Recover Java 1.527–1.536 release evidence inventory

docs/releases/2026-09-23-java-1.527-1.536-retrospective.md

@@ -0,0 +1,103 @@
+# Java 1.527–1.536 release evidence recovery
+
+Tracking issue: [#71](https://github.com/teaql/teaql-java/issues/71). This is a
+retrospective inventory, not a newly issued release or a security clearance.
+Observed on 2026-09-23 against the public Maven repository, remote Git tags,
+GitHub Actions history, and a fresh empty-cache Maven resolution.
+
+## Published artifact and source inventory
+
+`Maven` means the public repository returned HTTP 200 for the parent POM,
+`teaql-core` POM, and `teaql-core` JAR. `Consumer` means a JDK 21 Maven
+`dependency:get` of `io.teaql:teaql-runtime` with transitive dependencies
+succeeded from an initially empty local repository. Neither check proves all
+modules, runtime behavior, or the exact source commit used to build a JAR.
+
+| Version | Maven | Consumer | Remote tag and signature | Source/provenance limit |
+| --- | --- | --- | --- | --- |
+| `1.527` | 200 / 200 / 200 | PASS | No `v1.527-RELEASE` tag | `3a1fe09` first declares this version; published JAR commit unproven |
+| `1.528` | 200 / 200 / 200 | PASS | No tag | `2f2f43b` first declares this version; published JAR commit unproven |
+| `1.529` | 200 / 200 / 200 | PASS | No tag | `4d8dab2` first declares this version; published JAR commit unproven |
+| `1.530` | 200 / 200 / 200 | PASS | No tag | `a44a00f` first declares this version; published JAR commit unproven |
+| `1.531` | 200 / 200 / 200 | PASS | No tag | `e070e86` first declares this version; published JAR commit unproven |
+| `1.532` | 404 / 404 / 404 | Not run | No tag | `3e502ff` declares the version, but no core/parent publication was found |
+| `1.533` | 200 / 200 / 200 | PASS | No tag | `afe7f41` first declares this version; two successful workflow-dispatch runs at `44906de` and `a2c05da` used a 1.533 POM, but the exact JAR producer is unproven |
+| `1.534` | 404 / 404 / 404 | Not run | Unsigned annotated tag → `3a8298d` | Tag-triggered publish run failed with Maven HTTP 401 before parent POM deployment; do not call this a published runtime |
+| `1.535` | 200 / 200 / 200 | PASS | Unsigned annotated tag → `4b0234a` | Tag-triggered publish run failed with HTTP 401; public artifacts now exist, but their later uploader and exact source commit are unproven |
+| `1.536` | 200 / 200 / 200 | PASS | Unsigned annotated tag → `9ab328e` | Tag-triggered publish run failed with HTTP 401; public artifacts now exist, but their later uploader and exact source commit are unproven |
+
+The `1.534`, `1.535`, and `1.536` tag objects contain no PGP signature
+block; `git verify-tag` fails for each. Missing historical tags must not be
+manufactured, and existing tag names must not be moved to create an appearance
+of contemporaneous signed releases. A separately named signed attestation
+would require an explicit policy and a signer; it would not change what
+happened during the original release.
+
+The successful `1.533` dispatch runs are [32394774060](https://github.com/teaql/teaql-java/actions/runs/32394774060)
+and [32395202073](https://github.com/teaql/teaql-java/actions/runs/32395202073).
+The failed tag runs are [1.534: 32458999188](https://github.com/teaql/teaql-java/actions/runs/32458999188),
+[1.535: 32460386207](https://github.com/teaql/teaql-java/actions/runs/32460386207),
+and [1.536: 32557154129](https://github.com/teaql/teaql-java/actions/runs/32557154129).
+Each failure names `teaql-java-parent` upload and HTTP 401. The currently
+available `1.535` and `1.536` core JAR manifests say `Build-Jdk-Spec: 25`;
+this is descriptive build metadata, not a commit fingerprint.
+
+## Retained artifact fingerprints
+
+SHA-256 of the public `teaql-core` JAR downloaded on 2026-09-23:
+
+| Version | SHA-256 |
+| --- | --- |
+| `1.527` | `6e18010c81bb83f6cd28657d66e3e34b8f4457345d13aa20e06fd4516ed0850d` |
+| `1.528` | `f763d2500c38451f5e4d47ee0bc1e626bc8369e467c272897c640cc55ef102ba` |
+| `1.529` | `76de23128c5c5ea33080e5dc70b8ff22b61723108c8a5e0633a0b2bc85756533` |
+| `1.530` | `7258e23130e4c770bc34aa88f0f74967ff427f88e9858e79b2c0511174dfabbe` |
+| `1.531` | `2250475b99ce4a6f9c51f8cb8f9064415a697eb1a62369b600772766a3098e0e` |
+| `1.533` | `771beac1802cf8f20b7d4747a9d4ce1935b879e27ba04da064e8308da39bfb76` |
+| `1.535` | `071e8ddb7904974e2b9930d6ae26df6e3ccbf562c734613f2eca9a1eee888e0d` |
+| `1.536` | `f91cdd22045b8211a462b94c3cf2dcf93495f4c4ad57dd3c628d8b8dcaf033ca` |
+
+These hashes make later artifact comparison possible; they do not prove a
+source-to-binary chain. No corresponding public core JAR was found for 1.532
+or 1.534.
+
+## Human-readable change and vulnerability statement
+
+The tagged **source** interval `v1.534..v1.535` adds a typed active root to
+`UserContext` (`09276dd`). The `v1.535..v1.536` source commit introduces
+portable optimistic ID allocation (`9ab328e`). Those are source-history
+summaries, **not** verified release notes for the later-uploaded JARs. For
+1.527–1.533, no tag fixes a reliable end commit for a per-version change log.
+Consequently, a complete compatibility summary for these artifacts cannot be
+reconstructed from the evidence collected here.
+
+No contemporaneous dependency-vulnerability scan or accepted-risk record has
+been linked to an exact JAR in this range. The recent
+[#131](https://github.com/teaql/teaql-java/issues/131) scanner gate covers a
+different, newer dependency set and cannot retroactively certify these
+versions. Their vulnerability status is **not verified**; Maven resolution
+success is not a security finding. Do not label them vulnerability-free or
+assign an invented risk owner/date.
+
+## Reproduce the narrow checks
+
+```bash
+git ls-remote --tags origin
+git verify-tag v1.535-RELEASE  # expected failure: unsigned historical tag
+curl -I https://maven.teaql.io/repository/maven-releases/io/teaql/teaql-core/1.536-RELEASE/teaql-core-1.536-RELEASE.jar
+mvn -Dmaven.repo.local=/path/to/empty-cache \
+  org.apache.maven.plugins:maven-dependency-plugin:3.6.1:get \
+  -Dartifact=io.teaql:teaql-runtime:1.536-RELEASE \
+  -DremoteRepositories=teaql::default::https://maven.teaql.io/repository/maven-releases/
+```
+
+## Still open for #71
+
+- Find trustworthy source-to-artifact provenance for untagged or later-uploaded
+  versions, if such records exist; otherwise explicitly preserve `unknown`.
+- Link exact-version CI, generated-workspace, and conformance runs where they
+  can be verified. Today's empty-cache Maven resolution is not a historical
+  workspace acceptance run.
+- Decide a signed historical *attestation* policy without moving old tag names.
+- Write version-specific compatibility notes only for changes supported by a
+  proven release commit. Do not infer them from a version bump alone.