[sharanmoore]

Neal — action needed from you. The Java SDK has never been published to Maven Central, and the only remaining blocker is a Sonatype namespace that needs the account holder (I believe that's you, since you set up the pipeline and its SONATYPE_* secrets on 2026-06-29). Steps are in What's needed below; everything else is already done and tested.

TL;DR

• Releases fail with Namespace 'ai.gradientlabs' is not allowed.
• ai.gradientlabs maps to the domain gradientlabs.ai, which we don't own. It's parked for sale on Afternic. Our domain is gradient-labs.ai, so our namespace has to be ai.gradient-labs.
• This PR switches the Maven groupId to ai.gradient-labs. It stays a draft until Sonatype has verified that namespace for our account.

Background

This came out of PLA-176 (eMudhra CA compromise): we needed to publish a Java SDK release with a customer note about fixed JDKs. It turned out the SDK had never been released. There were no tags, nothing on Maven Central, and release.yml had never run, even though the README advertises 1.0.2 on Maven Central.

Releasing works by pushing a v* tag: release.yml signs the artifacts with GPG and uploads them through central-publishing-maven-plugin with autoPublish. We've tried v1.0.2 three times, and each run got one step further:

Attempt	Deployment	Error	Fix
1	d67cf8a0-13b1-4f52-a8ac-75f1187866b8	Spring Boot starter had no -sources/-javadoc jars (Central requires them)	#37
2	513d463b-0b33-43f3-981e-3663efdfba0f	Bundle has content that does NOT have a .pom file (plugin 0.6.0 bundled maven-metadata-local.xml and _remote.repositories)	#38: plugin 0.6.0 → 0.12.0
3	778b3c97-90b8-427f-9401-086d6aebb173	Namespace 'ai.gradientlabs' is not allowed for all three artifacts	this PR + namespace verification

Central publishes a deployment all or nothing, so none of these published anything. All three poms still 404 on repo1.

Already proven to work: the GPG key and passphrase secrets (signing succeeds), the Sonatype credentials (upload succeeds and the Publisher API answers), and the bundle layout (passes validation since #37 and #38). The namespace is the only thing left.

What this PR changes

Maven coordinates only: ai.gradientlabs → ai.gradient-labs in

• the three poms (parent, client, starter, including the starter's dependency on the client)
• the Spring Boot example's dependency
• both READMEs: the Maven and Gradle snippets, plus the Maven Central and javadoc.io badges/links

Not changed: the Java packages (ai.gradientlabs.client…) and the example's logger config (ai.gradientlabs: DEBUG). Those are package names, not Maven coordinates, so customer imports are unaffected. Nobody can be using the old coordinates, because nothing was ever published.

Sonatype's namespace docs confirm the hyphenated form: "The groupId should reverse the domain name exactly, even if the domain name contains hyphens… Hyphens are perfectly acceptable in groupIds." Verifying ai.gradient-labs also covers any future ai.gradient-labs.* groupIds.

Testing: mvn install on Maven 3.9 / JDK 25 (Docker). Build and tests pass, and the artifacts install under ai/gradient-labs/{gradient-labs-parent,gradient-labs-client,gradient-labs-spring-boot-starter}.

What's needed

1. Add the namespace (Sonatype account holder). At central.sonatype.com → View Namespaces → Add Namespace, enter ai.gradient-labs and copy the Verification Key it shows.
   • ⚠️ Don't click Verify yet. Sonatype warns that checking before the DNS record exists caches the failed lookup and delays verification.
   • This must be the same account whose user token is in the repo's SONATYPE_USERNAME / SONATYPE_PASSWORD secrets.
2. Add the DNS TXT record. gradient-labs.ai is managed in terraform: production-dns/dns.tf, resource google_dns_record_set.txt, the root TXT record. Add one entry to its rrdatas, next to the existing verification records:

   "\"<verification key>\"",

   Either open that terraform PR yourself, or send the key to Sharan and Claude will open it. After it's applied, dig -t txt gradient-labs.ai +short should show the key.
3. Verify. Back in the portal, click Verify Namespace on ai.gradient-labs. It should turn verified within a few minutes.
4. Release. Mark this PR ready, merge it, then move the v1.0.2 tag to the merge commit:

   git checkout main && git pull
   git push origin :refs/tags/v1.0.2 && git tag -d v1.0.2
   git tag -a v1.0.2 -m v1.0.2 && git push origin v1.0.2

   Moving the tag is safe because nothing was ever published under v1.0.2. release.yml only goes green once the release is live on Maven Central.

Optional: the old ai.gradientlabs namespace request, if one exists in the portal, can't ever be verified, so it can be deleted.