ci(governance): allow Java in android/**/src/**/*.java (platform-required JVM shims)

[hyperpolymath]

Why

Android instantiates Service / BroadcastReceiver / AppWidgetProvider / Activity subclasses by class name at platform boundaries. The JVM classloader demands bytecode implementing those superclasses — Rust / Zig cannot satisfy this contract directly. Consumers writing mobile apps via Gossamer (or any webview shell) need a minimal Java shim surface that delegates immediately to native (JNI / Zig-FFI) code.

Triggered by neurophone#97 (Kotlin → Gossamer migration RFC). Without this carve-out the migration cannot land cleanly.

What changes

One block in governance-reusable.yml (the language-policy job's Java/Kotlin check). Tight regex (^|/)android/.*/src/.*\.java$; Kotlin (.kt, .kts) remains banned outright.

Properties

• Tight scope. Only Java files inside an Android source tree.
• Kotlin still fully banned.
• Shim discipline. Each carve-out Java file is a minimal delegating wrapper that JNIs into Rust/Zig immediately. No business logic.
• Matches existing layouts. Gossamer upstream's own gossamer/android/src/main/java/io/gossamer/... qualifies; neurophone's android/app/src/main/java/ai/neurophone/... qualifies.

Negative-space checks

• Random Foo.java at repo root → blocked.
• not-android/.../src/.../Foo.java → blocked.
• android/Foo.java without src/ → blocked.
• android/.../src/.../Foo.kt → blocked (Kotlin still in the ban list above the grep).

Fan-out after merge

• 6 consumers pin @main → auto-consume (incl. neurophone itself).
• 228 consumers pin SHA 861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613 → SHA-bump fan-out needed; coordinate via R5b campaign script.

Companion change

Separate neurophone PR will delete neurophone's local Check for Java/Kotlin files step (sub-PR #2 path 2B per the RFC) and rely on this estate-wide reusable as single source of truth.

Out of scope

• Standards CLAUDE.md "Mobile Development" still lists "Tauri 2.0+" — estate pivoted to Gossamer per neurophone#97. Separate doc-update PR.
• Java/Kotlin BANNED row in CLAUDE.md could note the carve-out — separate PR.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 201 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	94

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action for the check script)\n        uses: actions/checkout@de0f needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-verify.yml",
    "type": "missing_timeout_minutes",
    "file": "affinescript-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "missing_timeout_minutes",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in changelog-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "changelog-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "missing_timeout_minutes",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno-ci-reusable.yml",
    "type": "missing_timeout_minutes",
    "file": "deno-ci-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

[hyperpolymath]

Closing — the carve-out is already achievable via the existing .hypatia-baseline.json mechanism in this reusable (governance-reusable.yml:91-260 + is_exempt():292-305 + in_baseline():260-285).

Discovered after opening this PR: neurophone#105 (merged 2026-06-02T10:49:37Z) already added .hypatia-baseline.json with file_pattern: "android/**" to declare the carve-out per-consumer. The estate-wide reusable's language-policy job already honours that.

Why this PR is worse than the baseline path:

• The grep -vE '(^|/)android/.*/src/.*\.java$' change is silent and global — any consumer can have Android Java without an explicit baseline declaration.
• The baseline path requires each consumer to explicitly declare the carve-out, which is auditable (the baseline file is reviewable; the workflow grep change is invisible after merge).

A follow-up neurophone cleanup PR will remove the redundant LOCAL Check for Java/Kotlin files step (the baseline carve-out belongs upstream-only).