Extend the conversion pipeline beyond Spring Boot

[amondnet]

Today PROJECTS in scripts/lib/upstream-sources.ts holds exactly one entry, boot. product.md scopes this repository at "Framework, Boot, Security, Data, Cloud (extensible)", and NOTICE already carries the upstream attribution for Framework, Security, Data and Cloud — so the content repository claims an ecosystem it does not yet build.

This epic tracks extending the pipeline to a second, third and fourth project.

The constraint that orders the work

Probing Maven Central on 2026-09-14: no Spring project except Boot 4.0.8+ publishes an Antora content archive there.

Coordinate	Result
org/springframework/spring-docs	not on Maven Central
org/springframework/security/spring-security-docs	not on Maven Central
org/springframework/graphql/spring-graphql-docs	not on Maven Central
org/springframework/integration/spring-integration-docs	not on Maven Central
org/springframework/batch/spring-batch-docs	<release>4.3.3</release> — predates the Antora layout
org/springframework/ai/spring-ai-docs 2.0.0	jar / sources / pom only, no content zip

So every new project takes the synthesized assembly path (ADR-0004), and its cost is decided by one question: what does that project's generateAntoraResources actually produce? Measured per candidate, that varies by more than an order of magnitude, and not in the order project popularity would suggest.

Ranking

Project	Generated content that must be reconstructed	Pages	Sub-issue
framework	one attribute: spring-version	456	#74
ai	version + prerelease, nothing else	109	#75
security	attribute function + 4 resolved dependency versions	173	#76
modulith / authorization-server / graphql	0-2 attributes each	small	not yet filed
Spring Data (data-jpa, ...)	parent-POM property chain + a second checkout of spring-data-commons	—	deliberately excluded, see below

Why Spring Data is excluded for now

spring-data-jpa's collector runs dependency:unpack to pull spring-data-commons documentation into target/antora/, but that content is published nowhere: spring-data-commons 4.1.1 ships only jar/sources/javadoc/pom, and spring-data-jpa-distribution publishes a POM and nothing else. Reconstructing it needs a second checkout pinned to the matching release-train version, plus resolution of ~15 ${...} placeholders through the spring-data-build parent POM chain. It is the most expensive candidate, and the cost multiplies across data-jpa / data-mongodb / data-redis. Revisit once the cheaper projects have proven the converter is project-neutral.

Order, and why it is not value order

framework goes first even though security is arguably more valuable per page. framework is a cheaper case than the Boot 3.x synthesis already shipped, so it is the cheapest possible proof that markdown-converter.ts did not overfit to Spring Boot. Once 456 pages convert under --strict, taking on Security's 206 javadoc: macros rests on evidence rather than hope.

Done when

• framework, ai and security each resolve through resolveUpstream and convert under --strict
• supportedProjects() returns four keys
• NOTICE attribution matches what is actually built
• the README support table and release-pipeline skill no longer say "boot only"