[intel352]

Repeated per-job Go caches and anonymous Docker volumes accumulated substantial
disk usage in the recent audit. Execution and closeout guidance now prefers stable
compatible caches, records isolation reasons and classifies persistent data. An
optional POSIX ledger attributes resources to jobs and reports conservative review
hints without running resource commands or deleting data.

Design and scope

See docs/plans/2026-10-05-resource-lifecycle-design.md, its independent review,
implementation plan and ADR0007. One PR/four tasks, all implementing commits present;
scope hash verifies. Related: #101 (bounded resource portion; other follow-ups remain).

Active, failed, unknown, reusable, database, volume and worktree resources remain
protected. Directory candidates require all declared owners to close successfully,
project temporary containment, no protected overlap/links/worktree markers, bounded
inspection and final path/identity validation. Session/job IDs are attribution,
not authentication. Stable locks and atomic JSON updates serialize cooperating
writers; corrupt/duplicate/future metadata is preserved.

Validation

• All 13 existing AGENTS/CI suites plus resource/guidance suites passed; helper 37/37.
• Independent adversarial review found and resolved first-writer, duplicate-field
  and scan-swap issues. Nine mutation attacks and 96 concurrent operations passed.
• Scope/hash, Python syntax, new Bash ShellCheck and diff hygiene passed.
• New path-filtered Ubuntu resource-lifecycle CI tests helper safety and guidance.
• All four manifests synchronized to 6.6.3; release notes updated.

Runtime transcript from the shipped helper and an owned temporary module:

python3 scripts/job-resources.py --help: record, closeout, report listed (exit0)
record disposable fixture: protected (exit0)
closeout --outcome success: review-candidate (exit0)
resource SHA256 before/after: identical
go version: go1.27.1 darwin/arm64
go env GOCACHE before/after: same existing native cache
go build -x -o <owned output> .: exit0
go build -x -o <same output> .: exit0; only WORK=..., no compile/link
record/closeout reusable cache: remains protected (exit0)
Docker/resource deletion commands:0; global Go setting changes:0

Direct CLI/Go proof does not establish host callbacks or agent adoption. The helper
adds no lifecycle hook, quota, allocator, daemon or automatic cleanup. Candidates
require fresh live-use/data review and separate deletion authorization.

Release and installation

Use the existing main tag/marketplace workflow, then publish the verified official
v6.6.3 Release. Preserve active native6.6.1 installation and configuration until
the safe maintenance condition is satisfied; native updates can prune old paths.
Overall installation acceptance remains open. Rollback leaves resources and
metadata intact; existing caches need no migration.