Add missing @Override annotations flagged by CodeQL

[vharseko]

Closes the remaining 1320 open java/missing-override-annotation CodeQL alerts on master — the last large note-severity category from the ongoing CodeQL cleanup series (#122, #123, #126, #128, #130–#134).

Change

Every location CodeQL's java/missing-override-annotation flagged gets an @Override line inserted immediately above the method signature, at the same indentation, at the exact line the alert points to. 225 files, purely additive (+1488 / −0):

• 1320 @Override insertions;
• 164 Portions Copyrighted 2026 3A Systems, LLC header lines: 162 appended to an existing header, and 2 in a new /* */ block for files that had no header at all (AttributeMappingConfig, ContainsQuery). The other 61 files already carried a 3A line covering 2026, so their headers are left alone.

No other code changes: no renames, no logic touched, no reordering.

Verification

@Override is compiler-checked — javac fails hard when it is placed on a method that does not actually override or implement anything from a supertype ("method does not override a method from its superclass"). Rather than review 1320 insertions by hand, the real proof is a clean build: the entire reactor was built from the root pom.xml (mvn install, all 28 modules) after the insertions, with no manual fixes needed afterward.

Result on the original head: BUILD SUCCESS, all 28 modules, 1442 tests, 0 failures, 0 errors (164 skipped, same skips as on master) — including connector-framework-internal (469 tests) and ldap-connector with its embedded OpenDJ (159 tests). Also spot-checked ~30 random insertions by hand across different files and annotation styles (interface method declarations, anonymous inner classes, nested static classes) before the build, all correctly placed. After the rebase below, the whole reactor was rebuilt (mvn install -DskipTests, main and test sources) and build.yml runs on the new head.

Rebase onto master

The branch was rebased onto master at c7648cf. Two files conflicted with PRs merged in the meantime:

• RemoteFrameworkConnectionInfoConverter (Verify the connector server certificate against the host over the legacy SSL connection #122): Verify the connector server certificate against the host over the legacy SSL connection #122 had already added its own 3A header line and replaced the anonymous X509TrustManager with an X509ExtendedTrustManager whose seven methods are annotated. Master's side is kept for both hunks; this PR now only adds @Override to enableLogging, canConvert and fromConfiguration.
• RemoteRequest ([#124] Create the RemoteRequest promise at construction so an unsent request can be cancelled #127): [#124] Create the RemoteRequest promise at construction so an unsent request can be cancelled #127 rewrote the anonymous classes and already annotates all four methods, so the file is taken from master unchanged and drops out of this PR.

In six files — the converter above plus EncryptorImpl, LocalConnectorInfoManagerImpl, RemoteFrameworkConnection, CCLWatchThreadFactory and ConnectionManager — other PRs of the series had already added a 3A header line; that line now comes from master, and no file carries two 3A lines.

The remaining open PRs of the series may still touch files changed here; whichever merges second needs a rebase.

[maximthomas]

praise: Every insertion is compiler-checked, and the full build matrix confirms it.

• The diff adds 1327 @Override lines in 226 src/main files and removes none. All 9 build-maven jobs (JDK 11–26 on Ubuntu, macOS and Windows) and Analyze (java-kotlin) are green.
• Code scanning reports 0 open java/missing-override-annotation alerts on refs/pull/136/merge. Master still has 1324.

---

issue (blocking): The PR conflicts with #122, already on master, in RemoteFrameworkConnectionInfoConverter.java, so it cannot be merged as is.

OpenICF-maven-plugin/src/main/java/org/forgerock/openicf/maven/RemoteFrameworkConnectionInfoConverter.java:23, :141

#122 rewrote both spots this PR touches. It added its own Portions Copyright 2026 3A Systems, LLC. header line, and it replaced new X509TrustManager() { with new X509ExtendedTrustManager() {, with all seven methods already annotated. A trial merge (git merge-tree --write-tree origin/master b62137f) produces one content conflict, in this file only, and GitHub reports the PR as CONFLICTING. The description says this PR "never touches the same line another PR modifies", and its overlap list leaves out #122. The green CI ran on a merge ref without #122, so the resolved file has not been built yet. Taking the PR side of the second hunk does not compile, because master dropped the X509TrustManager import. Keeping both header sides leaves two 3A copyright lines.

Rebase onto master and take master's side of both hunks. The three @Override lines this PR adds at :56, :63 and :70 merge cleanly and stay. Then let build.yml run on the rebased head.

 *
 * Portions Copyright 2026 3A Systems, LLC.
 */
...
    protected List<TrustManager> getTrustManager() {
        return Arrays.asList((TrustManager) new X509ExtendedTrustManager() {

---

note (non-blocking): The description does not match the diff in two places.

• Header lines: the description counts 220 + 6 header changes, but the diff adds 170 header lines, in 170 files.
• AesGcmEncryptor is named as a touched file, but it exists only on master. The diff touches EncryptorImpl instead. The branch is cut from fc18556, five commits behind current origin/master.

[vharseko]

Rebased onto current master (c7648cf). There were two conflicts, not one: besides RemoteFrameworkConnectionInfoConverter (#122), RemoteRequest conflicted with #127, which rewrote the anonymous classes and already annotates all four methods.

• RemoteFrameworkConnectionInfoConverter: took master's side of both hunks (its 3A header line and X509ExtendedTrustManager). The three @Override lines at enableLogging, canConvert and fromConfiguration stay; the file carries one 3A line.
• RemoteRequest: taken from master unchanged, so it drops out of the PR.

The rebased diff is 225 files, +1488 / −0: 1320 @Override lines, which matches the 1320 open java/missing-override-annotation alerts on master, plus 164 header lines. The whole reactor was rebuilt locally (mvn install -DskipTests, main and test sources), and build.yml runs on the new head.

The description is corrected: 164 header lines (162 appended to existing headers, 2 in new comment blocks in AttributeMappingConfig and ContainsQuery; the other 61 files already carry a 3A line covering 2026), EncryptorImpl instead of AesGcmEncryptor, #122 and #127 named as the conflicting PRs, and the "never touches the same line" claim dropped.

[maximthomas]

praise: The insertions match the alert set exactly, and the rebase resolved both conflicts to master's side.

• The 1320 inserted @Override lines join 1:1, by path and base line, with the 1320 open java/missing-override-annotation alerts on master at c7648cfd. No alert or insertion is left unmatched, 225 files are touched and 0 lines are removed.
• RemoteFrameworkConnectionInfoConverter keeps the X509ExtendedTrustManager from #122, and RemoteRequest (#127) drops out of the PR. The PR now merges cleanly (MERGEABLE / CLEAN), and Build is green on d842bfb across all 9 matrix jobs.

[vharseko]

Rebased onto current master (88760f1, after #133 and #134) to clear the merge conflicts.

Conflicts, resolved hunk by hunk:

• CSVFileConnector.java — license header: kept master's Portions Copyrighted 2026 3A Systems, LLC line instead of adding a second one.
• BatchApiOpImpl.java — CompletionListener.start(): kept master's synchronized; this PR's @Override above it is unchanged.

Compared with the previous head (d842bfb) via git range-diff, the only lines that dropped out of the diff are ones master already has: 8 header lines in the form above and the @Override on start(). All other @Override additions are unchanged (1479 insertions over 225 files, previously 1488). The whole reactor compiles with test sources (mvn test-compile -DskipTests).