diff --git a/.github/workflows/contract-tests.yml b/.github/workflows/contract-tests.yml
index 9a3c26f7..ddabc6a7 100644
--- a/.github/workflows/contract-tests.yml
+++ b/.github/workflows/contract-tests.yml
@@ -47,7 +47,7 @@ jobs:
         if: failure()
         run: |
           echo "### API surface changes detected in ${{ matrix.module }} ###"
-          echo "Compared against ${{ matrix.module }}/api-report/${{ matrix.artifact }}.baseline.jar."
+          echo "Compared against api-report/${{ matrix.artifact }}.baseline.jar."
           echo "If this change is intentional, run:"
           echo "    scripts/contract-snapshot-update.sh ${{ matrix.module }}"
           echo "and commit the updated baseline jar."
@@ -75,7 +75,7 @@ jobs:
         if: always() && github.event.pull_request
         run: |
           git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=1
-          BASELINE="${{ matrix.module }}/api-report/${{ matrix.artifact }}.baseline.jar"
+          BASELINE="api-report/${{ matrix.artifact }}.baseline.jar"
           if ! git diff --name-only "origin/${{ github.event.pull_request.base.ref }}" HEAD -- "$BASELINE" | grep -q .; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
           elif git cat-file -e "origin/${{ github.event.pull_request.base.ref }}:$BASELINE" 2>/dev/null; then
@@ -91,7 +91,7 @@ jobs:
       - name: Diff old vs new contract baseline
         if: always() && (steps.baseline-diff-check.outputs.changed == 'true' || steps.baseline-diff-check.outputs.changed == 'new')
         run: |
-          BASELINE="${{ matrix.module }}/api-report/${{ matrix.artifact }}.baseline.jar"
+          BASELINE="api-report/${{ matrix.artifact }}.baseline.jar"
 
           if [ "${{ steps.baseline-diff-check.outputs.changed }}" = "new" ]; then
             {
@@ -140,8 +140,8 @@ jobs:
               ? `## Contract baseline added (\`${module}\`)`
               : `## Contract baseline change detected (\`${module}\`)`;
             const preamble = isNew
-              ? `This PR adds \`${module}/api-report/${artifact}.baseline.jar\`, the approved public API contract for this module.`
-              : `This PR updates \`${module}/api-report/${artifact}.baseline.jar\` (the approved public API contract). Here is exactly what it changes, comparing the baseline on \`${{ github.event.pull_request.base.ref }}\` against the baseline committed in this PR:`;
+              ? `This PR adds \`api-report/${artifact}.baseline.jar\`, the approved public API contract for this module.`
+              : `This PR updates \`api-report/${artifact}.baseline.jar\` (the approved public API contract). Here is exactly what it changes, comparing the baseline on \`${{ github.event.pull_request.base.ref }}\` against the baseline committed in this PR:`;
             const body = `${marker}\n${heading}\n\n${preamble}\n\n${summary}`;
             const { data: comments } = await github.rest.issues.listComments({
               owner: context.repo.owner,
diff --git a/.gitignore b/.gitignore
index 4f10424a..751e8d7c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,6 @@ docs/superpowers/
 
 # local sample configuration - may hold credentials
 .env
+
+# comparison jars built for the contract gate (japicmp reads them off disk; never artifacts)
+api-report/build/
diff --git a/flowvault/api-report/skyflow-flowvault-java.baseline.jar b/api-report/skyflow-flowvault-java.baseline.jar
similarity index 100%
rename from flowvault/api-report/skyflow-flowvault-java.baseline.jar
rename to api-report/skyflow-flowvault-java.baseline.jar
diff --git a/skyvault/api-report/skyflow-java.baseline.jar b/api-report/skyflow-java.baseline.jar
similarity index 100%
rename from skyvault/api-report/skyflow-java.baseline.jar
rename to api-report/skyflow-java.baseline.jar
diff --git a/flowvault/pom.xml b/flowvault/pom.xml
index 5a8f014f..8d6d63cc 100644
--- a/flowvault/pom.xml
+++ b/flowvault/pom.xml
@@ -78,12 +78,11 @@
                 </executions>
             </plugin>
             <plugin>
-                <!-- Comparison-only jar (classifier "with-common") merging com.skyflow:common,
-                     mirroring skyvault. The published artifact is untouched: shadedArtifactAttached
-                     keeps the main jar as it was. This exists so japicmp compares the whole surface
-                     a consumer actually gets, since classes a customer imports (Credentials,
-                     SkyflowException, BearerToken) live in common and would otherwise read as
-                     missing - japicmp only sees what is physically inside the jars it is given. -->
+                <!-- Comparison-only jar merging com.skyflow:common, mirroring skyvault. It exists so
+                     japicmp compares the whole surface a consumer actually gets, since classes a
+                     customer imports (Credentials, SkyflowException, BearerToken) live in common and
+                     would otherwise read as missing - japicmp only sees what is physically inside the
+                     jars it is given. Build-time only: it is never an artifact. -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
                 <version>3.6.0</version>
@@ -95,8 +94,13 @@
                             <goal>shade</goal>
                         </goals>
                         <configuration>
-                            <shadedArtifactAttached>true</shadedArtifactAttached>
-                            <shadedClassifierName>with-common</shadedClassifierName>
+                            <!-- outputFile, NOT shadedArtifactAttached. Attaching makes this a real
+                                 project artifact, and Maven installs and DEPLOYS attached artifacts -
+                                 a -with-common.jar would ship to jfrog and Maven Central alongside
+                                 the real one. outputFile writes the file to disk for japicmp to read
+                                 and attaches nothing. -->
+                            <outputFile>${project.basedir}/../api-report/build/${project.build.finalName}-with-common.jar</outputFile>
+                            <createDependencyReducedPom>false</createDependencyReducedPom>
                             <artifactSet>
                                 <includes>
                                     <include>com.skyflow:common</include>
@@ -117,12 +121,12 @@
                          after an intentional public API change, then commit the updated jar. -->
                     <oldVersion>
                         <file>
-                            <path>${project.basedir}/api-report/skyflow-flowvault-java.baseline.jar</path>
+                            <path>${project.basedir}/../api-report/skyflow-flowvault-java.baseline.jar</path>
                         </file>
                     </oldVersion>
                     <newVersion>
                         <file>
-                            <path>${project.build.directory}/${project.build.finalName}-with-common.jar</path>
+                            <path>${project.basedir}/../api-report/build/${project.build.finalName}-with-common.jar</path>
                         </file>
                     </newVersion>
                     <parameter>
diff --git a/scripts/contract-snapshot-update.sh b/scripts/contract-snapshot-update.sh
index 9c4c5314..34948fb3 100755
--- a/scripts/contract-snapshot-update.sh
+++ b/scripts/contract-snapshot-update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Regenerates a module's contract-testing baseline (<module>/api-report/*.baseline.jar)
+# Regenerates a module's contract-testing baseline (repo-root api-report/*.baseline.jar)
 # from the CURRENT working tree and overwrites the committed snapshot.
 #
 # Run this after an intentional public API change, review the resulting git diff on
@@ -40,16 +40,17 @@ for MODULE in "${MODULES[@]}"; do
     echo "=== $MODULE ==="
     mvn -B package -pl "common,$MODULE" -am -DskipTests -Dmaven.javadoc.skip=true -Dgpg.skip=true
 
-    # the comparison-only jar, which merges com.skyflow:common into the module
-    SHADED_JAR=$(ls "$MODULE"/target/"$ARTIFACT"-*-with-common.jar 2>/dev/null | head -n1)
+    # The comparison-only jar merging com.skyflow:common. It is written to api-report/build/
+    # rather than the module's target/ so that nothing inside a published module can pick it
+    # up; it is deliberately not a Maven artifact, so it is never installed or deployed.
+    SHADED_JAR=$(ls api-report/build/"$ARTIFACT"-*-with-common.jar 2>/dev/null | head -n1)
     if [ -z "$SHADED_JAR" ]; then
-        echo "Error: could not find $MODULE/target/$ARTIFACT-*-with-common.jar. Did the build succeed?"
+        echo "Error: could not find api-report/build/$ARTIFACT-*-with-common.jar. Did the build succeed?"
         exit 1
     fi
 
-    mkdir -p "$MODULE/api-report"
-    cp "$SHADED_JAR" "$MODULE/api-report/$ARTIFACT.baseline.jar"
-    echo "Updated $MODULE/api-report/$ARTIFACT.baseline.jar from $SHADED_JAR"
+    cp "$SHADED_JAR" "api-report/$ARTIFACT.baseline.jar"
+    echo "Updated api-report/$ARTIFACT.baseline.jar from $SHADED_JAR"
 done
 
 echo "--------------------------"
diff --git a/skyvault/pom.xml b/skyvault/pom.xml
index 618c7e9d..6a8e8814 100644
--- a/skyvault/pom.xml
+++ b/skyvault/pom.xml
@@ -60,16 +60,14 @@
                 </executions>
             </plugin>
             <plugin>
-                <!-- Produces an additional, comparison-only jar (classifier "with-common")
-                     that merges in com.skyflow:common, same pattern flowvault already uses.
-                     The real published skyflow-java-2.1.1.jar is untouched (shadedArtifactAttached
-                     keeps the main artifact slim) - this attached jar exists only so japicmp can
-                     compare an apples-to-apples "everything a v2 consumer actually gets" surface
-                     against the old 2.1.0 baseline, which was a single self-contained jar
-                     (predating the common/v2 split). Without this, classes that moved into
-                     common (Credentials, ErrorCode, BearerToken, Token, etc.) would show up as
-                     false-positive "removed" classes, since japicmp only compares what's
-                     physically inside the two jars it's given. -->
+                <!-- Produces an additional, comparison-only jar that merges in com.skyflow:common,
+                     same pattern flowvault uses. It exists only so japicmp can compare an
+                     apples-to-apples "everything a v2 consumer actually gets" surface against the
+                     old 2.1.0 baseline, which was a single self-contained jar (predating the
+                     common/v2 split). Without it, classes that moved into common (Credentials,
+                     ErrorCode, BearerToken, Token, etc.) would show up as false-positive "removed"
+                     classes, since japicmp only compares what's physically inside the two jars it's
+                     given. Build-time only: it is never an artifact. -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
                 <version>3.6.0</version>
@@ -81,8 +79,14 @@
                             <goal>shade</goal>
                         </goals>
                         <configuration>
-                            <shadedArtifactAttached>true</shadedArtifactAttached>
-                            <shadedClassifierName>with-common</shadedClassifierName>
+                            <!-- outputFile, NOT shadedArtifactAttached. Attaching makes this a real
+                                 project artifact, and Maven installs and DEPLOYS attached artifacts -
+                                 a -with-common.jar would ship to jfrog and Maven Central alongside
+                                 the real one. outputFile writes the file to disk for japicmp to read
+                                 and attaches nothing. It lands in the repo-root api-report/build/,
+                                 outside every module, so nothing packaged or published can see it. -->
+                            <outputFile>${project.basedir}/../api-report/build/${project.build.finalName}-with-common.jar</outputFile>
+                            <createDependencyReducedPom>false</createDependencyReducedPom>
                             <artifactSet>
                                 <includes>
                                     <include>com.skyflow:common</include>
@@ -98,19 +102,19 @@
                 <version>0.26.0</version>
                 <configuration>
                     <!-- No published version is pulled for this comparison. "Old" is the
-                         committed contract snapshot (api-report/skyflow-java.baseline.jar) -
+                         committed contract snapshot (repo-root api-report/skyflow-java.baseline.jar) -
                          a jar built from the last code state a human deliberately approved as
                          the contract, same role as skyflow-node's committed api-report/*.api.md.
                          Regenerate it with scripts/contract-snapshot-update.sh after an
                          intentional public API change, then commit the updated jar. -->
                     <oldVersion>
                         <file>
-                            <path>${project.basedir}/api-report/skyflow-java.baseline.jar</path>
+                            <path>${project.basedir}/../api-report/skyflow-java.baseline.jar</path>
                         </file>
                     </oldVersion>
                     <newVersion>
                         <file>
-                            <path>${project.build.directory}/${project.build.finalName}-with-common.jar</path>
+                            <path>${project.basedir}/../api-report/build/${project.build.finalName}-with-common.jar</path>
                         </file>
                     </newVersion>
                     <parameter>