[Zoymusk]

Closes #114

Adds java-maven.yaml to the policy registry for Maven-built Java services (JUnit, Spring Boot, Flyway stack), following the shape of python-library.yaml.

• allowed_paths: src/main/java, src/test/java, src/main/resources, src/test/resources, pom.xml, README.md, CHANGELOG.md
• forbidden_paths: .mvn/**, settings.xml, prod application config, Flyway migrations, infra/deploy dirs, secrets/.env
• required_checks: mvn -q verify

Ran pytest tests/test_policy_registry.py — all java-maven tests pass. One pre-existing failure (test_policy_respects_force_like_the_starter_does) is unrelated to this change — it reproduces on a clean main checkout with this file stashed out.

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[Zoymusk]

I have read the CLA Document and hereby sign the CLA.

[github-actions]

Signetry Reviewer — 🟡 Needs human review

A human should decide — the required check is pending.

Deterministic gates (the authority)

Gate	Status
Required status check	⏳ pending
Secret scan	✅ clean
CI permission / OIDC	✅ no forbidden change
Dependency skew	✅ ok
All green	❌

Findings

No issues found by the deterministic scanners.

Merge

A human should review and merge.

This review is advisory. It never merges on its own judgement — the deterministic gates + a human are the authority. Findings can have false negatives; a green bot verdict is not a guarantee.

[Zoymusk]

I have read the CLA Document and hereby sign the CLA

[Zoymusk]

I have read the CLA Document and I hereby sign the CLA