@bjoernrochel/sevro 0.1.0-rc.17 → 0.1.0-rc.19

package/docs/development-cli.md

@@ -8,10 +8,15 @@ grading, evidence, and extension lifecycle.
 [versioned report contract](report-v1.md). It emits Markdown by default or
 `sevro.report.v1` with `--json`.
 
+`sevro prune` [removes older retained results](reading-results.md#prune-retained-results)
+and maintains the latest report index. Bare pruning keeps the newest ten results;
+`--keep`, `--older-than`, and `--latest` select explicit retention policies.
+
 Examples assume [Sevro and Bun are on `PATH`](installing.md#make-the-command-available).
 For a contributor checkout, use `bun src/cli.ts` in place of `sevro`.
 
-Use `sevro --help`, `sevro run --help`, or `sevro report --help` for examples,
+Use `sevro --help`, `sevro run --help`, `sevro report --help`, or
+`sevro prune --help` for examples,
 required options, and defaults without preparing a run. `sevro --version` prints
 the installed package version. Invocation and configuration diagnostics go to
 stderr in both output modes; `--json` keeps one `sevro.cli-result.v1` document
@@ -280,7 +285,7 @@ It runs candidate tools under Claude Code's native sandbox with private,
 source, and result paths denied. The route disables hooks by default and does not expose
 the Write tool. It currently supports passive candidate turns only. Use
 `--protected-root` to exclude additional private paths from the candidate's
-filesystem access. Configure shared host tools, private caches, goals, and selected
+filesystem access. Configure shared host tools, private or reusable caches, goals, and selected
 plugin hooks with [`sevro.json` or `--runtime-config-file`](runtime-v1.md).
 The same policy reaches isolated checks and native grading hosts.
 

package/docs/evaluation-workflow.md

@@ -81,7 +81,10 @@ an earlier failed assessment into success.
 `report --latest --results-root ./other-results` for another output root or working
 directory. `--result-file ./path/to/result.json` selects older runs and accepts
 relative paths. Reports validate referenced evidence; missing/moved evidence
-produces a diagnostic. [Report v1](report-v1.md) defines fields and limits.
+produces a diagnostic. To reclaim native bundle space while keeping reportable
+results and hashes, use [`sevro prune --native-transcripts`](reading-results.md#remove-native-transcript-bundles).
+Reports label bundles intentionally removed by that command as pruned.
+[Report v1](report-v1.md) defines fields and limits.
 
 ## Choose another starter
 

package/docs/identity-v1.md

@@ -87,7 +87,10 @@ contents and temporary native state paths do not enter identity.
 Selected [runtime configuration](runtime-v1.md) is retained under
 `configuration.redacted.runtimePolicy` and enters `configurationDigest`.
 It includes declared non-secret environment values, canonical read roots,
-private seed digests and optional role selections, and hook authority. Per-role output paths are resolved
+private seed digests and optional role selections, shared-cache sources/slots/roles,
+and hook authority. Mutable shared-cache contents are excluded; equal identities
+do not establish equal cache contents or trial independence in shared mode.
+Per-role output paths are resolved
 only during execution; runtime placeholders remain symbolic in identity.
 Runtime roots also retain lexical aliases, metadata discovery sources,
 and skipped optional directories. Moving or

package/docs/installing.md

@@ -23,10 +23,10 @@ Local installation records the selected version in the project lockfile.
 
 ## Current release
 
-The current release is `0.1.0-rc.17`. Install this exact version:
+The current release is `0.1.0-rc.19`. Install this exact version:
 
 ```sh
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.17
+bun add --exact @bjoernrochel/sevro@0.1.0-rc.19
 ```
 
 <!-- sevro-current-release:end -->

package/docs/native-hosts.md

@@ -44,7 +44,7 @@ Repository skill mounts under `.claude/skills` require explicit
 `--claude-project-settings`; otherwise repository dispatch is refused before
 launch. The bundled route disables hooks by default and omits candidate Write
 access. [Runtime configuration](runtime-v1.md) enables native goals and selected
-plugin hooks and reuses declared host tools with private caches. These changes
+plugin hooks and reuses declared host tools with private or explicitly shared caches. These changes
 require `rc.3` or later. The CLI reference covers credential scrubbing
 and follow-ups.
 
@@ -80,7 +80,10 @@ Page matching uses complete nonblank lines as anchors and exact fragments of
 at least 32 string code units. Fragments with multiple possible positions in a
 body cannot establish coverage. Recognizable unfinished fragments appear in
 `partialSkills` and keep the observation partial; a later complete match resolves
-them. Comparison and anchor budgets also fail closed. Private receipts retain
+them. Within each tool result, text covered by unambiguous complete-body matches
+does not also imply partial reads of skills sharing that text. Fragments returned
+outside those complete-body spans or in other tool results remain independent
+partial-read evidence. Comparison and anchor budgets also fail closed. Private receipts retain
 body offsets rather than tool text; the public observation omits those offsets.
 Shorter, transformed or unanchored fragments remain outside this matching scope.
 Newly created or changed skill bodies are outside the prepared snapshot. A

package/docs/reading-results.md

@@ -43,6 +43,75 @@ For a contributor checkout, use `bun src/cli.ts` in place of `sevro`.
 duration is unknown, not zero. Advisory recommendations remain independent
 of the task verdict.
 
+## Prune retained results
+
+Run `sevro prune` to permanently delete older retained evidence. With no options,
+it keeps the newest **10 results** under `<cwd>/.sevro/results`. Each completed
+attempt counts separately, including repeated evaluations, dry runs, failures,
+and interrupted runs that retained a CLI result.
+
+```sh
+sevro prune
+sevro prune --results-root ./other-results --keep 5
+sevro prune --older-than 30d
+sevro prune --latest
+```
+
+Choose at most one explicit policy. `--keep` accepts a positive safe integer;
+`--latest` is equivalent to `--keep 1`. `--older-than` accepts a positive integer
+followed by `ms`, `s`, `m`, `h`, `d`, or `w` (milliseconds through weeks). It
+deletes results strictly older than that duration at invocation. Age and newest
+ordering use each retained `result.json` file's modification time; copying or
+editing that file can change its retention age. Equal timestamps sort by
+absolute result-directory path, ascending. Relative roots resolve from the
+invoking directory.
+
+Pruning finds retained result directories inside the selected root, including
+nested `attempts` trees, validates results and their colocated run evidence, and
+removes each selected result's entire directory. Directories without a retained
+`result.json` are not themselves deleted. Active and unrecognized ownership states
+are excluded from the retention count. Descendant directory links are not
+followed; linked result, evidence, ownership and lock files are refused. The
+selected root itself may be a directory alias. Invalid policies or unreadable,
+malformed, inconsistent or unsafe retained inputs return exit `64` with a
+diagnostic. Validation completes before any result deletion or latest update.
+
+Pruning and CLI result publication serialize access to the root. Before deleting
+evidence, pruning atomically points `latest.json` at the newest remaining
+completed result, or removes the index if none remain. `sevro report --latest`
+and explicit reports for surviving results keep working; reports naming deleted
+results fail. An empty or missing results root is a successful no-op. Ownership
+coordination metadata, partial attempts without CLI results, temporary fixtures,
+and a separate `--run-state-root` remain outside evidence pruning.
+
+### Remove native transcript bundles
+
+Use `--native-transcripts` to permanently remove captured native bundles while
+keeping every result, recorded hash, observation, and other artifact:
+
+```sh
+sevro prune --native-transcripts
+sevro prune --native-transcripts --older-than 30d
+sevro prune --native-transcripts --keep 5
+sevro report --latest
+```
+
+Without a policy, this mode removes bundles from all completed results. With
+`--keep 5`, it preserves the newest five results' bundles and removes bundles
+from older results. `--latest` preserves the newest result's bundles;
+`--older-than` removes bundles only from results older than the given duration.
+Age, ordering, root selection, active-run protection, and input validation follow
+the rules above. The mode includes candidate, semantic, and advisory bundles.
+
+`result.json`, `run.json`, trial evidence, and `latest.json` stay unchanged.
+Before removing bytes, pruning atomically saves a private
+`native-transcripts-pruned.json` receipt beside `run.json`. Keep that receipt
+with the evidence: reports require it to distinguish intentional pruning from
+missing evidence. Reports show retained and pruned bundle counts while preserving
+the original verdicts and measurements. Pruned native bytes cannot be decoded
+or recovered from hashes. Repeating the command safely resumes interrupted
+deletions; ordinary whole-result pruning still works afterward.
+
 ## Compare carefully
 
 [Identity v1](identity-v1.md) binds inputs, evaluator content, host/model/effort,

package/docs/recipes.md

@@ -209,9 +209,13 @@ The negative fixture changes the port to `9000`; Python raises an assertion:
 bun "$SEVRO_RECIPES/run.ts" python-uv deterministic --fail
 ```
 
-For real dependencies, prepare a public cache before evaluation and add a
-declared [seed directory](runtime-v1.md#private-writable-state), then use your locked
-offline install command. This dependency-free recipe needs no cache seed.
+For real dependencies, prepare a public cache once outside the evaluated project
+and declare a [shared cache](runtime-v1.md#reuse-a-shared-dependency-cache), then
+use your locked offline install command. Select only the roles using UV; add
+`checks` only when the grader needs it. The same directory can serve candidates,
+hooks, and UV-based graders across trials and runs without copying the cache.
+Use [private seeds](runtime-v1.md#private-writable-state) when isolated dependency
+bytes matter more than disk reuse. This dependency-free recipe needs no cache seed.
 
 ### An existing mise installation
 

package/docs/report-v1.md

@@ -29,6 +29,22 @@ including dry and failed runs. Pre-run failures do not replace latest. Missing
 latest or referenced evidence is an error. See
 [the evaluation workflow](evaluation-workflow.md).
 
+[`sevro prune`](reading-results.md#prune-retained-results) maintains this index
+when removing retained evidence. After pruning, latest selects the newest
+remaining completed result; if none remain, the index is removed and `--latest`
+reports a missing-input diagnostic. Explicit reports still require their selected
+results and evidence to exist.
+
+After [`sevro prune --native-transcripts`](reading-results.md#remove-native-transcript-bundles),
+reports accept absent native bundles only with the matching
+[pruning receipt](results-v1.md#native-transcript-bundles). Present bundles must
+still match their recorded hashes; unexplained missing bytes remain an error.
+New report rows include optional `nativeTranscripts` with nonnegative integer
+`retained` and `pruned` bundle counts across the case's trials and host roles.
+Markdown shows the same counts beside retained evidence. Older report documents
+without this field remain valid. Pruning does not change verdicts, routes,
+identity, usage, or duration.
+
 Each case row keeps task verdict, execution, and grading separate. Task pass
 rate is measured only when every trial completed execution and grading with an
 assessed task verdict. Candidate duration sums the measured host call time

package/docs/results-v1.md

@@ -142,11 +142,23 @@ results and evidence remain intact. Failed cleanup is retried on later evaluatio
 `sevro.observation.workspaces` records candidate and retained auxiliary workspace
 paths for inspection. These paths are temporary and do not affect evaluation identity.
 
+Retained results have no automatic expiration. The explicit
+[`sevro prune` command](reading-results.md#prune-retained-results) applies an
+operator-selected age or count policy, defaulting to the newest ten results.
+It deletes complete retained result directories and maintains `latest.json`
+for the remaining results. Active or unrecognized attempts remain protected;
+fixture cleanup and run-state coordination metadata have separate lifecycles.
+
 Opted-in [candidate artifact runtimes](runtime-v1.md#candidate-artifact-access)
 remain available through grading and are removed afterward, including failed
 and cancelled trials. Failed-fixture retention does not preserve them.
 Read access does not automatically retain artifact bytes in run evidence.
 
+Checker private home, temporary storage, and copied dependency slots are removed
+after grading on success, failure, and cancellation. Retained failed fixtures and
+saved evidence do not retain checker runtime copies. Explicitly declared shared
+caches survive this cleanup and remain under operator control.
+
 A host adapter can return `executionFailed: true` with bounded artifacts from
 a failed process. The engine retains those artifacts, skips all grading, and
 reports `failed` / `not_requested` / `not_assessed` with exit code `2`. A final
@@ -212,14 +224,26 @@ failure; cleanup warnings contain no raw error/output bodies.
 With [runtime transcript opt-in](runtime-v1.md#native-transcript-access), each
 bundled host captures full native files before removing its private state.
 Candidate artifact `sevro.native-transcripts.bundle` has format
-`sevro.native-transcripts.v1`. It contains `host` (`codex` or `claude`), `role`,
+`sevro.native-transcripts.v2`. It contains `host` (`codex` or `claude`), `role`,
 native `rootSessionId` (or `null`), `completeness`, `issues`, and `files`.
-Each file records its native relative `path`, SHA-256 `sha256`, and exact bytes
-as `bytesBase64`. Decode the bytes without rewriting native records. Native
+Each file records its native relative `path`, SHA-256 `sha256` of the original
+bytes, and `gzipBase64`: the exact file bytes compressed with gzip, then encoded
+as base64. Decode base64, decompress gzip, and verify the original-byte hash
+before using a file. Bound decompression to 5 MiB across all files in the bundle.
+Decode bytes without rewriting native records. Native
 session paths, root/child records and sidecar metadata preserve associations;
 the bundle does not normalize model, effort, timing, token, or cost statistics.
 Existing unknown metrics remain unknown.
 
+Sevro reads both v2 bundles and existing `sevro.native-transcripts.v1` bundles.
+V1 files use uncompressed `bytesBase64`; decode that field directly without
+gzip decompression and verify the same original-byte hash. Readers must select
+the payload field and decoding by `format` and reject unsupported formats,
+corrupt compressed payloads, hash mismatches, or a decoded total above 5 MiB.
+New captures emit v2; reading retained v1 evidence does not rewrite it.
+The retained view exposes the same exact native files for either format, with
+the original bundle in `index.json`.
+
 `sevro.host.native-transcripts` records the same capture state and file hashes
 without raw bytes. Semantic and advisory bundles retain their role in the
 bundle and use the existing `sevro.semantic[.<source digest>].` and
@@ -230,7 +254,8 @@ benchmarks can use the same references and decode the native files.
 
 Capture includes native transcript-tree sidecars and refuses descendant links,
 special files and escaping paths. It is bounded to 4,096 directory entries,
-5 MiB of native file bytes and 7 MiB of encoded file metadata/content. The
+5 MiB of native file bytes before compression and 7 MiB of encoded file
+metadata/gzip content. The
 bundle remains inside the existing 8 MiB item and 32 MiB host artifact budgets;
 it groups sessions instead of spending an artifact per child. Limits produce
 `byte_limit`, `entry_limit`, or `bundle_limit` issues. Unreadable, unsafe or
@@ -249,3 +274,25 @@ structure, not native semantic correctness.
 An empty/missing native JSONL tree is `unavailable`. Failure, cancellation and
 timeout retain available native bytes with incomplete capture state. Raw
 bundles and views are private evidence and must stay out of Git.
+
+The explicit [`sevro prune --native-transcripts` mode](reading-results.md#remove-native-transcript-bundles)
+can remove these bundles without rewriting CLI results, run/trial evidence,
+capture observations, native file hashes, or whole-bundle hashes. It retains
+other artifacts and does not change evaluation identity or assessment states.
+Reports validate present native bundles against their recorded SHA-256 and
+require an exact pruning receipt for absent bundles.
+
+Before deletion, Sevro atomically writes private
+`native-transcripts-pruned.json` beside `run.json`, with format
+`sevro.pruned-native-transcripts.v1`, the original `runId`, and `artifacts`.
+Each entry contains the original artifact reference (`id`, `path`, `sha256`,
+and any optional reference flags), plus its `caseId` and `trial`. Entries follow
+run trial/reference order and cover every candidate, semantic (including
+source-specific), and advisory native bundle in that run. A receipt must match
+these original references exactly; malformed, inconsistent, or linked receipts
+are errors. Bundle references must name regular files directly inside their
+result directory. Missing bytes without a receipt, changed hashes, and escaping
+references remain errors. An interrupted deletion may leave some marked bundles
+present; reports count actual availability, and a repeated prune completes removal.
+Transcript references that alias result/trial metadata, raw responses, or other
+retained artifacts are refused before pruning.

package/docs/runtime-v1.md

@@ -1,6 +1,6 @@
 # Runtime configuration v1
 
-Configure access to existing host tools, private writable caches, native goals,
+Configure access to existing host tools, private state, reusable caches, native goals,
 and selected plugin hooks in `<project-root>/sevro.json`.
 
 `--runtime-config-file /absolute/path/runtime.json` selects a replacement file.
@@ -36,7 +36,13 @@ capabilities:
     }
   },
   "runtime": {
-    "seedDirectories": [{ "source": "./public-uv-cache", "target": "uv-cache" }]
+    "sharedCacheDirectories": [
+      {
+        "source": "../public-uv-cache",
+        "target": "uv-cache",
+        "roles": ["candidate", "hooks"]
+      }
+    ]
   },
   "hooks": {
     "nativeGoal": true,
@@ -45,7 +51,7 @@ capabilities:
 }
 ```
 
-Create the example's `public-uv-cache` directory beside the configuration, or
+Prepare the example's `public-uv-cache` directory outside the project, or
 omit `runtime` when no prepared cache is needed. Selected plugin names must be
 present in the case's prepared mounts; remove names that the case does not mount.
 `DARROW_CACHE_DIR` is an ordinary explicit variable in this example, not a
@@ -235,10 +241,12 @@ digits, and hyphens. `home` and `tmp` are reserved. Targets must be unique.
 An optional nonempty `roles` array selects any of `candidate`, `checks`, `hooks`,
 `semantic`, and `advisory`. For example, `"roles": ["candidate", "checks", "hooks"]`
 keeps dependency slots out of semantic and advisory runtimes. Without `roles`,
-execution and artifact-grading roles retain the existing selection. Response-only
+candidate, hook, artifact semantic, and advisory roles receive private copies.
+Shell checks require explicit `"checks"` selection; a non-UV grader receives no
+implicit UV/Python cache. Existing configurations whose shell checks need seeded
+dependencies must add `"checks"` to `roles`. Response-only
 semantic grading omits implicit seeds; include `"semantic"` explicitly in `roles`
-when that route needs dependencies. Artifact semantic grading and executable
-shell checks keep their declared tools and default seed selection.
+when that route needs dependencies. Declared host tools remain available to shell checks.
 
 Each source tree is bounded to 16,384 entries and 512 MiB. Escaping symlinks,
 directory cycles, dangling links, and special files are refused. File content
@@ -254,6 +262,41 @@ retaining large policies can retain up to the configured per-seed byte bounds.
 Source caches are never a writable runtime. Use prepared public caches rather
 than credential-bearing homes or evaluator directories.
 
+### Reuse a shared dependency cache
+
+`runtime.sharedCacheDirectories` opts into persistent writable caches without
+copying or hashing their contents for each trial. Each entry requires `source`,
+`target`, and a nonempty `roles` array drawn from the same five roles above.
+The source must already be an owned, readable, writable directory. Relative paths
+resolve beside the runtime file. Sevro resolves declaration symlinks to their
+canonical source and revalidates that directory before execution.
+Targets use the seed slot rules and must be unique across seeds and shared caches.
+Sources cannot overlap each other, private seed sources, declared read-only
+inputs, evaluated project/source trees, results, credentials, or native private state.
+
+Select only roles that actually use UV, for example `"roles": ["candidate", "hooks"]`.
+If a grader also uses UV, add `"checks"` to that same entry; both roles use the
+same cache. Each selected private slot aliases the original directory, with a
+narrow sandbox write grant. Other roles receive no slot or source grant.
+Shared content survives successful, failed, and cancelled trials and later runs.
+Sevro removes only disposable role state, never the declared shared source.
+
+Prepare UV packages once outside evaluation, point `UV_CACHE_DIR` at
+`{{sevro.runtime}}/uv-cache`, and reuse the existing Python installation through
+declared read-only tool roots. Set `UV_PYTHON_DOWNLOADS=never` to require that
+installation. Sevro keeps `UV_OFFLINE=1`; a missing dependency fails rather than
+downloading during a trial. Project virtual environments and temporary files
+remain disposable; UV's install/link mode can still allocate files in a virtual
+environment. The shared option removes the full cache copy per trial.
+
+Shared caches are mutable across trials, roles, and runs. Use them only for public
+dependencies and accept that a participant can change them for later participants.
+Use isolated seeds when dependency independence is required. Configuration identity
+binds the source, slot, and roles, but excludes mutable cache contents; equal
+identities therefore do not prove identical shared-cache bytes. Sevro does not
+age-delete shared caches. Manage their size between evaluations with the cache
+tool, such as `uv cache prune --cache-dir /absolute/public-uv-cache`.
+
 `{{sevro.runtime}}` in an environment value resolves to that role's writable
 root. Codex commands receive a `TMPPREFIX` inside their private `TMPDIR`,
 so zsh here-documents use their existing private temporary storage while shared
@@ -266,13 +309,15 @@ use. Its temporary directory stays disposable.
 Candidate, hook, checker, semantic, and advisory
 state are separate. With a runtime policy, native candidate, semantic, and
 advisory roots live in a unique runner-owned host directory outside the Git
-fixture. The root contains `home`, `tmp`, and declared seed slots; plugins can
+fixture. The root contains `home`, `tmp`, private seed slots and selected shared-cache links; plugins can
 use paths such as `~/.darrow/reviews` without creating repository-local review
 state. Command runtime directories are separate from host authentication,
-configuration, and live transcript sources. Checker and hook caches also live
-outside candidate-controlled workspace state. Private roots survive native
+configuration, and live transcript sources. Checker and hook private state also lives
+outside candidate-controlled workspace state. Shared sources remain at their declared locations. Private roots survive native
 continuation turns and children, then are removed with their owning trial or
-host state after owned hooks terminate. Opted-in candidate artifact runtimes
+host state after owned hooks terminate. Checker home, temporary storage, and copied
+seeds are removed after grading even when the fixture is retained after failure
+or cancellation. Results and evidence are preserved. Opted-in candidate artifact runtimes
 remain alive through grading as described below. Runs with neither fixture setup
 nor a selected runtime policy
 retain their previous writable-state locations.
@@ -525,7 +570,7 @@ run evidence. Extensions and external benchmarks consume the
 ## Evidence and compatibility
 
 `configuration.redacted.runtimePolicy` retains the selected environment,
-canonical read roots, seed digests, and hook declaration. The engine snapshots
+canonical read roots, seed digests, shared-cache declarations, and hook declaration. The engine snapshots
 this input once; it participates in `configurationDigest` and evaluation
 identity. Symbolic runtime placeholders remain symbolic in identity, while
 execution uses per-role paths. This binds declared setup and seed contents;
@@ -539,7 +584,8 @@ file contents do not. The same discovery and skip evidence reaches
 `sevro.host.runtime` observations.
 
 Bundled hosts supply `sevro.host.runtime` with the applied policy digest, role,
-environment names, read roots, and seed slots. `sevro.host.hooks` records source
+environment names, read roots, seed slots, and selected shared-cache declarations.
+Shared entries contain no content digest. `sevro.host.hooks` records source
 and effective plugin digests plus observed executions and their exit codes.
 An empty execution list does not prove hook activation. Partial lifecycle
 evidence remains partial. Cases can require these observations; missing required
@@ -549,7 +595,8 @@ task verdict.
 `--toolchain-bin-dir` and `--claude-uv-cache-dir` are deprecated. They keep their
 previous behavior with a warning when no runtime file is selected. Combining
 them with a runtime file fails before execution. Migrate to `environment`,
-`filesystem`, and private seed slots; removal is no earlier than `0.2.0`.
+`filesystem`, and either private seed slots or shared-cache declarations; removal
+is no earlier than `0.2.0`. The deprecated UV option continues to copy privately.
 See the [CLI reference](development-cli.md), [native hosts](native-hosts.md),
 and [identity contract](identity-v1.md).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bjoernrochel/sevro",
-  "version": "0.1.0-rc.17",
+  "version": "0.1.0-rc.19",
   "license": "SEE LICENSE IN LICENSE",
   "description": "A standalone evaluation runner for agentic coding capabilities",
   "type": "module",

package/schemas/report-v1.schema.json

@@ -110,6 +110,15 @@
         "domainOutcomes"
       ],
       "properties": {
+        "nativeTranscripts": {
+          "type": "object",
+          "required": ["retained", "pruned"],
+          "properties": {
+            "retained": { "type": "integer", "minimum": 0 },
+            "pruned": { "type": "integer", "minimum": 0 }
+          },
+          "additionalProperties": false
+        },
         "resultFile": { "$ref": "#/$defs/path" },
         "evidencePath": { "type": ["string", "null"] },
         "runId": { "type": ["string", "null"] },

package/schemas/runtime-v1.schema.json

@@ -62,6 +62,38 @@
             }
           }
         },
+        "sharedCacheDirectories": {
+          "type": "array",
+          "maxItems": 16,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["source", "target", "roles"],
+            "properties": {
+              "source": { "type": "string", "minLength": 1, "maxLength": 4096 },
+              "target": {
+                "type": "string",
+                "pattern": "^[a-z][a-z0-9-]{0,63}$",
+                "not": { "enum": ["home", "tmp"] }
+              },
+              "roles": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 5,
+                "uniqueItems": true,
+                "items": {
+                  "enum": [
+                    "candidate",
+                    "checks",
+                    "hooks",
+                    "semantic",
+                    "advisory"
+                  ]
+                }
+              }
+            }
+          }
+        },
         "seedDirectories": {
           "type": "array",
           "maxItems": 16,

package/src/cli/completion.ts

@@ -2,11 +2,14 @@ import { dirname, join } from "node:path";
 import { atomicWriteJson } from "../storage";
 import type { CliResult } from "../engine";
 import { createReport } from "../report";
+import { withResultsLock } from "../results-lock";
 
 /** Latest means the last successfully retained CLI result, including dry/failing runs. */
 export async function retainCliResult(result: CliResult, resultsRoot: string) {
-  const resultFile = join(dirname(result.evidencePath), "result.json");
-  await atomicWriteJson(resultFile, result);
-  await atomicWriteJson(join(resultsRoot, "latest.json"), result);
-  return { resultFile, report: await createReport([resultFile]) };
+  return withResultsLock(resultsRoot, async () => {
+    const resultFile = join(dirname(result.evidencePath), "result.json");
+    await atomicWriteJson(resultFile, result);
+    await atomicWriteJson(join(resultsRoot, "latest.json"), result);
+    return { resultFile, report: await createReport([resultFile]) };
+  });
 }

package/src/cli/help.ts

@@ -10,12 +10,14 @@ Examples:
     --condition passive --trials 1 --threshold 1
   sevro run --help
   sevro report --result-file /absolute/results/run/result.json
+  sevro prune
 
 Commands:
   demo      Run the packaged credential-free assessed example; use demo --help.
   init      Create a new evaluation project; use init --help.
   run       Evaluate one resolved case or extension case; use run --help.
   report    Summarize retained results; use report --help.
+  prune     Remove retained results using a retention policy; use prune --help.
 
 Options:
   -h, --help     Show help without preparing a run.
@@ -131,6 +133,36 @@ Options and defaults:
   -h, --help   Show this help without reading result files.
 `;
 
+const PRUNE_HELP = `Usage: sevro prune [options]
+
+Examples:
+  sevro prune
+  sevro prune --results-root ./other-results --keep 5
+  sevro prune --older-than 30d
+  sevro prune --latest
+  sevro prune --native-transcripts --older-than 30d
+
+Defaults: keep the newest 10 completed results under <cwd>/.sevro/results.
+Select at most one explicit retention policy:
+  --keep <positive-integer>  Keep this many newest results.
+  --latest                   Keep only the newest result (same as --keep 1).
+  --older-than <duration>    Remove results older than a positive integer plus ms, s, m, h, d or w.
+  --results-root <path>      Relative or absolute results root, resolved from cwd.
+  --native-transcripts       Remove only native transcript bundles; keep results and hashes.
+  -h, --help                 Show help without reading or deleting results.
+
+Age and ordering use result.json modification times; equal times sort by path.
+Each retained attempt counts separately, including dry, failed and interrupted runs.
+Active/unrecognized attempts and directories without result.json are preserved.
+Evidence is permanently deleted. Remaining results stay usable by sevro report;
+latest.json is updated, or removed when no completed results remain.
+With --native-transcripts, no policy removes bundles from all completed results;
+--keep/--latest preserve bundles for the newest results, and --older-than selects older results.
+Result/evidence files and latest.json stay unchanged. Reports label removed bundles as pruned.
+Missing or empty results roots are a successful no-op. Invalid or unreadable inputs exit 64.
+Reference: docs/reading-results.md in the installed package.
+`;
+
 const INIT_HELP = `Usage: sevro init [options]
 
 Examples:
@@ -169,6 +201,9 @@ const HELP_REQUESTS: Record<string, string> = {
   "report --help": REPORT_HELP,
   "report -h": REPORT_HELP,
   "help report": REPORT_HELP,
+  "prune --help": PRUNE_HELP,
+  "prune -h": PRUNE_HELP,
+  "help prune": PRUNE_HELP,
 };
 
 /** Handle informational commands before loading inputs or creating run state. */

package/src/cli.ts

@@ -4,6 +4,7 @@ import { reportCommand } from "./report";
 import { informationCommand } from "./cli/help";
 import { demoCommand } from "./cli/demo";
 import { initCommand } from "./cli/init";
+import { pruneCommand } from "./prune";
 
 if (informationCommand(process.argv.slice(2))) process.exitCode = 0;
 else if (process.argv[2] === "demo") await demoCommand(process.argv.slice(3));
@@ -11,4 +12,6 @@ else if (process.argv[2] === "init")
   process.exitCode = await initCommand(process.argv.slice(3));
 else if (process.argv[2] === "report")
   process.exitCode = await reportCommand(process.argv.slice(2));
+else if (process.argv[2] === "prune")
+  process.exitCode = await pruneCommand(process.argv.slice(3));
 else await main(process.argv.slice(2));

package/src/evaluation/trial.ts

@@ -1,4 +1,5 @@
 import { rm } from "node:fs/promises";
+import { hashJson } from "../identity";
 import {
   allocateCandidateRuntime,
   candidateArtifactRoots,
@@ -38,7 +39,10 @@ import type {
   ObservationCompleteness,
   TaskVerdict,
 } from "../contract-types";
-import { clearFixtureContents } from "../fixtures/cleanup";
+import {
+  clearFixtureContents,
+  removeDisposableDirectory,
+} from "../fixtures/cleanup";
 import { retainWorkspace } from "../fixtures/workspace-state";
 import { gitHeadRevision } from "../graders/git-head";
 import {
@@ -789,6 +793,13 @@ class EvaluationTrial {
     evaluationProgress(this.options, stage, status, this.trial);
   }
   private async cleanup(): Promise<void> {
+    await removeDisposableDirectory(
+      join(
+        this.context.resources.stateDir,
+        "shell-sandbox/runtime",
+        hashJson(this.fixture.workspace),
+      ),
+    );
     if (this.state.candidateTranscriptRoot)
       await rm(this.state.candidateTranscriptRoot, {
         recursive: true,