[kikashy]

Explicit Policy format 1.0.0 now uses the published Policy offline-reader draft through the existing shared Runtime reader and CLI/MCP tools. The release pin is Spec 0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94; capabilities/results identify draft, and editing schemas identify the official HTTPS source separately from derived Runtime resources.

Promotion changes no retained Policy/adoption artifact bytes. Prototype 0.0.2 defaults/reports and legacy candidate resources stay unchanged. Strict consumers of the complete old candidate report must deliberately adopt the new provenance/maturity; Desk is doing that in Judgment-Pack/judgment-pack-desk#534 while preserving exact historical checks. Existing experimental command/tool and candidate result member names remain transport compatibility names. No approval, live authority, automatic migration, source fetch, stable maturity or full-Core claim is added.

The complete actual 387-file published bundle has per-file provenance and a separate manifest pin; the release gate validates it. The existing Go reader matches all 124 official corpus results, and the unchanged original Python reader matches the same rows plus its 16 contract tests. Affected Policy/releasecheck/MCP packages, focused CLI/parity and claim-surface checks, vet, and three real offline Desk integrations passed. Local full CLI testing encountered a sandbox socket restriction; required repository CI remains a merge gate.

Prepares Runtime v0.37.0 release notes/changelog. Publication still requires green CI, exact merged source, signed tag, verified draft archives/checksums/attestations/native checks and production approval; OCI/MCP follow-on checks remain required. Held v0.35.0 stays unpublished, and this work does not interrupt the running local Desk.

Material-decision impact: public-surface, documented-claim, conformance, security, dependency; review: #299 (comment) (independent same-vendor, existing temporary different-vendor waiver).

Closes #293.

[kikashy]

Bounded independent review: Runtime official Policy draft adoption

Date: 2026-10-19. Actual reused reviewer selection: OpenAI gpt-6.1-sol / xhigh, retained from the earlier Spec review; no model switch is claimed. This is a separate reviewer from the implementation builder, using the same vendor under the maintainer's supplied standing temporary different-vendor waiver. It supplies neither cross-vendor review nor independently authored implementation evidence.

Exact reviewed artifact

• Checkout: /tmp/jps-policy-official-runtime-adoption.
• Reviewed commit: 7c59c614851c1eb24bb91d316e0129d0e6a7a0c2.
• Tree: b00e7610c1874fc04ac08e9633c77039ea9c06e2.
• Parent/base: 20d6bf86b23f1794340fdc648201dda2e80a4095.
• Independently verified HEAD, tree and parent above; worktree is clean. git diff --check over the complete base-to-HEAD diff passes. The handoff's earlier uncommitted description is superseded by this verified committed identity; its tree agrees exactly.
• Scope: the new official archive/provenance import, executable integration and release guard, changed CLI/MCP descriptions/report/schema identities, ADR-0061, maintained adoption/compatibility documentation, changelog 0.37.0 and prepared release notes. Read the Runtime material-decision rule in docs/adr/README.md and the relevant VERSIONING.md provisions. No Desk implementation review is included.

Complete findings

No actionable P1/P2 correctness, security, compatibility or false-claim issue was found in the reviewed artifact. No requested source fix is issued.

Accepted basis

1. Exact published-source import and integrity. Independently read the cached archive and compared its complete regular-file inventory and bytes with internal/policy/official/, excluding only the new provenance manifest. All 387 archive files are present at their original paths with identical bytes; there are no extra/missing imported files. Every manifest file hash and length matches. Archive SHA-256 is ce9bac7fc4a9e2658146a540966aec1e935e7624ba5a7ad70ff074319078b6b9. Provenance manifest SHA-256 matches the separate code pin 398735dc63478806ff77d75af61ef3dd76459ffbef454cb4bdb1b25bc54f3e25; its release is policy-v1.0.0-draft.1 and source commit is 0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94. This checks import/provenance rather than repeating review of unchanged Spec grammar or archived RFC material.
2. Fail-closed artifact and resolver path. internal/policy/official.go:19 independently pins the manifest; :33 validates release/source/format/maturity identity, every file's bytes and complete inventory. internal/policy/candidate_schema.go:30 invokes that guard before compilation, and internal/releasecheck/check.go:34 makes it a release check. .gitattributes protects official bytes from text conversion. The unchanged compiler's offlineSchemaLoader refuses external resources; new HTTPS identities are registered from embedded bytes. No network resolver or acquisition behavior is introduced.
3. Separate upstream and derived schema identities. Raw official schemas retain their published HTTPS IDs. internal/policy/schema.go:95 gives the self-contained editing copies distinct release-specific Runtime URNs, and :106 exposes upstream resource.sourceId. Inspection of both saved actual schema reports confirms these identities and that every $ref is local. Prototype omission of sourceId preserves its JSON shape.
4. Exact draft metadata with scoped results. internal/policy/format.go:16, :25 and :70 consistently name the official immutable source and draft maturity while retaining the existing experimental host namespace and report member names. The saved actual contract has the expected exact source revision/URL, format/profile, false authority/full-document flags and no specRelease field. Its capability value agrees with the official capability artifact, retained at SHA-256 2c6d87b7b925358c71f0d98a23c599fe024d841178c2458ccfc3c74674555ecf. finishCandidateCheck emits the finite portable object only for full checks; the unchanged check path excludes environment/setup failures from that result. Narrow encoding/local-validation operations retain their narrower semantics.
5. Compatibility and shared-engine isolation. The executable diff changes official resource selection, schemas/provenance and advertised metadata rather than introducing another reader or changing Core decoding, raw numeric/URI handling, registration/anchor/coverage logic, private material bounds or MCP transport ceilings. No diff exists under the old candidate/prototype trees, shared Core/validation/carrier/artifact packages or CONFORMANCE.md. The existing prototype default report remains unchanged; the actual saved prototype contract contains no official-only fields. Docs, ADR and changelog explicitly identify changed metadata, scope strings and editing IDs so strict consumers can deliberately repin; they do not silently relabel historical reports or migrate artifact bytes, approvals, Jobs or authority. The new optional output field retains the existing extensible output shape, consistent with VERSIONING.md's added-member rule; the documented intentional 0.x adoption change receives a minor release.
6. Claims and release preparation. ADR-0061 is proposed pending the normal review/merge transition; ADR-0060's accepted text remains unchanged, with a named partial-supersession annotation in its index. Maintained docs and the complete prepared 0.37.0 notes describe draft support, no stable/independent-authorship claim, unchanged conformance scope, retained source bytes and explicit migration boundaries. They do not treat a passing check as current authority or full Core semantics. The notes disclose required CI, final merged pin, archives/checksums/attestations/native smoke and publication as outstanding gates. The 0.0.0-dev Desk test binary is expressly test-only rather than a release/attestation pin.

Verification evidence reused and limits

Reused the supplied focused passing evidence: Policy/releasecheck package tests (including all 124 complete official results and tamper/missing/extra coverage), MCP tests, affected CLI/CLI-MCP parity and maintained-claim checks, affected go vet, the official reference harness's 124 results and all 16 reference contract tests, and three non-skipped Desk integrations against the frozen real development binary. Reviewed the relevant test changes and actual saved contract/prototype/schema reports. These results are supplied builder/consumer evidence; this reviewer did not repeat the tests or run the development binary.

Independently checked archive/vendor/provenance bytes and saved-report identities as described above. No broad tests, builds, services/listeners, provider/Job operations, source edits, commits/pushes, release changes, public comments or subdelegation occurred during this review. Only this /tmp report was written.

The cached /tmp/jps-policy-draft-verified.json is a readiness snapshot whose release metadata still has draft: true at its capture time. It was used here for cached archive/source/attestation context, not as fresh proof of current GitHub publication. Current official publication was supplied explicitly by the coordinator; this review performed no network download, cryptographic attestation rerun or remote publication-state audit. The cached archive integrity is independently verified locally above.

The attempted broad CLI package run's existing httptest socket restriction is recorded in the handoff; focused Policy tests passed. Required full repository CI remains the full-suite gate. The maintainer must record this exact commit, same-vendor exception and disposition on the material PR, complete ADR procedure on merge, and complete separate Runtime release/native/publication gates. No current release or account state, final CI success or consumer release pin is inferred from this report.

Literal review task

This is the verbatim launch task supplied by the coordinator, not a claim that it reproduces inherited system/developer/tool policies or subsequently read repository context.

Independent bounded read-only review of Runtime official Policy adoption. Retain actual launch GPT-6.1 Sol/xhigh from earlier Spec review; no model switch claimed. Independent SAME-vendor review under user's standing temporary different-vendor waiver. Both implementation builders stopped; at most2 active, no delegation. No source mutations, commits/pushes, listeners/services, provider/Jobs, release changes or broad tests.
Exact Runtime clone /tmp/jps-policy-official-runtime-adoption, commit7c59c614851c1eb24bb91d316e0129d0e6a7a0c2, treeb00e7610c1874fc04ac08e9633c77039ea9c06e2, base20d6bf86b23f1794340fdc648201dda2e80a4095. Handoff /tmp/jps-policy-official-runtime-current.md with all focused evidence. Read material review rule + newADR0061/changelog0.37. Official immutable release policy-v1.0.0-draft.1 source0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94; cached verified actual bundle /tmp/jps-release-assets/policy-v1.0.0-draft.1 and /tmp/jps-policy-draft-verified.json. 387 vendor files are complete published bundle (including old/Core reader dependencies), not hand edits; verify import/provenance digest from cache instead of broad rereview of unchanged Spec.
Review new integration and complete release claims/contracts: shared reader, official HTTPS schemas/derived sourceId/new release-specific editing IDs, draft metadata/capabilities/results, prototype default/report bytes preserved, legacy candidate vendor intact; no artifact/approval/Job migration or Core JSON/number/URI/pin changes. Existing experimental host namespace and candidateCapabilities/candidateResult names intentionally retained, no new specRelease field, authority/fullCore flags remain false. Full check alone exact portable result, narrow ops don't overclaim. Offline-only/schema resolver no network. Release gate enforces official provenance, LF bytes/immutable source. Reuse actual124 corpus + affected package/CLI/MCP/parity/vet/reference16 checks and Desk3 real dev-binary integrations; no broad retests. Full CLI socket sandbox failure recorded; required CI handles it. Test-only binary0.0.0-dev never publication pin.
Find actionable P1/P2 correctness/security/compatibility/false-claim issues only. Write /tmp/jps-policy-official-runtime-review.md exact commit/tree/base, findings/evidence/limits. One bounded review; no Desk review yet. Stop after report.

---

Procedural closure: conditional ADR acceptance and exact review record

Date: 2026-10-19. Reused reviewer remains OpenAI gpt-6.1-sol / xhigh. Scope was only the procedural delta from reviewed commit 7c59c614851c1eb24bb91d316e0129d0e6a7a0c2 to new HEAD 631ef046a959e66286f64688d4410c18739acbb1, tree e68f2c0d97a2e6df51be9b8dc8e961fd62bbaa0b. Independently confirmed commit/tree/parent, clean worktree and exactly two changed paths: ADR-0061 and the ADR index. git diff --check passes.

The delta accurately records the original reviewed commit/tree, actual reused reviewer model/effort, no actionable P1/P2 findings, original complete-report hash and honest same-vendor waiver limits. Its accepted status is expressly effective only after required CI and the introducing PR merge. It claims neither completed merge nor Runtime publication, and supplies no fabricated review URL. No product, vendored artifact, test, executable or contract changes are present.

Procedural closure accepted; no finding or requested fix is issued. The original material review remains applicable to unchanged product bytes. The maintainer must post the complete review and this closure on the material PR before merge and complete required CI and later release/publication gates. No tests, builds, broad rereview, network calls, source edits or release actions were performed; only this report was appended. All previous report bytes remain unchanged, original SHA-256 e39bfcada9d0722e7e9d4b7ec18db42f92ab5fa4331e727f29e3751b681e87ea.

Literal procedural-verification brief

Original Runtime review accepted. Verify ONLY procedural two-doc delta 7c59c614→631ef046a959e66286f64688d4410c18739acbb1, new tree e68f2c0d97a2e6df51be9b8dc8e961fd62bbaa0b, in same clone. Only ADR0061 and ADR index: records exact reviewed7c59 tree, honest same-vendor waiver/no findings, conditional accepted status effective after greenCI+merge, no publication claim/inventedURL. No product/vendor/test/contract changes. Please append narrow procedural closure to existing /tmp/jps-policy-official-runtime-review.md, bind new head/tree, no tests/full rereview. Stop.

[github-actions]

🎉 Thank you for your contribution to Judgment Pack!

If you’d like another task, choose a path that interests you:

• Go runtime
• Judgment desk
• Gateway and provenance
• Python and evaluator experiments
• Specification and documentation