[Mikola Lysenko (mikolalysenko)]

Vendored JVM (Maven reactor) liveness attested in cases where hosted mode and VEX discovery don't. The owner rule says hosted's stricter behavior is ground truth, so this PR brings vendored mode in line.

What attested wrongly, and the fix

J2: executable classifier and type copies. The project could also declare an executable copy of the patched GA: <classifier>tests</classifier>, a native classifier, or <type>test-jar</type>. The planner only warned (or, for typed copies, skipped silently), so the entry still attested. The classifier-less pin doesn't retarget the copy, and the vendored tree serves only the main jar, so Maven fetches the public release and its code runs.

• Now a used (non-dependencyManagement) executable copy is uncertain, and so not attestable, unless every pom that reads it resolves the suffixed version. That check uses the same inheritor/profile override check as the main jar.
• The rule is shared in formats::maven:
  • is_main_jar: untyped or jar, no classifier.
  • is_executable_variant: a type counts as the classifier it implies (test-jar → tests, ejb-client → client, java-source / javadoc → non-executable). Every other type except pom is executable.
  • is_executable_classifier: everything except sources / javadoc. Hosted mode and discovery use it too.
• Vendored mode is stricter than discovery in one case: a copy inside a <profile> also blocks attestation, because the profile may be active.

J8: unscoped "wired" check. maven_reactor::wired_checked searched every reactor pom's text for the suffixed version. A suffixed version that appeared only in a build plugin's dependencies, a <profile>, an unused property, another artifact's declaration or a classifier copy kept the entry wired.

• Now "wired" needs a <dependencies> or <dependencyManagement> declaration outside <profiles> that names the main jar at the suffixed version. Doc::declarations already excludes <build> and <reporting>.
• ${...} is interpolated in the declaring pom and in every pom that inherits it, as Maven interpolates after inheritance.
• A version-less declaration must also read the pin from the nearest local <dependencyManagement> on its chain. One pinned local root no longer proves an unpinned sibling root.
• vex, vendor --check and the planner's refuse_unwired use this check.

J15: fail-open on read errors. entry_wired was unwrap_or(true), so an unreadable or unparseable pom made Discovery::vendor_entry_live report a JVM entry as live. It now fails closed.

GC, the takeover classifier and vendor --check

• scan --prune GC: unchanged on purpose. It uses entry_references, which still answers "keep" on a read error. The old text search stays as maven_reactor::references_checked for the GC only, because the .mvn/maven.config tail repository also serves plugin resolution: a tree a <build> plugin or a profile still names must not be reverted out from under the build.
• scan's overlap takeover classifier: now uses a tri-state: apply::entry_liveness, Discovery::vendor_entry_liveness and LedgerLiveness::vendor_entry_state. "Unknown" is not "dead": an unreadable pom, or a tree still referenced without attestable wiring, gives None. The classifier stays silent then, instead of emitting redirect_supersedes_vendored ("remove ") for an entry the GC keeps.
• vendor --check: now agrees with vex. An intact, wired entry that isn't attestable stays verified, and the run gets the new warning vendor_jvm_unattested, which names the declarations. The new code is documented in CLI_CONTRACT.md. It's a warning, not a failure, because of the contract's unattested-references rule: liveness gates keep such wiring live, and re-vendoring cannot clear it.

Other behavior changes

• vendor's kept-older-patch rule: an unreadable kept entry now means the unserved upgrade fails as vendor_prebuilt_required instead of being a benign skip.
• refuse_unwired: a plan whose only wiring is a rewritten profile declaration, with no root pin, is refused as nothing_wired.
• A typed executable copy now adds a classifier_declared degraded warning to the plan.

Review findings (/code-review high)

All nine are confirmed and fixed. Each behavior test fails when its fix is neutralized.

1. test-jar skipped before the classifier check. Fixed with the shared type rule. plugin_dependencies_exclusions_and_other_types_are_untouched pinned the old silent pass-through; it now expects executable types to warn and not attest, while pom and java-source still pass silently.
2. Takeover regression on undecided claims. Fixed with the tri-state. Test: maven_takeover_stays_silent_on_an_undecided_vendored_claim (CLI), with a superseded control case.
3. Classifier copy version never override-checked. Fixed. Test: a_classifier_copy_a_reader_moves_back_to_the_base_is_not_attestable.
4. One pinned root proved an unpinned sibling root live. Fixed with the version-less management check. Test: a_version_less_declaration_under_an_unpinned_root_is_not_attestable.
5. vendor --check ignored J2. It now runs unattestable_checked and warns vendor_jvm_unattested. Test: vendor_check_reports_an_unattestable_entry.
6. Interpolation only in the declaring pom. Fixed by also interpolating in inheritors. Test: a_parent_declaration_its_modules_resolve_to_the_pin_is_wired. attestable_checked still treats a parent declaration whose ${...} the parent itself can't resolve as uncertain (property_unresolved); that rule predates this PR and I left it strict.
7. Duplicate version interpolation. Now uses Doc::coordinate.
8. Copy-pasted main-jar predicate. Extracted to Doc::is_main_jar / formats::maven::is_main_jar.
9. Uncalled maven_reactor::wired. Removed.

Tests

• Results:
  • cargo test -p socket-patch-core --lib -- vendor::jvm:: vex::discover:: formats::maven: 710 passed
  • golden committed_fixture_corpus_matches_golden: passes, output unchanged
  • -- vendor:: patch::redirect:: utils::purl_key: 3756 passed
  • CLI lib -- takeover commands::vendor::: 76 passed
  • --test vendor_jvm_cli: 54 passed
  • --test maven_sidecar_cli: 28 passed
  • --test e2e_vendor_jvm_build: 35 passed, 6 ignored
  • --test e2e_vendor_maven_build: 4 passed, 1 ignored
• cargo clippy --locked --workspace --all-features -- -D warnings and cargo fmt --all -- --check are clean.

🤖 Generated with Claude Code