platform-ci

Shared KOF/QQQ local CI; no release credentials

Repository-owned scripts receive command-scope Git trust for their exact resolved checkout, as source checks do. Inherited Git hooks, credentials and configuration remain excluded; no global setting or wildcard is added.

Maven libraries may declare build.publication_commands as native Maven argument lists containing only pinned maven-source-plugin:jar-no-fork, maven-javadoc-plugin:jar, or flatten-maven-plugin:flatten goals and ordinary options. They run only for an actual selected Maven publication, after normal verification or restoration of an independently verified earlier bundle. PR checks retain their original commands; compiled main JAR and consumer POM bytes must remain unchanged. The existing worker performs attachment-only continuation when necessary; a later already-prepared bundle is reused directly. No second compile/test/package lifecycle or publisher application execution is introduced.

The retained preparation report binds the source/platform/run/attempt, exact native commands, original completed baseline identity and file hashes. Trusted selection independently checks those bindings; an unprepared main-JAR-only baseline cannot be published when this hook was declared. Existing secret scanning and failed/cancelled attachment work remain required failures. This source adoption has synthetic end-to-end and focused reuse proof; it does not claim a live Maven plugin execution or activate repository configs, publication credentials or a global workflow/helper pin.

Original release-candidate behavior is default-off through release.rc.channel. The actual event remains workflow_dispatch; only an independently proven canonical source run on the configured release branch receives RC planning/publication semantics. Shared source preserves the existing cut/dry-run/finalize/recover intent, branch lease, signed completion and protected callback behavior. The existing finalizer may dispatch the existing original RC completion using its own scoped job token; no application is executed in write phases. Canonical candidate selection excludes unrelated native workflows before applying the existing failed-own-source guard.

The RC source definitions, owner-wrapper projections and eventual immutable helper/workflow publication are separate adoption steps. No source merge alone enables repository release modes, adds a credential or proves private source access. A synthetic lifecycle plus one public native Maven fixture establishes attachment behavior: one verification and one JUnit execution, followed by each original pinned source/Javadoc plugin pair against restored tested classes without compile/test lifecycle entry and with identical main JAR/POM hashes. That fixture ran on Windows/Java21/Maven3.10; Linux shared-workflow runtime proof remains a separate activation observation.