schema-version: 0.1.0
standard:
  schema-version: 0.1.0
  sequence: 231
  standard_id: REL-003-JAVA
  title: Java Patch Version Naming
  summary: Java patched releases use a version naming profile that optimizes Maven,
    Gradle, repository-manager, dependency-update, SCA, feed, and policy-tool behavior
    for the affected upstream version line.
  extends: REL-003
  doc-status: Ratified
  standard-version: 0.1.0
  candidate-pack: OSERA-SP-0.1.0 ratified
  ratified-in: OSERA-SP-0.1.0
  ratified-date: '2026-09-10'
  fitness-role: Required Java profile check
  type: REL
  category: Release Process
  applies-to:
  - Java package patch providers
  - Enterprise Java recipients
  - Java repository and dependency tooling
  requirements:
  - id: REL-003-JAVA.REQ-001
    override-explanation: Specializes the generic applicable-profile rule with a Java-specific
      version convention. The CARE-style convention uses the OSERA identifier; the
      parent obligations to identify the latest applicable remediation on the same
      upstream line and preserve baseline and OSERA identity remain.
    level: MUST
    text: Official OSERA Java patched releases must use the ratified Java patch CARE-style
      version naming convention with the OSERA identifier, so supported Java resolver,
      dependency update, repository manager, SCA, feed, and policy tooling treats
      the patched artifact as the latest applicable remediation on the same upstream
      version line.
    checkability: partially-automated
    checks:
    - id: REL-003-JAVA.CHECK-001
      override-explanation: Replaces generic profile-selection evidence with Java
        profile-decision, resolver, and dependency-update compatibility evidence.
        The parent consumer outcome remains the acceptance criterion; the naming convention
        is the CARE-style OSERA form described below.
      title: Java patch version pattern passes supported tooling compatibility tests
      type: release
      severity: blocking
      implementation: osera-fitness.rel003_java.version_pattern_compatibility
      evidence:
      - release_tag
      - artifact_version
      - java_profile_decision
      - resolver_test_result
      - dependency_update_test_result
  - id: REL-003-JAVA.REQ-002
    override-explanation: Specializes the parent identifier-consistency obligation
      for Java artifacts by explicitly including Maven package URLs. The same patched-release
      identity must still connect source tags, artifacts, feeds, and evidence.
    level: MUST
    text: Java release tags, artifact versions, Maven package URLs, vulnerability
      feeds, and release evidence must carry the same Java patch version identifier.
    checkability: automated
    checks:
    - id: REL-003-JAVA.CHECK-002
      override-explanation: Uses Maven package URL evidence for the parent consistency
        check while retaining release-tag, artifact-version, and feed identity matching.
      title: Java release identifier is consistent across source, artifact, and feeds
      type: release
      severity: blocking
      implementation: osera-fitness.rel003_java.identifier_consistency
      evidence:
      - release_tag
      - artifact_version
      - maven_purl
      - feed_purl
  source_path: docs/_standards/rel-003-java-patch-version-naming.md
  url: "/standards/rel-003-java-patch-version-naming/"
  parent_relationship:
    parent_standard: REL-003
    parent_version: 0.1.0
    requirements:
    - parent_item: REL-003.REQ-001
      treatment: Overrides
      effective_item: REL-003-JAVA.REQ-001
      explanation: Specializes the generic applicable-profile rule with a Java-specific
        version convention. The CARE-style convention uses the OSERA identifier; the
        parent obligations to identify the latest applicable remediation on the same
        upstream line and preserve baseline and OSERA identity remain.
    - parent_item: REL-003.REQ-002
      treatment: Overrides
      effective_item: REL-003-JAVA.REQ-002
      explanation: Specializes the parent identifier-consistency obligation for Java
        artifacts by explicitly including Maven package URLs. The same patched-release
        identity must still connect source tags, artifacts, feeds, and evidence.
    checks:
    - parent_item: REL-003.CHECK-001
      treatment: Overrides
      effective_item: REL-003-JAVA.CHECK-001
      explanation: Replaces generic profile-selection evidence with Java profile-decision,
        resolver, and dependency-update compatibility evidence. The parent consumer
        outcome remains the acceptance criterion; the naming convention is the CARE-style
        OSERA form described below.
    - parent_item: REL-003.CHECK-002
      treatment: Overrides
      effective_item: REL-003-JAVA.CHECK-002
      explanation: Uses Maven package URL evidence for the parent consistency check
        while retaining release-tag, artifact-version, and feed identity matching.