Corda's deserialisation engine expects to be able to inspect the annotations for classes it has been asked to instantiate, e.g. for @CordaSerializable. However, annotation classes inside the sandbox have all been rewritten to inherit from sandbox.java.lang.annotation.Annotation, which makes them meaningless. The JVM rejects them all by throwing an exception when trying to parse them .
The JVM defines an annotation as an interface class that extends java.lang.annotation.Annotation ONLY. Therefore the only solution is to add java.lang.annotation.Annotation to the DJVM's whitelist so that it is no longer mapped into the sandbox package-space.
We also need to preserve the annotations' meta-annotation values so that sandboxed annotations remain inheritable, visible at runtime etc.
Finally, Java allows annotations to declare methods with/without default values which the JVM needs to be able to handle outside of the sandbox. This is fine for methods returning native types and arrays, but fails for methods that return either String or Enum.