diff --git a/.fossa.yml b/.fossa.yml
new file mode 100644
index 00000000..c51f407b
--- /dev/null
+++ b/.fossa.yml
@@ -0,0 +1,11 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-License-Identifier: MIT OR Apache-2.0
+
+version: 3
+project:
+  locator: git+github.com/bernardladenthin/streambuffer
+
+# No fixed revision.branch: preserve the actual PR/main branch and commit.
+# No license overrides or scope exclusions: test and runtime findings stay visible.
+maven:
+  scope-exclude: []
diff --git a/.github/actions-config.json b/.github/actions-config.json
new file mode 100644
index 00000000..b0afc901
--- /dev/null
+++ b/.github/actions-config.json
@@ -0,0 +1,21 @@
+{
+  "$comment": "Configuration of the shared checks of bernardladenthin/actions (see its README).",
+  "templates": {
+    "sets": [
+      "common",
+      "java"
+    ],
+    "exclude": [
+      "lombok.config"
+    ]
+  },
+  "maven-versions": {
+    "poms": [
+      "pom.xml"
+    ],
+    "family": "java-maven",
+    "ignore-groups": [
+      "net.ladenthin"
+    ]
+  }
+}
diff --git a/.github/actions-config.json.license b/.github/actions-config.json.license
new file mode 100644
index 00000000..eca5b047
--- /dev/null
+++ b/.github/actions-config.json.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+
+SPDX-License-Identifier: MIT OR Apache-2.0
diff --git a/.github/buildcheck/__init__.py b/.github/buildcheck/__init__.py
deleted file mode 100644
index add4f0f5..00000000
--- a/.github/buildcheck/__init__.py
+++ /dev/null
@@ -1,14 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""Build checks as a library, so buildcheck/tests can test them. Standard library only.
-
-Two kinds of module live here. workflow.py, releasegate.py, sharedfiles.py, versions.py and
-runscripts.py (with their tests and the check-*.py entry points next to this package) are kept
-BYTE-IDENTICAL in java-llama.cpp, BitcoinAddressFinder, srcmorph and streambuffer: each repository
-lists them in .github/shared-files.sha256, which its `shared-files` job checks (see sharedfiles.py).
-Every other module is the repository's own.
-
-Run the tests from the repository root:
-  python3 -m unittest discover -s .github/buildcheck/tests -t .github
-"""
diff --git a/.github/buildcheck/releasegate.py b/.github/buildcheck/releasegate.py
deleted file mode 100644
index 729e2150..00000000
--- a/.github/buildcheck/releasegate.py
+++ /dev/null
@@ -1,60 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""Every job of publish.yml gates both publish jobs, unless the repository lists it in
-.github/release-gate-exemptions.txt with a reason.
-
-A job that nothing waits for can go red and a release still ships -- the natives-build jobs that
-`package` once forgot to wait for, and the aarch64 fat jars that were signed and attached for
-releases without any job launching them, were both of that shape. So "not gating" has to be a
-decision written down here, not the default a new job gets by being forgotten in two `needs:` lists.
-
-The check runs both ways: a job outside the gates and outside the exemptions fails, and so does an
-exemption that names no job or a job that gates both publish jobs after all (a stale
-exemption would hide the next job of that name).
-"""
-
-from . import workflow
-
-GATES = ("publish-snapshot", "publish-release")
-
-# Each repository lists its own exemptions here, one `<job>: <reason>` per line (# comments).
-EXEMPTIONS_FILE = ".github/release-gate-exemptions.txt"
-
-
-def read_exemptions(text):
-    """The exemptions file: job -> reason. A line without a reason is an error -- the point of the
-    file is that every job allowed to stay red says why."""
-    exemptions = {}
-    for number, line in enumerate(text.splitlines(), 1):
-        line = line.strip()
-        if not line or line.startswith("#"):
-            continue
-        job, _, reason = line.partition(":")
-        if not reason.strip() or not job.strip():
-            raise ValueError(f"line {number}: expected `<job>: <reason>`, got {line!r}")
-        if job.strip() in exemptions:
-            raise ValueError(f"line {number}: {job.strip()} is listed twice")
-        exemptions[job.strip()] = reason.strip()
-    return exemptions
-
-
-def check(jobs, non_gating, gates=GATES):
-    missing = [g for g in gates if g not in jobs]
-    if missing:
-        return [f"publish.yml has no job {g}" for g in missing]
-    closures = [workflow.closure(jobs, g) for g in gates]
-    failures = []
-    for name in jobs:
-        gated = [g for g, c in zip(gates, closures) if name in c]
-        if name in non_gating:
-            if len(gated) == len(gates):
-                failures.append(f"release-gate-exemptions.txt lists {name}, which gates {', '.join(gates)} "
-                                f"-- remove the stale exemption")
-        elif len(gated) != len(gates):
-            ungated = [g for g in gates if g not in gated]
-            failures.append(f"publish.yml: {', '.join(ungated)} does not wait for {name} -- add it to the "
-                            f"needs, or to release-gate-exemptions.txt with the reason it may stay red")
-    failures += [f"release-gate-exemptions.txt lists {name}, which is no job of publish.yml"
-                 for name in sorted(set(non_gating) - set(jobs))]
-    return failures
diff --git a/.github/buildcheck/runscripts.py b/.github/buildcheck/runscripts.py
deleted file mode 100644
index ea685058..00000000
--- a/.github/buildcheck/runscripts.py
+++ /dev/null
@@ -1,273 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""Every `run:` script of the workflows and composite actions that runs in bash, parsed with
-`bash -n` -- so a broken script fails the `shared-files` job in the first minutes of a run instead
-of the job that executes it, possibly hours later or only on a release path.
-
-The case this exists for: a cleanup lost the trailing backslash of six continued lines, leaving a
-line that starts with `||` or `-e` -- in a step only a publish run or a native build reaches. Neither
-actionlint (it parses scripts only when shellcheck is installed) nor a review saw it; `bash -n` sees
-every one of them.
-
-Which scripts are bash is decided the way the runner decides it: the step's `shell:`, else the job's
-and then the workflow's `defaults.run.shell`, else the runner's default -- PowerShell on a Windows
-runner, bash everywhere else. A runner chosen by an expression (a matrix, a workflow input) counts
-as Windows only when the step's `if:` says so; a step without `shell:` on such a job runs on every
-OS of the matrix and has to be valid bash anyway. Scripts in `sh`, `bash -el {0}` or a bash given by
-path are bash; pwsh, powershell, cmd and python are skipped.
-
-Like workflow.py this reads the two-space layout the workflows are written in, not general YAML.
-The run value is taken as YAML defines it: a literal block (`|`) line for line, a folded block
-(`>`) and a plain scalar folded into one line, a single-quoted scalar unquoted. A double-quoted
-scalar is skipped (its escapes are not worth a YAML parser). Every `${{ ... }}` expression becomes
-a word, which is what the runner substitutes before bash sees the script.
-"""
-
-import glob
-import os
-import re
-import shutil
-import subprocess
-import sys
-
-RUN = re.compile(r"^(?P<lead>\s*(?:- )?)run:(?:\s+(?P<value>.*?))?\s*$")
-BLOCK_HEADER = re.compile(r"^(?P<style>[|>])[-+]?[1-9]?\s*(#.*)?$")
-EXPRESSION = re.compile(r"\$\{\{.*?\}\}")
-COMMENT = re.compile(r"\s+#.*$")
-BASH_LINE = re.compile(r"line (\d+)")
-BASH_SHELLS = ("bash", "sh")
-SKIPPED_SHELLS = ("pwsh", "powershell", "cmd", "python")
-WINDOWS_IF = re.compile(r"runner\.os\s*==\s*'Windows'")
-PATTERNS = (".github/workflows/*.yml", ".github/workflows/*.yaml", ".github/actions/*/action.yml",
-            ".github/actions/*/action.yaml")
-
-
-class Script:
-    """One run script: the file line of its `run:` key, the shell it runs in, and its text."""
-
-    def __init__(self, line, shell, text, literal=False):
-        self.line = line
-        self.shell = shell
-        self.text = text
-        self.literal = literal
-
-
-def _indent(line):
-    return len(line) - len(line.lstrip())
-
-
-def _significant(line):
-    stripped = line.strip()
-    return bool(stripped) and not stripped.startswith("#")
-
-
-def _scalar(value):
-    value = COMMENT.sub("", value or "").strip()
-    if len(value) >= 2 and value[0] == value[-1] and value[0] in "'\"":
-        value = value[1:-1]
-    return value
-
-
-def _value(lines, indent, keys):
-    """The scalar at the mapping path `keys` in `lines`, its first key at `indent`, else None."""
-    for number, line in enumerate(lines):
-        if _indent(line) != indent or not line.strip().startswith(keys[0] + ":"):
-            continue
-        rest = line.strip()[len(keys[0]) + 1:]
-        if len(keys) == 1:
-            return _scalar(rest)
-        block = []
-        for following in lines[number + 1:]:
-            if _significant(following) and _indent(following) <= indent:
-                break
-            block.append(following)
-        return _value(block, indent + 2, keys[1:])
-    return None
-
-
-def _job_lines(lines, index):
-    """The lines of the workflow job containing line `index` (none in a composite action)."""
-    start = None
-    for number in range(index, -1, -1):
-        if re.match(r"^  [A-Za-z0-9_-]+:\s*(#.*)?$", lines[number]):
-            start = number
-            break
-        if lines[number] and not lines[number][0].isspace() and _significant(lines[number]):
-            return []
-    if start is None:
-        return []
-    end = len(lines)
-    for number in range(index + 1, len(lines)):
-        if _significant(lines[number]) and _indent(lines[number]) <= 2:
-            end = number
-            break
-    return lines[start:end]
-
-
-def _step_start(lines, index, key_indent):
-    """The line the step of the `run:` key at line `index` starts at; None when the key is not a
-    step's (`defaults: run:` is a mapping, not a script)."""
-    if lines[index].lstrip().startswith("- "):
-        return index
-    for number in range(index - 1, -1, -1):
-        line = lines[number]
-        if not _significant(line):
-            continue
-        if _indent(line) == key_indent - 2 and line.lstrip().startswith("- "):
-            return number
-        if _indent(line) < key_indent:
-            return None
-    return None
-
-
-def _step_lines(lines, index, key_indent):
-    """The lines of the step the `run:` key at line `index` belongs to."""
-    dash = key_indent - 2
-    start = _step_start(lines, index, key_indent)
-    end = len(lines)
-    for number in range(index + 1, len(lines)):
-        if _significant(lines[number]) and _indent(lines[number]) <= dash:
-            end = number
-            break
-    # the step's own keys, its first one written after the dash
-    return [" " * key_indent + line.lstrip()[2:] if number == start and line.lstrip().startswith("- ")
-            else line for number, line in enumerate(lines[start:end], start)]
-
-
-def _shell_name(shell):
-    first = shell.split()[0] if shell.split() else ""
-    name = re.split(r"[\\/]", first)[-1].lower()
-    return name[:-4] if name.endswith(".exe") else name
-
-
-def shell_of(lines, index, key_indent):
-    """The shell the step whose `run:` key is at line `index` runs in, as the runner decides it."""
-    step = _step_lines(lines, index, key_indent)
-    shell = _value(step, key_indent, ["shell"])
-    job = _job_lines(lines, index)
-    if not shell and job:
-        shell = _value(job, 4, ["defaults", "run", "shell"])
-    if not shell:
-        shell = _value(lines, 0, ["defaults", "run", "shell"])
-    if shell:
-        return _shell_name(shell)
-    runs_on = (_value(job, 4, ["runs-on"]) or "") if job else ""
-    condition = _value(step, key_indent, ["if"]) or ""
-    if "windows" in EXPRESSION.sub("", runs_on).lower() or WINDOWS_IF.search(condition):
-        return "pwsh"
-    return "bash"
-
-
-def _fold(lines):
-    """YAML folding of a block's lines (indentation removed): lines of equal indentation join with
-    a space, an empty line is a line break, more-indented lines keep their breaks."""
-    out = ""
-    previous = None
-    for line in lines:
-        if not line.strip():
-            out += "\n"
-            previous = "empty"
-            continue
-        more = line[0].isspace()
-        if previous == "text" and not more:
-            out += " " + line
-        else:
-            if previous is not None and previous != "empty":
-                out += "\n"
-            out += line
-        previous = "more" if more else "text"
-    return out
-
-
-def scripts(text):
-    """Every run script of a workflow or composite action, in file order."""
-    lines = text.splitlines()
-    found = []
-    number = 0
-    while number < len(lines):
-        match = RUN.match(lines[number])
-        if not match or _step_start(lines, number, len(match.group("lead"))) is None:
-            number += 1
-            continue
-        key_indent = len(match.group("lead"))
-        value = match.group("value") or ""
-        body_end = number + 1
-        while body_end < len(lines) and (not lines[body_end].strip() or _indent(lines[body_end]) > key_indent):
-            body_end += 1
-        while body_end > number + 1 and not lines[body_end - 1].strip():
-            body_end -= 1
-        body = lines[number + 1:body_end]
-        header = BLOCK_HEADER.match(value)
-        if header:
-            significant = [line for line in body if line.strip()]
-            indent = min((_indent(line) for line in significant), default=0)
-            body = [line[indent:] for line in body]
-            script = "\n".join(body) if header.group("style") == "|" else _fold(body)
-        elif value.startswith('"'):
-            script = None
-        elif value.startswith("'"):
-            script = " ".join([value] + [line.strip() for line in body]).strip()
-            script = script[1:-1].replace("''", "'") if script.endswith("'") else None
-        else:
-            script = COMMENT.sub("", " ".join([value] + [line.strip() for line in body]))
-        if script is not None:
-            found.append(Script(number + 1, shell_of(lines, number, key_indent), script,
-                                literal=bool(header) and header.group("style") == "|"))
-        number = max(body_end, number + 1)
-    return found
-
-
-def bash_n(script, bash="bash"):
-    """bash -n over the script: None when it parses, else bash's message."""
-    result = subprocess.run([bash, "-n"], input=EXPRESSION.sub("X", script), capture_output=True,
-                            text=True, check=False)
-    return None if result.returncode == 0 else result.stderr.strip() or f"exit {result.returncode}"
-
-
-def check(path, text, parser=bash_n):
-    """`path:line: message` per bash script that does not parse; the count of scripts checked."""
-    errors = []
-    checked = 0
-    for script in scripts(text):
-        if script.shell in SKIPPED_SHELLS:
-            continue
-        if script.shell not in BASH_SHELLS:
-            errors.append(f"{path}:{script.line}: unknown shell '{script.shell}' -- add it to runscripts.py")
-            continue
-        checked += 1
-        message = parser(script.text)
-        if message:
-            # bash counts a literal block's lines from 1, the first one being the line after `run: |`;
-            # a folded script has no line of the file to point at but its `run:`
-            match = BASH_LINE.search(message)
-            line = script.line + int(match.group(1)) if match and script.literal else script.line
-            errors.append(f"{path}:{line}: {message}")
-    return errors, checked
-
-
-def files(root):
-    return sorted({path for pattern in PATTERNS for path in glob.glob(os.path.join(root, pattern))})
-
-
-def main(argv, root, out=sys.stdout, err=sys.stderr):
-    """check-run-scripts.py -- bash -n over every bash run script of the workflows and actions"""
-    if argv[1:]:
-        print(main.__doc__, file=err)
-        return 2
-    bash = shutil.which("bash")
-    if not bash:
-        print("::error::bash not found", file=err)
-        return 2
-    errors = []
-    checked = 0
-    paths = files(root)
-    for path in paths:
-        with open(path, encoding="utf-8") as f:
-            found, count = check(os.path.relpath(path, root), f.read(), lambda s: bash_n(s, bash))
-        errors += found
-        checked += count
-    for error in errors:
-        print(f"::error::{error}", file=err)
-    print(f"{checked} bash run scripts in {len(paths)} files, {len(errors)} that do not parse", file=out)
-    return 1 if errors or not paths else 0
diff --git a/.github/buildcheck/sharedfiles.py b/.github/buildcheck/sharedfiles.py
deleted file mode 100644
index 19518ea7..00000000
--- a/.github/buildcheck/sharedfiles.py
+++ /dev/null
@@ -1,178 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""The files kept byte-identical across java-llama.cpp, BitcoinAddressFinder, srcmorph and
-streambuffer, checked by every repository's own `shared-files` job.
-
-Each repository lists the shared files it carries, with their SHA-256, in
-.github/shared-files.sha256 -- `sha256sum` format. An entry can also name ONE JOB of a workflow,
-`.github/workflows/publish.yml#startgate`: jobs such as `startgate` or `check-tag` are kept identical
-inside four otherwise different workflows, and a job entry hashes just that job's text (its header
-and body, without the comment lines between it and the next job, which belong to the next one).
-An entry ending in `?repo` (`SUPPORT.md?repo`, `.github/workflows/publish.yml#code-style?repo`)
-stands for a file or job that is identical up to the repository's own name: it is hashed with every
-occurrence of that name replaced by `{repo}`, so a support page or a Sonar project key that names its
-repository can be shared too. `sha256sum -c` reads the plain file entries only. The job
-  * fails when a listed file is missing or its content no longer matches its line: a shared file
-    was edited here alone. Edit it in every repository that lists it, then update each manifest
-    (`check-shared-files.py --write` rewrites the hashes of this repository's lines);
-  * warns when another repository's manifest (its default branch) lists the same file with a
-    different hash: one side of a sync is not merged yet. A warning and not a failure, because a
-    sync is one change per repository and lands in four steps.
-A file is matched across repositories by its path, or, when the other side has no such path, by
-its file name if that is unique there (lombok.config lives at llama/lombok.config in the
-java-llama.cpp reactor and at the root elsewhere).
-"""
-
-import hashlib
-import os
-import re
-import sys
-import urllib.request
-
-from . import workflow
-
-REPOS = ("java-llama.cpp", "BitcoinAddressFinder", "srcmorph", "streambuffer")
-OWNER = "bernardladenthin"
-MANIFEST = ".github/shared-files.sha256"
-RAW_URL = "https://raw.githubusercontent.com/{owner}/{repo}/HEAD/" + MANIFEST
-LINE = re.compile(r"^([0-9a-f]{64}) [ *](.+)$")
-REPO_SUFFIX = "?repo"
-REPO_PLACEHOLDER = b"{repo}"
-
-
-def parse(text):
-    """path -> sha256 of a manifest. Comment and blank lines are skipped; anything else that is
-    not a `sha256sum` line is an error, and so is a path listed twice."""
-    entries = {}
-    for number, line in enumerate(text.splitlines(), 1):
-        if not line.strip() or line.startswith("#"):
-            continue
-        match = LINE.match(line)
-        if not match:
-            raise ValueError(f"{MANIFEST} line {number}: not `<sha256>  <path>`: {line!r}")
-        if match.group(2) in entries:
-            raise ValueError(f"{MANIFEST} line {number}: {match.group(2)} is listed twice")
-        entries[match.group(2)] = match.group(1)
-    return entries
-
-
-def content(root, entry):
-    """The bytes an entry stands for: a file, or for `<workflow>#<job>` that one job's text; for an
-    entry ending in `?repo` with the repository's name replaced by `{repo}`. None when the file or
-    the job does not exist."""
-    if entry.endswith(REPO_SUFFIX):
-        data = content(root, entry[:-len(REPO_SUFFIX)])
-        return None if data is None else data.replace(current_repo(root).encode("utf-8"), REPO_PLACEHOLDER)
-    path, _, job = entry.partition("#")
-    full = os.path.join(root, path)
-    if not os.path.isfile(full):
-        return None
-    with open(full, "rb") as f:
-        data = f.read()
-    if not job:
-        return data
-    jobs = workflow.parse(data.decode("utf-8"))
-    if job not in jobs:
-        return None
-    lines = jobs[job].lines
-    while lines and (not lines[-1].strip() or lines[-1].startswith("  #")):
-        lines = lines[:-1]
-    return ("\n".join(lines) + "\n").encode("utf-8")
-
-
-def sha256(root, entry):
-    data = content(root, entry)
-    return None if data is None else hashlib.sha256(data).hexdigest()
-
-
-def verify(root, entries):
-    """Failures: every listed file (or job) exists and still has its listed hash."""
-    failures = []
-    for path, digest in entries.items():
-        actual = sha256(root, path)
-        if actual is None:
-            failures.append(f"{path} is listed in {MANIFEST} but does not exist")
-        elif actual != digest:
-            failures.append(f"{path} differs from its line in {MANIFEST}: a shared file was changed in "
-                            f"this repository alone -- change every copy, then update every manifest")
-    return failures
-
-
-def rewrite(text, root):
-    """The manifest with every hash recomputed from the files; comments and order kept."""
-    out = []
-    for line in text.splitlines():
-        match = LINE.match(line)
-        if not match:
-            out.append(line)
-            continue
-        digest = sha256(root, match.group(2))
-        if digest is None:
-            raise ValueError(f"{match.group(2)} is listed in {MANIFEST} but does not exist")
-        out.append(f"{digest}  {match.group(2)}")
-    return "\n".join(out) + "\n"
-
-
-def counterpart(path, other):
-    """The path `other` (another manifest) lists for our `path`: the same path, else a unique
-    file of the same name, else None."""
-    if path in other:
-        return path
-    same_name = [p for p in other if os.path.basename(p) == os.path.basename(path)]
-    return same_name[0] if len(same_name) == 1 else None
-
-
-def compare(own, others):
-    """Warnings for every shared file another repository lists with a different hash."""
-    warnings = []
-    for repo, entries in sorted(others.items()):
-        for path, digest in own.items():
-            theirs = counterpart(path, entries)
-            if theirs is not None and entries[theirs] != digest:
-                warnings.append(f"{path} differs from {repo}'s {theirs}: finish or redo the sync")
-    return warnings
-
-
-def current_repo(root):
-    name = os.environ.get("GITHUB_REPOSITORY", "").split("/")[-1]
-    return name or os.path.basename(os.path.abspath(root))
-
-
-def fetch(repo):
-    with urllib.request.urlopen(RAW_URL.format(owner=OWNER, repo=repo), timeout=20) as response:
-        return response.read().decode("utf-8")
-
-
-def main(argv, root, fetcher=fetch, out=sys.stdout, err=sys.stderr):
-    """check-shared-files.py [--write | --offline]"""
-    path = os.path.join(root, MANIFEST)
-    with open(path, encoding="utf-8") as f:
-        text = f.read()
-    if argv[1:] == ["--write"]:
-        with open(path, "w", encoding="utf-8", newline="\n") as f:
-            f.write(rewrite(text, root))
-        print(f"rewrote the hashes of {MANIFEST}", file=out)
-        return 0
-    if argv[1:] not in ([], ["--offline"]):
-        print(main.__doc__, file=err)
-        return 2
-    own = parse(text)
-    failures = verify(root, own)
-    for failure in failures:
-        print(f"::error::{failure}", file=err)
-    print(f"{len(own)} shared files, {len(failures)} changed here alone", file=out)
-    if argv[1:] == ["--offline"]:
-        return 1 if failures else 0
-    others = {}
-    for repo in REPOS:
-        if repo == current_repo(root):
-            continue
-        try:
-            others[repo] = parse(fetcher(repo))
-        except Exception as e:  # noqa: BLE001 -- a sibling that cannot be read is a warning, never a red
-            print(f"::warning::could not read {repo}'s {MANIFEST}: {e}", file=err)
-    for warning in compare(own, others):
-        print(f"::warning::{warning}", file=err)
-    print(f"compared with {', '.join(sorted(others)) or 'no other repository'}", file=out)
-    return 1 if failures else 0
diff --git a/.github/buildcheck/tests/__init__.py b/.github/buildcheck/tests/__init__.py
deleted file mode 100644
index 4833295f..00000000
--- a/.github/buildcheck/tests/__init__.py
+++ /dev/null
@@ -1,3 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
diff --git a/.github/buildcheck/tests/helpers.py b/.github/buildcheck/tests/helpers.py
deleted file mode 100644
index 6e1a4bbf..00000000
--- a/.github/buildcheck/tests/helpers.py
+++ /dev/null
@@ -1,31 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""Shared fixtures of the buildcheck tests."""
-
-import os
-
-REPO = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
-
-
-def workflow_text(jobs):
-    """A workflow with the given jobs, each (name, needs, body lines)."""
-    lines = ["name: t", "on:", "  push:", "jobs:"]
-    for name, needs, body in jobs:
-        lines.append(f"  {name}:")
-        if needs is not None:
-            lines.append(f"    needs: {needs}")
-        lines.append("    runs-on: ubuntu-latest")
-        lines.append("    steps:")
-        lines += body
-    return "\n".join(lines) + "\n"
-
-
-def upload(artifact, path="x/", overwrite=False, if_no_files_found=None):
-    lines = ["      - uses: actions/upload-artifact@v7", "        with:", f"          name: {artifact}",
-             f"          path: {path}"]
-    if overwrite:
-        lines.append("          overwrite: true")
-    if if_no_files_found:
-        lines.append(f"          if-no-files-found: {if_no_files_found}")
-    return lines
diff --git a/.github/buildcheck/tests/test_releasegate.py b/.github/buildcheck/tests/test_releasegate.py
deleted file mode 100644
index 19fe7049..00000000
--- a/.github/buildcheck/tests/test_releasegate.py
+++ /dev/null
@@ -1,61 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-
-import os
-import unittest
-
-from buildcheck import releasegate, workflow
-from buildcheck.tests.helpers import REPO, workflow_text
-
-GATES = ("pub-a", "pub-b")
-
-
-def jobs(*extra):
-    return workflow.parse(workflow_text([("test", None, []), ("build", "test", []), *extra,
-                                         ("pub-a", "[build]", []), ("pub-b", "[build]", [])]))
-
-
-class ReleaseGateTest(unittest.TestCase):
-
-    def check(self, js, non_gating):
-        return releasegate.check(js, dict.fromkeys(non_gating, "reason"), GATES)
-
-    def test_transitively_gating_jobs_pass(self):
-        self.assertEqual(self.check(jobs(), ["pub-a", "pub-b"]), [])
-
-    def test_a_job_nothing_waits_for_fails(self):
-        self.assertEqual(self.check(jobs(("lint", None, [])), ["pub-a", "pub-b"]),
-                         ["publish.yml: pub-a, pub-b does not wait for lint -- add it to the needs, or to "
-                          "release-gate-exemptions.txt with the reason it may stay red"])
-
-    def test_gating_only_one_publish_job_fails(self):
-        js = workflow.parse(workflow_text([("lint", None, []), ("pub-a", "[lint]", []), ("pub-b", None, [])]))
-        self.assertEqual(len(self.check(js, ["pub-a", "pub-b"])), 1)
-
-    def test_a_listed_job_may_stay_outside(self):
-        self.assertEqual(self.check(jobs(("lint", None, [])), ["pub-a", "pub-b", "lint"]), [])
-
-    def test_a_stale_exemption_fails(self):
-        self.assertIn("remove the stale exemption", self.check(jobs(), ["pub-a", "pub-b", "build"])[0])
-        self.assertEqual(self.check(jobs(), ["pub-a", "pub-b", "gone"]),
-                         ["release-gate-exemptions.txt lists gone, which is no job of publish.yml"])
-
-    def test_reads_the_exemptions_file(self):
-        self.assertEqual(releasegate.read_exemptions("# c\n\na: why: because\n b :x\n"),
-                         {"a": "why: because", "b": "x"})
-
-    def test_an_exemption_without_a_reason_is_an_error(self):
-        for text in ("a\n", "a:\n", "a:  \n", ": x\n", "a: x\na: y\n"):
-            with self.subTest(text=text), self.assertRaises(ValueError):
-                releasegate.read_exemptions(text)
-
-    def test_the_repository_passes(self):
-        with open(os.path.join(REPO, ".github", "workflows", "publish.yml"), encoding="utf-8") as f:
-            jobs = workflow.parse(f.read())
-        with open(os.path.join(REPO, releasegate.EXEMPTIONS_FILE), encoding="utf-8") as f:
-            self.assertEqual(releasegate.check(jobs, releasegate.read_exemptions(f.read())), [])
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/.github/buildcheck/tests/test_runscripts.py b/.github/buildcheck/tests/test_runscripts.py
deleted file mode 100644
index 6f1ac186..00000000
--- a/.github/buildcheck/tests/test_runscripts.py
+++ /dev/null
@@ -1,127 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-
-import io
-import shutil
-import unittest
-
-from buildcheck import runscripts
-from buildcheck.tests.helpers import REPO, workflow_text
-
-BASH = shutil.which("bash")
-
-
-def shells(text):
-    return [(script.line, script.shell) for script in runscripts.scripts(text)]
-
-
-def texts(text):
-    return [script.text for script in runscripts.scripts(text)]
-
-
-class ValueTest(unittest.TestCase):
-
-    def test_literal_block_keeps_its_lines_and_drops_the_indentation(self):
-        text = workflow_text([("a", None, ["      - run: |", "          echo a \\", "            b", "",
-                                           "          echo c", "", "      - run: echo d"])])
-        self.assertEqual(texts(text), ["echo a \\\n  b\n\necho c", "echo d"])
-
-    def test_folded_block_joins_lines_and_keeps_the_more_indented_ones(self):
-        text = workflow_text([("a", None, ["      - run: >-", "          mvn -B", "          -DskipTests",
-                                           "            verify", "", "          echo done"])])
-        self.assertEqual(texts(text), ["mvn -B -DskipTests\n  verify\necho done"])
-
-    def test_plain_scalar_drops_its_comment_and_folds_its_continuation(self):
-        text = workflow_text([("a", None, ["      - run: mvn -B test  # the suite", "      - run: mvn -B",
-                                           "          -Dx=1", "      - name: n", "        run: echo '$#'"])])
-        self.assertEqual(texts(text), ["mvn -B test", "mvn -B -Dx=1", "echo '$#'"])
-
-    def test_single_quoted_is_unquoted_and_double_quoted_skipped(self):
-        text = workflow_text([("a", None, ["      - run: 'echo ''x'''", '      - run: "echo \\"x\\""'])])
-        self.assertEqual(texts(text), ["echo 'x'"])
-
-    def test_a_run_key_that_is_not_a_step_key_is_not_mistaken_for_one(self):
-        text = "name: t\non:\n  push:\n# run: | in a comment\njobs:\n  a:\n    runs-on: ubuntu-latest\n" \
-               "    steps:\n      - run: echo a\n"
-        self.assertEqual(texts(text), ["echo a"])
-
-
-class ShellTest(unittest.TestCase):
-
-    def test_step_shell_before_or_after_run(self):
-        text = workflow_text([("a", None, ["      - shell: pwsh", "        run: Get-Item x",
-                                           "      - run: |", "          dir", "        shell: cmd",
-                                           "      - run: echo a", "        shell: bash -el {0}",
-                                           "      - run: echo b", "        shell: C:\\msys64\\usr\\bin\\bash.exe -e {0}"])])
-        self.assertEqual([shell for _, shell in shells(text)], ["pwsh", "cmd", "bash", "bash"])
-
-    def test_windows_runner_defaults_to_powershell_others_to_bash(self):
-        text = workflow_text([("w", None, ["      - run: Get-Item x"]), ("u", None, ["      - run: ls"])])
-        text = text.replace("runs-on: ubuntu-latest", "runs-on: windows-2025-vs2026", 1)
-        self.assertEqual([shell for _, shell in shells(text)], ["pwsh", "bash"])
-
-    def test_a_runner_from_an_expression_is_windows_only_by_the_step_condition(self):
-        text = workflow_text([("m", None, ["      - if: runner.os == 'Windows'", "        run: Get-Item x",
-                                           "      - run: ls"])])
-        text = text.replace("ubuntu-latest", "${{ matrix.windows-runner }}")
-        self.assertEqual([shell for _, shell in shells(text)], ["pwsh", "bash"])
-
-    def test_job_defaults_win_over_workflow_defaults_and_both_over_the_runner(self):
-        text = workflow_text([("j", None, ["      - run: dir"]), ("k", None, ["      - run: Get-Item x"])])
-        text = text.replace("jobs:\n", "defaults:\n  run:\n    shell: pwsh\njobs:\n")
-        text = text.replace("  j:\n", "  j:\n    defaults:\n      run:\n        working-directory: x\n"
-                                      "        shell: cmd\n")
-        self.assertEqual([shell for _, shell in shells(text)], ["cmd", "pwsh"])
-
-    def test_composite_action_steps(self):
-        text = ("name: a\nruns:\n  using: composite\n  steps:\n    - name: x\n      shell: pwsh\n"
-                "      run: Get-Item x\n    - shell: bash\n      run: ls\n")
-        self.assertEqual(shells(text), [(7, "pwsh"), (9, "bash")])
-
-
-class CheckTest(unittest.TestCase):
-
-    def test_only_bash_scripts_reach_the_parser_and_an_unknown_shell_is_an_error(self):
-        seen = []
-        text = workflow_text([("a", None, ["      - run: ls", "      - run: Get-Item x", "        shell: pwsh",
-                                           "      - run: print(1)", "        shell: python",
-                                           "      - run: x", "        shell: fish {0}"])])
-        errors, checked = runscripts.check("w.yml", text, lambda s: seen.append(s))
-        self.assertEqual((seen, checked), (["ls"], 1))
-        self.assertEqual(errors, ["w.yml:13: unknown shell 'fish' -- add it to runscripts.py"])
-
-    @unittest.skipUnless(BASH, "bash not installed")
-    def test_a_lost_line_continuation_is_reported_at_its_line(self):
-        text = workflow_text([("a", None, ["      - run: |", "          echo ${{ github.sha }}",
-                                           "          grep -q x file", "            || exit 1"])])
-        errors, checked = runscripts.check("w.yml", text)
-        self.assertEqual(checked, 1)
-        self.assertEqual(len(errors), 1)
-        self.assertTrue(errors[0].startswith("w.yml:11: "), errors[0])
-        self.assertIn("`||'", errors[0])
-
-    @unittest.skipUnless(BASH, "bash not installed")
-    def test_continued_lines_expressions_and_heredocs_parse(self):
-        text = workflow_text([("a", None, ["      - run: |", "          grep -q x file \\",
-                                           "            || exit 1", "          cat <<EOF",
-                                           "          ${{ toJSON(matrix) }}", "          EOF",
-                                           "      - run: >", "          echo a", "          && echo b"])])
-        self.assertEqual(runscripts.check("w.yml", text), ([], 2))
-
-    @unittest.skipUnless(BASH, "bash not installed")
-    def test_main_refuses_arguments(self):
-        self.assertEqual(runscripts.main(["x", "-v"], REPO, err=io.StringIO()), 2)
-
-
-class RepositoryTest(unittest.TestCase):
-
-    @unittest.skipUnless(BASH, "bash not installed")
-    def test_every_bash_script_of_this_repository_parses(self):
-        out, err = io.StringIO(), io.StringIO()
-        self.assertEqual(runscripts.main(["x"], REPO, out, err), 0, err.getvalue())
-        self.assertNotIn(" 0 bash run scripts", out.getvalue())
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/.github/buildcheck/tests/test_sharedfiles.py b/.github/buildcheck/tests/test_sharedfiles.py
deleted file mode 100644
index 2fe0d9d5..00000000
--- a/.github/buildcheck/tests/test_sharedfiles.py
+++ /dev/null
@@ -1,209 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-
-import hashlib
-import io
-import os
-import tempfile
-import unittest
-from unittest import mock
-
-from buildcheck import sharedfiles
-from buildcheck.tests.helpers import REPO
-
-A = hashlib.sha256(b"a").hexdigest()
-B = hashlib.sha256(b"b").hexdigest()
-
-
-class ParseTest(unittest.TestCase):
-
-    def test_reads_sha256sum_lines_and_skips_comments(self):
-        text = f"# header\n\n{A}  x/one.sh\n{B} *two.py\n"
-        self.assertEqual(sharedfiles.parse(text), {"x/one.sh": A, "two.py": B})
-
-    def test_rejects_malformed_and_duplicate_lines(self):
-        for text in ("nonsense\n", f"{A[:-1]}  x\n", f"{A}  x\n{B}  x\n"):
-            with self.subTest(text=text), self.assertRaises(ValueError):
-                sharedfiles.parse(text)
-
-
-class TreeTest(unittest.TestCase):
-
-    def setUp(self):
-        self.root = tempfile.mkdtemp()
-        os.makedirs(os.path.join(self.root, ".github"))
-        with open(os.path.join(self.root, "one.sh"), "wb") as f:
-            f.write(b"a")
-
-    def manifest(self, text):
-        with open(os.path.join(self.root, sharedfiles.MANIFEST), "w", encoding="utf-8", newline="") as f:
-            f.write(text)
-
-    def run_main(self, *args, others=None):
-        out, err = io.StringIO(), io.StringIO()
-        others = others or {}
-
-        def fetcher(repo):
-            if repo not in others:
-                raise OSError("unreachable")
-            return others[repo]
-        code = sharedfiles.main(["x", *args], self.root, fetcher, out, err)
-        return code, err.getvalue()
-
-    def test_an_unchanged_file_passes(self):
-        self.manifest(f"# h\n{A}  one.sh\n")
-        self.assertEqual(self.run_main("--offline"), (0, ""))
-
-    def test_a_file_changed_alone_or_missing_fails(self):
-        self.manifest(f"{B}  one.sh\n{A}  gone.sh\n")
-        code, err = self.run_main("--offline")
-        self.assertEqual(code, 1)
-        self.assertIn("one.sh differs", err)
-        self.assertIn("gone.sh is listed", err)
-
-    def test_write_recomputes_the_hashes_and_keeps_the_comments(self):
-        self.manifest(f"# keep me\n{B}  one.sh\n")
-        self.assertEqual(self.run_main("--write")[0], 0)
-        with open(os.path.join(self.root, sharedfiles.MANIFEST), encoding="utf-8") as f:
-            self.assertEqual(f.read(), f"# keep me\n{A}  one.sh\n")
-
-    def test_sibling_differences_are_warnings_not_failures(self):
-        self.manifest(f"{A}  one.sh\n")
-        others = {"srcmorph": f"{B}  one.sh\n", "streambuffer": f"{A}  one.sh\n"}
-        # Pinned: the repository being checked is never fetched, and unpinned it came from
-        # GITHUB_REPOSITORY -- so in BitcoinAddressFinder's own CI the unreachable sibling this
-        # test expects was skipped and the test failed there alone.
-        with mock.patch.object(sharedfiles, "current_repo", return_value="java-llama.cpp"):
-            code, err = self.run_main(others=others)
-        self.assertEqual(code, 0)
-        self.assertIn("::warning::one.sh differs from srcmorph's one.sh", err)
-        self.assertNotIn("streambuffer's", err)
-        self.assertIn("could not read BitcoinAddressFinder", err)
-        self.assertNotIn("java-llama.cpp", err)
-
-    def test_unknown_arguments(self):
-        self.manifest("")
-        self.assertEqual(self.run_main("--nope")[0], 2)
-
-
-WORKFLOW = """name: t
-on:
-  push:
-jobs:
-  first:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo one
-
-  # a comment about the second job belongs to the second job
-  second:
-    needs: first
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo two
-"""
-FIRST = "  first:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo one\n"
-
-
-class JobEntryTest(unittest.TestCase):
-
-    def setUp(self):
-        self.root = tempfile.mkdtemp()
-        os.makedirs(os.path.join(self.root, ".github", "workflows"))
-        self.write(WORKFLOW)
-
-    def write(self, text):
-        with open(os.path.join(self.root, ".github/workflows/w.yml"), "w", encoding="utf-8", newline="") as f:
-            f.write(text)
-
-    def test_a_job_entry_hashes_the_job_alone(self):
-        self.assertEqual(sharedfiles.content(self.root, ".github/workflows/w.yml#first"), FIRST.encode())
-        self.assertEqual(sharedfiles.sha256(self.root, ".github/workflows/w.yml#first"),
-                         hashlib.sha256(FIRST.encode()).hexdigest())
-
-    def test_the_comment_before_the_next_job_is_not_part_of_the_job(self):
-        self.write(WORKFLOW.replace("belongs to the second job", "was reworded"))
-        self.assertEqual(sharedfiles.content(self.root, ".github/workflows/w.yml#first"), FIRST.encode())
-
-    def test_a_change_inside_the_job_is_seen_and_one_elsewhere_is_not(self):
-        entry = ".github/workflows/w.yml#first"
-        entries = {entry: sharedfiles.sha256(self.root, entry)}
-        self.write(WORKFLOW.replace("echo two", "echo three"))
-        self.assertEqual(sharedfiles.verify(self.root, entries), [])
-        self.write(WORKFLOW.replace("echo one", "echo changed"))
-        self.assertIn("differs from its line", sharedfiles.verify(self.root, entries)[0])
-
-    def test_a_missing_job_or_workflow_is_reported(self):
-        entries = {".github/workflows/w.yml#gone": A, ".github/workflows/x.yml#first": A}
-        failures = sharedfiles.verify(self.root, entries)
-        self.assertEqual(len(failures), 2)
-        self.assertTrue(all("does not exist" in f for f in failures), failures)
-
-    def test_write_refuses_an_entry_that_does_not_exist(self):
-        with self.assertRaises(ValueError):
-            sharedfiles.rewrite(f"{A}  .github/workflows/w.yml#gone\n", self.root)
-
-
-class RepoEntryTest(unittest.TestCase):
-
-    def setUp(self):
-        self.root = tempfile.mkdtemp()
-        os.makedirs(os.path.join(self.root, ".github", "workflows"))
-        self.write("SUPPORT.md", "Issues: https://github.com/o/streambuffer/issues\n")
-        self.write(".github/workflows/w.yml", WORKFLOW.replace("echo one", "echo streambuffer"))
-        patcher = mock.patch.object(sharedfiles, "current_repo", return_value="streambuffer")
-        patcher.start()
-        self.addCleanup(patcher.stop)
-
-    def write(self, path, text):
-        with open(os.path.join(self.root, path), "w", encoding="utf-8", newline="") as f:
-            f.write(text)
-
-    def test_the_repository_name_is_replaced_by_a_placeholder(self):
-        self.assertEqual(sharedfiles.content(self.root, "SUPPORT.md?repo"), b"Issues: https://github.com/o/{repo}/issues\n")
-        self.assertEqual(sharedfiles.content(self.root, ".github/workflows/w.yml#first?repo"),
-                         FIRST.replace("echo one", "echo {repo}").encode())
-
-    def test_two_repositories_differing_only_in_their_name_hash_alike(self):
-        here = sharedfiles.sha256(self.root, "SUPPORT.md?repo")
-        with mock.patch.object(sharedfiles, "current_repo", return_value="srcmorph"):
-            self.write("SUPPORT.md", "Issues: https://github.com/o/srcmorph/issues\n")
-            self.assertEqual(sharedfiles.sha256(self.root, "SUPPORT.md?repo"), here)
-            self.write("SUPPORT.md", "Bugs: https://github.com/o/srcmorph/issues\n")
-            self.assertNotEqual(sharedfiles.sha256(self.root, "SUPPORT.md?repo"), here)
-
-    def test_a_missing_file_stays_missing(self):
-        self.assertIsNone(sharedfiles.content(self.root, "GONE.md?repo"))
-
-
-class CompareTest(unittest.TestCase):
-
-    def test_matches_by_path_then_by_a_unique_file_name(self):
-        own = {"llama/lombok.config": A, "a/__init__.py": A}
-        self.assertEqual(sharedfiles.compare(own, {"r": {"lombok.config": B}}),
-                         ["llama/lombok.config differs from r's lombok.config: finish or redo the sync"])
-        # two candidates of the same name: no guess
-        self.assertEqual(sharedfiles.compare(own, {"r": {"b/__init__.py": B, "c/__init__.py": B}}), [])
-        # a file the other repository does not share is no difference
-        self.assertEqual(sharedfiles.compare(own, {"r": {}}), [])
-
-
-class RepositoryTest(unittest.TestCase):
-
-    def test_this_repository_matches_its_manifest(self):
-        with open(os.path.join(REPO, sharedfiles.MANIFEST), encoding="utf-8") as f:
-            entries = sharedfiles.parse(f.read())
-        self.assertEqual(sharedfiles.verify(REPO, entries), [])
-
-    def test_the_shared_build_checks_list_themselves(self):
-        with open(os.path.join(REPO, sharedfiles.MANIFEST), encoding="utf-8") as f:
-            entries = sharedfiles.parse(f.read())
-        for path in (".github/buildcheck/sharedfiles.py", ".github/check-shared-files.py",
-                     ".github/buildcheck/tests/test_sharedfiles.py",
-                     ".github/workflows/publish.yml#shared-files"):
-            self.assertIn(path, entries)
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/.github/buildcheck/tests/test_versions.py b/.github/buildcheck/tests/test_versions.py
deleted file mode 100644
index 3504e253..00000000
--- a/.github/buildcheck/tests/test_versions.py
+++ /dev/null
@@ -1,161 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-
-import io
-import os
-import tempfile
-import unittest
-from unittest import mock
-
-from buildcheck import versions
-from buildcheck.tests.helpers import REPO
-
-
-def pom(body, properties=""):
-    return (f'<project xmlns="http://maven.apache.org/POM/4.0.0"><properties>{properties}</properties>'
-            f'{body}</project>')
-
-
-PARENT = pom("", "<junit.version>6.1.3</junit.version><nested>${junit.version}</nested><palantir>2.99.0</palantir>")
-CHILD = pom("""<dependencies>
-  <dependency><groupId>org.junit.jupiter</groupId><artifactId>junit-jupiter</artifactId>
-    <version>${junit.version}</version></dependency>
-  <dependency><groupId>a</groupId><artifactId>nested</artifactId><version>${nested}</version></dependency>
-  <dependency><groupId>a</groupId><artifactId>unresolved</artifactId><version>${nowhere}</version></dependency>
-  <dependency><groupId>a</groupId><artifactId>managed</artifactId></dependency>
-  <dependency><groupId>net.ladenthin</groupId><artifactId>llama</artifactId><version>5.2.0</version></dependency>
-</dependencies>
-<build><plugins><plugin><artifactId>maven-jar-plugin</artifactId><version>3.5.0</version>
-  <configuration><annotationProcessorPaths><path><groupId>com.google.errorprone</groupId>
-    <artifactId>error_prone_core</artifactId><version>2.50.0</version></path></annotationProcessorPaths>
-  </configuration></plugin>
-  <plugin><groupId>com.diffplug.spotless</groupId><artifactId>spotless-maven-plugin</artifactId><version>3.10.3</version>
-    <configuration><java><palantirJavaFormat><version>${palantir}</version></palantirJavaFormat></java></configuration>
-  </plugin></plugins></build>""")
-
-
-class CoordinatesTest(unittest.TestCase):
-
-    def test_reads_plugins_dependencies_and_processor_paths_with_properties_resolved(self):
-        self.assertEqual(versions.coordinates([PARENT, CHILD]), {
-            "org.junit.jupiter:junit-jupiter": {"6.1.3"},
-            "a:nested": {"6.1.3"},
-            "org.apache.maven.plugins:maven-jar-plugin": {"3.5.0"},
-            "com.google.errorprone:error_prone_core": {"2.50.0"},
-            "com.diffplug.spotless:spotless-maven-plugin": {"3.10.3"},
-            "com.palantir.javaformat:palantir-java-format": {"2.99.0"},
-        })
-
-    def test_a_repository_using_two_versions_of_one_coordinate_keeps_both(self):
-        other = pom('<dependencies><dependency><groupId>org.junit.jupiter</groupId>'
-                    '<artifactId>junit-jupiter</artifactId><version>6.0.0</version></dependency></dependencies>')
-        self.assertEqual(versions.coordinates([PARENT, CHILD, other])["org.junit.jupiter:junit-jupiter"],
-                         {"6.0.0", "6.1.3"})
-
-
-class CompareTest(unittest.TestCase):
-
-    def test_only_coordinates_both_use_and_only_differences(self):
-        own = {"j:u": {"1"}, "s:p": {"2"}, "only:here": {"3"}}
-        others = {"r1": {"j:u": {"1"}, "s:p": {"9"}}, "r2": {"only:there": {"4"}}}
-        self.assertEqual(versions.compare(own, others),
-                         ["s:p is 2 here and 9 in r1: bump it in every repository"])
-
-
-class GradleKotlinTest(unittest.TestCase):
-
-    def test_plugins_are_read_from_every_kts_file_outside_build_output(self):
-        with tempfile.TemporaryDirectory() as root:
-            os.makedirs(os.path.join(root, "app", "build"))
-            with open(os.path.join(root, "app", "build.gradle.kts"), "w", encoding="utf-8") as f:
-                f.write('plugins {\n    id("com.android.application") version "9.4.0"\n'
-                        '    id("org.jetbrains.kotlin.plugin.compose") version "2.4.20"\n'
-                        '    kotlin("jvm") version "2.4.21"\n}\n')
-            with open(os.path.join(root, "app", "build", "stale.gradle.kts"), "w", encoding="utf-8") as f:
-                f.write('kotlin("jvm") version "1.0.0"\n')
-            self.assertEqual(versions.gradle_kotlin_plugins(root), [
-                ("app/build.gradle.kts", "org.jetbrains.kotlin.plugin.compose", "2.4.20"),
-                ("app/build.gradle.kts", "org.jetbrains.kotlin.jvm", "2.4.21"),
-            ])
-
-    def test_a_plugin_behind_the_poms_kotlin_is_a_warning_and_nothing_else_is(self):
-        own = {"org.jetbrains.kotlin:kotlin-stdlib": {"2.4.21"}, "org.jetbrains.kotlinx:kotlinx-coroutines-core": {"1.11.0"}}
-        plugins = [("app/build.gradle.kts", "org.jetbrains.kotlin.plugin.compose", "2.4.20"),
-                   ("app/build.gradle.kts", "org.jetbrains.kotlin.jvm", "2.4.21")]
-        self.assertEqual(versions.compare_gradle_kotlin(own, plugins), [
-            "org.jetbrains.kotlin.plugin.compose is 2.4.20 in app/build.gradle.kts and the POMs use Kotlin 2.4.21: "
-            "Dependabot bumps only the POMs, bump the Gradle plugin with them"])
-        self.assertEqual(versions.compare_gradle_kotlin({"a:b": {"1"}}, plugins), [])
-        self.assertEqual(versions.compare_gradle_kotlin(own, []), [])
-
-
-class MainTest(unittest.TestCase):
-
-    def run_main(self, siblings):
-        out, err = io.StringIO(), io.StringIO()
-
-        def fetcher(repo, path):
-            if repo not in siblings:
-                raise OSError("unreachable")
-            return siblings[repo]
-        with mock.patch.object(versions, "current_repo", return_value="streambuffer"), \
-                mock.patch.object(versions, "read_local", return_value=[PARENT, CHILD]):
-            code = versions.main(["x"], "/nowhere", fetcher, out, err)
-        return code, out.getvalue(), err.getvalue()
-
-    def test_differences_are_warnings_and_never_fail(self):
-        bumped = pom('<dependencies><dependency><groupId>org.junit.jupiter</groupId>'
-                     '<artifactId>junit-jupiter</artifactId><version>6.1.4</version></dependency></dependencies>')
-        code, out, err = self.run_main({"srcmorph": bumped, "BitcoinAddressFinder": CHILD.replace(
-            "${junit.version}", "6.1.3").replace("${nested}", "6.1.3")})
-        self.assertEqual(code, 0)
-        self.assertIn("::warning::org.junit.jupiter:junit-jupiter is 6.1.3 here and 6.1.4 in srcmorph", err)
-        self.assertIn("could not read java-llama.cpp's pom.xml", err)
-        self.assertNotIn("BitcoinAddressFinder:", err)
-        self.assertIn("1 version differences", out)
-
-    def test_a_gradle_kotlin_plugin_behind_the_poms_is_reported_with_the_other_warnings(self):
-        kotlin = pom('<dependencies><dependency><groupId>org.jetbrains.kotlin</groupId>'
-                     '<artifactId>kotlin-stdlib</artifactId><version>2.4.21</version></dependency></dependencies>')
-        out, err = io.StringIO(), io.StringIO()
-        with mock.patch.object(versions, "current_repo", return_value="java-llama.cpp"), \
-                mock.patch.object(versions, "read_local", return_value=[kotlin]), \
-                mock.patch.object(versions, "gradle_kotlin_plugins", return_value=[
-                    ("android-llmservice/app/build.gradle.kts", "org.jetbrains.kotlin.plugin.compose", "2.4.20")]):
-            self.assertEqual(versions.main(["x"], "/nowhere", lambda repo, path: kotlin, out, err), 0)
-        self.assertIn("::warning::org.jetbrains.kotlin.plugin.compose is 2.4.20 in android-llmservice/app/build.gradle.kts "
-                      "and the POMs use Kotlin 2.4.21", err.getvalue())
-        self.assertIn("1 version differences", out.getvalue())
-
-    def test_a_missing_pom_skips_that_file_not_the_repository(self):
-        out, err = io.StringIO(), io.StringIO()
-        bumped = pom('<dependencies><dependency><groupId>org.junit.jupiter</groupId>'
-                     '<artifactId>junit-jupiter</artifactId><version>6.1.4</version></dependency></dependencies>')
-
-        def fetcher(repo, path):
-            if repo == "srcmorph" and path == "pom.xml":
-                return bumped
-            raise OSError("404")
-        with mock.patch.object(versions, "current_repo", return_value="streambuffer"), \
-                mock.patch.object(versions, "read_local", return_value=[PARENT, CHILD]):
-            self.assertEqual(versions.main(["x"], "/nowhere", fetcher, out, err), 0)
-        self.assertIn("could not read srcmorph's srcmorph/pom.xml", err.getvalue())
-        self.assertIn("6.1.4 in srcmorph", err.getvalue())
-
-    def test_arguments_are_refused(self):
-        self.assertEqual(versions.main(["x", "--offline"], REPO, err=io.StringIO()), 2)
-
-
-class RepositoryTest(unittest.TestCase):
-
-    def test_this_repository_s_poms_are_listed_and_readable(self):
-        repo = versions.current_repo(REPO)
-        if repo not in versions.POMS:
-            self.skipTest(f"checked out as {repo}, not under its repository name")
-        found = versions.coordinates(versions.read_local(REPO, repo))
-        self.assertTrue(found, "no versioned coordinate found -- the POM list in versions.POMS is stale")
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/.github/buildcheck/tests/test_workflow.py b/.github/buildcheck/tests/test_workflow.py
deleted file mode 100644
index b9bf48d8..00000000
--- a/.github/buildcheck/tests/test_workflow.py
+++ /dev/null
@@ -1,70 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-
-import os
-import unittest
-
-from buildcheck import workflow
-from buildcheck.tests.helpers import REPO, upload, workflow_text
-
-
-class ParseTest(unittest.TestCase):
-
-    def test_reads_every_needs_shape(self):
-        text = workflow_text([
-            ("a", None, []),
-            ("b", "a", []),
-            ("c", "[a, b]", []),
-            ("d", "", []),
-        ]).replace("    needs: \n", "    needs:\n      - a\n      - c  # why\n")
-        jobs = workflow.parse(text)
-        self.assertEqual(list(jobs), ["a", "b", "c", "d"])
-        self.assertEqual(jobs["a"].needs, [])
-        self.assertEqual(jobs["b"].needs, ["a"])
-        self.assertEqual(jobs["c"].needs, ["a", "b"])
-        self.assertEqual(jobs["d"].needs, ["a", "c"])
-
-    def test_keys_outside_jobs_are_not_jobs(self):
-        jobs = workflow.parse(workflow_text([("a", None, [])]) + "env:\n  X: 1\n")
-        self.assertEqual(list(jobs), ["a"])
-
-    def test_unknown_need_is_an_error(self):
-        with self.assertRaisesRegex(ValueError, "needs nope"):
-            workflow.parse(workflow_text([("a", "nope", [])]))
-
-    def test_unreadable_needs_is_an_error_not_a_guess(self):
-        with self.assertRaisesRegex(ValueError, "cannot read needs"):
-            workflow.parse(workflow_text([("a", None, []), ("b", "${{ fromJSON(x) }}", [])]))
-
-    def test_uploads_reads_the_artifact_name_not_the_step_name(self):
-        body = ["      - name: Upload something", "        if: always()",
-                "        uses: actions/upload-artifact@v7"] + upload("natives-x")[1:] \
-            + ["      - run: echo name: fake"] + upload("second")
-        job = workflow.parse(workflow_text([("a", None, body)]))["a"]
-        self.assertEqual(job.uploads(), ["natives-x", "second"])
-
-    def test_closure_is_transitive_and_excludes_the_job(self):
-        jobs = workflow.parse(workflow_text([("a", None, []), ("b", "a", []), ("c", "[b]", []), ("x", None, [])]))
-        self.assertEqual(workflow.closure(jobs, "c"), {"a", "b"})
-        self.assertEqual(workflow.closure(jobs, "a"), set())
-
-
-class RepositoryWorkflowsTest(unittest.TestCase):
-
-    def test_every_workflow_of_the_repository_parses(self):
-        folder = os.path.join(REPO, ".github", "workflows")
-        for name in sorted(os.listdir(folder)):
-            with self.subTest(name):
-                with open(os.path.join(folder, name), encoding="utf-8") as f:
-                    self.assertTrue(workflow.parse(f.read()))
-
-    def test_publish_has_both_publish_jobs_and_they_wait_for_something(self):
-        with open(os.path.join(REPO, ".github", "workflows", "publish.yml"), encoding="utf-8") as f:
-            jobs = workflow.parse(f.read())
-        for gate in ("publish-snapshot", "publish-release"):
-            self.assertGreater(len(workflow.closure(jobs, gate)), 3, gate)
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/.github/buildcheck/versions.py b/.github/buildcheck/versions.py
deleted file mode 100644
index 58b6bfad..00000000
--- a/.github/buildcheck/versions.py
+++ /dev/null
@@ -1,181 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""The Maven dependencies and plugins java-llama.cpp, BitcoinAddressFinder, srcmorph and streambuffer
-have in common, compared across the repositories: a warning per coordinate whose version differs.
-
-The four repositories pin the same build tooling (JUnit, Error Prone, NullAway, Spotless, SpotBugs,
-JaCoCo, the Maven plugins, ...), and Dependabot bumps each repository on its own, so they drift one
-pull request at a time. This check makes the drift visible in every repository's `shared-files`
-job. It compares what the POMs actually USE -- every `groupId:artifactId` of a plugin, dependency or
-annotation-processor path with its version, plus the formatter version Spotless is configured with,
-`${property}` references resolved -- not property
-names, which differ between repositories and include values that must differ (the Java release).
-
-It also compares the Kotlin the POMs use with every Kotlin Gradle plugin a `*.gradle.kts` of the
-repository pins: Dependabot's maven ecosystem bumps `kotlin.version` and never sees the Gradle files,
-which is how a Compose compiler plugin stayed one patch release behind the POMs.
-
-Warnings, never failures: a bump lands in four pull requests, and the first one merged would
-otherwise turn the other three repositories red. The repository's own artifacts
-(`net.ladenthin:*`) are left out: a sibling depends on the last RELEASE of java-llama.cpp while
-java-llama.cpp itself is at the next snapshot.
-"""
-
-import os
-import re
-import sys
-import urllib.request
-import xml.etree.ElementTree as ET
-
-from .sharedfiles import OWNER, REPOS, current_repo
-
-NS = "{http://maven.apache.org/POM/4.0.0}"
-POMS = {
-    "java-llama.cpp": ("pom.xml", "llama/pom.xml", "llama-langchain4j/pom.xml", "llama-kotlin/pom.xml", "llama-ffm/pom.xml",
-                       "llama-platform/pom.xml", "llama-atmosphere-agent/pom.xml", "examples/server/pom.xml"),
-    "BitcoinAddressFinder": ("pom.xml",),
-    "srcmorph": ("pom.xml", "srcmorph/pom.xml", "srcmorph-cli/pom.xml", "srcmorph-maven-plugin/pom.xml"),
-    "streambuffer": ("pom.xml",),
-}
-OWN_GROUP = "net.ladenthin"
-DEFAULT_PLUGIN_GROUP = "org.apache.maven.plugins"
-VERSIONED = ("plugin", "dependency", "path", "annotationProcessorPath")
-# Versions a plugin's <configuration> names without coordinates: Spotless takes its formatter as
-# <palantirJavaFormat><version>. The versions plugin cannot see those, which is how palantir fell
-# behind unnoticed more than once (workspace crossrepostatus, "Tool versions").
-CONFIGURED = {"palantirJavaFormat": "com.palantir.javaformat:palantir-java-format"}
-RAW_URL = "https://raw.githubusercontent.com/{owner}/{repo}/HEAD/{path}"
-PROPERTY = re.compile(r"\$\{([^}]+)\}")
-KOTLIN_GROUP = "org.jetbrains.kotlin"
-# `id("org.jetbrains.kotlin.plugin.compose") version "2.4.21"` and `kotlin("jvm") version "2.4.21"`
-GRADLE_KOTLIN = re.compile(
-    r'(?:id\("(org\.jetbrains\.kotlin(?:\.[A-Za-z.]+)?)"\)|kotlin\("([A-Za-z.]+)"\))\s+version\s+"([^"]+)"')
-SKIPPED_DIRS = {".git", ".gradle", ".idea", "build", "node_modules", "target"}
-
-
-def coordinates(pom_texts):
-    """groupId:artifactId -> set of versions used across the POMs of one repository. Properties
-    are looked up across all of them (a child module uses its parent's), up to a few levels deep;
-    a version that does not resolve to a literal is left out."""
-    roots = [ET.fromstring(text) for text in pom_texts]
-    props = {}
-    for root in roots:
-        for element in root.findall(NS + "properties/*"):
-            props[element.tag[len(NS):]] = (element.text or "").strip()
-
-    def resolve(value):
-        for _ in range(5):
-            match = PROPERTY.fullmatch(value)
-            if not match or match.group(1) not in props:
-                break
-            value = props[match.group(1)]
-        return None if "${" in value else value
-
-    found = {}
-    for root in roots:
-        for element in root.iter():
-            tag = element.tag[len(NS):]
-            if tag in CONFIGURED:
-                version = resolve((element.findtext(NS + "version") or "").strip())
-                if version:
-                    found.setdefault(CONFIGURED[tag], set()).add(version)
-                continue
-            if tag not in VERSIONED:
-                continue
-            artifact, version = element.findtext(NS + "artifactId"), element.findtext(NS + "version")
-            if not artifact or not version:
-                continue
-            group = (element.findtext(NS + "groupId") or DEFAULT_PLUGIN_GROUP).strip()
-            version = resolve(version.strip())
-            if version and group != OWN_GROUP:
-                found.setdefault(f"{group}:{artifact.strip()}", set()).add(version)
-    return found
-
-
-def compare(own, others):
-    """Warnings for every coordinate another repository uses in a different version."""
-    warnings = []
-    for repo, theirs in sorted(others.items()):
-        for coordinate in sorted(set(own) & set(theirs)):
-            if own[coordinate] != theirs[coordinate]:
-                warnings.append(f"{coordinate} is {', '.join(sorted(own[coordinate]))} here and "
-                                f"{', '.join(sorted(theirs[coordinate]))} in {repo}: bump it in every repository")
-    return warnings
-
-
-def gradle_kotlin_plugins(root):
-    """(path, plugin id, version) for every Kotlin Gradle plugin a `*.gradle.kts` below root pins, in
-    path order; build output and the tools' own directories are not searched."""
-    found = []
-    for dirpath, dirnames, filenames in os.walk(root):
-        dirnames[:] = sorted(d for d in dirnames if d not in SKIPPED_DIRS)
-        for name in sorted(filenames):
-            if not name.endswith(".gradle.kts"):
-                continue
-            path = os.path.join(dirpath, name)
-            with open(path, encoding="utf-8") as f:
-                text = f.read()
-            for match in GRADLE_KOTLIN.finditer(text):
-                plugin = match.group(1) or f"{KOTLIN_GROUP}.{match.group(2)}"
-                found.append((os.path.relpath(path, root).replace(os.sep, "/"), plugin, match.group(3)))
-    return found
-
-
-def compare_gradle_kotlin(own, plugins):
-    """Warnings for every Kotlin Gradle plugin whose version is not one the POMs use for
-    `org.jetbrains.kotlin:*`; nothing when the POMs use no Kotlin or no Gradle file pins a plugin."""
-    maven = set()
-    for coordinate, used in own.items():
-        if coordinate.startswith(KOTLIN_GROUP + ":"):
-            maven |= used
-    if not maven:
-        return []
-    return [f"{plugin} is {version} in {path} and the POMs use Kotlin {', '.join(sorted(maven))}: "
-            f"Dependabot bumps only the POMs, bump the Gradle plugin with them"
-            for path, plugin, version in plugins if version not in maven]
-
-
-def fetch(repo, path):
-    with urllib.request.urlopen(RAW_URL.format(owner=OWNER, repo=repo, path=path), timeout=20) as response:
-        return response.read().decode("utf-8")
-
-
-def read_local(root, repo):
-    texts = []
-    for path in POMS[repo]:
-        with open(f"{root}/{path}", encoding="utf-8") as f:
-            texts.append(f.read())
-    return texts
-
-
-def main(argv, root, fetcher=fetch, out=sys.stdout, err=sys.stderr):
-    """check-versions.py -- compare with the siblings' default branches (warnings only)"""
-    if argv[1:]:
-        print(main.__doc__, file=err)
-        return 2
-    repo = current_repo(root)
-    if repo not in POMS:
-        print(f"::error::{repo} is not one of {', '.join(REPOS)}", file=err)
-        return 2
-    own = coordinates(read_local(root, repo))
-    others = {}
-    for sibling in REPOS:
-        if sibling == repo:
-            continue
-        texts = []
-        for path in POMS[sibling]:
-            try:
-                texts.append(fetcher(sibling, path))
-            except Exception as e:  # noqa: BLE001 -- a sibling that cannot be read is a warning, never a red
-                print(f"::warning::could not read {sibling}'s {path}: {e}", file=err)
-        if texts:
-            others[sibling] = coordinates(texts)
-    warnings = compare(own, others) + compare_gradle_kotlin(own, gradle_kotlin_plugins(root))
-    for warning in warnings:
-        print(f"::warning::{warning}", file=err)
-    shared = set(own).intersection(*others.values()) if others else set()
-    print(f"{len(own)} versioned coordinates here, {len(shared)} used by every repository read, "
-          f"{len(warnings)} version differences (compared with {', '.join(sorted(others)) or 'no other repository'})",
-          file=out)
-    return 0
diff --git a/.github/buildcheck/workflow.py b/.github/buildcheck/workflow.py
deleted file mode 100644
index de7055a6..00000000
--- a/.github/buildcheck/workflow.py
+++ /dev/null
@@ -1,120 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""The part of a GitHub Actions workflow the checks need: its jobs, their `needs`, the artifacts
-they upload and the text of their steps.
-
-Deliberately not a YAML parser. The runners' Python has no PyYAML guaranteed, and the checks
-need only the job graph, which the workflow writes in two fixed shapes: jobs at two spaces of
-indentation below `jobs:`, and `needs:` at four, either inline (`needs: a` / `needs: [a, b]`) or
-as a block list (`- a` at six). A workflow written any other way is reported by `parse`, never
-misread silently: every job must be found, and a `needs:` that matches neither shape fails.
-"""
-
-import re
-
-JOB = re.compile(r"^  ([A-Za-z0-9_-]+):\s*(#.*)?$")
-NEEDS = re.compile(r"^    needs:\s*(.*?)\s*(#.*)?$")
-NEEDS_ITEM = re.compile(r"^      - ([A-Za-z0-9_-]+)\s*(#.*)?$")
-STEP = re.compile(r"^      - ")
-
-
-class Job:
-    """One job: its id, the jobs it needs, and its lines (the job header included)."""
-
-    def __init__(self, name):
-        self.name = name
-        self.needs = []
-        self.lines = []
-
-    @property
-    def text(self):
-        return "\n".join(self.lines)
-
-    def steps(self):
-        """The job's steps, each as a list of lines (a step starts at `      - `)."""
-        out = []
-        for line in self.lines:
-            if STEP.match(line):
-                out.append([line])
-            elif out:
-                out[-1].append(line)
-        return out
-
-    def uploads(self):
-        """The names of the artifacts the job uploads (upload-artifact's `with: name:`)."""
-        names = []
-        for step in self.steps():
-            if not any("actions/upload-artifact@" in line for line in step):
-                continue
-            with_indent = None
-            for line in step:
-                stripped = line.lstrip()
-                indent = len(line) - len(stripped)
-                if stripped.startswith("with:"):
-                    with_indent = indent
-                elif with_indent is not None and indent > with_indent and stripped.startswith("name:"):
-                    names.append(stripped[len("name:"):].strip().strip("'\""))
-                    break
-                elif with_indent is not None and indent <= with_indent:
-                    with_indent = None
-        return names
-
-
-def parse(text):
-    """Jobs by id, in file order. Raises ValueError on a `needs:` in a shape it does not read."""
-    jobs = {}
-    in_jobs = False
-    current = None
-    block_needs = False
-    for number, line in enumerate(text.splitlines(), 1):
-        if line and not line[0].isspace() and not line.startswith("#"):
-            in_jobs = line.rstrip() == "jobs:"
-            current = None
-            continue
-        if not in_jobs:
-            continue
-        match = JOB.match(line)
-        if match:
-            current = jobs[match.group(1)] = Job(match.group(1))
-            current.lines.append(line)
-            block_needs = False
-            continue
-        if current is None:
-            continue
-        current.lines.append(line)
-        match = NEEDS.match(line)
-        if match:
-            value = match.group(1)
-            if value == "":
-                block_needs = True
-            elif value.startswith("[") and value.endswith("]"):
-                current.needs += [n.strip() for n in value[1:-1].split(",") if n.strip()]
-            elif re.fullmatch(r"[A-Za-z0-9_-]+", value):
-                current.needs.append(value)
-            else:
-                raise ValueError(f"line {number}: cannot read needs of job {current.name}: {value!r}")
-            continue
-        if block_needs:
-            item = NEEDS_ITEM.match(line)
-            if item:
-                current.needs.append(item.group(1))
-            elif line.strip() and not line.lstrip().startswith("#"):
-                block_needs = False
-    for job in jobs.values():
-        for need in job.needs:
-            if need not in jobs:
-                raise ValueError(f"job {job.name} needs {need}, which is no job of this workflow")
-    return jobs
-
-
-def closure(jobs, name):
-    """Every job `name` waits for, directly or through another job (itself excluded)."""
-    seen = set()
-    todo = list(jobs[name].needs)
-    while todo:
-        need = todo.pop()
-        if need not in seen:
-            seen.add(need)
-            todo += jobs[need].needs
-    return seen
diff --git a/.github/check-release-gate.py b/.github/check-release-gate.py
deleted file mode 100755
index 447256fe..00000000
--- a/.github/check-release-gate.py
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""Fail when a job of publish.yml gates neither publish job without a written reason.
-
-See buildcheck/releasegate.py; the reasons are in .github/release-gate-exemptions.txt.
-Usage (from anywhere): check-release-gate.py
-"""
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from buildcheck import releasegate, workflow  # noqa: E402
-
-ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-
-
-def main():
-    with open(os.path.join(ROOT, ".github", "workflows", "publish.yml"), encoding="utf-8") as f:
-        jobs = workflow.parse(f.read())
-    with open(os.path.join(ROOT, releasegate.EXEMPTIONS_FILE), encoding="utf-8") as f:
-        exemptions = releasegate.read_exemptions(f.read())
-    failures = releasegate.check(jobs, exemptions)
-    for failure in failures:
-        print(f"::error::{failure}", file=sys.stderr)
-    print(f"{len(jobs)} jobs, {len(exemptions)} exempt, {len(failures)} violations")
-    return 1 if failures else 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
diff --git a/.github/check-run-scripts.py b/.github/check-run-scripts.py
deleted file mode 100755
index d6403667..00000000
--- a/.github/check-run-scripts.py
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""Fail when a bash run script of a workflow or composite action does not parse (bash -n).
-See buildcheck/runscripts.py. Usage: check-run-scripts.py
-"""
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from buildcheck import runscripts  # noqa: E402
-
-if __name__ == "__main__":
-    sys.exit(runscripts.main(sys.argv, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
diff --git a/.github/check-shared-files.py b/.github/check-shared-files.py
deleted file mode 100755
index 47359ee6..00000000
--- a/.github/check-shared-files.py
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""Check the files this repository shares byte-identically with its sibling repositories.
-
-See buildcheck/sharedfiles.py; the list is .github/shared-files.sha256.
-Usage: check-shared-files.py            verify the local copies, compare with the siblings (warnings)
-       check-shared-files.py --offline  verify the local copies only
-       check-shared-files.py --write    recompute the hashes of the listed files after a sync
-"""
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from buildcheck import sharedfiles  # noqa: E402
-
-if __name__ == "__main__":
-    sys.exit(sharedfiles.main(sys.argv, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
diff --git a/.github/check-versions.py b/.github/check-versions.py
deleted file mode 100755
index 69745035..00000000
--- a/.github/check-versions.py
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-"""Warn about Maven dependencies and plugins whose version differs between this repository and its
-siblings. See buildcheck/versions.py. Usage: check-versions.py
-"""
-
-import os
-import sys
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-from buildcheck import versions  # noqa: E402
-
-if __name__ == "__main__":
-    sys.exit(versions.main(sys.argv, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
diff --git a/.github/print-crash-logs.sh b/.github/print-crash-logs.sh
deleted file mode 100755
index faa409ed..00000000
--- a/.github/print-crash-logs.sh
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-
-# Cross-repo shared script -- kept BYTE-IDENTICAL in java-llama.cpp, BitcoinAddressFinder,
-# srcmorph and streambuffer (listed in each repo's .github/shared-files.sha256). The "Print crash
-# logs" step of workspace/policies/ci-test-diagnostics.md section 3.1: echoes the JVM crash logs
-# of a failed test job into the job log, because an uploaded artifact is unreadable from anywhere
-# that cannot fetch from Azure Blob Storage (a phone, a restricted network, an agent sandbox).
-#
-# Usage: print-crash-logs.sh [<module-dir>...]   (default: the current directory)
-#   For each module directory: <dir>/hs_err_pid*.log (first 200 lines -- the diagnostic core is at
-#   the top, the tail is thread dumps and the memory map) and
-#   <dir>/target/surefire-reports/*.dumpstream|*.dump (whole; they are small).
-#
-# Always exits 0: it runs under `if: failure()` and must never replace the job's real failure.
-shopt -s nullglob
-[ "$#" -gt 0 ] || set -- .
-found=0
-for dir in "$@"; do
-    for f in "$dir"/hs_err_pid*.log; do
-        found=1
-        echo "===== $f (first 200 lines; full file in the uploaded artifact) ====="
-        sed -n '1,200p' "$f"
-    done
-    for f in "$dir"/target/surefire-reports/*.dumpstream "$dir"/target/surefire-reports/*.dump; do
-        found=1
-        echo "===== $f ====="
-        cat "$f"
-    done
-done
-if [ "$found" = 0 ]; then
-    # Worded defensively on purpose (policy section 3): the step fires on EVERY job failure, and
-    # an ordinary assertion failure writes no crash log. Never assert an abort from a missing file.
-    echo "No hs_err_pid*.log and no surefire dump/dumpstream was written (looked in: $*)."
-    echo
-    echo "For an ordinary test failure that is EXPECTED, not a finding: this step runs on"
-    echo "any job failure, and an assertion failure, a timeout or a compile error writes no"
-    echo "crash log. Read the surefire output above for the real cause."
-    echo
-    echo "It points at a JVM-level abort only if the log ALSO shows a fork ending abnormally"
-    echo "-- 'The forked VM terminated without properly saying goodbye', or an exit with no"
-    echo "test results. In that case the abort bypassed the JVM error handler (a native"
-    echo "exit()/terminate() rather than a raised signal), which is why no file was written."
-fi
-exit 0
diff --git a/.github/print-host-info.sh b/.github/print-host-info.sh
deleted file mode 100755
index 5e9928c5..00000000
--- a/.github/print-host-info.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-
-# Prints the runner's CPU, for reading a native build or test log: which instruction sets the
-# compiler saw (GGML_NATIVE, the x86 variants) and how many cores the job had. Informational only
-# -- it never fails the step. One script for every OS (the step runs `shell: bash`, which is Git
-# Bash on Windows).
-case "$(uname -s)" in
-    Linux)
-        echo "=== CPU information (lscpu) ==="
-        lscpu || true
-        echo
-        echo "=== CPU details (/proc/cpuinfo) ==="
-        cat /proc/cpuinfo || true
-        ;;
-    Darwin)
-        echo "=== CPU information (sysctl) ==="
-        sysctl hw.model hw.cachelinesize hw.cpufrequency hw.cachesize hw.physicalcpu hw.logicalcpu \
-            hw.packages hw.memsize hw.ncpu 2>/dev/null || true
-        echo
-        echo "=== Processor details (system_profiler) ==="
-        system_profiler SPHardwareDataType || true
-        ;;
-    MINGW* | MSYS* | CYGWIN*)
-        echo "=== CPU information (Get-CimInstance Win32_Processor) ==="
-        powershell.exe -NoProfile -Command 'Get-CimInstance Win32_Processor | Select-Object * | Format-List' || true
-        echo "=== Processor (systeminfo) ==="
-        systeminfo | grep -i processor || true
-        ;;
-    *)
-        echo "no CPU report for $(uname -s)"
-        ;;
-esac
-exit 0
diff --git a/.github/release-assets.json b/.github/release-assets.json
new file mode 100644
index 00000000..8d8244cc
--- /dev/null
+++ b/.github/release-assets.json
@@ -0,0 +1,3 @@
+{
+  "schema": 1
+}
diff --git a/.github/release-assets.json.license b/.github/release-assets.json.license
new file mode 100644
index 00000000..eca5b047
--- /dev/null
+++ b/.github/release-assets.json.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+
+SPDX-License-Identifier: MIT OR Apache-2.0
diff --git a/.github/release-gate-exemptions.txt b/.github/release-gate-exemptions.txt
index 5663e042..065c1411 100644
--- a/.github/release-gate-exemptions.txt
+++ b/.github/release-gate-exemptions.txt
@@ -3,8 +3,8 @@
 # SPDX-License-Identifier: MIT OR Apache-2.0
 #
 # Jobs of publish.yml that do not gate both publish jobs, each with the reason it may stay red.
-# Every other job must gate both; check-release-gate.py (shared-files job) fails on a job that does
-# not, and on a line here that names no job or a job that gates both after all.
+# Every other job must gate both; the release-gate check of bernardladenthin/actions (repository-checks
+# job) fails on a job that does not, and on a line here that names no job or a job that gates both after all.
 # Format: <job>: <reason>
 publish-snapshot: a publish job itself
 publish-release: a publish job itself
@@ -14,3 +14,7 @@ github-snapshot: runs after publishing; attaches the assets to the rolling snaps
 github-release: runs after publishing; attaches the signed assets to the tag release
 verify-signing-key: red by design where the secret is withheld (forks, other contributors' branches); the publish jobs sign with the same key and fail on it themselves
 verify-signing-key-gradle: same as verify-signing-key, for the Gradle/BouncyCastle signing path
+central-snapshot: Independent post-preflight Central transfer; must not gate the GitHub publication path.
+central-release: Independent post-preflight Central transfer; must not gate the GitHub publication path.
+attest-snapshot: Independent provenance after the secured handoff; cannot gate either publication consumer.
+attest-release: Independent provenance after the secured handoff; cannot gate either publication consumer.
diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256
deleted file mode 100644
index 5f5ae673..00000000
--- a/.github/shared-files.sha256
+++ /dev/null
@@ -1,72 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-#
-# The files this repository keeps BYTE-IDENTICAL with java-llama.cpp, BitcoinAddressFinder,
-# srcmorph and streambuffer (each lists the ones it carries). Checked by the `shared-files` job of
-# .github/workflows/publish.yml (.github/check-shared-files.py, see .github/buildcheck/sharedfiles.py):
-# a copy changed here alone fails it, a copy another repository lists with a different hash warns.
-# To change a shared file: change it in every repository listing it, then run
-# `python3 .github/check-shared-files.py --write` in each. An entry `<workflow>#<job>` stands for one
-# job of a workflow (kept identical inside otherwise different workflows); an entry ending in `?repo`
-# for a file or job identical up to the repository's name (hashed with that name replaced by
-# `{repo}`); `sha256sum -c` reads the plain file entries only.
-9ad21ea42bced35498c6fcaa533d9ba448af042497f923e60646a77cfbe0fc5f  .github/buildcheck/__init__.py
-3d1a9f2e93709941261a9655bc19bf50d5becefd8f6a6c2f5564096a757996bb  .github/buildcheck/workflow.py
-5a70eee1bb8af180edfd2a4bae61be61fac15b409f5df6a8bb9869425d7fc381  .github/buildcheck/releasegate.py
-ff2aaec95e53916ea340a0a291bf0f57e0011522aedb486622b1fb1cac136865  .github/buildcheck/sharedfiles.py
-0059120aab539c6ce8055675ae0d3b040097f80320051e40385072f68845ddb0  .github/buildcheck/tests/__init__.py
-a7af59d075b41c2dc9cce1facef527f96fc127b4e26e2ba7986a6e3f51a71e29  .github/buildcheck/tests/helpers.py
-4985f25fa177bd79a79335742adfd0da0431e101124b4e7e214906b56ae903de  .github/buildcheck/tests/test_workflow.py
-cbe504ad081ba31ec16e11c11f879c64179ca7741bf0b1d1318a7fc969ed67dd  .github/buildcheck/tests/test_releasegate.py
-fe36042fbd5444f0b454ad1304cdafde901dd8cec57cfaba7c7086d996dfee27  .github/buildcheck/tests/test_sharedfiles.py
-7fe208dd33184b4543328f97b339c95e23c408b120e6bfa6095de4182aeb9a19  .github/check-release-gate.py
-1604ccdea83998814a3c1f98f746272222039867b0c7d692355e61495c1c648b  .github/check-shared-files.py
-ea373db1a28e16711110e50f1c2159e5d40b4e400fa22779883d1ce75971eb6e  .github/buildcheck/versions.py
-de437064302f9314028afff00e17fc995e48869e07ee402206d23708c7ed355a  .github/buildcheck/tests/test_versions.py
-0c78f43dd181f079d35edde7cbf25bb22eac92c907845d8dc8eec78e812aa097  .github/check-versions.py
-33c70847b6568604e8725d167a9b1d5910cc2a1a5b01fec7362be31b488ddb02  .github/buildcheck/runscripts.py
-c4967e3011d474ec43dbc797d113685c0a8a01b7cc52e910a1356273e6a67dc9  .github/buildcheck/tests/test_runscripts.py
-7ad8f7258c983c91e67db695e5ab6ea0f9279af007a6aa815f92f0d8a74c2ae4  .github/check-run-scripts.py
-7da53fdb9537ccf7d3f3740be31f295bacb914fe186304b9ed8a65fd3d3d413e  .github/print-crash-logs.sh
-fa1469664cb632e210ff3aa0669f15219d160ef13b486abeb978efade55f330b  .github/print-host-info.sh
-c8c02dc39aeacc154fad74071443c6513666aa94ca9f9c5fab49c5f39dea7ee6  .github/verify-signing-key.sh
-e0b2a4f331eae326b61c71f78d6272d06d99140a85dedb7710f93402de862466  .github/verify-bytecode-version.sh
-ab45f5c102b47dd16c325d4d9c283d158ba90c05f484eac45b2767885c4462f9  .github/signing-selftest/build.gradle.kts
-9b2ea5b5ff8d48607e26e4e211ad6d496f7660e71c84e42caaa82b84f7001710  .github/signing-selftest/settings.gradle.kts
-7232b092d3ba49b97bee7b539aaf6ee4c698e86bd3d4dd256e8ae2f85f653ee9  .github/ISSUE_TEMPLATE/bug_report.md
-0f08122e597f93dbbdc9c80e88984b4bf4738951d5902813df3d4640cdb11bac  .github/ISSUE_TEMPLATE/feature_request.md
-ebfcc0adf59f5858bbe4dc077c906304a197f72a55256f0d5aac669bee5e871f  .github/PULL_REQUEST_TEMPLATE.md
-f2a516d98a4287486dac82fc2c1293d81e3a4a1087e3ace934da0af5caaeace5  CODE_OF_CONDUCT.md
-b191c691d333249de1780e474817446cd94262e0bfa87e27cb6e412865f90943  .claude/skills/java-tdd-guide/SKILL.pointer.md
-074e6e32c86a4c0ef8b3ed25b721ca23aca83df277cd88106ef7177c354615ff  LICENSES/Apache-2.0.txt
-b05785f9f18e6716bab63424b11454513b9943a222595b70411009202fc592b5  LICENSES/MIT.txt
-edc34bc287c32b4d7ff970c0dd7a25e7d724cdd2775ef2b65aaccccd49c733c8  .editorconfig
-1568baf866c5f6c40751acd1e3b6760cc5db563c7330b8f33073cf2a9561cd4b  .gitattributes
-c47fad91718bf42aac298f569dcb8d0e36c81987f8706952d0637fb34ec1a1b5  .github/FUNDING.yml
-684faa8cb817db46e066c93c742c314066bc3ae71214132b226015e1a65be672  .github/CODEOWNERS
-11f78c496af746d3d6bdeb32827705e99fcfe45cb85ae50da4943a514e85e675  SUPPORT.md?repo
-e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73  .github/ISSUE_TEMPLATE/config.yml?repo
-2de09a4aa4b2bf2f9199c603806c6b6b65c254adbc35a6b5d184652f7022e69f  .mvn/jvm.config
-71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .mvn/jvm.config.license
-46fc025df0fd7b1bdbd84b875652ce9981aec87c2bb49b9263ae8c383cf7ce5a  .mvn/settings.xml
-8b8abf79508c4f53b2e765b78d6142655631d5ed69b59e95f234416a62e057b6  CITATION.cff?repo
-49eda3d2e846e1b5ec1d0f646a1adafb45ef42efbc3a50931df207bf9759ef13  .github/workflows/sonarqube.yml?repo
-9a24b2a67ab8e6f52016093e9b6a89796adea29887b7820accede06cc0c0d170  .github/workflows/publish.yml#code-style
-6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52  .java-version
-71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .java-version.license
-48cf852de627f1b11f402e408af907ce3e9ec926f6ba11720467645117e92e3a  .github/workflows/claude.yml
-362d1d169821b8954dc305dac36b8e2437acdbe2921ac42e9887a215663fa666  .github/workflows/claude-code-review.yml
-d4371cbcd6c5511e9b712599bbadc7b4c2437f3107f5d706a9adccdda24c2c44  .github/workflows/scorecard.yml
-480afc0c1e41f3997b195d7297750b43599ba71a7471657aa32bfc9662b6fd30  .github/workflows/reuse.yml
-93aedaf67af1c4d63b2502107a51f2f454f2b3b4bc5f2fe892561e12363e57a9  .github/workflows/osv-scanner.yml
-ed4231dc5b4ba9357a06974cb61e92b60e3eaac9a293810087efb2933e0cac82  .github/workflows/codeql.yml
-c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9  .github/dependabot.yml
-f26d05f25a154b84d8f281bb92857811749e2225cdbc167362de930c48b532d1  .github/workflows/publish.yml#startgate
-e3dde66089fd568f03caeefee86ea36a9f6eb7f47e5dc6d053e0e5784fd7a208  .github/workflows/publish.yml#shared-files
-3ef45f189f4419e0d4087f572b3c1b6085c0fe39ac7979b07deb2e882f7ffe8c  .github/workflows/publish.yml#verify-signing-key
-09230b04c5f14bdda50a0c862152ff197a656cbc3fd0d110899c5f8150f8aa9a  .github/workflows/publish.yml#check-snapshot
-51e987d59efd9887b43e345edc0e0f3db21686879e3ca6ea9f0fdbc493d37121  .github/workflows/publish.yml#check-tag
-a4f42a0bfa9b14ca937675052b990e5f1dda238d762f9d0268ac282cd7030c0d  .github/workflows/publish.yml#verify-signing-key-gradle
-c2684a3f93aaf552c13f845307536c2a14dda315c7d7b1e416bc66951b811dc1  .github/workflows/publish.yml#github-snapshot
-c09a030706dbea4221851ca0fcbfa6fc686165b408724724ade61724da6e123b  .github/workflows/publish.yml#github-release
diff --git a/.github/signing-selftest/build.gradle.kts b/.github/signing-selftest/build.gradle.kts
deleted file mode 100644
index e165c9f6..00000000
--- a/.github/signing-selftest/build.gradle.kts
+++ /dev/null
@@ -1,41 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-//
-// SPDX-License-Identifier: MIT OR Apache-2.0
-
-// Throwaway signing project used ONLY by the `verify-signing-key-gradle`
-// preflight job in .github/workflows/publish.yml. It signs a tiny throwaway Zip
-// through Gradle's `signing` plugin + `useInMemoryPgpKeys` (BouncyCastle) — the
-// exact path any Gradle-based publish (e.g. an Android AAR) uses to sign release
-// artifacts, and a stricter parser of the armored key than the `gpg` CLI. The
-// job asserts only that the detached .asc was produced; no secret is ever
-// printed (the key/passphrase arrive via env). Kept identical across the sibling
-// repos so a future Gradle publish is pre-validated ("prepared for Gradle").
-plugins {
-    base
-    signing
-}
-
-val signingKey = System.getenv("MAVEN_GPG_PRIVATE_KEY")
-val signingPassphrase = System.getenv("MAVEN_GPG_PASSPHRASE")
-// Optional signing (sub)key id (e.g. 07D2D767). When set, Gradle selects that
-// key instead of the primary — required when the key's signing capability lives
-// on a subkey (gpg auto-selects it, but the 2-arg useInMemoryPgpKeys picks the
-// primary, whose secret BouncyCastle may not be able to unlock -> null
-// PGPPrivateKey). Driven by the GPG_KEY_ID env secret.
-val signingKeyId = System.getenv("MAVEN_GPG_KEY_ID")
-require(!signingKey.isNullOrBlank()) { "MAVEN_GPG_PRIVATE_KEY is empty" }
-
-val makeArtifact = tasks.register<Zip>("makeArtifact") {
-    archiveBaseName.set("signing-selftest")
-    destinationDirectory.set(layout.buildDirectory)
-    from(layout.projectDirectory.file("settings.gradle.kts"))
-}
-
-signing {
-    if (!signingKeyId.isNullOrBlank()) {
-        useInMemoryPgpKeys(signingKeyId, signingKey, signingPassphrase ?: "")
-    } else {
-        useInMemoryPgpKeys(signingKey, signingPassphrase ?: "")
-    }
-    sign(makeArtifact.get())
-}
diff --git a/.github/signing-selftest/settings.gradle.kts b/.github/signing-selftest/settings.gradle.kts
deleted file mode 100644
index 211f2533..00000000
--- a/.github/signing-selftest/settings.gradle.kts
+++ /dev/null
@@ -1,5 +0,0 @@
-// SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-//
-// SPDX-License-Identifier: MIT OR Apache-2.0
-
-rootProject.name = "signing-selftest"
diff --git a/.github/verify-bytecode-version.sh b/.github/verify-bytecode-version.sh
deleted file mode 100755
index 384f3c96..00000000
--- a/.github/verify-bytecode-version.sh
+++ /dev/null
@@ -1,160 +0,0 @@
-#!/usr/bin/env bash
-
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-
-# Cross-repo shared script — kept BYTE-IDENTICAL in java-llama.cpp, srcmorph,
-# BitcoinAddressFinder and streambuffer (listed in each repo's .github/shared-files.sha256, which
-# the `shared-files` job checks: sync any edit to all four, then `check-shared-files.py --write`).
-# Fails when a built jar contains a class file newer than the Java
-# release the artifact claims to support.
-#
-# Why: `maven.compiler.release` governs only the code WE compile. A dependency compiled for a newer
-# Java lands in the jar untouched, and nothing in a normal build objects. The failure surfaces at a
-# consumer's JVM as UnsupportedClassVersionError, which is the worst possible place to find it.
-# This has happened twice here: checker-qual 4.x (Java 11 bytecode, and its annotations are
-# @Retention(RUNTIME), so anything reflecting over an annotated element loads them), and
-# logback-classic from 1.4.0 on, whose LogbackServiceProvider SLF4J's ServiceLoader loads at
-# startup — a guaranteed crash rather than a latent one.
-#
-# Scan the BUILT ARTIFACT, not a resolved classpath: an uber jar is what a user actually runs, and
-# `dependency:build-classpath` answers a different question (and answers it with an empty file when
-# it fails, which reads as a pass).
-#
-# Usage: verify-bytecode-version.sh --max-major <N> [--allow <pattern>]... <path>...
-#   --max-major <N>   highest class-file major version a consumer JVM may be asked to load.
-#                     52 = Java 8, 55 = Java 11, 61 = Java 17, 65 = Java 21.
-#                     Pass it from the pipeline so the value lives next to the release it belongs
-#                     to, instead of being duplicated here per repo.
-#   --allow <pattern> repeatable, optional. Glob matched against "<jar-basename>:<entry-path>", so
-#                     it can waive a whole jar (`--allow 'foo-*.jar:*'`) or a single entry
-#                     (`--allow '*:com/example/Legacy.class'`). Use sparingly and say why in the
-#                     workflow: every entry here is a hole in the guarantee, and a hole nobody
-#                     revisits is how a gate stops gating.
-#   <path>...         jars, and/or directories searched recursively for *.jar.
-#
-# ALWAYS skipped, not configurable — a classpath JVM never loads these, so a high version in them
-# is not a defect and waiving them per-repo would only invite blanket exceptions:
-#   * module-info.class (any directory)  — read only in module mode, and Java 8 has none
-#   * META-INF/versions/**               — multi-release overlays, invisible below their own release
-#
-# Exit codes: 0 clean · 1 violations found · 2 nothing to scan / bad usage. 2 matters as much as 1:
-# a run that scanned no jars must never be reported as a pass.
-
-set -euo pipefail
-
-MAX_MAJOR=""
-ALLOW=()
-PATHS=()
-
-fail_usage() {
-    echo "::error::$*" >&2
-    echo "usage: verify-bytecode-version.sh --max-major <N> [--allow <pattern>]... <path>..." >&2
-    exit 2
-}
-
-while [ $# -gt 0 ]; do
-    case "$1" in
-        --max-major) [ $# -ge 2 ] || fail_usage "--max-major needs a value"; MAX_MAJOR="$2"; shift 2 ;;
-        --allow)     [ $# -ge 2 ] || fail_usage "--allow needs a value";     ALLOW+=("$2");   shift 2 ;;
-        --) shift; while [ $# -gt 0 ]; do PATHS+=("$1"); shift; done ;;
-        -*) fail_usage "unknown option '$1'" ;;
-        *)  PATHS+=("$1"); shift ;;
-    esac
-done
-
-[ -n "$MAX_MAJOR" ] || fail_usage "--max-major is required"
-case "$MAX_MAJOR" in ''|*[!0-9]*) fail_usage "--max-major must be a number, got '$MAX_MAJOR'" ;; esac
-[ "${#PATHS[@]}" -gt 0 ] || fail_usage "at least one jar or directory is required"
-
-for p in "${PATHS[@]}"; do
-    [ -e "$p" ] || fail_usage "path '$p' does not exist"
-done
-
-command -v python3 >/dev/null 2>&1 || fail_usage "python3 is required to read class-file headers"
-
-# The scan itself: one pass per jar, reading the 8-byte class-file header of every entry. Kept in
-# python because the alternative (unzip -p per entry) spawns a process per class — thousands for a
-# fat jar — and because a zip reader must not be reimplemented in shell.
-python3 - "$MAX_MAJOR" "${#ALLOW[@]}" "${ALLOW[@]}" "${PATHS[@]}" <<'PYTHON'
-import fnmatch, os, sys, zipfile
-
-max_major = int(sys.argv[1])
-n_allow = int(sys.argv[2])
-allow = sys.argv[3:3 + n_allow]
-paths = sys.argv[3 + n_allow:]
-
-jars = []
-for p in paths:
-    if os.path.isdir(p):
-        for root, _dirs, files in os.walk(p):
-            jars.extend(os.path.join(root, f) for f in files if f.endswith(".jar"))
-    elif p.endswith(".jar"):
-        jars.append(p)
-jars = sorted(set(jars))
-
-# An empty scan is a broken measurement, never a pass. A glob that matched nothing, a download step
-# that silently produced no artifact, a renamed output directory: all of them yield "0 violations"
-# from a scanner that just shrugs, and that is indistinguishable from a clean run.
-if not jars:
-    print(f"::error::no jars found under: {', '.join(paths)} -- refusing to report a pass", file=sys.stderr)
-    sys.exit(2)
-
-def skipped_always(entry):
-    # A plain classpath JVM never loads either of these, at any Java level.
-    return (entry == "module-info.class"
-            or entry.endswith("/module-info.class")
-            or entry.startswith("META-INF/versions/"))
-
-violations = []
-waived = 0
-scanned = 0
-
-for jar in jars:
-    base = os.path.basename(jar)
-    try:
-        zf = zipfile.ZipFile(jar)
-    except Exception as exc:                                   # noqa: BLE001 - report, do not crash
-        print(f"::error::cannot read '{jar}': {exc}", file=sys.stderr)
-        sys.exit(2)
-    with zf:
-        for entry in zf.namelist():
-            if not entry.endswith(".class") or skipped_always(entry):
-                continue
-            try:
-                with zf.open(entry) as handle:
-                    head = handle.read(8)
-            except Exception:                                  # noqa: BLE001 - unreadable entry
-                continue
-            if len(head) < 8 or head[:4] != b"\xca\xfe\xba\xbe":
-                continue
-            scanned += 1
-            major = int.from_bytes(head[6:8], "big")
-            if major <= max_major:
-                continue
-            key = f"{base}:{entry}"
-            if any(fnmatch.fnmatch(key, pattern) for pattern in allow):
-                waived += 1
-                continue
-            violations.append((base, entry, major))
-
-# One line per offending jar, naming an example entry: a full listing of a fat jar's thousands of
-# classes buries the answer, and the jar is the unit somebody acts on.
-by_jar = {}
-for base, entry, major in violations:
-    prev = by_jar.get(base)
-    if prev is None or major > prev[1]:
-        by_jar[base] = (entry, major)
-
-for base in sorted(by_jar):
-    entry, major = by_jar[base]
-    print(f"::error::{base}: class-file major {major} (Java {major - 44}) exceeds the "
-          f"allowed {max_major} (Java {max_major - 44}) -- e.g. {entry}")
-
-print(f"scanned {scanned} class file(s) in {len(jars)} jar(s); "
-      f"{len(by_jar)} jar(s) over major {max_major}"
-      + (f"; {waived} entr(y/ies) waived by --allow" if waived else ""))
-
-sys.exit(1 if violations else 0)
-PYTHON
diff --git a/.github/verify-signing-key.sh b/.github/verify-signing-key.sh
deleted file mode 100755
index 8940490b..00000000
--- a/.github/verify-signing-key.sh
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/usr/bin/env bash
-
-# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
-#
-# SPDX-License-Identifier: MIT OR Apache-2.0
-
-# Cross-repo shared script -- kept BYTE-IDENTICAL in java-llama.cpp, BitcoinAddressFinder,
-# srcmorph and streambuffer (listed in each repo's .github/shared-files.sha256). The body of the
-# `verify-signing-key` job: reproduces what maven-gpg-plugin does at deploy time, so a bad or
-# expired key or a wrong passphrase is caught in seconds instead of failing the publish stage.
-#
-# Input: GPG_PRIVATE_KEY (armored secret key) and GPG_PASSPHRASE in the environment.
-#
-# SECURITY: prints no secret material. The key is imported into an ephemeral keyring via stdin;
-# only PUBLIC key metadata is printed (key id, fingerprint, owner UID, algorithm, created/expiry,
-# all of which live on public keyservers); the passphrase is validated by producing and verifying
-# a throwaway signature, reaches gpg on fd 3 only (never argv, never a log line), and is
-# additionally `::add-mask::`ed. `set -x` must never be enabled here.
-set -euo pipefail   # NOTE: deliberately NO `set -x` — it would echo the passphrase.
-
-if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
-  echo "::error::GPG_PRIVATE_KEY is empty for this run. Either the secret is not set, or it is scoped to a different environment/branch than 'maven-central' on this ref. Nothing to verify."
-  exit 1
-fi
-# Defensive: even though we never print it, register the passphrase as a
-# masked value so any accidental echo downstream is redacted.
-if [ -n "${GPG_PASSPHRASE:-}" ]; then echo "::add-mask::${GPG_PASSPHRASE}"; fi
-
-echo "gpg: $(gpg --version | head -n1)"
-
-# Ephemeral, private keyring; removed on exit.
-export GNUPGHOME="$(mktemp -d)"
-chmod 700 "$GNUPGHOME"
-cleanup() { gpgconf --kill gpg-agent >/dev/null 2>&1 || true; rm -rf "$GNUPGHOME"; }
-trap cleanup EXIT
-
-echo "== Import private key into an ephemeral keyring (key via stdin, never argv) =="
-printf '%s\n' "$GPG_PRIVATE_KEY" | gpg --batch --import
-
-COLONS="$(gpg --list-secret-keys --with-colons --fixed-list-mode)"
-SECCOUNT="$(printf '%s\n' "$COLONS" | awk -F: '$1=="sec"{n++} END{print n+0}')"
-echo "Secret keys imported: $SECCOUNT"
-if [ "$SECCOUNT" -lt 1 ]; then
-  echo "::error::No secret key was imported — GPG_PRIVATE_KEY is not a valid armored secret key (check that the secret contains the full -----BEGIN PGP PRIVATE KEY BLOCK----- with intact newlines)."
-  exit 1
-fi
-
-KEYID="$(printf '%s\n' "$COLONS"  | awk -F: '$1=="sec"{print $5; exit}')"
-ALGO="$(printf '%s\n'  "$COLONS"  | awk -F: '$1=="sec"{print $4; exit}')"
-CREATED="$(printf '%s\n' "$COLONS"| awk -F: '$1=="sec"{print $6; exit}')"
-EXPIRES="$(printf '%s\n' "$COLONS"| awk -F: '$1=="sec"{print $7; exit}')"
-FPR="$(printf '%s\n'   "$COLONS"  | awk -F: '$1=="fpr"{print $10; exit}')"
-
-echo "== PUBLIC key metadata =="
-echo "  Key ID (long):  $KEYID"
-echo "  Fingerprint:    $FPR"
-echo "  Pubkey algo id: $ALGO"
-echo "  Created (UTC):  $(date -u -d "@$CREATED" 2>/dev/null || echo "$CREATED")"
-echo "  Owner UID(s):"
-printf '%s\n' "$COLONS" | awk -F: '$1=="uid"{print "    - " $10}'
-
-# --- Expiration gate ---
-NOW="$(date -u +%s)"
-if [ -n "$EXPIRES" ]; then
-  echo "  Expires (UTC):  $(date -u -d "@$EXPIRES" 2>/dev/null || echo "$EXPIRES")"
-  if [ "$EXPIRES" -le "$NOW" ]; then
-    echo "::error::Signing key is EXPIRED — Maven Central will reject its signatures. Extend the key's expiry and update the GPG_PRIVATE_KEY secret."
-    exit 1
-  fi
-  echo "  Days to expiry: $(( (EXPIRES - NOW) / 86400 ))"
-  if [ "$(( (EXPIRES - NOW) / 86400 ))" -lt 30 ]; then
-    echo "::warning::Signing key expires in under 30 days — plan to rotate it."
-  fi
-else
-  echo "  Expires (UTC):  never"
-fi
-
-# --- Signing-capability gate ---
-if printf '%s\n' "$COLONS" | awk -F: '($1=="sec"||$1=="ssb"){print $12}' | grep -q 's'; then
-  echo "  Signing capability: present"
-else
-  echo "::error::No signing-capable (sub)key found — this key cannot produce release signatures."
-  exit 1
-fi
-
-# --- Passphrase unlock + sign + verify roundtrip (the exact failure mode) ---
-# Passphrase on fd 3 only. Payload is a throwaway nonce; only the signature's
-# validity (exit codes) matters — no secret is ever emitted.
-echo "== Passphrase unlock + detached-sign + verify self-test =="
-WORK="$(mktemp -d)"
-printf '%s' "ai-index signing-selftest" > "$WORK/payload.txt"
-gpg --batch --yes --pinentry-mode loopback --passphrase-fd 3 \
-    --local-user "$KEYID" \
-    --detach-sign --armor --output "$WORK/payload.txt.asc" "$WORK/payload.txt" \
-    3<<<"${GPG_PASSPHRASE:-}"
-echo "  Signature produced: $(wc -c < "$WORK/payload.txt.asc") armored bytes"
-gpg --batch --verify "$WORK/payload.txt.asc" "$WORK/payload.txt"
-rm -rf "$WORK"
-
-echo "RESULT: OK — key imports, is not expired, is signing-capable, and the passphrase successfully unlocked it to produce a VALID signature. maven-gpg-plugin will be able to sign with this key/passphrase."
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index c96753cf..fa0847ff 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -25,7 +25,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@6b6870e649b5ff408753befeaee5fc7989d4e6a9 # v1
+        uses: anthropics/claude-code-action@ae68417a745a5df4b2124873632bd73a2255e6f6 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 2600eff4..94706d63 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@6b6870e649b5ff408753befeaee5fc7989d4e6a9 # v1
+        uses: anthropics/claude-code-action@ae68417a745a5df4b2124873632bd73a2255e6f6 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index da8c6ade..fe965acf 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,7 +2,9 @@
 #
 # SPDX-License-Identifier: MIT OR Apache-2.0
 
+# Template of bernardladenthin/actions (templates/java); the job is its reusable workflow.
 name: CodeQL
+
 on:
   push:
     branches: [main]
@@ -10,26 +12,14 @@ on:
     branches: [main]
   schedule:
     - cron: "12 1 * * 0"
+
+permissions:
+  contents: read
+
 jobs:
   analyze:
-    runs-on: ubuntu-latest
+    uses: bernardladenthin/actions/.github/workflows/java-codeql.yml@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
     permissions:
       actions: read
       contents: read
       security-events: write
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      # Two JDKs, as in every job that builds a whole reactor: a module with a Java floor above
-      # .java-version (java-llama.cpp's llama-ffm, Java 22) builds through maven-toolchains-plugin,
-      # and setup-java writes a toolchains.xml entry per JDK it installs; the second step keeps
-      # JAVA_HOME on .java-version. Harmless in a repository without such a module. Shared file.
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
-        with: { java-version: '25', distribution: temurin }
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
-        with: { java-version-file: .java-version, distribution: temurin }
-      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
-        with: { languages: java, queries: +security-and-quality }
-      - name: Build with Maven
-        run: mvn --batch-mode --no-transfer-progress compile
-      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
-        with: { category: "/language:java" }
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
new file mode 100644
index 00000000..d1c76876
--- /dev/null
+++ b/.github/workflows/dependency-submission.yml
@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-License-Identifier: MIT OR Apache-2.0
+
+# Template of bernardladenthin/actions (templates/java); the job is its reusable workflow.
+name: Maven Dependency Submission
+
+on:
+  # The graph GitHub shows is the default branch's. Other branches (Dependabot's among them, whose
+  # pushes get a read-only token) would only fail or add snapshots nobody reads.
+  push:
+    branches: [ main ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  submit:
+    uses: bernardladenthin/actions/.github/workflows/java-maven-dependency-submission.yml@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+    permissions:
+      contents: write
diff --git a/.github/workflows/formal-verification.yml b/.github/workflows/formal-verification.yml
index 639dba6b..da5f4273 100644
--- a/.github/workflows/formal-verification.yml
+++ b/.github/workflows/formal-verification.yml
@@ -89,8 +89,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Display CPU Info
-        shell: bash
-        run: bash .github/print-host-info.sh
+        uses: bernardladenthin/actions/common/print-host-info@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
           java-version-file: .java-version
@@ -145,8 +144,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Display CPU Info
-        shell: bash
-        run: bash .github/print-host-info.sh
+        uses: bernardladenthin/actions/common/print-host-info@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
           java-version-file: .java-version
@@ -228,21 +226,20 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Display CPU Info
-        shell: bash
-        run: bash .github/print-host-info.sh
+        uses: bernardladenthin/actions/common/print-host-info@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
-          # 21 builds the repo's Java-8 production classes (matching the shipped bytecode);
+          # 25 builds the repo's Java-8 production classes (matching the shipped bytecode);
           # 11 builds and runs jpf-core.
           java-version: |
             11
-            21
+            25
           distribution: temurin
           cache: maven
-      - name: Build Java-8 production classes + collect annotation jars (JDK 21)
+      - name: Build Java-8 production classes + collect annotation jars (JDK 25)
         run: |
           set -euo pipefail
-          export JAVA_HOME="$JAVA_HOME_21_X64"
+          export JAVA_HOME="$JAVA_HOME_25_X64"
           mvn -B --no-transfer-progress -DskipTests -Denforcer.skip=true compile
           # Copy the compile-scope dependencies (incl. the optional checker-qual/jspecify/
           # error-prone annotation jars the production bytecode references) into one directory,
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index c9797f94..534c3b9c 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -2,7 +2,9 @@
 #
 # SPDX-License-Identifier: MIT OR Apache-2.0
 
+# Template of bernardladenthin/actions (templates/common); the jobs are its reusable workflow.
 name: OSV-Scanner
+
 on:
   pull_request:
     branches: [ main ]
@@ -16,17 +18,8 @@ permissions:
   contents: read
 
 jobs:
-  scan-scheduled:
-    if: ${{ github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36" # v2.7.0
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-  scan-pr:
-    if: ${{ github.event_name == 'pull_request' }}
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36" # v2.7.0
+  scan:
+    uses: bernardladenthin/actions/.github/workflows/osv-scanner.yml@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c5e7d9a1..34b90d1b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -62,84 +62,56 @@ jobs:
       - run: echo "Start gate elapsed — proceeding with pipeline."
 
   # ---------------------------------------------------------------------------
-  # Files kept byte-identical with the sibling repositories (java-llama.cpp,
-  # BitcoinAddressFinder, srcmorph, streambuffer), listed in .github/shared-files.sha256.
-  # A copy changed here alone fails; one the siblings list with another hash warns.
-  # Also runs the tests of the shared build checks and the release-gate check. This
-  # job is itself identical in all four repositories.
+  # The repository checks of bernardladenthin/actions, configured in
+  # .github/actions-config.json: the files this repository keeps equal to the templates
+  # there (replaced the shared-files.sha256 manifest), the release gate, bash -n over
+  # every run script, Maven version drift against the sibling repositories (warnings
+  # only), and the publication wiring plus a dry run of the release asset contract.
   # ---------------------------------------------------------------------------
-  shared-files:
-    name: Shared files + build checks
+  repository-checks:
+    name: Repository checks
     needs: startgate
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - name: Shared files match .github/shared-files.sha256 (siblings compared, warnings only)
-        run: python3 .github/check-shared-files.py
-      - name: Build-check tests
-        run: python3 -m unittest discover -s .github/buildcheck/tests -t .github
+      - name: Files equal their templates in bernardladenthin/actions
+        uses: bernardladenthin/actions/common/check-templates@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
       - name: Release gate (every job gates both publish jobs, or release-gate-exemptions.txt says why)
-        run: python3 .github/check-release-gate.py
+        uses: bernardladenthin/actions/common/check-release-gate@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
       - name: Run scripts parse (bash -n over every bash run script of the workflows and actions)
-        run: python3 .github/check-run-scripts.py
+        uses: bernardladenthin/actions/common/check-run-scripts@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
       - name: Maven versions (warns where a dependency or plugin differs from a sibling repository)
-        run: python3 .github/check-versions.py
+        uses: bernardladenthin/actions/java/check-maven-versions@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+      - name: Publication wiring and release asset contract (dry run)
+        uses: bernardladenthin/actions/java/check-publication@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
 
   # ---------------------------------------------------------------------------
-  # GPG signing-key preflight (standalone, no `needs:` — runs in parallel at the
-  # very start on every trigger). Reproduces what maven-gpg-plugin does at deploy
-  # time so a bad/expired key or wrong passphrase is caught in ~20s instead of
-  # failing the publish stage. Declares `environment: maven-central` so it reads
-  # the SAME GPG_PRIVATE_KEY / GPG_PASSPHRASE secret the publish jobs use.
-  #
-  # It is EXPECTED to go RED on refs where the secret is not delivered — fork PRs
-  # and other contributors' branches (secrets are withheld there). That red is
-  # the intended signal: "this ref cannot sign a release", not a regression.
-  #
-  # SECURITY: this job NEVER prints secret material. It imports the key into an
-  # ephemeral keyring, prints only PUBLIC key metadata (key id, fingerprint,
-  # owner UID, algorithm, created/expiry — all of which live on public
-  # keyservers), and validates the passphrase by producing + verifying a
-  # throwaway signature. The passphrase is passed on fd 3 (never argv, never a
-  # log line), `set -x` is deliberately never enabled, and the passphrase is
-  # additionally `::add-mask::`ed.
+  # GPG signing-key preflight (standalone, no `needs:` -- runs in parallel at the
+  # very start on every trigger): what maven-gpg-plugin does at deploy time, so a
+  # bad/expired key or wrong passphrase is caught in ~20s instead of failing the
+  # publish stage. `environment: maven-central` gives it the SAME secret the publish
+  # jobs use. EXPECTED to go RED where the secret is not delivered (fork PRs, other
+  # contributors' branches): "this ref cannot sign a release", not a regression.
+  # Prints only public key metadata; the security notes are in the action's script.
   # ---------------------------------------------------------------------------
   verify-signing-key:
     name: Verify GPG signing key (no secrets printed)
     runs-on: ubuntu-latest
     environment: maven-central
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: bernardladenthin/actions/common/verify-gpg-key@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
         with:
-          persist-credentials: false
-      - name: Import key + run sign/verify self-test (prints only PUBLIC metadata)
-        env:
-          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-        # Shared, byte-identical in all four repos; the security notes are in the script.
-        run: bash .github/verify-signing-key.sh
+          private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
 
   # ---------------------------------------------------------------------------
-  # GPG signing-key preflight — GRADLE / BouncyCastle path.
-  # Companion to the `verify-signing-key` (gpg) job above: that one mirrors
-  # maven-gpg-plugin (how the Maven artifacts are signed); this one drives
-  # Gradle's `signing` plugin + `useInMemoryPgpKeys` (BouncyCastle) — the path any
-  # Gradle-based publish (e.g. an Android AAR) uses to sign. BouncyCastle is a
-  # STRICTER parser of the armored key than gpg, so it catches key/format problems
-  # gpg tolerates (e.g. the primary-vs-signing-subkey null-PGPPrivateKey issue).
-  # It signs a throwaway project (.github/signing-selftest/) — no repo build is
-  # involved — so this job is IDENTICAL across the sibling repos and validates the
-  # release key via the Gradle path even in repos that do not publish via Gradle
-  # yet ("prepared for Gradle"). Standalone (no `needs:`), parallel at pipeline
-  # start, `environment: maven-central` so it reads the same secret the publish
-  # uses. Red-by-design where the secret is not delivered (see the gpg job's note).
-  #
-  # SECURITY: prints no secret material. Key/passphrase reach Gradle only via env
-  # (read by System.getenv at runtime); `set -x` is never enabled; the passphrase
-  # is `::add-mask::`ed; Gradle runs with `--stacktrace` only. Only the produced
-  # `.asc` (exit code) is asserted. Uses Gradle 9.6.1.
+  # The same key through Gradle's signing plugin + useInMemoryPgpKeys (BouncyCastle),
+  # the path a Gradle publication (an Android AAR) signs with. BouncyCastle parses the
+  # armored key more strictly than gpg, so it catches what the job above tolerates.
+  # It signs the action's own throwaway project, so it is the same in every repository
+  # ("prepared for Gradle"). Red by design where the secret is not delivered.
   # ---------------------------------------------------------------------------
   verify-signing-key-gradle:
     name: Verify GPG signing key — Gradle/BouncyCastle path (no secrets printed)
@@ -147,40 +119,13 @@ jobs:
     environment: maven-central
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
-          java-version-file: .java-version
-          distribution: temurin
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
+          persist-credentials: false
+      - uses: bernardladenthin/actions/java/verify-signing-key-gradle@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
         with:
-          gradle-version: "9.8.2"
-      - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle)
-        shell: bash
-        env:
-          MAVEN_GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
-          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-          MAVEN_GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
-        run: |
-          set -euo pipefail   # NOTE: deliberately NO `set -x` — it would echo the passphrase.
-
-          if [ -z "${MAVEN_GPG_PRIVATE_KEY:-}" ]; then
-            echo "::error::MAVEN_GPG_PRIVATE_KEY is empty for this run. The maven-central environment did not deliver the secret to this ref (fork PR / other branch). Nothing to verify."
-            exit 1
-          fi
-          if [ -n "${MAVEN_GPG_PASSPHRASE:-}" ]; then echo "::add-mask::${MAVEN_GPG_PASSPHRASE}"; fi
-
-          PROJ=".github/signing-selftest"
-          echo "== Sign a throwaway artifact through Gradle's useInMemoryPgpKeys (BouncyCastle) =="
-          gradle --no-daemon -p "$PROJ" signMakeArtifact --stacktrace
-
-          ASC="$PROJ/build/signing-selftest.zip.asc"
-          if [ -f "$ASC" ]; then
-            echo "  Detached signature produced: $(wc -c < "$ASC") armored bytes"
-            echo "RESULT: OK — Gradle's useInMemoryPgpKeys accepted the armored key + passphrase and produced a signature."
-          else
-            echo "::error::Gradle signing produced no .asc — useInMemoryPgpKeys could not build a usable signatory from MAVEN_GPG_PRIVATE_KEY / MAVEN_GPG_PASSPHRASE."
-            exit 1
-          fi
+          private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.GPG_PASSPHRASE }}
+          key-id: ${{ secrets.GPG_KEY_ID }}
 
   code-style:
     name: Code style (spotless) + package graph
@@ -188,20 +133,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
-          java-version-file: .java-version
-          distribution: temurin
-      - name: Spotless check (fail fast on format violations)
-        run: mvn -B --no-transfer-progress spotless:check
-      - name: SpotBugs check (fail fast on static-analysis findings)
-        run: mvn -B --no-transfer-progress -DskipTests -Denforcer.skip=true compile spotbugs:check
-      - name: Print internal package dependency graph (jdeps, informational)
-        continue-on-error: true
-        run: |
-          mvn -B --no-transfer-progress -DskipTests -Denforcer.skip=true compile
-          echo "=== internal package dependency graph (jdeps, bytecode) ==="
-          jdeps -verbose:package target/classes | grep 'net\.ladenthin\.' || true
+          persist-credentials: false
+      - uses: bernardladenthin/actions/java/maven-code-style@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+        with:
+          package-pattern: 'net\.ladenthin\.'
 
   build:
     name: Build
@@ -250,7 +186,11 @@ jobs:
       # unconditionally because a classpath JVM never loads them. Runs before the smoke test so an
       # unloadable class is reported as such instead of as a mysterious smoke failure.
       - name: Verify Java 8 bytecode (no class newer than major 52)
-        run: .github/verify-bytecode-version.sh --max-major 52 jars
+        uses: bernardladenthin/actions/java/verify-bytecode@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+        with:
+          max-major: "52"
+          paths: |
+            jars
       - name: Run packaged-jar smoke test
         run: .github/smoke-jar.sh jars 'streambuffer-*.jar'
 
@@ -261,8 +201,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Display CPU Info
-        shell: bash
-        run: bash .github/print-host-info.sh
+        uses: bernardladenthin/actions/common/print-host-info@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with:
           java-version-file: .java-version
@@ -283,8 +222,9 @@ jobs:
       # Echo the crash logs into the job log (workspace/policies/ci-test-diagnostics.md 3.1).
       - name: Print crash logs (on failure)
         if: failure()
-        shell: bash
-        run: bash .github/print-crash-logs.sh .
+        uses: bernardladenthin/actions/java/print-crash-logs@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+        with:
+          modules: .
       - name: Upload crash & surefire dumps
         if: failure()
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
@@ -306,8 +246,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Display CPU Info
-        shell: bash
-        run: bash .github/print-host-info.sh
+        uses: bernardladenthin/actions/common/print-host-info@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with: { java-version-file: .java-version, distribution: temurin, cache: maven }
       - name: Test under vmlens
@@ -324,19 +263,18 @@ jobs:
     needs: [test]
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
         with: { java-version-file: .java-version, distribution: temurin, cache: maven }
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with: { name: jacoco-report, path: target/site/jacoco/ }
         continue-on-error: true
-      # Submits the dependency graph to GitHub. Informational: it says nothing about whether the
-      # artifacts are correct, but it sits in the `report` job, which the release path needs -- so
-      # without this flag a third-party action having a bad day can block a publish.
-      - uses: advanced-security/maven-dependency-submission-action@a64327a7329c9939cf675e458452febe1894a70c # v6
-        continue-on-error: true
+      # The dependency graph is submitted by dependency-submission.yml (on pushes to main, with the
+      # JDK of .java-version), not here: this job gates the release path and needs no write access.
       - name: Coveralls
         uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2
         with:
@@ -385,8 +323,17 @@ jobs:
       (github.event_name == 'push' && github.ref == 'refs/heads/main') ||
       (github.event_name == 'workflow_dispatch' && !startsWith(github.ref, 'refs/tags/v'))
     steps:
-      - name: Confirm snapshot ref
-        run: echo "Confirmed on snapshot ref ${{ github.ref }}"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      # Every project version ends in -SNAPSHOT before anything is published to the snapshot channel.
+      # Only then: a push publishes nothing, and main carries the release version for the commit
+      # a release is tagged on.
+      - name: Require a SNAPSHOT version
+        if: inputs.publish_to_central
+        uses: bernardladenthin/actions/java/check-release-ref@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+        with:
+          channel: snapshot
 
   check-tag:
     name: "Check: v* tag"
@@ -394,15 +341,30 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
-      - name: Confirm tag ref
-        run: echo "Confirmed on tag ${{ github.ref }}"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      # The tag names exactly the project version (v1.2.3 for 1.2.3), which is no SNAPSHOT.
+      - name: Require the release version the tag names
+        uses: bernardladenthin/actions/java/check-release-ref@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+        with:
+          channel: release
 
   publish-snapshot:
-    name: Publish Snapshot to Central
-    needs: [check-snapshot, code-style, smoke-jar, shared-files, vmlens]
+    name: Prepare and verify signed snapshot artifacts
+    needs:
+      - check-snapshot
+      - code-style
+      - smoke-jar
+      - repository-checks
+      - vmlens
     if: needs.check-snapshot.result == 'success' && inputs.publish_to_central
     runs-on: ubuntu-latest
     environment: maven-central
+    outputs:
+      assets_complete: ${{ steps.finalize.outputs.complete }}
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
@@ -421,181 +383,54 @@ jobs:
           VERSION=$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version | tail -n1)
           echo "Resolved project version: $VERSION"
           case "$VERSION" in
-            *-SNAPSHOT) echo "OK: -SNAPSHOT version, continuing snapshot deploy." ;;
+            *-SNAPSHOT) echo "OK: -SNAPSHOT version, continuing local snapshot staging." ;;
             *) echo "::error::Refusing to publish non-SNAPSHOT version '$VERSION' from the snapshot job. Snapshot publishing requires a -SNAPSHOT version; releases go through the v* tag path."; exit 1 ;;
           esac
-      # Informational only (nothing depends on it): logs the effective POM with the same
-      # profile as the deploy below, so the resolved central-publishing configuration
-      # (waitUntil/waitMaxTime etc.) is visible for debugging.
       - name: Show effective POM (debug)
-        run: mvn --batch-mode --no-transfer-progress -P release help:effective-pom
-      # -Dmaven.repository.credentialScope=id: Maven 3.10 (on the runners since 2026-10) sends a server's
-      # credentials only to its declared origins, and for the id `central` that is repo.maven.apache.org --
-      # an upload to central.sonatype.com then goes out anonymously and fails with HTTP 401.
-      # Restores id-only matching; replace with setup-java's `mvn-server-repository-origins:
-      # central:https://central.sonatype.com` once a release of setup-java ships that input.
-      - name: Deploy snapshot
-        run: mvn --batch-mode --no-transfer-progress -Dmaven.repository.credentialScope=id -P release deploy -DskipTests
+        run: mvn --batch-mode --no-transfer-progress -P release -DskipUpload=true help:effective-pom
+      - name: Stage snapshot
+        run: mvn --batch-mode --no-transfer-progress -P release -DskipUpload=true deploy -DskipTests
         env:
-          MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
-          MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      # Runs even when the deploy step failed: a Central publish-poll timeout reds the
-      # job *after* the bundle was uploaded (and typically published server-side), while
-      # the signed jars and poms + .asc files already exist in target/ (signing happens at
-      # verify). Collecting on failure lets the github-snapshot job still attach them.
-      - name: Collect signed artifacts
-        if: ${{ !cancelled() }}
-        run: |
-          mkdir -p signed-snapshot-assets
-          cp target/*.jar signed-snapshot-assets/ 2>/dev/null || true
-          cp target/*.jar.asc signed-snapshot-assets/ 2>/dev/null || true
-          # maven-gpg writes target/<artifactId>-<version>.pom next to its .pom.asc; Central has both.
-          cp target/*.pom signed-snapshot-assets/ 2>/dev/null || true
-          cp target/*.pom.asc signed-snapshot-assets/ 2>/dev/null || true
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
-        if: ${{ !cancelled() }}
+      - name: Finalize and secure the signed publication
+        id: finalize
+        uses: bernardladenthin/actions/java/finalize-publication@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
         with:
-          name: signed-snapshot-assets
-          path: signed-snapshot-assets/
+          channel: snapshot
 
   github-snapshot:
     name: Update Snapshot Pre-release on GitHub
-    needs: [publish-snapshot]
-    # Also runs when publish-snapshot FAILED (not when skipped/cancelled): a Central
-    # publish-poll timeout reds that job after the artifacts were already uploaded —
-    # the GitHub pre-release assets must not be lost in that case.
-    if: ${{ !cancelled() && (needs.publish-snapshot.result == 'success' || needs.publish-snapshot.result == 'failure') }}
+    needs:
+      - publish-snapshot
+    if: ${{ !cancelled() && needs.publish-snapshot.outputs.assets_complete == 'true' }}
     runs-on: ubuntu-latest
+    concurrency:
+      group: snapshot-release-${{ github.repository }}
+      cancel-in-progress: false
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+      - uses: bernardladenthin/actions/java/publish-github@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
         with:
-          name: signed-snapshot-assets
-          path: snapshot-assets/
-      - name: Report unsigned assets (does not block the upload)
-        # Deliberately NON-blocking, and deliberately BEFORE the upload. Both attach jobs run even
-        # when their publish job failed, because a Central publish-poll timeout must not cost the
-        # GitHub assets: if Central is unreachable these are the ONLY way to get the artifacts at
-        # all. Refusing to attach on a signing failure would defeat exactly that. So annotate here,
-        # upload regardless, and fail the job afterwards. Assets always land; an unsigned release is
-        # still loudly red rather than quietly wrong.
-        # See workspace/policies/fat-jar-release-assets.md, "Attach first, then go red".
-        id: signatures
-        run: |
-          set -uo pipefail
-          dir="snapshot-assets"
-          # Every attachable artifact type, not only jars: with '*.jar' alone the AARs were attached
-          # unsigned for months and nothing counted them, so the job reported success.
-          artifacts=$(find "$dir" -maxdepth 1 \( -name '*.jar' -o -name '*.aar' -o -name '*.pom' \) | sort)
-          if [ -z "$artifacts" ]; then
-            echo "::error::no artifacts in $dir -- the collection step produced nothing"
-            echo "missing=-1" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          missing=0
-          for artifact in $artifacts; do
-            if [ ! -e "$artifact.asc" ]; then
-              echo "::error::unsigned: $(basename "$artifact") has no detached .asc"
-              missing=$((missing + 1))
-            fi
-          done
-          echo "missing=$missing" >> "$GITHUB_OUTPUT"
-          [ "$missing" -eq 0 ] && echo "all $(echo "$artifacts" | wc -l) artifact(s) signed"
-          exit 0
-      - name: Update snapshot pre-release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh release view snapshot --repo ${{ github.repository }} 2>/dev/null \
-            || gh release create snapshot \
-                 --repo ${{ github.repository }} \
-                 --prerelease \
-                 --title "Snapshot (latest)" \
-                 --notes "Latest snapshot build from the main branch."
-          gh release upload snapshot snapshot-assets/* \
-            --repo ${{ github.repository }} \
-            --clobber
-      - name: Remove the assets this run did not upload
-        # `snapshot` is a rolling "latest" pre-release, and `gh release upload --clobber` replaces
-        # same-named assets but never removes any other, so every asset of every past version stayed
-        # forever: 208 on java-llama.cpp (109 of them from 5.0.x, 43 in shapes that no longer exist),
-        # and SpotBugs plugin jars an old collect step attached in 2026-05 on three repositories. A
-        # non-current asset on this release is noise by definition. The keep-set is what this run
-        # uploaded -- the files in the asset directory -- never a version pattern, which would have to
-        # be re-taught at every classifier added or dropped (how the stale shapes arose). AFTER the
-        # upload on purpose: a failed upload must not leave the release emptier than it was. And only
-        # here: a versioned v* release is history, github-release never deletes anything. Every
-        # deletion is printed by name, so the job log is the audit trail.
-        #
-        # Asset by asset, never the release. The first form of this job (2026-05-07) deleted the whole
-        # `snapshot` release with its tag and recreated it; on 2026-05-10 the runs of several main
-        # pushes minutes apart deleted it under each other, and every job of each burst but the last
-        # failed in that step with its artifacts present. The job then went with the Central
-        # migration and came back as `view || create` + `upload --clobber` without any cleanup, which
-        # is how the backlog grew (workspace/policies/fat-jar-release-assets.md has the runs). Hence
-        # three guards: an empty upload is refused (every asset would count as stale; the download
-        # and upload steps above fail first, the guard keeps it so), an asset that is already gone
-        # counts as removed (two overlapping dispatches may both pick it), and a failed deletion is
-        # reported and the rest still tried -- the assets of this upload are on the release either
-        # way, so this is "attach first, then red" like the signature check.
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-          keep="$(ls -1 snapshot-assets | sort)"
-          if [ -z "$keep" ]; then
-            echo "::error::refusing to prune: this run uploaded nothing, so every asset of the release would count as stale"
-            exit 1
-          fi
-          list_assets() {
-            gh release view snapshot --repo ${{ github.repository }} --json assets --jq '.assets[].name' | sort
-          }
-          current="$(list_assets)"
-          stale="$(comm -13 <(printf '%s\n' "$keep") <(printf '%s\n' "$current"))"
-          if [ -z "$stale" ]; then
-            echo "nothing to remove: the release holds exactly the $(printf '%s\n' "$keep" | wc -l) asset(s) of this upload"
-            exit 0
-          fi
-          echo "removing $(printf '%s\n' "$stale" | wc -l) asset(s) that are not part of this upload:"
-          failed=0
-          while IFS= read -r name; do
-            [ -n "$name" ] || continue
-            echo "  deleting $name"
-            if gh release delete-asset snapshot "$name" --repo ${{ github.repository }} --yes; then
-              continue
-            fi
-            if ! remaining="$(list_assets)"; then
-              echo "::error::could not delete $name, and could not re-read the release to tell whether it is gone"
-              failed=$((failed + 1))
-            elif printf '%s\n' "$remaining" | grep -qxF -- "$name"; then
-              echo "::error::could not delete $name"
-              failed=$((failed + 1))
-            else
-              echo "  $name was already gone"
-            fi
-          done <<< "$stale"
-          if [ "$failed" -ne 0 ]; then
-            echo "::error::$failed asset(s) could not be removed; the $(printf '%s\n' "$keep" | wc -l) asset(s) of this upload are on the release"
-            exit 1
-          fi
-          echo "kept the $(printf '%s\n' "$keep" | wc -l) asset(s) of this upload"
-      - name: Fail if anything was attached unsigned
-        # After the upload on purpose: the assets must exist even when the signature does not.
-        if: ${{ always() && steps.signatures.outputs.missing != '0' }}
-        run: |
-          echo "::error::${{ steps.signatures.outputs.missing }} asset(s) attached without a signature (-1 means none were collected at all)"
-          exit 1
+          channel: snapshot
+          assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
   publish-release:
-    name: Publish Release to Central
-    needs: [check-tag, code-style, smoke-jar, shared-files, vmlens]
+    name: Prepare and verify signed release artifacts
+    needs:
+      - check-tag
+      - code-style
+      - smoke-jar
+      - repository-checks
+      - vmlens
     if: needs.check-tag.result == 'success' && inputs.publish_to_central
     runs-on: ubuntu-latest
     environment: maven-central
+    outputs:
+      assets_complete: ${{ steps.finalize.outputs.complete }}
     permissions:
-      contents: write
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
@@ -608,89 +443,108 @@ jobs:
           server-password: MAVEN_PASSWORD
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
-      # Informational only (nothing depends on it): logs the effective POM with the same
-      # profile as the deploy below, so the resolved central-publishing configuration
-      # (waitUntil/waitMaxTime etc.) is visible for debugging.
       - name: Show effective POM (debug)
-        run: mvn --batch-mode --no-transfer-progress -P release help:effective-pom
-      # -Dmaven.repository.credentialScope=id: see the first deploy step of this file (Maven 3.10).
-      - name: Deploy release
-        run: mvn --batch-mode --no-transfer-progress -Dmaven.repository.credentialScope=id -P release deploy -DskipTests
+        run: mvn --batch-mode --no-transfer-progress -P release -DskipUpload=true help:effective-pom
+      - name: Stage release
+        run: mvn --batch-mode --no-transfer-progress -P release -DskipUpload=true deploy -DskipTests
         env:
-          MAVEN_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
-          MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-      # Runs even when the deploy step failed: a Central publish-poll timeout reds the
-      # job *after* the bundle was uploaded (and typically published server-side), while
-      # the signed jars and poms + .asc files already exist in target/ (signing happens at
-      # verify). Collecting on failure lets the github-release job still attach them.
-      - name: Collect signed artifacts
-        if: ${{ !cancelled() }}
-        run: |
-          mkdir -p signed-release-assets
-          cp target/*.jar signed-release-assets/ 2>/dev/null || true
-          cp target/*.jar.asc signed-release-assets/ 2>/dev/null || true
-          # maven-gpg writes target/<artifactId>-<version>.pom next to its .pom.asc; Central has both.
-          cp target/*.pom signed-release-assets/ 2>/dev/null || true
-          cp target/*.pom.asc signed-release-assets/ 2>/dev/null || true
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
-        if: ${{ !cancelled() }}
+      - name: Finalize and secure the signed publication
+        id: finalize
+        uses: bernardladenthin/actions/java/finalize-publication@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
         with:
-          name: signed-release-assets
-          path: signed-release-assets/
+          channel: release
 
   github-release:
     name: Attach Binaries to GitHub Release
-    needs: [publish-release]
-    # Also runs when publish-release FAILED (not when skipped/cancelled): a Central
-    # publish-poll timeout reds that job after the artifacts were already uploaded —
-    # the GitHub release assets must not be lost in that case.
-    if: ${{ !cancelled() && (needs.publish-release.result == 'success' || needs.publish-release.result == 'failure') }}
+    needs:
+      - publish-release
+    if: ${{ !cancelled() && needs.publish-release.outputs.assets_complete == 'true' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
+      - uses: bernardladenthin/actions/java/publish-github@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
         with:
-          name: signed-release-assets
-          path: release-assets/
-      - name: Report unsigned assets (does not block the upload)
-        # Deliberately NON-blocking, and deliberately BEFORE the upload. Both attach jobs run even
-        # when their publish job failed, because a Central publish-poll timeout must not cost the
-        # GitHub assets: if Central is unreachable these are the ONLY way to get the artifacts at
-        # all. Refusing to attach on a signing failure would defeat exactly that. So annotate here,
-        # upload regardless, and fail the job afterwards. Assets always land; an unsigned release is
-        # still loudly red rather than quietly wrong.
-        # See workspace/policies/fat-jar-release-assets.md, "Attach first, then go red".
-        id: signatures
-        run: |
-          set -uo pipefail
-          dir="release-assets"
-          # Every attachable artifact type, not only jars: with '*.jar' alone the AARs were attached
-          # unsigned for months and nothing counted them, so the job reported success.
-          artifacts=$(find "$dir" -maxdepth 1 \( -name '*.jar' -o -name '*.aar' -o -name '*.pom' \) | sort)
-          if [ -z "$artifacts" ]; then
-            echo "::error::no artifacts in $dir -- the collection step produced nothing"
-            echo "missing=-1" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          missing=0
-          for artifact in $artifacts; do
-            if [ ! -e "$artifact.asc" ]; then
-              echo "::error::unsigned: $(basename "$artifact") has no detached .asc"
-              missing=$((missing + 1))
-            fi
-          done
-          echo "missing=$missing" >> "$GITHUB_OUTPUT"
-          [ "$missing" -eq 0 ] && echo "all $(echo "$artifacts" | wc -l) artifact(s) signed"
-          exit 0
-      - name: Upload release assets
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
-        with:
-          files: release-assets/*
-      - name: Fail if anything was attached unsigned
-        # After the upload on purpose: the assets must exist even when the signature does not.
-        if: ${{ always() && steps.signatures.outputs.missing != '0' }}
-        run: |
-          echo "::error::${{ steps.signatures.outputs.missing }} asset(s) attached without a signature (-1 means none were collected at all)"
-          exit 1
+          channel: release
+          assets-complete: ${{ needs.publish-release.outputs.assets_complete }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+  central-snapshot:
+    name: Upload checked snapshot artifacts to Maven Central
+    needs:
+      - publish-snapshot
+    if: ${{ !cancelled() && needs.publish-snapshot.outputs.assets_complete == 'true' }}
+    runs-on: ubuntu-latest
+    environment: maven-central
+    # One transfer at a time; an older commit finishing late is skipped (the superseded check).
+    concurrency:
+      group: central-snapshot-${{ github.repository }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Transfer frozen artifacts (no rebuild, signing or validation polling)
+        uses: bernardladenthin/actions/java/publish-central@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+        with:
+          channel: snapshot
+          assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }}
+          username: ${{ secrets.CENTRAL_USERNAME }}
+          password: ${{ secrets.CENTRAL_TOKEN }}
+
+  central-release:
+    name: Upload checked release artifacts to Maven Central
+    needs:
+      - publish-release
+    if: ${{ !cancelled() && needs.publish-release.outputs.assets_complete == 'true' }}
+    runs-on: ubuntu-latest
+    environment: maven-central
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Transfer frozen artifacts (no rebuild, signing or validation polling)
+        uses: bernardladenthin/actions/java/publish-central@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+        with:
+          channel: release
+          assets-complete: ${{ needs.publish-release.outputs.assets_complete }}
+          username: ${{ secrets.CENTRAL_USERNAME }}
+          password: ${{ secrets.CENTRAL_TOKEN }}
+
+  attest-snapshot:
+    name: Attest the checked snapshot publication
+    needs:
+      - publish-snapshot
+    if: ${{ !cancelled() && needs.publish-snapshot.outputs.assets_complete == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: bernardladenthin/actions/java/attest-publication@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+        with:
+          channel: snapshot
+          assets-complete: ${{ needs.publish-snapshot.outputs.assets_complete }}
+
+  attest-release:
+    name: Attest the checked release publication
+    needs:
+      - publish-release
+    if: ${{ !cancelled() && needs.publish-release.outputs.assets_complete == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: bernardladenthin/actions/java/attest-publication@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+        with:
+          channel: release
+          assets-complete: ${{ needs.publish-release.outputs.assets_complete }}
diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
index 7d19b492..b7505185 100644
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@@ -2,15 +2,16 @@
 #
 # SPDX-License-Identifier: MIT OR Apache-2.0
 
+# Template of bernardladenthin/actions (templates/common); the job is its reusable workflow.
 name: REUSE Compliance Check
 on:
   push:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6
+    uses: bernardladenthin/actions/.github/workflows/reuse.yml@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index f8cc69c1..30b7df07 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -2,39 +2,22 @@
 #
 # SPDX-License-Identifier: MIT OR Apache-2.0
 
+# Template of bernardladenthin/actions (templates/java); the job is its reusable workflow.
+# A repository with an analysis of its own (another build, coverage merging) excludes this template.
 name: SonarQube
+
 on:
   push:
     branches:
       - main
   pull_request:
     types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
 jobs:
   build:
-    name: Build and analyze
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
-      - name: Set up JDK 21
-        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6
-        with:
-          java-version-file: .java-version
-          distribution: 'zulu'
-      - name: Cache SonarQube packages
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: ~/.sonar/cache
-          key: ${{ runner.os }}-sonar
-          restore-keys: ${{ runner.os }}-sonar
-      - name: Cache Maven packages
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-          restore-keys: ${{ runner.os }}-m2
-      - name: Build and analyze
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: mvn -B --no-transfer-progress verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=bernardladenthin_streambuffer
+    uses: bernardladenthin/actions/.github/workflows/java-sonarqube.yml@7646ab0603d75ee130463eceaa8988f7352e2d6a # v1.0.0
+    secrets:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/.gitignore b/.gitignore
index a2c6376b..ad3fc7f6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -56,5 +56,5 @@ src/test/jpf/jpf-output*.log
 # Netbeans files
 nbactions.xml
 
-# Python bytecode of the .github/buildcheck checks
+# Python bytecode
 __pycache__/
diff --git a/.java-version b/.java-version
index aabe6ec3..7273c0fa 100644
--- a/.java-version
+++ b/.java-version
@@ -1 +1 @@
-21
+25
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40857c24..d916aafe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- **The shared CI code moved to [bernardladenthin/actions](https://github.com/bernardladenthin/actions).**
+  The build-check library, the publication gate and its consumers, the signing-key checks and the
+  shared scripts and workflows are actions and reusable workflows there, pinned by commit; the
+  `shared-files` job and `.github/shared-files.sha256` are replaced by the `repository-checks` job,
+  configured in `.github/actions-config.json`: the files this repository must carry are compared with
+  the templates there, and the publication wiring and a dry run of the release asset contract are
+  checked in every pull request.
+- **Releases and snapshots are published through one local gate.** The publish jobs stage and sign
+  everything, `publication.py prepare` checks the exact file set, every signature and the version
+  against the tag (`v<version>`, no `-SNAPSHOT`; `check-tag` / `check-snapshot` check it first), and
+  freezes the result; the GitHub release, the Maven Central transfer and the provenance attestation
+  are independent jobs on that frozen package, so a Central outage no longer hides the GitHub files and
+  nothing is attached before the gate has passed. Builds run on JDK 25 (`.java-version`); the
+  published bytecode target is unchanged. Every published jar carries `LICENSE` and `THIRD_PARTY.md`
+  under `META-INF/third-party/`.
+
 ### Added
 - OpenSSF Best Practices badge added to README (project 12861).
 - `CONTRIBUTING.md` with build instructions, test policy, and PR workflow.
diff --git a/CLAUDE.md b/CLAUDE.md
index 020566e1..b1ac2cac 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -227,19 +227,23 @@ on a consumer's JVM. This repo is the least exposed of the four siblings — it
 its deliverable is the plain library jar, not a fat jar — but it runs the same gate so a future
 dependency cannot change that quietly.
 
-**The gate: `.github/verify-bytecode-version.sh`.** Kept **byte-identical** across java-llama.cpp /
-BitcoinAddressFinder / streambuffer / srcmorph (listed in `.github/shared-files.sha256`, checked by the `shared-files` job).
+**The gate: the `java/verify-bytecode` action of [bernardladenthin/actions](https://github.com/bernardladenthin/actions)** (its `verify-bytecode-version.sh`).
 It opens every `.class` in every jar it is given and fails on any whose class-file major version
-exceeds `--max-major`:
-
-```bash
-.github/verify-bytecode-version.sh --max-major 52 [--allow '<jar>:<entry>']... <jar-or-dir>...
+exceeds `max-major`:
+
+```yaml
+- uses: bernardladenthin/actions/java/verify-bytecode@<commit> # v1.x.y
+  with:
+    max-major: "52"
+    paths: |          # jars or directories, one per line
+      jars
+    allow: |          # optional: '<jar-basename>:<entry-path>' globs to tolerate
 ```
 
 Paths may be jars or directories (searched recursively for `*.jar`). `module-info.class` and
 `META-INF/versions/**` are skipped unconditionally: a classpath JVM never loads either, which is
 why the `release 9` `module-info` here is fine. `--allow` is a repeatable glob matched against
-`<jar-basename>:<entry-path>` for anything else that must be tolerated. Exit codes: 0 clean,
+`<jar-basename>:<entry-path>` for anything else that must be tolerated (`allow`). Exit codes: 0 clean,
 1 violations, **2 nothing to scan** (an empty input is a failure, never a pass). Wired into the
 `smoke-jar` job, ahead of the smoke test itself.
 
@@ -263,41 +267,54 @@ enforcer default gotcha are in
 
 The thin jar, its sources and javadoc jars and the pom are attached to the GitHub `snapshot`
 pre-release and to every versioned release with the `.asc` maven-gpg wrote at deploy; no fat jar
-exists here. The attach jobs are shared text with the two sibling Maven-only repositories
-(`publish.yml#github-snapshot` / `#github-release` in `shared-files.sha256`): the collect steps copy
-`<artifactId>-<version>.pom` + `.pom.asc` with the jars (maven-gpg writes both into `target/`), the
-signature check counts every attachable type (`*.jar`, `*.aar`, `*.pom`), and `github-snapshot` ends
-by deleting every asset of the `snapshot` pre-release that the run did not upload, each printed by
-name -- `gh release upload --clobber` never removed anything, so the release accumulated every past
-version. The prune refuses an empty upload, treats an asset that is already gone as removed and
-fails only after trying every deletion; versioned releases are never pruned. See the policy's
-"Attach first, then go red" and "The `snapshot` pre-release holds exactly the current upload", which
-also records the delete-and-recreate form of this job (May 2026) and why it is gone.
-
-## Shared files and the release gate (`shared-files` job)
-
-Files kept byte-identical with java-llama.cpp, BitcoinAddressFinder, srcmorph and streambuffer are
-listed with their SHA-256 in **`.github/shared-files.sha256`** — the reference for what must stay
-equal. An entry `.github/workflows/publish.yml#<job>` stands for one job of the workflow: the jobs kept
-identical across the repositories (`startgate`, `shared-files`, `verify-signing-key`, `check-snapshot`,
-`check-tag`, `verify-signing-key-gradle`, `github-snapshot`, `github-release`) are checked like files. An entry ending in `?repo` covers a file or job identical up to the
-repository's name (hashed with the name replaced by `{repo}`), e.g. `SUPPORT.md?repo`.
-The `shared-files` job of `publish.yml` (gating both publish jobs) fails when a listed file changed here alone and warns when another repository's
-default branch lists it with a different hash. To change a shared file, change every copy, then run
-`python3 .github/check-shared-files.py --write` in each repository. The shared build-check library
-(`.github/buildcheck/`, stdlib-only Python with unit tests: `python3 -m unittest discover -s
-.github/buildcheck/tests -t .github`) also runs **`check-release-gate.py`**: every job must gate both
-publish jobs unless `.github/release-gate-exemptions.txt` names it with a reason, and
-**`check-versions.py`**, which **warns** where a Maven dependency or plugin (incl. the Spotless
-formatter version) is used here in another version than in a sibling repository -- Dependabot bumps
-each repository on its own, so this is where the drift shows; it also compares the Kotlin Gradle plugins
-of a repository's `*.gradle.kts` files with its POMs' Kotlin, the files Dependabot never sees -- and
-**`check-run-scripts.py`**, which
-runs `bash -n` over every `run:` script of the workflows and composite actions that runs in bash, so
-a broken script (a lost line continuation, say) fails here instead of in the job running it. The JDK every
-workflow uses is `.java-version` (setup-java's `java-version-file`), the same shared file in all four. Details and the
-reasoning (copies with a checksum rather than a shared actions repository):
-[`../workspace/crossrepostatus.md`](../workspace/crossrepostatus.md), "Cross-repo byte-identical files".
+exists here. Every publication goes through the one gate of [bernardladenthin/actions](https://github.com/bernardladenthin/actions) (full text: [docs/publication.md](https://github.com/bernardladenthin/actions/blob/main/docs/publication.md)).
+`check-snapshot` / `check-tag` run `java/check-release-ref`: a release publishes only from the tag
+`v<version>` of a non-SNAPSHOT version, a snapshot only a `-SNAPSHOT` version and never from a tag.
+The publish jobs stage and sign the Central files locally (`-DskipUpload=true deploy`) and end in
+`java/finalize-publication`, which collects what `.github/release-assets.json` names (Maven modules
+are discovered from the POMs), checks it -- exact membership, every signature with `gpg --verify`,
+each Central file byte-equal to its GitHub twin -- and freezes it into one package. Only after that
+package is uploaded does the job output `assets_complete=true`; a missing file or signature fails
+there, and nothing is published. Three pairs of consumers each need only that output, never each
+other: `github-snapshot` / `github-release` (`java/publish-github`: the rolling `snapshot`
+pre-release is serialized, never lets an older commit or run replace a newer one, prunes only after a
+complete upload and starts as a draft; a versioned tag is refused), `central-snapshot` /
+`central-release` (`java/publish-central`, no rebuild, no re-signing) and `attest-snapshot` /
+`attest-release` (`java/attest-publication`). The jobs themselves stay in this workflow
+(environment, permissions, concurrency); `java/check-publication` checks their wiring in every pull
+request.
+
+## Shared CI: bernardladenthin/actions (`repository-checks` job)
+
+The CI code the four Java repositories (java-llama.cpp, BitcoinAddressFinder, srcmorph,
+streambuffer) share lives once in [bernardladenthin/actions](https://github.com/bernardladenthin/actions): composite actions for single steps (`uses:
+bernardladenthin/actions/<common|java>/<action>@<commit> # v1.x.y`), reusable workflows for whole
+jobs (CodeQL, Maven dependency submission, REUSE, OSV-Scanner, SonarQube -- the workflow files here
+only name the triggers), and templates for the files this repository has to carry itself.
+Dependabot moves the pins with every release of that repository. Until 2026-10 the same code was
+four byte-identical copies held together by a `.github/shared-files.sha256` manifest per repository.
+
+The `repository-checks` job of `publish.yml` (gating both publish jobs) runs its checks, configured
+in **`.github/actions-config.json`**:
+
+- **templates**: every file this repository keeps equal to a template there (community files,
+  licenses, `.editorconfig`, `.gitattributes`, `.java-version`, `.mvn/`, Dependabot, the workflow
+  callers, `scorecard.yml`, the Claude workflows) still equals it, up to the repository's name and
+  the action pins. To change one, change the template in bernardladenthin/actions; `python3 -m
+  actionlib.common.templates --write` (with its `lib/` on `PYTHONPATH`) writes it here;
+- **release gate**: every job gates both publish jobs unless `.github/release-gate-exemptions.txt`
+  names it with a reason;
+- **run scripts**: `bash -n` over every bash `run:` script of the workflows and local actions, so a
+  broken script (a lost line continuation, say) fails here instead of in the job running it;
+- **Maven versions** (warnings only): a dependency or plugin (incl. the Spotless formatter version)
+  used here in another version than in a sibling of the `java-maven` family (each sibling's POMs come
+  from its own configuration), and Kotlin Gradle plugins behind the POMs' Kotlin;
+- **publication**: the publication jobs are wired as the actions expect, and a dry run of
+  `.github/release-assets.json` against the real POMs collects exactly what it promises.
+
+The JDK every workflow uses is `.java-version` (setup-java's `java-version-file`), a template of
+the `java` set. Why a repository instead of copies:
+[`../workspace/crossrepostatus.md`](../workspace/crossrepostatus.md).
 
 ## Open TODOs
 
diff --git a/README.md b/README.md
index a583b84e..fb79c225 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,7 @@
 
 **AI:**  
 [![Claude](https://img.shields.io/badge/Claude-D97757?logo=claude&logoColor=fff)](#)  
+[![CodeRabbit Pull Request Reviews](https://img.shields.io/coderabbit/prs/github/bernardladenthin/streambuffer?utm_source=oss&utm_medium=github&utm_campaign=bernardladenthin%2Fstreambuffer&labelColor=171717&color=FF570A&label=CodeRabbit+Reviews)](https://coderabbit.ai)
 
 **Build:**  
 ![Java 8+](https://img.shields.io/badge/Java-8%2B-informational)  
diff --git a/REUSE.toml b/REUSE.toml
index 4b48f795..8bf72790 100644
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -12,8 +12,8 @@ precedence = "aggregate"
 SPDX-FileCopyrightText = "2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>"
 SPDX-License-Identifier = "Apache-2.0"
 
-# The issue/PR templates are kept byte-identical in java-llama.cpp, BitcoinAddressFinder, srcmorph
-# and streambuffer (.github/shared-files.sha256) and carry the license of the other shared files.
+# The issue/PR templates are templates of bernardladenthin/actions (templates/common), checked by
+# its check-templates action, and carry the license of the other template files.
 # Last in this file on purpose: of several matching annotations the last one applies.
 [[annotations]]
 path = [
diff --git a/THIRD_PARTY.md b/THIRD_PARTY.md
new file mode 100644
index 00000000..dfaa9dec
--- /dev/null
+++ b/THIRD_PARTY.md
@@ -0,0 +1,31 @@
+<!--
+SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+
+SPDX-License-Identifier: MIT OR Apache-2.0
+-->
+
+# Third-party license and attribution notes
+
+The project is Apache-2.0. Its only compile dependencies are optional annotation libraries
+(Error Prone annotations and JSpecify, Apache-2.0; Checker Framework qualifiers, MIT): consumers
+do not receive them transitively, and the JVM never loads them, so the library has no runtime
+dependency.
+JMH 1.37, JCStress 0.16, Lincheck 3.7, JUnit and jqwik are test-only tools.
+Lincheck includes LGPL-3.0-or-later source files as well as its declared MPL license.
+A FOSSA scan of the old master revision does not cover this current build.
+
+## Review evidence
+
+See [the dependency license review](https://github.com/bernardladenthin/actions/blob/main/docs/dependency-license-review.md) of bernardladenthin/actions
+for exact-version evidence and remaining decisions. This inventory is not an approval of all
+licenses found by a scanner. Test-tool redistribution requires a separate review.
+
+For unchanged Maven components, source is available from
+`https://repo.maven.apache.org/maven2/<groupId with slashes>/<artifactId>/<version>/`
+as `<artifactId>-<version>-sources.jar`; POMs and upstream source repositories provide provenance.
+Preserve copyright, license and NOTICE files when redistributing dependencies.
+
+streambuffer ships no fat JAR, so the license collector of bernardladenthin/actions
+(`actionlib.java.thirdpartylicenses`), which puts dependency legal files into the runnable fat JARs
+of BitcoinAddressFinder and srcmorph, does not run here.
+This source-location statement does not clear unknown proprietary or historical Git findings.
diff --git a/pom.xml b/pom.xml
index a676a450..56f0abe7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -30,7 +30,7 @@ SPDX-License-Identifier: Apache-2.0
              contributor PR that bumps this MUST be rejected. See CLAUDE.md
              section "jqwik prompt-injection in test output" for full context. -->
         <jqwik.version>1.9.3</jqwik.version>
-        <errorprone.version>2.50.0</errorprone.version>
+        <errorprone.version>2.51.0</errorprone.version>
         <nullaway.version>0.14.2</nullaway.version>
         <jspecify.version>1.0.1</jspecify.version>
         <checker.version>4.3.1</checker.version>
@@ -46,6 +46,10 @@ SPDX-License-Identifier: Apache-2.0
         <vmlens.version>1.2.28</vmlens.version>
         <project.build.outputTimestamp>${git.commit.time}</project.build.outputTimestamp>
         <sonar.organization>bernardladenthin</sonar.organization>
+        <!-- No Python or other code under .github is covered by a report that reaches Sonar (the
+             shared checks run from bernardladenthin/actions), so counting it would only ever show
+             0 %. Its issues are still analysed. -->
+        <sonar.coverage.exclusions>.github/**</sonar.coverage.exclusions>
     </properties>
     <inceptionYear>2014</inceptionYear>
     <developers>
@@ -226,6 +230,19 @@ SPDX-License-Identifier: Apache-2.0
         </dependency>
     </dependencies>
     <build>
+        <resources>
+            <resource>
+                <directory>${project.basedir}/src/main/resources</directory>
+            </resource>
+            <resource>
+                <directory>${project.basedir}</directory>
+                <targetPath>META-INF/third-party/net.ladenthin/${project.artifactId}</targetPath>
+                <includes>
+                    <include>LICENSE</include>
+                    <include>THIRD_PARTY.md</include>
+                </includes>
+            </resource>
+        </resources>
         <pluginManagement>
             <plugins>
                 <plugin>
@@ -803,10 +820,8 @@ SPDX-License-Identifier: Apache-2.0
                         <configuration>
                             <publishingServerId>central</publishingServerId>
                             <autoPublish>true</autoPublish>
-                            <!-- validated: wait only for portal validation (where real errors surface), not the slow server-side publish; autoPublish completes it -->
-                            <waitUntil>validated</waitUntil>
-                            <!-- seconds; generous headroom for the validation poll (default 1800) -->
-                            <waitMaxTime>21600</waitMaxTime>
+                            <!-- uploaded: acknowledge transfer only; Central validates and publishes asynchronously -->
+                            <waitUntil>uploaded</waitUntil>
                         </configuration>
                     </plugin>
                 </plugins>