feat: finalize cyclic topology support

.cz.toml

@@ -2,5 +2,5 @@
 name = "cz_conventional_commits"
 tag_format = "v$version"
 version_scheme = "semver"
-version = "3.0.0-rc.1"
+version = "3.0.0-rc.3"
 update_changelog_on_bump = true

.gitattributes

@@ -25,3 +25,7 @@ __MACOSX/** export-ignore
 *.hprof export-ignore
 hs_err_pid*.log export-ignore
 replay_pid*.log export-ignore
+
+# These retained evidence bytes are checksum-bound and must not be normalized.
+stabilization/sdk-freeze-final/FINAL_RECEIPT.md -whitespace
+stabilization/sdk-freeze-final/changed-files.sha256 -whitespace

.github/scripts/prepare-rc-release.js

@@ -4,7 +4,7 @@ const { execFileSync } = require('node:child_process');
 const fs = require('node:fs');
 
 const CZ_TOML = '.cz.toml';
-const CANONICAL_EVIDENCE = 'docs/releases/3.0.0-rc.1-evidence.json';
+const RELEASE_AUTHORITY = 'docs/releases/3.0.0-rc.3.md';
 const MAIN_REF = process.env.RC_BASE_REF || 'origin/main';
 const VALID_BUMPS = new Set(['major', 'minor', 'patch']);
 
@@ -109,19 +109,19 @@ function nextVersionForCurrentRc(currentVersion, latestTaggedRc) {
   return `${formatVersion(parsed)}-rc.${nextRc}`;
 }
 
-function evidenceRelease(content) {
-  const evidence = JSON.parse(content);
-  if (typeof evidence.release !== 'string' || evidence.release.length === 0) {
-    throw new Error(`Canonical evidence is missing a release: ${CANONICAL_EVIDENCE}`);
+function authorityRelease(content) {
+  const match = content.match(/^RC3_VERSION:\s*(\S+)\s*$/m);
+  if (!match) {
+    throw new Error(`Release authority is missing RC3_VERSION: ${RELEASE_AUTHORITY}`);
   }
-  return evidence.release;
+  return match[1];
 }
 
-function assertEvidenceRelease(preparedVersion, content) {
-  const canonicalRelease = evidenceRelease(content);
-  if (canonicalRelease !== preparedVersion) {
+function assertAuthorityRelease(preparedVersion, content) {
+  const authorizedRelease = authorityRelease(content);
+  if (authorizedRelease !== preparedVersion) {
     throw new Error(
-      `Prepared RC ${preparedVersion} does not match canonical evidence release ${canonicalRelease}`,
+      `Prepared RC ${preparedVersion} does not match authorized release ${authorizedRelease}`,
     );
   }
 }
@@ -147,9 +147,9 @@ function prepareRcRelease() {
     console.log(`Aggregate bump: ${bump}`);
   }
 
-  assertEvidenceRelease(
+  assertAuthorityRelease(
     nextVersion,
-    fs.readFileSync(CANONICAL_EVIDENCE, 'utf8'),
+    fs.readFileSync(RELEASE_AUTHORITY, 'utf8'),
   );
 
   const nextContent = currentContent.replace(
@@ -170,8 +170,8 @@ if (require.main === module) {
 }
 
 module.exports = {
-  assertEvidenceRelease,
-  evidenceRelease,
+  assertAuthorityRelease,
+  authorityRelease,
   nextVersionForCurrentRc,
   parseVersion,
 };

.github/scripts/prepare-rc-release.test.js

@@ -2,8 +2,8 @@ const assert = require('node:assert/strict');
 const test = require('node:test');
 
 const {
-  assertEvidenceRelease,
-  evidenceRelease,
+  assertAuthorityRelease,
+  authorityRelease,
   nextVersionForCurrentRc,
   parseVersion,
 } = require('./prepare-rc-release.js');
@@ -32,24 +32,24 @@ test('advances an RC after the current tag exists', () => {
   assert.equal(nextVersionForCurrentRc('3.0.0-rc.1', 8), '3.0.0-rc.9');
 });
 
-test('reads the release bound by canonical evidence', () => {
-  assert.equal(evidenceRelease('{"release":"3.0.0-rc.1"}'), '3.0.0-rc.1');
+test('reads the release bound by the current authority', () => {
+  assert.equal(authorityRelease('RC3_VERSION: 3.0.0-rc.3\n'), '3.0.0-rc.3');
   assert.throws(
-    () => evidenceRelease('{}'),
-    /Canonical evidence is missing a release/,
+    () => authorityRelease('# missing marker\n'),
+    /Release authority is missing RC3_VERSION/,
   );
 });
 
-test('rejects a prepared RC that differs from canonical evidence', () => {
-  assert.doesNotThrow(() => assertEvidenceRelease(
-    '3.0.0-rc.1',
-    '{"release":"3.0.0-rc.1"}',
+test('rejects a prepared RC that differs from its authority', () => {
+  assert.doesNotThrow(() => assertAuthorityRelease(
+    '3.0.0-rc.3',
+    'RC3_VERSION: 3.0.0-rc.3\n',
   ));
   assert.throws(
-    () => assertEvidenceRelease(
-      '2.0.0-rc.9',
-      '{"release":"3.0.0-rc.1"}',
+    () => assertAuthorityRelease(
+      '3.0.0-rc.4',
+      'RC3_VERSION: 3.0.0-rc.3\n',
     ),
-    /Prepared RC 2\.0\.0-rc\.9 does not match canonical evidence release 3\.0\.0-rc\.1/,
+    /Prepared RC 3\.0\.0-rc\.4 does not match authorized release 3\.0\.0-rc\.3/,
   );
 });

.github/workflows/build.yml

@@ -30,7 +30,7 @@ jobs:
           - test-java: '17'
             setup-java: '17.0.19+10'
           - test-java: '21'
-            setup-java: '21.0.11+10'
+            setup-java: '21.0.11+10.0.LTS'
     env:
       CI: true
     defaults:
@@ -103,9 +103,8 @@ jobs:
       - name: Verify RC staging readiness
         if: ${{ matrix.test-java == '17' }}
         run: >-
-          ./gradlew --no-daemon --no-build-cache verifyRound13Readiness
+          ./gradlew --no-daemon --no-build-cache verifyRcReadiness
           -PblueDependencyMode=published-artifact
-          -PallowRound13LatencyException=true
           -PtestJavaVersion=17
 
       - name: Archive verification evidence

.github/workflows/release-rc.yml

@@ -39,15 +39,23 @@ jobs:
           architecture: x64
           check-latest: false
 
-      - name: Restrict Gradle to the pinned JDK
+      - name: Set up Java 21 test JDK
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '21.0.11+10.0.LTS'
+          architecture: x64
+          check-latest: false
+
+      - name: Restrict Gradle to the pinned JDKs
         shell: bash
         run: |
           set -euo pipefail
           mkdir -p "$GRADLE_USER_HOME"
           {
             echo "org.gradle.java.installations.auto-detect=false"
             echo "org.gradle.java.installations.auto-download=false"
-            echo "org.gradle.java.installations.paths=$JAVA_HOME_17_X64"
+            echo "org.gradle.java.installations.paths=$JAVA_HOME_17_X64,$JAVA_HOME_21_X64"
           } >> "$GRADLE_USER_HOME/gradle.properties"
 
       - name: Set up Node 22
@@ -109,13 +117,19 @@ jobs:
           ./gradlew --no-daemon dependencyPreflight \
             -PblueDependencyMode=published-artifact
 
-      - name: Build and stage from published dependencies
-        # RC-only policy: Gradle rejects this exception unless the declared
-        # canonical 3.0.0-rc.1 Round 13 evidence satisfies its exact guard.
+      - name: Verify the Java 21 release gate
         run: >-
-          ./gradlew --no-daemon --no-build-cache clean stageRelease
+          ./gradlew --no-daemon --no-build-cache clean releaseCheck
           -PblueDependencyMode=published-artifact
-          -PallowRound13LatencyException=true
+          -PtestJavaVersion=21
+
+      - name: Build and stage from published dependencies
+        run: |
+          set -euo pipefail
+          JAVA_HOME="$JAVA_HOME_17_X64" \
+            ./gradlew --no-daemon --no-build-cache clean stageRelease \
+            -PblueDependencyMode=published-artifact \
+            -PtestJavaVersion=17
 
       - name: Publish to Maven Central
         env:
@@ -126,10 +140,12 @@ jobs:
           JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
           JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
           JRELEASER_REPRODUCIBLE: true
-        run: >-
-          ./gradlew --no-daemon --no-build-cache jreleaserDeploy
-          -PblueDependencyMode=published-artifact
-          -PallowRound13LatencyException=true
+        run: |
+          set -euo pipefail
+          JAVA_HOME="$JAVA_HOME_17_X64" \
+            ./gradlew --no-daemon --no-build-cache jreleaserDeploy \
+            -PblueDependencyMode=published-artifact \
+            -PtestJavaVersion=17
 
       - name: Push release commit and tag
         run: git push origin HEAD:next --follow-tags

.github/workflows/release.yml

@@ -40,15 +40,23 @@ jobs:
           architecture: x64
           check-latest: false
 
-      - name: Restrict Gradle to the pinned JDK
+      - name: Set up Java 21 test JDK
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '21.0.11+10.0.LTS'
+          architecture: x64
+          check-latest: false
+
+      - name: Restrict Gradle to the pinned JDKs
         shell: bash
         run: |
           set -euo pipefail
           mkdir -p "$GRADLE_USER_HOME"
           {
             echo "org.gradle.java.installations.auto-detect=false"
             echo "org.gradle.java.installations.auto-download=false"
-            echo "org.gradle.java.installations.paths=$JAVA_HOME_17_X64"
+            echo "org.gradle.java.installations.paths=$JAVA_HOME_17_X64,$JAVA_HOME_21_X64"
           } >> "$GRADLE_USER_HOME/gradle.properties"
 
       - name: Validate Gradle wrapper
@@ -62,10 +70,19 @@ jobs:
           ./gradlew --no-daemon dependencyPreflight
           -PblueDependencyMode=published-artifact
 
-      - name: Build and stage from published dependencies
+      - name: Verify the Java 21 release gate
         run: >-
-          ./gradlew --no-daemon --no-build-cache clean stageRelease
+          ./gradlew --no-daemon --no-build-cache clean releaseCheck
           -PblueDependencyMode=published-artifact
+          -PtestJavaVersion=21
+
+      - name: Build and stage from published dependencies
+        run: |
+          set -euo pipefail
+          JAVA_HOME="$JAVA_HOME_17_X64" \
+            ./gradlew --no-daemon --no-build-cache clean stageRelease \
+            -PblueDependencyMode=published-artifact \
+            -PtestJavaVersion=17
 
       - name: Publish to Maven Central
         env:
@@ -76,9 +93,12 @@ jobs:
           JRELEASER_GPG_PUBLIC_KEY: ${{ secrets.GPG_PUBLIC_KEY }}
           JRELEASER_GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
           JRELEASER_REPRODUCIBLE: true
-        run: >-
-          ./gradlew --no-daemon --no-build-cache jreleaserDeploy
-          -PblueDependencyMode=published-artifact
+        run: |
+          set -euo pipefail
+          JAVA_HOME="$JAVA_HOME_17_X64" \
+            ./gradlew --no-daemon --no-build-cache jreleaserDeploy \
+            -PblueDependencyMode=published-artifact \
+            -PtestJavaVersion=17
 
       - name: Archive release evidence
         uses: actions/upload-artifact@v4