Remove the push of the pinned llama.cpp commit to the fork

.github/release-gate-exemptions.txt

@@ -18,7 +18,6 @@ verify-signing-key-gradle: same as verify-signing-key, for the Gradle/BouncyCast
 test-java-llama-langchain4j-integration: validation only; a cold model cache degrades it to self-skips (CLAUDE.md, LangChain4j integration)
 build-android-llmservice: an app, not a library release; a Compose/AGP pin must not block a release (CLAUDE.md, Android app "LLM Service")
 test-android-llmservice: the emulator UI test of that app, optional for the same reason
-mirror-llama-source: runs after publish-release; pushes the pinned llama.cpp commit to the mirror fork
 central-snapshot: Independent post-preflight Central transfer; must not gate the GitHub publication path.
 central-release: Independent post-preflight Central transfer; must not gate the GitHub publication path.
 attest-snapshot: Independent provenance after the secured handoff; cannot gate either publication consumer.

.github/workflows/publish.yml

@@ -772,9 +772,7 @@ jobs:
   # upstream (no fetch, no patching: the archived tree carries the applier's stamp, which
   # verify-patches-applied.sh checks against the patches on disk). The publish jobs sign the
   # archive with the release key and attach it next to the Maven artifacts, so "no release asset
-  # is attached that CI has not run" holds for it too. mirror-llama-source (after a release) pushes
-  # the pristine commit to bernardladenthin/llama.cpp as jllama/b<nnnn>, the fallback the
-  # configure's JLLAMA_GIT_REPOSITORY can be pointed at.
+  # is attached that CI has not run" holds for it too.
   # ---------------------------------------------------------------------------
   archive-llama-source:
     name: Archive the patched llama.cpp source
@@ -3777,54 +3775,6 @@ jobs:
           assets-complete: ${{ needs.publish-release.outputs.assets_complete }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-  mirror-llama-source:
-    name: Mirror the pinned llama.cpp commit to bernardladenthin/llama.cpp
-    needs: [publish-release]
-    if: ${{ !cancelled() && needs.publish-release.result == 'success' }}
-    runs-on: ubuntu-latest
-    # The pristine upstream commit every natives jar of this release was built from, pushed to the
-    # project's fork as the tag jllama/b<nnnn> (.github/mirror-llama-source.sh: idempotent, and a
-    # tag that names another commit fails rather than being moved). Together with the signed source
-    # archive this is what keeps a release rebuildable without upstream (TODO.md, delivery roadmap,
-    # item 6); the configure takes the mirror through -DJLLAMA_GIT_REPOSITORY. LLAMA_MIRROR_TOKEN
-    # is a token with contents:write on the fork, kept with the release secrets; the job fails
-    # without it rather than skipping, so a release never silently goes unmirrored.
-    environment: maven-central
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - name: Resolve pinned llama.cpp tag from CMakeLists.txt
-        id: tag
-        shell: bash
-        run: |
-          # The same rule as build-webui: JLLAMA_GIT_TAG is the number, JLLAMA_GIT_COMMIT the commit
-          # it names; the checkout takes the commit when it is set.
-          TAG=$(grep -oE '^set\(JLLAMA_GIT_TAG[[:space:]]+b[0-9]+\)' llama/CMakeLists.txt | grep -oE 'b[0-9]+' | head -1)
-          if [ -z "$TAG" ]; then
-            echo "could not resolve llama.cpp JLLAMA_GIT_TAG (b<nnnn>) from CMakeLists.txt" >&2
-            exit 1
-          fi
-          COMMIT=$(grep -oE '^set\(JLLAMA_GIT_COMMIT[[:space:]]+"[0-9a-f]{40}"\)' llama/CMakeLists.txt | grep -oE '[0-9a-f]{40}' | head -1 || true)
-          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
-          echo "ref=${COMMIT:-$TAG}" >> "$GITHUB_OUTPUT"
-          echo "Pinned llama.cpp: $TAG${COMMIT:+ (commit $COMMIT)}"
-      - name: Checkout llama.cpp at the pinned commit (full history, the push needs it)
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-          repository: ggml-org/llama.cpp
-          ref: ${{ steps.tag.outputs.ref }}
-          path: llama-src
-          fetch-depth: 0
-      - name: Push the commit as jllama/<tag> to the mirror
-        shell: bash
-        env:
-          LLAMA_MIRROR_TOKEN: ${{ secrets.LLAMA_MIRROR_TOKEN }}
-        run: bash .github/mirror-llama-source.sh llama-src bernardladenthin/llama.cpp
-
   central-snapshot:
     name: Upload checked snapshot artifacts to Maven Central
     needs:

CHANGELOG.md

@@ -242,14 +242,11 @@ the first two items break every existing consumer at upgrade.
   jars into a directory and starts from it with no natives jar on the classpath. README, "Natives
   outside Maven", documents the directory, how to fetch a natives jar without Maven and the WDAC /
   AppLocker case.
-- **The patched llama.cpp source of a release is an asset of its own, and mirrored.**
+- **The patched llama.cpp source of a release is an asset of its own.**
   `archive-llama-source` packs the pinned commit with the patches applied, reproducibly, as
   `llama.cpp-b<nnnn>-jllama-<version>-src.tar.gz`, signed and attached with the Maven artifacts;
   `test-source-archive` builds the C++ suite from that archive before either publish job runs, and a
-  consumer rebuilds a release with `-DFETCHCONTENT_SOURCE_DIR_LLAMA.CPP=<unpacked>`. After a release
-  `mirror-llama-source` pushes the pinned commit to `bernardladenthin/llama.cpp` as `jllama/b<nnnn>`
-  (`JLLAMA_GIT_REPOSITORY` selects the mirror for a build); the patches stay files in this
-  repository, never fork commits.
+  consumer rebuilds a release with `-DFETCHCONTENT_SOURCE_DIR_LLAMA.CPP=<unpacked>`.
 - **Modular natives: the GPU backends are additive module jars, and every platform a GPU can join is
   built modular.** A GPU natives jar (`cuda13-linux-x86-64`, `vulkan-windows-aarch64`, ... -- 15 of
   them) now holds **only** ggml's backend module for that GPU (`libggml-cuda.so`, `ggml-vulkan.dll`,