diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
new file mode 100644
index 0000000..4cda895
--- /dev/null
+++ b/.github/workflows/integration.yml
@@ -0,0 +1,31 @@
+# generated by zed-pkg-test/test-org-fleet; edit the fleet manifest or bootstrapper, not this file.
+name: gated integration
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '17 8 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  integration:
+    if: ${{ vars.ENABLE_TEST_FLEET_INTEGRATION == 'true' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Check out source pins and submodules
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          show-progress: false
+          submodules: recursive
+          token: ${{ secrets.TEST_FLEET_READ_TOKEN || github.token }}
+      - name: Validate contract
+        run: node scripts/validate-plan.mjs
+      - name: Explain profile gate
+        run: |
+          echo "Profile: sdk-consumer"
+          echo "Required checks are defined in test-plan.json."
+          echo "Add product-specific executable fixtures here without weakening the generated contract."
diff --git a/.github/workflows/test-harness-contract.yml b/.github/workflows/test-harness-contract.yml
new file mode 100644
index 0000000..1e88b58
--- /dev/null
+++ b/.github/workflows/test-harness-contract.yml
@@ -0,0 +1,31 @@
+# generated by zed-pkg-test/test-org-fleet; edit the fleet manifest or bootstrapper, not this file.
+name: generated test harness contract
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: generated-contract-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  contract:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Check out without credentials
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          show-progress: false
+          submodules: false
+      - name: Validate generated plan, source pins, and gitlinks
+        run: node scripts/validate-plan.mjs
+      - name: Record profile
+        run: printf '%s\n' "sdk-consumer" > generated-profile.txt
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..de3ac3e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,10 @@
+# generated by zed-pkg-test/test-org-fleet; edit the fleet manifest or bootstrapper, not this file.
+.env
+.env.*
+!.env.example
+node_modules/
+.dart_tool/
+target/
+build/
+.zed/
+.vendor/
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..21458b1
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,5 @@
+# generated by zed-pkg-test/test-org-fleet; edit the fleet manifest or bootstrapper, not this file.
+[submodule "vendor/zed-interfaces"]
+	path = vendor/zed-interfaces
+	url = https://github.com/zed-pkg/zed-interfaces.git
+
diff --git a/.zpkg.toml b/.zpkg.toml
new file mode 100644
index 0000000..19bd0e3
--- /dev/null
+++ b/.zpkg.toml
@@ -0,0 +1,17 @@
+# generated by zed-pkg-test/test-org-fleet; edit the fleet manifest or bootstrapper, not this file.
+[package]
+org = "zed-pkg-test"
+name = "java-lib"
+version = "0.1.0"
+description = "java adapter projection; Maven packaging; frozen replay"
+license = "MIT"
+
+[package.repository]
+vcs = "git"
+url = "https://github.com/zed-pkg-test/java-lib"
+
+[install]
+dir = ".vendor/.zed"
+
+[dependencies]
+"zed-pkg/zed-interfaces" = "^0.1.0"
diff --git a/README.md b/README.md
index 99f1b1d..fa72c05 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,34 @@
-# java-lib
-Generated sdk-consumer test harness for zed-pkg-test.
+<!-- generated by zed-pkg-test/test-org-fleet; edit the fleet manifest or bootstrapper, not this file. -->
+# zed-pkg-test/java-lib
+
+Generated sdk-consumer harness for zed-pkg.
+
+## Contract
+
+Profile: `sdk-consumer`  
+Source organization: `zed-pkg`
+
+- java adapter projection
+- Maven packaging
+- frozen replay
+
+## Immutable source pins
+
+| Source | Commit | Branch observed |
+|---|---:|---|
+| `zed-pkg/zed-cli` | `7977b1d43231a68e1ac34903e0f18cef5135add6` | `main` |
+| `zed-pkg/zed-interfaces` | `5f15f1f2686199924b3e32e7ef8e6a85434bca3e` | `main` |
+| `zed-pkg/zed-clients` | `c97ead9ce1cd3675be7704d35e2395fa59f4baa4` | `main` |
+
+## Dependency lanes
+
+| Mode | Source | Manager | Path/subdir |
+|---|---|---|---|
+| `git-submodule` | `zed-pkg/zed-interfaces` | - | `vendor/zed-interfaces` |
+| `zed` | `zed-pkg/zed-interfaces` | - | - |
+| `native-package` | `zed-pkg/zed-clients` | `maven` | - |
+
+## Running
+
+The pull-request workflow validates the generated contract without cross-organization credentials. Full integration is intentionally release-gated until required source repositories and organization read credentials are present. Run the profile-specific checks recorded in `test-plan.json` after materializing the submodule, Zed, or native-package lane.
+
diff --git a/package-consumers.json b/package-consumers.json
new file mode 100644
index 0000000..9653d41
--- /dev/null
+++ b/package-consumers.json
@@ -0,0 +1,13 @@
+{
+  "generatedBy": "generated by zed-pkg-test/test-org-fleet",
+  "consumers": [
+    {
+      "manager": "maven",
+      "package": null,
+      "subdir": null,
+      "source": "zed-pkg/zed-clients",
+      "sourceSha": "c97ead9ce1cd3675be7704d35e2395fa59f4baa4",
+      "status": "discover-from-source-artifact"
+    }
+  ]
+}
diff --git a/scripts/validate-plan.mjs b/scripts/validate-plan.mjs
new file mode 100644
index 0000000..bcf08e6
--- /dev/null
+++ b/scripts/validate-plan.mjs
@@ -0,0 +1,27 @@
+// generated by zed-pkg-test/test-org-fleet; edit the fleet manifest or bootstrapper, not this file.
+import fs from 'node:fs';
+import childProcess from 'node:child_process';
+
+const plan = JSON.parse(fs.readFileSync(new URL('../test-plan.json', import.meta.url), 'utf8'));
+const errors = [];
+if (plan.schemaVersion !== 1) errors.push('schemaVersion must be 1');
+if (!plan.repository || !plan.profile) errors.push('repository and profile are required');
+if (!Array.isArray(plan.focus) || plan.focus.length < 2) errors.push('focus must contain at least two assertions');
+if (!Array.isArray(plan.sources) || plan.sources.length === 0) errors.push('at least one source is required');
+for (const source of plan.sources ?? []) {
+  if (source.exists && !/^[0-9a-f]{40}$/.test(source.sha ?? '')) errors.push('existing source must be pinned to a 40-character SHA: ' + source.fullName);
+}
+for (const dependency of plan.imports ?? []) {
+  if (!['git-submodule', 'zed', 'native-package'].includes(dependency.mode)) errors.push('unsupported dependency mode: ' + dependency.mode);
+}
+if (fs.existsSync(new URL('../.gitmodules', import.meta.url))) {
+  // Nested gitlinks are omitted by a non-recursive tree listing.
+  const tree = childProcess.execFileSync('git', ['ls-tree', '-r', 'HEAD'], { encoding: 'utf8' });
+  for (const dependency of plan.imports.filter((item) => item.mode === 'git-submodule')) {
+    if (!tree.includes('160000 commit') || !tree.includes(dependency.path)) errors.push('missing gitlink for ' + dependency.path);
+  }
+}
+const serialized = JSON.stringify(plan);
+if (/ghp_[A-Za-z0-9]+|github_pat_[A-Za-z0-9_]+/.test(serialized)) errors.push('credential-shaped value found');
+if (errors.length) { for (const error of errors) console.error('error: ' + error); process.exit(1); }
+console.log('validated generated test plan for ' + plan.testOrganization + '/' + plan.repository);
diff --git a/source-pins.json b/source-pins.json
new file mode 100644
index 0000000..ac41208
--- /dev/null
+++ b/source-pins.json
@@ -0,0 +1,20 @@
+{
+  "generatedBy": "generated by zed-pkg-test/test-org-fleet",
+  "sources": {
+    "zed-pkg/zed-cli": {
+      "branch": "main",
+      "sha": "7977b1d43231a68e1ac34903e0f18cef5135add6",
+      "exists": true
+    },
+    "zed-pkg/zed-interfaces": {
+      "branch": "main",
+      "sha": "5f15f1f2686199924b3e32e7ef8e6a85434bca3e",
+      "exists": true
+    },
+    "zed-pkg/zed-clients": {
+      "branch": "main",
+      "sha": "c97ead9ce1cd3675be7704d35e2395fa59f4baa4",
+      "exists": true
+    }
+  }
+}
diff --git a/test-plan.json b/test-plan.json
new file mode 100644
index 0000000..b15bc00
--- /dev/null
+++ b/test-plan.json
@@ -0,0 +1,69 @@
+{
+  "generatedBy": "generated by zed-pkg-test/test-org-fleet",
+  "schemaVersion": 1,
+  "sourceOrganization": "zed-pkg",
+  "testOrganization": "zed-pkg-test",
+  "repository": "java-lib",
+  "profile": "sdk-consumer",
+  "description": "java adapter projection; Maven packaging; frozen replay",
+  "focus": [
+    "java adapter projection",
+    "Maven packaging",
+    "frozen replay"
+  ],
+  "services": [],
+  "matrix": {},
+  "requiredChecks": [
+    "dependency-provenance",
+    "native-package-install",
+    "zed-install",
+    "submodule-pin",
+    "api-smoke"
+  ],
+  "sources": [
+    {
+      "fullName": "zed-pkg/zed-cli",
+      "exists": true,
+      "branch": "main",
+      "sha": "7977b1d43231a68e1ac34903e0f18cef5135add6",
+      "visibility": "public"
+    },
+    {
+      "fullName": "zed-pkg/zed-interfaces",
+      "exists": true,
+      "branch": "main",
+      "sha": "5f15f1f2686199924b3e32e7ef8e6a85434bca3e",
+      "visibility": "public"
+    },
+    {
+      "fullName": "zed-pkg/zed-clients",
+      "exists": true,
+      "branch": "main",
+      "sha": "c97ead9ce1cd3675be7704d35e2395fa59f4baa4",
+      "visibility": "public"
+    }
+  ],
+  "sourceGates": [],
+  "imports": [
+    {
+      "source": "zed-pkg/zed-interfaces",
+      "mode": "git-submodule",
+      "path": "vendor/zed-interfaces"
+    },
+    {
+      "source": "zed-pkg/zed-interfaces",
+      "mode": "zed"
+    },
+    {
+      "source": "zed-pkg/zed-clients",
+      "mode": "native-package",
+      "manager": "maven"
+    }
+  ],
+  "security": {
+    "immutableSourcePins": true,
+    "pullRequestCredentials": false,
+    "leastPrivilege": true,
+    "redactSecretsAndRawMedia": true
+  }
+}
diff --git a/vendor/zed-interfaces b/vendor/zed-interfaces
new file mode 160000
index 0000000..5f15f1f
--- /dev/null
+++ b/vendor/zed-interfaces
@@ -0,0 +1 @@
+Subproject commit 5f15f1f2686199924b3e32e7ef8e6a85434bca3e