Preserve current rendering, operator and retained-source behavior while integrating script quality, meaningful headers and strict Error Prone/NullAway contracts. Production and test compilation and the 189-case verification gate pass with zero failures and one intentional workload skip.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
Add strict Python and checked JavaScript tooling, explicit source-scope
checks and real rejection probes to CI. Preserve existing runtime
behavior and document the limited bundle and test portability changes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Codex GPT-6 <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Require the reviewed H2 runtime in the selected Maven inventory and reject absent or different versions. Record unchanged H2 licensing and exact-artifact native cold-restart acceptance while keeping the central license exception and live deployment pending.
Validation: 11 inventory guard tests and 6 SARIF guard tests pass; workflow lint and independent review passed. Production Java remains the verified 67-test H2-fixed candidate.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
Resolve the selected UI profile once into a Maven CycloneDX graph and fail closed when Trivy or OSV omits packages or returns malformed evidence. Keep existing vulnerability and malicious-package gates.
Co-authored-by: Codex (GPT-6) <noreply@openai.com>
Signed-off-by: James Maes <james@kof22.com>
james.maesandClaude Sonnet 5.5