From f6b08f81e675759972a3eab3b54ccd29c5199875 Mon Sep 17 00:00:00 2001
From: Bernard Ladenthin <bernard.ladenthin@gmail.com>
Date: Mon, 26 Oct 2026 21:12:05 +0100
Subject: [PATCH 1/2] chore(release): move main on to 1.4.0-SNAPSHOT

Step 6 of docs/RELEASE.md, after 1.3.0 was published from the v1.3.0 tag.
The next line is 1.4.0, not 1.3.1: it drops the fat jars (see TODO.md).

versions:set covers the four poms. README and CLAUDE.md state which version
main carries and which was last released (1.4.0-SNAPSHOT / 1.3.0), and
CLAUDE.md's paragraph about main sitting at a plain release version describes
a window that has closed again. The consumer-facing dependency snippets stay
at 1.3.0, SECURITY.md stays at 1.3.x, and [Unreleased] already compares
v1.3.0...HEAD.

mvn validate resolves the reactor at the new version.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DuAkLtHrCTx81vP5Mt4jad
---
 CLAUDE.md                     | 17 ++++++++---------
 README.md                     |  2 +-
 pom.xml                       |  2 +-
 srcmorph-cli/pom.xml          |  4 ++--
 srcmorph-maven-plugin/pom.xml |  4 ++--
 srcmorph/pom.xml              |  4 ++--
 6 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index ee9f66d6..858c07ce 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -20,12 +20,11 @@ coordinates, package, goal prefix, and every `@Parameter` property changed in th
 write `aiIndex.*` properties, the `ai-index` goal prefix, or the
 `net.ladenthin.maven.llamacpp.aiindex` package in new documentation or code; use `srcmorph.*`,
 `srcmorph`, and `net.ladenthin.maven.srcmorph.mojo` instead (see the plugin module's own section
-below). The `1.2.0` reactor release was published to Maven Central from the `v1.2.0` tag. **`main`
-currently sits at the plain release version `1.3.0`, not a `-SNAPSHOT`** — step 1 of
-`docs/RELEASE.md` (bump to the release version) is done and the `v1.3.0` tag has not been cut yet.
-Step 6 moves `main` on to the next `-SNAPSHOT` *after* the release: `main` must never again carry a
-version matching something already published, so a `-SNAPSHOT` on `main` is the normal state between
-releases, just not right now.
+below). The `1.3.0` reactor release was published to Maven Central from the `v1.3.0` tag, and `main`
+has since been moved on to `1.4.0-SNAPSHOT` (step 6 of `docs/RELEASE.md`). **A `-SNAPSHOT` on `main`
+is the normal state between releases** — `main` sits at a plain release version only in the short
+window between the release bump and the tag, which is exactly why that step exists: `main` must
+never again carry a version matching something already published.
 
 **A fourth module existed temporarily**: a tiny relocation-stub POM
 (`net.ladenthin:llamacpp-ai-index-maven-plugin`, pinned at `1.0.4`, only a
@@ -41,8 +40,8 @@ keep carrying it (and its `versions:set` exclusion footgun) in active developmen
 - **Java:** target bytecode 1.8 (production code), Java 21 test sources, built with JDK 25
 - **License:** Apache 2.0
 - **Author:** Bernard Ladenthin (Copyright 2026)
-- **Reactor version:** `1.3.0` (single shared version across `srcmorph`, `srcmorph-cli`,
-  and `srcmorph-maven-plugin`). Last released version: `1.2.0`.
+- **Reactor version:** `1.4.0-SNAPSHOT` (single shared version across `srcmorph`, `srcmorph-cli`,
+  and `srcmorph-maven-plugin`). Last released version: `1.3.0`.
 
 ---
 
@@ -309,7 +308,7 @@ mvn -pl srcmorph-maven-plugin srcmorph:generate -P srcmorph-selftest
 
 ```bash
 mvn -pl srcmorph-cli package
-java -jar srcmorph-cli/target/srcmorph-cli-1.3.0-jar-with-dependencies.jar examples/config_All.json
+java -jar srcmorph-cli/target/srcmorph-cli-1.4.0-SNAPSHOT-jar-with-dependencies.jar examples/config_All.json
 ```
 
 See `examples/` (repo root) for ready-to-run `config_*.json`/`.yaml` + paired `run_*.sh`/`.bat`
diff --git a/README.md b/README.md
index 4de56b7e..3ad1563a 100644
--- a/README.md
+++ b/README.md
@@ -223,7 +223,7 @@ on `main` with `publish_to_central` checked — not automatically on push:
 https://central.sonatype.com/repository/maven-snapshots/net/ladenthin/
 ```
 
-Current reactor version: `1.3.0`. Last released version: `1.2.0`.
+Current reactor version: `1.4.0-SNAPSHOT`. Last released version: `1.3.0`.
 
 ## A Note on History
 
diff --git a/pom.xml b/pom.xml
index 1be22c9e..9087e74a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -12,7 +12,7 @@ SPDX-License-Identifier: Apache-2.0
 
     <groupId>net.ladenthin</groupId>
     <artifactId>srcmorph-parent</artifactId>
-    <version>1.3.0</version>
+    <version>1.4.0-SNAPSHOT</version>
     <packaging>pom</packaging>
 
     <name>${project.groupId}:${project.artifactId}</name>
diff --git a/srcmorph-cli/pom.xml b/srcmorph-cli/pom.xml
index 87162c2f..c9665126 100644
--- a/srcmorph-cli/pom.xml
+++ b/srcmorph-cli/pom.xml
@@ -13,7 +13,7 @@ SPDX-License-Identifier: Apache-2.0
     <parent>
         <groupId>net.ladenthin</groupId>
         <artifactId>srcmorph-parent</artifactId>
-        <version>1.3.0</version>
+        <version>1.4.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -62,7 +62,7 @@ SPDX-License-Identifier: Apache-2.0
         <spotless.version>3.10.4</spotless.version>
         <palantir-java-format.version>2.102.0</palantir-java-format.version>
 
-        <project.build.outputTimestamp>2026-10-26T20:05:59Z</project.build.outputTimestamp>
+        <project.build.outputTimestamp>2026-10-26T20:11:27Z</project.build.outputTimestamp>
     </properties>
 
     <!--
diff --git a/srcmorph-maven-plugin/pom.xml b/srcmorph-maven-plugin/pom.xml
index 7aa1d8c6..970cbf1f 100644
--- a/srcmorph-maven-plugin/pom.xml
+++ b/srcmorph-maven-plugin/pom.xml
@@ -13,7 +13,7 @@ SPDX-License-Identifier: Apache-2.0
     <parent>
         <groupId>net.ladenthin</groupId>
         <artifactId>srcmorph-parent</artifactId>
-        <version>1.3.0</version>
+        <version>1.4.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -123,7 +123,7 @@ SPDX-License-Identifier: Apache-2.0
         <exp.pkgPrompt>package-body</exp.pkgPrompt>
         -->
 
-        <project.build.outputTimestamp>2026-10-26T20:05:59Z</project.build.outputTimestamp>
+        <project.build.outputTimestamp>2026-10-26T20:11:27Z</project.build.outputTimestamp>
 
     </properties>
 
diff --git a/srcmorph/pom.xml b/srcmorph/pom.xml
index f129b50d..9e9c3b3c 100644
--- a/srcmorph/pom.xml
+++ b/srcmorph/pom.xml
@@ -13,7 +13,7 @@ SPDX-License-Identifier: Apache-2.0
     <parent>
         <groupId>net.ladenthin</groupId>
         <artifactId>srcmorph-parent</artifactId>
-        <version>1.3.0</version>
+        <version>1.4.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 
@@ -88,7 +88,7 @@ SPDX-License-Identifier: Apache-2.0
         <spotless.version>3.10.4</spotless.version>
         <palantir-java-format.version>2.102.0</palantir-java-format.version>
 
-        <project.build.outputTimestamp>2026-10-26T20:05:59Z</project.build.outputTimestamp>
+        <project.build.outputTimestamp>2026-10-26T20:11:27Z</project.build.outputTimestamp>
     </properties>
 
     <!--

From ba737dc4f6557d2ac943c0112f7403b9cda871f5 Mon Sep 17 00:00:00 2001
From: Bernard Ladenthin <bernard.ladenthin@gmail.com>
Date: Mon, 26 Oct 2026 21:12:05 +0100
Subject: [PATCH 2/2] docs(todo): record the decision to drop the fat jars in
 1.4.0

1.3.0 is the last release with fat jars on the GitHub release. They were
never on Central: the assembly is <attach>false</attach>, the Central bundle
is collected with --maven-only, and no file rule in release-assets.json sets
"central": true. The item now lists what goes with them instead of asking
whether to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DuAkLtHrCTx81vP5Mt4jad
---
 TODO.md | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/TODO.md b/TODO.md
index b39698eb..bccdd19a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -35,18 +35,23 @@ everything below is genuinely still open.
   no AMD, Intel or second GPU here. Vulkan is reachable on any NVIDIA box and is the cheapest one to
   add next.
 
-- **Follow java-llama.cpp and drop the per-classifier fat jars? (owner's decision)** Since its
+- **Drop the fat jars in 1.4.0 (owner's decision, 2026-10-26).** 1.3.0 is the last release with
+  fat jars on GitHub; they were never on Central (`<attach>false</attach>`, `--maven-only`, and no
+  `"central": true` in `.github/release-assets.json`), so removing them touches only the GitHub
+  release. Users build their own jar locally, as `examples/windows-fatjar` shows. Since its
   modular natives java-llama.cpp ships no fat jar at all: the thin jar on Central is the deliverable,
   a GPU is `jbang --deps net.ladenthin:llama:<v>:<classifier> …`, and its smoke jobs launch the
   published jars on the classpath a consumer resolves. The same shape fits `srcmorph-cli`
   (`jbang net.ladenthin:srcmorph-cli:<v> config.json` resolves slf4j-simple and llama-platform from its
-  pom; a GPU is one more `--deps` jar) and would remove the 14 signed classifier fat jars per release,
-  the loop above and the structural-only check. It would also close a gap the current shape has: the
+  pom; a GPU is one more `--deps` jar). Removing them drops the default and 14 signed classifier fat
+  jars per release, the build loop in `publish.yml`, `sign-fatjars.sh`, `verify-classifier-fatjars.sh`
+  and `.github/release-assets.json`'s file rules. It also closes a gap the current shape has: the
   artifact `smoke-fatjar` launches is the fat jar built by the `build` job (a GitHub asset, rebuilt by
   the publish jobs' loop), while the `srcmorph-cli` jar that goes to Central is never launched by any
-  job -- a smoke over the thin jar plus its resolved runtime classpath (what java-llama.cpp's smoke
-  sets are) would test what is published. Decide before the next release that bumps to a published
-  llama 6.0.0; the classifier list is current for 6.0.0 either way.
+  job. The smoke has to move to the thin jar plus its resolved runtime classpath (what
+  java-llama.cpp's smoke sets are), so it tests what is published. `README.md`,
+  `srcmorph-cli/README.md`, `CLAUDE.md` and the eight `examples/run_*` scripts that name the fat jar
+  go with it.
 
 - **jqwik pin policy** — see [`../workspace/policies/jqwik-prompt-injection.md`](../workspace/policies/jqwik-prompt-injection.md). `jqwik.version ≤ 1.9.3` is mandatory (declared in `srcmorph/pom.xml`, the only reactor module with a jqwik test dependency).