Release protocol

Use this release order without moving signing or publication ahead of protection:

package and run ordinary tests -> smoke-test the exact original JAR -> Nativify -> smoke-test the protected JAR on every target -> sign/attest protected bytes -> publish those exact bytes

Before enabling a pipeline, identify the build system, normal test command, exact unsigned artifact, meaningful input and protected-output smoke commands, target platforms, and the current signing/publication handoff. If a project produces only an APK, AAB, WAR, native image, or signed artifact, stop and decide which unsigned JAR or ZIP is safe to protect; do not silently substitute another output.

Make remote protection an explicit release task or opt-in release profile, not a side effect of every local compilation. If a submit result is ambiguous, inspect build history and obtain human approval before resubmitting.