engineering-process 0.2.0__tar.gz → 0.3.0__tar.gz

{engineering_process-0.2.0/engineering_process.egg-info → engineering_process-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 0.2.0
+Version: 0.3.0
 Summary: Agent-neutral end-to-end engineering lifecycle and deterministic process CLI
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -136,6 +136,26 @@ attribute files are rejected by existing managed-tree ownership and content chec
 External Git overrides that alter a checkout still fail byte-exact distribution
 attestation. A consumer never authors or maintains process skills locally.
 
+CI installs the pinned authority through the repository-root
+`phuongnse/engineering-process` action from the same governed release. Consumers pin
+the action with the release commit's full object id and retain the human-readable
+`v<SemVer>` annotation; floating tags and copied installer implementations are not
+supported. The action reads the consumer-owned `requirements/process.txt` and changes
+no version or source decision: it preserves the complete hash lock, public PyPI,
+binary-only policy, sanitized pip environment, exact-version-only propagation retry,
+bounded output and time, and cross-platform descendant cleanup. The action source is
+resolved only from `github.action_path`, so an untrusted consumer checkout cannot
+replace the installer.
+
+Project-owned CI workflows remain local because they select the project's commands
+and evidence. Reusable installation and publication grammar belong to this
+distribution; product, architecture, dependency, documentation, and acceptance
+checks remain with the consumer. The managed `.process/adopt-process.py` and Windows
+Job Object sidecar are intentional bootstrap snapshots, not consumer implementations:
+Renovate must install and verify a target authority before that target exists in the
+checkout, and `processctl sync --check` compares those bytes with the pinned
+distribution.
+
 For an existing consumer, a published version is adopted through one Renovate draft.
 The managed runner installs the target authority from the complete hash lock outside
 the checkout and atomically updates the process lock and managed assets. If the
@@ -386,6 +406,13 @@ processctl change verify --change-id issue-123 --profile review \
   --actor worker --context worker-session --actor-kind agent
 ~~~
 
+If later remote evidence or a source correction invalidates that verified checkpoint
+before review, commit the correction and run `change implement` again. The CLI
+preserves the earlier evidence, records `verification-invalidated`, increments the
+cycle, and requires every profile again. It accepts this transition only when the
+recorded verification is actually stale; a current verified checkpoint cannot use it
+to bypass independent review.
+
 After the phase becomes `verified`, a separate reviewer context registers its
 assignment:
 
@@ -504,6 +531,11 @@ authenticates who produced it.
   draft contains the new lock, managed contracts, skill snapshots, and any
   target-version consumer-owned project migration; after CI and fresh-context
   independent review, merge is the end of adoption.
+- The repository-root GitHub Action is the shared CI bootstrap surface. Consumers pin
+  its full governed release commit, while the exact Python authority remains selected
+  exclusively by their hash-locked `requirements/process.txt`. The action invokes the
+  producer-owned installer from its immutable action checkout and never downloads or
+  executes helper source from the consumer branch.
 - Versioned JSON schemas define change, plan, verification, review, lifecycle,
   completion-related artifacts, release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the

{engineering_process-0.2.0 → engineering_process-0.3.0}/README.md

@@ -101,6 +101,26 @@ attribute files are rejected by existing managed-tree ownership and content chec
 External Git overrides that alter a checkout still fail byte-exact distribution
 attestation. A consumer never authors or maintains process skills locally.
 
+CI installs the pinned authority through the repository-root
+`phuongnse/engineering-process` action from the same governed release. Consumers pin
+the action with the release commit's full object id and retain the human-readable
+`v<SemVer>` annotation; floating tags and copied installer implementations are not
+supported. The action reads the consumer-owned `requirements/process.txt` and changes
+no version or source decision: it preserves the complete hash lock, public PyPI,
+binary-only policy, sanitized pip environment, exact-version-only propagation retry,
+bounded output and time, and cross-platform descendant cleanup. The action source is
+resolved only from `github.action_path`, so an untrusted consumer checkout cannot
+replace the installer.
+
+Project-owned CI workflows remain local because they select the project's commands
+and evidence. Reusable installation and publication grammar belong to this
+distribution; product, architecture, dependency, documentation, and acceptance
+checks remain with the consumer. The managed `.process/adopt-process.py` and Windows
+Job Object sidecar are intentional bootstrap snapshots, not consumer implementations:
+Renovate must install and verify a target authority before that target exists in the
+checkout, and `processctl sync --check` compares those bytes with the pinned
+distribution.
+
 For an existing consumer, a published version is adopted through one Renovate draft.
 The managed runner installs the target authority from the complete hash lock outside
 the checkout and atomically updates the process lock and managed assets. If the
@@ -351,6 +371,13 @@ processctl change verify --change-id issue-123 --profile review \
   --actor worker --context worker-session --actor-kind agent
 ~~~
 
+If later remote evidence or a source correction invalidates that verified checkpoint
+before review, commit the correction and run `change implement` again. The CLI
+preserves the earlier evidence, records `verification-invalidated`, increments the
+cycle, and requires every profile again. It accepts this transition only when the
+recorded verification is actually stale; a current verified checkpoint cannot use it
+to bypass independent review.
+
 After the phase becomes `verified`, a separate reviewer context registers its
 assignment:
 
@@ -469,6 +496,11 @@ authenticates who produced it.
   draft contains the new lock, managed contracts, skill snapshots, and any
   target-version consumer-owned project migration; after CI and fresh-context
   independent review, merge is the end of adoption.
+- The repository-root GitHub Action is the shared CI bootstrap surface. Consumers pin
+  its full governed release commit, while the exact Python authority remains selected
+  exclusively by their hash-locked `requirements/process.txt`. The action invokes the
+  producer-owned installer from its immutable action checkout and never downloads or
+  executes helper source from the consumer branch.
 - Versioned JSON schemas define change, plan, verification, review, lifecycle,
   completion-related artifacts, release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the

{engineering_process-0.2.0 → engineering_process-0.3.0}/VERSIONING.md

@@ -71,6 +71,13 @@ verification manifest and project-adoption migration each follow that rule. Addi
 optional `timeoutSeconds` evidence to verification schema 2 preserves existing
 schema-2 documents and therefore does not advance that artifact's schema version.
 
+Every generator must be qualified against the exact released reader that consumes its
+output. For a lifecycle artifact, validation at creation is insufficient: CI runs the
+generated change, plan, review, completion, and exported evidence through public N-1
+up to the final consuming transition. Review schema and quality mappings derive from
+the registered change contract instead of being maintained as an independent version
+constant.
+
 Package `schemaImpact` is `unchanged`, `additive`, or `breaking` for the combined
 release. Additive schema capability requires at least a capability release; a
 breaking schema requires an incompatible release.
@@ -91,13 +98,29 @@ Release, self-adoption, and consumer adoption are separate changes:
    checkpoint. Merge completes adoption; there is no post-merge synchronization.
 5. N+1 governs only changes that begin after the adoption checkpoint.
 
+The repository-root GitHub Action and Python package are two surfaces of the same
+governed release checkpoint. A consumer invocation pins the action by the release
+commit's full object id and keeps the `v<SemVer>` annotation; Renovate groups that
+GitHub Action identity with the direct Python authority update. The action does not
+select the package version. It installs only the consumer's complete hash lock, so
+the process lock, Python artifacts, managed assets, action source, and reviewed tag
+remain independently checkable parts of one release identity.
+
+Consumer repositories do not own copies of reusable installation or publication
+algorithms. They retain declarative process/project locks, exact project commands,
+and managed bootstrap snapshots required before a target version is installed. A
+clean-cutover PR may delete an obsolete local helper only after it pins an immutable
+public action checkpoint; no compatibility shim or dual execution path is retained.
+
 Renovate PRs are generated adoption candidates, not trusted adoption evidence.
 Automerge is forbidden for process-authority updates. A PR that changes only a
 requirement pin, omits generated hashes or managed assets, or requires a post-merge
 step must fail closed.
 
 `requirements/process.in` owns the direct public pin and `requirements/process.txt`
-is its pip-compile hash lock. Renovate's exact allowlisted post-upgrade command runs
+is its pip-compile hash lock. The lock generator is pinned, and the committed lock must
+cover compatible binary artifacts for every supported Python/OS runner rather than
+only the platform that compiled it. Renovate's exact allowlisted post-upgrade command runs
 `.process/adopt-process.py`; that managed runner creates a bounded temporary
 environment outside the checkout, rejects symlink, junction, or reparse input in
 every supplied lock-path component, and makes one stable private snapshot. Component

{engineering_process-0.2.0 → engineering_process-0.3.0}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "0.2.0"
+VERSION = "0.3.0"

{engineering_process-0.2.0 → engineering_process-0.3.0}/engineering_process/lifecycle.py

@@ -624,10 +624,45 @@ def _begin_implementation_unlocked(
     kind: str,
 ) -> dict[str, Any]:
     state = load_state(project_root, change_id)
-    _require_phase(state, "planned", "implementing", "changes-requested")
     _contract(project_root, state)
     _plan(project_root, state)
     actor = _actor(actor_id, context_id, kind)
+    if state["phase"] == "verified":
+        source = source_state(project_root)
+        checkpoints = {item["checkpoint"] for item in state["verification"]}
+        fingerprints = {
+            item["workspaceFingerprint"] for item in state["verification"]
+        }
+        current = (
+            source["dirty"] is False
+            and source["checkpoint"] is not None
+            and source["fingerprint"] is not None
+            and checkpoints == {source["checkpoint"]}
+            and fingerprints == {source["fingerprint"]}
+        )
+        if current:
+            raise ContractError(
+                "current verified change must enter independent review before "
+                "another implementation cycle"
+            )
+        previous_cycle = state["cycle"]
+        previous_verification = list(state["verification"])
+        state["cycle"] += 1
+        state["implementationActors"] = []
+        state["verification"] = []
+        state["reviewAssignment"] = None
+        state["review"] = None
+        _event(
+            state,
+            "verification-invalidated",
+            actor,
+            cycle=state["cycle"],
+            previousCycle=previous_cycle,
+            previousVerification=previous_verification,
+            reason="source-changed-after-verification",
+        )
+    else:
+        _require_phase(state, "planned", "implementing", "changes-requested")
     if state["phase"] == "changes-requested":
         state["cycle"] += 1
         state["implementationActors"] = []

{engineering_process-0.2.0 → engineering_process-0.3.0}/engineering_process/publication.py

@@ -1,5 +1,8 @@
 from __future__ import annotations
 
+import base64
+import binascii
+import json
 import re
 from pathlib import Path
 
@@ -243,12 +246,66 @@ def managed_pull_request_visibility_issues(body: str) -> list[str]:
 
 
 PROJECT_EXTENSION_HEADING = "## Project-specific requirements"
+RENOVATE_DEBUG_COMMENT_RE = re.compile(
+    r"^<!--renovate-debug:(?P<payload>[A-Za-z0-9+/]{1,4096}={0,2})-->$"
+)
+RENOVATE_DEBUG_KEYS = {
+    "createdInVer",
+    "updatedInVer",
+    "targetBranch",
+    "labels",
+}
+
+
+def _strip_renovate_debug_comment(extension: str) -> tuple[str, list[str]]:
+    lines = extension.strip().splitlines()
+    matches = [
+        (index, match)
+        for index, line in enumerate(lines)
+        if (match := RENOVATE_DEBUG_COMMENT_RE.fullmatch(line)) is not None
+    ]
+    if not matches:
+        return extension, []
+    if len(matches) != 1 or matches[0][0] != len(lines) - 1:
+        return extension, ["Renovate metadata comment must appear exactly once at the end"]
+    _, match = matches[0]
+    try:
+        decoded = base64.b64decode(match.group("payload"), validate=True)
+        if len(decoded) > 3072:
+            raise ValueError("payload exceeds 3072 decoded bytes")
+        metadata = json.loads(decoded.decode("utf-8"))
+    except (binascii.Error, UnicodeDecodeError, json.JSONDecodeError, ValueError):
+        return extension, ["Renovate metadata comment must contain bounded base64 JSON"]
+    if not isinstance(metadata, dict) or set(metadata) != RENOVATE_DEBUG_KEYS:
+        return extension, ["Renovate metadata comment has an unexpected JSON contract"]
+    if any(
+        not isinstance(metadata[key], str)
+        or not metadata[key]
+        or len(metadata[key]) > 64
+        for key in ("createdInVer", "updatedInVer")
+    ):
+        return extension, ["Renovate metadata versions must be bounded strings"]
+    if metadata["targetBranch"] != "main":
+        return extension, ["Renovate metadata must target protected main"]
+    labels = metadata["labels"]
+    if (
+        not isinstance(labels, list)
+        or len(labels) > 50
+        or any(not isinstance(label, str) or len(label) > 100 for label in labels)
+    ):
+        return extension, ["Renovate metadata labels must be a bounded string list"]
+    return "\n".join(lines[:-1]).strip(), []
 
 
 def validate_project_extensions(body: str, *, allow_pending: bool) -> list[str]:
     body = _normalized_markdown(body)
     _, end = _managed_span(body)
     extension = body[end:]
+    if not extension.strip():
+        return []
+    extension, metadata_issues = _strip_renovate_debug_comment(extension)
+    if metadata_issues:
+        return metadata_issues
     if not extension.strip():
         return []
     if contains_raw_html(extension):

{engineering_process-0.2.0 → engineering_process-0.3.0}/engineering_process/release.py

@@ -118,10 +118,6 @@ def validate_reviewed_checkpoint(
         ],
     )
     if reviewed_checkpoint != release_checkpoint:
-        _git(
-            project_root,
-            ["merge-base", "--is-ancestor", reviewed_checkpoint, release_checkpoint],
-        )
         reviewed_tree = _git(
             project_root,
             ["rev-parse", "--verify", f"{reviewed_checkpoint}^{{tree}}"],

{engineering_process-0.2.0 → engineering_process-0.3.0}/engineering_process/release_candidate.py

@@ -232,7 +232,7 @@ def _release_lifecycle_documents(
 ) -> tuple[bytes, bytes]:
     change_id = f"release-{version.replace('.', '-')}"
     contract = {
-        "schemaVersion": 2,
+        "schemaVersion": 3,
         "id": change_id,
         "summary": f"Authorize and publish {project} {version}",
         "source": "Automatically aggregated reviewed release-change fragments",
@@ -259,6 +259,71 @@ def _release_lifecycle_documents(
             },
         ],
         "requiredProfiles": ["development", "review"],
+        "quality": {
+            "standard": "production-v1",
+            "assessments": [
+                {
+                    "dimension": "compatibility",
+                    "status": "applicable",
+                    "rationale": "The release must preserve its declared compatibility and exact identity surfaces.",
+                    "criteria": ["ac-identity"],
+                },
+                {
+                    "dimension": "correctness",
+                    "status": "applicable",
+                    "rationale": "The derived identity and published bytes must match the reviewed release contract.",
+                    "criteria": ["ac-identity", "ac-publication"],
+                },
+                {
+                    "dimension": "maintainability",
+                    "status": "applicable",
+                    "rationale": "Independent review verifies the generated contract and deterministic release owner.",
+                    "criteria": ["ac-review"],
+                },
+                {
+                    "dimension": "observability",
+                    "status": "applicable",
+                    "rationale": "Release evidence and attestations expose the exact publication outcome.",
+                    "criteria": ["ac-publication"],
+                },
+                {
+                    "dimension": "operability",
+                    "status": "applicable",
+                    "rationale": "The reviewed release must publish and recover through the declared automated workflow.",
+                    "criteria": ["ac-publication"],
+                },
+                {
+                    "dimension": "performance",
+                    "status": "not-applicable",
+                    "rationale": "Release authorization adds no product runtime or scaling behavior.",
+                    "criteria": [],
+                },
+                {
+                    "dimension": "privacy",
+                    "status": "not-applicable",
+                    "rationale": "Release metadata contains no personal or sensitive data processing.",
+                    "criteria": [],
+                },
+                {
+                    "dimension": "reliability",
+                    "status": "applicable",
+                    "rationale": "Immutable assets and exact external-state checks must fail closed and recover deterministically.",
+                    "criteria": ["ac-publication"],
+                },
+                {
+                    "dimension": "security",
+                    "status": "applicable",
+                    "rationale": "Independent review and merge remain the only publication authorization boundary.",
+                    "criteria": ["ac-review"],
+                },
+                {
+                    "dimension": "supply-chain",
+                    "status": "applicable",
+                    "rationale": "The release binds source, version, artifacts, attestations, and registry bytes.",
+                    "criteria": ["ac-identity", "ac-publication"],
+                },
+            ],
+        },
         "signOff": {
             "required": False,
             "status": "not-required",
@@ -268,7 +333,7 @@ def _release_lifecycle_documents(
     contract_bytes = _canonical_json_bytes(contract)
     contract_digest = f"sha256:{hashlib.sha256(contract_bytes).hexdigest()}"
     plan = {
-        "schemaVersion": 1,
+        "schemaVersion": 2,
         "changeId": change_id,
         "contractDigest": contract_digest,
         "approach": "Validate the generated release contract and every declared surface, build from the exact reviewed tree, and permit publication only after independent approval and merge.",

{engineering_process-0.2.0 → engineering_process-0.3.0/engineering_process.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 0.2.0
+Version: 0.3.0
 Summary: Agent-neutral end-to-end engineering lifecycle and deterministic process CLI
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -136,6 +136,26 @@ attribute files are rejected by existing managed-tree ownership and content chec
 External Git overrides that alter a checkout still fail byte-exact distribution
 attestation. A consumer never authors or maintains process skills locally.
 
+CI installs the pinned authority through the repository-root
+`phuongnse/engineering-process` action from the same governed release. Consumers pin
+the action with the release commit's full object id and retain the human-readable
+`v<SemVer>` annotation; floating tags and copied installer implementations are not
+supported. The action reads the consumer-owned `requirements/process.txt` and changes
+no version or source decision: it preserves the complete hash lock, public PyPI,
+binary-only policy, sanitized pip environment, exact-version-only propagation retry,
+bounded output and time, and cross-platform descendant cleanup. The action source is
+resolved only from `github.action_path`, so an untrusted consumer checkout cannot
+replace the installer.
+
+Project-owned CI workflows remain local because they select the project's commands
+and evidence. Reusable installation and publication grammar belong to this
+distribution; product, architecture, dependency, documentation, and acceptance
+checks remain with the consumer. The managed `.process/adopt-process.py` and Windows
+Job Object sidecar are intentional bootstrap snapshots, not consumer implementations:
+Renovate must install and verify a target authority before that target exists in the
+checkout, and `processctl sync --check` compares those bytes with the pinned
+distribution.
+
 For an existing consumer, a published version is adopted through one Renovate draft.
 The managed runner installs the target authority from the complete hash lock outside
 the checkout and atomically updates the process lock and managed assets. If the
@@ -386,6 +406,13 @@ processctl change verify --change-id issue-123 --profile review \
   --actor worker --context worker-session --actor-kind agent
 ~~~
 
+If later remote evidence or a source correction invalidates that verified checkpoint
+before review, commit the correction and run `change implement` again. The CLI
+preserves the earlier evidence, records `verification-invalidated`, increments the
+cycle, and requires every profile again. It accepts this transition only when the
+recorded verification is actually stale; a current verified checkpoint cannot use it
+to bypass independent review.
+
 After the phase becomes `verified`, a separate reviewer context registers its
 assignment:
 
@@ -504,6 +531,11 @@ authenticates who produced it.
   draft contains the new lock, managed contracts, skill snapshots, and any
   target-version consumer-owned project migration; after CI and fresh-context
   independent review, merge is the end of adoption.
+- The repository-root GitHub Action is the shared CI bootstrap surface. Consumers pin
+  its full governed release commit, while the exact Python authority remains selected
+  exclusively by their hash-locked `requirements/process.txt`. The action invokes the
+  producer-owned installer from its immutable action checkout and never downloads or
+  executes helper source from the consumer branch.
 - Versioned JSON schemas define change, plan, verification, review, lifecycle,
   completion-related artifacts, release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the

{engineering_process-0.2.0 → engineering_process-0.3.0}/engineering_process.egg-info/SOURCES.txt

@@ -109,9 +109,14 @@ tests/test_environment.py
 tests/test_evals.py
 tests/test_impact.py
 tests/test_lifecycle.py
+tests/test_process_install.py
 tests/test_publication.py
+tests/test_publish_event.py
+tests/test_pypi_publication.py
 tests/test_release.py
 tests/test_release_candidate.py
+tests/test_release_preparation.py
+tests/test_release_qualification.py
 tests/test_runner.py
 tests/test_runtime.py
 tests/test_schemas.py

{engineering_process-0.2.0 → engineering_process-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-process"
-version = "0.2.0"
+version = "0.3.0"
 description = "Agent-neutral end-to-end engineering lifecycle and deterministic process CLI"
 readme = "README.md"
 license = "MIT"

engineering_process-0.3.0/release.json

@@ -0,0 +1,54 @@
+{
+  "schemaVersion": 3,
+  "previousVersion": "0.2.1",
+  "version": "0.3.0",
+  "classification": "minor",
+  "compatibility": "backward-compatible",
+  "schemaImpact": "unchanged",
+  "migration": null,
+  "identity": {
+    "package": "engineering-process",
+    "distribution": "engineering_process",
+    "tag": "v0.3.0",
+    "releaseName": "v0.3.0",
+    "runtimeVersion": {
+      "path": "engineering_process/__init__.py",
+      "variable": "VERSION"
+    },
+    "artifacts": [
+      "engineering_process-0.3.0-py3-none-any.whl",
+      "engineering_process-0.3.0.tar.gz"
+    ],
+    "receiptAsset": "engineering-process-v0.3.0-evidence.json",
+    "authorizationAsset": null
+  },
+  "provenance": {
+    "mode": "governed",
+    "statement": "The public N-1 lifecycle receipt and reviewed Release PR authorize this release.",
+    "lifecycleReceipt": {
+      "asset": "engineering-process-v0.3.0-evidence.json",
+      "project": "engineering-process",
+      "changeId": "release-0-3-0",
+      "cycle": 1
+    }
+  },
+  "changes": [
+    {
+      "id": "consumer-process-boundary-cleanup",
+      "type": "capability",
+      "surfaces": [
+        "ci-bootstrap",
+        "workflow"
+      ],
+      "rationale": "Provide one immutable producer-owned CI installation action so consumers can remove copied process algorithms without weakening exact hash locks or bounded registry propagation recovery."
+    },
+    {
+      "id": "reopen-stale-verification",
+      "type": "fix",
+      "surfaces": [
+        "lifecycle"
+      ],
+      "rationale": "Allow a verified change invalidated by later remote evidence or a source correction to begin a new implementation cycle while preserving prior evidence and still forbidding current verified work from bypassing independent review."
+    }
+  ]
+}

{engineering_process-0.2.0 → engineering_process-0.3.0}/templates/adopt-process.py

@@ -500,6 +500,11 @@ def main(argv: list[str] | None = None) -> int:
         type=Path,
         default=Path("requirements/process.txt"),
     )
+    parser.add_argument(
+        "--check",
+        action="store_true",
+        help="Validate through the installed hash-locked authority without applying",
+    )
     args = parser.parse_args(argv)
     project_root = Path(os.path.abspath(os.fspath(args.project_root)))
     requirements_source, requirements_root = _requirements_binding(
@@ -566,7 +571,25 @@ def main(argv: list[str] | None = None) -> int:
         target_version = _installed_process_version(
             python, cwd=environment_root
         )
-        if target_version == current_version:
+        if args.check:
+            output = _run(
+                [
+                    str(python),
+                    "-I",
+                    "-c",
+                    "from engineering_process.cli import main; "
+                    "raise SystemExit(main())",
+                    "adoption",
+                    "check",
+                    "--project-root",
+                    str(project_root),
+                    "--requirements-lock",
+                    str(requirements_source),
+                    "--json",
+                ],
+                cwd=environment_root,
+            )
+        elif target_version == current_version:
             output = json.dumps(
                 {
                     "requirementsDigest": requirements_digest,
@@ -615,9 +638,11 @@ def main(argv: list[str] | None = None) -> int:
         if (
             not isinstance(result, dict)
             or result.get("requirementsDigest") != requirements_digest
+            or result.get("version") != target_version
         ):
             raise RuntimeError(
-                "adoption authority did not attest the private requirements snapshot"
+                "adoption authority did not attest the installed version and "
+                "private requirements snapshot"
             )
     sys.stdout.write(output)
     return 0

{engineering_process-0.2.0 → engineering_process-0.3.0}/tests/test_adoption_runner.py

@@ -262,7 +262,12 @@ class AdoptionRunnerTests(unittest.TestCase):
                     self.assertEqual(observed_snapshot, [snapshot])
                     self.assertTrue(source.samefile(checkout))
                     self.assertEqual(digest, expected)
-                    return json.dumps({"requirementsDigest": digest})
+                    return json.dumps(
+                        {
+                            "requirementsDigest": digest,
+                            "version": "0.1.1",
+                        }
+                    )
                 return ""
 
             with (
@@ -281,6 +286,61 @@ class AdoptionRunnerTests(unittest.TestCase):
                     ),
                 )
 
+    def test_check_uses_installed_authority_even_when_target_is_adopted(self):
+        runner = load_runner()
+        content = b"--only-binary :all:\nengineering-process==0.2.0\n"
+        digest = "sha256:" + hashlib.sha256(content).hexdigest()
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            self.write_process_lock(root, "0.2.0")
+            source = root / "requirements" / "process.txt"
+            source.parent.mkdir()
+            source.write_bytes(content)
+            adoption_commands: list[list[str]] = []
+
+            def fake_run(argv, *, cwd):
+                del cwd
+                if any("engineering_process.VERSION" in part for part in argv):
+                    return "0.2.0\n"
+                if "adoption" in argv:
+                    adoption_commands.append(argv)
+                    self.assertIn("check", argv)
+                    self.assertNotIn("apply", argv)
+                    supplied = Path(argv[argv.index("--requirements-lock") + 1])
+                    self.assertTrue(source.samefile(supplied))
+                    return json.dumps(
+                        {
+                            "requirementsDigest": digest,
+                            "status": "passed",
+                            "version": "0.2.0",
+                        }
+                    )
+                return ""
+
+            with (
+                mock.patch.object(runner, "_run", side_effect=fake_run),
+                mock.patch.object(runner.sys.stdout, "write"),
+            ):
+                self.assertEqual(
+                    0,
+                    runner.main(
+                        [
+                            "--project-root",
+                            str(root),
+                            "--requirements-lock",
+                            "requirements/process.txt",
+                            "--check",
+                        ]
+                    ),
+                )
+
+            self.assertEqual(1, len(adoption_commands))
+            self.assertIn("-I", adoption_commands[0])
+            self.assertIn(
+                "from engineering_process.cli import main; raise SystemExit(main())",
+                adoption_commands[0],
+            )
+
     def test_main_noops_when_the_hash_locked_target_is_already_adopted(self):
         runner = load_runner()
         content = b"--only-binary :all:\nengineering-process==0.1.1\n"