From eaafb806a06f20e0e1ce48ed891f5a5a9c8f92bf Mon Sep 17 00:00:00 2001 From: kikashy Date: Sun, 1 Nov 2026 09:45:45 -0500 Subject: [PATCH] Prepare judgment-pack-devkit v0.14.0 Signed-off-by: kikashy --- docs/releases/v0.14.0.md | 68 +++++++++++++++++++++++++++++++++ lib/common.sh | 2 +- scripts/dev/changed_checks.py | 2 +- scripts/dev/check.sh | 2 +- scripts/dev/handover_check.sh | 2 +- scripts/dev/release_evidence.py | 2 +- templates/check.sh | 2 +- 7 files changed, 74 insertions(+), 6 deletions(-) create mode 100644 docs/releases/v0.14.0.md diff --git a/docs/releases/v0.14.0.md b/docs/releases/v0.14.0.md new file mode 100644 index 0000000..4d9a964 --- /dev/null +++ b/docs/releases/v0.14.0.md @@ -0,0 +1,68 @@ +# jpdev v0.14.0 + +This release completes the v0.14.0 milestone with four changes: + +- Bind pull-request evidence reuse to the pinned API's merge event ([#70](https://github.com/Judgment-Pack/judgment-pack-devkit/issues/70), [#74](https://github.com/Judgment-Pack/judgment-pack-devkit/pull/74)). +- Account for nested process groups in the RSS guard ([#65](https://github.com/Judgment-Pack/judgment-pack-devkit/issues/65), [#72](https://github.com/Judgment-Pack/judgment-pack-devkit/pull/72)). +- Permit reviewed verifier replacement with a complete guarantee mapping ([#69](https://github.com/Judgment-Pack/judgment-pack-devkit/issues/69), [#75](https://github.com/Judgment-Pack/judgment-pack-devkit/pull/75)). +- Share acceptance mapping and complexity-control rules across agent instructions and operating policy ([#71](https://github.com/Judgment-Pack/judgment-pack-devkit/issues/71), [#73](https://github.com/Judgment-Pack/judgment-pack-devkit/pull/73)). + +## Pull-request evidence reuse + +The pinned API version omits `merge_commit_sha` from associated pull-request records. +The gate now requires exactly one server-recorded timeline `merged` event whose +`commit_id` matches the branch commit. Missing, malformed, ambiguous or mismatched +merge evidence refuses reuse with `reuse-pull-request`, so checks run fresh. +The complete timeline also supplies the existing base-change check. Repository, +branch, head, run, tree, parent, input and artifact checks remain in force. + +Captured API-shape projections and handwritten regression cases cover the changed +binding. A live API plan replay with original source and recorded runner/environment +inputs selected reuse for 21 checks. This demonstrates the plan with those recorded +inputs; it was not a fresh hosted-runner execution and did not execute consumer checks. + +## RSS guard + +The guard samples resident memory across the launched session, including descendants +in separate process groups. It continues monitoring after the leader exits and cleans +up session process groups on a memory limit, wall-clock limit or handled interruption. +Its diagnostics now describe the session rather than one process group. + +For Go race runs that require a large virtual address reservation, the documented +explicit outer RSS guard can be combined with `JPDEV_GO_ULIMIT_KB=unlimited` while +retaining the existing wrapper's lock, cache, read-only module mode and inner timeout. +No default resource limit changes. + +This is a sampled, cooperative guard. A descendant that creates a new session escapes +its accounting and cleanup. Shared resident pages can be counted more than once. +It is not a security containment mechanism. Process tests exercise the guard and +wrapper; they do not establish that a consumer's Go race suite passed. + +## Adoption and operating policy + +An adopter may replace an existing verifier only through reviewed compatibility work +that maps every previous guarantee to a gate check, configuration entry or unchanged +release job. An unmapped guarantee blocks replacement. Passing the kit's tests alone +does not establish adopter equivalence. + +The shared instructions require one current acceptance mapping, the smallest design +that preserves accepted contracts, accurate completion states, reuse of existing +harnesses, planned resource headroom, preserved failure evidence and grouped fix +rounds. Generated instruction copies remain synchronized with their canonical files. +Ownership, delegation, stop/handoff, review, CI and release gates remain in force. + +## Validation and rollout + +The implementation batch passed all eight local checklist steps, including 449 tests, +and each merged PR passed exact-head lint, tests and DCO checks. Independent same-vendor +reviews report no findings; #74 includes the clean-room security round. The PR records +identify the reviewers, evidence, additional probes and limitations. + +The release preparation follows the separate full-checklist, exact-head CI, complete +release-diff review, signed-tag and protected-publication gates in `docs/releasing.md`. +The workflow verifies main CI evidence, packages the tagged source and attests both +the tarball and its checksum file before publication. + +This release updates judgment-pack-devkit only. It does not update consumer copies, +enable evidence reuse in a consumer, replace a consumer verifier or authorize rollout. +Each adoption remains a separately authorized and reviewed repository change. diff --git a/lib/common.sh b/lib/common.sh index 8c7f54b..8c37a68 100644 --- a/lib/common.sh +++ b/lib/common.sh @@ -3,7 +3,7 @@ # Sourced by bin/jpdev and lib/wrap.sh. Needs bash 5. # shellcheck disable=SC2034 # read by bin/jpdev -JPDEV_VERSION=0.13.0 +JPDEV_VERSION=0.14.0 # Every setting jpdev reads. The environment wins over the config file, the config file over the default. JPDEV_SETTINGS=(JPDEV_SCRATCH JPDEV_LOCK JPDEV_NODE_RSS_MB JPDEV_NODE_TIMEOUT_S JPDEV_GO_ULIMIT_KB diff --git a/scripts/dev/changed_checks.py b/scripts/dev/changed_checks.py index 7d52f61..73226fb 100644 --- a/scripts/dev/changed_checks.py +++ b/scripts/dev/changed_checks.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# from judgment-pack-devkit v0.13.0 (lib/changed_checks.py) +# from judgment-pack-devkit v0.14.0 (lib/changed_checks.py) """changed_checks.py --root ROOT --manifest MANIFEST [--base BASE] [--label TEXT] Selects the check-list steps that the changed paths of a clone can affect, for diff --git a/scripts/dev/check.sh b/scripts/dev/check.sh index 34e43c3..af3a9fb 100755 --- a/scripts/dev/check.sh +++ b/scripts/dev/check.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# from judgment-pack-devkit v0.13.0 (templates/check.sh) +# from judgment-pack-devkit v0.14.0 (templates/check.sh) # scripts/dev/check.sh [--setup] [--only a,b | --changed [BASE]] [--skip a,b] [--all] [--strict] [--manifest FILE] # Runs dev.json checks in order; exit counts failures, or is nonzero for infrastructure-unrun checks. # --changed runs only the checks jpdev.json maps the paths changed since the merge base of BASE diff --git a/scripts/dev/handover_check.sh b/scripts/dev/handover_check.sh index 75ba264..f12e47f 100755 --- a/scripts/dev/handover_check.sh +++ b/scripts/dev/handover_check.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# from judgment-pack-devkit v0.13.0 (lib/handover_check.sh) +# from judgment-pack-devkit v0.14.0 (lib/handover_check.sh) set -eu python3 - <<'PY' diff --git a/scripts/dev/release_evidence.py b/scripts/dev/release_evidence.py index 7c84904..566947b 100644 --- a/scripts/dev/release_evidence.py +++ b/scripts/dev/release_evidence.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -# from judgment-pack-devkit v0.13.0 (lib/release_evidence.py) +# from judgment-pack-devkit v0.14.0 (lib/release_evidence.py) """release_evidence.py capture|verify|reuse: reuse the CI evidence main produced at the release commit. capture Runs in a CI job on the trusted branch, after the job's checks. Writes evidence.json for diff --git a/templates/check.sh b/templates/check.sh index 34e43c3..af3a9fb 100755 --- a/templates/check.sh +++ b/templates/check.sh @@ -1,5 +1,5 @@ #!/usr/bin/env bash -# from judgment-pack-devkit v0.13.0 (templates/check.sh) +# from judgment-pack-devkit v0.14.0 (templates/check.sh) # scripts/dev/check.sh [--setup] [--only a,b | --changed [BASE]] [--skip a,b] [--all] [--strict] [--manifest FILE] # Runs dev.json checks in order; exit counts failures, or is nonzero for infrastructure-unrun checks. # --changed runs only the checks jpdev.json maps the paths changed since the merge base of BASE