diff --git a/.editorconfig b/.editorconfig
index f0c1cf12..930052fb 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 # https://editorconfig.org
 root = true
diff --git a/.gitattributes b/.gitattributes
index 0a1b8d5d..440bfb57 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,5 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 * text=auto eol=lf
+*.gguf binary
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ce0569d6..eaead476 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 # https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
 # Default reviewer for all paths.
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
index 204af027..c5f202d6 100644
--- a/.github/FUNDING.yml
+++ b/.github/FUNDING.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 # Sponsorship configuration for github.com/bernardladenthin.
 # Uncomment any line below to advertise a funding channel on the repository.
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index b6ca577e..40b634ed 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 blank_issues_enabled: false
 contact_links:
diff --git a/.github/actions/setup-openjml/action.yml b/.github/actions/setup-openjml/action.yml
index fd6e6ce0..7d5dd6f0 100644
--- a/.github/actions/setup-openjml/action.yml
+++ b/.github/actions/setup-openjml/action.yml
@@ -1,6 +1,6 @@
 # SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 name: Set up OpenJML
 description: >
diff --git a/.github/buildcheck/__init__.py b/.github/buildcheck/__init__.py
new file mode 100644
index 00000000..add4f0f5
--- /dev/null
+++ b/.github/buildcheck/__init__.py
@@ -0,0 +1,14 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""Build checks as a library, so buildcheck/tests can test them. Standard library only.
+
+Two kinds of module live here. workflow.py, releasegate.py, sharedfiles.py, versions.py and
+runscripts.py (with their tests and the check-*.py entry points next to this package) are kept
+BYTE-IDENTICAL in java-llama.cpp, BitcoinAddressFinder, srcmorph and streambuffer: each repository
+lists them in .github/shared-files.sha256, which its `shared-files` job checks (see sharedfiles.py).
+Every other module is the repository's own.
+
+Run the tests from the repository root:
+  python3 -m unittest discover -s .github/buildcheck/tests -t .github
+"""
diff --git a/.github/buildcheck/releasegate.py b/.github/buildcheck/releasegate.py
new file mode 100644
index 00000000..729e2150
--- /dev/null
+++ b/.github/buildcheck/releasegate.py
@@ -0,0 +1,60 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""Every job of publish.yml gates both publish jobs, unless the repository lists it in
+.github/release-gate-exemptions.txt with a reason.
+
+A job that nothing waits for can go red and a release still ships -- the natives-build jobs that
+`package` once forgot to wait for, and the aarch64 fat jars that were signed and attached for
+releases without any job launching them, were both of that shape. So "not gating" has to be a
+decision written down here, not the default a new job gets by being forgotten in two `needs:` lists.
+
+The check runs both ways: a job outside the gates and outside the exemptions fails, and so does an
+exemption that names no job or a job that gates both publish jobs after all (a stale
+exemption would hide the next job of that name).
+"""
+
+from . import workflow
+
+GATES = ("publish-snapshot", "publish-release")
+
+# Each repository lists its own exemptions here, one `<job>: <reason>` per line (# comments).
+EXEMPTIONS_FILE = ".github/release-gate-exemptions.txt"
+
+
+def read_exemptions(text):
+    """The exemptions file: job -> reason. A line without a reason is an error -- the point of the
+    file is that every job allowed to stay red says why."""
+    exemptions = {}
+    for number, line in enumerate(text.splitlines(), 1):
+        line = line.strip()
+        if not line or line.startswith("#"):
+            continue
+        job, _, reason = line.partition(":")
+        if not reason.strip() or not job.strip():
+            raise ValueError(f"line {number}: expected `<job>: <reason>`, got {line!r}")
+        if job.strip() in exemptions:
+            raise ValueError(f"line {number}: {job.strip()} is listed twice")
+        exemptions[job.strip()] = reason.strip()
+    return exemptions
+
+
+def check(jobs, non_gating, gates=GATES):
+    missing = [g for g in gates if g not in jobs]
+    if missing:
+        return [f"publish.yml has no job {g}" for g in missing]
+    closures = [workflow.closure(jobs, g) for g in gates]
+    failures = []
+    for name in jobs:
+        gated = [g for g, c in zip(gates, closures) if name in c]
+        if name in non_gating:
+            if len(gated) == len(gates):
+                failures.append(f"release-gate-exemptions.txt lists {name}, which gates {', '.join(gates)} "
+                                f"-- remove the stale exemption")
+        elif len(gated) != len(gates):
+            ungated = [g for g in gates if g not in gated]
+            failures.append(f"publish.yml: {', '.join(ungated)} does not wait for {name} -- add it to the "
+                            f"needs, or to release-gate-exemptions.txt with the reason it may stay red")
+    failures += [f"release-gate-exemptions.txt lists {name}, which is no job of publish.yml"
+                 for name in sorted(set(non_gating) - set(jobs))]
+    return failures
diff --git a/.github/buildcheck/runscripts.py b/.github/buildcheck/runscripts.py
new file mode 100644
index 00000000..ea685058
--- /dev/null
+++ b/.github/buildcheck/runscripts.py
@@ -0,0 +1,273 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""Every `run:` script of the workflows and composite actions that runs in bash, parsed with
+`bash -n` -- so a broken script fails the `shared-files` job in the first minutes of a run instead
+of the job that executes it, possibly hours later or only on a release path.
+
+The case this exists for: a cleanup lost the trailing backslash of six continued lines, leaving a
+line that starts with `||` or `-e` -- in a step only a publish run or a native build reaches. Neither
+actionlint (it parses scripts only when shellcheck is installed) nor a review saw it; `bash -n` sees
+every one of them.
+
+Which scripts are bash is decided the way the runner decides it: the step's `shell:`, else the job's
+and then the workflow's `defaults.run.shell`, else the runner's default -- PowerShell on a Windows
+runner, bash everywhere else. A runner chosen by an expression (a matrix, a workflow input) counts
+as Windows only when the step's `if:` says so; a step without `shell:` on such a job runs on every
+OS of the matrix and has to be valid bash anyway. Scripts in `sh`, `bash -el {0}` or a bash given by
+path are bash; pwsh, powershell, cmd and python are skipped.
+
+Like workflow.py this reads the two-space layout the workflows are written in, not general YAML.
+The run value is taken as YAML defines it: a literal block (`|`) line for line, a folded block
+(`>`) and a plain scalar folded into one line, a single-quoted scalar unquoted. A double-quoted
+scalar is skipped (its escapes are not worth a YAML parser). Every `${{ ... }}` expression becomes
+a word, which is what the runner substitutes before bash sees the script.
+"""
+
+import glob
+import os
+import re
+import shutil
+import subprocess
+import sys
+
+RUN = re.compile(r"^(?P<lead>\s*(?:- )?)run:(?:\s+(?P<value>.*?))?\s*$")
+BLOCK_HEADER = re.compile(r"^(?P<style>[|>])[-+]?[1-9]?\s*(#.*)?$")
+EXPRESSION = re.compile(r"\$\{\{.*?\}\}")
+COMMENT = re.compile(r"\s+#.*$")
+BASH_LINE = re.compile(r"line (\d+)")
+BASH_SHELLS = ("bash", "sh")
+SKIPPED_SHELLS = ("pwsh", "powershell", "cmd", "python")
+WINDOWS_IF = re.compile(r"runner\.os\s*==\s*'Windows'")
+PATTERNS = (".github/workflows/*.yml", ".github/workflows/*.yaml", ".github/actions/*/action.yml",
+            ".github/actions/*/action.yaml")
+
+
+class Script:
+    """One run script: the file line of its `run:` key, the shell it runs in, and its text."""
+
+    def __init__(self, line, shell, text, literal=False):
+        self.line = line
+        self.shell = shell
+        self.text = text
+        self.literal = literal
+
+
+def _indent(line):
+    return len(line) - len(line.lstrip())
+
+
+def _significant(line):
+    stripped = line.strip()
+    return bool(stripped) and not stripped.startswith("#")
+
+
+def _scalar(value):
+    value = COMMENT.sub("", value or "").strip()
+    if len(value) >= 2 and value[0] == value[-1] and value[0] in "'\"":
+        value = value[1:-1]
+    return value
+
+
+def _value(lines, indent, keys):
+    """The scalar at the mapping path `keys` in `lines`, its first key at `indent`, else None."""
+    for number, line in enumerate(lines):
+        if _indent(line) != indent or not line.strip().startswith(keys[0] + ":"):
+            continue
+        rest = line.strip()[len(keys[0]) + 1:]
+        if len(keys) == 1:
+            return _scalar(rest)
+        block = []
+        for following in lines[number + 1:]:
+            if _significant(following) and _indent(following) <= indent:
+                break
+            block.append(following)
+        return _value(block, indent + 2, keys[1:])
+    return None
+
+
+def _job_lines(lines, index):
+    """The lines of the workflow job containing line `index` (none in a composite action)."""
+    start = None
+    for number in range(index, -1, -1):
+        if re.match(r"^  [A-Za-z0-9_-]+:\s*(#.*)?$", lines[number]):
+            start = number
+            break
+        if lines[number] and not lines[number][0].isspace() and _significant(lines[number]):
+            return []
+    if start is None:
+        return []
+    end = len(lines)
+    for number in range(index + 1, len(lines)):
+        if _significant(lines[number]) and _indent(lines[number]) <= 2:
+            end = number
+            break
+    return lines[start:end]
+
+
+def _step_start(lines, index, key_indent):
+    """The line the step of the `run:` key at line `index` starts at; None when the key is not a
+    step's (`defaults: run:` is a mapping, not a script)."""
+    if lines[index].lstrip().startswith("- "):
+        return index
+    for number in range(index - 1, -1, -1):
+        line = lines[number]
+        if not _significant(line):
+            continue
+        if _indent(line) == key_indent - 2 and line.lstrip().startswith("- "):
+            return number
+        if _indent(line) < key_indent:
+            return None
+    return None
+
+
+def _step_lines(lines, index, key_indent):
+    """The lines of the step the `run:` key at line `index` belongs to."""
+    dash = key_indent - 2
+    start = _step_start(lines, index, key_indent)
+    end = len(lines)
+    for number in range(index + 1, len(lines)):
+        if _significant(lines[number]) and _indent(lines[number]) <= dash:
+            end = number
+            break
+    # the step's own keys, its first one written after the dash
+    return [" " * key_indent + line.lstrip()[2:] if number == start and line.lstrip().startswith("- ")
+            else line for number, line in enumerate(lines[start:end], start)]
+
+
+def _shell_name(shell):
+    first = shell.split()[0] if shell.split() else ""
+    name = re.split(r"[\\/]", first)[-1].lower()
+    return name[:-4] if name.endswith(".exe") else name
+
+
+def shell_of(lines, index, key_indent):
+    """The shell the step whose `run:` key is at line `index` runs in, as the runner decides it."""
+    step = _step_lines(lines, index, key_indent)
+    shell = _value(step, key_indent, ["shell"])
+    job = _job_lines(lines, index)
+    if not shell and job:
+        shell = _value(job, 4, ["defaults", "run", "shell"])
+    if not shell:
+        shell = _value(lines, 0, ["defaults", "run", "shell"])
+    if shell:
+        return _shell_name(shell)
+    runs_on = (_value(job, 4, ["runs-on"]) or "") if job else ""
+    condition = _value(step, key_indent, ["if"]) or ""
+    if "windows" in EXPRESSION.sub("", runs_on).lower() or WINDOWS_IF.search(condition):
+        return "pwsh"
+    return "bash"
+
+
+def _fold(lines):
+    """YAML folding of a block's lines (indentation removed): lines of equal indentation join with
+    a space, an empty line is a line break, more-indented lines keep their breaks."""
+    out = ""
+    previous = None
+    for line in lines:
+        if not line.strip():
+            out += "\n"
+            previous = "empty"
+            continue
+        more = line[0].isspace()
+        if previous == "text" and not more:
+            out += " " + line
+        else:
+            if previous is not None and previous != "empty":
+                out += "\n"
+            out += line
+        previous = "more" if more else "text"
+    return out
+
+
+def scripts(text):
+    """Every run script of a workflow or composite action, in file order."""
+    lines = text.splitlines()
+    found = []
+    number = 0
+    while number < len(lines):
+        match = RUN.match(lines[number])
+        if not match or _step_start(lines, number, len(match.group("lead"))) is None:
+            number += 1
+            continue
+        key_indent = len(match.group("lead"))
+        value = match.group("value") or ""
+        body_end = number + 1
+        while body_end < len(lines) and (not lines[body_end].strip() or _indent(lines[body_end]) > key_indent):
+            body_end += 1
+        while body_end > number + 1 and not lines[body_end - 1].strip():
+            body_end -= 1
+        body = lines[number + 1:body_end]
+        header = BLOCK_HEADER.match(value)
+        if header:
+            significant = [line for line in body if line.strip()]
+            indent = min((_indent(line) for line in significant), default=0)
+            body = [line[indent:] for line in body]
+            script = "\n".join(body) if header.group("style") == "|" else _fold(body)
+        elif value.startswith('"'):
+            script = None
+        elif value.startswith("'"):
+            script = " ".join([value] + [line.strip() for line in body]).strip()
+            script = script[1:-1].replace("''", "'") if script.endswith("'") else None
+        else:
+            script = COMMENT.sub("", " ".join([value] + [line.strip() for line in body]))
+        if script is not None:
+            found.append(Script(number + 1, shell_of(lines, number, key_indent), script,
+                                literal=bool(header) and header.group("style") == "|"))
+        number = max(body_end, number + 1)
+    return found
+
+
+def bash_n(script, bash="bash"):
+    """bash -n over the script: None when it parses, else bash's message."""
+    result = subprocess.run([bash, "-n"], input=EXPRESSION.sub("X", script), capture_output=True,
+                            text=True, check=False)
+    return None if result.returncode == 0 else result.stderr.strip() or f"exit {result.returncode}"
+
+
+def check(path, text, parser=bash_n):
+    """`path:line: message` per bash script that does not parse; the count of scripts checked."""
+    errors = []
+    checked = 0
+    for script in scripts(text):
+        if script.shell in SKIPPED_SHELLS:
+            continue
+        if script.shell not in BASH_SHELLS:
+            errors.append(f"{path}:{script.line}: unknown shell '{script.shell}' -- add it to runscripts.py")
+            continue
+        checked += 1
+        message = parser(script.text)
+        if message:
+            # bash counts a literal block's lines from 1, the first one being the line after `run: |`;
+            # a folded script has no line of the file to point at but its `run:`
+            match = BASH_LINE.search(message)
+            line = script.line + int(match.group(1)) if match and script.literal else script.line
+            errors.append(f"{path}:{line}: {message}")
+    return errors, checked
+
+
+def files(root):
+    return sorted({path for pattern in PATTERNS for path in glob.glob(os.path.join(root, pattern))})
+
+
+def main(argv, root, out=sys.stdout, err=sys.stderr):
+    """check-run-scripts.py -- bash -n over every bash run script of the workflows and actions"""
+    if argv[1:]:
+        print(main.__doc__, file=err)
+        return 2
+    bash = shutil.which("bash")
+    if not bash:
+        print("::error::bash not found", file=err)
+        return 2
+    errors = []
+    checked = 0
+    paths = files(root)
+    for path in paths:
+        with open(path, encoding="utf-8") as f:
+            found, count = check(os.path.relpath(path, root), f.read(), lambda s: bash_n(s, bash))
+        errors += found
+        checked += count
+    for error in errors:
+        print(f"::error::{error}", file=err)
+    print(f"{checked} bash run scripts in {len(paths)} files, {len(errors)} that do not parse", file=out)
+    return 1 if errors or not paths else 0
diff --git a/.github/buildcheck/sharedfiles.py b/.github/buildcheck/sharedfiles.py
new file mode 100644
index 00000000..19518ea7
--- /dev/null
+++ b/.github/buildcheck/sharedfiles.py
@@ -0,0 +1,178 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""The files kept byte-identical across java-llama.cpp, BitcoinAddressFinder, srcmorph and
+streambuffer, checked by every repository's own `shared-files` job.
+
+Each repository lists the shared files it carries, with their SHA-256, in
+.github/shared-files.sha256 -- `sha256sum` format. An entry can also name ONE JOB of a workflow,
+`.github/workflows/publish.yml#startgate`: jobs such as `startgate` or `check-tag` are kept identical
+inside four otherwise different workflows, and a job entry hashes just that job's text (its header
+and body, without the comment lines between it and the next job, which belong to the next one).
+An entry ending in `?repo` (`SUPPORT.md?repo`, `.github/workflows/publish.yml#code-style?repo`)
+stands for a file or job that is identical up to the repository's own name: it is hashed with every
+occurrence of that name replaced by `{repo}`, so a support page or a Sonar project key that names its
+repository can be shared too. `sha256sum -c` reads the plain file entries only. The job
+  * fails when a listed file is missing or its content no longer matches its line: a shared file
+    was edited here alone. Edit it in every repository that lists it, then update each manifest
+    (`check-shared-files.py --write` rewrites the hashes of this repository's lines);
+  * warns when another repository's manifest (its default branch) lists the same file with a
+    different hash: one side of a sync is not merged yet. A warning and not a failure, because a
+    sync is one change per repository and lands in four steps.
+A file is matched across repositories by its path, or, when the other side has no such path, by
+its file name if that is unique there (lombok.config lives at llama/lombok.config in the
+java-llama.cpp reactor and at the root elsewhere).
+"""
+
+import hashlib
+import os
+import re
+import sys
+import urllib.request
+
+from . import workflow
+
+REPOS = ("java-llama.cpp", "BitcoinAddressFinder", "srcmorph", "streambuffer")
+OWNER = "bernardladenthin"
+MANIFEST = ".github/shared-files.sha256"
+RAW_URL = "https://raw.githubusercontent.com/{owner}/{repo}/HEAD/" + MANIFEST
+LINE = re.compile(r"^([0-9a-f]{64}) [ *](.+)$")
+REPO_SUFFIX = "?repo"
+REPO_PLACEHOLDER = b"{repo}"
+
+
+def parse(text):
+    """path -> sha256 of a manifest. Comment and blank lines are skipped; anything else that is
+    not a `sha256sum` line is an error, and so is a path listed twice."""
+    entries = {}
+    for number, line in enumerate(text.splitlines(), 1):
+        if not line.strip() or line.startswith("#"):
+            continue
+        match = LINE.match(line)
+        if not match:
+            raise ValueError(f"{MANIFEST} line {number}: not `<sha256>  <path>`: {line!r}")
+        if match.group(2) in entries:
+            raise ValueError(f"{MANIFEST} line {number}: {match.group(2)} is listed twice")
+        entries[match.group(2)] = match.group(1)
+    return entries
+
+
+def content(root, entry):
+    """The bytes an entry stands for: a file, or for `<workflow>#<job>` that one job's text; for an
+    entry ending in `?repo` with the repository's name replaced by `{repo}`. None when the file or
+    the job does not exist."""
+    if entry.endswith(REPO_SUFFIX):
+        data = content(root, entry[:-len(REPO_SUFFIX)])
+        return None if data is None else data.replace(current_repo(root).encode("utf-8"), REPO_PLACEHOLDER)
+    path, _, job = entry.partition("#")
+    full = os.path.join(root, path)
+    if not os.path.isfile(full):
+        return None
+    with open(full, "rb") as f:
+        data = f.read()
+    if not job:
+        return data
+    jobs = workflow.parse(data.decode("utf-8"))
+    if job not in jobs:
+        return None
+    lines = jobs[job].lines
+    while lines and (not lines[-1].strip() or lines[-1].startswith("  #")):
+        lines = lines[:-1]
+    return ("\n".join(lines) + "\n").encode("utf-8")
+
+
+def sha256(root, entry):
+    data = content(root, entry)
+    return None if data is None else hashlib.sha256(data).hexdigest()
+
+
+def verify(root, entries):
+    """Failures: every listed file (or job) exists and still has its listed hash."""
+    failures = []
+    for path, digest in entries.items():
+        actual = sha256(root, path)
+        if actual is None:
+            failures.append(f"{path} is listed in {MANIFEST} but does not exist")
+        elif actual != digest:
+            failures.append(f"{path} differs from its line in {MANIFEST}: a shared file was changed in "
+                            f"this repository alone -- change every copy, then update every manifest")
+    return failures
+
+
+def rewrite(text, root):
+    """The manifest with every hash recomputed from the files; comments and order kept."""
+    out = []
+    for line in text.splitlines():
+        match = LINE.match(line)
+        if not match:
+            out.append(line)
+            continue
+        digest = sha256(root, match.group(2))
+        if digest is None:
+            raise ValueError(f"{match.group(2)} is listed in {MANIFEST} but does not exist")
+        out.append(f"{digest}  {match.group(2)}")
+    return "\n".join(out) + "\n"
+
+
+def counterpart(path, other):
+    """The path `other` (another manifest) lists for our `path`: the same path, else a unique
+    file of the same name, else None."""
+    if path in other:
+        return path
+    same_name = [p for p in other if os.path.basename(p) == os.path.basename(path)]
+    return same_name[0] if len(same_name) == 1 else None
+
+
+def compare(own, others):
+    """Warnings for every shared file another repository lists with a different hash."""
+    warnings = []
+    for repo, entries in sorted(others.items()):
+        for path, digest in own.items():
+            theirs = counterpart(path, entries)
+            if theirs is not None and entries[theirs] != digest:
+                warnings.append(f"{path} differs from {repo}'s {theirs}: finish or redo the sync")
+    return warnings
+
+
+def current_repo(root):
+    name = os.environ.get("GITHUB_REPOSITORY", "").split("/")[-1]
+    return name or os.path.basename(os.path.abspath(root))
+
+
+def fetch(repo):
+    with urllib.request.urlopen(RAW_URL.format(owner=OWNER, repo=repo), timeout=20) as response:
+        return response.read().decode("utf-8")
+
+
+def main(argv, root, fetcher=fetch, out=sys.stdout, err=sys.stderr):
+    """check-shared-files.py [--write | --offline]"""
+    path = os.path.join(root, MANIFEST)
+    with open(path, encoding="utf-8") as f:
+        text = f.read()
+    if argv[1:] == ["--write"]:
+        with open(path, "w", encoding="utf-8", newline="\n") as f:
+            f.write(rewrite(text, root))
+        print(f"rewrote the hashes of {MANIFEST}", file=out)
+        return 0
+    if argv[1:] not in ([], ["--offline"]):
+        print(main.__doc__, file=err)
+        return 2
+    own = parse(text)
+    failures = verify(root, own)
+    for failure in failures:
+        print(f"::error::{failure}", file=err)
+    print(f"{len(own)} shared files, {len(failures)} changed here alone", file=out)
+    if argv[1:] == ["--offline"]:
+        return 1 if failures else 0
+    others = {}
+    for repo in REPOS:
+        if repo == current_repo(root):
+            continue
+        try:
+            others[repo] = parse(fetcher(repo))
+        except Exception as e:  # noqa: BLE001 -- a sibling that cannot be read is a warning, never a red
+            print(f"::warning::could not read {repo}'s {MANIFEST}: {e}", file=err)
+    for warning in compare(own, others):
+        print(f"::warning::{warning}", file=err)
+    print(f"compared with {', '.join(sorted(others)) or 'no other repository'}", file=out)
+    return 1 if failures else 0
diff --git a/.github/buildcheck/tests/__init__.py b/.github/buildcheck/tests/__init__.py
new file mode 100644
index 00000000..4833295f
--- /dev/null
+++ b/.github/buildcheck/tests/__init__.py
@@ -0,0 +1,3 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
diff --git a/.github/buildcheck/tests/helpers.py b/.github/buildcheck/tests/helpers.py
new file mode 100644
index 00000000..375a8128
--- /dev/null
+++ b/.github/buildcheck/tests/helpers.py
@@ -0,0 +1,26 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""Shared fixtures of the buildcheck tests."""
+
+import os
+
+REPO = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
+
+
+def workflow_text(jobs):
+    """A workflow with the given jobs, each (name, needs, body lines)."""
+    lines = ["name: t", "on:", "  push:", "jobs:"]
+    for name, needs, body in jobs:
+        lines.append(f"  {name}:")
+        if needs is not None:
+            lines.append(f"    needs: {needs}")
+        lines.append("    runs-on: ubuntu-latest")
+        lines.append("    steps:")
+        lines += body
+    return "\n".join(lines) + "\n"
+
+
+def upload(artifact, path="x/"):
+    return ["      - uses: actions/upload-artifact@v7", "        with:", f"          name: {artifact}",
+            f"          path: {path}"]
diff --git a/.github/buildcheck/tests/test_releasegate.py b/.github/buildcheck/tests/test_releasegate.py
new file mode 100644
index 00000000..19fe7049
--- /dev/null
+++ b/.github/buildcheck/tests/test_releasegate.py
@@ -0,0 +1,61 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+
+import os
+import unittest
+
+from buildcheck import releasegate, workflow
+from buildcheck.tests.helpers import REPO, workflow_text
+
+GATES = ("pub-a", "pub-b")
+
+
+def jobs(*extra):
+    return workflow.parse(workflow_text([("test", None, []), ("build", "test", []), *extra,
+                                         ("pub-a", "[build]", []), ("pub-b", "[build]", [])]))
+
+
+class ReleaseGateTest(unittest.TestCase):
+
+    def check(self, js, non_gating):
+        return releasegate.check(js, dict.fromkeys(non_gating, "reason"), GATES)
+
+    def test_transitively_gating_jobs_pass(self):
+        self.assertEqual(self.check(jobs(), ["pub-a", "pub-b"]), [])
+
+    def test_a_job_nothing_waits_for_fails(self):
+        self.assertEqual(self.check(jobs(("lint", None, [])), ["pub-a", "pub-b"]),
+                         ["publish.yml: pub-a, pub-b does not wait for lint -- add it to the needs, or to "
+                          "release-gate-exemptions.txt with the reason it may stay red"])
+
+    def test_gating_only_one_publish_job_fails(self):
+        js = workflow.parse(workflow_text([("lint", None, []), ("pub-a", "[lint]", []), ("pub-b", None, [])]))
+        self.assertEqual(len(self.check(js, ["pub-a", "pub-b"])), 1)
+
+    def test_a_listed_job_may_stay_outside(self):
+        self.assertEqual(self.check(jobs(("lint", None, [])), ["pub-a", "pub-b", "lint"]), [])
+
+    def test_a_stale_exemption_fails(self):
+        self.assertIn("remove the stale exemption", self.check(jobs(), ["pub-a", "pub-b", "build"])[0])
+        self.assertEqual(self.check(jobs(), ["pub-a", "pub-b", "gone"]),
+                         ["release-gate-exemptions.txt lists gone, which is no job of publish.yml"])
+
+    def test_reads_the_exemptions_file(self):
+        self.assertEqual(releasegate.read_exemptions("# c\n\na: why: because\n b :x\n"),
+                         {"a": "why: because", "b": "x"})
+
+    def test_an_exemption_without_a_reason_is_an_error(self):
+        for text in ("a\n", "a:\n", "a:  \n", ": x\n", "a: x\na: y\n"):
+            with self.subTest(text=text), self.assertRaises(ValueError):
+                releasegate.read_exemptions(text)
+
+    def test_the_repository_passes(self):
+        with open(os.path.join(REPO, ".github", "workflows", "publish.yml"), encoding="utf-8") as f:
+            jobs = workflow.parse(f.read())
+        with open(os.path.join(REPO, releasegate.EXEMPTIONS_FILE), encoding="utf-8") as f:
+            self.assertEqual(releasegate.check(jobs, releasegate.read_exemptions(f.read())), [])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/buildcheck/tests/test_runscripts.py b/.github/buildcheck/tests/test_runscripts.py
new file mode 100644
index 00000000..6f1ac186
--- /dev/null
+++ b/.github/buildcheck/tests/test_runscripts.py
@@ -0,0 +1,127 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+
+import io
+import shutil
+import unittest
+
+from buildcheck import runscripts
+from buildcheck.tests.helpers import REPO, workflow_text
+
+BASH = shutil.which("bash")
+
+
+def shells(text):
+    return [(script.line, script.shell) for script in runscripts.scripts(text)]
+
+
+def texts(text):
+    return [script.text for script in runscripts.scripts(text)]
+
+
+class ValueTest(unittest.TestCase):
+
+    def test_literal_block_keeps_its_lines_and_drops_the_indentation(self):
+        text = workflow_text([("a", None, ["      - run: |", "          echo a \\", "            b", "",
+                                           "          echo c", "", "      - run: echo d"])])
+        self.assertEqual(texts(text), ["echo a \\\n  b\n\necho c", "echo d"])
+
+    def test_folded_block_joins_lines_and_keeps_the_more_indented_ones(self):
+        text = workflow_text([("a", None, ["      - run: >-", "          mvn -B", "          -DskipTests",
+                                           "            verify", "", "          echo done"])])
+        self.assertEqual(texts(text), ["mvn -B -DskipTests\n  verify\necho done"])
+
+    def test_plain_scalar_drops_its_comment_and_folds_its_continuation(self):
+        text = workflow_text([("a", None, ["      - run: mvn -B test  # the suite", "      - run: mvn -B",
+                                           "          -Dx=1", "      - name: n", "        run: echo '$#'"])])
+        self.assertEqual(texts(text), ["mvn -B test", "mvn -B -Dx=1", "echo '$#'"])
+
+    def test_single_quoted_is_unquoted_and_double_quoted_skipped(self):
+        text = workflow_text([("a", None, ["      - run: 'echo ''x'''", '      - run: "echo \\"x\\""'])])
+        self.assertEqual(texts(text), ["echo 'x'"])
+
+    def test_a_run_key_that_is_not_a_step_key_is_not_mistaken_for_one(self):
+        text = "name: t\non:\n  push:\n# run: | in a comment\njobs:\n  a:\n    runs-on: ubuntu-latest\n" \
+               "    steps:\n      - run: echo a\n"
+        self.assertEqual(texts(text), ["echo a"])
+
+
+class ShellTest(unittest.TestCase):
+
+    def test_step_shell_before_or_after_run(self):
+        text = workflow_text([("a", None, ["      - shell: pwsh", "        run: Get-Item x",
+                                           "      - run: |", "          dir", "        shell: cmd",
+                                           "      - run: echo a", "        shell: bash -el {0}",
+                                           "      - run: echo b", "        shell: C:\\msys64\\usr\\bin\\bash.exe -e {0}"])])
+        self.assertEqual([shell for _, shell in shells(text)], ["pwsh", "cmd", "bash", "bash"])
+
+    def test_windows_runner_defaults_to_powershell_others_to_bash(self):
+        text = workflow_text([("w", None, ["      - run: Get-Item x"]), ("u", None, ["      - run: ls"])])
+        text = text.replace("runs-on: ubuntu-latest", "runs-on: windows-2025-vs2026", 1)
+        self.assertEqual([shell for _, shell in shells(text)], ["pwsh", "bash"])
+
+    def test_a_runner_from_an_expression_is_windows_only_by_the_step_condition(self):
+        text = workflow_text([("m", None, ["      - if: runner.os == 'Windows'", "        run: Get-Item x",
+                                           "      - run: ls"])])
+        text = text.replace("ubuntu-latest", "${{ matrix.windows-runner }}")
+        self.assertEqual([shell for _, shell in shells(text)], ["pwsh", "bash"])
+
+    def test_job_defaults_win_over_workflow_defaults_and_both_over_the_runner(self):
+        text = workflow_text([("j", None, ["      - run: dir"]), ("k", None, ["      - run: Get-Item x"])])
+        text = text.replace("jobs:\n", "defaults:\n  run:\n    shell: pwsh\njobs:\n")
+        text = text.replace("  j:\n", "  j:\n    defaults:\n      run:\n        working-directory: x\n"
+                                      "        shell: cmd\n")
+        self.assertEqual([shell for _, shell in shells(text)], ["cmd", "pwsh"])
+
+    def test_composite_action_steps(self):
+        text = ("name: a\nruns:\n  using: composite\n  steps:\n    - name: x\n      shell: pwsh\n"
+                "      run: Get-Item x\n    - shell: bash\n      run: ls\n")
+        self.assertEqual(shells(text), [(7, "pwsh"), (9, "bash")])
+
+
+class CheckTest(unittest.TestCase):
+
+    def test_only_bash_scripts_reach_the_parser_and_an_unknown_shell_is_an_error(self):
+        seen = []
+        text = workflow_text([("a", None, ["      - run: ls", "      - run: Get-Item x", "        shell: pwsh",
+                                           "      - run: print(1)", "        shell: python",
+                                           "      - run: x", "        shell: fish {0}"])])
+        errors, checked = runscripts.check("w.yml", text, lambda s: seen.append(s))
+        self.assertEqual((seen, checked), (["ls"], 1))
+        self.assertEqual(errors, ["w.yml:13: unknown shell 'fish' -- add it to runscripts.py"])
+
+    @unittest.skipUnless(BASH, "bash not installed")
+    def test_a_lost_line_continuation_is_reported_at_its_line(self):
+        text = workflow_text([("a", None, ["      - run: |", "          echo ${{ github.sha }}",
+                                           "          grep -q x file", "            || exit 1"])])
+        errors, checked = runscripts.check("w.yml", text)
+        self.assertEqual(checked, 1)
+        self.assertEqual(len(errors), 1)
+        self.assertTrue(errors[0].startswith("w.yml:11: "), errors[0])
+        self.assertIn("`||'", errors[0])
+
+    @unittest.skipUnless(BASH, "bash not installed")
+    def test_continued_lines_expressions_and_heredocs_parse(self):
+        text = workflow_text([("a", None, ["      - run: |", "          grep -q x file \\",
+                                           "            || exit 1", "          cat <<EOF",
+                                           "          ${{ toJSON(matrix) }}", "          EOF",
+                                           "      - run: >", "          echo a", "          && echo b"])])
+        self.assertEqual(runscripts.check("w.yml", text), ([], 2))
+
+    @unittest.skipUnless(BASH, "bash not installed")
+    def test_main_refuses_arguments(self):
+        self.assertEqual(runscripts.main(["x", "-v"], REPO, err=io.StringIO()), 2)
+
+
+class RepositoryTest(unittest.TestCase):
+
+    @unittest.skipUnless(BASH, "bash not installed")
+    def test_every_bash_script_of_this_repository_parses(self):
+        out, err = io.StringIO(), io.StringIO()
+        self.assertEqual(runscripts.main(["x"], REPO, out, err), 0, err.getvalue())
+        self.assertNotIn(" 0 bash run scripts", out.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/buildcheck/tests/test_sharedfiles.py b/.github/buildcheck/tests/test_sharedfiles.py
new file mode 100644
index 00000000..588239a2
--- /dev/null
+++ b/.github/buildcheck/tests/test_sharedfiles.py
@@ -0,0 +1,204 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+
+import hashlib
+import io
+import os
+import tempfile
+import unittest
+from unittest import mock
+
+from buildcheck import sharedfiles
+from buildcheck.tests.helpers import REPO
+
+A = hashlib.sha256(b"a").hexdigest()
+B = hashlib.sha256(b"b").hexdigest()
+
+
+class ParseTest(unittest.TestCase):
+
+    def test_reads_sha256sum_lines_and_skips_comments(self):
+        text = f"# header\n\n{A}  x/one.sh\n{B} *two.py\n"
+        self.assertEqual(sharedfiles.parse(text), {"x/one.sh": A, "two.py": B})
+
+    def test_rejects_malformed_and_duplicate_lines(self):
+        for text in ("nonsense\n", f"{A[:-1]}  x\n", f"{A}  x\n{B}  x\n"):
+            with self.subTest(text=text), self.assertRaises(ValueError):
+                sharedfiles.parse(text)
+
+
+class TreeTest(unittest.TestCase):
+
+    def setUp(self):
+        self.root = tempfile.mkdtemp()
+        os.makedirs(os.path.join(self.root, ".github"))
+        with open(os.path.join(self.root, "one.sh"), "wb") as f:
+            f.write(b"a")
+
+    def manifest(self, text):
+        with open(os.path.join(self.root, sharedfiles.MANIFEST), "w", encoding="utf-8") as f:
+            f.write(text)
+
+    def run_main(self, *args, others=None):
+        out, err = io.StringIO(), io.StringIO()
+        others = others or {}
+
+        def fetcher(repo):
+            if repo not in others:
+                raise OSError("unreachable")
+            return others[repo]
+        code = sharedfiles.main(["x", *args], self.root, fetcher, out, err)
+        return code, err.getvalue()
+
+    def test_an_unchanged_file_passes(self):
+        self.manifest(f"# h\n{A}  one.sh\n")
+        self.assertEqual(self.run_main("--offline"), (0, ""))
+
+    def test_a_file_changed_alone_or_missing_fails(self):
+        self.manifest(f"{B}  one.sh\n{A}  gone.sh\n")
+        code, err = self.run_main("--offline")
+        self.assertEqual(code, 1)
+        self.assertIn("one.sh differs", err)
+        self.assertIn("gone.sh is listed", err)
+
+    def test_write_recomputes_the_hashes_and_keeps_the_comments(self):
+        self.manifest(f"# keep me\n{B}  one.sh\n")
+        self.assertEqual(self.run_main("--write")[0], 0)
+        with open(os.path.join(self.root, sharedfiles.MANIFEST), encoding="utf-8") as f:
+            self.assertEqual(f.read(), f"# keep me\n{A}  one.sh\n")
+
+    def test_sibling_differences_are_warnings_not_failures(self):
+        self.manifest(f"{A}  one.sh\n")
+        others = {"srcmorph": f"{B}  one.sh\n", "streambuffer": f"{A}  one.sh\n"}
+        code, err = self.run_main(others=others)
+        self.assertEqual(code, 0)
+        self.assertIn("::warning::one.sh differs from srcmorph's one.sh", err)
+        self.assertNotIn("streambuffer's", err)
+        self.assertIn("could not read BitcoinAddressFinder", err)
+
+    def test_unknown_arguments(self):
+        self.manifest("")
+        self.assertEqual(self.run_main("--nope")[0], 2)
+
+
+WORKFLOW = """name: t
+on:
+  push:
+jobs:
+  first:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo one
+
+  # a comment about the second job belongs to the second job
+  second:
+    needs: first
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo two
+"""
+FIRST = "  first:\n    runs-on: ubuntu-latest\n    steps:\n      - run: echo one\n"
+
+
+class JobEntryTest(unittest.TestCase):
+
+    def setUp(self):
+        self.root = tempfile.mkdtemp()
+        os.makedirs(os.path.join(self.root, ".github", "workflows"))
+        self.write(WORKFLOW)
+
+    def write(self, text):
+        with open(os.path.join(self.root, ".github/workflows/w.yml"), "w", encoding="utf-8") as f:
+            f.write(text)
+
+    def test_a_job_entry_hashes_the_job_alone(self):
+        self.assertEqual(sharedfiles.content(self.root, ".github/workflows/w.yml#first"), FIRST.encode())
+        self.assertEqual(sharedfiles.sha256(self.root, ".github/workflows/w.yml#first"),
+                         hashlib.sha256(FIRST.encode()).hexdigest())
+
+    def test_the_comment_before_the_next_job_is_not_part_of_the_job(self):
+        self.write(WORKFLOW.replace("belongs to the second job", "was reworded"))
+        self.assertEqual(sharedfiles.content(self.root, ".github/workflows/w.yml#first"), FIRST.encode())
+
+    def test_a_change_inside_the_job_is_seen_and_one_elsewhere_is_not(self):
+        entry = ".github/workflows/w.yml#first"
+        entries = {entry: sharedfiles.sha256(self.root, entry)}
+        self.write(WORKFLOW.replace("echo two", "echo three"))
+        self.assertEqual(sharedfiles.verify(self.root, entries), [])
+        self.write(WORKFLOW.replace("echo one", "echo changed"))
+        self.assertIn("differs from its line", sharedfiles.verify(self.root, entries)[0])
+
+    def test_a_missing_job_or_workflow_is_reported(self):
+        entries = {".github/workflows/w.yml#gone": A, ".github/workflows/x.yml#first": A}
+        failures = sharedfiles.verify(self.root, entries)
+        self.assertEqual(len(failures), 2)
+        self.assertTrue(all("does not exist" in f for f in failures), failures)
+
+    def test_write_refuses_an_entry_that_does_not_exist(self):
+        with self.assertRaises(ValueError):
+            sharedfiles.rewrite(f"{A}  .github/workflows/w.yml#gone\n", self.root)
+
+
+class RepoEntryTest(unittest.TestCase):
+
+    def setUp(self):
+        self.root = tempfile.mkdtemp()
+        os.makedirs(os.path.join(self.root, ".github", "workflows"))
+        self.write("SUPPORT.md", "Issues: https://github.com/o/streambuffer/issues\n")
+        self.write(".github/workflows/w.yml", WORKFLOW.replace("echo one", "echo streambuffer"))
+        patcher = mock.patch.object(sharedfiles, "current_repo", return_value="streambuffer")
+        patcher.start()
+        self.addCleanup(patcher.stop)
+
+    def write(self, path, text):
+        with open(os.path.join(self.root, path), "w", encoding="utf-8") as f:
+            f.write(text)
+
+    def test_the_repository_name_is_replaced_by_a_placeholder(self):
+        self.assertEqual(sharedfiles.content(self.root, "SUPPORT.md?repo"), b"Issues: https://github.com/o/{repo}/issues\n")
+        self.assertEqual(sharedfiles.content(self.root, ".github/workflows/w.yml#first?repo"),
+                         FIRST.replace("echo one", "echo {repo}").encode())
+
+    def test_two_repositories_differing_only_in_their_name_hash_alike(self):
+        here = sharedfiles.sha256(self.root, "SUPPORT.md?repo")
+        with mock.patch.object(sharedfiles, "current_repo", return_value="srcmorph"):
+            self.write("SUPPORT.md", "Issues: https://github.com/o/srcmorph/issues\n")
+            self.assertEqual(sharedfiles.sha256(self.root, "SUPPORT.md?repo"), here)
+            self.write("SUPPORT.md", "Bugs: https://github.com/o/srcmorph/issues\n")
+            self.assertNotEqual(sharedfiles.sha256(self.root, "SUPPORT.md?repo"), here)
+
+    def test_a_missing_file_stays_missing(self):
+        self.assertIsNone(sharedfiles.content(self.root, "GONE.md?repo"))
+
+
+class CompareTest(unittest.TestCase):
+
+    def test_matches_by_path_then_by_a_unique_file_name(self):
+        own = {"llama/lombok.config": A, "a/__init__.py": A}
+        self.assertEqual(sharedfiles.compare(own, {"r": {"lombok.config": B}}),
+                         ["llama/lombok.config differs from r's lombok.config: finish or redo the sync"])
+        # two candidates of the same name: no guess
+        self.assertEqual(sharedfiles.compare(own, {"r": {"b/__init__.py": B, "c/__init__.py": B}}), [])
+        # a file the other repository does not share is no difference
+        self.assertEqual(sharedfiles.compare(own, {"r": {}}), [])
+
+
+class RepositoryTest(unittest.TestCase):
+
+    def test_this_repository_matches_its_manifest(self):
+        with open(os.path.join(REPO, sharedfiles.MANIFEST), encoding="utf-8") as f:
+            entries = sharedfiles.parse(f.read())
+        self.assertEqual(sharedfiles.verify(REPO, entries), [])
+
+    def test_the_shared_build_checks_list_themselves(self):
+        with open(os.path.join(REPO, sharedfiles.MANIFEST), encoding="utf-8") as f:
+            entries = sharedfiles.parse(f.read())
+        for path in (".github/buildcheck/sharedfiles.py", ".github/check-shared-files.py",
+                     ".github/buildcheck/tests/test_sharedfiles.py",
+                     ".github/workflows/publish.yml#shared-files"):
+            self.assertIn(path, entries)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/buildcheck/tests/test_versions.py b/.github/buildcheck/tests/test_versions.py
new file mode 100644
index 00000000..b2f03ca0
--- /dev/null
+++ b/.github/buildcheck/tests/test_versions.py
@@ -0,0 +1,120 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+
+import io
+import os
+import unittest
+from unittest import mock
+
+from buildcheck import versions
+from buildcheck.tests.helpers import REPO
+
+
+def pom(body, properties=""):
+    return (f'<project xmlns="http://maven.apache.org/POM/4.0.0"><properties>{properties}</properties>'
+            f'{body}</project>')
+
+
+PARENT = pom("", "<junit.version>6.1.3</junit.version><nested>${junit.version}</nested><palantir>2.99.0</palantir>")
+CHILD = pom("""<dependencies>
+  <dependency><groupId>org.junit.jupiter</groupId><artifactId>junit-jupiter</artifactId>
+    <version>${junit.version}</version></dependency>
+  <dependency><groupId>a</groupId><artifactId>nested</artifactId><version>${nested}</version></dependency>
+  <dependency><groupId>a</groupId><artifactId>unresolved</artifactId><version>${nowhere}</version></dependency>
+  <dependency><groupId>a</groupId><artifactId>managed</artifactId></dependency>
+  <dependency><groupId>net.ladenthin</groupId><artifactId>llama</artifactId><version>5.2.0</version></dependency>
+</dependencies>
+<build><plugins><plugin><artifactId>maven-jar-plugin</artifactId><version>3.5.0</version>
+  <configuration><annotationProcessorPaths><path><groupId>com.google.errorprone</groupId>
+    <artifactId>error_prone_core</artifactId><version>2.50.0</version></path></annotationProcessorPaths>
+  </configuration></plugin>
+  <plugin><groupId>com.diffplug.spotless</groupId><artifactId>spotless-maven-plugin</artifactId><version>3.10.3</version>
+    <configuration><java><palantirJavaFormat><version>${palantir}</version></palantirJavaFormat></java></configuration>
+  </plugin></plugins></build>""")
+
+
+class CoordinatesTest(unittest.TestCase):
+
+    def test_reads_plugins_dependencies_and_processor_paths_with_properties_resolved(self):
+        self.assertEqual(versions.coordinates([PARENT, CHILD]), {
+            "org.junit.jupiter:junit-jupiter": {"6.1.3"},
+            "a:nested": {"6.1.3"},
+            "org.apache.maven.plugins:maven-jar-plugin": {"3.5.0"},
+            "com.google.errorprone:error_prone_core": {"2.50.0"},
+            "com.diffplug.spotless:spotless-maven-plugin": {"3.10.3"},
+            "com.palantir.javaformat:palantir-java-format": {"2.99.0"},
+        })
+
+    def test_a_repository_using_two_versions_of_one_coordinate_keeps_both(self):
+        other = pom('<dependencies><dependency><groupId>org.junit.jupiter</groupId>'
+                    '<artifactId>junit-jupiter</artifactId><version>6.0.0</version></dependency></dependencies>')
+        self.assertEqual(versions.coordinates([PARENT, CHILD, other])["org.junit.jupiter:junit-jupiter"],
+                         {"6.0.0", "6.1.3"})
+
+
+class CompareTest(unittest.TestCase):
+
+    def test_only_coordinates_both_use_and_only_differences(self):
+        own = {"j:u": {"1"}, "s:p": {"2"}, "only:here": {"3"}}
+        others = {"r1": {"j:u": {"1"}, "s:p": {"9"}}, "r2": {"only:there": {"4"}}}
+        self.assertEqual(versions.compare(own, others),
+                         ["s:p is 2 here and 9 in r1: bump it in every repository"])
+
+
+class MainTest(unittest.TestCase):
+
+    def run_main(self, siblings):
+        out, err = io.StringIO(), io.StringIO()
+
+        def fetcher(repo, path):
+            if repo not in siblings:
+                raise OSError("unreachable")
+            return siblings[repo]
+        with mock.patch.object(versions, "current_repo", return_value="streambuffer"), \
+                mock.patch.object(versions, "read_local", return_value=[PARENT, CHILD]):
+            code = versions.main(["x"], "/nowhere", fetcher, out, err)
+        return code, out.getvalue(), err.getvalue()
+
+    def test_differences_are_warnings_and_never_fail(self):
+        bumped = pom('<dependencies><dependency><groupId>org.junit.jupiter</groupId>'
+                     '<artifactId>junit-jupiter</artifactId><version>6.1.4</version></dependency></dependencies>')
+        code, out, err = self.run_main({"srcmorph": bumped, "BitcoinAddressFinder": CHILD.replace(
+            "${junit.version}", "6.1.3").replace("${nested}", "6.1.3")})
+        self.assertEqual(code, 0)
+        self.assertIn("::warning::org.junit.jupiter:junit-jupiter is 6.1.3 here and 6.1.4 in srcmorph", err)
+        self.assertIn("could not read java-llama.cpp's pom.xml", err)
+        self.assertNotIn("BitcoinAddressFinder:", err)
+        self.assertIn("1 version differences", out)
+
+    def test_a_missing_pom_skips_that_file_not_the_repository(self):
+        out, err = io.StringIO(), io.StringIO()
+        bumped = pom('<dependencies><dependency><groupId>org.junit.jupiter</groupId>'
+                     '<artifactId>junit-jupiter</artifactId><version>6.1.4</version></dependency></dependencies>')
+
+        def fetcher(repo, path):
+            if repo == "srcmorph" and path == "pom.xml":
+                return bumped
+            raise OSError("404")
+        with mock.patch.object(versions, "current_repo", return_value="streambuffer"), \
+                mock.patch.object(versions, "read_local", return_value=[PARENT, CHILD]):
+            self.assertEqual(versions.main(["x"], "/nowhere", fetcher, out, err), 0)
+        self.assertIn("could not read srcmorph's srcmorph/pom.xml", err.getvalue())
+        self.assertIn("6.1.4 in srcmorph", err.getvalue())
+
+    def test_arguments_are_refused(self):
+        self.assertEqual(versions.main(["x", "--offline"], REPO, err=io.StringIO()), 2)
+
+
+class RepositoryTest(unittest.TestCase):
+
+    def test_this_repository_s_poms_are_listed_and_readable(self):
+        repo = versions.current_repo(REPO)
+        if repo not in versions.POMS:
+            self.skipTest(f"checked out as {repo}, not under its repository name")
+        found = versions.coordinates(versions.read_local(REPO, repo))
+        self.assertTrue(found, "no versioned coordinate found -- the POM list in versions.POMS is stale")
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/buildcheck/tests/test_workflow.py b/.github/buildcheck/tests/test_workflow.py
new file mode 100644
index 00000000..b9bf48d8
--- /dev/null
+++ b/.github/buildcheck/tests/test_workflow.py
@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+
+import os
+import unittest
+
+from buildcheck import workflow
+from buildcheck.tests.helpers import REPO, upload, workflow_text
+
+
+class ParseTest(unittest.TestCase):
+
+    def test_reads_every_needs_shape(self):
+        text = workflow_text([
+            ("a", None, []),
+            ("b", "a", []),
+            ("c", "[a, b]", []),
+            ("d", "", []),
+        ]).replace("    needs: \n", "    needs:\n      - a\n      - c  # why\n")
+        jobs = workflow.parse(text)
+        self.assertEqual(list(jobs), ["a", "b", "c", "d"])
+        self.assertEqual(jobs["a"].needs, [])
+        self.assertEqual(jobs["b"].needs, ["a"])
+        self.assertEqual(jobs["c"].needs, ["a", "b"])
+        self.assertEqual(jobs["d"].needs, ["a", "c"])
+
+    def test_keys_outside_jobs_are_not_jobs(self):
+        jobs = workflow.parse(workflow_text([("a", None, [])]) + "env:\n  X: 1\n")
+        self.assertEqual(list(jobs), ["a"])
+
+    def test_unknown_need_is_an_error(self):
+        with self.assertRaisesRegex(ValueError, "needs nope"):
+            workflow.parse(workflow_text([("a", "nope", [])]))
+
+    def test_unreadable_needs_is_an_error_not_a_guess(self):
+        with self.assertRaisesRegex(ValueError, "cannot read needs"):
+            workflow.parse(workflow_text([("a", None, []), ("b", "${{ fromJSON(x) }}", [])]))
+
+    def test_uploads_reads_the_artifact_name_not_the_step_name(self):
+        body = ["      - name: Upload something", "        if: always()",
+                "        uses: actions/upload-artifact@v7"] + upload("natives-x")[1:] \
+            + ["      - run: echo name: fake"] + upload("second")
+        job = workflow.parse(workflow_text([("a", None, body)]))["a"]
+        self.assertEqual(job.uploads(), ["natives-x", "second"])
+
+    def test_closure_is_transitive_and_excludes_the_job(self):
+        jobs = workflow.parse(workflow_text([("a", None, []), ("b", "a", []), ("c", "[b]", []), ("x", None, [])]))
+        self.assertEqual(workflow.closure(jobs, "c"), {"a", "b"})
+        self.assertEqual(workflow.closure(jobs, "a"), set())
+
+
+class RepositoryWorkflowsTest(unittest.TestCase):
+
+    def test_every_workflow_of_the_repository_parses(self):
+        folder = os.path.join(REPO, ".github", "workflows")
+        for name in sorted(os.listdir(folder)):
+            with self.subTest(name):
+                with open(os.path.join(folder, name), encoding="utf-8") as f:
+                    self.assertTrue(workflow.parse(f.read()))
+
+    def test_publish_has_both_publish_jobs_and_they_wait_for_something(self):
+        with open(os.path.join(REPO, ".github", "workflows", "publish.yml"), encoding="utf-8") as f:
+            jobs = workflow.parse(f.read())
+        for gate in ("publish-snapshot", "publish-release"):
+            self.assertGreater(len(workflow.closure(jobs, gate)), 3, gate)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/.github/buildcheck/versions.py b/.github/buildcheck/versions.py
new file mode 100644
index 00000000..2935a761
--- /dev/null
+++ b/.github/buildcheck/versions.py
@@ -0,0 +1,139 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""The Maven dependencies and plugins java-llama.cpp, BitcoinAddressFinder, srcmorph and streambuffer
+have in common, compared across the repositories: a warning per coordinate whose version differs.
+
+The four repositories pin the same build tooling (JUnit, Error Prone, NullAway, Spotless, SpotBugs,
+JaCoCo, the Maven plugins, ...), and Dependabot bumps each repository on its own, so they drift one
+pull request at a time. This check makes the drift visible in every repository's `shared-files`
+job. It compares what the POMs actually USE -- every `groupId:artifactId` of a plugin, dependency or
+annotation-processor path with its version, plus the formatter version Spotless is configured with,
+`${property}` references resolved -- not property
+names, which differ between repositories and include values that must differ (the Java release).
+
+Warnings, never failures: a bump lands in four pull requests, and the first one merged would
+otherwise turn the other three repositories red. The repository's own artifacts
+(`net.ladenthin:*`) are left out: a sibling depends on the last RELEASE of java-llama.cpp while
+java-llama.cpp itself is at the next snapshot.
+"""
+
+import re
+import sys
+import urllib.request
+import xml.etree.ElementTree as ET
+
+from .sharedfiles import OWNER, REPOS, current_repo
+
+NS = "{http://maven.apache.org/POM/4.0.0}"
+POMS = {
+    "java-llama.cpp": ("pom.xml", "llama/pom.xml", "llama-langchain4j/pom.xml", "llama-kotlin/pom.xml",
+                       "llama-platform/pom.xml", "llama-atmosphere-agent/pom.xml"),
+    "BitcoinAddressFinder": ("pom.xml",),
+    "srcmorph": ("pom.xml", "srcmorph/pom.xml", "srcmorph-cli/pom.xml", "srcmorph-maven-plugin/pom.xml"),
+    "streambuffer": ("pom.xml",),
+}
+OWN_GROUP = "net.ladenthin"
+DEFAULT_PLUGIN_GROUP = "org.apache.maven.plugins"
+VERSIONED = ("plugin", "dependency", "path", "annotationProcessorPath")
+# Versions a plugin's <configuration> names without coordinates: Spotless takes its formatter as
+# <palantirJavaFormat><version>. The versions plugin cannot see those, which is how palantir fell
+# behind unnoticed more than once (workspace crossrepostatus, "Tool versions").
+CONFIGURED = {"palantirJavaFormat": "com.palantir.javaformat:palantir-java-format"}
+RAW_URL = "https://raw.githubusercontent.com/{owner}/{repo}/HEAD/{path}"
+PROPERTY = re.compile(r"\$\{([^}]+)\}")
+
+
+def coordinates(pom_texts):
+    """groupId:artifactId -> set of versions used across the POMs of one repository. Properties
+    are looked up across all of them (a child module uses its parent's), up to a few levels deep;
+    a version that does not resolve to a literal is left out."""
+    roots = [ET.fromstring(text) for text in pom_texts]
+    props = {}
+    for root in roots:
+        for element in root.findall(NS + "properties/*"):
+            props[element.tag[len(NS):]] = (element.text or "").strip()
+
+    def resolve(value):
+        for _ in range(5):
+            match = PROPERTY.fullmatch(value)
+            if not match or match.group(1) not in props:
+                break
+            value = props[match.group(1)]
+        return None if "${" in value else value
+
+    found = {}
+    for root in roots:
+        for element in root.iter():
+            tag = element.tag[len(NS):]
+            if tag in CONFIGURED:
+                version = resolve((element.findtext(NS + "version") or "").strip())
+                if version:
+                    found.setdefault(CONFIGURED[tag], set()).add(version)
+                continue
+            if tag not in VERSIONED:
+                continue
+            artifact, version = element.findtext(NS + "artifactId"), element.findtext(NS + "version")
+            if not artifact or not version:
+                continue
+            group = (element.findtext(NS + "groupId") or DEFAULT_PLUGIN_GROUP).strip()
+            version = resolve(version.strip())
+            if version and group != OWN_GROUP:
+                found.setdefault(f"{group}:{artifact.strip()}", set()).add(version)
+    return found
+
+
+def compare(own, others):
+    """Warnings for every coordinate another repository uses in a different version."""
+    warnings = []
+    for repo, theirs in sorted(others.items()):
+        for coordinate in sorted(set(own) & set(theirs)):
+            if own[coordinate] != theirs[coordinate]:
+                warnings.append(f"{coordinate} is {', '.join(sorted(own[coordinate]))} here and "
+                                f"{', '.join(sorted(theirs[coordinate]))} in {repo}: bump it in every repository")
+    return warnings
+
+
+def fetch(repo, path):
+    with urllib.request.urlopen(RAW_URL.format(owner=OWNER, repo=repo, path=path), timeout=20) as response:
+        return response.read().decode("utf-8")
+
+
+def read_local(root, repo):
+    texts = []
+    for path in POMS[repo]:
+        with open(f"{root}/{path}", encoding="utf-8") as f:
+            texts.append(f.read())
+    return texts
+
+
+def main(argv, root, fetcher=fetch, out=sys.stdout, err=sys.stderr):
+    """check-versions.py -- compare with the siblings' default branches (warnings only)"""
+    if argv[1:]:
+        print(main.__doc__, file=err)
+        return 2
+    repo = current_repo(root)
+    if repo not in POMS:
+        print(f"::error::{repo} is not one of {', '.join(REPOS)}", file=err)
+        return 2
+    own = coordinates(read_local(root, repo))
+    others = {}
+    for sibling in REPOS:
+        if sibling == repo:
+            continue
+        texts = []
+        for path in POMS[sibling]:
+            try:
+                texts.append(fetcher(sibling, path))
+            except Exception as e:  # noqa: BLE001 -- a sibling that cannot be read is a warning, never a red
+                print(f"::warning::could not read {sibling}'s {path}: {e}", file=err)
+        if texts:
+            others[sibling] = coordinates(texts)
+    warnings = compare(own, others)
+    for warning in warnings:
+        print(f"::warning::{warning}", file=err)
+    shared = set(own).intersection(*others.values()) if others else set()
+    print(f"{len(own)} versioned coordinates here, {len(shared)} used by every repository read, "
+          f"{len(warnings)} version differences (compared with {', '.join(sorted(others)) or 'no other repository'})",
+          file=out)
+    return 0
diff --git a/.github/buildcheck/workflow.py b/.github/buildcheck/workflow.py
new file mode 100644
index 00000000..de7055a6
--- /dev/null
+++ b/.github/buildcheck/workflow.py
@@ -0,0 +1,120 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""The part of a GitHub Actions workflow the checks need: its jobs, their `needs`, the artifacts
+they upload and the text of their steps.
+
+Deliberately not a YAML parser. The runners' Python has no PyYAML guaranteed, and the checks
+need only the job graph, which the workflow writes in two fixed shapes: jobs at two spaces of
+indentation below `jobs:`, and `needs:` at four, either inline (`needs: a` / `needs: [a, b]`) or
+as a block list (`- a` at six). A workflow written any other way is reported by `parse`, never
+misread silently: every job must be found, and a `needs:` that matches neither shape fails.
+"""
+
+import re
+
+JOB = re.compile(r"^  ([A-Za-z0-9_-]+):\s*(#.*)?$")
+NEEDS = re.compile(r"^    needs:\s*(.*?)\s*(#.*)?$")
+NEEDS_ITEM = re.compile(r"^      - ([A-Za-z0-9_-]+)\s*(#.*)?$")
+STEP = re.compile(r"^      - ")
+
+
+class Job:
+    """One job: its id, the jobs it needs, and its lines (the job header included)."""
+
+    def __init__(self, name):
+        self.name = name
+        self.needs = []
+        self.lines = []
+
+    @property
+    def text(self):
+        return "\n".join(self.lines)
+
+    def steps(self):
+        """The job's steps, each as a list of lines (a step starts at `      - `)."""
+        out = []
+        for line in self.lines:
+            if STEP.match(line):
+                out.append([line])
+            elif out:
+                out[-1].append(line)
+        return out
+
+    def uploads(self):
+        """The names of the artifacts the job uploads (upload-artifact's `with: name:`)."""
+        names = []
+        for step in self.steps():
+            if not any("actions/upload-artifact@" in line for line in step):
+                continue
+            with_indent = None
+            for line in step:
+                stripped = line.lstrip()
+                indent = len(line) - len(stripped)
+                if stripped.startswith("with:"):
+                    with_indent = indent
+                elif with_indent is not None and indent > with_indent and stripped.startswith("name:"):
+                    names.append(stripped[len("name:"):].strip().strip("'\""))
+                    break
+                elif with_indent is not None and indent <= with_indent:
+                    with_indent = None
+        return names
+
+
+def parse(text):
+    """Jobs by id, in file order. Raises ValueError on a `needs:` in a shape it does not read."""
+    jobs = {}
+    in_jobs = False
+    current = None
+    block_needs = False
+    for number, line in enumerate(text.splitlines(), 1):
+        if line and not line[0].isspace() and not line.startswith("#"):
+            in_jobs = line.rstrip() == "jobs:"
+            current = None
+            continue
+        if not in_jobs:
+            continue
+        match = JOB.match(line)
+        if match:
+            current = jobs[match.group(1)] = Job(match.group(1))
+            current.lines.append(line)
+            block_needs = False
+            continue
+        if current is None:
+            continue
+        current.lines.append(line)
+        match = NEEDS.match(line)
+        if match:
+            value = match.group(1)
+            if value == "":
+                block_needs = True
+            elif value.startswith("[") and value.endswith("]"):
+                current.needs += [n.strip() for n in value[1:-1].split(",") if n.strip()]
+            elif re.fullmatch(r"[A-Za-z0-9_-]+", value):
+                current.needs.append(value)
+            else:
+                raise ValueError(f"line {number}: cannot read needs of job {current.name}: {value!r}")
+            continue
+        if block_needs:
+            item = NEEDS_ITEM.match(line)
+            if item:
+                current.needs.append(item.group(1))
+            elif line.strip() and not line.lstrip().startswith("#"):
+                block_needs = False
+    for job in jobs.values():
+        for need in job.needs:
+            if need not in jobs:
+                raise ValueError(f"job {job.name} needs {need}, which is no job of this workflow")
+    return jobs
+
+
+def closure(jobs, name):
+    """Every job `name` waits for, directly or through another job (itself excluded)."""
+    seen = set()
+    todo = list(jobs[name].needs)
+    while todo:
+        need = todo.pop()
+        if need not in seen:
+            seen.add(need)
+            todo += jobs[need].needs
+    return seen
diff --git a/.github/check-release-gate.py b/.github/check-release-gate.py
new file mode 100755
index 00000000..447256fe
--- /dev/null
+++ b/.github/check-release-gate.py
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""Fail when a job of publish.yml gates neither publish job without a written reason.
+
+See buildcheck/releasegate.py; the reasons are in .github/release-gate-exemptions.txt.
+Usage (from anywhere): check-release-gate.py
+"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from buildcheck import releasegate, workflow  # noqa: E402
+
+ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+
+def main():
+    with open(os.path.join(ROOT, ".github", "workflows", "publish.yml"), encoding="utf-8") as f:
+        jobs = workflow.parse(f.read())
+    with open(os.path.join(ROOT, releasegate.EXEMPTIONS_FILE), encoding="utf-8") as f:
+        exemptions = releasegate.read_exemptions(f.read())
+    failures = releasegate.check(jobs, exemptions)
+    for failure in failures:
+        print(f"::error::{failure}", file=sys.stderr)
+    print(f"{len(jobs)} jobs, {len(exemptions)} exempt, {len(failures)} violations")
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.github/check-run-scripts.py b/.github/check-run-scripts.py
new file mode 100755
index 00000000..d6403667
--- /dev/null
+++ b/.github/check-run-scripts.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""Fail when a bash run script of a workflow or composite action does not parse (bash -n).
+See buildcheck/runscripts.py. Usage: check-run-scripts.py
+"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from buildcheck import runscripts  # noqa: E402
+
+if __name__ == "__main__":
+    sys.exit(runscripts.main(sys.argv, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
diff --git a/.github/check-shared-files.py b/.github/check-shared-files.py
new file mode 100755
index 00000000..47359ee6
--- /dev/null
+++ b/.github/check-shared-files.py
@@ -0,0 +1,20 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""Check the files this repository shares byte-identically with its sibling repositories.
+
+See buildcheck/sharedfiles.py; the list is .github/shared-files.sha256.
+Usage: check-shared-files.py            verify the local copies, compare with the siblings (warnings)
+       check-shared-files.py --offline  verify the local copies only
+       check-shared-files.py --write    recompute the hashes of the listed files after a sync
+"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from buildcheck import sharedfiles  # noqa: E402
+
+if __name__ == "__main__":
+    sys.exit(sharedfiles.main(sys.argv, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
diff --git a/.github/check-versions.py b/.github/check-versions.py
new file mode 100755
index 00000000..69745035
--- /dev/null
+++ b/.github/check-versions.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+"""Warn about Maven dependencies and plugins whose version differs between this repository and its
+siblings. See buildcheck/versions.py. Usage: check-versions.py
+"""
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from buildcheck import versions  # noqa: E402
+
+if __name__ == "__main__":
+    sys.exit(versions.main(sys.argv, os.path.dirname(os.path.dirname(os.path.abspath(__file__)))))
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 334224d2..e3b006e8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 version: 2
 updates:
diff --git a/.github/print-crash-logs.sh b/.github/print-crash-logs.sh
new file mode 100755
index 00000000..faa409ed
--- /dev/null
+++ b/.github/print-crash-logs.sh
@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+
+# Cross-repo shared script -- kept BYTE-IDENTICAL in java-llama.cpp, BitcoinAddressFinder,
+# srcmorph and streambuffer (listed in each repo's .github/shared-files.sha256). The "Print crash
+# logs" step of workspace/policies/ci-test-diagnostics.md section 3.1: echoes the JVM crash logs
+# of a failed test job into the job log, because an uploaded artifact is unreadable from anywhere
+# that cannot fetch from Azure Blob Storage (a phone, a restricted network, an agent sandbox).
+#
+# Usage: print-crash-logs.sh [<module-dir>...]   (default: the current directory)
+#   For each module directory: <dir>/hs_err_pid*.log (first 200 lines -- the diagnostic core is at
+#   the top, the tail is thread dumps and the memory map) and
+#   <dir>/target/surefire-reports/*.dumpstream|*.dump (whole; they are small).
+#
+# Always exits 0: it runs under `if: failure()` and must never replace the job's real failure.
+shopt -s nullglob
+[ "$#" -gt 0 ] || set -- .
+found=0
+for dir in "$@"; do
+    for f in "$dir"/hs_err_pid*.log; do
+        found=1
+        echo "===== $f (first 200 lines; full file in the uploaded artifact) ====="
+        sed -n '1,200p' "$f"
+    done
+    for f in "$dir"/target/surefire-reports/*.dumpstream "$dir"/target/surefire-reports/*.dump; do
+        found=1
+        echo "===== $f ====="
+        cat "$f"
+    done
+done
+if [ "$found" = 0 ]; then
+    # Worded defensively on purpose (policy section 3): the step fires on EVERY job failure, and
+    # an ordinary assertion failure writes no crash log. Never assert an abort from a missing file.
+    echo "No hs_err_pid*.log and no surefire dump/dumpstream was written (looked in: $*)."
+    echo
+    echo "For an ordinary test failure that is EXPECTED, not a finding: this step runs on"
+    echo "any job failure, and an assertion failure, a timeout or a compile error writes no"
+    echo "crash log. Read the surefire output above for the real cause."
+    echo
+    echo "It points at a JVM-level abort only if the log ALSO shows a fork ending abnormally"
+    echo "-- 'The forked VM terminated without properly saying goodbye', or an exit with no"
+    echo "test results. In that case the abort bypassed the JVM error handler (a native"
+    echo "exit()/terminate() rather than a raised signal), which is why no file was written."
+fi
+exit 0
diff --git a/.github/release-gate-exemptions.txt b/.github/release-gate-exemptions.txt
new file mode 100644
index 00000000..5663e042
--- /dev/null
+++ b/.github/release-gate-exemptions.txt
@@ -0,0 +1,16 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+#
+# Jobs of publish.yml that do not gate both publish jobs, each with the reason it may stay red.
+# Every other job must gate both; check-release-gate.py (shared-files job) fails on a job that does
+# not, and on a line here that names no job or a job that gates both after all.
+# Format: <job>: <reason>
+publish-snapshot: a publish job itself
+publish-release: a publish job itself
+check-snapshot: publish-snapshot's own precondition (the version is a SNAPSHOT)
+check-tag: publish-release's own precondition (the version matches the tag)
+github-snapshot: runs after publishing; attaches the assets to the rolling snapshot release
+github-release: runs after publishing; attaches the signed assets to the tag release
+verify-signing-key: red by design where the secret is withheld (forks, other contributors' branches); the publish jobs sign with the same key and fail on it themselves
+verify-signing-key-gradle: same as verify-signing-key, for the Gradle/BouncyCastle signing path
diff --git a/.github/shared-files.sha256 b/.github/shared-files.sha256
new file mode 100644
index 00000000..1a3d8d2a
--- /dev/null
+++ b/.github/shared-files.sha256
@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+#
+# The files this repository keeps BYTE-IDENTICAL with java-llama.cpp, BitcoinAddressFinder,
+# srcmorph and streambuffer (each lists the ones it carries). Checked by the `shared-files` job of
+# .github/workflows/publish.yml (.github/check-shared-files.py, see .github/buildcheck/sharedfiles.py):
+# a copy changed here alone fails it, a copy another repository lists with a different hash warns.
+# To change a shared file: change it in every repository listing it, then run
+# `python3 .github/check-shared-files.py --write` in each. An entry `<workflow>#<job>` stands for one
+# job of a workflow (kept identical inside otherwise different workflows); an entry ending in `?repo`
+# for a file or job identical up to the repository's name (hashed with that name replaced by
+# `{repo}`); `sha256sum -c` reads the plain file entries only.
+9ad21ea42bced35498c6fcaa533d9ba448af042497f923e60646a77cfbe0fc5f  .github/buildcheck/__init__.py
+3d1a9f2e93709941261a9655bc19bf50d5becefd8f6a6c2f5564096a757996bb  .github/buildcheck/workflow.py
+5a70eee1bb8af180edfd2a4bae61be61fac15b409f5df6a8bb9869425d7fc381  .github/buildcheck/releasegate.py
+ff2aaec95e53916ea340a0a291bf0f57e0011522aedb486622b1fb1cac136865  .github/buildcheck/sharedfiles.py
+0059120aab539c6ce8055675ae0d3b040097f80320051e40385072f68845ddb0  .github/buildcheck/tests/__init__.py
+561efd3f26d7728e475c8ce83c10b4761a6703b585b7b2a7ab052df10f73166c  .github/buildcheck/tests/helpers.py
+4985f25fa177bd79a79335742adfd0da0431e101124b4e7e214906b56ae903de  .github/buildcheck/tests/test_workflow.py
+cbe504ad081ba31ec16e11c11f879c64179ca7741bf0b1d1318a7fc969ed67dd  .github/buildcheck/tests/test_releasegate.py
+3ae66ea309fcbceb809de21b5062a3b0eba5e192c69fbc02592accb05d3f400a  .github/buildcheck/tests/test_sharedfiles.py
+7fe208dd33184b4543328f97b339c95e23c408b120e6bfa6095de4182aeb9a19  .github/check-release-gate.py
+1604ccdea83998814a3c1f98f746272222039867b0c7d692355e61495c1c648b  .github/check-shared-files.py
+e5f1679dc7151b2676b2f587860bbaa17e1b89b44a5a4e9703eb3499248c4a06  .github/buildcheck/versions.py
+d454d33b61089b5f7bd6d439e3e5b58e01e7b01eeba6b4c2f7ed3360bbb158f0  .github/buildcheck/tests/test_versions.py
+0c78f43dd181f079d35edde7cbf25bb22eac92c907845d8dc8eec78e812aa097  .github/check-versions.py
+33c70847b6568604e8725d167a9b1d5910cc2a1a5b01fec7362be31b488ddb02  .github/buildcheck/runscripts.py
+c4967e3011d474ec43dbc797d113685c0a8a01b7cc52e910a1356273e6a67dc9  .github/buildcheck/tests/test_runscripts.py
+7ad8f7258c983c91e67db695e5ab6ea0f9279af007a6aa815f92f0d8a74c2ae4  .github/check-run-scripts.py
+7da53fdb9537ccf7d3f3740be31f295bacb914fe186304b9ed8a65fd3d3d413e  .github/print-crash-logs.sh
+c8c02dc39aeacc154fad74071443c6513666aa94ca9f9c5fab49c5f39dea7ee6  .github/verify-signing-key.sh
+e0b2a4f331eae326b61c71f78d6272d06d99140a85dedb7710f93402de862466  .github/verify-bytecode-version.sh
+ab45f5c102b47dd16c325d4d9c283d158ba90c05f484eac45b2767885c4462f9  .github/signing-selftest/build.gradle.kts
+9b2ea5b5ff8d48607e26e4e211ad6d496f7660e71c84e42caaa82b84f7001710  .github/signing-selftest/settings.gradle.kts
+7232b092d3ba49b97bee7b539aaf6ee4c698e86bd3d4dd256e8ae2f85f653ee9  .github/ISSUE_TEMPLATE/bug_report.md
+0f08122e597f93dbbdc9c80e88984b4bf4738951d5902813df3d4640cdb11bac  .github/ISSUE_TEMPLATE/feature_request.md
+ebfcc0adf59f5858bbe4dc077c906304a197f72a55256f0d5aac669bee5e871f  .github/PULL_REQUEST_TEMPLATE.md
+f2a516d98a4287486dac82fc2c1293d81e3a4a1087e3ace934da0af5caaeace5  CODE_OF_CONDUCT.md
+074e6e32c86a4c0ef8b3ed25b721ca23aca83df277cd88106ef7177c354615ff  LICENSES/Apache-2.0.txt
+b05785f9f18e6716bab63424b11454513b9943a222595b70411009202fc592b5  LICENSES/MIT.txt
+edc34bc287c32b4d7ff970c0dd7a25e7d724cdd2775ef2b65aaccccd49c733c8  .editorconfig
+1568baf866c5f6c40751acd1e3b6760cc5db563c7330b8f33073cf2a9561cd4b  .gitattributes
+c47fad91718bf42aac298f569dcb8d0e36c81987f8706952d0637fb34ec1a1b5  .github/FUNDING.yml
+684faa8cb817db46e066c93c742c314066bc3ae71214132b226015e1a65be672  .github/CODEOWNERS
+11f78c496af746d3d6bdeb32827705e99fcfe45cb85ae50da4943a514e85e675  SUPPORT.md?repo
+e8f444ef851bd134330f1505f52b4b0970ef9a62dd76e4c25829241814ba5c73  .github/ISSUE_TEMPLATE/config.yml?repo
+2de09a4aa4b2bf2f9199c603806c6b6b65c254adbc35a6b5d184652f7022e69f  .mvn/jvm.config
+71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .mvn/jvm.config.license
+46fc025df0fd7b1bdbd84b875652ce9981aec87c2bb49b9263ae8c383cf7ce5a  .mvn/settings.xml
+8b8abf79508c4f53b2e765b78d6142655631d5ed69b59e95f234416a62e057b6  CITATION.cff?repo
+21341be0ac0628437973ddc2eb21ba9ea68a365d9d71dedee1512e10507649f0  .github/workflows/sonarqube.yml?repo
+7ed2f843a5187d3cdc1ba9841cb737ecabfb86dea638a314f890c70409dfea96  .github/workflows/publish.yml#code-style
+6e2ae11dad0616f66bbb2b6e6556f580bb987fd911d7132aa6bee2bfc7cc7b52  .java-version
+71ec85b7a30e80b18a9ab1fac0199cc50d68548e6f00dd116ab0f904ad63aa50  .java-version.license
+bee58687456c0695990a925ac50a2c17b71768a8ef493b584d7ac679debed7b9  .github/workflows/claude.yml
+19ccc3d4f0aef292c19883d4766a0193e9a3e998514f461df6609ccf65a19492  .github/workflows/claude-code-review.yml
+13ada38d1cd8d06b5098aab0ee996429156a2251daa11fb331c02248b7e6a40e  .github/workflows/scorecard.yml
+c0e9885eaab7a660fe2c236e3f10df284a6b2f42dad9ce59084a2d7ab00aa9cf  .github/workflows/reuse.yml
+f3b1a0864200236c61a5807b1e59236d474431a27695cd9d977bc6636d582667  .github/workflows/osv-scanner.yml
+2c43a2b7f4352b7bb09b6e487256ba74c18c170394946b0303b116c88f7b851c  .github/workflows/codeql.yml
+c9e757f2d0a2f456a08791697a94161c776d9b008a8aa75890da4133c81a99e9  .github/dependabot.yml
+f26d05f25a154b84d8f281bb92857811749e2225cdbc167362de930c48b532d1  .github/workflows/publish.yml#startgate
+89738e9b6939e31a452ea7d40adb6514c89e6209ed57fd4d574c8ba047f11e36  .github/workflows/publish.yml#shared-files
+fcb6cd0e2a71205b918f545f2680d378c790b774b9852129c5f9c7f3f8eb9860  .github/workflows/publish.yml#verify-signing-key
+09230b04c5f14bdda50a0c862152ff197a656cbc3fd0d110899c5f8150f8aa9a  .github/workflows/publish.yml#check-snapshot
+51e987d59efd9887b43e345edc0e0f3db21686879e3ca6ea9f0fdbc493d37121  .github/workflows/publish.yml#check-tag
+da8f26eaf73a7c1cb3842189a82576468e99c8d978b3742fde089cf771061555  .github/workflows/publish.yml#verify-signing-key-gradle
+de7ae553e6ac327094bcedf3acacd8b0c9e25607f9556c99419abf1dde405493  .github/workflows/publish.yml#github-snapshot
+4232da9e0a0742e21b78c971642d99805b7365a025771f48fa26118849500ee9  .github/workflows/publish.yml#github-release
diff --git a/.github/smoke-jar.sh b/.github/smoke-jar.sh
index deeb2fac..2aac5805 100755
--- a/.github/smoke-jar.sh
+++ b/.github/smoke-jar.sh
@@ -2,7 +2,7 @@
 
 # SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 # Post-`package` smoke for the PACKAGED library jar: puts it on a classpath, exactly as a consumer
 # does, and calls the API through the JDK single-file source launcher.
diff --git a/.github/smoke/StreamBufferSmoke.java b/.github/smoke/StreamBufferSmoke.java
index b296f743..a222f1e3 100644
--- a/.github/smoke/StreamBufferSmoke.java
+++ b/.github/smoke/StreamBufferSmoke.java
@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 //
-// SPDX-License-Identifier: Apache-2.0
+// SPDX-License-Identifier: MIT OR Apache-2.0
 
 import java.io.InputStream;
 import java.io.OutputStream;
diff --git a/.github/verify-bytecode-version.sh b/.github/verify-bytecode-version.sh
index a7a39546..384f3c96 100755
--- a/.github/verify-bytecode-version.sh
+++ b/.github/verify-bytecode-version.sh
@@ -5,8 +5,9 @@
 # SPDX-License-Identifier: MIT OR Apache-2.0
 
 # Cross-repo shared script — kept BYTE-IDENTICAL in java-llama.cpp, srcmorph,
-# BitcoinAddressFinder and streambuffer (sync any edit to all four, and to the checksum table in
-# workspace/crossrepostatus.md). Fails when a built jar contains a class file newer than the Java
+# BitcoinAddressFinder and streambuffer (listed in each repo's .github/shared-files.sha256, which
+# the `shared-files` job checks: sync any edit to all four, then `check-shared-files.py --write`).
+# Fails when a built jar contains a class file newer than the Java
 # release the artifact claims to support.
 #
 # Why: `maven.compiler.release` governs only the code WE compile. A dependency compiled for a newer
diff --git a/.github/verify-signing-key.sh b/.github/verify-signing-key.sh
new file mode 100755
index 00000000..8940490b
--- /dev/null
+++ b/.github/verify-signing-key.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+#
+# SPDX-License-Identifier: MIT OR Apache-2.0
+
+# Cross-repo shared script -- kept BYTE-IDENTICAL in java-llama.cpp, BitcoinAddressFinder,
+# srcmorph and streambuffer (listed in each repo's .github/shared-files.sha256). The body of the
+# `verify-signing-key` job: reproduces what maven-gpg-plugin does at deploy time, so a bad or
+# expired key or a wrong passphrase is caught in seconds instead of failing the publish stage.
+#
+# Input: GPG_PRIVATE_KEY (armored secret key) and GPG_PASSPHRASE in the environment.
+#
+# SECURITY: prints no secret material. The key is imported into an ephemeral keyring via stdin;
+# only PUBLIC key metadata is printed (key id, fingerprint, owner UID, algorithm, created/expiry,
+# all of which live on public keyservers); the passphrase is validated by producing and verifying
+# a throwaway signature, reaches gpg on fd 3 only (never argv, never a log line), and is
+# additionally `::add-mask::`ed. `set -x` must never be enabled here.
+set -euo pipefail   # NOTE: deliberately NO `set -x` — it would echo the passphrase.
+
+if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
+  echo "::error::GPG_PRIVATE_KEY is empty for this run. Either the secret is not set, or it is scoped to a different environment/branch than 'maven-central' on this ref. Nothing to verify."
+  exit 1
+fi
+# Defensive: even though we never print it, register the passphrase as a
+# masked value so any accidental echo downstream is redacted.
+if [ -n "${GPG_PASSPHRASE:-}" ]; then echo "::add-mask::${GPG_PASSPHRASE}"; fi
+
+echo "gpg: $(gpg --version | head -n1)"
+
+# Ephemeral, private keyring; removed on exit.
+export GNUPGHOME="$(mktemp -d)"
+chmod 700 "$GNUPGHOME"
+cleanup() { gpgconf --kill gpg-agent >/dev/null 2>&1 || true; rm -rf "$GNUPGHOME"; }
+trap cleanup EXIT
+
+echo "== Import private key into an ephemeral keyring (key via stdin, never argv) =="
+printf '%s\n' "$GPG_PRIVATE_KEY" | gpg --batch --import
+
+COLONS="$(gpg --list-secret-keys --with-colons --fixed-list-mode)"
+SECCOUNT="$(printf '%s\n' "$COLONS" | awk -F: '$1=="sec"{n++} END{print n+0}')"
+echo "Secret keys imported: $SECCOUNT"
+if [ "$SECCOUNT" -lt 1 ]; then
+  echo "::error::No secret key was imported — GPG_PRIVATE_KEY is not a valid armored secret key (check that the secret contains the full -----BEGIN PGP PRIVATE KEY BLOCK----- with intact newlines)."
+  exit 1
+fi
+
+KEYID="$(printf '%s\n' "$COLONS"  | awk -F: '$1=="sec"{print $5; exit}')"
+ALGO="$(printf '%s\n'  "$COLONS"  | awk -F: '$1=="sec"{print $4; exit}')"
+CREATED="$(printf '%s\n' "$COLONS"| awk -F: '$1=="sec"{print $6; exit}')"
+EXPIRES="$(printf '%s\n' "$COLONS"| awk -F: '$1=="sec"{print $7; exit}')"
+FPR="$(printf '%s\n'   "$COLONS"  | awk -F: '$1=="fpr"{print $10; exit}')"
+
+echo "== PUBLIC key metadata =="
+echo "  Key ID (long):  $KEYID"
+echo "  Fingerprint:    $FPR"
+echo "  Pubkey algo id: $ALGO"
+echo "  Created (UTC):  $(date -u -d "@$CREATED" 2>/dev/null || echo "$CREATED")"
+echo "  Owner UID(s):"
+printf '%s\n' "$COLONS" | awk -F: '$1=="uid"{print "    - " $10}'
+
+# --- Expiration gate ---
+NOW="$(date -u +%s)"
+if [ -n "$EXPIRES" ]; then
+  echo "  Expires (UTC):  $(date -u -d "@$EXPIRES" 2>/dev/null || echo "$EXPIRES")"
+  if [ "$EXPIRES" -le "$NOW" ]; then
+    echo "::error::Signing key is EXPIRED — Maven Central will reject its signatures. Extend the key's expiry and update the GPG_PRIVATE_KEY secret."
+    exit 1
+  fi
+  echo "  Days to expiry: $(( (EXPIRES - NOW) / 86400 ))"
+  if [ "$(( (EXPIRES - NOW) / 86400 ))" -lt 30 ]; then
+    echo "::warning::Signing key expires in under 30 days — plan to rotate it."
+  fi
+else
+  echo "  Expires (UTC):  never"
+fi
+
+# --- Signing-capability gate ---
+if printf '%s\n' "$COLONS" | awk -F: '($1=="sec"||$1=="ssb"){print $12}' | grep -q 's'; then
+  echo "  Signing capability: present"
+else
+  echo "::error::No signing-capable (sub)key found — this key cannot produce release signatures."
+  exit 1
+fi
+
+# --- Passphrase unlock + sign + verify roundtrip (the exact failure mode) ---
+# Passphrase on fd 3 only. Payload is a throwaway nonce; only the signature's
+# validity (exit codes) matters — no secret is ever emitted.
+echo "== Passphrase unlock + detached-sign + verify self-test =="
+WORK="$(mktemp -d)"
+printf '%s' "ai-index signing-selftest" > "$WORK/payload.txt"
+gpg --batch --yes --pinentry-mode loopback --passphrase-fd 3 \
+    --local-user "$KEYID" \
+    --detach-sign --armor --output "$WORK/payload.txt.asc" "$WORK/payload.txt" \
+    3<<<"${GPG_PASSPHRASE:-}"
+echo "  Signature produced: $(wc -c < "$WORK/payload.txt.asc") armored bytes"
+gpg --batch --verify "$WORK/payload.txt.asc" "$WORK/payload.txt"
+rm -rf "$WORK"
+
+echo "RESULT: OK — key imports, is not expired, is signing-capable, and the passphrase successfully unlocked it to produce a VALID signature. maven-gpg-plugin will be able to sign with this key/passphrase."
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 7e80b686..c8bcb91a 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 name: Claude Code Review
 
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index e50d5468..60f20b8b 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 name: Claude Code
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 59cb58a2..596b1491 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 name: CodeQL
 on:
@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
-        with: { java-version: '21', distribution: temurin }
+        with: { java-version-file: .java-version, distribution: temurin }
       - uses: github/codeql-action/init@v4
         with: { languages: java, queries: +security-and-quality }
       - name: Build with Maven
diff --git a/.github/workflows/formal-verification.yml b/.github/workflows/formal-verification.yml
index 0cd0d255..4f72366b 100644
--- a/.github/workflows/formal-verification.yml
+++ b/.github/workflows/formal-verification.yml
@@ -1,6 +1,6 @@
 # SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 # ---------------------------------------------------------------------------------------------
 # Formal verification — a SEPARATE pipeline, on purpose.
@@ -90,7 +90,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '21'
+          java-version-file: .java-version
           distribution: temurin
           cache: maven
       - name: Set up OpenJML (pinned + checksum-verified)
@@ -143,7 +143,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '21'
+          java-version-file: .java-version
           distribution: temurin
           cache: maven
       - name: Set up OpenJML (pinned + checksum-verified)
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
index 9aa96688..6073bc8b 100644
--- a/.github/workflows/osv-scanner.yml
+++ b/.github/workflows/osv-scanner.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 name: OSV-Scanner
 on:
@@ -12,7 +12,8 @@ on:
     - cron: '0 6 * * 1'
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   scan-scheduled:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9fa21e0f..91ee2885 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,6 +1,6 @@
 # SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 name: Publish
 on:
@@ -61,6 +61,32 @@ jobs:
     steps:
       - run: echo "Start gate elapsed — proceeding with pipeline."
 
+  # ---------------------------------------------------------------------------
+  # Files kept byte-identical with the sibling repositories (java-llama.cpp,
+  # BitcoinAddressFinder, srcmorph, streambuffer), listed in .github/shared-files.sha256.
+  # A copy changed here alone fails; one the siblings list with another hash warns.
+  # Also runs the tests of the shared build checks and the release-gate check. This
+  # job is itself identical in all four repositories.
+  # ---------------------------------------------------------------------------
+  shared-files:
+    name: Shared files + build checks
+    needs: startgate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Shared files match .github/shared-files.sha256 (siblings compared, warnings only)
+        run: python3 .github/check-shared-files.py
+      - name: Build-check tests
+        run: python3 -m unittest discover -s .github/buildcheck/tests -t .github
+      - name: Release gate (every job gates both publish jobs, or release-gate-exemptions.txt says why)
+        run: python3 .github/check-release-gate.py
+      - name: Run scripts parse (bash -n over every bash run script of the workflows and actions)
+        run: python3 .github/check-run-scripts.py
+      - name: Maven versions (warns where a dependency or plugin differs from a sibling repository)
+        run: python3 .github/check-versions.py
+
   # ---------------------------------------------------------------------------
   # GPG signing-key preflight (standalone, no `needs:` — runs in parallel at the
   # very start on every trigger). Reproduces what maven-gpg-plugin does at deploy
@@ -85,94 +111,15 @@ jobs:
     runs-on: ubuntu-latest
     environment: maven-central
     steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Import key + run sign/verify self-test (prints only PUBLIC metadata)
-        shell: bash
         env:
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-        run: |
-          set -euo pipefail   # NOTE: deliberately NO `set -x` — it would echo the passphrase.
-
-          if [ -z "${GPG_PRIVATE_KEY:-}" ]; then
-            echo "::error::GPG_PRIVATE_KEY is empty for this run. Either the secret is not set, or it is scoped to a different environment/branch than 'maven-central' on this ref. Nothing to verify."
-            exit 1
-          fi
-          # Defensive: even though we never print it, register the passphrase as a
-          # masked value so any accidental echo downstream is redacted.
-          if [ -n "${GPG_PASSPHRASE:-}" ]; then echo "::add-mask::${GPG_PASSPHRASE}"; fi
-
-          echo "gpg: $(gpg --version | head -n1)"
-
-          # Ephemeral, private keyring; removed on exit.
-          export GNUPGHOME="$(mktemp -d)"
-          chmod 700 "$GNUPGHOME"
-          cleanup() { gpgconf --kill gpg-agent >/dev/null 2>&1 || true; rm -rf "$GNUPGHOME"; }
-          trap cleanup EXIT
-
-          echo "== Import private key into an ephemeral keyring (key via stdin, never argv) =="
-          printf '%s\n' "$GPG_PRIVATE_KEY" | gpg --batch --import
-
-          COLONS="$(gpg --list-secret-keys --with-colons --fixed-list-mode)"
-          SECCOUNT="$(printf '%s\n' "$COLONS" | awk -F: '$1=="sec"{n++} END{print n+0}')"
-          echo "Secret keys imported: $SECCOUNT"
-          if [ "$SECCOUNT" -lt 1 ]; then
-            echo "::error::No secret key was imported — GPG_PRIVATE_KEY is not a valid armored secret key (check that the secret contains the full -----BEGIN PGP PRIVATE KEY BLOCK----- with intact newlines)."
-            exit 1
-          fi
-
-          KEYID="$(printf '%s\n' "$COLONS"  | awk -F: '$1=="sec"{print $5; exit}')"
-          ALGO="$(printf '%s\n'  "$COLONS"  | awk -F: '$1=="sec"{print $4; exit}')"
-          CREATED="$(printf '%s\n' "$COLONS"| awk -F: '$1=="sec"{print $6; exit}')"
-          EXPIRES="$(printf '%s\n' "$COLONS"| awk -F: '$1=="sec"{print $7; exit}')"
-          FPR="$(printf '%s\n'   "$COLONS"  | awk -F: '$1=="fpr"{print $10; exit}')"
-
-          echo "== PUBLIC key metadata =="
-          echo "  Key ID (long):  $KEYID"
-          echo "  Fingerprint:    $FPR"
-          echo "  Pubkey algo id: $ALGO"
-          echo "  Created (UTC):  $(date -u -d "@$CREATED" 2>/dev/null || echo "$CREATED")"
-          echo "  Owner UID(s):"
-          printf '%s\n' "$COLONS" | awk -F: '$1=="uid"{print "    - " $10}'
-
-          # --- Expiration gate ---
-          NOW="$(date -u +%s)"
-          if [ -n "$EXPIRES" ]; then
-            echo "  Expires (UTC):  $(date -u -d "@$EXPIRES" 2>/dev/null || echo "$EXPIRES")"
-            if [ "$EXPIRES" -le "$NOW" ]; then
-              echo "::error::Signing key is EXPIRED — Maven Central will reject its signatures. Extend the key's expiry and update the GPG_PRIVATE_KEY secret."
-              exit 1
-            fi
-            echo "  Days to expiry: $(( (EXPIRES - NOW) / 86400 ))"
-            if [ "$(( (EXPIRES - NOW) / 86400 ))" -lt 30 ]; then
-              echo "::warning::Signing key expires in under 30 days — plan to rotate it."
-            fi
-          else
-            echo "  Expires (UTC):  never"
-          fi
-
-          # --- Signing-capability gate ---
-          if printf '%s\n' "$COLONS" | awk -F: '($1=="sec"||$1=="ssb"){print $12}' | grep -q 's'; then
-            echo "  Signing capability: present"
-          else
-            echo "::error::No signing-capable (sub)key found — this key cannot produce release signatures."
-            exit 1
-          fi
-
-          # --- Passphrase unlock + sign + verify roundtrip (the exact failure mode) ---
-          # Passphrase on fd 3 only. Payload is a throwaway nonce; only the signature's
-          # validity (exit codes) matters — no secret is ever emitted.
-          echo "== Passphrase unlock + detached-sign + verify self-test =="
-          WORK="$(mktemp -d)"
-          printf '%s' "ai-index signing-selftest" > "$WORK/payload.txt"
-          gpg --batch --yes --pinentry-mode loopback --passphrase-fd 3 \
-              --local-user "$KEYID" \
-              --detach-sign --armor --output "$WORK/payload.txt.asc" "$WORK/payload.txt" \
-              3<<<"${GPG_PASSPHRASE:-}"
-          echo "  Signature produced: $(wc -c < "$WORK/payload.txt.asc") armored bytes"
-          gpg --batch --verify "$WORK/payload.txt.asc" "$WORK/payload.txt"
-          rm -rf "$WORK"
-
-          echo "RESULT: OK — key imports, is not expired, is signing-capable, and the passphrase successfully unlocked it to produce a VALID signature. maven-gpg-plugin will be able to sign with this key/passphrase."
+        # Shared, byte-identical in all four repos; the security notes are in the script.
+        run: bash .github/verify-signing-key.sh
 
   # ---------------------------------------------------------------------------
   # GPG signing-key preflight — GRADLE / BouncyCastle path.
@@ -202,11 +149,11 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '21'
+          java-version-file: .java-version
           distribution: temurin
       - uses: gradle/actions/setup-gradle@v6
         with:
-          gradle-version: "9.6.1"
+          gradle-version: "9.8.0"
       - name: Sign a throwaway artifact via useInMemoryPgpKeys (BouncyCastle)
         shell: bash
         env:
@@ -243,7 +190,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '21'
+          java-version-file: .java-version
           distribution: temurin
       - name: Spotless check (fail fast on format violations)
         run: mvn -B --no-transfer-progress spotless:check
@@ -254,7 +201,7 @@ jobs:
         run: |
           mvn -B --no-transfer-progress -DskipTests -Denforcer.skip=true compile
           echo "=== internal package dependency graph (jdeps, bytecode) ==="
-          jdeps -verbose:package target/classes | grep 'net.ladenthin.streambuffer' || true
+          jdeps -verbose:package target/classes | grep 'net\.ladenthin\.' || true
 
   build:
     name: Build
@@ -264,7 +211,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '21'
+          java-version-file: .java-version
           distribution: temurin
           cache: maven
       - name: Build
@@ -291,7 +238,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '21'
+          java-version-file: .java-version
           distribution: temurin
       - uses: actions/download-artifact@v8
         with: { name: jars, path: jars/ }
@@ -308,18 +255,14 @@ jobs:
         run: .github/smoke-jar.sh jars 'streambuffer-*.jar'
 
   test:
-    name: Test (JDK ${{ matrix.java-version }})
+    name: Test
     needs: [build]
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        java-version: ['21']
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: ${{ matrix.java-version }}
+          java-version-file: .java-version
           distribution: temurin
           cache: maven
       - name: Memory before tests
@@ -327,7 +270,6 @@ jobs:
       - name: Test
         run: mvn -e --batch-mode --no-transfer-progress -P jcstress verify
       - uses: actions/upload-artifact@v7
-        if: matrix.java-version == '21'
         with:
           name: jacoco-report
           path: target/site/jacoco/jacoco.xml
@@ -335,45 +277,16 @@ jobs:
       - name: Memory after tests
         if: always()
         run: free -h
-      # A forked test JVM that aborts leaves an hs_err_pid log and a surefire
-      # dumpstream -- both otherwise ONLY inside the artifact uploaded below,
-      # which is unreachable from anywhere that cannot fetch from Azure Blob
-      # (a phone, a restricted network, an agent sandbox). Echo them here so the
-      # aborting frame is readable from the run page itself. See
-      # ../workspace/policies/ci-test-diagnostics.md section 3.1.
+      # Echo the crash logs into the job log (workspace/policies/ci-test-diagnostics.md 3.1).
       - name: Print crash logs (on failure)
         if: failure()
         shell: bash
-        run: |
-          shopt -s nullglob
-          found=0
-          for f in hs_err_pid*.log; do
-            found=1
-            echo "===== $f (first 200 lines; full file in the uploaded artifact) ====="
-            sed -n '1,200p' "$f"
-          done
-          for f in target/surefire-reports/*.dumpstream target/surefire-reports/*.dump; do
-            found=1
-            echo "===== $f ====="
-            cat "$f"
-          done
-          if [ "$found" = 0 ]; then
-            echo "No hs_err_pid*.log and no surefire dump/dumpstream was written."
-            echo
-            echo "For an ordinary test failure that is EXPECTED, not a finding: this step runs on"
-            echo "any job failure, and an assertion failure, a timeout or a compile error writes no"
-            echo "crash log. Read the surefire output above for the real cause."
-            echo
-            echo "It points at a JVM-level abort only if the log ALSO shows a fork ending abnormally"
-            echo "-- 'The forked VM terminated without properly saying goodbye', or an exit with no"
-            echo "test results. In that case the abort bypassed the JVM error handler (a native"
-            echo "exit()/terminate() rather than a raised signal), which is why no file was written."
-          fi
+        run: bash .github/print-crash-logs.sh .
       - name: Upload crash & surefire dumps
         if: failure()
         uses: actions/upload-artifact@v7
         with:
-          name: crash-dumps-jdk${{ matrix.java-version }}
+          name: crash-dumps
           path: |
             ${{ github.workspace }}/hs_err_pid*.log
             ${{ github.workspace }}/*.hprof
@@ -390,7 +303,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
-        with: { java-version: '21', distribution: temurin, cache: maven }
+        with: { java-version-file: .java-version, distribution: temurin, cache: maven }
       - name: Test under vmlens
         run: mvn --batch-mode --no-transfer-progress -Pvmlens test
       - uses: actions/upload-artifact@v7
@@ -409,7 +322,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
-        with: { java-version: '21', distribution: temurin, cache: maven }
+        with: { java-version-file: .java-version, distribution: temurin, cache: maven }
       - uses: actions/download-artifact@v8
         with: { name: jacoco-report, path: target/site/jacoco/ }
         continue-on-error: true
@@ -480,7 +393,7 @@ jobs:
 
   publish-snapshot:
     name: Publish Snapshot to Central
-    needs: [check-snapshot, code-style, smoke-jar]
+    needs: [check-snapshot, code-style, smoke-jar, shared-files, vmlens]
     if: needs.check-snapshot.result == 'success' && inputs.publish_to_central
     runs-on: ubuntu-latest
     environment: maven-central
@@ -488,7 +401,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '21'
+          java-version-file: .java-version
           distribution: temurin
           cache: maven
           server-id: central
@@ -597,7 +510,7 @@ jobs:
 
   publish-release:
     name: Publish Release to Central
-    needs: [check-tag, code-style, smoke-jar]
+    needs: [check-tag, code-style, smoke-jar, shared-files, vmlens]
     if: needs.check-tag.result == 'success' && inputs.publish_to_central
     runs-on: ubuntu-latest
     environment: maven-central
@@ -607,7 +520,7 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6
         with:
-          java-version: '21'
+          java-version-file: .java-version
           distribution: temurin
           cache: maven
           server-id: central
diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
index 560b066f..a1e66bde 100644
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 name: REUSE Compliance Check
 on:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 4f838ef8..51cb023c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 name: Scorecard supply-chain security
 on:
diff --git a/.github/workflows/sonarqube.yml b/.github/workflows/sonarqube.yml
index 82271cd8..4238d4c5 100644
--- a/.github/workflows/sonarqube.yml
+++ b/.github/workflows/sonarqube.yml
@@ -1,6 +1,6 @@
-# SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+# SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 #
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: MIT OR Apache-2.0
 
 name: SonarQube
 on:
@@ -20,7 +20,7 @@ jobs:
       - name: Set up JDK 21
         uses: actions/setup-java@v6
         with:
-          java-version: 21
+          java-version-file: .java-version
           distribution: 'zulu'
       - name: Cache SonarQube packages
         uses: actions/cache@v6
diff --git a/.gitignore b/.gitignore
index b4f1f368..5de12ed1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -55,3 +55,6 @@ src/test/jpf/jpf-output.log
 
 # Netbeans files
 nbactions.xml
+
+# Python bytecode of the .github/buildcheck checks
+__pycache__/
diff --git a/.java-version b/.java-version
new file mode 100644
index 00000000..aabe6ec3
--- /dev/null
+++ b/.java-version
@@ -0,0 +1 @@
+21
diff --git a/.java-version.license b/.java-version.license
new file mode 100644
index 00000000..eca5b047
--- /dev/null
+++ b/.java-version.license
@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+
+SPDX-License-Identifier: MIT OR Apache-2.0
diff --git a/.mvn/jvm.config.license b/.mvn/jvm.config.license
index 6ef5e77c..eca5b047 100644
--- a/.mvn/jvm.config.license
+++ b/.mvn/jvm.config.license
@@ -1,3 +1,3 @@
-SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 
-SPDX-License-Identifier: Apache-2.0
+SPDX-License-Identifier: MIT OR Apache-2.0
diff --git a/.mvn/settings.xml b/.mvn/settings.xml
index bd8f4bb4..a3f9464f 100644
--- a/.mvn/settings.xml
+++ b/.mvn/settings.xml
@@ -1,7 +1,7 @@
 <!--
-SPDX-FileCopyrightText: 2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
+SPDX-FileCopyrightText: 2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>
 
-SPDX-License-Identifier: Apache-2.0
+SPDX-License-Identifier: MIT OR Apache-2.0
 -->
 
 <settings>
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 063938d7..db71ad93 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Cancellable pipeline start-gate via a `startgate` GitHub Environment with configurable wait timer.
 
 ### Changed
+- **CI: shared files and the release gate are checked.** The files kept byte-identical with the sibling
+  repositories are listed with their SHA-256 in `.github/shared-files.sha256`; a new `shared-files` job
+  fails on a copy changed here alone and warns on a sibling's differing copy. The same job runs the
+  shared build-check library's tests and `check-release-gate.py`: every job must gate both publish
+  jobs unless `.github/release-gate-exemptions.txt` says why (`vmlens` now gates). The crash-log step
+  and the signing-key preflight are shared scripts (`print-crash-logs.sh`, `verify-signing-key.sh`)
+  instead of copies pasted into the workflow.
+- **Workflow jobs kept identical across the repositories are checked too**: a
+  `.github/shared-files.sha256` entry `.github/workflows/publish.yml#<job>` hashes one job (`startgate`,
+  `shared-files`, `verify-signing-key`, `check-snapshot`, `check-tag`, and where present
+  `verify-signing-key-gradle`, `github-snapshot`, `github-release`).
+- **More shared files, and files identical up to the repository name**: a shared-files entry ending
+  in `?repo` is hashed with the repository's name replaced by `{repo}`. Added: `.editorconfig`,
+  `.gitattributes` (now with `*.gguf binary` everywhere), `FUNDING.yml`, `CODEOWNERS`, the license texts,
+  `SUPPORT.md`, `ISSUE_TEMPLATE/config.yml` and further files listed in `.github/shared-files.sha256`;
+  the signing self-test now runs on Gradle 9.8.0 in all four repositories.
+- **The JDK is named once, in `.java-version`**: every workflow reads it through setup-java's
+  `java-version-file` (the `JAVA_VERSION` env and the literal `21`s are gone); `.java-version` and
+  `codeql.yml` are now byte-identical in all four sibling repositories and in the shared-files manifest.
+  The one-JDK `test` matrix became a plain job on `.java-version` (check name `Test`, crash artifact
+  `crash-dumps`); the JPF job still pins 11 + 21 explicitly, since jpf-core needs JDK 11.
+- **CI files are licensed `MIT OR Apache-2.0`**: every `.github` file carrying only the owner's
+  copyright now has the same license header in all four sibling repositories, so the shared ones are
+  byte-identical. `claude.yml`, `claude-code-review.yml`, `scorecard.yml`, `reuse.yml`,
+  `osv-scanner.yml`, `dependabot.yml` and `CODE_OF_CONDUCT.md` joined the shared-files manifest;
+  `osv-scanner.yml` now grants `contents: read` instead of `read-all` (as java-llama.cpp already did).
+- **Workflow run scripts are parsed in the `shared-files` job**: `check-run-scripts.py` runs `bash -n`
+  over every `run:` script of the workflows and composite actions that runs in bash (shell decided as
+  the runner does), so a broken script fails within minutes instead of in the job that runs it.
+- **Maven versions are compared with the sibling repositories**: `check-versions.py` (in the
+  `shared-files` job) warns where a dependency or plugin -- incl. annotation-processor paths and the
+  Spotless formatter version -- is used in another version than in a sibling's default branch.
 - Build and test tooling bumped to latest stable in step with the sibling repos: spotless 3.10.2 → 3.10.3,
   palantir-java-format 2.98.0 → 2.99.0, NullAway 0.14.1 → 0.14.2, archunit-junit5 1.5.0 → 1.5.1.
 - Build plugins bumped to latest stable: `com.diffplug.spotless:spotless-maven-plugin` 3.9.0 → 3.10.0,
diff --git a/CLAUDE.md b/CLAUDE.md
index 7ec3b176..3dda5e7d 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -209,7 +209,7 @@ its deliverable is the plain library jar, not a fat jar — but it runs the same
 dependency cannot change that quietly.
 
 **The gate: `.github/verify-bytecode-version.sh`.** Kept **byte-identical** across java-llama.cpp /
-BitcoinAddressFinder / streambuffer / srcmorph (checksum table in `workspace/crossrepostatus.md`).
+BitcoinAddressFinder / streambuffer / srcmorph (listed in `.github/shared-files.sha256`, checked by the `shared-files` job).
 It opens every `.class` in every jar it is given and fails on any whose class-file major version
 exceeds `--max-major`:
 
@@ -240,6 +240,29 @@ backstop — added because it previously had none. Convention + the `excludedSco
 enforcer default gotcha are in
 [`../workspace/policies/dependency-convergence-pinning.md`](../workspace/policies/dependency-convergence-pinning.md).
 
+## Shared files and the release gate (`shared-files` job)
+
+Files kept byte-identical with java-llama.cpp, BitcoinAddressFinder, srcmorph and streambuffer are
+listed with their SHA-256 in **`.github/shared-files.sha256`** — the reference for what must stay
+equal. An entry `.github/workflows/publish.yml#<job>` stands for one job of the workflow: the jobs kept
+identical across the repositories (`startgate`, `shared-files`, `verify-signing-key`, `check-snapshot`,
+`check-tag`, `verify-signing-key-gradle`, `github-snapshot`, `github-release`) are checked like files. An entry ending in `?repo` covers a file or job identical up to the
+repository's name (hashed with the name replaced by `{repo}`), e.g. `SUPPORT.md?repo`.
+The `shared-files` job of `publish.yml` (gating both publish jobs) fails when a listed file changed here alone and warns when another repository's
+default branch lists it with a different hash. To change a shared file, change every copy, then run
+`python3 .github/check-shared-files.py --write` in each repository. The shared build-check library
+(`.github/buildcheck/`, stdlib-only Python with unit tests: `python3 -m unittest discover -s
+.github/buildcheck/tests -t .github`) also runs **`check-release-gate.py`**: every job must gate both
+publish jobs unless `.github/release-gate-exemptions.txt` names it with a reason, and
+**`check-versions.py`**, which **warns** where a Maven dependency or plugin (incl. the Spotless
+formatter version) is used here in another version than in a sibling repository -- Dependabot bumps
+each repository on its own, so this is where the drift shows -- and **`check-run-scripts.py`**, which
+runs `bash -n` over every `run:` script of the workflows and composite actions that runs in bash, so
+a broken script (a lost line continuation, say) fails here instead of in the job running it. The JDK every
+workflow uses is `.java-version` (setup-java's `java-version-file`), the same shared file in all four. Details and the
+reasoning (copies with a checksum rather than a shared actions repository):
+[`../workspace/crossrepostatus.md`](../workspace/crossrepostatus.md), "Cross-repo byte-identical files".
+
 ## Open TODOs
 
 Open TODOs for this repo live in [`TODO.md`](TODO.md). Cross-repo status
diff --git a/REUSE.toml b/REUSE.toml
index d60c00b3..4b48f795 100644
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -11,3 +11,15 @@ path = [
 precedence = "aggregate"
 SPDX-FileCopyrightText = "2014-2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>"
 SPDX-License-Identifier = "Apache-2.0"
+
+# The issue/PR templates are kept byte-identical in java-llama.cpp, BitcoinAddressFinder, srcmorph
+# and streambuffer (.github/shared-files.sha256) and carry the license of the other shared files.
+# Last in this file on purpose: of several matching annotations the last one applies.
+[[annotations]]
+path = [
+    ".github/ISSUE_TEMPLATE/bug_report.md",
+    ".github/ISSUE_TEMPLATE/feature_request.md",
+    ".github/PULL_REQUEST_TEMPLATE.md",
+]
+SPDX-FileCopyrightText = "2026 Bernard Ladenthin <bernard.ladenthin@gmail.com>"
+SPDX-License-Identifier = "MIT OR Apache-2.0"