[kikashy]

Summary

Closes #48: the CI template's commented parity example checked the other repository out inside the clone, an untracked, un-ignored path, so check.sh --changed ran the whole list on every pull request.

What changes

• templates/ci-check.yml: the commented parity example still uses the pinned actions/checkout (which places a checkout only under the workspace), then a step moves it to ${{ runner.temp }}/desk-checkout before any check runs and points JPDEV_DESK there. The comment says why the checkout must end up outside the clone. actionlint passes on the example uncommented.
• lib/changed_checks.py and the vendored scripts/dev/changed_checks.py (identical but for line 2): an unmapped path that only git ls-files --others names is reported as untracked path PATH is not mapped; a workflow-created path belongs outside the clone or in .gitignore: whole list; a tracked unmapped path keeps unmapped path PATH: whole list. Selection is unchanged.
• docs/adopting.md: step 4, the worked example and "Changed-path check selection" say that any untracked, un-ignored path a workflow creates inside the clone defeats --changed and must live outside the clone or be ignored, and quote the report line.
• tests/changed_checks_test.py: the report text for an untracked unmapped path next to a tracked one, an ignored workflow path that leaves the selection scoped, and the existing untracked case updated; each runs through both jpdev check and the vendored check.sh. The tests/run.sh comparison of the two selection files passes unchanged.

Mutant: reporting every unmapped path with the plain reason fails 4 tests (both new-text tests, through both runners).

Public surface

The selection report's whole-list reason for an unmapped untracked path (new text); the commented example in templates/ci-check.yml; docs.

Checks

== jpdev check --changed: 5 changed paths since origin/main (merge base 250b07a) ==
selection input changed: scripts/dev/changed_checks.py: whole list
== whole list: 8 checks ==
PASS     diff-check, local-paths, agent-docs, bash-n, duplication, json, shellcheck
PASS     tests                    100s
    439 passed, 0 failed
== 8 passed, 0 failed, 0 skipped, 0 not run ==

Sign-off

Every commit carries a Developer Certificate of Origin sign-off that matches its author.

🤖 Generated with Claude Code

[kikashy]

Narrow review: devkit #49 (issue #48) and #50 (issue #46)

#49 (e779849 on 250b07a): the parity example now moves its checkout out of the clone before any check runs, and an unmapped untracked path gets its own reason; no findings.
#50 (406a87d on 250b07a): the clean tests' git helper closes stdin unless given input, and a socketpair test holds the hang shut; no findings. Same-vendor review, not a cross-vendor claim.

#49 dispositions

Finding	Severity	Evidence	What to do
none	-	Move step precedes check.sh --setup, the first check.sh call; mv takes the whole directory; an empty untracked directory is not a changed path (selection returned no paths); actionlint on the uncommented example: clean (shellcheck present)	-
none	-	Untracked unmapped path gets the new reason, a staged unmapped path keeps unmapped path ...; a checkout left inside with its own .git is reported as untracked; lib and vendored copies identical after the vendored header line	-
none	-	Mutant "plain reason for every path": 3 failures; reverse mutant "untracked reason for every path": 4 failures	-
none	-	Docs state the rule plainly (outside the clone or in .gitignore, else whole list on every pull request); public text clean	-

#50 dispositions

Finding	Severity	Evidence	What to do
none	-	Helper: stdin DEVNULL unless input=, 60 s timeout, mktree fed input=''; clean.run() already passes stdin=DEVNULL; the only stdin-reading git subcommand in lib/, tests/, scripts/, bin/ is mktree (other git calls inherit stdin but do not read it)	-
none	-	Socketpair test passes (0.2 s); mutant "helper inherits stdin": fails at its 60 s timeout with the named message; mutant "DEVNULL removed from clean.run()": errors with verification unavailable: git at 30 s; no stray process left	-
none	-	tests/run.sh with a socketpair on stdin: exit 0, 439 passed, 0 failed (137 s)	-

What I ran

• Python 3.12.11, ulimit -v 4000000, timeout on every run; scratch copies only, deleted after use; no tracked file changed.
• CI template: check a parity repository out outside the clone (#48) #49, stdin closed: tests/changed_checks_test.py (55 OK); tests/run.sh (439 passed, 0 failed); two reason mutants; actionlint; empty-directory and nested-checkout probes against the selection module.
• clean tests: never hand a git call the runner's stdin (#46) #50: socketpair test, tests/clean_test.py with a socketpair on stdin (68 OK), both builder mutants, tests/run.sh with a socketpair on stdin.

#49 merge: ready, no HIGH, no MEDIUM, no LOW.
#50 merge: ready, no HIGH, no MEDIUM, no LOW.

[github-actions]

🎉 Thank you for your contribution to Judgment Pack!

If you’d like another task, choose a path that interests you:

• Go runtime
• Judgment desk
• Gateway and provenance
• Python and evaluator experiments
• Specification and documentation
• Agent harness and adapters