AuDigitalHealth · gavinbaumanis · Aug 19, 2026 · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026
diff --git a/.cursor/rules/ascii-source.mdc b/.cursor/rules/ascii-source.mdc
@@ -0,0 +1,22 @@
+---
+description: Tracked source and docs must be ASCII only
+alwaysApply: true
+---
+
+# ASCII source
+
+Every file you **add or edit** must be **ASCII only** (bytes 0x00-0x7F). Scan touched paths before finishing.
+
+Replace:
+
+| Non-ASCII          | ASCII       |
+| ------------------ | ----------- |
+| em/en dash, minus  | `-`         |
+| ellipsis           | `...`       |
+| curly quotes       | `'` / `"`   |
+| arrows             | `->` / `<-` |
+| non-breaking space | space       |
+
+Do not introduce Unicode symbols, emoji, or locale punctuation in code, comments, XML, or docs.
+
+WSDL/XSD copied from the licensed toolkit may contain non-ASCII. Do not add more. Prefer ASCII in files you author.
diff --git a/.cursor/rules/documentation-standards.mdc b/.cursor/rules/documentation-standards.mdc
@@ -1,5 +1,5 @@
 ---
-description: Documentation and build scripts — implementor-first, Maven Central default, no secrets
+description: Documentation and build scripts - implementor-first, Maven Central default, no secrets
 alwaysApply: true
 ---
 
@@ -10,13 +10,13 @@ Applies when writing or editing **README**, **CONTRIBUTING**, integrator guides,
 ## Priority: implementors
 
 - Primary audience: developers **consuming** published Maven artifacts.
-- Contributor/maintainer workflow lives in **CONTRIBUTING.md**, **MAINTAINERS.md**, or labelled subsections — not mixed into the integrator main flow.
-- Do not duplicate agent workflow in README or CONTRIBUTING (**AGENTS.md** → `.cursor/rules/`).
+- Contributor/maintainer workflow lives in **CONTRIBUTING.md**, **MAINTAINERS.md**, or labelled subsections - not mixed into the integrator main flow.
+- Do not duplicate agent workflow in README or CONTRIBUTING (**AGENTS.md** -> `.cursor/rules/`).
 
 ## Default narrative: Maven Central
 
-- Write as if **released** coordinates are on Maven Central (no SNAPSHOT, sibling-repo checkout, or `-P…` profiles in the main integrator path).
-- Use **version numbers** in integrator docs — not Git branch names.
+- Write as if **released** coordinates are on Maven Central (no SNAPSHOT, sibling-repo checkout, or `-P...` profiles in the main integrator path).
+- Use **version numbers** in integrator docs - not Git branch names.
 - SNAPSHOT installs, optional Maven profiles, licensed WSDL for source builds, and sibling `mvn install` belong under **Local development** / **Local builds** only.
 
 ## Structure
@@ -30,21 +30,25 @@ Applies when writing or editing **README**, **CONTRIBUTING**, integrator guides,
 ## Paths
 
 - **Relative paths only** (e.g. `wsdls/xml`, `./certs/<folder>/`, `pom.xml` beside repo root).
-- **Never** hardcode machine paths (`C:\…`, `/Users/…`, `~/`, worktree folders) in tracked docs.
-- Override only when strictly required to remove ambiguity — say why.
+- **Never** hardcode machine paths (`C:\...`, `/Users/...`, `~/`, worktree folders) in tracked docs.
+- Override only when strictly required to remove ambiguity - say why.
 
 ## Current state only
 
 - No migration, legacy, or branch-history commentary in user-facing docs.
 - Describe **what is true now**; omit "removed", "used to", and repo archaeology in integrator material.
 - **CHANGELOG** entries: current release capabilities; avoid branch names and migration essays in new notes.
 
-## Secrets — MUST NOT
+## Secrets - MUST NOT
 
 - **Never** put real or plausible **passwords**, **tokens**, **API keys**, **private keys**, or **keystore passphrases** in tracked files (code, comments, examples, docs).
 - Use placeholders (`<pkcs12-password>`), empty values in `.example` files, or "from your registration pack".
 - See **SECURITY.md**.
 
+## ASCII source
+
+All tracked files you add or change must be **ASCII only**. See **`ascii-source.mdc`**.
+
 ## Override
 
 These rules may be overridden **only when necessary** to clear ambiguity (e.g. maintainer branch mapping in **MAINTAINERS.md** or `.cursor/rules/`, clearly labelled maintainer-only).
diff --git a/.cursor/rules/hi-wsdl-project.mdc b/.cursor/rules/hi-wsdl-project.mdc
@@ -5,35 +5,40 @@ alwaysApply: true
 
 # hi-wsdl-java
 
-Maven artifact **`au.gov.nehta:hi-wsdl`** — HI B2B WSDL resources and pre-generated JAX-WS/JAXB types. **Not** facade clients (**hi-b2b-client-java**).
+Maven artifact **`au.gov.nehta:hi-wsdl`** - HI B2B WSDL resources and pre-generated JAX-WS/JAXB types. **Not** facade clients (**hi-b2b-client-java**).
 
 ## Documentation
 
-Follow **`documentation-standards.mdc`**. Integrator docs use **version numbers** — not Git branch names.
+Follow **`documentation-standards.mdc`**. Integrator docs use **version numbers** - not Git branch names.
+
+The **first number** of **`au.gov.nehta:hi-wsdl`** is the **Java SE** target. Downstream artifacts that pin this coordinate to **`${project.version}`** (including **`hi-b2b-client`**) use the same version.
 
 | Version | Java | XML stack | `Service` stubs |
-| ------- | ---- | --------- | ----------------- |
-| **1.6.3** | 8 | **javax** | **14** (standard HI B2B) |
-| **1.6.5** | 11 | **Jakarta** | **14** (standard HI B2B) |
-| **1.7.0** | 11 | **Jakarta** | **26** (full MCA) |
+| ------- | ---- | -------- | --------------- |
+| **8.0.0** | 8 | **javax** | **14** (standard HI B2B) |
+| **11.0.0** | 11 | **Jakarta** | **26** (full MCA) |
+| **17.0.0** | 17 | **Jakarta** | **26** (full MCA) |
+| **21.0.0** | 21 | **Jakarta** | **26** (full MCA) |
+| **24.0.0** | 24 | **Jakarta** | **26** (full MCA) |
 
-**Git branch mapping (maintainers only — never in integrator docs):**
+**Git branch mapping (maintainers only - never in integrator docs):**
 
-| Version | Git branch |
-| ------- | ---------- |
-| **1.6.3** | `java-8-javax` |
-| **1.6.5** | `java-11-jakarta` |
-| **1.7.0** | `java-11-jakarta-full-wsdl` |
+| Version | Official Git branch |
+| ------- | ------------------- |
+| **8.0.0** | `java-8` |
+| **11.0.0** | `java-11` |
+| **17.0.0** | `java-17` |
+| **21.0.0** | `java-21` |
+| **24.0.0** | `java-24` |
 
-## This checkout
+## This 24.0.0 line
 
-**`1.6.3-SNAPSHOT`**: Java **8**, **`javax`** committed types, **14** services (standard HI B2B), `src/main/resources/HI_*.wsdl`, `hi_override/` xmldsig package. Sources frozen — no **`wsimport`** in this POM.
+**`24.0.0-SNAPSHOT`**: Java **24**, **Jakarta** committed types, **26** services (full MCA), `src/main/resources/HI_*.wsdl`, `hi_override/` xmldsig package. Default build compiles committed sources. Regen (**`-Pregenerate-sources`**) requires licensed **`wsdls/xml/`** locally. See **MAINTAINERS.md**.
 
 ## Build
 
-- JDK **8+**, from repo root: `mvn -B "-Dgpg.skip=true" clean verify` (quote `-D` on PowerShell).
-- Default build uses **committed** `src/main/java` — no wsimport.
-- Type regeneration for new HI releases is on **`1.6.5`** / **`1.7.0`** lines.
+- JDK **24**, from repo root: `mvn -B "-Dgpg.skip=true" clean verify` (quote `-D` on PowerShell).
+- Default build uses **committed** `src/main/java` - no wsimport.
 
 ## vs hi-b2b-client-java
 
@@ -42,11 +47,11 @@ Follow **`documentation-standards.mdc`**. Integrator docs use **version numbers*
 | Delivers | WSDL on classpath + generated types | Facade clients, TLS, signing |
 | Artifact | `hi-wsdl` | `hi-b2b-client` |
 
-Align **`hi-wsdl`** and **`hi-b2b-client`** versions per release line table.
+Publish **`hi-wsdl`** first. Consumers that pin **`${project.version}`** (including **`hi-b2b-client`**) use the same coordinate on each line (**8.0.0**, **11.0.0**, **17.0.0**, **21.0.0**, **24.0.0**, and so on).
 
 ## Doc split
 
 - **`documentation-standards.mdc`**: implementor-first, Maven Central default, local/OS sections, relative paths, no secrets
 - **`README.md`**: integrators (Maven Central default)
-- **`CONTRIBUTING.md`**: build from source, local SNAPSHOT, OS wrappers
+- **`CONTRIBUTING.md`**: build from source, local SNAPSHOT, regeneration notes
 - **`MAINTAINERS.md`**: POM / type-regeneration internals
diff --git a/.cursor/rules/multi-branch-worktrees.mdc b/.cursor/rules/multi-branch-worktrees.mdc
@@ -3,13 +3,13 @@ description: Use git worktree when editing multiple branches of the same reposit
 alwaysApply: true
 ---
 
-# Multi-branch work — use git worktree
+# Multi-branch work - use git worktree
 
-When a task requires **changes on two or more branches of the same Git repository**, use **`git worktree`** — do **not** hop branches with `git checkout` while carrying uncommitted edits or stashes.
+When a task requires **changes on two or more branches of the same Git repository**, use **`git worktree`** - do **not** hop branches with `git checkout` while carrying uncommitted edits or stashes.
 
 ## When this applies
 
-- Same-repo edits across release lines (e.g. `java-8-javax`, `java-11-jakarta`, `master`)
+- Same-repo edits across release lines (e.g. `java-8`, `java-11`)
 - Applying the same fix to several branches before commit
 - Comparing or building two branches side by side
 
@@ -22,7 +22,7 @@ When a task requires **changes on two or more branches of the same Git repositor
 ## Workflow
 
 1. **Primary clone** stays on the main working branch; do not stash-and-hop to edit other branches.
-2. **Add a worktree per extra branch** (paths are local — never commit them to tracked docs):
+2. **Add a worktree per extra branch** (paths are local - never commit them to tracked docs):
 
    ```bash
    git worktree add ../<repo>-<branch-slug> <branch>
@@ -34,18 +34,12 @@ When a task requires **changes on two or more branches of the same Git repositor
 ## Do not
 
 - `git checkout` other branches with uncommitted changes (Git will block or force stash churn).
-- Stash the same files across multiple branch switches — causes merge conflicts on `stash pop`.
+- Stash the same files across multiple branch switches - causes merge conflicts on `stash pop`.
 - Put worktree directory paths in README, CONTRIBUTING, or other tracked docs (see repo **`worktrees.mdc`** / **`documentation-standards.mdc`**).
 
 ## Example (maintainer-local paths only)
 
 ```bash
-# In hi-wsdl-java primary clone (on java-11-jakarta-full-wsdl)
-git worktree add ../hi-wsdl-java-java-8-javax java-8-javax
-git worktree add ../hi-wsdl-java-java-11-jakarta java-11-jakarta
-
-# Apply edits in each ../hi-wsdl-java-* folder; commit per branch
-# When finished:
-git worktree remove ../hi-wsdl-java-java-8-javax
-git worktree remove ../hi-wsdl-java-java-11-jakarta
+git worktree add <path> java-8
+git worktree add <path> java-11
 ```
diff --git a/.cursor/rules/worktrees.mdc b/.cursor/rules/worktrees.mdc
@@ -13,21 +13,21 @@ Follow **`documentation-standards.mdc`** (implementor-first, Maven Central defau
 
 | Doc | Audience | Use |
 | --- | -------- | --- |
-| **README**, integrator guides | Implementors | **Maven version** (`1.7.0`), Central coordinates, runtime config |
+| **README**, integrator guides | Implementors | **Maven version** (`24.0.0`), Central coordinates, JAR contents (WSDL + types) |
 | **CONTRIBUTING** | Contributors | Build from source, **Local builds**, OS-specific steps |
 | **MAINTAINERS**, **`.cursor/rules/`** | Maintainers | POM/wsimport internals; **branch mapping** only when labelled maintainer-only |
 
 Integrator docs: **version numbers**, not Git branch names. Local/SNAPSHOT/profile flows: **CONTRIBUTING** only.
 
 ## Do not put in tracked docs
 
-- Hardcoded worktree or machine paths (`wt/`, `C:\…`, `/Users/…`, `~/`, `this worktree`, `primary clone`)
+- Hardcoded worktree or machine paths (`wt/`, `C:\...`, `/Users/...`, `~/`, `this worktree`, `primary clone`)
 - References to **`wt/README.md`** or other local-only layout files
-- “Open folder X to switch branches” — IDE/local workflow, not repo documentation
+- "Open folder X to switch branches" - IDE/local workflow, not repo documentation
 
 ## Allowed (maintainer-only, when labelled)
 
-- **Git branch mapping** table (version → branch) in **MAINTAINERS.md** or agent rules
+- **Git branch mapping** table (version -> branch) in **MAINTAINERS.md** or agent rules
 - Generic worktree example only: `git worktree add <path> <branch>` (placeholder **`<path>`**, never a committed example)
 - Optional **untracked** local notes outside the repo
 

diff --git a/.editorconfig b/.editorconfig
@@ -0,0 +1,25 @@
+# https://editorconfig.org - aligns with .gitattributes (LF default; CRLF for *.bat / *.cmd)
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.{java,xml,xsd,wsdl,properties,txt,json,groovy,py}]
+indent_style = space
+indent_size = 4
+
+[*.{yml,yaml}]
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.bat]
+end_of_line = crlf
+
+[*.cmd]
+end_of_line = crlf
diff --git a/.gitattributes b/.gitattributes
@@ -1,10 +1,5 @@
-# Text files: LF in the index and on checkout (see *.bat / *.cmd below for CRLF).
-# Windows: git config core.autocrlf false once per clone so Git does not fight these rules.
-# After changing this file: git add --renormalize .
-# Optional (less diff noise if old blobs had stray CR): git config diff.ignoreCrAtEol true
 * text=auto eol=lf
 
-# Never treat these as text (no CRLF/LF conversion)
 *.class binary
 *.dll binary
 *.ear binary
@@ -22,6 +17,5 @@
 *.woff2 binary
 *.zip binary
 
-# cmd.exe reliably parses these with CRLF; keep them out of LF normalization churn
 *.bat text eol=crlf
 *.cmd text eol=crlf
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,23 @@
+name: CI
+
+on:
+  push:
+    branches: [ java-24 ]
+  pull_request:
+    branches: [ java-24 ]
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "24"
+          cache: maven
+      - name: Maven verify
+        run: mvn -B "-Dgpg.skip=true" clean verify
diff --git a/.gitignore b/.gitignore
@@ -1,37 +1,27 @@
-# Maven
 /target/
-pom.xml.tag
-pom.xml.releaseBackup
-pom.xml.versionsBackup
-pom.xml.next
-release.properties
-
-# Java
-*.class
-*.log
-hs_err_pid*
-
-# IDE / editor
 /.idea/
 *.iml
-*.ipr
-*.iws
-.vscode/
-.classpath
-.project
-.settings/
-bin/
-
-# OS
-.DS_Store
-Thumbs.db
-*.swp
-*.orig
-*~
 
-# Local secrets / keystores
+# Local secrets (never commit populated copies)
+/local.properties
 local.properties
 /settings.xml
+settings.xml
+
+# Licensed HI WSDL/XSD tree for wsimport regeneration (see wsdls/readme.txt)
+/wsdls/*
+!/wsdls/readme.txt
+
+/certs/
 *.jks
 *.keystore
 *.p12
+
+# Editor / agent / OS noise (not part of the published tree)
+.DS_Store
+Thumbs.db
+*.swp
+*.orig
+*~
+.vscode/
+hi-wsdl-java.code-workspace
diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -0,0 +1,3 @@
+{
+    "java.configuration.updateBuildConfiguration": "interactive"
+}
diff --git a/AGENTS.md b/AGENTS.md
@@ -4,9 +4,10 @@ Rules: `.cursor/rules/*.mdc`. Do not duplicate in README or CONTRIBUTING.
 
 | Concern | Rule |
 |---------|------|
+| ASCII only in authored files | `ascii-source.mdc` |
 | Documentation and build scripts (implementor-first, Central, local, OS, paths, no secrets) | `documentation-standards.mdc` |
 | HI WSDL scope, build, version lines | `hi-wsdl-project.mdc` |
 | Worktrees local only; versions in integrator docs | `worktrees.mdc` |
-| Multi-branch edits in one repo — use worktree, not checkout/stash | `multi-branch-worktrees.mdc` |
+| Multi-branch edits in one repo - use worktree, not checkout/stash | `multi-branch-worktrees.mdc` |
 
 Contributors (humans): README, CONTRIBUTING, MAINTAINERS, SECURITY, CHANGELOG.