Re-vendor the devkit pair and check.sh at v0.4.0

AGENTS.md

@@ -11,6 +11,36 @@ Edit `AGENTS.md` and run `scripts/sync-agent-docs.sh` to regenerate `CLAUDE.md`.
 - If a check fails: read its first lines in the block, fix the cause, re-run that one check with
   `--only NAME`, then run the whole list once more. Do not loop on the whole list.
 - Start no CI watch. Push, report once, and stop; CI owns everything deterministic.
+- Push with `jpdev push [BRANCH]`, or where the kit is not installed with
+  `git -c credential.helper= -c 'credential.helper=!gh auth git-credential' push -u origin BRANCH`.
+  The machine's stored git credential can be another account's, and a plain `git push` is then
+  refused; the helper form uses the `gh` login. Never store a credential, never change global git
+  configuration, never push with force (`jpdev push` refuses `--force` and `-f`).
+
+## Before you hand over
+
+Run these self-checks on the builder's own head before writing the commit message:
+
+- (a) The boundary paths in `dev.json` (`handover.boundary_paths`) show no admission or verdict
+  change unless the issue names one: `git diff origin/main...HEAD -- <paths>` contains additions to
+  offer tables or new paths only.
+- (b) Every schema member and enum value the change adds is carried by at least one vector: remove
+  it from a scratch copy of the schema and a vector fails.
+- (c) Where two languages read the same vectors, both readers pass over everything added.
+- (d) Every mutation row added is caught, and its twin in the other language is caught by hand.
+- (e) Every refusal path added emits an event that validates with a malformed input: empty,
+  missing or oversized.
+- (f) An interrupted and resumed run carries every new checkpoint member.
+- (g) The design's words and the code agree sentence by sentence.
+
+Run the check list with `--only <touched steps>` while iterating and whole exactly once at the end.
+Change the paths in `dev.json` `handover.shared_paths` by appending only, never by reordering or
+rewriting, because a sibling build may be open. Never fetch, rebase or merge; the coordinator
+carries `main` into the branch after the push.
+
+A HIGH (a path that executes twice, runs without approval, or crosses a boundary the issue did not
+open) is fixed in the pull request before review. MEDIUMs named by the review of record are fixed in
+the same fix round; a MEDIUM found only on a re-read goes to the pre-release batch. LOW rides.
 
 ## Rules
 

CLAUDE.md

@@ -11,6 +11,36 @@ Edit `AGENTS.md` and run `scripts/sync-agent-docs.sh` to regenerate `CLAUDE.md`.
 - If a check fails: read its first lines in the block, fix the cause, re-run that one check with
   `--only NAME`, then run the whole list once more. Do not loop on the whole list.
 - Start no CI watch. Push, report once, and stop; CI owns everything deterministic.
+- Push with `jpdev push [BRANCH]`, or where the kit is not installed with
+  `git -c credential.helper= -c 'credential.helper=!gh auth git-credential' push -u origin BRANCH`.
+  The machine's stored git credential can be another account's, and a plain `git push` is then
+  refused; the helper form uses the `gh` login. Never store a credential, never change global git
+  configuration, never push with force (`jpdev push` refuses `--force` and `-f`).
+
+## Before you hand over
+
+Run these self-checks on the builder's own head before writing the commit message:
+
+- (a) The boundary paths in `dev.json` (`handover.boundary_paths`) show no admission or verdict
+  change unless the issue names one: `git diff origin/main...HEAD -- <paths>` contains additions to
+  offer tables or new paths only.
+- (b) Every schema member and enum value the change adds is carried by at least one vector: remove
+  it from a scratch copy of the schema and a vector fails.
+- (c) Where two languages read the same vectors, both readers pass over everything added.
+- (d) Every mutation row added is caught, and its twin in the other language is caught by hand.
+- (e) Every refusal path added emits an event that validates with a malformed input: empty,
+  missing or oversized.
+- (f) An interrupted and resumed run carries every new checkpoint member.
+- (g) The design's words and the code agree sentence by sentence.
+
+Run the check list with `--only <touched steps>` while iterating and whole exactly once at the end.
+Change the paths in `dev.json` `handover.shared_paths` by appending only, never by reordering or
+rewriting, because a sibling build may be open. Never fetch, rebase or merge; the coordinator
+carries `main` into the branch after the push.
+
+A HIGH (a path that executes twice, runs without approval, or crosses a boundary the issue did not
+open) is fixed in the pull request before review. MEDIUMs named by the review of record are fixed in
+the same fix round; a MEDIUM found only on a re-read goes to the pre-release batch. LOW rides.
 
 ## Rules
 

dev.json

@@ -19,5 +19,9 @@
     {"name": "build", "run": "CGO_ENABLED=0 go build -trimpath -o /dev/null ./cmd/jpack", "toolchain": "go", "timeout": 1200},
     {"name": "registry-template", "run": "python3 scripts/check-registry-template.py", "toolchain": "python",
      "summary": "^registry template:", "timeout": 300}
-  ]
+  ],
+  "handover": {
+    "boundary_paths": ["internal/evaluation", "internal/policy", "internal/validation", "internal/mcp"],
+    "shared_paths": ["internal/conformance", "docs/adr"]
+  }
 }

scripts/dev/check.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# from judgment-pack-devkit v0.2.0 (templates/check.sh)
+# from judgment-pack-devkit v0.4.0 (templates/check.sh)
 # scripts/dev/check.sh [--setup] [--only a,b] [--skip a,b] [--all] [--manifest FILE]
 # Runs the checks of dev.json in order and prints one summary block; exit status = failures.
 # Stops at the first failure unless --all. --setup runs the manifest's setup steps instead.
@@ -46,6 +46,10 @@ for c in steps:
     failed += 1
     rows.append((n, 'FAIL', '%s, exit %d' % (took, p.returncode), note + ['    --'] + ['    ' + l for l in lines[:40]] + (['    ... %d more lines' % (len(lines) - 40)] if len(lines) > 40 else [])))
 print('== %s summary (%s) ==' % ('setup' if opt['setup'] else 'check', os.path.basename(opt['manifest'])))
+if not opt['setup'] and 'handover' in m:
+    h = m['handover']
+    print('handover: boundary %d paths, shared %d paths; see AGENTS.md "Before you hand over"' %
+          (len(h.get('boundary_paths', [])), len(h.get('shared_paths', []))))
 for n, s, head, extra in rows: print('\n'.join(['%-8s %-24s %s' % (s, n, head)] + extra))
 print('== %d passed, %d failed, %d skipped, %d not run ==' % tuple(sum(1 for r in rows if r[1] == k) for k in ('PASS', 'FAIL', 'SKIP', 'NOT RUN')))
 sys.exit(min(failed, 255))