engineering-process 0.2.1__tar.gz → 0.4.0__tar.gz

{engineering_process-0.2.1/engineering_process.egg-info → engineering_process-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 0.2.1
+Version: 0.4.0
 Summary: Agent-neutral end-to-end engineering lifecycle and deterministic process CLI
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -85,6 +85,9 @@ distribution: the POSIX backend owns a new process session/group and the Windows
 backend owns a kill-on-close Job Object. Consumer manifests, evidence, and exit codes
 do not branch by operating system. If an outer Windows Job applies incompatible
 nesting or UI limits, target creation fails closed instead of running uncontained.
+After a command root exits, both backends allow at most 250 milliseconds for child
+accounting to drain naturally. A process still present after that bound is terminated
+and makes the command fail; commands with no remaining child return immediately.
 
 This task boundary intentionally separates finite commands from services and
 interactive protocols. `processctl exec`, requirement probes, setup command actions,
@@ -136,6 +139,26 @@ attribute files are rejected by existing managed-tree ownership and content chec
 External Git overrides that alter a checkout still fail byte-exact distribution
 attestation. A consumer never authors or maintains process skills locally.
 
+CI installs the pinned authority through the repository-root
+`phuongnse/engineering-process` action from the same governed release. Consumers pin
+the action with the release commit's full object id and retain the human-readable
+`v<SemVer>` annotation; floating tags and copied installer implementations are not
+supported. The action reads the consumer-owned `requirements/process.txt` and changes
+no version or source decision: it preserves the complete hash lock, public PyPI,
+binary-only policy, sanitized pip environment, exact-version-only propagation retry,
+bounded output and time, and cross-platform descendant cleanup. The action source is
+resolved only from `github.action_path`, so an untrusted consumer checkout cannot
+replace the installer.
+
+Project-owned CI workflows remain local because they select the project's commands
+and evidence. Reusable installation and publication grammar belong to this
+distribution; product, architecture, dependency, documentation, and acceptance
+checks remain with the consumer. The managed `.process/adopt-process.py` and Windows
+Job Object sidecar are intentional bootstrap snapshots, not consumer implementations:
+Renovate must install and verify a target authority before that target exists in the
+checkout, and `processctl sync --check` compares those bytes with the pinned
+distribution.
+
 For an existing consumer, a published version is adopted through one Renovate draft.
 The managed runner installs the target authority from the complete hash lock outside
 the checkout and atomically updates the process lock and managed assets. If the
@@ -386,6 +409,13 @@ processctl change verify --change-id issue-123 --profile review \
   --actor worker --context worker-session --actor-kind agent
 ~~~
 
+If later remote evidence or a source correction invalidates that verified checkpoint
+before review, commit the correction and run `change implement` again. The CLI
+preserves the earlier evidence, records `verification-invalidated`, increments the
+cycle, and requires every profile again. It accepts this transition only when the
+recorded verification is actually stale; a current verified checkpoint cannot use it
+to bypass independent review.
+
 After the phase becomes `verified`, a separate reviewer context registers its
 assignment:
 
@@ -504,6 +534,11 @@ authenticates who produced it.
   draft contains the new lock, managed contracts, skill snapshots, and any
   target-version consumer-owned project migration; after CI and fresh-context
   independent review, merge is the end of adoption.
+- The repository-root GitHub Action is the shared CI bootstrap surface. Consumers pin
+  its full governed release commit, while the exact Python authority remains selected
+  exclusively by their hash-locked `requirements/process.txt`. The action invokes the
+  producer-owned installer from its immutable action checkout and never downloads or
+  executes helper source from the consumer branch.
 - Versioned JSON schemas define change, plan, verification, review, lifecycle,
   completion-related artifacts, release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the

{engineering_process-0.2.1 → engineering_process-0.4.0}/PRODUCTION_STANDARD.md

@@ -59,6 +59,24 @@ its schema-2 profile reports. The remote artifact id and service-computed digest
 preserved with review evidence. These reports supplement the public N-1 lifecycle
 authority; code under verification never promotes itself to lifecycle authority.
 
+## Failure to invariant
+
+A validated command, gate, release, adoption, or external-integration failure must
+preserve exact bounded evidence and classify its owner before corrective mutation as
+project-local, shared-process, operations-or-external, or missing product or
+authorization input. Dependent candidates stay blocked. Shared defects are corrected
+in the producer rather than wrapped or duplicated by consumers; project behavior
+remains project-owned unless a portable class is proven.
+
+Every correction proves valid behavior and the corresponding fail-closed class at the
+lowest reliable owner boundary. Shared corrections additionally require producer
+profiles and reproduction at affected consumer boundaries before release. A transient
+operations/external recovery is allowed only with unchanged source and configuration;
+attempts are bounded, idempotent, diagnostic-preserving, and stop on deterministic
+failure. Source, branch, version, credentials, and controls are never changed merely
+to cause another attempt. Independent review treats violation of these ownership and
+evidence boundaries as completion-blocking.
+
 ## Resource and generated-state policy
 
 Every operation over repository-controlled or remote input has explicit limits for

{engineering_process-0.2.1 → engineering_process-0.4.0}/README.md

@@ -50,6 +50,9 @@ distribution: the POSIX backend owns a new process session/group and the Windows
 backend owns a kill-on-close Job Object. Consumer manifests, evidence, and exit codes
 do not branch by operating system. If an outer Windows Job applies incompatible
 nesting or UI limits, target creation fails closed instead of running uncontained.
+After a command root exits, both backends allow at most 250 milliseconds for child
+accounting to drain naturally. A process still present after that bound is terminated
+and makes the command fail; commands with no remaining child return immediately.
 
 This task boundary intentionally separates finite commands from services and
 interactive protocols. `processctl exec`, requirement probes, setup command actions,
@@ -101,6 +104,26 @@ attribute files are rejected by existing managed-tree ownership and content chec
 External Git overrides that alter a checkout still fail byte-exact distribution
 attestation. A consumer never authors or maintains process skills locally.
 
+CI installs the pinned authority through the repository-root
+`phuongnse/engineering-process` action from the same governed release. Consumers pin
+the action with the release commit's full object id and retain the human-readable
+`v<SemVer>` annotation; floating tags and copied installer implementations are not
+supported. The action reads the consumer-owned `requirements/process.txt` and changes
+no version or source decision: it preserves the complete hash lock, public PyPI,
+binary-only policy, sanitized pip environment, exact-version-only propagation retry,
+bounded output and time, and cross-platform descendant cleanup. The action source is
+resolved only from `github.action_path`, so an untrusted consumer checkout cannot
+replace the installer.
+
+Project-owned CI workflows remain local because they select the project's commands
+and evidence. Reusable installation and publication grammar belong to this
+distribution; product, architecture, dependency, documentation, and acceptance
+checks remain with the consumer. The managed `.process/adopt-process.py` and Windows
+Job Object sidecar are intentional bootstrap snapshots, not consumer implementations:
+Renovate must install and verify a target authority before that target exists in the
+checkout, and `processctl sync --check` compares those bytes with the pinned
+distribution.
+
 For an existing consumer, a published version is adopted through one Renovate draft.
 The managed runner installs the target authority from the complete hash lock outside
 the checkout and atomically updates the process lock and managed assets. If the
@@ -351,6 +374,13 @@ processctl change verify --change-id issue-123 --profile review \
   --actor worker --context worker-session --actor-kind agent
 ~~~
 
+If later remote evidence or a source correction invalidates that verified checkpoint
+before review, commit the correction and run `change implement` again. The CLI
+preserves the earlier evidence, records `verification-invalidated`, increments the
+cycle, and requires every profile again. It accepts this transition only when the
+recorded verification is actually stale; a current verified checkpoint cannot use it
+to bypass independent review.
+
 After the phase becomes `verified`, a separate reviewer context registers its
 assignment:
 
@@ -469,6 +499,11 @@ authenticates who produced it.
   draft contains the new lock, managed contracts, skill snapshots, and any
   target-version consumer-owned project migration; after CI and fresh-context
   independent review, merge is the end of adoption.
+- The repository-root GitHub Action is the shared CI bootstrap surface. Consumers pin
+  its full governed release commit, while the exact Python authority remains selected
+  exclusively by their hash-locked `requirements/process.txt`. The action invokes the
+  producer-owned installer from its immutable action checkout and never downloads or
+  executes helper source from the consumer branch.
 - Versioned JSON schemas define change, plan, verification, review, lifecycle,
   completion-related artifacts, release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the

{engineering_process-0.2.1 → engineering_process-0.4.0}/VERSIONING.md

@@ -98,6 +98,20 @@ Release, self-adoption, and consumer adoption are separate changes:
    checkpoint. Merge completes adoption; there is no post-merge synchronization.
 5. N+1 governs only changes that begin after the adoption checkpoint.
 
+The repository-root GitHub Action and Python package are two surfaces of the same
+governed release checkpoint. A consumer invocation pins the action by the release
+commit's full object id and keeps the `v<SemVer>` annotation; Renovate groups that
+GitHub Action identity with the direct Python authority update. The action does not
+select the package version. It installs only the consumer's complete hash lock, so
+the process lock, Python artifacts, managed assets, action source, and reviewed tag
+remain independently checkable parts of one release identity.
+
+Consumer repositories do not own copies of reusable installation or publication
+algorithms. They retain declarative process/project locks, exact project commands,
+and managed bootstrap snapshots required before a target version is installed. A
+clean-cutover PR may delete an obsolete local helper only after it pins an immutable
+public action checkpoint; no compatibility shim or dual execution path is retained.
+
 Renovate PRs are generated adoption candidates, not trusted adoption evidence.
 Automerge is forbidden for process-authority updates. A PR that changes only a
 requirement pin, omits generated hashes or managed assets, or requires a post-merge

{engineering_process-0.2.1 → engineering_process-0.4.0}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "0.2.1"
+VERSION = "0.4.0"

{engineering_process-0.2.1 → engineering_process-0.4.0}/engineering_process/_supervisor_posix.py

@@ -9,7 +9,7 @@ import subprocess
 import time
 from typing import Mapping
 
-from .supervision import CleanupOutcome
+from .supervision import CleanupOutcome, NATURAL_DRAIN_GRACE_MILLISECONDS
 
 
 def _process_group_exists(process_group: int) -> bool:
@@ -156,7 +156,20 @@ class PosixProcessSupervisor:
         grace_seconds: float,
     ) -> CleanupOutcome:
         # The group id remains valid while any descendant from the owned session is
-        # alive, even after the original process has exited.
+        # alive, even after the original process has exited. Give descendants that
+        # were synchronously asked to stop one short bounded interval to disappear
+        # naturally before classifying them as abandoned background work.
+        if not _process_group_exists(process.pid):
+            return CleanupOutcome(bounded=True)
+        natural_drain_seconds = min(
+            grace_seconds,
+            NATURAL_DRAIN_GRACE_MILLISECONDS / 1000,
+        )
+        if natural_drain_seconds > 0 and _wait_for_process_group(
+            process.pid,
+            natural_drain_seconds,
+        ):
+            return CleanupOutcome(bounded=True)
         return _terminate_group(process.pid, grace_seconds)
 
 

{engineering_process-0.2.1 → engineering_process-0.4.0}/engineering_process/lifecycle.py

@@ -624,10 +624,45 @@ def _begin_implementation_unlocked(
     kind: str,
 ) -> dict[str, Any]:
     state = load_state(project_root, change_id)
-    _require_phase(state, "planned", "implementing", "changes-requested")
     _contract(project_root, state)
     _plan(project_root, state)
     actor = _actor(actor_id, context_id, kind)
+    if state["phase"] == "verified":
+        source = source_state(project_root)
+        checkpoints = {item["checkpoint"] for item in state["verification"]}
+        fingerprints = {
+            item["workspaceFingerprint"] for item in state["verification"]
+        }
+        current = (
+            source["dirty"] is False
+            and source["checkpoint"] is not None
+            and source["fingerprint"] is not None
+            and checkpoints == {source["checkpoint"]}
+            and fingerprints == {source["fingerprint"]}
+        )
+        if current:
+            raise ContractError(
+                "current verified change must enter independent review before "
+                "another implementation cycle"
+            )
+        previous_cycle = state["cycle"]
+        previous_verification = list(state["verification"])
+        state["cycle"] += 1
+        state["implementationActors"] = []
+        state["verification"] = []
+        state["reviewAssignment"] = None
+        state["review"] = None
+        _event(
+            state,
+            "verification-invalidated",
+            actor,
+            cycle=state["cycle"],
+            previousCycle=previous_cycle,
+            previousVerification=previous_verification,
+            reason="source-changed-after-verification",
+        )
+    else:
+        _require_phase(state, "planned", "implementing", "changes-requested")
     if state["phase"] == "changes-requested":
         state["cycle"] += 1
         state["implementationActors"] = []

{engineering_process-0.2.1 → engineering_process-0.4.0}/engineering_process/supervision.py

@@ -14,6 +14,9 @@ import subprocess
 from typing import Mapping, Protocol
 
 
+NATURAL_DRAIN_GRACE_MILLISECONDS = 250
+
+
 @dataclass(frozen=True)
 class CleanupOutcome:
     """Result of a bounded process-tree cleanup operation."""

{engineering_process-0.2.1 → engineering_process-0.4.0/engineering_process.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 0.2.1
+Version: 0.4.0
 Summary: Agent-neutral end-to-end engineering lifecycle and deterministic process CLI
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -85,6 +85,9 @@ distribution: the POSIX backend owns a new process session/group and the Windows
 backend owns a kill-on-close Job Object. Consumer manifests, evidence, and exit codes
 do not branch by operating system. If an outer Windows Job applies incompatible
 nesting or UI limits, target creation fails closed instead of running uncontained.
+After a command root exits, both backends allow at most 250 milliseconds for child
+accounting to drain naturally. A process still present after that bound is terminated
+and makes the command fail; commands with no remaining child return immediately.
 
 This task boundary intentionally separates finite commands from services and
 interactive protocols. `processctl exec`, requirement probes, setup command actions,
@@ -136,6 +139,26 @@ attribute files are rejected by existing managed-tree ownership and content chec
 External Git overrides that alter a checkout still fail byte-exact distribution
 attestation. A consumer never authors or maintains process skills locally.
 
+CI installs the pinned authority through the repository-root
+`phuongnse/engineering-process` action from the same governed release. Consumers pin
+the action with the release commit's full object id and retain the human-readable
+`v<SemVer>` annotation; floating tags and copied installer implementations are not
+supported. The action reads the consumer-owned `requirements/process.txt` and changes
+no version or source decision: it preserves the complete hash lock, public PyPI,
+binary-only policy, sanitized pip environment, exact-version-only propagation retry,
+bounded output and time, and cross-platform descendant cleanup. The action source is
+resolved only from `github.action_path`, so an untrusted consumer checkout cannot
+replace the installer.
+
+Project-owned CI workflows remain local because they select the project's commands
+and evidence. Reusable installation and publication grammar belong to this
+distribution; product, architecture, dependency, documentation, and acceptance
+checks remain with the consumer. The managed `.process/adopt-process.py` and Windows
+Job Object sidecar are intentional bootstrap snapshots, not consumer implementations:
+Renovate must install and verify a target authority before that target exists in the
+checkout, and `processctl sync --check` compares those bytes with the pinned
+distribution.
+
 For an existing consumer, a published version is adopted through one Renovate draft.
 The managed runner installs the target authority from the complete hash lock outside
 the checkout and atomically updates the process lock and managed assets. If the
@@ -386,6 +409,13 @@ processctl change verify --change-id issue-123 --profile review \
   --actor worker --context worker-session --actor-kind agent
 ~~~
 
+If later remote evidence or a source correction invalidates that verified checkpoint
+before review, commit the correction and run `change implement` again. The CLI
+preserves the earlier evidence, records `verification-invalidated`, increments the
+cycle, and requires every profile again. It accepts this transition only when the
+recorded verification is actually stale; a current verified checkpoint cannot use it
+to bypass independent review.
+
 After the phase becomes `verified`, a separate reviewer context registers its
 assignment:
 
@@ -504,6 +534,11 @@ authenticates who produced it.
   draft contains the new lock, managed contracts, skill snapshots, and any
   target-version consumer-owned project migration; after CI and fresh-context
   independent review, merge is the end of adoption.
+- The repository-root GitHub Action is the shared CI bootstrap surface. Consumers pin
+  its full governed release commit, while the exact Python authority remains selected
+  exclusively by their hash-locked `requirements/process.txt`. The action invokes the
+  producer-owned installer from its immutable action checkout and never downloads or
+  executes helper source from the consumer branch.
 - Versioned JSON schemas define change, plan, verification, review, lifecycle,
   completion-related artifacts, release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the

{engineering_process-0.2.1 → engineering_process-0.4.0}/engineering_process.egg-info/SOURCES.txt

@@ -109,6 +109,7 @@ tests/test_environment.py
 tests/test_evals.py
 tests/test_impact.py
 tests/test_lifecycle.py
+tests/test_process_install.py
 tests/test_publication.py
 tests/test_publish_event.py
 tests/test_pypi_publication.py

{engineering_process-0.2.1 → engineering_process-0.4.0}/process_assets/skills/evolve-process/SKILL.md

@@ -14,18 +14,26 @@ incident history into permanent ceremony.
 
 1. Start from a reproducer, escaped defect, false positive, review finding, or measured
    workflow cost. Do not generalize from speculation alone.
-2. Classify the evidence as a project-local defect, reusable process rule,
-   deterministic invariant, portability gap, or obsolete rule.
-3. Fix local behavior in the project owner. Change shared skills only for portable
+2. Apply the run-change failure-to-invariant protocol. Classify the owning boundary as
+   project-local, shared-process, operations-or-external, or missing product or
+   authorization input before corrective mutation; then classify the reusable class
+   as a process rule, deterministic invariant, portability gap, or obsolete rule.
+3. Fix local behavior in the project owner. When the defect belongs to shared process
+   semantics, keep the consumer candidate blocked and remove any provisional consumer
+   wrapper or duplicate implementation. Change shared skills only for portable
    semantics. Add CLI or schema enforcement only when deterministic.
-4. Add a regression case at the lowest reliable boundary. For skill behavior, run a
-   realistic forward test without providing the expected answer.
+4. Add regression cases at the lowest reliable owner boundary for both valid behavior
+   and the fail-closed class. A shared fix also requires producer profiles and a real
+   affected-consumer reproduction before release authorization. For skill behavior,
+   run a realistic forward test without providing the expected answer.
 5. Validate backward compatibility, version impact, consumer locks, and migration
    needs. Remove superseded guidance instead of preserving duplicate paths.
    Check the full `production-v1` boundary and derive every release identity surface
    from the release contract so a local fix cannot create a new cross-surface drift.
 6. Measure whether the change improves task fidelity without disproportionate
    workflow cost.
+7. For an operations or external transient, require bounded idempotent recovery with
+   retained per-attempt diagnostics. Never mutate source or version merely to retry.
 
 ## Hard gates
 

{engineering_process-0.2.1 → engineering_process-0.4.0}/process_assets/skills/review-change/SKILL.md

@@ -33,6 +33,9 @@ specific checkpoint without changing the reviewed source.
    Resolved, deferred, and false-positive findings require resolution evidence.
    Deferred remains unresolved and completion-blocking unless a future process
    contract introduces an explicit owner-approved exception.
+   Treat owner mismatch, consumer workaround for a shared defect, evidence-free rerun,
+   missing valid/fail-closed regression proof, or missing affected-consumer proof for
+   a shared correction as required completion-blocking findings.
 5. Request changes when any required finding remains open or deferred. Approve only
    when required outcomes and evidence are complete for the reviewed checkpoint.
 6. Validate the report with processctl contract validate --kind review, then submit

{engineering_process-0.2.1 → engineering_process-0.4.0}/process_assets/skills/run-change/SKILL.md

@@ -31,10 +31,14 @@ semantics shared by every project.
 3. Apply the nearest AGENTS.md and domain skill inside each phase. Project policy may
    add stronger gates but cannot remove lifecycle phases, baseline profiles,
    independent review, evidence freshness, or finding closure.
-4. After a valid finding, preserve the reviewed checkpoint, begin the next
+4. When a command, gate, release, adoption, or external integration fails, apply the
+   failure-to-invariant protocol in the required execution reference before any
+   corrective mutation. Keep dependent candidates blocked until the owning boundary
+   and required proof are explicit.
+5. After a valid finding, preserve the reviewed checkpoint, begin the next
    implementation cycle, resolve the finding, and repeat every invalidated profile
    and independent review.
-5. Report the processctl phase, cycle, current evidence, blockers, and next owner.
+6. Report the processctl phase, cycle, current evidence, blockers, and next owner.
    Never call a task complete from prose alone.
 
 ## Hard gates

{engineering_process-0.2.1 → engineering_process-0.4.0}/process_assets/skills/run-change/references/execution.md

@@ -54,6 +54,37 @@ When progress depends on user-controlled or external state:
 5. Report `Blocker`, `Evidence`, `Boundary`, `User action or decision needed`, and
    `Safe next step after confirmation`.
 
+## Failure-to-invariant protocol
+
+Apply this protocol before corrective mutation whenever a command, gate, release,
+adoption, or external integration produces a validated failure:
+
+1. Preserve the smallest reliable reproducer, exact command/event, immutable source
+   identity, environment, exit status, bounded output, and available service evidence.
+   Do not use an evidence-free rerun as diagnosis.
+2. Classify the owning boundary as `project-local`, `shared-process`,
+   `operations-or-external`, or `missing-product-or-authorization-input`. State the
+   evidence that excludes the other boundaries before selecting a fix.
+3. Keep every dependent candidate blocked. A shared-process defect must be fixed in
+   the shared producer; do not add a consumer-owned wrapper, duplicate algorithm,
+   alternate authority, relaxed control, or environment substitution to keep moving.
+   A project-local behavior remains in the project owner and must not be promoted to
+   portable core without evidence of a reusable class.
+4. Add regression evidence at the lowest reliable owner boundary for both the valid
+   behavior and the corresponding persistent, invalid, timeout, or interruption case
+   that must remain fail closed.
+5. For a shared correction, require producer profiles and a reproduction at every
+   affected consumer boundary before release authorization. Consumer proof supplements
+   producer evidence; neither substitutes for the other.
+6. Treat operations or external propagation as transient only when source and
+   configuration are already proven unchanged. Recovery must be bounded, idempotent,
+   preserve per-attempt diagnostics, and stop on a deterministic failure. Do not
+   change source, branch, version, credentials, or controls merely to cause another
+   attempt.
+7. Reopen or create the owning change lifecycle when scope moves across a boundary,
+   then repeat invalidated verification and independent review on one exact final
+   checkpoint. Record the reusable invariant, not just the incident chronology.
+
 ## Independent review
 
 Review begins only after all baseline and change-required profiles pass on one clean

{engineering_process-0.2.1 → engineering_process-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-process"
-version = "0.2.1"
+version = "0.4.0"
 description = "Agent-neutral end-to-end engineering lifecycle and deterministic process CLI"
 readme = "README.md"
 license = "MIT"

engineering_process-0.4.0/release.json

@@ -0,0 +1,55 @@
+{
+  "schemaVersion": 3,
+  "previousVersion": "0.3.0",
+  "version": "0.4.0",
+  "classification": "minor",
+  "compatibility": "backward-compatible",
+  "schemaImpact": "unchanged",
+  "migration": null,
+  "identity": {
+    "package": "engineering-process",
+    "distribution": "engineering_process",
+    "tag": "v0.4.0",
+    "releaseName": "v0.4.0",
+    "runtimeVersion": {
+      "path": "engineering_process/__init__.py",
+      "variable": "VERSION"
+    },
+    "artifacts": [
+      "engineering_process-0.4.0-py3-none-any.whl",
+      "engineering_process-0.4.0.tar.gz"
+    ],
+    "receiptAsset": "engineering-process-v0.4.0-evidence.json",
+    "authorizationAsset": null
+  },
+  "provenance": {
+    "mode": "governed",
+    "statement": "The public N-1 lifecycle receipt and reviewed Release PR authorize this release.",
+    "lifecycleReceipt": {
+      "asset": "engineering-process-v0.4.0-evidence.json",
+      "project": "engineering-process",
+      "changeId": "release-0-4-0",
+      "cycle": 1
+    }
+  },
+  "changes": [
+    {
+      "id": "failure-to-invariant",
+      "type": "capability",
+      "surfaces": [
+        "governance",
+        "skills"
+      ],
+      "rationale": "Require future failures to preserve evidence, classify the correct owner, repair a reusable invariant, prove valid and fail-closed behavior, and obtain affected-consumer proof before shared release."
+    },
+    {
+      "id": "natural-descendant-drain",
+      "type": "fix",
+      "surfaces": [
+        "execution",
+        "supervision"
+      ],
+      "rationale": "Allow short, bounded child-process shutdown to drain naturally on POSIX just as it already does under the Windows Job Object, while persistent descendants remain terminated and completion-blocking."
+    }
+  ]
+}

{engineering_process-0.2.1 → engineering_process-0.4.0}/tests/test_environment.py

@@ -101,6 +101,40 @@ def project_document(*, setup: bool = True, dependency: bool = False):
 
 
 class EnvironmentTests(unittest.TestCase):
+    @unittest.skipUnless(os.name == "posix", "POSIX process-group regression")
+    def test_successful_command_allows_short_natural_descendant_drain(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            child_started = root / "child.started"
+            child_code = (
+                "from pathlib import Path; import sys, time; "
+                "Path(sys.argv[1]).write_text('started'); time.sleep(0.08)"
+            )
+            parent_code = (
+                "import subprocess, sys, time; from pathlib import Path; "
+                "subprocess.Popen([sys.executable, '-c', sys.argv[1], sys.argv[2]]); "
+                "marker=Path(sys.argv[2]); deadline=time.monotonic()+5; "
+                "\nwhile not marker.exists() and time.monotonic() < deadline: time.sleep(0.01)\n"
+                "raise SystemExit(0 if marker.exists() else 2)"
+            )
+
+            report = execute_command(
+                root,
+                identifier="natural-drain",
+                run=(
+                    sys.executable,
+                    "-c",
+                    parent_code,
+                    child_code,
+                    str(child_started),
+                ),
+                timeout_seconds=10,
+                working_directory=".",
+            )
+
+        self.assertEqual("passed", report["status"])
+        self.assertEqual(0, report["exitCode"])
+
     def test_managed_command_binding_preserves_logical_evidence_without_a_shell(self):
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)

{engineering_process-0.2.1 → engineering_process-0.4.0}/tests/test_lifecycle.py

@@ -300,6 +300,68 @@ class LifecycleTests(unittest.TestCase):
             self.assertEqual(report["impact"]["baseRef"], "HEAD")
             self.assertEqual(report["impact"]["changedPaths"], [])
 
+    def test_stale_verified_source_can_begin_a_new_implementation_cycle(self):
+        with tempfile.TemporaryDirectory() as directory:
+            base = Path(directory)
+            root = base / "project"
+            inputs = base / "inputs"
+            root.mkdir()
+            inputs.mkdir()
+            self.initialize_repository(root)
+            self.prepare_verified_change(root, inputs)
+
+            (root / "tracked.txt").write_text("remote CI correction\n", encoding="utf-8")
+            subprocess.run(["git", "add", "tracked.txt"], cwd=root, check=True)
+            subprocess.run(
+                ["git", "commit", "-qm", "fix: address remote verification"],
+                cwd=root,
+                check=True,
+            )
+
+            state = begin_implementation(
+                root,
+                "change-1",
+                actor_id="worker",
+                context_id="worker-context",
+                kind="agent",
+            )
+
+            self.assertEqual("implementing", state["phase"])
+            self.assertEqual(2, state["cycle"])
+            self.assertEqual([], state["verification"])
+            invalidated = [
+                event
+                for event in state["history"]
+                if event["event"] == "verification-invalidated"
+            ]
+            self.assertEqual(1, len(invalidated))
+            self.assertEqual(1, invalidated[0]["previousCycle"])
+            self.assertEqual(
+                "source-changed-after-verification", invalidated[0]["reason"]
+            )
+            self.assertEqual(2, len(invalidated[0]["previousVerification"]))
+
+    def test_current_verified_source_cannot_bypass_independent_review(self):
+        with tempfile.TemporaryDirectory() as directory:
+            base = Path(directory)
+            root = base / "project"
+            inputs = base / "inputs"
+            root.mkdir()
+            inputs.mkdir()
+            self.initialize_repository(root)
+            self.prepare_verified_change(root, inputs)
+
+            with self.assertRaisesRegex(
+                ContractError, "must enter independent review"
+            ):
+                begin_implementation(
+                    root,
+                    "change-1",
+                    actor_id="worker",
+                    context_id="worker-context",
+                    kind="agent",
+                )
+
     def test_full_lifecycle_requires_independent_review(self):
         with tempfile.TemporaryDirectory() as directory:
             base = Path(directory)