jmanico · Oct 18, 2026 · Oct 18, 2026
@@ -1,28 +1,32 @@
 # Reviewed action pins
 
 Resolved release tags through each authoritative repository Git ref (including
-annotated-tag dereferencing) on 2026-09-26 UTC. These are source pins, not claims
-that runtime tool downloads are made immutable by pinning an action.
+annotated-tag dereferencing) on 2026-10-18 UTC, matching the current workflows.
+These are source pins, not claims that runtime tool downloads are made immutable
+by pinning an action.
 
 | Repository/action | Release | Commit |
 | --- | --- | --- |
 | `actions/checkout` | [v7.0.1](https://github.com/actions/checkout/releases/tag/v7.0.1) | `3d3c42e5aac5ba805825da76410c181273ba90b1` |
 | `actions/setup-java` | [v6.0.1](https://github.com/actions/setup-java/releases/tag/v6.0.1) | `de7274f081f381c8f8158605e0321c36c376e2e6` |
-| `actions/upload-artifact` | [v7.0.1](https://github.com/actions/upload-artifact/releases/tag/v7.0.1) | `043fb46d1a93c77aae656e7c1c64a875d1fc6a0a` |
-| `actions/download-artifact` | [v8.0.1](https://github.com/actions/download-artifact/releases/tag/v8.0.1) | `3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c` |
-| `github/codeql-action` | [v4.38.2](https://github.com/github/codeql-action/releases/tag/v4.38.2) | `2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2` |
+| `actions/upload-artifact` | [v7.0.2](https://github.com/actions/upload-artifact/releases/tag/v7.0.2) | `cf430e030ddbb5b0abf93d22962f4752f3646cd9` |
+| `actions/download-artifact` | [v8.0.2](https://github.com/actions/download-artifact/releases/tag/v8.0.2) | `9000827ccba6bdab643e8b6fd33ac0654aef8333` |
+| `github/codeql-action` | [v4.38.3](https://github.com/github/codeql-action/releases/tag/v4.38.3) | `24c54180a607b1449ed407dd24f251e4e9147c8d` |
 | `advanced-security/maven-dependency-submission-action` | [v6.0.1](https://github.com/advanced-security/maven-dependency-submission-action/releases/tag/v6.0.1) | `a64327a7329c9939cf675e458452febe1894a70c` |
 
 CodeQL uses the `init` and `analyze` subactions at the same commit. No other
 external actions or reusable workflows are referenced. Upload/download were
-reviewed together for PR #175; the two official lightweight release tags resolve
+originally reviewed together for PR #175 and advanced with CodeQL in
+[PR #240](https://github.com/OWASP/owasp-java-encoder/pull/240). The current
+release-to-commit mappings were rechecked on 2026-10-18; this inventory refresh
+does not claim a new full source audit. The two artifact-action release tags resolve
 directly to the commits above. All actions are JavaScript actions, not composite
 actions with hidden
 `uses` references. Their metadata, entrypoints and relevant credential/download
 paths were reviewed, along with the release changes.
 
 CodeQL's release tag is annotated: the Git ref points to tag object
-`88585263c0627ee42c0e1c5143a112c8d6f4aa18`, which must be dereferenced to the
+`cee97f86b972a3ded3c58d04148362b193ddc518`, which must be dereferenced to the
 commit in the table. Do not copy an annotated tag object's SHA into a commit
 pin. Verify the object's type and follow tag targets until it is a commit
 (equivalently, inspect the peeled `refs/tags/<version>^{}` Git ref).

@@ -67,7 +67,7 @@ for child or fixture POMs. Graph reports and submission JSON are retained for
 inspection. Inspect representative Jakarta Spring/Tomcat dependencies in the
 resulting graph; alert counts are not gates.
 
-The immutable 1.5.0 Java Encoder artifacts used by japicmp are intentional
+The immutable 1.6.0 Java Encoder artifacts used by japicmp are intentional
 development-only comparison inputs. Keep them visible in the build graph: an alert
 on a baseline artifact describes that historical input, not a dependency shipped
 to current development consumers, and must be assessed rather than hidden with a graph filter.
@@ -143,9 +143,10 @@ unverified owners or treat review rules as CODEOWNERS validation.
 
 All tags prohibit update/deletion with no bypass; new signed release tags still
 follow `RELEASING.md`. GitHub `required_signatures` checks commit signatures,
-not annotated tag signatures. Legacy Codacy and Travis webhooks have no current
-workflow/required-check owner and return 404/502; disable them while retaining
-their private configuration for recovery. Site retirement remains with #96.
+not annotated tag signatures. The [September validation](../docs/archive/maintenance-2026-09/batch-02-validation.md#live-settings-and-negative-tests)
+records disabling the legacy Codacy and Travis webhooks, with their private
+configuration retained for recovery. Maven Site sources and publishing are
+retired; the implicit Site lifecycle remains explicitly pinned and disabled.
 
 For recovery, an administrator uses Settings or the REST API, records the actor,
 reason and affected PR in #169, makes the narrowest temporary change, then

@@ -5,7 +5,11 @@ Apache Maven Wrapper 3.3.4's unmodified `only-script` distribution; no wrapper
 JAR executes before the download check. It pins Maven 3.10.0 and its SHA-256.
 The downloaded Maven ZIP was independently compared to the SHA-512 served at
 [Apache's distribution site](https://downloads.apache.org/maven/maven-3/3.10.0/binaries/).
-Wrapper archive SHA-256: `6cb584c2bc907b849a0b931d8266d3ff3214cdd3127115ed4f49fb7176413d36`.
+The separate [Maven Wrapper 3.3.4 only-script archive](https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper-distribution/3.3.4/maven-wrapper-distribution-3.3.4-only-script.zip)
+(`maven-wrapper-distribution-3.3.4-only-script.zip`) has SHA-256
+`6cb584c2bc907b849a0b931d8266d3ff3214cdd3127115ed4f49fb7176413d36`.
+The Maven 3.10.0 ZIP checksum is recorded in
+[the wrapper configuration](.mvn/wrapper/maven-wrapper.properties).
 Both bootstrap paths are CI gates, including a deliberately wrong checksum with
 an empty wrapper cache. `.mvn/maven.config` requires strict transfer checksums.
 These checks detect corruption against the recorded hash; checksums fetched from
@@ -71,7 +75,8 @@ evidence. CI retains reports alongside test results.
 
 The old Site/Reflow/Velocity/Doxia, FindBugs, PMD, JXR and report-only bindings
 were dormant. Unique core/JSP examples moved to [docs/usage.md](docs/usage.md).
-README/module docs and attached source/Javadoc JARs remain supported. Build-bound
+The unused module `src/site` trees have been removed. README/module guides
+and attached source/Javadoc JARs remain supported. Build-bound
 Checkstyle/JaCoCo, Surefire XML, CodeQL and dependency submission replace useful
 reports. Maven's implicit Site plugin is pinned to 3.22.0 and skipped to prevent
 falling back to an old lifecycle default; `mvn site` is not a publishing path.

@@ -4,11 +4,13 @@ Released entries are grounded in the linked immutable tags, GitHub release notes
 and retained README announcements. Dates below are GitHub publication dates in
 UTC where a release record exists; older announcement/tag dates are labeled.
 An open proposal is not a release. Historical tags, assets and signatures remain
-unchanged. [1.5.1 is available from Central](releases/1.5.1-central-publication.md).
+unchanged. [1.6.0 is available from Central](releases/1.6.0-central-publication.md).
 
 ## Unreleased
 
-No changes yet.
+- Remove retired Maven Site sources and archive September maintenance records.
+- Refresh build/dependency documentation and clarify the 1.6.0 review record.
+  Encoding behavior, public APIs, and published artifacts are unchanged.
 
 ## 1.6.0 — 2026-10-18 UTC
 
@@ -110,7 +112,7 @@ Signed artifact availability and independent verification are tracked in the
   work (#111) are recorded in the [publication follow-up](releases/1.4.1-central-publication.md).
 
 The [maintenance tracker](https://github.com/OWASP/owasp-java-encoder/issues/169)
-and [closeout record](releases/maintenance-closeout.md) record the corresponding
+and [closeout record](docs/archive/maintenance-2026-09/maintenance-closeout.md) record the corresponding
 PRs, tests and dispositions; they are not approval to publish 1.5.
 
 ## 1.4.1 — 2026-09-26 UTC

@@ -24,6 +24,42 @@ current. The key's public fingerprint is:
 The public key is in [KEYS](KEYS). This is a shared project signing identity;
 custody of it does not grant permission to publish Maven coordinates.
 
+## Latest recorded custody and publishing status
+
+The latest custody and rehearsal confirmations remain those reported on
+2026-09-26 below; this cleanup does not assert that new recovery drills ran.
+The [1.6.0 publication record](releases/1.6.0-central-publication.md) documents
+Jim's subsequent successful Central publication on 2026-10-18.
+
+### Central publication follow-up: 2026-09-26 (America/Los_Angeles)
+
+Jim's signed-in Portal account now shows the verified `org.owasp.encoder`
+namespace in the Owasp organization. The exact retained signed 1.4.1 bundle was
+validated and published as deployment `ce91e36f-756c-489f-bbea-3629b728ad28`.
+All 17 POM/JAR files and their 17 signatures downloaded from Central matched
+the retained release byte for byte. See the [publication record](releases/1.4.1-central-publication.md).
+
+This supersedes the earlier namespace-access and pending-publication status
+for Jim and 1.4.1.
+
+Jim also confirmed on 2026-09-26 (America/Los_Angeles) that he and Jeremy both
+completed the independent vault-recovery drills, namespace-access checks, and
+separate validated-and-dropped Central staging rehearsals that day. This is
+maintainer-reported completion; the individual private recovery records and
+rehearsal deployment IDs were not supplied or independently inspected in this
+publication session. Keep those operational records in each custodian's vault.
+
+| Custodian | Independent vault-recovery drill | Namespace access | Separate validated-and-dropped rehearsal |
+| --- | --- | --- | --- |
+| Jim Manico | Completed 2026-09-26, reported by Jim | Verified directly by 1.4.1 publication | Completed 2026-09-26, reported by Jim |
+| Jeremy Long | Completed 2026-09-26, reported by Jim | Confirmed 2026-09-26, reported by Jim | Completed 2026-09-26, reported by Jim |
+
+Together with the publication verification and reconciled consumer notices,
+this records completion of #111 on the stated evidence. Earlier observations
+are retained in the [historical status record](docs/archive/maintenance-2026-09/maintainer-status.md).
+Future recovery drills and release rehearsals follow the procedures below and
+[RELEASING.md](RELEASING.md).
+
 ## Independent recovery copies
 
 Each custodian's vault must contain a complete recovery set:
@@ -127,74 +163,3 @@ coordinate with the OWASP Foundation and Central Support to establish project
 ownership and restore namespace access; that process cannot recover a lost
 private key. If neither independent key copy is recoverable, arrange a new
 project key and publish the new fingerprint before signing any future release.
-
-## Recorded status: 2026-09-25
-
-The encrypted local backup was successfully imported and used to sign and verify
-a challenge in an isolated temporary keyring; that keyring was then removed.
-The local release and recovery directories were checked as owner-only (`0700`).
-These observations do not confirm the individual vault copies:
-
-| Custodian | Import into own vault | Drill from own vault copy | Central access and staging rehearsal |
-| --- | --- | --- | --- |
-| Jim Manico | Unconfirmed | Unconfirmed | Portal showed no namespaces and disabled publishing; validated-and-dropped rehearsal unconfirmed |
-| Jeremy Long | Unconfirmed | Unconfirmed | Current namespace access and validated-and-dropped rehearsal unconfirmed |
-
-Central Support has acknowledged the existing access request. Continue that
-request rather than opening a duplicate. The exact `encoder` 1.4.1 POM still
-returned HTTP 404 from Maven Central at this check. Retain the pending notices
-and the existing signed 1.4.1 bundle until publication is verified; do not rebuild
-or replace those artifacts or move their tag.
-
-### Batch 00 follow-up: 2026-09-25 (America/Los_Angeles)
-
-Jim confirmed initial key setup on this date. This confirms setup only; retrieval
-from his own vault, the isolated recovery drill, and a validated-and-dropped
-Central staging rehearsal remain unconfirmed. No new independent confirmation
-was received from Jeremy.
-
-The signed-in Central Portal account displayed `JIM MANICO`, **No Namespace(s)
-Found**, and a disabled **Publish Component** button. All five exact 1.4.1 POM
-URLs (the four libraries and parent) returned HTTP 404, and core metadata still
-listed 1.4.0. Publication and Jim's staging rehearsal remain blocked on namespace
-access; Jeremy's access remains unconfirmed. Continue the existing Support
-request. No new request or deployment was created.
-
-The retained public GitHub bundle, all artifact signatures, and signed checksum
-manifests were verified; see [batch 00 validation](releases/batch-00-validation.md).
-Verification of public artifacts is separate from private-key recovery and
-publisher access.
-
-Update this dated record only from each custodian's confirmation and actual
-publishing evidence. [#111](https://github.com/OWASP/owasp-java-encoder/issues/111)
-owns the remaining independent vault recovery, namespace access, publication,
-and staging checks. [#95](https://github.com/OWASP/owasp-java-encoder/issues/95)
-owns future release-tooling changes.
-
-### Central publication follow-up: 2026-09-26 (America/Los_Angeles)
-
-Jim's signed-in Portal account now shows the verified `org.owasp.encoder`
-namespace in the Owasp organization. The exact retained signed 1.4.1 bundle was
-validated and published as deployment `ce91e36f-756c-489f-bbea-3629b728ad28`.
-All 17 POM/JAR files and their 17 signatures downloaded from Central matched
-the retained release byte for byte. See the [publication record](releases/1.4.1-central-publication.md).
-
-This supersedes the earlier namespace-access and pending-publication status
-for Jim and 1.4.1.
-
-Jim also confirmed on 2026-09-26 (America/Los_Angeles) that he and Jeremy both
-completed the independent vault-recovery drills, namespace-access checks, and
-separate validated-and-dropped Central staging rehearsals that day. This is
-maintainer-reported completion; the individual private recovery records and
-rehearsal deployment IDs were not supplied or independently inspected in this
-publication session. Keep those operational records in each custodian's vault.
-
-| Custodian | Independent vault-recovery drill | Namespace access | Separate validated-and-dropped rehearsal |
-| --- | --- | --- | --- |
-| Jim Manico | Completed 2026-09-26, reported by Jim | Verified directly by 1.4.1 publication | Completed 2026-09-26, reported by Jim |
-| Jeremy Long | Completed 2026-09-26, reported by Jim | Confirmed 2026-09-26, reported by Jim | Completed 2026-09-26, reported by Jim |
-
-Together with the publication verification and reconciled consumer notices,
-this records completion of #111 on the stated evidence. The earlier dated
-records remain as history. Future recovery drills and release rehearsals still
-follow the procedures above; the 1.5 release gate remains unchanged.
@@ -10,7 +10,7 @@ this gate on its own. Keep current development at `1.6.1-SNAPSHOT` until maintai
 deliberately create the exact release commit after the technical gates pass.
 Changing that commit to a release version is release preparation, not release approval.
 
-The [2026-09-26 maintenance closeout](releases/maintenance-closeout.md) records
+The [2026-09-26 maintenance closeout](docs/archive/maintenance-2026-09/maintenance-closeout.md) records
 the final backlog inventory and dispositions for #110 and #169. A closed tracker
 does not waive this gate: repeat the complete open-issue/PR inventory when a new
 release is actually proposed and obtain release approval then.
@@ -224,9 +224,11 @@ are verified separately from the deterministic unsigned payload. Never rebuild o
 replace the retained 1.4.1 release to retrofit reproducibility.
 
 The publisher's isolated dependencies override Jackson core/databind 2.22.3 and
-annotations 2.22, HttpClient 5.6.4 and HttpCore/httpcore5-h2 5.4.4. The upstream
-0.11.0 dependency versions matched current OSV advisories; these six reviewed
-replacement coordinates did not on 2026-09-26. Local signed bundle validation
+annotations 2.22, HttpClient 5.6.5 and HttpCore/httpcore5-h2 5.4.4. The upstream
+0.11.0 dependency versions matched OSV advisories in the dated
+[September validation](docs/archive/maintenance-2026-09/batch-04-validation.md#release-plugin-dependency-follow-up-187).
+That check used HttpClient 5.6.4; the current 5.6.5 pin arrived later and is not
+covered by that historical advisory result. Local signed bundle validation
 exercises the overridden plugin. This is not an audit of every plugin dependency
 or a claim that the plugin's live Central HTTP path has been tested. Jim's Portal
 namespace access and exact 1.4.1 publication are now [verified](releases/1.4.1-central-publication.md).