xfoundries · youngledo · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -310,8 +310,6 @@ jobs:
     name: Maven 4 compatibility
     runs-on: ubuntu-latest
     needs: package
-    env:
-      MAVEN_VERSION: 4.0.0-rc-5
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -323,15 +321,8 @@ jobs:
           java-version: 25
           cache: maven
 
-      - name: Install Maven 4
-        run: |
-          curl -fsSLo /tmp/apache-maven-${MAVEN_VERSION}-bin.tar.gz \
-            https://archive.apache.org/dist/maven/maven-4/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz
-          tar -xzf /tmp/apache-maven-${MAVEN_VERSION}-bin.tar.gz -C /tmp
-          echo "/tmp/apache-maven-${MAVEN_VERSION}/bin" >> "$GITHUB_PATH"
-
       - name: Check Maven 4 package compatibility
-        run: mvn -B -DskipTests package
+        run: ./mvnw -B -DskipTests package
 
   merge-gate:
     name: Merge gate

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -110,6 +110,23 @@ jobs:
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
         run: ./mvnw -B -Prelease -DskipTests verify -Dgpg.passphrase="${GPG_PASSPHRASE}"
 
+      - name: Verify Maven Central Consumer POMs
+        env:
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        run: |
+          set -euo pipefail
+
+          consumer_pom_repository="${RUNNER_TEMP}/jfoundry-consumer-pom-repository"
+          rm -rf "${consumer_pom_repository}"
+          mkdir -p "${consumer_pom_repository}"
+          ./mvnw -B -Prelease -DskipTests -Dmaven.repo.local="${consumer_pom_repository}" \
+            -Dgpg.passphrase="${GPG_PASSPHRASE}" install
+
+          version="$(./mvnw -q help:evaluate -Dexpression=project.version -DforceStdout | tail -n 1)"
+          bash scripts/verify-consumer-pom.sh "${consumer_pom_repository}" "${version}" \
+            "$(command -v mvn)" "$(pwd)/mvnw"
+          echo "CONSUMER_POM_REPOSITORY=${consumer_pom_repository}" >> "${GITHUB_ENV}"
+
       - name: Verify Dependabot security alerts
         env:
           GH_TOKEN: ${{ github.token }}
@@ -138,21 +155,19 @@ jobs:
         run: |
           set -euo pipefail
 
-          mkdir -p release-evidence/artifacts release-evidence/poms release-evidence/signatures release-evidence/sboms
+          mkdir -p release-evidence/artifacts release-evidence/consumer-poms release-evidence/signatures release-evidence/sboms
           while IFS= read -r artifact; do
             module="${artifact#./}"
             module="${module%/target/*}"
             target="release-evidence/artifacts/${module//\//_}-$(basename "${artifact}")"
             cp "${artifact}" "${target}"
           done < <(find . -path '*/target/*.jar' -type f | sort)
           while IFS= read -r pom; do
-            module="${pom#./}"
-            module="${module%/pom.xml}"
-            if [[ "${module}" == "${pom#./}" ]]; then
-              module="root"
-            fi
-            cp "${pom}" "release-evidence/poms/${module//\//_}-pom.xml"
-          done < <(find . -name pom.xml -type f | sort)
+            relative_pom="${pom#${CONSUMER_POM_REPOSITORY}/}"
+            target="release-evidence/consumer-poms/${relative_pom}"
+            mkdir -p "$(dirname "${target}")"
+            cp "${pom}" "${target}"
+          done < <(find "${CONSUMER_POM_REPOSITORY}/io/github/xfoundries" -name '*.pom' ! -name '*-build.pom' -type f | sort)
           signature_count=0
           while IFS= read -r signature; do
             module="${signature#./}"

diff --git a/.mvn/maven.config b/.mvn/maven.config
@@ -1,3 +1,5 @@
 --show-version
 -T
 1C
+-Dmaven.consumer.pom=true
+-Dmaven.consumer.pom.flatten=true
diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties
@@ -1,3 +1,3 @@
 wrapperVersion=3.3.4
 distributionType=only-script
-distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/4.0.0-rc-5/apache-maven-4.0.0-rc-5-bin.zip
diff --git a/docs/release/compatibility.md b/docs/release/compatibility.md
@@ -10,8 +10,8 @@
 | Spring Framework | 7.0.x |
 | Quarkus | 3.37.3 |
 | Helidon MP | 4.5.1 |
-| Maven release tool | 3.9.x |
-| Maven 4 | Compatibility check only while Maven 4 is preview/RC |
+| Maven release tool | 4.0.0-rc-5 (experimental) |
+| Maven 3.9 | Consumer compatibility check |
 
 ## Dependency Baseline
 
@@ -61,7 +61,7 @@ general JFoundry dependency-management rule.
 
 ## Verification Evidence
 
-Historic evidence was recorded on 2026-06-27 with local Java `21.0.10-tem` and Maven wrapper `3.9.16`. The current release-baseline evidence was recorded on 2026-07-24 with GraalVM Community `25.0.2` and Maven wrapper `3.9.16`. The Spring MyBatis-Plus, Redisson, and JobRunr Native Image verification evidence was recorded on 2026-07-30 with the same GraalVM and Maven versions.
+Historic evidence was recorded on 2026-06-27 with local Java `21.0.10-tem` and Maven wrapper `3.9.16`. The current release-baseline evidence was recorded on 2026-07-24 with GraalVM Community `25.0.2` and Maven wrapper `3.9.16`. The Spring MyBatis-Plus, Redisson, and JobRunr Native Image verification evidence was recorded on 2026-07-30 with the same GraalVM and Maven versions. Maven 4 RC5 Consumer POM release verification was added on 2026-08-01; the release workflow performs a clean Maven 4 install and verifies the installed POMs with both Maven 3.9 and Maven 4 RC5 before deployment.
 
 | Gate | Command | Result |
 |------|---------|--------|
@@ -75,8 +75,9 @@ Historic evidence was recorded on 2026-06-27 with local Java `21.0.10-tem` and M
 | Quarkus PostgreSQL middleware integration | `./mvnw -B -pl jfoundry-runtime-integrations/jfoundry-quarkus/jfoundry-quarkus-integration-tests -am -Pjvm-integration verify` | PASS on Java 25 with Docker 29.6.2/Testcontainers |
 | Helidon PostgreSQL/JTA middleware integration | `./mvnw -B -pl jfoundry-runtime-integrations/jfoundry-helidon/jfoundry-helidon-integration-tests -am -Pjvm-integration verify` | PASS on Java 25 with Docker 29.6.2/Testcontainers |
 | Release guard | `mvn -Prelease -DskipTests validate` | Expected fail fast on `Release builds require non-SNAPSHOT project versions.` |
-| Maven 4 validate | Maven `4.0.0-rc-5`, `mvn -B -DskipTests validate -e` | PASS |
-| Maven 4 package | Maven `4.0.0-rc-5`, `mvn -B -DskipTests package` | PASS on 2026-07-24; Maven 4 reports imported-BOM model warnings |
+| Maven 4 validate | Maven `4.0.0-rc-5`, `./mvnw -B -DskipTests validate -e` | PASS |
+| Maven 4 package | Maven `4.0.0-rc-5`, `./mvnw -B -DskipTests package` | PASS on 2026-07-24; Maven 4 reports imported-BOM model warnings |
+| Maven Consumer POM contract | Maven `4.0.0-rc-5`, clean `install`, then `scripts/verify-consumer-pom.sh` with Maven 3.9 and Maven 4 RC5 | Required before Central deploy; verifies flattened child POMs and Maven 3.9/Maven 4 consumer resolution |
 | Quarkus JVM consumer smoke test | Install runtime/deployment artifacts, then `mvn -pl jfoundry-runtime-integrations/jfoundry-quarkus/jfoundry-quarkus-integration-tests -Pjvm-integration verify` | Historical PASS on Java 21; Java 25 revalidation is required by the release baseline |
 | Helidon Native CDI/Web consumer smoke test | GraalVM 25, `mvn -pl jfoundry-runtime-integrations/jfoundry-helidon/jfoundry-helidon-integration-tests -am -Pnative-image package`, then HTTP Problem Details smoke | PASS on 2026-07-24 |
 
@@ -99,7 +100,7 @@ support works.
 - `./mvnw -DskipTests package`
 - `./mvnw -pl jfoundry-runtime-integrations/jfoundry-spring/jfoundry-spring-integration-tests -am -Pit verify`
 - Java 25 release-baseline test in CI
-- Maven 4 compatibility matrix in CI
+- Maven 4 Wrapper package compatibility and Consumer POM contract before Central deployment
 - Spring and Quarkus Native Image smoke tests in CI
 - Spring Native Image MyBatis-Plus persistence integration in CI
 - Spring Native Image Redisson lock and JobRunr Outbox integrations in CI

diff --git a/docs/release/maven-central.md b/docs/release/maven-central.md
@@ -9,7 +9,8 @@ The root POM publishes URL and SCM metadata for `https://github.com/xfoundries/j
 ## Prerequisites
 
 - Java 25.
-- Maven 3.9.0 or newer.
+- The checked-in Maven Wrapper, currently Maven `4.0.0-rc-5` with Consumer POM transformation enabled.
+- Maven 3.9.x for the release consumer-compatibility check.
 - A Sonatype Central Portal account with publishing rights for `io.github.xfoundries`.
 - SNAPSHOT publishing enabled for the `io.github.xfoundries` namespace if publishing development snapshots.
 - For local release dry-runs, a Maven server entry named `jfoundry` in `~/.m2/settings.xml`.
@@ -58,13 +59,13 @@ Require maintainer review for this environment before publishing a release.
 Run the regular package build first:
 
 ```bash
-mvn -DskipTests package
+./mvnw -DskipTests package
 ```
 
 Then run the release profile through `verify` so sources, Javadocs, and local signatures are exercised:
 
 ```bash
-mvn -Prelease -DskipTests verify
+./mvnw -Prelease -DskipTests verify
 ```
 
 The `verify` phase checks local artifact generation and signatures up to the GPG signing step. It does not upload or stage a Central Portal deployment bundle; that behavior is triggered during `deploy`.
@@ -79,9 +80,16 @@ matches the tag exactly. For example, `v1.0.0-RC1` must point to source whose ro
 is `1.0.0-RC1`.
 
 The release workflow checks out the requested annotated tag, verifies the tag-to-version relationship
-and a clean source tree, runs `./mvnw -B -Prelease -DskipTests verify`, checks for open High or
-Critical Dependabot alerts, and only then stages `deploy`. It never changes POM versions or pushes a
-branch during publication.
+and a clean source tree, runs `./mvnw -B -Prelease -DskipTests verify`, installs the complete reactor
+into an isolated repository, verifies the Maven 4 Consumer POMs and Maven 3.9/Maven 4 consumer
+resolution, checks for open High or Critical Dependabot alerts, and only then stages `deploy`. It
+never changes POM versions or pushes a branch during publication.
+
+Maven 4 is still an RC release. JFoundry uses its official Consumer POM transformation because Maven
+Central validates the POM that is deployed, rather than the build-time inheritance model. The source
+POMs remain maintainable parent/BOM-based POMs; Maven 4 publishes flattened Consumer POMs for child
+artifacts. The workflow archives those transformed POMs in the release evidence and checks that Maven
+3.9 and Maven 4 can consume them before deployment.
 
 The Central publishing plugin uses `autoPublish=false`. Inspect the staged deployment, signatures,
 source and Javadoc artifacts, BOM resolution, CycloneDX SBOM, checksums, and provenance evidence
@@ -97,7 +105,7 @@ including standalone BOM modules.
 Publish the current development version locally with:
 
 ```bash
-mvn -DskipTests deploy \
+./mvnw -DskipTests deploy \
   -DaltDeploymentRepository=jfoundry::https://central.sonatype.com/repository/maven-snapshots/
 ```
 

diff --git a/jfoundry-boms/jfoundry-dependencies/pom.xml b/jfoundry-boms/jfoundry-dependencies/pom.xml
@@ -4,7 +4,7 @@
 
   <groupId>io.github.xfoundries</groupId>
   <artifactId>jfoundry-dependencies</artifactId>
-  <version>1.0.0-RC2</version>
+  <version>1.0.0</version>
   <packaging>pom</packaging>
   <name>jfoundry-dependencies</name>
   <description>Framework-neutral dependency management BOM for jfoundry.</description>

diff --git a/jfoundry-boms/jfoundry-foundation-dependencies/pom.xml b/jfoundry-boms/jfoundry-foundation-dependencies/pom.xml
@@ -4,7 +4,7 @@
 
   <groupId>io.github.xfoundries</groupId>
   <artifactId>jfoundry-foundation-dependencies</artifactId>
-  <version>1.0.0-RC2</version>
+  <version>1.0.0</version>
   <packaging>pom</packaging>
   <name>jfoundry-foundation-dependencies</name>
   <description>Dependency management BOM for framework-neutral foundation libraries used by jfoundry.</description>

diff --git a/jfoundry-boms/jfoundry-helidon-dependencies/pom.xml b/jfoundry-boms/jfoundry-helidon-dependencies/pom.xml
@@ -6,7 +6,7 @@
 
     <groupId>io.github.xfoundries</groupId>
     <artifactId>jfoundry-helidon-dependencies</artifactId>
-    <version>1.0.0-RC2</version>
+    <version>1.0.0</version>
     <packaging>pom</packaging>
 
     <name>jfoundry-helidon-dependencies</name>

diff --git a/jfoundry-boms/jfoundry-modules-dependencies/pom.xml b/jfoundry-boms/jfoundry-modules-dependencies/pom.xml
@@ -4,7 +4,7 @@
 
   <groupId>io.github.xfoundries</groupId>
   <artifactId>jfoundry-modules-dependencies</artifactId>
-  <version>1.0.0-RC2</version>
+  <version>1.0.0</version>
   <packaging>pom</packaging>
   <name>jfoundry-modules-dependencies</name>
   <description>Dependency management BOM for jfoundry modules.</description>

diff --git a/jfoundry-boms/jfoundry-quarkus-dependencies/pom.xml b/jfoundry-boms/jfoundry-quarkus-dependencies/pom.xml
@@ -6,7 +6,7 @@
 
     <groupId>io.github.xfoundries</groupId>
     <artifactId>jfoundry-quarkus-dependencies</artifactId>
-    <version>1.0.0-RC2</version>
+    <version>1.0.0</version>
     <packaging>pom</packaging>
 
     <name>jfoundry-quarkus-dependencies</name>

diff --git a/jfoundry-boms/jfoundry-spring-dependencies/pom.xml b/jfoundry-boms/jfoundry-spring-dependencies/pom.xml
@@ -6,7 +6,7 @@
 
     <groupId>io.github.xfoundries</groupId>
     <artifactId>jfoundry-spring-dependencies</artifactId>
-    <version>1.0.0-RC2</version>
+    <version>1.0.0</version>
     <packaging>pom</packaging>
     <name>jfoundry-spring-dependencies</name>
     <description>Spring Boot and Cloud platform dependency management BOM for jfoundry applications.</description>

diff --git a/jfoundry-core/jfoundry-application/jfoundry-application-core/pom.xml b/jfoundry-core/jfoundry-application/jfoundry-application-core/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-application</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-application/jfoundry-domain-event-core/pom.xml b/jfoundry-core/jfoundry-application/jfoundry-domain-event-core/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-application</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-application/jfoundry-domain-event-externalization-core/pom.xml b/jfoundry-core/jfoundry-application/jfoundry-domain-event-externalization-core/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-application</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-application/jfoundry-inbox-core/pom.xml b/jfoundry-core/jfoundry-application/jfoundry-inbox-core/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-application</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-application/jfoundry-lock-core/pom.xml b/jfoundry-core/jfoundry-application/jfoundry-lock-core/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-application</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-application/jfoundry-messaging-core/pom.xml b/jfoundry-core/jfoundry-application/jfoundry-messaging-core/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-application</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-application/jfoundry-outbox-core/pom.xml b/jfoundry-core/jfoundry-application/jfoundry-outbox-core/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-application</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-application/jfoundry-transaction-core/pom.xml b/jfoundry-core/jfoundry-application/jfoundry-transaction-core/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-application</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-application/pom.xml b/jfoundry-core/jfoundry-application/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-parent</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-architecture/jfoundry-architecture-test/pom.xml b/jfoundry-core/jfoundry-architecture/jfoundry-architecture-test/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-parent</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-architecture/jfoundry-cqrs/pom.xml b/jfoundry-core/jfoundry-architecture/jfoundry-cqrs/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-architecture</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-architecture/jfoundry-hexagonal/pom.xml b/jfoundry-core/jfoundry-architecture/jfoundry-hexagonal/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-architecture</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-architecture/jfoundry-onion/pom.xml b/jfoundry-core/jfoundry-architecture/jfoundry-onion/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-architecture</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-architecture/pom.xml b/jfoundry-core/jfoundry-architecture/pom.xml
@@ -7,7 +7,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-parent</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-domain/pom.xml b/jfoundry-core/jfoundry-domain/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-parent</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-infrastructure/jfoundry-inbox-jpa/pom.xml b/jfoundry-core/jfoundry-infrastructure/jfoundry-inbox-jpa/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-infrastructure</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 

diff --git a/jfoundry-core/jfoundry-infrastructure/jfoundry-inbox-mybatis-plus/pom.xml b/jfoundry-core/jfoundry-infrastructure/jfoundry-inbox-mybatis-plus/pom.xml
@@ -4,7 +4,7 @@
     <parent>
         <groupId>io.github.xfoundries</groupId>
         <artifactId>jfoundry-infrastructure</artifactId>
-        <version>1.0.0-RC2</version>
+        <version>1.0.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>