[johnnyt]

Refs: uxjv-578

The release prep for systems.riddler:uxid 1.0.0, the package's first release on Maven Central. Nothing here tags, signs or publishes: once this is merged, the tag v1.0.0 at the merged commit runs .github/workflows/release.yml, which publishes.

Commits

• Stops printing the Maven settings file in the release workflow: the publish job's settings step writes the file and no longer cats it. The file holds only two ${env.NAME} references, but the job that carries the credentials has no reason to print a file that names them.
• Says to wait for repo1 before re-running the publish job alone: the header's re-run paragraph now says that a deployment the Portal reports published is waited for at repo1.maven.org (the version's POM answering 200) before re-running publish alone, because repo1 can lag the Portal and a re-run inside that window finds the version not listed and uploads again.
• Names a Portal validation failure among the commit-caused failures: the header's list of failures the tagged commit itself causes now includes a deployment the Portal fails on validation because of the commit (the POM's metadata, a file the build does not produce), which fails the same way on every re-run.
• Prepares the 1.0.0 release: pom.xml's own <version> moves from 0.1.0-SNAPSHOT to 1.0.0; CHANGELOG.md replaces the Unreleased note with a ## 1.0.0 - 2026-10-21 section; the fragments changelog.d/uxjv-5tk.md, uxjv-94x.md, uxjv-iq8.md and uxjv-nyt.md are promoted into its ### Added list in file-name order, their bullets unchanged, and deleted in the same commit.
• States what version 1.0.0 is in the agent instructions: CLAUDE.md no longer calls 1.0.0 a target the repository is being built into; it says pom.xml states 1.0.0 and the release workflow publishes it when the tag v1.0.0 is pushed.

The 1.0.0 section

Its opening paragraph names the coordinate, the module and exported package systems.riddler.uxid, the Java 17 floor, the absence of runtime dependencies, the scope (time-based and deterministic generation, decoding, the validity checks, the monotonic generator and the generation refusals) and the corpus tag v2.10.0 with conformance/SOURCE.json. Every public type and member it names was read from javap -public on the built uxid-1.0.0.jar and from the type pages in the built javadoc jar, not from the fragments: Uxid, UxidOptions and UxidOptions.Builder (its methods prefix, size, randSize, compactTime, letterCase, delimiter, time, rand, byteSource, from), Size, LetterCase, ByteSource, DecodeOptions and DecodeOptions.Builder (delimiter, clock), the sealed DecodeResult with DecodeResult.Decoded (prefix(), size(), compact(), deterministic(), time()) and DecodeResult.Invalid (reason()), InvalidReason, Monotonic (both constructors, generate(), generate(UxidOptions)), DrawSource (seed, step), UxidException (code()) and ErrorCode. A script matched every backticked API name in the file against the javap output; the only names it did not find there are the JDK types SecureRandom and IllegalArgumentException and the id marker Z.

The release jars

Built with mvn -B -ntp -DskipTests clean package on the mise.toml JDK (Temurin 25.0.4) and Maven 3.9.16:

• uxid-1.0.0.jar (module systems.riddler.uxid@1.0.0, exports systems.riddler.uxid, requires only java.base; manifest Java-Version: 17)
• uxid-1.0.0-sources.jar
• uxid-1.0.0-javadoc.jar

Two clean builds gave byte-identical files (SHA-256 compared), and mvn -DskipTests clean verify, the phases the publish job's clean deploy runs before signing, gave the same three sums. project.build.outputTimestamp stays 2026-10-21T00:00:00Z, which is already the release date. The POM inside the jar is byte-identical to pom.xml, the file the publishing plugin uploads: name uxid, a description, url https://github.com/riddler/uxid-java, the MIT License, a developer, scm, issue management on GitHub Issues, version 1.0.0, and one dependency, junit-jupiter in test scope.

Gate and checks

mise run gate green on the release commit's tree before that commit (192 tests, no skips, the corpus runner and hash check included, JaCoCo check met, the javadoc and sources jars built with the javadoc lint at all); the commit staged the byte-identical tree. The workflow and CLAUDE.md commits touch no gated path. The README's Maven and Gradle lines already named 1.0.0 on main, so it is unchanged. No test is added or changed.