From 1dfbb36a4a37e7e96692c81b300049149acf9c57 Mon Sep 17 00:00:00 2001 From: kikashy Date: Wed, 21 Oct 2026 07:50:04 -0400 Subject: [PATCH] Re-vendor the devkit pair and check.sh at v0.4.0 AGENTS.md and CLAUDE.md carry the kit's "Before you hand over" section (the builder's self-checks, scoped-then-whole checks, additive shared paths, the severity line) above this repository's own section; scripts/dev/check.sh is the v0.4.0 template; dev.json gains the handover lists where this repository names them. Co-Authored-By: Claude Fable 5.1 Signed-off-by: kikashy --- AGENTS.md | 30 ++++++++++++++++++++++++++++++ CLAUDE.md | 30 ++++++++++++++++++++++++++++++ dev.json | 6 +++++- scripts/dev/check.sh | 6 +++++- 4 files changed, 70 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 78efd13..b61f5b4 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -11,6 +11,36 @@ Edit `AGENTS.md` and run `scripts/sync-agent-docs.sh` to regenerate `CLAUDE.md`. - If a check fails: read its first lines in the block, fix the cause, re-run that one check with `--only NAME`, then run the whole list once more. Do not loop on the whole list. - Start no CI watch. Push, report once, and stop; CI owns everything deterministic. +- Push with `jpdev push [BRANCH]`, or where the kit is not installed with + `git -c credential.helper= -c 'credential.helper=!gh auth git-credential' push -u origin BRANCH`. + The machine's stored git credential can be another account's, and a plain `git push` is then + refused; the helper form uses the `gh` login. Never store a credential, never change global git + configuration, never push with force (`jpdev push` refuses `--force` and `-f`). + +## Before you hand over + +Run these self-checks on the builder's own head before writing the commit message: + +- (a) The boundary paths in `dev.json` (`handover.boundary_paths`) show no admission or verdict + change unless the issue names one: `git diff origin/main...HEAD -- ` contains additions to + offer tables or new paths only. +- (b) Every schema member and enum value the change adds is carried by at least one vector: remove + it from a scratch copy of the schema and a vector fails. +- (c) Where two languages read the same vectors, both readers pass over everything added. +- (d) Every mutation row added is caught, and its twin in the other language is caught by hand. +- (e) Every refusal path added emits an event that validates with a malformed input: empty, + missing or oversized. +- (f) An interrupted and resumed run carries every new checkpoint member. +- (g) The design's words and the code agree sentence by sentence. + +Run the check list with `--only ` while iterating and whole exactly once at the end. +Change the paths in `dev.json` `handover.shared_paths` by appending only, never by reordering or +rewriting, because a sibling build may be open. Never fetch, rebase or merge; the coordinator +carries `main` into the branch after the push. + +A HIGH (a path that executes twice, runs without approval, or crosses a boundary the issue did not +open) is fixed in the pull request before review. MEDIUMs named by the review of record are fixed in +the same fix round; a MEDIUM found only on a re-read goes to the pre-release batch. LOW rides. ## Rules diff --git a/CLAUDE.md b/CLAUDE.md index 78efd13..b61f5b4 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -11,6 +11,36 @@ Edit `AGENTS.md` and run `scripts/sync-agent-docs.sh` to regenerate `CLAUDE.md`. - If a check fails: read its first lines in the block, fix the cause, re-run that one check with `--only NAME`, then run the whole list once more. Do not loop on the whole list. - Start no CI watch. Push, report once, and stop; CI owns everything deterministic. +- Push with `jpdev push [BRANCH]`, or where the kit is not installed with + `git -c credential.helper= -c 'credential.helper=!gh auth git-credential' push -u origin BRANCH`. + The machine's stored git credential can be another account's, and a plain `git push` is then + refused; the helper form uses the `gh` login. Never store a credential, never change global git + configuration, never push with force (`jpdev push` refuses `--force` and `-f`). + +## Before you hand over + +Run these self-checks on the builder's own head before writing the commit message: + +- (a) The boundary paths in `dev.json` (`handover.boundary_paths`) show no admission or verdict + change unless the issue names one: `git diff origin/main...HEAD -- ` contains additions to + offer tables or new paths only. +- (b) Every schema member and enum value the change adds is carried by at least one vector: remove + it from a scratch copy of the schema and a vector fails. +- (c) Where two languages read the same vectors, both readers pass over everything added. +- (d) Every mutation row added is caught, and its twin in the other language is caught by hand. +- (e) Every refusal path added emits an event that validates with a malformed input: empty, + missing or oversized. +- (f) An interrupted and resumed run carries every new checkpoint member. +- (g) The design's words and the code agree sentence by sentence. + +Run the check list with `--only ` while iterating and whole exactly once at the end. +Change the paths in `dev.json` `handover.shared_paths` by appending only, never by reordering or +rewriting, because a sibling build may be open. Never fetch, rebase or merge; the coordinator +carries `main` into the branch after the push. + +A HIGH (a path that executes twice, runs without approval, or crosses a boundary the issue did not +open) is fixed in the pull request before review. MEDIUMs named by the review of record are fixed in +the same fix round; a MEDIUM found only on a re-read goes to the pre-release batch. LOW rides. ## Rules diff --git a/dev.json b/dev.json index 766e074..615fc56 100644 --- a/dev.json +++ b/dev.json @@ -19,5 +19,9 @@ {"name": "build", "run": "CGO_ENABLED=0 go build -trimpath -o /dev/null ./cmd/jpack", "toolchain": "go", "timeout": 1200}, {"name": "registry-template", "run": "python3 scripts/check-registry-template.py", "toolchain": "python", "summary": "^registry template:", "timeout": 300} - ] + ], + "handover": { + "boundary_paths": ["internal/evaluation", "internal/policy", "internal/validation", "internal/mcp"], + "shared_paths": ["internal/conformance", "docs/adr"] + } } diff --git a/scripts/dev/check.sh b/scripts/dev/check.sh index d341c9e..1c8e375 100755 --- a/scripts/dev/check.sh +++ b/scripts/dev/check.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# from judgment-pack-devkit v0.2.0 (templates/check.sh) +# from judgment-pack-devkit v0.4.0 (templates/check.sh) # scripts/dev/check.sh [--setup] [--only a,b] [--skip a,b] [--all] [--manifest FILE] # Runs the checks of dev.json in order and prints one summary block; exit status = failures. # Stops at the first failure unless --all. --setup runs the manifest's setup steps instead. @@ -46,6 +46,10 @@ for c in steps: failed += 1 rows.append((n, 'FAIL', '%s, exit %d' % (took, p.returncode), note + [' --'] + [' ' + l for l in lines[:40]] + ([' ... %d more lines' % (len(lines) - 40)] if len(lines) > 40 else []))) print('== %s summary (%s) ==' % ('setup' if opt['setup'] else 'check', os.path.basename(opt['manifest']))) +if not opt['setup'] and 'handover' in m: + h = m['handover'] + print('handover: boundary %d paths, shared %d paths; see AGENTS.md "Before you hand over"' % + (len(h.get('boundary_paths', [])), len(h.get('shared_paths', [])))) for n, s, head, extra in rows: print('\n'.join(['%-8s %-24s %s' % (s, n, head)] + extra)) print('== %d passed, %d failed, %d skipped, %d not run ==' % tuple(sum(1 for r in rows if r[1] == k) for k in ('PASS', 'FAIL', 'SKIP', 'NOT RUN'))) sys.exit(min(failed, 255))