docs: pivot non-version-locked references to Maven-Central-primary (#103)

Phase 1 of the Maven Central coordinate migration: rewrites every
forward-facing reference in the documentation and CI infrastructure to
describe Maven Central as the canonical install channel, while marking
the JitPack URL as legacy (kept resolvable for callers pinned to
v1.6.5 and earlier but no longer documented as the recommended path).

Version-locked snippets are NOT touched in this commit. The README
install section, docs/index.html JSON-LD/install snippets, and the
VersionConsistencyGuardTest regex stay on the JitPack format because
their value has to equal the current pom.xml version (1.6.5) — a
value that does not exist on Maven Central yet. cut-release.ps1 will
flip those at v1.6.6 cut time in the release commit; that mechanical
swap is Phase 2 of this migration and lands together with the actual
Central debut.

Files updated:
- CONTRIBUTING.md release-flow steps now describe Central publish
  via .github/workflows/publish.yml; JitPack confirmation removed
- ROADMAP.md "Next (v1.7)" entry removed; equivalent "Now (v1.6.x)"
  entry added noting Central debut in v1.6.6
- SECURITY.md artifacts line points at Central; JitPack noted as
  legacy-only
- docs/README.md release-process pointer mentions Central instead
  of JitPack
- docs/SHOWCASE.md install-snippet description points at Central
  artefact URL
- docs/templates/which-template-system.md "Maven coordinates do not
  change in 2.0" section reframed Central-first, JitPack as legacy
- docs/roadmaps/v1.6-roadmap.md Phase E scope rewritten for Central
  primary; release-identity coords switched to io.github.demchaav
- docs/contributing/release-process.md: top distribution-coordinates
  block, Phase 2.B post-release verification (Central artefact poll
  instead of JitPack BUILD SUCCESS), Phase 3 hotfix protocol opener,
  Section 5 never-do tag-force-move rule, and Section 6 done-criteria
  all rewritten for Central-primary flow. Historical v1.5.0 / v1.6.5
  lessons-learned kept verbatim (accurate to when they happened)
- .github/workflows/ci.yml japicmp comment notes Central as baseline
  source for v1.6.6+, JitPack still serves v1.6.5
- .github/workflows/publish.yml hyphenated-tag comments drop the
  "go to JitPack" mention; pre-releases ship only to the GitHub
  Release surface now

Guard suite green locally: CanonicalSurfaceGuardTest +
DocumentationExamplesTest + DocumentationCoverageTest +
VersionConsistencyGuardTest = 30/0/0.

Author: DemchaAV

.github/workflows/ci.yml

@@ -166,7 +166,8 @@ jobs:
           cache: maven
 
       - name: Compare public API against baseline
-        # The `japicmp` profile pulls the v1.6.5 jar from JitPack and
+        # The `japicmp` profile resolves the prior published jar (currently
+        # v1.6.5 from JitPack; v1.6.6 and later from Maven Central) and
         # diffs it against the freshly-built artifact. Fails the job on
         # any binary-incompatible modification to the public surface.
         # Source-incompatible changes are reported only (phased policy).

.github/workflows/publish.yml

@@ -9,8 +9,8 @@ name: Publish to Maven Central
 # workflow alone via workflow_dispatch if Central had a transient
 # validator hiccup without re-cutting the tag.
 #
-# Hyphenated tags (rc / alpha / beta / SNAPSHOT) are skipped: those go
-# only to JitPack and the GitHub Release pre-release, never to Central
+# Hyphenated tags (rc / alpha / beta / SNAPSHOT) are skipped: those
+# ship only to the GitHub Release pre-release surface, never to Central
 # (Central's validator rejects SNAPSHOT-style coordinates anyway).
 #
 # Human prerequisites (one-time per repo):
@@ -46,8 +46,7 @@ jobs:
     name: Publish ${{ github.ref_name }} to Maven Central
     runs-on: ubuntu-latest
     # Only ship plain semver tags (vX.Y.Z) to Central. Pre-release tags
-    # like v1.7.0-rc.1 ship to JitPack + the GitHub Release pre-release
-    # surface only.
+    # like v1.7.0-rc.1 ship to the GitHub Release pre-release surface only.
     if: |
       github.event_name == 'workflow_dispatch' ||
       (!contains(github.ref, '-rc') && !contains(github.ref, '-alpha') && !contains(github.ref, '-beta') && !contains(github.ref, '-snapshot'))

CONTRIBUTING.md

@@ -76,9 +76,9 @@ GraphCompose follows a fork → feature branch → pull request flow. Exte
 
 ### Release flow
 
-1. **Release prep** lands on `develop` — version bumps in `pom.xml`, `examples/pom.xml`, and `benchmarks/pom.xml`; fresh CHANGELOG entry; migration guide for minor releases. **README install snippets stay pinned to the previously published tag** (e.g. `v1.6.0`) until JitPack confirms the new build, otherwise consumers copying the snippet during the publish window hit a 404.
+1. **Release prep** lands on `develop` — version bumps propagate via `aggregator/pom.xml` to all modules in one pass; fresh CHANGELOG entry; migration guide for minor releases. **README install snippet stays pinned to the previously published version** until Maven Central confirms the new artifact, otherwise consumers copying the snippet during the publish window hit a 404.
 2. **`scripts/cut-release.ps1 -Version <X.Y.Z>`** automates the bump + CHANGELOG date + commit + tag + push from `develop`. The maintainer fast-forwards `main` from `develop` after the tag lands (`git push origin develop:main`).
-3. **JitPack** picks up the new tag automatically. After JitPack reports `BUILD SUCCESS`, a separate post-release commit on `develop` flips the README install snippets to the new version.
+3. **Maven Central** picks up the new tag automatically via [`.github/workflows/publish.yml`](./.github/workflows/publish.yml) &mdash; the workflow re-runs `mvnw verify` at the tagged commit, signs the four artefacts (main / sources / javadoc / pom) with the repo's GPG key, and uploads via the `central-publishing-maven-plugin`. Hyphenated tags (`-rc`, `-alpha`, `-beta`) are skipped on Central; they ship only to the GitHub Release pre-release surface. Javadocs auto-publish to [javadoc.io/doc/io.github.demchaav/graphcompose](https://javadoc.io/doc/io.github.demchaav/graphcompose) shortly after each Central release.
 4. **GitHub Release** is created with notes from the matching `CHANGELOG.md` section.
 
 See [docs/contributing/release-process.md](./docs/contributing/release-process.md) for the full checklist (audit gates, hotfix protocol, lessons learned).

ROADMAP.md

@@ -8,12 +8,12 @@ In flight on `main` / `develop`.
 
 - v1.6 polish — documentation, examples, visual baselines, fixes.
 - Open-source hygiene — security policy, support guidance, dependency automation, security scanning.
+- **Maven Central distribution** — debut shipping in v1.6.6 under `io.github.demchaav:graphcompose`. Replaces JitPack as the primary install channel; the JitPack URL stays alive for existing pinned consumers but is no longer documented as a primary option. Tracked in [#7](https://github.com/DemchaAV/GraphCompose/issues/7).
 
 ## Next (v1.7)
 
 Committed direction. Tracked in CHANGELOG (Phase E) and issues.
 
-- **Maven Central distribution** — replace JitPack as the primary install channel. Tracked in [#7](https://github.com/DemchaAV/GraphCompose/issues/7).
 - **JMH benchmark migration** — replace the current custom benchmark harness with `org.openjdk.jmh` so the published numbers are credible and machine-comparable.
 - **Templates v2 component refactor** — 13 of the 14 v2 CV presets are currently hand-coded `DocumentTemplate` subclasses. Route more visual decisions through `CvBuilder` and equivalent component recipes so each preset becomes a thin composition rather than a 400–700-line class.
 

SECURITY.md

@@ -47,7 +47,7 @@ In scope:
 - DOCX / PPTX semantic backends (`com.demcha.compose.document.backend.semantic`).
 - Templates shipped in `com.demcha.compose.document.templates`.
 - Public authoring API (`GraphCompose`, `DocumentSession`, DSL).
-- Build and release artifacts on JitPack (and Maven Central once published).
+- Build and release artifacts on Maven Central (`io.github.demchaav:graphcompose`). The legacy JitPack URL remains available for consumers pinned to v1.6.5 and earlier but is no longer the documented install channel.
 
 Out of scope:
 

docs/README.md

@@ -49,7 +49,7 @@ back here.
 ### Contributing
 - **[contributing/extension-guide.md](contributing/extension-guide.md)** — add a new node type, backend handler, or theme primitive.
 - **[contributing/implementation-guide.md](contributing/implementation-guide.md)** — internal engine notes for contributors hacking on layout / measurement / pagination.
-- **[contributing/release-process.md](contributing/release-process.md)** — versioning, tag procedure, JitPack publication.
+- **[contributing/release-process.md](contributing/release-process.md)** — versioning, tag procedure, Maven Central publication.
 
 ### Roadmaps & migrations
 - **[roadmaps/v1.6-roadmap.md](roadmaps/v1.6-roadmap.md)** — current development roadmap.

docs/SHOWCASE.md

@@ -51,8 +51,8 @@ The gallery is driven by code, not by hand-editing JSON. Source of truth:
 ## Version and source links
 
 - The displayed version lives **only** in `index.html` (JSON-LD
-  `softwareVersion`, the JitPack download URL, the hero badge, and the Maven +
-  Gradle install snippets). It does not inherit from the pom.
+  `softwareVersion`, the Maven Central artefact URL, the hero badge, and the
+  Maven + Gradle install snippets). It does not inherit from the pom.
 - `scripts/cut-release.ps1` flips all of those — plus the README and poms — to
   the release tag in the release commit, and `VersionConsistencyGuardTest`
   fails the `verify` gate if any of them drift out of sync with the library