{
  "schema-version": "0.1.0",
  "standard": {
    "schema-version": "0.1.0",
    "sequence": 231,
    "standard_id": "REL-003-JAVA",
    "title": "Java Patch Version Naming",
    "summary": "Java patched releases use a version naming profile that optimizes Maven, Gradle, repository-manager, dependency-update, SCA, feed, and policy-tool behavior for the affected upstream version line.",
    "extends": "REL-003",
    "doc-status": "Ratified",
    "standard-version": "0.1.0",
    "candidate-pack": "OSERA-SP-0.1.0 ratified",
    "ratified-in": "OSERA-SP-0.1.0",
    "ratified-date": "2026-09-10",
    "fitness-role": "Required Java profile check",
    "type": "REL",
    "category": "Release Process",
    "applies-to": [
      "Java package patch providers",
      "Enterprise Java recipients",
      "Java repository and dependency tooling"
    ],
    "requirements": [
      {
        "id": "REL-003-JAVA.REQ-001",
        "override-explanation": "Specializes the generic applicable-profile rule with a Java-specific version convention. The CARE-style convention uses the OSERA identifier; the parent obligations to identify the latest applicable remediation on the same upstream line and preserve baseline and OSERA identity remain.",
        "level": "MUST",
        "text": "Official OSERA Java patched releases must use the ratified Java patch CARE-style version naming convention with the OSERA identifier, so supported Java resolver, dependency update, repository manager, SCA, feed, and policy tooling treats the patched artifact as the latest applicable remediation on the same upstream version line.",
        "checkability": "partially-automated",
        "checks": [
          {
            "id": "REL-003-JAVA.CHECK-001",
            "override-explanation": "Replaces generic profile-selection evidence with Java profile-decision, resolver, and dependency-update compatibility evidence. The parent consumer outcome remains the acceptance criterion; the naming convention is the CARE-style OSERA form described below.",
            "title": "Java patch version pattern passes supported tooling compatibility tests",
            "type": "release",
            "severity": "blocking",
            "implementation": "osera-fitness.rel003_java.version_pattern_compatibility",
            "evidence": [
              "release_tag",
              "artifact_version",
              "java_profile_decision",
              "resolver_test_result",
              "dependency_update_test_result"
            ]
          }
        ]
      },
      {
        "id": "REL-003-JAVA.REQ-002",
        "override-explanation": "Specializes the parent identifier-consistency obligation for Java artifacts by explicitly including Maven package URLs. The same patched-release identity must still connect source tags, artifacts, feeds, and evidence.",
        "level": "MUST",
        "text": "Java release tags, artifact versions, Maven package URLs, vulnerability feeds, and release evidence must carry the same Java patch version identifier.",
        "checkability": "automated",
        "checks": [
          {
            "id": "REL-003-JAVA.CHECK-002",
            "override-explanation": "Uses Maven package URL evidence for the parent consistency check while retaining release-tag, artifact-version, and feed identity matching.",
            "title": "Java release identifier is consistent across source, artifact, and feeds",
            "type": "release",
            "severity": "blocking",
            "implementation": "osera-fitness.rel003_java.identifier_consistency",
            "evidence": [
              "release_tag",
              "artifact_version",
              "maven_purl",
              "feed_purl"
            ]
          }
        ]
      }
    ],
    "source_path": "docs/_standards/rel-003-java-patch-version-naming.md",
    "url": "/standards/rel-003-java-patch-version-naming/",
    "parent_relationship": {
      "parent_standard": "REL-003",
      "parent_version": "0.1.0",
      "requirements": [
        {
          "parent_item": "REL-003.REQ-001",
          "treatment": "Overrides",
          "effective_item": "REL-003-JAVA.REQ-001",
          "explanation": "Specializes the generic applicable-profile rule with a Java-specific version convention. The CARE-style convention uses the OSERA identifier; the parent obligations to identify the latest applicable remediation on the same upstream line and preserve baseline and OSERA identity remain."
        },
        {
          "parent_item": "REL-003.REQ-002",
          "treatment": "Overrides",
          "effective_item": "REL-003-JAVA.REQ-002",
          "explanation": "Specializes the parent identifier-consistency obligation for Java artifacts by explicitly including Maven package URLs. The same patched-release identity must still connect source tags, artifacts, feeds, and evidence."
        }
      ],
      "checks": [
        {
          "parent_item": "REL-003.CHECK-001",
          "treatment": "Overrides",
          "effective_item": "REL-003-JAVA.CHECK-001",
          "explanation": "Replaces generic profile-selection evidence with Java profile-decision, resolver, and dependency-update compatibility evidence. The parent consumer outcome remains the acceptance criterion; the naming convention is the CARE-style OSERA form described below."
        },
        {
          "parent_item": "REL-003.CHECK-002",
          "treatment": "Overrides",
          "effective_item": "REL-003-JAVA.CHECK-002",
          "explanation": "Uses Maven package URL evidence for the parent consistency check while retaining release-tag, artifact-version, and feed identity matching."
        }
      ]
    }
  }
}