D-163: Maven Central release history — the temporal axis reaches maven nodes

[MoSLoF]

What

Closes D-162's residual: maven-coordinate nodes had advisory coverage (VC-008) but no release timeline, so VC-004 dormancy and the temporal axis silently never evaluated for the dependency class that motivated the Clojure adapter. This adds registry.NewMaven — a RegistrySource for ecosystem maven through the existing Spec framework (shared cache/concurrency/stats machinery unchanged).

Source: Maven Central's solrsearch gav core — q=g:"group" AND a:"artifact", one page of 200 versions newest-first, epoch-milli timestamp decoded to UTC. Names arrive as the group:artifact form maven nodes already carry (bare name → group==artifact, the Leiningen convention).

Why no Clojars (a data-honesty constraint, not effort)

Clojars' artifact API serves no per-version publish timestamps, and a Release with a zero time poisons every temporal computation downstream — a "dormancy gap" measured from the Unix epoch reads as a 55-year awakening on every package. A fabricated timeline is strictly worse than a disclosed absence, so a Clojars-hosted artifact (jepsen's com.taoensso/carmine) 404s on Central and counts as NotFound in stats: disclosed coverage, like any other registry miss. Reaching Clojars honestly needs per-version pom probing or an upstream API with dates — its own decision, named in the entry.

Registry semantics, stated not assumed

• Central is immutable → Yanked stays false as a registry fact; the VC-012 yank-lure shape is structurally impossible from this source (pinned in test).
• No per-version publisher identity → Publishers empty; VC-011's honesty predicate declines to evaluate rather than claim continuity (pinned).
• What maven nodes gain: the timeline — VC-004 dormancy, median cadence, republish-burst window, all ecosystem-neutral ReleaseHistory consumers.

Validation

• Parser, two-sided: real-shaped response sorts oldest-first with correct UTC instants; empty versions, zero/negative timestamps, and duplicates drop; malformed JSON errors rather than returning an empty history.
• Wire pinned fragment-by-fragment through the shared client with a fake doer (search.maven.org is egress-blocked in this environment — same posture as D-162's OSV mapping); 404 pinned as NotFound-not-failure.
• Registration pin (TestRegistrySourcesCoverEmittedEcosystems): fails if any emitting ecosystem loses its release-history source — mutation-checked by unwiring NewMaven.
• Consumer-side pin (TestDormancyFiresOnMavenHistory): a maven history fires VC-004 identically to npm, guarding the check layer's ecosystem neutrality.
• Live-fired: the built binary issued the exact expected solrsearch query per jepsen dependency, and under denied egress disclosed degraded data source(s): maven-central-registry … NOT an all-clear.
• Full suite green (35 packages), -race clean, gofmt/vet silent. D-163 entry in docs/DECISIONS.md.

Residuals

One page of 200 versions bounds the old end of a very long history (recent history — what the temporal checks read — stays intact); pagination is the named follow-up. Clojars as above. First scan from a network reaching both api.osv.dev and search.maven.org remains the outstanding live confirmation for the D-162/D-163 chain.

---

🤖 Generated with Claude Code

---

Generated by Claude Code