[kikashy]

Closes #70. Milestone: v0.14.0. One issue per PR; stack order #70 → #65 → #69 → #71.

Summary

The pinned API omits merge_commit_sha, so the old gate always fell back to fresh checks with a generic KeyError. The candidate binds the merged PR to the commit through exactly one server-recorded timeline merged event and reuses that complete timeline for existing base-change checks.

Public surface

The reuse admission binding and named reuse-pull-request refusals. No schema, version, consumer pin or publication-policy change.

Acceptance mapping

Requirement	Implementation	Verification	Remaining gate
Pinned API shape	Captured read-only response projections and consumed-field inventory	Captured merge binding passes without the obsolete field; missing, malformed, wrong and ambiguous events refuse	Complete: reviewed, exact-head CI passed, merged and released in v0.14.0
Preserve trusted binding	All existing repository, branch, run, tree, parent, input and artifact checks retained	167 release-evidence tests pass; three safeguard-removal controls fail at intended assertions	Complete: reviewed, exact-head CI passed, merged and released in v0.14.0
Reported live plan	Original source/configuration, live API and digest-verified original runtime/environment inputs	Run 41149914554 plan replay decides reuse for 21 checks	Released in v0.14.0; consumer adoption separate

Live replay details: the reported consumer source 52441d17bc33b9a0346047bff02b469db93dc84d; PR run 41145567567 attempt 1; admitted artifact 13022755912, SHA-256 a47477e6f51254b6fcb00d1da91fae5b160f2ef4725973d0cd5c59918af2c380. Original main runtime/environment inputs came from artifact 13023513896, SHA-256 e20e6f51dc8884906da0937cb0016c53a48a51a0f0c9266e832fb5f86ed85d3a. The replay called the actual plan function with live API responses, replaying those original runtime/environment inputs instead of claiming the local workstation was the hosted runner. It did not execute or reuse consumer CI checks. No admission check was disabled.

An initial replay used the devkit working directory and therefore the wrong dev.json; that diagnostic failure was retained, and the final replay used an isolated original-source snapshot. The initial focused invocation also named a nonexistent test class; corrected invocation passed. These setup errors are not acceptance evidence.

Checks

PR head: 138c9f99785a1aa7c41ee9f580bd965ce58bfa49.

The full checklist ran once on the clean integrated batch head a8ec74e2b70608d350f5cca740ec777fa41fdb7d, using scripts/dev/check.sh --all under the configured shared lock. No uncommitted diff. This batch result does not replace exact-head CI for the individual PRs. Only the machine-local interpreter path is omitted from this runner summary:

== check summary (dev.json) ==
PASS     diff-check               0s
PASS     local-paths              0s
PASS     agent-docs               0s
    sync-agent-docs: CLAUDE.md matches AGENTS.md
    sync-agent-docs: CLAUDE.md matches AGENTS.md
PASS     bash-n                   0s
    bash -n: every script parses
PASS     duplication              0s, python [interpreter path omitted] (Python 3.12.11)
    duplication: no duplicate block (at least 100 tokens over at least 10 lines, 23 files of python, shell)
PASS     json                     0s, python [interpreter path omitted] (Python 3.12.11)
    parsed 14 JSON documents
PASS     shellcheck               4s
    shellcheck: clean
PASS     tests                    110s
    449 passed, 0 failed
== 8 passed, 0 failed, 0 skipped, 0 not run ==

Review and release status

Authored, executed, independently reviewed and merged into main as fa51ef5b156ee82b86ea68d3deaf913ffee2b2ff. Exact-head lint, tests and DCO passed before merge. Review record reports no findings and includes the clean-room security round; it identifies the same-vendor reviewer and actual model. The merged tree exactly matches the reviewed candidate. Published in v0.14.0; release verification record. Consumer rollout remains a separate gate.

Sign-off

Commits carry the repository-required sign-off.

[kikashy]

Independent security review of judgment-pack-devkit PR #74 / issue #70.

Head: 138c9f99785a1aa7c41ee9f580bd965ce58bfa49
Base: 939b0377e57e1d09964e3b4d5dc4c45ad70c7854

Reviewer: OpenAI, gpt-6.1-sol, high reasoning, selected for the admission boundary. This is an independent same-vendor review, not cross-vendor review.

Clean-room scope: repository instructions, policy, issue #70, and the pinned diff with relevant contract context; no builder reasoning or PR description.

Findings: none.

The change requires exactly one server timeline merged event bound to the requested commit and preserves the existing repository, branch, head, base-change, run and evidence checks. The complete timeline supplies both merge binding and base-change detection.

Evidence inspected:

• Changed implementation, vendored copy, documentation, captured API shapes and regression assertions.
• Six additional malformed-response and pagination probes: all returned fresh, reuse-pull-request, and no reused coverage.
• Scratch removal of uniqueness and exact-commit safeguards: each failed its intended refusal assertion; restored safeguards passed.
• Live API replay script and output: reuse, with candidate checksum matching this head. The replay supplied recorded original runtime/environment inputs.
• Reused verified exact-head CI run 41312850621: lint/tests and DCO successful.

Limits: no broad suites or live replay were rerun by this reviewer. Replay evidence demonstrates the plan with recorded runner inputs, not a fresh hosted-runner execution. No tracked files or Git state changed.

Disposition:

Finding	Action
None	Clean-room review complete; exact-head CI and DCO passed. Ready for the authorized merge.

[github-actions]

🎉 Thank you for your contribution to Judgment Pack!

If you’d like another task, choose a path that interests you:

• Go runtime
• Judgment desk
• Gateway and provenance
• Python and evaluator experiments
• Specification and documentation
• Agent harness and adapters