engineering-process 0.2.1__tar.gz → 0.3.0__tar.gz

{engineering_process-0.2.1/engineering_process.egg-info → engineering_process-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 0.2.1
+Version: 0.3.0
 Summary: Agent-neutral end-to-end engineering lifecycle and deterministic process CLI
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -136,6 +136,26 @@ attribute files are rejected by existing managed-tree ownership and content chec
 External Git overrides that alter a checkout still fail byte-exact distribution
 attestation. A consumer never authors or maintains process skills locally.
 
+CI installs the pinned authority through the repository-root
+`phuongnse/engineering-process` action from the same governed release. Consumers pin
+the action with the release commit's full object id and retain the human-readable
+`v<SemVer>` annotation; floating tags and copied installer implementations are not
+supported. The action reads the consumer-owned `requirements/process.txt` and changes
+no version or source decision: it preserves the complete hash lock, public PyPI,
+binary-only policy, sanitized pip environment, exact-version-only propagation retry,
+bounded output and time, and cross-platform descendant cleanup. The action source is
+resolved only from `github.action_path`, so an untrusted consumer checkout cannot
+replace the installer.
+
+Project-owned CI workflows remain local because they select the project's commands
+and evidence. Reusable installation and publication grammar belong to this
+distribution; product, architecture, dependency, documentation, and acceptance
+checks remain with the consumer. The managed `.process/adopt-process.py` and Windows
+Job Object sidecar are intentional bootstrap snapshots, not consumer implementations:
+Renovate must install and verify a target authority before that target exists in the
+checkout, and `processctl sync --check` compares those bytes with the pinned
+distribution.
+
 For an existing consumer, a published version is adopted through one Renovate draft.
 The managed runner installs the target authority from the complete hash lock outside
 the checkout and atomically updates the process lock and managed assets. If the
@@ -386,6 +406,13 @@ processctl change verify --change-id issue-123 --profile review \
   --actor worker --context worker-session --actor-kind agent
 ~~~
 
+If later remote evidence or a source correction invalidates that verified checkpoint
+before review, commit the correction and run `change implement` again. The CLI
+preserves the earlier evidence, records `verification-invalidated`, increments the
+cycle, and requires every profile again. It accepts this transition only when the
+recorded verification is actually stale; a current verified checkpoint cannot use it
+to bypass independent review.
+
 After the phase becomes `verified`, a separate reviewer context registers its
 assignment:
 
@@ -504,6 +531,11 @@ authenticates who produced it.
   draft contains the new lock, managed contracts, skill snapshots, and any
   target-version consumer-owned project migration; after CI and fresh-context
   independent review, merge is the end of adoption.
+- The repository-root GitHub Action is the shared CI bootstrap surface. Consumers pin
+  its full governed release commit, while the exact Python authority remains selected
+  exclusively by their hash-locked `requirements/process.txt`. The action invokes the
+  producer-owned installer from its immutable action checkout and never downloads or
+  executes helper source from the consumer branch.
 - Versioned JSON schemas define change, plan, verification, review, lifecycle,
   completion-related artifacts, release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the

{engineering_process-0.2.1 → engineering_process-0.3.0}/README.md

@@ -101,6 +101,26 @@ attribute files are rejected by existing managed-tree ownership and content chec
 External Git overrides that alter a checkout still fail byte-exact distribution
 attestation. A consumer never authors or maintains process skills locally.
 
+CI installs the pinned authority through the repository-root
+`phuongnse/engineering-process` action from the same governed release. Consumers pin
+the action with the release commit's full object id and retain the human-readable
+`v<SemVer>` annotation; floating tags and copied installer implementations are not
+supported. The action reads the consumer-owned `requirements/process.txt` and changes
+no version or source decision: it preserves the complete hash lock, public PyPI,
+binary-only policy, sanitized pip environment, exact-version-only propagation retry,
+bounded output and time, and cross-platform descendant cleanup. The action source is
+resolved only from `github.action_path`, so an untrusted consumer checkout cannot
+replace the installer.
+
+Project-owned CI workflows remain local because they select the project's commands
+and evidence. Reusable installation and publication grammar belong to this
+distribution; product, architecture, dependency, documentation, and acceptance
+checks remain with the consumer. The managed `.process/adopt-process.py` and Windows
+Job Object sidecar are intentional bootstrap snapshots, not consumer implementations:
+Renovate must install and verify a target authority before that target exists in the
+checkout, and `processctl sync --check` compares those bytes with the pinned
+distribution.
+
 For an existing consumer, a published version is adopted through one Renovate draft.
 The managed runner installs the target authority from the complete hash lock outside
 the checkout and atomically updates the process lock and managed assets. If the
@@ -351,6 +371,13 @@ processctl change verify --change-id issue-123 --profile review \
   --actor worker --context worker-session --actor-kind agent
 ~~~
 
+If later remote evidence or a source correction invalidates that verified checkpoint
+before review, commit the correction and run `change implement` again. The CLI
+preserves the earlier evidence, records `verification-invalidated`, increments the
+cycle, and requires every profile again. It accepts this transition only when the
+recorded verification is actually stale; a current verified checkpoint cannot use it
+to bypass independent review.
+
 After the phase becomes `verified`, a separate reviewer context registers its
 assignment:
 
@@ -469,6 +496,11 @@ authenticates who produced it.
   draft contains the new lock, managed contracts, skill snapshots, and any
   target-version consumer-owned project migration; after CI and fresh-context
   independent review, merge is the end of adoption.
+- The repository-root GitHub Action is the shared CI bootstrap surface. Consumers pin
+  its full governed release commit, while the exact Python authority remains selected
+  exclusively by their hash-locked `requirements/process.txt`. The action invokes the
+  producer-owned installer from its immutable action checkout and never downloads or
+  executes helper source from the consumer branch.
 - Versioned JSON schemas define change, plan, verification, review, lifecycle,
   completion-related artifacts, release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the

{engineering_process-0.2.1 → engineering_process-0.3.0}/VERSIONING.md

@@ -98,6 +98,20 @@ Release, self-adoption, and consumer adoption are separate changes:
    checkpoint. Merge completes adoption; there is no post-merge synchronization.
 5. N+1 governs only changes that begin after the adoption checkpoint.
 
+The repository-root GitHub Action and Python package are two surfaces of the same
+governed release checkpoint. A consumer invocation pins the action by the release
+commit's full object id and keeps the `v<SemVer>` annotation; Renovate groups that
+GitHub Action identity with the direct Python authority update. The action does not
+select the package version. It installs only the consumer's complete hash lock, so
+the process lock, Python artifacts, managed assets, action source, and reviewed tag
+remain independently checkable parts of one release identity.
+
+Consumer repositories do not own copies of reusable installation or publication
+algorithms. They retain declarative process/project locks, exact project commands,
+and managed bootstrap snapshots required before a target version is installed. A
+clean-cutover PR may delete an obsolete local helper only after it pins an immutable
+public action checkpoint; no compatibility shim or dual execution path is retained.
+
 Renovate PRs are generated adoption candidates, not trusted adoption evidence.
 Automerge is forbidden for process-authority updates. A PR that changes only a
 requirement pin, omits generated hashes or managed assets, or requires a post-merge

{engineering_process-0.2.1 → engineering_process-0.3.0}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "0.2.1"
+VERSION = "0.3.0"

{engineering_process-0.2.1 → engineering_process-0.3.0}/engineering_process/lifecycle.py

@@ -624,10 +624,45 @@ def _begin_implementation_unlocked(
     kind: str,
 ) -> dict[str, Any]:
     state = load_state(project_root, change_id)
-    _require_phase(state, "planned", "implementing", "changes-requested")
     _contract(project_root, state)
     _plan(project_root, state)
     actor = _actor(actor_id, context_id, kind)
+    if state["phase"] == "verified":
+        source = source_state(project_root)
+        checkpoints = {item["checkpoint"] for item in state["verification"]}
+        fingerprints = {
+            item["workspaceFingerprint"] for item in state["verification"]
+        }
+        current = (
+            source["dirty"] is False
+            and source["checkpoint"] is not None
+            and source["fingerprint"] is not None
+            and checkpoints == {source["checkpoint"]}
+            and fingerprints == {source["fingerprint"]}
+        )
+        if current:
+            raise ContractError(
+                "current verified change must enter independent review before "
+                "another implementation cycle"
+            )
+        previous_cycle = state["cycle"]
+        previous_verification = list(state["verification"])
+        state["cycle"] += 1
+        state["implementationActors"] = []
+        state["verification"] = []
+        state["reviewAssignment"] = None
+        state["review"] = None
+        _event(
+            state,
+            "verification-invalidated",
+            actor,
+            cycle=state["cycle"],
+            previousCycle=previous_cycle,
+            previousVerification=previous_verification,
+            reason="source-changed-after-verification",
+        )
+    else:
+        _require_phase(state, "planned", "implementing", "changes-requested")
     if state["phase"] == "changes-requested":
         state["cycle"] += 1
         state["implementationActors"] = []

{engineering_process-0.2.1 → engineering_process-0.3.0/engineering_process.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 0.2.1
+Version: 0.3.0
 Summary: Agent-neutral end-to-end engineering lifecycle and deterministic process CLI
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -136,6 +136,26 @@ attribute files are rejected by existing managed-tree ownership and content chec
 External Git overrides that alter a checkout still fail byte-exact distribution
 attestation. A consumer never authors or maintains process skills locally.
 
+CI installs the pinned authority through the repository-root
+`phuongnse/engineering-process` action from the same governed release. Consumers pin
+the action with the release commit's full object id and retain the human-readable
+`v<SemVer>` annotation; floating tags and copied installer implementations are not
+supported. The action reads the consumer-owned `requirements/process.txt` and changes
+no version or source decision: it preserves the complete hash lock, public PyPI,
+binary-only policy, sanitized pip environment, exact-version-only propagation retry,
+bounded output and time, and cross-platform descendant cleanup. The action source is
+resolved only from `github.action_path`, so an untrusted consumer checkout cannot
+replace the installer.
+
+Project-owned CI workflows remain local because they select the project's commands
+and evidence. Reusable installation and publication grammar belong to this
+distribution; product, architecture, dependency, documentation, and acceptance
+checks remain with the consumer. The managed `.process/adopt-process.py` and Windows
+Job Object sidecar are intentional bootstrap snapshots, not consumer implementations:
+Renovate must install and verify a target authority before that target exists in the
+checkout, and `processctl sync --check` compares those bytes with the pinned
+distribution.
+
 For an existing consumer, a published version is adopted through one Renovate draft.
 The managed runner installs the target authority from the complete hash lock outside
 the checkout and atomically updates the process lock and managed assets. If the
@@ -386,6 +406,13 @@ processctl change verify --change-id issue-123 --profile review \
   --actor worker --context worker-session --actor-kind agent
 ~~~
 
+If later remote evidence or a source correction invalidates that verified checkpoint
+before review, commit the correction and run `change implement` again. The CLI
+preserves the earlier evidence, records `verification-invalidated`, increments the
+cycle, and requires every profile again. It accepts this transition only when the
+recorded verification is actually stale; a current verified checkpoint cannot use it
+to bypass independent review.
+
 After the phase becomes `verified`, a separate reviewer context registers its
 assignment:
 
@@ -504,6 +531,11 @@ authenticates who produced it.
   draft contains the new lock, managed contracts, skill snapshots, and any
   target-version consumer-owned project migration; after CI and fresh-context
   independent review, merge is the end of adoption.
+- The repository-root GitHub Action is the shared CI bootstrap surface. Consumers pin
+  its full governed release commit, while the exact Python authority remains selected
+  exclusively by their hash-locked `requirements/process.txt`. The action invokes the
+  producer-owned installer from its immutable action checkout and never downloads or
+  executes helper source from the consumer branch.
 - Versioned JSON schemas define change, plan, verification, review, lifecycle,
   completion-related artifacts, release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the

{engineering_process-0.2.1 → engineering_process-0.3.0}/engineering_process.egg-info/SOURCES.txt

@@ -109,6 +109,7 @@ tests/test_environment.py
 tests/test_evals.py
 tests/test_impact.py
 tests/test_lifecycle.py
+tests/test_process_install.py
 tests/test_publication.py
 tests/test_publish_event.py
 tests/test_pypi_publication.py

{engineering_process-0.2.1 → engineering_process-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-process"
-version = "0.2.1"
+version = "0.3.0"
 description = "Agent-neutral end-to-end engineering lifecycle and deterministic process CLI"
 readme = "README.md"
 license = "MIT"

engineering_process-0.3.0/release.json

@@ -0,0 +1,54 @@
+{
+  "schemaVersion": 3,
+  "previousVersion": "0.2.1",
+  "version": "0.3.0",
+  "classification": "minor",
+  "compatibility": "backward-compatible",
+  "schemaImpact": "unchanged",
+  "migration": null,
+  "identity": {
+    "package": "engineering-process",
+    "distribution": "engineering_process",
+    "tag": "v0.3.0",
+    "releaseName": "v0.3.0",
+    "runtimeVersion": {
+      "path": "engineering_process/__init__.py",
+      "variable": "VERSION"
+    },
+    "artifacts": [
+      "engineering_process-0.3.0-py3-none-any.whl",
+      "engineering_process-0.3.0.tar.gz"
+    ],
+    "receiptAsset": "engineering-process-v0.3.0-evidence.json",
+    "authorizationAsset": null
+  },
+  "provenance": {
+    "mode": "governed",
+    "statement": "The public N-1 lifecycle receipt and reviewed Release PR authorize this release.",
+    "lifecycleReceipt": {
+      "asset": "engineering-process-v0.3.0-evidence.json",
+      "project": "engineering-process",
+      "changeId": "release-0-3-0",
+      "cycle": 1
+    }
+  },
+  "changes": [
+    {
+      "id": "consumer-process-boundary-cleanup",
+      "type": "capability",
+      "surfaces": [
+        "ci-bootstrap",
+        "workflow"
+      ],
+      "rationale": "Provide one immutable producer-owned CI installation action so consumers can remove copied process algorithms without weakening exact hash locks or bounded registry propagation recovery."
+    },
+    {
+      "id": "reopen-stale-verification",
+      "type": "fix",
+      "surfaces": [
+        "lifecycle"
+      ],
+      "rationale": "Allow a verified change invalidated by later remote evidence or a source correction to begin a new implementation cycle while preserving prior evidence and still forbidding current verified work from bypassing independent review."
+    }
+  ]
+}

{engineering_process-0.2.1 → engineering_process-0.3.0}/tests/test_lifecycle.py

@@ -300,6 +300,68 @@ class LifecycleTests(unittest.TestCase):
             self.assertEqual(report["impact"]["baseRef"], "HEAD")
             self.assertEqual(report["impact"]["changedPaths"], [])
 
+    def test_stale_verified_source_can_begin_a_new_implementation_cycle(self):
+        with tempfile.TemporaryDirectory() as directory:
+            base = Path(directory)
+            root = base / "project"
+            inputs = base / "inputs"
+            root.mkdir()
+            inputs.mkdir()
+            self.initialize_repository(root)
+            self.prepare_verified_change(root, inputs)
+
+            (root / "tracked.txt").write_text("remote CI correction\n", encoding="utf-8")
+            subprocess.run(["git", "add", "tracked.txt"], cwd=root, check=True)
+            subprocess.run(
+                ["git", "commit", "-qm", "fix: address remote verification"],
+                cwd=root,
+                check=True,
+            )
+
+            state = begin_implementation(
+                root,
+                "change-1",
+                actor_id="worker",
+                context_id="worker-context",
+                kind="agent",
+            )
+
+            self.assertEqual("implementing", state["phase"])
+            self.assertEqual(2, state["cycle"])
+            self.assertEqual([], state["verification"])
+            invalidated = [
+                event
+                for event in state["history"]
+                if event["event"] == "verification-invalidated"
+            ]
+            self.assertEqual(1, len(invalidated))
+            self.assertEqual(1, invalidated[0]["previousCycle"])
+            self.assertEqual(
+                "source-changed-after-verification", invalidated[0]["reason"]
+            )
+            self.assertEqual(2, len(invalidated[0]["previousVerification"]))
+
+    def test_current_verified_source_cannot_bypass_independent_review(self):
+        with tempfile.TemporaryDirectory() as directory:
+            base = Path(directory)
+            root = base / "project"
+            inputs = base / "inputs"
+            root.mkdir()
+            inputs.mkdir()
+            self.initialize_repository(root)
+            self.prepare_verified_change(root, inputs)
+
+            with self.assertRaisesRegex(
+                ContractError, "must enter independent review"
+            ):
+                begin_implementation(
+                    root,
+                    "change-1",
+                    actor_id="worker",
+                    context_id="worker-context",
+                    kind="agent",
+                )
+
     def test_full_lifecycle_requires_independent_review(self):
         with tempfile.TemporaryDirectory() as directory:
             base = Path(directory)

engineering_process-0.3.0/tests/test_process_install.py

@@ -0,0 +1,235 @@
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+from verification import install_process_runtime as installer
+from verification.install_process_runtime import (
+    Attempt,
+    BACKOFF_SECONDS,
+    InstallError,
+    PUBLIC_INDEX,
+    install_process_runtime,
+)
+
+
+class ProcessRuntimeInstallTests(unittest.TestCase):
+    def fixture(self, root: Path) -> Path:
+        lock = root / "requirements" / "process.txt"
+        lock.parent.mkdir()
+        lock.write_text(
+            "--only-binary :all:\n\nengineering-process==0.2.1 \\\n"
+            "    --hash=sha256:cbabb56b367f5d48e5f2d0e6dd5837eca7ea46c40b47ef232d7d04e014609153\n",
+            encoding="utf-8",
+        )
+        return lock
+
+    def test_installs_exact_hash_lock_from_public_index_with_sanitized_environment(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            lock = self.fixture(root)
+            calls = []
+
+            def runner(command, cwd, environment):
+                calls.append((tuple(command), cwd, environment))
+                return Attempt(0, b"installed\n", b"")
+
+            index_name = "_".join(("PIP", "INDEX", "URL"))
+            extra_index_name = "_".join(("PIP", "EXTRA", "INDEX", "URL"))
+            with patch.dict(
+                os.environ,
+                {
+                    index_name: "untrusted-index-sentinel",
+                    extra_index_name: "untrusted-extra-sentinel",
+                    "PYTHONPATH": "/untrusted",
+                },
+                clear=False,
+            ):
+                install_process_runtime(root, lock, runner=runner)
+
+        self.assertEqual(1, len(calls))
+        command, cwd, environment = calls[0]
+        self.assertEqual(root.resolve(), cwd)
+        self.assertIn("--require-hashes", command)
+        self.assertIn("--no-cache-dir", command)
+        self.assertEqual(PUBLIC_INDEX, command[command.index("--index-url") + 1])
+        self.assertEqual(str(lock.resolve()), command[-1])
+        self.assertNotIn(index_name, environment)
+        self.assertNotIn(extra_index_name, environment)
+        self.assertNotIn("PYTHONPATH", environment)
+        self.assertEqual(os.devnull, environment["PIP_CONFIG_FILE"])
+
+    def test_retries_only_exact_pinned_version_absence(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            lock = self.fixture(root)
+            attempts = iter(
+                (
+                    Attempt(
+                        1,
+                        b"",
+                        (
+                            b"Could not find a version that satisfies the requirement "
+                            b"engineering-process==0.2.1\n"
+                            b"No matching distribution found for "
+                            b"engineering-process==0.2.1\n"
+                        ),
+                    ),
+                    Attempt(0, b"installed\n", b""),
+                )
+            )
+            sleeps = []
+
+            install_process_runtime(
+                root,
+                lock,
+                runner=lambda *_arguments: next(attempts),
+                sleeper=sleeps.append,
+            )
+
+        self.assertEqual([BACKOFF_SECONDS[0]], sleeps)
+
+    def test_fails_immediately_for_hash_or_other_deterministic_errors(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            lock = self.fixture(root)
+            sleeps = []
+
+            with self.assertRaisesRegex(InstallError, "non-retryable"):
+                install_process_runtime(
+                    root,
+                    lock,
+                    runner=lambda *_arguments: Attempt(
+                        1, b"", b"THESE PACKAGES DO NOT MATCH THE HASHES\n"
+                    ),
+                    sleeper=sleeps.append,
+                )
+
+        self.assertEqual([], sleeps)
+
+    def test_bounds_timeout_output_and_eventual_absence(self):
+        scenarios = (
+            (Attempt(-1, b"", b"", timed_out=True), "exceeded 300 seconds"),
+            (Attempt(1, b"", b"", output_exceeded=True), "output exceeded"),
+        )
+        for attempt, expected in scenarios:
+            with self.subTest(expected), tempfile.TemporaryDirectory() as directory:
+                root = Path(directory)
+                lock = self.fixture(root)
+                with self.assertRaisesRegex(InstallError, expected):
+                    install_process_runtime(
+                        root,
+                        lock,
+                        runner=lambda *_arguments, value=attempt: value,
+                        sleeper=lambda _delay: None,
+                    )
+
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            lock = self.fixture(root)
+            transient = Attempt(
+                1,
+                b"",
+                (
+                    b"Could not find a version that satisfies the requirement "
+                    b"engineering-process==0.2.1\n"
+                    b"No matching distribution found for engineering-process==0.2.1\n"
+                ),
+            )
+            sleeps = []
+            with self.assertRaisesRegex(InstallError, "did not become visible"):
+                install_process_runtime(
+                    root,
+                    lock,
+                    runner=lambda *_arguments: transient,
+                    sleeper=sleeps.append,
+                )
+
+        self.assertEqual(list(BACKOFF_SECONDS), sleeps)
+
+    def test_rejects_ambiguous_non_binary_or_symlinked_locks(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            lock = self.fixture(root)
+            lock.write_text(
+                "engineering-process==0.2.1\nengineering-process==0.2.1\n",
+                encoding="utf-8",
+            )
+            with self.assertRaisesRegex(InstallError, "exactly one"):
+                install_process_runtime(
+                    root,
+                    lock,
+                    runner=lambda *_arguments: Attempt(0, b"", b""),
+                )
+
+        if os.name != "nt":
+            with tempfile.TemporaryDirectory() as directory:
+                root = Path(directory)
+                target = root / "target.txt"
+                target.write_text(
+                    "--only-binary :all:\nengineering-process==0.2.1\n",
+                    encoding="utf-8",
+                )
+                link = root / "requirements" / "process.txt"
+                link.parent.mkdir()
+                link.symlink_to(target)
+                with self.assertRaisesRegex(InstallError, "symlinks"):
+                    install_process_runtime(
+                        root,
+                        link,
+                        runner=lambda *_arguments: Attempt(0, b"", b""),
+                    )
+
+    def test_real_runner_bounds_output_and_terminates_on_timeout(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            with patch.object(installer, "MAX_OUTPUT_BYTES", 1024):
+                attempt = installer._run_attempt(
+                    [
+                        sys.executable,
+                        "-c",
+                        "import sys; sys.stdout.buffer.write(b'x' * 100000); sys.stdout.flush()",
+                    ],
+                    root,
+                    os.environ.copy(),
+                )
+            self.assertTrue(attempt.output_exceeded)
+            self.assertLessEqual(len(attempt.stdout) + len(attempt.stderr), 1024)
+
+            with (
+                patch.object(installer, "ATTEMPT_TIMEOUT_SECONDS", 0.1),
+                patch.object(installer, "TERMINATION_TIMEOUT_SECONDS", 1.0),
+            ):
+                started = installer.time.monotonic()
+                attempt = installer._run_attempt(
+                    [sys.executable, "-c", "import time; time.sleep(30)"],
+                    root,
+                    os.environ.copy(),
+                )
+                elapsed = installer.time.monotonic() - started
+            self.assertTrue(attempt.timed_out)
+            self.assertLess(elapsed, 3.0)
+
+    @unittest.skipIf(os.name == "nt", "Windows descendants are covered by Job Object tests")
+    def test_real_runner_terminates_descendants_left_by_successful_root(self):
+        with tempfile.TemporaryDirectory() as directory:
+            attempt = installer._run_attempt(
+                [
+                    sys.executable,
+                    "-c",
+                    (
+                        "import subprocess, sys; "
+                        "subprocess.Popen([sys.executable, '-c', "
+                        "'import time; time.sleep(30)'])"
+                    ),
+                ],
+                Path(directory),
+                os.environ.copy(),
+            )
+        self.assertTrue(attempt.descendants_terminated)
+
+
+if __name__ == "__main__":
+    unittest.main()