FLPATH-5076: Enforce dynamic abstention and profile guards

.github/workflows/ci.yml

@@ -0,0 +1,64 @@
+name: Java CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  adapter-tests:
+    name: Adapter tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+
+      - name: Run adapter tests
+        run: make adapter-test
+
+      - name: Validate spike contracts
+        run: make spike-validate
+
+  java-lint:
+    name: Java lint gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Java 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+
+      - name: Run Java lint gate
+        run: make java-lint
+
+      - name: Upload Java lint reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: java-lint-reports
+          path: |
+            target/pmd.xml
+            target/cpd.xml
+            target/java-lint/
+            target/java-lint-effective-pom.xml
+          if-no-files-found: warn
+          retention-days: 7

.gitignore

@@ -1,5 +1,6 @@
 # Java/Maven build output
 /target/
+tools/java-lint-maven-plugin/target/
 
 # FLPATH-5000 disposable analysis output
 spike/runs/

Makefile

@@ -1,4 +1,4 @@
-.PHONY: test package adapter-test adapter-package manual-analysis spike-validate framework-enrichment semantic-facts-spike fixture-test fixture-package spring-test download-jdtls jdtls-probe sootup-quarkus sootup-quarkus-full sootup-spring sootup-fsi codeql-quarkus codeql-spring codeql-fsi normalize-static-analysis
+.PHONY: test package adapter-test adapter-package java-lint java-lint-report java-lint-test manual-analysis spike-validate framework-enrichment semantic-facts-spike fixture-test fixture-package spring-test download-jdtls jdtls-probe sootup-quarkus sootup-quarkus-full sootup-spring sootup-fsi codeql-quarkus codeql-spring codeql-fsi normalize-static-analysis
 
 adapter-test test:
 	MAVEN_BIN="$$(bash spike/scripts/bootstrap-maven.sh)" && "$${MAVEN_BIN}" -B -ntp test -f pom.xml
@@ -15,6 +15,24 @@ manual-analysis:
 adapter-package package:
 	MAVEN_BIN="$$(bash spike/scripts/bootstrap-maven.sh)" && "$${MAVEN_BIN}" -B -ntp package -DskipTests -f pom.xml
 
+java-lint-test:
+	MAVEN_BIN="$$(bash spike/scripts/bootstrap-maven.sh)" && \
+	"$${MAVEN_BIN}" -B -ntp test -f tools/java-lint-maven-plugin/pom.xml
+
+java-lint: java-lint-test
+	MAVEN_BIN="$$(bash spike/scripts/bootstrap-maven.sh)" && \
+	"$${MAVEN_BIN}" -B -ntp install -DskipTests -f tools/java-lint-maven-plugin/pom.xml && \
+	"$${MAVEN_BIN}" -B -ntp help:effective-pom -Doutput=target/java-lint-effective-pom.xml -f pom.xml && \
+	"$${MAVEN_BIN}" -B -ntp pmd:pmd pmd:cpd -f pom.xml && \
+	"$${MAVEN_BIN}" -B -ntp org.projectlightpath:java-lint-maven-plugin:0.1.0:validate -DjavaLint.enforce=true -f pom.xml
+
+java-lint-report:
+	MAVEN_BIN="$$(bash spike/scripts/bootstrap-maven.sh)" && \
+	"$${MAVEN_BIN}" -B -ntp install -DskipTests -f tools/java-lint-maven-plugin/pom.xml && \
+	"$${MAVEN_BIN}" -B -ntp help:effective-pom -Doutput=target/java-lint-effective-pom.xml -f pom.xml && \
+	"$${MAVEN_BIN}" -B -ntp pmd:pmd pmd:cpd -f pom.xml && \
+	"$${MAVEN_BIN}" -B -ntp org.projectlightpath:java-lint-maven-plugin:0.1.0:validate -DjavaLint.enforce=false -f pom.xml
+
 spike-validate:
 	python3 spike/scripts/validate_spike.py
 

README.md

@@ -24,11 +24,27 @@ make package
 ```
 
 The `Adapter tests` CI lane runs `make adapter-test` and `make spike-validate`
-on pull requests and pushes to `main`.
+on pull requests and pushes to `main`. The separate `Java lint` CI lane runs
+the enforced production-quality gate with `make java-lint` and uploads the
+PMD/CPD reports as workflow artifacts, including when the gate fails.
 
 See [`docs/flpath-5002-java-adapter.md`](docs/flpath-5002-java-adapter.md) for
 the implementation boundary.
 
+Run the enforced Java quality gate with:
+
+```sh
+make java-lint
+```
+
+It runs the pinned PMD/CPD configuration against production Java sources,
+compares normalized findings and the effective Maven CPD configuration with
+[`config/java-lint-baseline.json`](config/java-lint-baseline.json), and fails
+on new findings, changed lint configuration, or partial PMD/CPD reports. For
+exploratory reports without enforcement, use `make java-lint-report`. See
+[`docs/java-lint.md`](docs/java-lint.md) for the rule rationale, baseline,
+limitations, and review process.
+
 ## FLPATH-5000 spike and findings
 
 The [`spike/`](spike/) directory contains the Java 21/Quarkus fixture, pinned