RouteContract v0.1.0

RouteContract v0.1.0 is the first stable release of a Java test library for detecting review-worthy execution-structure drift in Apache ShardingSphere-JDBC 5.5.3 integration tests. It keeps existing business assertions and adds an operation-scoped contract over the physical JDBC execution attempts reported by ShardingSphere's SQLExecutionHook.

Highlights

• Captures hook-reported physical execution attempts for one named application operation.
• Compares a value-minimized candidate manifest with a human-approved baseline.
• Produces deterministic structural diffs and stable RCM codes that can fail a required CI check.
• Omits raw SQL, parameter values, connection properties, exception messages, timestamps, UUIDs, and thread identifiers from canonical manifests.
• Includes real-MySQL regression, determinism, concurrency, failure-boundary, privacy, and generic-tool comparison fixtures.
• Provides a checksum-verified, no-registry installation path for the attached JAR and POM assets.

Verified release evidence

• Annotated tag: v0.1.0 (tag object e3944631ad827e88d4936b75e9b738ef50a22b20)
• Commit: db203cfd9202ff10cd22c41cf04034eca5177341
• Tree: 89071f42a011fb8bc735caa7486525d828d31f1c
• Release evidence workflow run: 7 suites, 52 tests, 0 failures, 0 errors, 0 skipped
• Actions artifact ID: 9570423805
• Actions artifact SHA-256: 4c6dbbcd199a96ed0db1491bd348badb6d06b8f6be999aa5913faffd6df86ee7
• Public asset set: 11 payloads plus SHA256SUMS
• SHA256SUMS SHA-256: 820ed33eb8bfe8d47f3ec8782d2aa99f2879227c4ee066ecafc467e61abb8684

The exact-tag workflow ran the public Quick Start from a clean checkout and fresh Gradle home, built the release assets, and installed those assets into an isolated file Maven repository before a standalone MySQL consumer test. This is release-packaging evidence, not evidence of external adoption.

Install from the attached assets

Download all twelve attached files into one new directory, then follow the Release-asset installation instructions. The installer verifies the exact filename set, SHA256SUMS, POM/JAR/source structure, and the SBOM and supply-chain bindings before writing to an explicit empty file Maven repository.

Checksums establish asset integrity; they do not authenticate publisher identity. This v0.1 release has no signature assets or SLSA provenance claim.

Supply-chain boundary

The pinned offline OSV scan used OSV-Scanner 2.5.0 and a Maven database snapshot last modified at 2026-08-20T19:18:35.128Z. The exact release evidence contains 154 Maven packages, 0 vulnerability findings, 0 accepted vulnerability exceptions, and 0 unreviewed findings.

One package-level license review remains manual-review-required: the digest-pinned mysql:8.4.11 OCI image used only as a test container. It was reviewed on 2026-08-24 and expires on 2026-12-05. This is not legal advice, legal clearance, or an image-wide license conclusion. Re-review is required immediately if the digest, selected platform, embedded license evidence, or test-container boundary changes.

Compatibility and non-claims

The supported boundary is Java 17 and exactly ShardingSphere-JDBC 5.5.3 for normally returning, non-interrupted, synchronous, non-batch PreparedStatement execution. RouteContract observes hook callbacks; it does not prove a complete route plan, physical-table count, SQL semantic equivalence, enclosing JDBC completion, transaction commit, business success, performance, security, production readiness, external adoption, or Apache ShardingSphere endorsement.

See the README, specification, and changelog for usage, limits, and the exact v0.1.0 source delta.

RouteContract v0.1.0-rc2

RouteContract v0.1.0-rc2 is an immutable prerelease candidate for exact-tag installation and external validation. It is not the final stable v0.1.0 release and does not establish adoption or production readiness.

What changed since RC1:

• preserved the annotated RC1 tag and its failed evidence run without retagging or replacing assets;
• fixed release-evidence collection for a digest-qualified MySQL image by binding the official repository namespace, exact registry digest, and one resolved image ID;
• advanced project coordinates and the reviewed version-derived installation form to RC2 while retaining the RC1 form byte-for-byte;
• refreshed the pinned Maven OSV database snapshot after the prior generation URL became unavailable.

Verified boundary:

• Java 17, ShardingSphere-JDBC exactly 5.5.3;
• normally returning, non-interrupted, synchronous non-batch PreparedStatement execution;
• SQLExecutionHook-reported physical JDBC execution attempts and structural manifest changes only;
• no claim of a complete route plan, physical-table count, transaction commit, business success, performance, security, or upstream endorsement.

Evidence:

• tag commit: 4cb8b368fef4ca15ad2f09a8c4a17f820e80d16b
• release-evidence run: https://github.com/ym0506/routecontract/actions/runs/32438464149
• workflow artifact: routecontract-release-evidence-4cb8b368fef4ca15ad2f09a8c4a17f820e80d16b
• public assets: eleven checksummed payloads plus SHA256SUMS
• supply chain: 154 Maven packages; 3 reviewed test/example-graph findings; 0 unreviewed findings; 2 unresolved manual license reviews

unreviewed=0 does not mean zero vulnerabilities, and the automated license-policy result is not legal clearance. Current exception/review windows expire on 2026-08-27.

Install only from the attached checksummed assets and follow the exact RC2 instructions in the repository README. Independent recruitment is not active until a separate committed activation record passes the public validator.