[kikashy]

What changes

• dev.json: every check CI ran, as an ordered step with its toolchain and summary pattern, plus three new ones: the machine-local-path grep, the agent-docs sync check and git diff --check. Nothing CI ran is dropped.
• scripts/dev/check.sh (vendored from the development kit v0.1.0, unchanged) and scripts/sync-agent-docs.sh.
• AGENTS.md and CLAUDE.md (identical): the kit's shared rules, then a "This repository" section.
• scripts/checks/build-pinned.sh: the four checkout-and-build steps (the tested Runtime, the ownership-era Runner, the earlier Runtime, the Gateway) as one step. Each pin is fetched by commit into .ci/ (ignored by git) and built into .ci/bin; the pins, the release names beside them and their comments are as they were in the workflow.
• scripts/checks/manual-gate.sh, unit-tests.sh, chain-tests.sh, release-toolchain.sh, release-programs.sh: the multi-line steps as scripts, unchanged except that binaries are read from .ci/bin instead of $RUNNER_TEMP and the Linux-only assertions test uname -s instead of $RUNNER_OS.
• scripts/checks/local-paths.sh: the grep. Four files are not counted, where a /tmp path is a synthetic example, test input or a command in a design note written before this check existed (docs/design/executor-ownership.md, docs/design/manual-admission-store-prepare-shape.md, docs/design/manual-admission-store-prepare-wire.json, internal/runner/cloud_test.go).
• go fmt plus git diff --exit-code became a gofmt -l check that does not rewrite files; go build of the two programs writes to /dev/null.
• .gitignore: /.ci/. README: a short paragraph on scripts/dev/check.sh and the agent docs, under "Verification".

CI

Before: test ("Runner (ubuntu-latest)", "Runner (macos-latest)") and release-contents ("Release contents").

After: check (job id; still named Runner (<os>), same two operating systems, same 15-minute limit) runs scripts/dev/check.sh --manifest dev.json --only local-paths first, sets up Go 1.26.x, then runs scripts/dev/check.sh --all without the four release steps. release-contents (still "Release contents", Go 1.26.5) runs those four release steps with scripts/dev/check.sh --all --only .... workflow_call is kept and release.yml is not changed.

Required status checks on main, all kept as job names: Runner (ubuntu-latest), Runner (macos-latest), Release contents, DCO. The runner has not been run on a macOS runner before this pull request; its CI run is that first run.

Checks

scripts/dev/check.sh --all, run once from the clone root at the head commit, with Python 3.12:

== check summary (dev.json) ==
PASS     local-paths              0s
PASS     agent-docs               0s
    sync-agent-docs: CLAUDE.md matches AGENTS.md
PASS     diff-check               0s
PASS     go-fmt                   0s
PASS     go-vet                   0s
PASS     build-pinned             0s
PASS     manual-gate              11s
    13 lines matched; last: ok  	github.com/Judgment-Pack/judgment-pack-runner/internal/runner	10.811s
PASS     unit-tests               561s
    5 lines matched; last: ok  	github.com/Judgment-Pack/judgment-pack-runner/internal/runner	558.391s
PASS     chain-tests              10s
    ok  	github.com/Judgment-Pack/judgment-pack-runner/internal/runner	10.277s
    ok  	github.com/Judgment-Pack/judgment-pack-runner/cmd/jpack-runner	5.834s
PASS     openapi                  0s
PASS     build                    1s
PASS     release-toolchain        0s
PASS     third-party-notices      0s
PASS     release-archives         64s
    Ran 59 tests in 64.586s
    OK
PASS     release-programs         0s
== 15 passed, 0 failed, 0 skipped, 0 not run ==

actionlint .github/workflows/ci.yml: clean. git diff --check: clean.

Material-decision impact: tooling and CI (no product code); a narrow review follows, run by the coordinator.

🤖 Generated with Claude Code

[kikashy]

Narrow review record (same vendor, not a cross-vendor claim)

Reviewer: one clean-room Claude Sonnet agent over the five adoption pull requests (runtime #300, gateway #302, runner #163, spec #220, exchange #31), read-only, no suite re-run; CI logs and workflow diffs read. The common part and this repository's part of the verbatim report follow.

---

All five repositories:

• scripts/dev/check.sh is byte-identical to the devkit's templates/check.sh. It has no version comment at all (LOW: nothing in the file records v0.1.0; the PR body says so).
• scripts/sync-agent-docs.sh is identical.
• AGENTS.md and CLAUDE.md are identical to each other. Against the template, AGENTS.md differs only by the appended "## This repository" section, and no template line changed.
• The agent-docs step in dev.json checks CLAUDE.md against AGENTS.md (as in agent PR Prepare research dialect sources from retained responses and produce replayable fixtures #88). Nothing in CI compares them to the template.
• No product files are touched: the changed files are only workflows, scripts, the four docs files, dev.json and ignore or attribute files. runtime also edits docs/adr/template.md (one trailing space removed) and adds scripts/check-registry-template.py.
• git diff --check is clean, actionlint is clean, and there is no personal name or machine-local path in any added line.
• No manifest step uses optional or requires_env.
  runner Adopt the development kit: dev.json, scripts/dev/check.sh, AGENTS.md and CLAUDE.md, CI #163, head b9d0777
• Finding (LOW): local-paths.sh excludes two design docs as whole files. docs/design/executor-ownership.md has GOCACHE=<tmp>/jps-policy-coverage-go-cache. docs/design/manual-admission-store-prepare-shape.md has <tmp>/jps-policy-manual-admission-store-prepare-wire.json. Both are session scratch paths in public docs. The wire.json and cloud_test.go exclusions are synthetic or test data and are fine. The PR body discloses all four.
• Finding (LOW): the ubuntu leg took 10m36s against its 15-minute limit. The old test job had the same 15-minute limit, and unit-tests alone was 559s. That leaves little headroom.
• Q1: The contexts Runner (ubuntu-latest), Runner (macos-latest), Release contents and DCO all still exist as job names. The old steps all map to dev.json steps: fmt, vet, the four pinned builds (now build-pinned), manual-gate, unit-tests (go test -race), chain-tests, openapi, build, and the four release steps. workflow_call is kept. The grep is new.
• Q2: Template files match, as above.
• Q3: Every step is real. The old go fmt plus git diff --exit-code became gofmt -l.
• Q4: The macOS leg, exercised for the first time, passed all 11 non-release steps, 0 skipped. The ubuntu leg passed 11 of 11. The Release contents job ran its 4 steps, 4 passed.
• Q5: Clean.

Verdict: mergeable — head b9d0777

---

Disposition

Finding	Disposition
two design docs excluded whole, holding scratch paths	Runner issue: replace the paths with <scratch> and drop the exclusions.
the ubuntu leg at 10m36s of a 15-minute limit	The same issue: raise the job's limit to 25 minutes.
Merged on green CI.