# JPA Leaf Verification Java Migration Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Remove the remaining procedural JPA leaf verification logic from Groovy while deleting a redundant verifier-of-verifier task.

**Architecture:** Keep the security scenario as a declarative `strictTestLanes.requires(...)` contract and remove `verifyJpaSecurityFixtures` from both the leaf and readiness registry. Move the real PostgreSQL `set_config` source-safety rule into a typed task/verifier owned by the already-applied `ca.jpa-evidence` Java plugin.

**Tech Stack:** Java 21, Gradle 9 binary plugins/tasks, JUnit 6.

**Spec:** `docs/superpowers/specs/2026-09-16-verification-surface-reduction-design.md`

## Global Constraints

- Preserve the `verifyJpaSqlConstructionSafety` task name because readiness registry/evidence tooling references it.
- Preserve the PostgreSQL security method selector on `postgresqlSecurityBaselineIntegrationTest`.
- Remove `verifyJpaSecurityFixtures` only together with its readiness-card support-task reference.
- Do not add production dependencies or change JPA runtime behavior.
- Do not stage, commit, amend, or push.

---

### Task 1: Typed SQL construction safety verifier

**Files:**
- Create: `src/build-tools/src/main/java/dev/caskeleton/buildtools/jpa/JpaSqlConstructionSafetyVerifier.java`
- Create: `src/build-tools/src/main/java/dev/caskeleton/buildtools/jpa/JpaSqlConstructionSafetyResult.java`
- Test: `src/build-tools/src/test/java/dev/caskeleton/buildtools/jpa/JpaSqlConstructionSafetyVerifierTest.java`

- [ ] **Step 1:** Write RED tests for parameterized `set_config`, non-parameterized `set_config`, comments, and nested source paths.
- [ ] **Step 2:** Implement the minimal typed verifier preserving the current line-based rule.
- [ ] **Step 3:** Run the focused verifier tests to GREEN.

### Task 2: Java task ownership and redundant task removal

**Files:**
- Create: `src/build-tools/src/main/java/dev/caskeleton/buildtools/jpa/VerifyJpaSqlConstructionSafetyTask.java`
- Modify: `src/build-tools/src/main/java/dev/caskeleton/buildtools/jpa/JpaEvidencePlugin.java`
- Modify: `src/adapter/outbound/persistence-jpa/build.gradle`
- Modify: `src/config/jpa/readiness-cards.yaml`

- [ ] **Step 1:** Register `verifyJpaSqlConstructionSafety` as a typed task from `JpaEvidencePlugin`.
- [ ] **Step 2:** Delete the Groovy implementation of `verifyJpaSqlConstructionSafety`.
- [ ] **Step 3:** Delete `verifyJpaSecurityFixtures` and remove it from the security card support tasks while keeping the `requires(...)` selector.
- [ ] **Step 4:** Verify readiness registry and SQL-safety tasks.
- [ ] **Step 5:** Run `:adapter:outbound:persistence-jpa:check`, build-tools tests, and `git diff --check`.