Updated tex files with latest information about the program

README.md

@@ -161,6 +161,12 @@ Supply your hostname, TLS certificates, and HTTP-to-HTTPS redirect in the surrou
 
 [Jenkinsfile](Jenkinsfile) defines a multibranch pipeline that checks out source, assigns a build version, updates a shared OWASP cache, runs `mvn clean verify`, publishes Java test results, archives JARs, and conditionally publishes Maven artifacts to Nexus.
 
+The `Build LaTeX` stage runs only on branches matching `release/**` and compiles `docs/src/portal.tex` with three `pdflatex` passes to resolve references and the table of contents. The agent needs `pdflatex` on `PATH` and the document's LaTeX packages installed; neither `latexmk` nor Perl is required. Compilation errors fail the stage. The same stage saves `target/latex/portal.pdf` with fingerprinting before workspace cleanup.
+
+Every successful `release/**` build records a release with an immutable Git tag named `portal-release-${BUILD_VERSION}`. The `Build LaTeX` stage also generates and archives `target/release-notes.md`, listing commit subjects and hashes since the nearest earlier release tag reachable from the current commit. The first recorded release includes the full history; a rebuild without new commits reports no source changes. Before compiling, the same stage uses `awk` to generate `docs/src/appendix/ReleaseNotes.tex`, which `portal.tex` includes immediately after the Revisions appendix. The generated TeX is archived alongside the PDF and Markdown. Commit text is escaped for LaTeX. Local builds use a placeholder until release notes are generated. The agent needs `awk` on its path. Notes are generated from Git history, so their detail depends on the commit messages.
+
+The final `Tag release` stage pushes the tag only after the preceding build, PDF, and applicable Maven deployment stages succeed. Notes archived before a later failure are build artifacts, not a completed release marker. Failed builds do not publish a new release tag. The helper fetches release tags and expands shallow history before comparison. Jenkins needs the SSH Agent plugin, `ssh-agent` on the agent, a trusted Git server host key, and the checkout SCM SSH credential with permission to push tags. Tag conflicts fail the build; existing remote tags are never overwritten. Existing releases without this tag prefix are not comparison baselines.
+
 | Branch | Version | Publish to Nexus |
 | --- | --- | --- |
 | `release/<version>` | `<version>.<build-number>-RELEASE` | Yes |