engineering-process 0.2.0__tar.gz → 0.2.1__tar.gz

{engineering_process-0.2.0/engineering_process.egg-info → engineering_process-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 0.2.0
+Version: 0.2.1
 Summary: Agent-neutral end-to-end engineering lifecycle and deterministic process CLI
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process

{engineering_process-0.2.0 → engineering_process-0.2.1}/VERSIONING.md

@@ -71,6 +71,13 @@ verification manifest and project-adoption migration each follow that rule. Addi
 optional `timeoutSeconds` evidence to verification schema 2 preserves existing
 schema-2 documents and therefore does not advance that artifact's schema version.
 
+Every generator must be qualified against the exact released reader that consumes its
+output. For a lifecycle artifact, validation at creation is insufficient: CI runs the
+generated change, plan, review, completion, and exported evidence through public N-1
+up to the final consuming transition. Review schema and quality mappings derive from
+the registered change contract instead of being maintained as an independent version
+constant.
+
 Package `schemaImpact` is `unchanged`, `additive`, or `breaking` for the combined
 release. Additive schema capability requires at least a capability release; a
 breaking schema requires an incompatible release.
@@ -97,7 +104,9 @@ requirement pin, omits generated hashes or managed assets, or requires a post-me
 step must fail closed.
 
 `requirements/process.in` owns the direct public pin and `requirements/process.txt`
-is its pip-compile hash lock. Renovate's exact allowlisted post-upgrade command runs
+is its pip-compile hash lock. The lock generator is pinned, and the committed lock must
+cover compatible binary artifacts for every supported Python/OS runner rather than
+only the platform that compiled it. Renovate's exact allowlisted post-upgrade command runs
 `.process/adopt-process.py`; that managed runner creates a bounded temporary
 environment outside the checkout, rejects symlink, junction, or reparse input in
 every supplied lock-path component, and makes one stable private snapshot. Component

{engineering_process-0.2.0 → engineering_process-0.2.1}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "0.2.0"
+VERSION = "0.2.1"

{engineering_process-0.2.0 → engineering_process-0.2.1}/engineering_process/publication.py

@@ -1,5 +1,8 @@
 from __future__ import annotations
 
+import base64
+import binascii
+import json
 import re
 from pathlib import Path
 
@@ -243,12 +246,66 @@ def managed_pull_request_visibility_issues(body: str) -> list[str]:
 
 
 PROJECT_EXTENSION_HEADING = "## Project-specific requirements"
+RENOVATE_DEBUG_COMMENT_RE = re.compile(
+    r"^<!--renovate-debug:(?P<payload>[A-Za-z0-9+/]{1,4096}={0,2})-->$"
+)
+RENOVATE_DEBUG_KEYS = {
+    "createdInVer",
+    "updatedInVer",
+    "targetBranch",
+    "labels",
+}
+
+
+def _strip_renovate_debug_comment(extension: str) -> tuple[str, list[str]]:
+    lines = extension.strip().splitlines()
+    matches = [
+        (index, match)
+        for index, line in enumerate(lines)
+        if (match := RENOVATE_DEBUG_COMMENT_RE.fullmatch(line)) is not None
+    ]
+    if not matches:
+        return extension, []
+    if len(matches) != 1 or matches[0][0] != len(lines) - 1:
+        return extension, ["Renovate metadata comment must appear exactly once at the end"]
+    _, match = matches[0]
+    try:
+        decoded = base64.b64decode(match.group("payload"), validate=True)
+        if len(decoded) > 3072:
+            raise ValueError("payload exceeds 3072 decoded bytes")
+        metadata = json.loads(decoded.decode("utf-8"))
+    except (binascii.Error, UnicodeDecodeError, json.JSONDecodeError, ValueError):
+        return extension, ["Renovate metadata comment must contain bounded base64 JSON"]
+    if not isinstance(metadata, dict) or set(metadata) != RENOVATE_DEBUG_KEYS:
+        return extension, ["Renovate metadata comment has an unexpected JSON contract"]
+    if any(
+        not isinstance(metadata[key], str)
+        or not metadata[key]
+        or len(metadata[key]) > 64
+        for key in ("createdInVer", "updatedInVer")
+    ):
+        return extension, ["Renovate metadata versions must be bounded strings"]
+    if metadata["targetBranch"] != "main":
+        return extension, ["Renovate metadata must target protected main"]
+    labels = metadata["labels"]
+    if (
+        not isinstance(labels, list)
+        or len(labels) > 50
+        or any(not isinstance(label, str) or len(label) > 100 for label in labels)
+    ):
+        return extension, ["Renovate metadata labels must be a bounded string list"]
+    return "\n".join(lines[:-1]).strip(), []
 
 
 def validate_project_extensions(body: str, *, allow_pending: bool) -> list[str]:
     body = _normalized_markdown(body)
     _, end = _managed_span(body)
     extension = body[end:]
+    if not extension.strip():
+        return []
+    extension, metadata_issues = _strip_renovate_debug_comment(extension)
+    if metadata_issues:
+        return metadata_issues
     if not extension.strip():
         return []
     if contains_raw_html(extension):

{engineering_process-0.2.0 → engineering_process-0.2.1}/engineering_process/release.py

@@ -118,10 +118,6 @@ def validate_reviewed_checkpoint(
         ],
     )
     if reviewed_checkpoint != release_checkpoint:
-        _git(
-            project_root,
-            ["merge-base", "--is-ancestor", reviewed_checkpoint, release_checkpoint],
-        )
         reviewed_tree = _git(
             project_root,
             ["rev-parse", "--verify", f"{reviewed_checkpoint}^{{tree}}"],

{engineering_process-0.2.0 → engineering_process-0.2.1}/engineering_process/release_candidate.py

@@ -232,7 +232,7 @@ def _release_lifecycle_documents(
 ) -> tuple[bytes, bytes]:
     change_id = f"release-{version.replace('.', '-')}"
     contract = {
-        "schemaVersion": 2,
+        "schemaVersion": 3,
         "id": change_id,
         "summary": f"Authorize and publish {project} {version}",
         "source": "Automatically aggregated reviewed release-change fragments",
@@ -259,6 +259,71 @@ def _release_lifecycle_documents(
             },
         ],
         "requiredProfiles": ["development", "review"],
+        "quality": {
+            "standard": "production-v1",
+            "assessments": [
+                {
+                    "dimension": "compatibility",
+                    "status": "applicable",
+                    "rationale": "The release must preserve its declared compatibility and exact identity surfaces.",
+                    "criteria": ["ac-identity"],
+                },
+                {
+                    "dimension": "correctness",
+                    "status": "applicable",
+                    "rationale": "The derived identity and published bytes must match the reviewed release contract.",
+                    "criteria": ["ac-identity", "ac-publication"],
+                },
+                {
+                    "dimension": "maintainability",
+                    "status": "applicable",
+                    "rationale": "Independent review verifies the generated contract and deterministic release owner.",
+                    "criteria": ["ac-review"],
+                },
+                {
+                    "dimension": "observability",
+                    "status": "applicable",
+                    "rationale": "Release evidence and attestations expose the exact publication outcome.",
+                    "criteria": ["ac-publication"],
+                },
+                {
+                    "dimension": "operability",
+                    "status": "applicable",
+                    "rationale": "The reviewed release must publish and recover through the declared automated workflow.",
+                    "criteria": ["ac-publication"],
+                },
+                {
+                    "dimension": "performance",
+                    "status": "not-applicable",
+                    "rationale": "Release authorization adds no product runtime or scaling behavior.",
+                    "criteria": [],
+                },
+                {
+                    "dimension": "privacy",
+                    "status": "not-applicable",
+                    "rationale": "Release metadata contains no personal or sensitive data processing.",
+                    "criteria": [],
+                },
+                {
+                    "dimension": "reliability",
+                    "status": "applicable",
+                    "rationale": "Immutable assets and exact external-state checks must fail closed and recover deterministically.",
+                    "criteria": ["ac-publication"],
+                },
+                {
+                    "dimension": "security",
+                    "status": "applicable",
+                    "rationale": "Independent review and merge remain the only publication authorization boundary.",
+                    "criteria": ["ac-review"],
+                },
+                {
+                    "dimension": "supply-chain",
+                    "status": "applicable",
+                    "rationale": "The release binds source, version, artifacts, attestations, and registry bytes.",
+                    "criteria": ["ac-identity", "ac-publication"],
+                },
+            ],
+        },
         "signOff": {
             "required": False,
             "status": "not-required",
@@ -268,7 +333,7 @@ def _release_lifecycle_documents(
     contract_bytes = _canonical_json_bytes(contract)
     contract_digest = f"sha256:{hashlib.sha256(contract_bytes).hexdigest()}"
     plan = {
-        "schemaVersion": 1,
+        "schemaVersion": 2,
         "changeId": change_id,
         "contractDigest": contract_digest,
         "approach": "Validate the generated release contract and every declared surface, build from the exact reviewed tree, and permit publication only after independent approval and merge.",

{engineering_process-0.2.0 → engineering_process-0.2.1/engineering_process.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 0.2.0
+Version: 0.2.1
 Summary: Agent-neutral end-to-end engineering lifecycle and deterministic process CLI
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process

{engineering_process-0.2.0 → engineering_process-0.2.1}/engineering_process.egg-info/SOURCES.txt

@@ -110,8 +110,12 @@ tests/test_evals.py
 tests/test_impact.py
 tests/test_lifecycle.py
 tests/test_publication.py
+tests/test_publish_event.py
+tests/test_pypi_publication.py
 tests/test_release.py
 tests/test_release_candidate.py
+tests/test_release_preparation.py
+tests/test_release_qualification.py
 tests/test_runner.py
 tests/test_runtime.py
 tests/test_schemas.py

{engineering_process-0.2.0 → engineering_process-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-process"
-version = "0.2.0"
+version = "0.2.1"
 description = "Agent-neutral end-to-end engineering lifecycle and deterministic process CLI"
 readme = "README.md"
 license = "MIT"

engineering_process-0.2.1/release.json

@@ -0,0 +1,106 @@
+{
+  "schemaVersion": 3,
+  "previousVersion": "0.2.0",
+  "version": "0.2.1",
+  "classification": "patch",
+  "compatibility": "backward-compatible",
+  "schemaImpact": "unchanged",
+  "migration": null,
+  "identity": {
+    "package": "engineering-process",
+    "distribution": "engineering_process",
+    "tag": "v0.2.1",
+    "releaseName": "v0.2.1",
+    "runtimeVersion": {
+      "path": "engineering_process/__init__.py",
+      "variable": "VERSION"
+    },
+    "artifacts": [
+      "engineering_process-0.2.1-py3-none-any.whl",
+      "engineering_process-0.2.1.tar.gz"
+    ],
+    "receiptAsset": "engineering-process-v0.2.1-evidence.json",
+    "authorizationAsset": null
+  },
+  "provenance": {
+    "mode": "governed",
+    "statement": "The public N-1 lifecycle receipt and reviewed Release PR authorize this release.",
+    "lifecycleReceipt": {
+      "asset": "engineering-process-v0.2.1-evidence.json",
+      "project": "engineering-process",
+      "changeId": "release-0-2-1",
+      "cycle": 1
+    }
+  },
+  "changes": [
+    {
+      "id": "bootstrap-self-adoption-verifier",
+      "type": "fix",
+      "surfaces": [
+        "adoption",
+        "self-hosting",
+        "workflow"
+      ],
+      "rationale": "Verify bootstrap self-adoption with the target-aware producer template so the exact installed public authority performs the check even when the managed N-1 runner predates check-only mode."
+    },
+    {
+      "id": "portable-process-lock-hashes",
+      "type": "fix",
+      "surfaces": [
+        "adoption",
+        "portability",
+        "supply-chain"
+      ],
+      "rationale": "Regenerate process dependency locks with the complete binary wheel hash set and pin the lock generator so one immutable authority installs on every supported runtime and platform."
+    },
+    {
+      "id": "post-v0-2-release-adoption-hardening",
+      "type": "fix",
+      "surfaces": [
+        "adoption",
+        "publication",
+        "workflow"
+      ],
+      "rationale": "Correct event-driven publication recovery, validate Renovate metadata through a bounded exact contract, require strict consumer outcomes, and verify self-adoption through the public hash-locked authority instead of source under development."
+    },
+    {
+      "id": "release-approval-app-token",
+      "type": "fix",
+      "surfaces": [
+        "publication",
+        "workflow"
+      ],
+      "rationale": "Use the short-lived Release PR owning GitHub App token for the Draft-to-Ready transition after exact lifecycle and receipt authorization, while retaining GITHUB_TOKEN for commit status writes."
+    },
+    {
+      "id": "release-lifecycle-quality-contract",
+      "type": "fix",
+      "surfaces": [
+        "contracts",
+        "publication",
+        "workflow"
+      ],
+      "rationale": "Generate new release lifecycle runs with schema-3 production quality assessments and a bounded schema-2 plan so public N-1 authority can validate the Release PR candidate."
+    },
+    {
+      "id": "release-pr-self-adoption-refresh",
+      "type": "fix",
+      "surfaces": [
+        "adoption",
+        "publication",
+        "workflow"
+      ],
+      "rationale": "Defer a new Release PR until the latest public authority is self-adopted, refresh that adoption through the exact verified publication event, and resume release derivation automatically after the adoption merge."
+    },
+    {
+      "id": "release-review-qualification-gate",
+      "type": "fix",
+      "surfaces": [
+        "contracts",
+        "publication",
+        "workflow"
+      ],
+      "rationale": "Derive release review quality from its registered contract and require a disposable complete public N-1 lifecycle rehearsal before source changes can merge."
+    }
+  ]
+}

{engineering_process-0.2.0 → engineering_process-0.2.1}/templates/adopt-process.py

@@ -500,6 +500,11 @@ def main(argv: list[str] | None = None) -> int:
         type=Path,
         default=Path("requirements/process.txt"),
     )
+    parser.add_argument(
+        "--check",
+        action="store_true",
+        help="Validate through the installed hash-locked authority without applying",
+    )
     args = parser.parse_args(argv)
     project_root = Path(os.path.abspath(os.fspath(args.project_root)))
     requirements_source, requirements_root = _requirements_binding(
@@ -566,7 +571,25 @@ def main(argv: list[str] | None = None) -> int:
         target_version = _installed_process_version(
             python, cwd=environment_root
         )
-        if target_version == current_version:
+        if args.check:
+            output = _run(
+                [
+                    str(python),
+                    "-I",
+                    "-c",
+                    "from engineering_process.cli import main; "
+                    "raise SystemExit(main())",
+                    "adoption",
+                    "check",
+                    "--project-root",
+                    str(project_root),
+                    "--requirements-lock",
+                    str(requirements_source),
+                    "--json",
+                ],
+                cwd=environment_root,
+            )
+        elif target_version == current_version:
             output = json.dumps(
                 {
                     "requirementsDigest": requirements_digest,
@@ -615,9 +638,11 @@ def main(argv: list[str] | None = None) -> int:
         if (
             not isinstance(result, dict)
             or result.get("requirementsDigest") != requirements_digest
+            or result.get("version") != target_version
         ):
             raise RuntimeError(
-                "adoption authority did not attest the private requirements snapshot"
+                "adoption authority did not attest the installed version and "
+                "private requirements snapshot"
             )
     sys.stdout.write(output)
     return 0

{engineering_process-0.2.0 → engineering_process-0.2.1}/tests/test_adoption_runner.py

@@ -262,7 +262,12 @@ class AdoptionRunnerTests(unittest.TestCase):
                     self.assertEqual(observed_snapshot, [snapshot])
                     self.assertTrue(source.samefile(checkout))
                     self.assertEqual(digest, expected)
-                    return json.dumps({"requirementsDigest": digest})
+                    return json.dumps(
+                        {
+                            "requirementsDigest": digest,
+                            "version": "0.1.1",
+                        }
+                    )
                 return ""
 
             with (
@@ -281,6 +286,61 @@ class AdoptionRunnerTests(unittest.TestCase):
                     ),
                 )
 
+    def test_check_uses_installed_authority_even_when_target_is_adopted(self):
+        runner = load_runner()
+        content = b"--only-binary :all:\nengineering-process==0.2.0\n"
+        digest = "sha256:" + hashlib.sha256(content).hexdigest()
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            self.write_process_lock(root, "0.2.0")
+            source = root / "requirements" / "process.txt"
+            source.parent.mkdir()
+            source.write_bytes(content)
+            adoption_commands: list[list[str]] = []
+
+            def fake_run(argv, *, cwd):
+                del cwd
+                if any("engineering_process.VERSION" in part for part in argv):
+                    return "0.2.0\n"
+                if "adoption" in argv:
+                    adoption_commands.append(argv)
+                    self.assertIn("check", argv)
+                    self.assertNotIn("apply", argv)
+                    supplied = Path(argv[argv.index("--requirements-lock") + 1])
+                    self.assertTrue(source.samefile(supplied))
+                    return json.dumps(
+                        {
+                            "requirementsDigest": digest,
+                            "status": "passed",
+                            "version": "0.2.0",
+                        }
+                    )
+                return ""
+
+            with (
+                mock.patch.object(runner, "_run", side_effect=fake_run),
+                mock.patch.object(runner.sys.stdout, "write"),
+            ):
+                self.assertEqual(
+                    0,
+                    runner.main(
+                        [
+                            "--project-root",
+                            str(root),
+                            "--requirements-lock",
+                            "requirements/process.txt",
+                            "--check",
+                        ]
+                    ),
+                )
+
+            self.assertEqual(1, len(adoption_commands))
+            self.assertIn("-I", adoption_commands[0])
+            self.assertIn(
+                "from engineering_process.cli import main; raise SystemExit(main())",
+                adoption_commands[0],
+            )
+
     def test_main_noops_when_the_hash_locked_target_is_already_adopted(self):
         runner = load_runner()
         content = b"--only-binary :all:\nengineering-process==0.1.1\n"

{engineering_process-0.2.0 → engineering_process-0.2.1}/tests/test_publication.py

@@ -1,3 +1,5 @@
+import base64
+import json
 import subprocess
 import tempfile
 import unittest
@@ -96,6 +98,57 @@ class PublicationTests(unittest.TestCase):
             ),
         )
 
+    def test_draft_renovate_pr_accepts_only_bounded_debug_metadata(self):
+        payload = base64.b64encode(
+            json.dumps(
+                {
+                    "createdInVer": "44.37.1",
+                    "updatedInVer": "44.37.1",
+                    "targetBranch": "main",
+                    "labels": [],
+                },
+                separators=(",", ":"),
+            ).encode("utf-8")
+        ).decode("ascii")
+        body = pr_body("pending") + f"\n<!--renovate-debug:{payload}-->\n"
+
+        self.assertEqual(
+            [],
+            validate_pull_request(
+                title="chore(deps): update actions/checkout action to v7",
+                body=body,
+                branch="automation/renovate/actions-checkout-7.x",
+                state="draft",
+            ),
+        )
+
+    def test_renovate_metadata_does_not_allow_arbitrary_html_or_contracts(self):
+        valid = {
+            "createdInVer": "44.37.1",
+            "updatedInVer": "44.37.1",
+            "targetBranch": "main",
+            "labels": [],
+        }
+        unexpected = {**valid, "extra": "not-allowed"}
+        encoded = base64.b64encode(
+            json.dumps(unexpected, separators=(",", ":")).encode("utf-8")
+        ).decode("ascii")
+        bodies = (
+            pr_body("pending") + "\n<div>hidden policy</div>\n",
+            pr_body("pending") + "\n<!--renovate-debug:not-base64-->\n",
+            pr_body("pending") + f"\n<!--renovate-debug:{encoded}-->\n",
+        )
+
+        for body in bodies:
+            with self.subTest(body=body[-100:]):
+                self.assertTrue(
+                    validate_pull_request(
+                        title="chore(deps): update actions/checkout action to v7",
+                        body=body,
+                        branch="automation/renovate/actions-checkout-7.x",
+                        state="draft",
+                    )
+                )
     def test_project_extensions_cannot_redefine_common_policy(self):
         duplicate_section = pr_body() + (
             "\n## Independent review\n\nIndependent review is not required here.\n"

engineering_process-0.2.1/tests/test_publish_event.py

@@ -0,0 +1,57 @@
+import unittest
+
+from verification.validate_publish_event import (
+    PublishEventError,
+    validate_publish_event,
+)
+
+
+def event() -> dict[str, object]:
+    return {
+        "action": "engineering-process-release-ready",
+        "client_payload": {
+            "attestationDigest": f"sha256:{'a' * 64}",
+            "commit": "b" * 40,
+            "repository": "phuongnse/engineering-process",
+            "tag": "v0.2.0",
+            "version": "0.2.0",
+        },
+        "repository": {"full_name": "phuongnse/engineering-process"},
+        "sender": {"login": "phuongnse-renovate-ops[bot]"},
+    }
+
+
+class PublishEventTests(unittest.TestCase):
+    def test_exact_app_authored_event_is_accepted(self):
+        self.assertEqual(event()["client_payload"], validate_publish_event(event()))
+
+    def test_different_sender_is_rejected(self):
+        candidate = event()
+        candidate["sender"]["login"] = "phuongnse"
+
+        with self.assertRaisesRegex(PublishEventError, "release GitHub App"):
+            validate_publish_event(candidate)
+
+    def test_extra_payload_authority_is_rejected(self):
+        candidate = event()
+        candidate["client_payload"]["skipExisting"] = True
+
+        with self.assertRaisesRegex(PublishEventError, "unexpected fields"):
+            validate_publish_event(candidate)
+
+    def test_tag_commit_and_digest_are_bound(self):
+        cases = (
+            ("tag", "v0.2.1", "tag does not match"),
+            ("commit", "pending", "invalid commit"),
+            ("attestationDigest", "sha256:pending", "attestation digest"),
+        )
+        for field, value, message in cases:
+            with self.subTest(field=field):
+                candidate = event()
+                candidate["client_payload"][field] = value
+                with self.assertRaisesRegex(PublishEventError, message):
+                    validate_publish_event(candidate)
+
+
+if __name__ == "__main__":
+    unittest.main()