Prepare jpdev v0.7.0

docs/releases/v0.7.0.md

@@ -0,0 +1,53 @@
+# jpdev v0.7.0
+
+This release adds explicit session cleanup and keeps builder temporary files beneath scratch
+([issue #30](https://github.com/Judgment-Pack/judgment-pack-devkit/issues/30),
+[pull request #31](https://github.com/Judgment-Pack/judgment-pack-devkit/pull/31)).
+
+## Session cleanup
+
+`jpdev clean` defaults to a dry run with no implicit roots. Initialize an empty session-created
+root with `clean init`, then explicitly seal completed disposable paths with `clean seal`.
+Cleanup reports root-relative candidates, logical sizes, reasons, totals and per-path outcomes.
+Deletion requires `--yes` and all ownership and safety checks to pass.
+
+The default age threshold is seven days. Transcript candidates also have an inclusive 10 MiB
+logical regular-file size floor, adjustable with `--min-transcript-bytes N`; zero disables that
+floor. Exact paths in `.jpdev-clean-keep` protect reserves. Supported candidate kinds are
+worktrees, reviewer directories/clones, transcripts, scratch associated with a removed worktree,
+and shared caches whose base has no linked worktree users.
+
+Cleanup requires explicit disposal evidence for every included file, including ignored,
+untracked and review evidence. It refuses changed content, unpublished commits, tracked/index
+changes, live process use, protected paths, symlinks, nested repositories, mount crossings and
+unavailable verification evidence. Bare or saved Git metadata, inherited Git evidence
+redirection, and assume-unchanged/skip-worktree index flags are refused. Git publication and,
+where applicable, closed/merged pull-request evidence remain mandatory.
+
+The tool checks evidence again after quarantine and during descriptor-relative removal.
+Cache users and associated-worktree absence are checked throughout removal, including before
+the final directory is removed. Git administrative entries and branch refs are retained.
+
+## Builder temporary files
+
+`jpdev codex run` creates `TMPDIR` beneath the builder's effective scratch, replacing an inherited
+temporary directory. The brief template and cleanup policy document session-prefixed scratch and
+disposal ownership. Mutation copies exclude nested scratch, temporary storage and the copy
+destination while retaining ordinary source siblings. Repository fixtures handle clone-local
+temporary storage, and check summaries retain the names of failing test cases.
+
+## Operating limits
+
+Existing unmarked roots cannot be adopted for cleanup. Complete initial Linux host process,
+mount and root visibility is required; containers, sandboxes and inaccessible process evidence
+cause refusal. System/global Git configuration is disabled during verification, so authentication
+that depends on it may be unavailable and cause refusal.
+
+A refusal during removal can leave a partially removed candidate. Remaining content is restored
+when its original name is vacant, or retained in quarantine for assessment. The operation does
+not provide transactional rollback or isolation from a malicious process with the same user
+identity. See [Scratch and cleanup](https://github.com/Judgment-Pack/judgment-pack-devkit/blob/v0.7.0/docs/policy.md#scratch-and-cleanup)
+for formats and procedures.
+
+This release is limited to the Devkit change. Adoption or re-vendoring in other repositories is
+separate work.

lib/common.sh

@@ -3,7 +3,7 @@
 # Sourced by bin/jpdev and lib/wrap.sh. Needs bash 5.
 
 # shellcheck disable=SC2034  # read by bin/jpdev
-JPDEV_VERSION=0.6.0
+JPDEV_VERSION=0.7.0
 
 # Every setting jpdev reads. The environment wins over the config file, the config file over the default.
 JPDEV_SETTINGS=(JPDEV_SCRATCH JPDEV_LOCK JPDEV_NODE_RSS_MB JPDEV_NODE_TIMEOUT_S JPDEV_GO_ULIMIT_KB

scripts/dev/check.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# from judgment-pack-devkit v0.6.0 (templates/check.sh)
+# from judgment-pack-devkit v0.7.0 (templates/check.sh)
 # scripts/dev/check.sh [--setup] [--only a,b] [--skip a,b] [--all] [--manifest FILE]
 # Runs the checks of dev.json in order and prints one summary block; exit status = failures.
 # Stops at the first failure unless --all. --setup runs the manifest's setup steps instead.

scripts/dev/handover_check.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# from judgment-pack-devkit v0.6.0 (lib/handover_check.sh)
+# from judgment-pack-devkit v0.7.0 (lib/handover_check.sh)
 set -eu
 
 python3 - <<'PY'

templates/check.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# from judgment-pack-devkit v0.6.0 (templates/check.sh)
+# from judgment-pack-devkit v0.7.0 (templates/check.sh)
 # scripts/dev/check.sh [--setup] [--only a,b] [--skip a,b] [--all] [--manifest FILE]
 # Runs the checks of dev.json in order and prints one summary block; exit status = failures.
 # Stops at the first failure unless --all. --setup runs the manifest's setup steps instead.