This is a very good example of where it doesn't really matter from which platform the defined specification is maintained because a developer chooses a mix of ingredients for his app that happen to come from platform one, or platform two.
Correct, up till so far the APIs from both platform one and two agree to totally support each other. Meaning that e.g. Config is usable for all specs, and, say, the "Security Backbone" is used throughout all security specs. If I pic JWT as my authentication mechanism, and if I then define an additional identity store, it should be used. It should also be clear that if an app happens to define an authentication mechanism in web.xml and define JWT as the authentication mechanism what happens.
