's src/test/resources rather than a feature branch.
  • CSV and XML are passed to Solr's own handlers, which report the payload accepted rather than a document count, so the expected result says that.
  • XML is Solr update XML, so its field names match JSON; the show_ prefix warning and the step 4 and step 6 notes about it are removed, and the Option B XML paste is converted to <add><doc><field name="…">.
  • Markdown is one multi-record file indexed in one call. Its description lives in content, which the step 6 dataset note now says.
• Step 4: fix(config): keep empty facet arrays as NamedList, not List #175 is in the image, so the ClassCastException branch is gone. An assistant that reads the schema first facets on platform_str, the copy schemaless mode makes, and gets real buckets; the note says so and gives the follow-up that shows the empty facet on platform itself.
• Step 6: the Markdown path gets its own phrase prompt naming content, where Markdown keeps the description.
• Native Docker images: pull commands for the prebuilt amd64 + arm64 images, ahead of the build-it-yourself commands.
• Native http security: Spring AOT fixes the security filter chain in the binary, so HTTP_SECURITY_ENABLED only takes effect at build time. The native http build commands now set it, and a note explains that without it every tool answers Access Denied until OAuth2 is configured. The prebuilt coc2026-native-http image is built with security off.
• Native builds panel: follows the Run via and Transport choices from step 0, like the rest of the card. JAR shows the JVM jar and the native binary, Docker shows the JVM and native images, and each shows only the stdio or http commands. The build-time security note appears only for http.
• Nothing reachable from the conference network: security is off for the hackathon, so every server the card starts now listens on localhost only.
  • The MCP server: -p 127.0.0.1:8080:8080 for Docker, SERVER_ADDRESS=127.0.0.1 for the JAR and the native binary (shell and PowerShell, including the secured Keycloak and Auth0 walkthroughs).
  • Solr, LGTM and Keycloak are published on 127.0.0.1. Solr had no authentication and Keycloak uses admin/admin.
  • On Linux, host.docker.internal:host-gateway cannot reach a loopback-only port, so step 1 creates a solr-mcp Docker network. Solr and LGTM join it, every Docker command and client config uses --network=solr-mcp instead of --add-host, and SOLR_URL and the OTLP URLs use container names. JAR users still use localhost.
• Observability panel:
  • Export goes over OTLP/HTTP on 4318, with one URL per signal (OTEL_TRACES_URL, OTEL_METRICS_URL, OTEL_LOGS_URL).
  • Span names are SearchService#search / CollectionService#checkHealth.
  • The request metric is http_server_requests_milliseconds_count.
  • JVM metrics arrive over OTLP; there is no /actuator/prometheus.
  • The LGTM image is pinned to 0.33.0, the version the tests use.
• Security panel: the protected resource metadata for /mcp is read from the RFC 9728 path-suffixed URL /.well-known/oauth-protected-resource/mcp; the root URL describes the host. A token that reaches the server but fails validation is now refused with HTTP 401, so the client shows the tools as missing; the Claude Code and Codex proof steps say so.
• Sizes and footer: 52 MB JAR, ~170 MB image, "Spring Boot 4.1.1, Spring AI 2.0.1".
• Table cards and slides: fifteen tools; ChatGPT added to the table card's client list.

Verification

Each step was replayed against the published :coc2026 image with fresh SolrCloud containers. Results:

Area	Result
All four formats, steps 3–7	Every count on the card holds (61 indexed; Netflix 20; 2020+ 31; comedies 15; Ended 33 / Ongoing 28; 2015+ rated 8+ 39; Pedro Pascal 3; top five as listed), apart from the Markdown phrase query noted above
Option B pastes	Index 12 / 12 / 12 / 3 documents
Observability panel	Run against grafana/otel-lgtm:0.33.0: tool spans, the correlated WARN line in Loki, and the request and JVM metrics in Prometheus all appear
Security panel	Run against Keycloak 26: tokens without the /mcp audience are rejected with 401, and the card's two curl lines return Access Denied and the collection list
Table card	Prints on one A5 page
Localhost binding	With the published images: Solr, Grafana, OTLP and the MCP server answer on localhost and not on the LAN IP (the old -p 8080:8080 did answer there). Over the solr-mcp network the stdio and http MCP containers reach Solr by name (list-collections) and traces reach LGTM by name. The JVM jar listens on 127.0.0.1 with SERVER_ADDRESS, and the native binary honours it at run time
Codex CLI, steps 2–7	Jar, JVM image, native binary and native image over stdio; jar, JVM image and native binary over http; CSV, XML and Markdown on the jar; secured HTTP with a Keycloak bearer token. Every card result came back, with the step 4 and step 6 notes above. The native image over http hit the Codex usage limit after step 2, so it was replayed with the same tool calls directly over HTTP, with the same results

🤖 Generated with Claude Code