Production Capstone: Build, Test, Secure, Publish, and Optimize a Multi-Module JVM Platform: Final Operational Review and Handoff

1. Final checkpoint scenario

You are handing Orbit to another build/release team. They must be able to reproduce the accepted build, understand dependency and repository policy, locate test evidence, verify the published artifact, promote without rebuilding, diagnose common failures, consume the library from Maven, and remove every disposable state directory without touching normal user caches.

The handoff is accepted only when the evidence package can answer “what source?”, “what tools?”, “what dependencies?”, “what tests?”, “what bytes?”, “what repository?”, “what cache trust?”, “what promotion?”, and “what recovery procedure?” without relying on institutional memory.

2. Final preflight and environment record

Capture tool identity before the final run:

mkdir -p evidence/final
java -version 2>&1 | tee evidence/final/java-version.txt
javac -version 2>&1 | tee evidence/final/javac-version.txt
./gradlew -version | tee evidence/final/gradle-version.txt
sha256sum gradle/wrapper/gradle-wrapper.jar | tee evidence/final/gradle-wrapper-jar.sha256
cat gradle/wrapper/gradle-wrapper.properties > evidence/final/gradle-wrapper.properties

git status --short 2>/dev/null | tee evidence/final/git-status.txt || true

If Maven consumer verification is part of this execution environment, also capture ./mvnw -version from maven-consumer. If Maven is unavailable, mark I-11 environment-specific rather than fabricating success.

3. Prove at least six critical invariants independently

The prompt minimum is six; a production-style handoff should attempt all eleven:

4. Run the final build/test/package evidence gate

Use a project-local user home and preserve outputs:

export GRADLE_USER_HOME="$PWD/.final-gradle"
./gradlew clean check --info | tee evidence/final/clean-check.log
./gradlew :core:dependencyInsight \
  --dependency org.apache.commons:commons-lang3 \
  --configuration runtimeClasspath \
  | tee evidence/final/core-dependency-insight.txt

find core/build/test-results app/build/test-results -name 'TEST-*.xml' -print \
  | sort | tee evidence/final/test-report-files.txt
javap -verbose core/build/classes/java/main/dev/academy/capstone/MessageNormalizer.class \
  | grep 'major version' | tee evidence/final/core-bytecode.txt

A green exit code is insufficient if test-report-files.txt lacks the integration suite or if bytecode/tool identity is wrong.

5. Final publication and immutable promotion review

Rebuild the candidate only in the build/stage lane, capture the accepted checksum, and then promote by copy:

rm -rf staging-repo release-repo
./gradlew :platform:publishPlatformPublicationToStagingRepository \
          :core:publishCorePublicationToStagingRepository
stage="staging-repo/dev/academy/capstone/core/1.0.0/core-1.0.0.jar"
sha256sum "$stage" | tee evidence/final/staged-core.sha256

mkdir -p release-repo/dev/academy
cp -a staging-repo/dev/academy/capstone release-repo/dev/academy/
release="release-repo/dev/academy/capstone/core/1.0.0/core-1.0.0.jar"
sha256sum "$release" | tee evidence/final/release-core.sha256

test "$(sha256sum "$stage" | awk '{print $1}')" = \
     "$(sha256sum "$release" | awk '{print $1}')"

Inspect the published POM and module metadata and retain them with the evidence package. In a real repository manager, staging/promotion APIs replace filesystem copy, but the invariant remains: promotion changes repository state/visibility, not artifact bytes.

6. Close at least four controlled failure drills

Complete one drill from each required domain and optionally the cache/credential additions:

7. Assemble the handoff package

Create a folder that contains human-readable policy plus machine evidence. A useful minimum:

handoff/
  architecture.md                 # compound diagrams + arrow explanations
  versions-toolchains.md          # Gradle/JDK/Java/Maven baseline and upgrade rule
  dependency-governance.md        # platform/catalog/locks/verification/repository policy
  build-test-commands.md          # clean build, unit/integration, report locations
  cache-policy.md                 # allowed state, keys, writers/readers, clean-room exception
  publication-promotion.md        # coordinates, staging/release, exact-byte rule
  ci-contract.yaml                # provider-neutral ephemeral-agent contract
  troubleshooting-runbook.md      # diagnostic sequence + drills
  upgrade-migration-notes.md      # Gradle/Maven/JDK/plugin/dependency compatibility policy
  risk-register.md                # residual risks, owner, next action
  cleanup.md                      # only disposable state
  evidence/
    source-files.sha256
    wrapper-and-jdk/
    dependency-and-verification/
    test-reports/
    artifact-checksums/
    publication-metadata/
    performance-baseline/
    failure-drills/

The handoff package is not another cache. It contains policy and evidence sufficient to reproduce or audit the build; large disposable dependency/build caches can be deleted.

8. Operational runbook: normal build, release, and incident paths

9. Upgrade and mixed-estate policy

Upgrade one axis at a time when practical: Wrapper/Gradle, build-runtime JDK, Java target, dependencies, testing stack, publication metadata, and Maven consumer baseline. Record compatibility/deprecation evidence and keep rollback artifacts until acceptance.

Maven 3.9.16 remains the production consumer baseline at generation time. Maven 4.0.0-rc-6 is pre-GA and therefore belongs in an optional compatibility lane, not the release gate. The Maven boundary should continue to consume the published contract; do not introduce a second full build unless there is an explicit ownership/release reason.

10. Residual risk register

11. Production-readiness decision

Decision framework: Orbit’s build-engineering model is ready for handoff when the executed environment independently proves the required invariants and closes the required failure drills. This demonstrates controlled tool identity, Java compatibility, dependency governance, intended tests, clean-room behavior, artifact traceability, immutable local promotion, and the Maven consumer boundary.

Not automatically production-ready: hosted repository authentication, signing-key custody, remote-cache transport, CI-provider isolation/secrets, vulnerability management, organization-specific approvals, and cross-OS agent matrices remain environment-specific integrations. They must be marked as residual risks with owners and validation plans rather than silently inferred from the local lab.

12. Complete cleanup without touching normal caches

Preserve the handoff/evidence package first. Then delete only disposable capstone state:

rm -rf .lab-gradle .final-gradle .drill-gradle-fresh
rm -rf core/build app/build platform/build build
rm -rf maven-consumer/.m2-clean
rm -rf staging-repo release-repo
# From the parent directory, remove clean-room copies only after evidence is preserved:
# rm -rf orbit-clean-a orbit-clean-b

# Never use this capstone as a reason to delete normal ~/.gradle or ~/.m2.

If the workspace itself is disposable and the handoff package has been copied to an approved location, remove the entire workspace according to local policy.

13. What the completed course operating model now contains

The course has progressed from JVM/build fundamentals through Maven and Gradle models, dependency governance, testing, publishing, caches, performance, security, CI, migration, and finally an evidence-backed operating model. The transferable skill is not memorizing two CLIs. It is reasoning from declared model → resolved graph → execution plan → filesystem/repository state → artifact/evidence identity, then applying the least destructive correction when those layers disagree.

Knowledge check

Official references and version notes

• Gradle 9.7.1 release notes — pinned Gradle baseline for the capstone.
• Gradle Wrapper and release checksums — wrapper/distribution identity and integrity.
• Gradle JVM toolchains — build JVM versus compiler/test launchers.
• Dependency verification — checksum/signature verification metadata and review workflow.
• Repository declarations and content filtering — dependency origin controls.
• Java testing and JVM Test Suite — unit/integration verification model.
• Maven Publish — Gradle publication to Maven repository layout and clean Maven consumption.
• Build Cache and Configuration Cache — bounded build-state reuse.
• Gradle performance guidance — measurement-first optimization and profiling.
• Apache Maven release history — Maven 3.9.16 GA consumer baseline; Maven 4.0.0-rc-6 remains pre-GA.
• Apache Maven Wrapper 3.3.4 — stable Maven Wrapper baseline.
• Maven Compiler Plugin 3.15.0 — clean Maven consumer compilation baseline.
• JUnit 6.1.3 — Java 17+ test runtime baseline.
• Apache Commons Lang release notes — Commons Lang 3.20.0 dependency baseline.

Version-sensitive statements were rechecked against primary documentation on 2026-08-24. Mandatory work remains local/free. Hosted CI, commercial build analytics, production repository managers, remote caches, and real signing/credential systems are optional integration boundaries only.