[kikashy]

Closes #12. Closes #16.

What it adds

• Treats text inside paired backticks as an identifier, path or command during brief checks, while preserving the existing refusal and suggestion for the same bare word.
• Removes the product's adversarial-review term from the base filter list.
• Makes codex run --add DIRECTORY commit every eligible file below the directory, exclude untracked handover files and ignored or cache files, preserve the tracked-handover refusal, and name an empty directory in its refusal.
• Documents both command behaviors and covers them with hand-written tests.

Checks

== check summary (dev.json) ==
PASS diff-check 0s
PASS local-paths 0s
PASS agent-docs 0s
sync-agent-docs: CLAUDE.md matches AGENTS.md
sync-agent-docs: CLAUDE.md matches AGENTS.md
PASS bash-n 0s
bash -n: every script parses
PASS json 0s, python .venv/bin/python3 (Python 3.8.20)
parsed 6 JSON documents
FAIL shellcheck 0s, exit 127
--
bash: shellcheck: command not found
PASS tests 50s
382 passed, 0 failed
== 6 passed, 1 failed, 0 skipped, 0 not run ==

Not in this PR

shellcheck was not run because it is not installed on this machine; CI runs that check.

A Codex session wrote this change.

[kikashy]

Review round 1 (OpenAI gpt-5.6-sol, effort medium, 2026-10-23), reviewed SHA e1ead39

Clean-room clone at the head, probes under .review/; CI green before the round. The report verbatim:

HIGH — bin/jpdev:771: handover exclusion checks only root msg.txt and pr.md. --add bundle committed bundle/msg.txt; a directory containing only bundle/msg.txt and bundle/pr.md was committed instead of refused. Remove handover basenames throughout added directories, then evaluate emptiness; add the nested-directory regression at tests/run.sh:912.

MEDIUM — lib/codex_words.py:39: an unmatched backtick can pair with the opener of a later valid span. ` unmatched exploit before `safe` returned clean, exempting the bare exploit. Parse backtick runs fail-closed when delimiters are unbalanced and add an odd-run regression test.

Verified

• Single backticks, fenced blocks, split spans, bare terms, and mixed backticked/bare terms otherwise behaved as required.
• The product list removed only adversar; no other entry changed.
• Nested directories, ignored files, ordinary file paths, and outside-clone refusal behaved correctly.
• Two mutation checks were caught by existing expectations: disabling masking breaks tests/run.sh:756; disabling directory bookkeeping breaks the message expectation at tests/run.sh:914.
• README documents the intended behavior, but the two findings contradict it.
• Focused suite: 380 passed, 2 unrelated local Python-selection fixture failures; CI was already green. Shell syntax and diff checks passed.
• No tracked files changed; probes remain under .review/.

merge: after fixes — e1ead39

Disposition (the coordinator's)

#	Finding	Severity	Disposition
1	--add of a directory commits nested msg.txt and pr.md, and a directory holding only those is committed instead of refused	HIGH	Fix in this pull request by the same builder: the handover basenames are excluded throughout added directories before the emptiness check; nested-directory regression test; the merge waits for it
2	An unmatched backtick pairs with a later valid span and exempts a bare word	MEDIUM	Fixed in the same push: unbalanced delimiters parse fail-closed (no exemption); odd-run regression test

The same reviewer re-reads the fixed head. Same vendor as the builder, not a cross-vendor claim.

[kikashy]

Re-read after the fix (OpenAI gpt-5.6-sol, effort medium, 2026-10-23), reviewed SHA fdefeee

The same reviewer, clean-room clone at the fixed head, probes under .review/; CI green. The report verbatim:

Verified

• Nested msg.txt/pr.md are excluded before emptiness checks; both directory probes pass.
• Odd backticks fail closed; balanced spans remain exempt.
• Each regression test fails when its corresponding fix is reverted.
• Fix commit changes only the three scoped files.

merge: yes
reviewed SHA: fdefeeeb970549152498f50891e9f133fdc6c5b6

Disposition: the round-1 HIGH and MEDIUM are fixed; no further round. Merged on the standing rule. Same vendor as the builder, not a cross-vendor claim.

[github-actions]

🎉 Thank you for your contribution to Judgment Pack!

If you’d like another task, choose a path that interests you:

• Go runtime
• Judgment desk
• Gateway and provenance
• Python and evaluator experiments
• Specification and documentation
• Agent harness and adapters