diff --git a/CLAUDE.md b/CLAUDE.md index 6f287d7..4da0de0 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -9,7 +9,7 @@ four Java projects: - [BitcoinAddressFinder](https://github.com/bernardladenthin/BitcoinAddressFinder) — Bitcoin/altcoin private-key scanner (`net.ladenthin:bitcoinaddressfinder`) - [java-llama.cpp](https://github.com/bernardladenthin/java-llama.cpp) — JNI bindings to llama.cpp (`net.ladenthin:llama`) -- [llamacpp-ai-index-maven-plugin](https://github.com/bernardladenthin/llamacpp-ai-index-maven-plugin) — Maven plugin generating AI summaries (`net.ladenthin:llamacpp-ai-index-maven-plugin`) +- [srcmorph](https://github.com/bernardladenthin/srcmorph) — prompt-driven source-tree transformer / AI-index generator, a 3-module reactor (`net.ladenthin:srcmorph` core + `srcmorph-cli` + `srcmorph-maven-plugin`; formerly `llamacpp-ai-index-maven-plugin`) - [streambuffer](https://github.com/bernardladenthin/streambuffer) — `OutputStream`/`InputStream` bridge over a dynamic FIFO (`net.ladenthin:streambuffer`) This repo carries **no production code and no build system** of its @@ -43,7 +43,7 @@ crossrepostatus.md Live cross-repo status table ## Java version tier — important -The canonical guides assume **Java 8 + JUnit Jupiter 6.1.0 + Hamcrest 3.0** +The canonical guides assume **Java 8 + JUnit Jupiter 6.1.2 + Hamcrest 3.0** because that is the lowest common denominator across the four sibling repos: @@ -51,7 +51,7 @@ repos: |---|---|---| | `streambuffer` | Java 8 | `pom.xml` `${java.version}` | | `java-llama.cpp` | Java 8 | `pom.xml` `8` | -| `llamacpp-ai-index-maven-plugin` | Java 8 | `pom.xml` `8` | +| `srcmorph` (formerly `llamacpp-ai-index-maven-plugin`) | Java 8 | `pom.xml` `8` | | `BitcoinAddressFinder` | Java 21 | `pom.xml` `21/21` | BAF additionally follows the @@ -71,7 +71,7 @@ from the lowest applicable version up to the highest one your repo's BAF and streambuffer are hand-written by the owner and are the authoritative style references. `java-llama.cpp` and -`llamacpp-ai-index-maven-plugin` are predominantly AI-generated; +`srcmorph` are predominantly AI-generated; their patterns are useful as data points but should NOT be treated as canonical when they conflict with BAF/sb. diff --git a/crossrepostatus.md b/crossrepostatus.md index cd3cf8e..1d119ce 100644 --- a/crossrepostatus.md +++ b/crossrepostatus.md @@ -4,7 +4,7 @@ This file tracks **only items that span ≥ 2 of the four sibling repos**. Singl - [`../BitcoinAddressFinder/TODO.md`](../BitcoinAddressFinder/TODO.md) - [`../java-llama.cpp/TODO.md`](../java-llama.cpp/TODO.md) -- [`../llamacpp-ai-index-maven-plugin/TODO.md`](../llamacpp-ai-index-maven-plugin/TODO.md) +- [`../srcmorph/TODO.md`](../srcmorph/TODO.md) - [`../streambuffer/TODO.md`](../streambuffer/TODO.md) Recurring per-repo audits (mostly cross-repo by nature but living per-repo today) are documented in [`policies/code-quality-todos.md`](policies/code-quality-todos.md). @@ -12,9 +12,14 @@ Recurring per-repo audits (mostly cross-repo by nature but living per-repo today Repos: - **BAF** = `/home/user/BitcoinAddressFinder` - **jllama** = `/home/user/java-llama.cpp` -- **plugin** = `/home/user/llamacpp-ai-index-maven-plugin` +- **plugin** = `/home/user/srcmorph` (repo renamed `llamacpp-ai-index-maven-plugin` → **srcmorph**, now a 3-module reactor; the `plugin` shorthand is kept here for continuity with the historical rows below) - **sb** = `/home/user/streambuffer` +> **Scope note:** the parity/history tables below track the **four sibling library repos** +> (BAF, jllama, srcmorph, sb). The **do-not-bump registry** under "Dependency / plugin +> freshness" additionally covers **BroomCabinet** pins, because a cross-repo dependency audit +> needs one reference for every deliberate pin regardless of which repo owns it. + Legend: ✅ done · 🚧 in progress · ❌ open · ➖ N/A · 📌 standing policy **Badge resources:** [inttter/md-badges](https://github.com/inttter/md-badges?tab=readme-ov-file) — searchable index of badge syntax for shields.io, Simple Icons, and more (used across all four repo READMEs). @@ -27,10 +32,10 @@ Legend: ✅ done · 🚧 in progress · ❌ open · ➖ N/A · 📌 standing pol |---|---| | Error Prone `-Xep::ERROR` promotions | Identical 13-pattern set in all 4 poms | | NullAway `-XepOpt` options | Identical 6 standard options (`CheckOptionalEmptiness`, `AcknowledgeRestrictiveAnnotations`, `AcknowledgeAndroidRecent`, `AssertsEnabled`, `OnlyNullMarked`, strict JSpecify). Plugin additionally has `ExcludedFieldAnnotations=…@Parameter,@Component` — correct repo-local exception for Mojo POJOs. | -| Tool versions | Identical across all 4: Checker 4.2.1, fb-contrib 7.7.4, findsecbugs 1.14.0, spotbugs 4.10.2.0, spotless 3.8.0, palantir 2.94.0, errorprone 2.50.0, nullaway 0.13.7, surefire 3.5.6, archunit 1.4.2, junit-jupiter 6.1.1, hamcrest 3.0, pitest-maven 1.25.6 (pitest-junit5-plugin 1.2.3). **All on latest stable** (pitest bumped 1.25.5→1.25.6 and the row refreshed to the actual pom values; verified 2026-07-08 against Maven Central — see "Dependency / plugin freshness" below). | +| Tool versions | Identical across all 4: Checker 4.2.1, fb-contrib 7.7.4, findsecbugs 1.14.0, spotbugs 4.10.3.0, spotless 3.9.0, palantir 2.96.0, errorprone 2.50.0, nullaway 0.13.8, surefire 3.5.6, archunit 1.4.2, junit-jupiter 6.1.2, hamcrest 3.0, pitest-maven 1.25.8 (pitest-junit5-plugin 1.2.3). **All on latest stable** — this row is the **canonical cross-repo tool-version matrix** (the policy files point here rather than re-pinning). Verified 2026-07-29 against the poms + Maven Central; see "Dependency / plugin freshness" below. | | Maven Enforcer `bannedDependencies` | Identical 7-entry list | | `true` javac arg | All 4 ✅ | -| PIT `100` | All 4 wired at a 100% gate. Scope expanded 2026-06-07 from the original single-class staging: **sb** whole-package (179 mutations) · **jllama** `value.*`+`exception.*`+`args.*`+`json.TimingsLogger`+`json.RerankResponseParser`+`json.ChatResponseParser`+`json.CompletionResponseParser` (243 mutations as of 2026-06-25; **not fully hermetic — see "Deliberate non-parity" below**) · **plugin** explicit 21-class list (146 mutations) · **BAF** explicit 16-class list (65 mutations). All previously pointed at one class; jllama's/BAF's were silently matching nothing after the package restructure (`llama.Pair`→`value.Pair`, `bitcoinaddressfinder.BitHelper`→`util.BitHelper`) — fixed. Canonical command + the `@{argLine}`/jacoco invocation rule live in [`policies/pit-mutation-testing.md`](policies/pit-mutation-testing.md). | +| PIT `100` | All 4 wired at a 100% gate. Scope expanded 2026-06-07 from the original single-class staging: **sb** whole-package (179 mutations) · **jllama** `value.*`+`exception.*`+`args.*`+`json.TimingsLogger`+`json.RerankResponseParser`+`json.ChatResponseParser`+`json.CompletionResponseParser` (243 mutations as of 2026-06-25; **not fully hermetic — see "Deliberate non-parity" below**) · **srcmorph** (reactor core module) explicit 47-class list · **BAF** explicit 16-class list (65 mutations). All previously pointed at one class; jllama's/BAF's were silently matching nothing after the package restructure (`llama.Pair`→`value.Pair`, `bitcoinaddressfinder.BitHelper`→`util.BitHelper`) — fixed. Canonical command + the `@{argLine}`/jacoco invocation rule live in [`policies/pit-mutation-testing.md`](policies/pit-mutation-testing.md). | | Checker Framework as 2nd nullness pass | All 4 ✅ | | JPMS `module-info.java` present | All 4 ✅ | | ArchUnit standard set (`noSystemExit` / `noNewRandom` / `Thread.sleep` / sun-com.sun-jdk.internal bans / public-fields-final / `noTestFrameworksInProduction` / `noPackageCycles`) | All 4 ✅ | @@ -338,16 +343,49 @@ local gates (spotless, spotbugs, pitest). Per-repo scope: documented in [`policies/lombok-config.md`](policies/lombok-config.md) so Sonar ignores synthetic getters/`equals`/`toString`. -### Dependency / plugin freshness (verified 2026-06-07, re-verified 2026-07-08) +### Dependency / plugin freshness (verified 2026-06-07, re-verified 2026-07-08, re-verified 2026-07-29) All four repos are on the **newest stable** versions of every dependency and build plugin (checked with `versions:display-dependency-updates` + `display-plugin-updates` against Maven Central, and direct `maven-metadata.xml` probes for the annotation-processor paths the versions plugin does not scan: Error Prone, NullAway, Checker). The only "updates" offered are **pre-releases** — Maven 4 plugin `4.0.0-beta-*` (compiler/jar/source/resources/plugin), -`maven-surefire-plugin:3.6.0-M1`, `slf4j-api:2.1.0-alpha1`, Maven-core `4.0.0-rc-5` — which are -deliberately **not** adopted, plus **jqwik 1.10.1** which is 📌 **banned** (see policy). No -action needed. +`maven-surefire-plugin:3.6.0-M1`, `slf4j-api:2.1.0-alpha1`, `protobuf-javalite:4.36.0-RC1`, +`kotlin:2.4.20-Beta2`, Maven-core `4.0.0-rc-5` — which are deliberately **not** adopted, plus +**jqwik 1.10.1** which is 📌 **banned** (see policy). No action needed. + +**2026-07-29 audit (branch `claude/dependency-updates-audit-vv4mz5`):** full sweep of all +sibling repos **plus** BroomCabinet (15 Maven modules) and the GitHub Actions / Gradle-Android +surface. Result: everything is on latest stable; nothing bumped. Two doc-sync fixes only — +the tool-version matrix above had drifted (spotbugs `4.10.2.0→4.10.3.0`, spotless +`3.8.0→3.9.0`, palantir `2.94.0→2.96.0`, nullaway `0.13.7→0.13.8`, junit-jupiter `6.1.1→6.1.2`, +pitest-maven `1.25.6→1.25.8` — the repos were already ahead of the doc) and the two policy +files that re-pinned those numbers now point at the matrix instead. **GitHub Actions:** every +`uses:` pin across all repos is at its latest release (floating `@vN` majors + version-pinned +ones alike — checkout v7, setup-java v5, upload-artifact v7, download-artifact v8, cache v6, +codeql v4, codecov v7, scorecard 2.4.4, osv-scanner 2.3.8, Jimver/cuda-toolkit 0.2.35, +jakoch/install-vulkan-sdk 1.6.0, reuse v6, gradle/actions v6, android-emulator-runner v2, +action-gh-release v3). **Gradle/Android (jllama):** Gradle 9.6.1 (latest stable; 9.7 is +pre-release), AGP 9.3.0, Compose BOM 2026.06.01, kotlinx-coroutines 1.11.0, kotlin 2.4.10 — all +current/deliberately pinned. + +#### Pinned dependencies — do-not-bump registry (cross-repo audit reference) + +The single place a dependency audit should consult before "upgrading" any of these. The +**detailed rationale stays in the one repo that owns each pin** (this table only registers it so +a cross-repo sweep does not mistake a deliberate pin for a stale dependency). "Newer available" += what `versions:display-*` offers and why it is rejected. + +| Pinned dep | Version | Repos | Newer available | Why pinned — authoritative source | +|---|---|---|---|---| +| `net.jqwik:jqwik` | 1.9.3 | BAF, jllama, srcmorph | 1.10.1 | 📌 prompt-injection incident — [`policies/jqwik-prompt-injection.md`](policies/jqwik-prompt-injection.md) | +| `com.h2database:h2` | 2.2.224 | BroomCabinet (`JOracleRowSetGetRowBug`) | 2.4.240 | **Last Java-8-compatible line** (2.3.x+ needs Java 11); module is `8`. Rationale in that module's `pom.xml` comment. | +| `com.oracle.database.jdbc:ojdbc8` | 21.21.0.0 | BroomCabinet (`JOracleRowSetGetRowBug`) | 23.26.3.0.0 | The `oracle.jdbc.rowset.OracleCachedRowSet` class the bug reproducer needs exists **only in the 19.x/21.x ojdbc8 lines — Oracle removed the package in 23.x**. Rationale in that module's `pom.xml` comment + `BUG.md`. | +| `org.bouncycastle:bcprov-jdk15to18` | 1.85.1 | BAF | (transitive) | Pins the bitcoinj-transitive bcprov to patch GHSA-c3fc-8qff-9hwx / GHSA-p93r-85wp-75v3. Rationale in BAF `CLAUDE.md` deps table. | +| `com.google.protobuf:protobuf-javalite` | 4.35.1 | BAF | 4.36.0-RC1 | Latest **stable**; newer is RC only. | +| `org.slf4j:slf4j-api` | 2.0.18 | all | 2.1.0-alpha1 | Latest **stable**; newer is alpha only. | +| `org.jetbrains.kotlin` | 2.4.10 | jllama (`llama-kotlin`) | 2.4.20-Beta2 | Latest **stable**; newer is beta only. | +| Maven-4 plugin line / surefire `3.6.0-M1` | — | all | `4.0.0-beta-*` / `-M1` | Maven-3 toolchain; Maven-4 betas + milestones deliberately not adopted. | **2026-07-08 bump round (branch `claude/build-timeout-config-nzli8l`):** pitest-maven 1.25.5→1.25.6 (all 4; every 100% gate re-run green on the new version — sb 179/179 @@ -565,7 +603,7 @@ Central". Commits — **jllama** `52ca3af` · **BAF** `a111584` · **sb** `6bb98 **Standing policy:** DO NOT UPGRADE jqwik past 1.9.3 — 📌 active in all 4 repos (see [`policies/jqwik-prompt-injection.md`](policies/jqwik-prompt-injection.md)). -**Standing policy:** run `mvn spotless:apply` before every commit that touches `.java` — 📌 active in all 4 repos (Spotless 3.7.0 + Palantir Java Format 2.92.0; `spotless:check` is bound to `verify` and the early `code-style` CI job. See [`policies/spotless-formatting.md`](policies/spotless-formatting.md)). +**Standing policy:** run `mvn spotless:apply` before every commit that touches `.java` — 📌 active in all 4 repos (versions in the canonical tool matrix above; `spotless:check` is bound to `verify` and the early `code-style` CI job. See [`policies/spotless-formatting.md`](policies/spotless-formatting.md)). --- diff --git a/guides/src/CODE_WRITING_GUIDE-21.md b/guides/src/CODE_WRITING_GUIDE-21.md index 5c10cb6..6b3139a 100644 --- a/guides/src/CODE_WRITING_GUIDE-21.md +++ b/guides/src/CODE_WRITING_GUIDE-21.md @@ -14,7 +14,7 @@ > `16` or later (records require Java 16+). Today > only `BitcoinAddressFinder` (`21/21`) > qualifies. `streambuffer`, `java-llama.cpp`, and -> `llamacpp-ai-index-maven-plugin` target Java 8 (`8`) +> `srcmorph` target Java 8 (`8`) > and MUST NOT use the idioms below. > > **When BAF upgrades to a newer LTS** (Java 25 / 29 / ...): add diff --git a/guides/src/CODE_WRITING_GUIDE-8.md b/guides/src/CODE_WRITING_GUIDE-8.md index dce0912..54deeda 100644 --- a/guides/src/CODE_WRITING_GUIDE-8.md +++ b/guides/src/CODE_WRITING_GUIDE-8.md @@ -18,7 +18,7 @@ > > **This file (Java 8 baseline):** applies to every sibling Java repo > (`BitcoinAddressFinder`, `java-llama.cpp`, -> `llamacpp-ai-index-maven-plugin`, `streambuffer`). Three of the four +> `srcmorph`, `streambuffer`). Three of the four > build to Java 8 bytecode (`8` in `pom.xml`); BAF > targets Java 21 but still follows everything below. > @@ -237,7 +237,7 @@ intent to readers and to static-analysis tools. applying it, check whether constructor injection, behaviour extraction, or making the observable property a public method achieves the same goal without widening visibility. See -[`../policies/code-quality-todos.md`](../policies/code-quality-todos.md) +[`../../policies/code-quality-todos.md`](../../policies/code-quality-todos.md) for the design-fit review. Verified in BAF: 16 sites across 5 production files. The other three diff --git a/guides/test/TEST_WRITING_GUIDE-8.md b/guides/test/TEST_WRITING_GUIDE-8.md index 7b6743f..00efe67 100644 --- a/guides/test/TEST_WRITING_GUIDE-8.md +++ b/guides/test/TEST_WRITING_GUIDE-8.md @@ -59,7 +59,7 @@ REUSE-tool compliance is enforced in CI in every repo. | Concern | Choice | |---|---| -| Runner | JUnit Jupiter 6.1.0 (`org.junit.jupiter.api.*`) | +| Runner | JUnit Jupiter 6.1.2 (`org.junit.jupiter.api.*`) | | Assertions | Hamcrest 3.0 (`assertThat(actual, is(equalTo(expected)))`) | | Parameterized | `@ParameterizedTest` + `@MethodSource(SourceClass.CONSTANT_NAME)` | | Mocking | Mockito (BAF, plugin) | diff --git a/policies/jpms-module-descriptor.md b/policies/jpms-module-descriptor.md index 4458710..b9ab56b 100644 --- a/policies/jpms-module-descriptor.md +++ b/policies/jpms-module-descriptor.md @@ -14,7 +14,7 @@ publish-snapshot") and the comments on BAF's `attach-javadocs` / `module-info-co |---|:--:|---|---|:--:|---| | streambuffer | 8 | `src/main/java` (excluded from default-compile) | `compile`, release 9 | 8 | classpath | | java-llama.cpp | 8 | `src/main/java` (excluded) | `compile`, release 9 | 1.8 | classpath | -| llamacpp-ai-index-maven-plugin | 8 | `src/main/java` (excluded) | `compile`, release 9 | 8 | classpath | +| srcmorph | 8 | `src/main/java` (excluded) | `compile`, release 9 | 8 | classpath | | BitcoinAddressFinder | 21 | `src/main/java9` | `prepare-package`, release 9 | 21 | classpath (forced) | Why a separate execution at all: a Java-8 main compile (`release 8`) literally cannot compile a diff --git a/policies/lombok-config.md b/policies/lombok-config.md index ca4fca3..f6a928d 100644 --- a/policies/lombok-config.md +++ b/policies/lombok-config.md @@ -12,7 +12,7 @@ Three sibling repos use Lombok today and therefore carry `lombok.config`: |---|---|---| | `BitcoinAddressFinder` | Java 21 | `@Data` / `@Value` / `@Getter` on configuration POJOs | | `java-llama.cpp` | Java 8 | `@EqualsAndHashCode` / `@ToString` on value classes | -| `llamacpp-ai-index-maven-plugin` | Java 8 | `@Getter` on Mojo `@Parameter` POJOs | +| `srcmorph` | Java 8 | `@Getter` on Mojo `@Parameter` POJOs | `streambuffer` does **not** use Lombok (no `lombok.config`, no Lombok dependency) and is out of scope. diff --git a/policies/pit-mutation-testing.md b/policies/pit-mutation-testing.md index a61fec6..9019766 100644 --- a/policies/pit-mutation-testing.md +++ b/policies/pit-mutation-testing.md @@ -47,7 +47,7 @@ flag keeps the run clean on hosts without the LMDB native lib). | Setting | Value | |---|---| -| `pitest-maven` | **1.25.6** | +| `pitest-maven` | **1.25.8** (canonical pin: the tool matrix in [`../crossrepostatus.md`](../crossrepostatus.md)) | | `pitest-junit5-plugin` | **1.2.3** | | `` | **100** (CI-enforced gate) | | `` | **30000** | @@ -67,13 +67,19 @@ passes. This divergence is deliberate. |---|---|---|---| | streambuffer | whole package `net.ladenthin.streambuffer.*` | 179 | yes | | BitcoinAddressFinder | explicit 16-class list (util/model/io/core/keyproducer/secret/configuration/statistics leaves + custom exceptions) | 65 | yes | -| llamacpp-ai-index-maven-plugin | explicit 21-class list (config / document / prompt / provider / support) | 146 | yes | +| srcmorph (reactor `srcmorph` core module) | explicit 47-class list (config / document / engine / indexer / prompt / provider / support) | see `srcmorph/pom.xml`† | yes | | java-llama.cpp | `value.*` + `exception.*` + `args.*` + `json.{TimingsLogger,RerankResponseParser,ChatResponseParser,CompletionResponseParser}` | 243 | **no — see §4** | \* Mutation counts verified 2026-06-25 (`pitest-maven 1.25.5`); all four gates -re-run green 2026-07-08 on `pitest-maven 1.25.6`. Counts drift as -code changes — treat them as a snapshot, not a contract; the **100% gate** is the -contract. +re-run green 2026-07-08 on `pitest-maven 1.25.6`. The pin has since bumped to +`1.25.8` (current). Counts drift as code changes — treat them as a snapshot, not a +contract; the **100% gate** is the contract. + +† srcmorph became a 3-module reactor (rename from `llamacpp-ai-index-maven-plugin`); its +PIT gate now targets the framework-free **`srcmorph` core module** (47 classes, `mutationThreshold` +100), authoritative list in `srcmorph/pom.xml`. The `srcmorph-cli` / `srcmorph-maven-plugin` +modules are not PIT-gated yet. The exact mutation total for the 47-class set has not been +re-recorded here — the 100% gate is the contract. ## 4. Hermeticity caveat — java-llama.cpp audio path diff --git a/policies/spotless-formatting.md b/policies/spotless-formatting.md index c52f5f9..4d54d4b 100644 --- a/policies/spotless-formatting.md +++ b/policies/spotless-formatting.md @@ -6,8 +6,10 @@ All four sibling repos enforce Java code formatting with the Spotless Maven plugin (`com.diffplug.spotless:spotless-maven-plugin`) configured for **Palantir Java Format** (plus `removeUnusedImports`, `trimTrailingWhitespace`, -`endWithNewline`). The versions are identical everywhere and managed in each -`pom.xml`: Spotless **3.7.0** + Palantir Java Format **2.92.0**. +`endWithNewline`). The Spotless + Palantir-Java-Format versions are identical everywhere and +managed in each `pom.xml`; the pinned values live in the **canonical cross-repo tool-version +matrix** in [`../crossrepostatus.md`](../crossrepostatus.md) ("Tool versions" row) — kept in one +place there so they cannot drift between this file and the status doc. `spotless:check` is bound to the `verify` phase, so a formatting violation fails any `mvn verify` / `mvn package` and the CI `code-style` job (which runs diff --git a/workflows/release-process.md b/workflows/release-process.md index a41490b..a0e8404 100644 --- a/workflows/release-process.md +++ b/workflows/release-process.md @@ -1,7 +1,7 @@ # Release Process (canonical, cross-repo) Maintainer-facing release procedure shared by all sibling repos -(BitcoinAddressFinder, java-llama.cpp, streambuffer, llamacpp-ai-index-maven-plugin). +(BitcoinAddressFinder, java-llama.cpp, streambuffer, srcmorph). End users should consult each repo's `CHANGELOG.md`. Each sibling's `docs/RELEASE.md` points here and adds only **repo-specific** notes