engineering-process 0.6.0__tar.gz → 0.7.0__tar.gz

{engineering_process-0.6.0/engineering_process.egg-info → engineering_process-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 0.6.0
+Version: 0.7.0
 Summary: Agent-neutral end-to-end engineering lifecycle and deterministic process CLI
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -291,6 +291,14 @@ project-native dependency commands, dependency edges, and remediation. Project s
 does not carry a generic downloader, archive installer, doctor, or setup lifecycle.
 Host prerequisites with no safe automated setup action stay blocking.
 
+The exact logical executable `python` is reserved by the distribution and resolves to
+the absolute interpreter running the selected immutable process authority. This rule
+applies consistently to requirement probes, verification profiles, setup command
+actions, and `processctl exec`; callers do not activate a virtual environment or
+modify `PATH` first. Manifests and reports retain the portable logical token, managed
+tools cannot shadow it, and absolute executables plus non-Python commands keep their
+existing resolution behavior.
+
 Probe `readOnly`, foreground-only execution, and command-action mutation scopes are
 project-owner attestations, not an operating-system sandbox: `processctl` cannot infer
 arbitrary subprocess side effects. Commands must not daemonize, start a detached
@@ -528,6 +536,48 @@ resolution records a selected valid option but grants no lifecycle completion, m
 release, deployment, or adoption authority. Those owning gates remain separate. The
 accepted decision is recorded before dependent work resumes.
 
+Projects may separately adopt the `provenance-gated-authored-review` lifecycle policy.
+Under that policy, every new nontrivial authored plan uses schema 3 and is assessed
+before implementation by a genuinely fresh read-only reviewer. The assessment covers
+architecture, authority, compatibility, external mutation, lifecycle order, owner,
+rollout, scope, and trust boundary for the exact contract, plan, clean source,
+authority, policy, author, and reviewer context. A clear assessment permits
+implementation. A decision-required assessment must complete the existing reviewed
+recommendation and owner-resolution chain, with a dedicated invariant binding the
+exact assessment digest:
+
+~~~text
+processctl change decision start --project-root . --change-id issue-123 \
+  --actor <reviewer> --context <fresh-context> --actor-kind agent \
+  --method isolated-context --attested-by <host> \
+  --attestation-evidence <bounded-attestation>
+processctl contract validate --kind plan-decision-review \
+  plan-decision-review.json
+processctl change decision submit --project-root . --change-id issue-123 \
+  --review plan-decision-review.json
+processctl change decision resolve --project-root . --change-id issue-123 \
+  --actor <coordinator> --context <coordinator-context> --actor-kind agent \
+  --recommendation recommendation.json \
+  --assignment recommendation-review-assignment.json \
+  --recommendation-review recommendation-review.json \
+  --resolution recommendation-resolution.json
+processctl change implement --project-root . --change-id issue-123 \
+  --actor <worker> --context <worker-context> --actor-kind agent
+~~~
+
+The resolve command is used only for `decision-required`; a clear assessment goes
+directly to `change implement`. Unreviewed prose, risk tiers, heuristics, author
+self-classification, and generator labels are candidate-only and grant no authority.
+A generated bypass is valid only for a core-registered generator whose complete plan
+is exactly recomputed from bounded source-owned inputs and the immutable installed
+authority. Exact generated plans are not universally sent to semantic review. Core
+requires no daemon, scheduler, service, webhook receiver, hosted reviewer platform,
+vendor, model, or proprietary agent API.
+Every later implementation cycle after a finding or clean post-verification source
+drift repeats the assessment with a newly reserved reviewer context bound to the new
+source checkpoint. Earlier assignment, assessment, and owner-decision artifacts stay
+historical and cannot authorize the new cycle.
+
 When a schema-3 change selects a project-owned `requiredEvidence` id, local profiles
 alone do not advance it to review. Create the exact no-authority request, run the
 project adapter, and ingest the complete supplemental set first:
@@ -783,9 +833,10 @@ fingerprint, source tree, or publication range.
   exclusively by their hash-locked `requirements/process.txt`. The action invokes the
   producer-owned installer from its immutable action checkout and never downloads or
   executes helper source from the consumer branch.
-- Versioned JSON schemas define change, plan, verification, review, recommendation,
-  independent recommendation assignment and challenge, owner resolution, lifecycle,
-  completion-related artifacts, release-change fragments, and the release
+- Versioned JSON schemas define change, plan provenance, plan-decision assignment and
+  review, verification, review, recommendation, independent recommendation assignment
+  and challenge, owner resolution, lifecycle, completion-related artifacts,
+  release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the
   exact SemVer increment, package version, latest reachable prior tag, reviewed head,
   identical merge tree, immutable checkpoint, and main ancestry.
@@ -798,10 +849,12 @@ fingerprint, source tree, or publication range.
   readable under their released semantics. GitHub's artifact id and digest complete
   the immutable remote reference; this supplements rather than replaces N-1
   lifecycle evidence.
-- New lifecycle work uses bounded plan schema 2. Selective-impact consumers may add
-  the optional capability on project schema 3, while new integrations use bounded
-  project schema 4. Plan schema 1 and the pre-existing fields of project schemas 1-3
-  retain their published validation behavior instead of being tightened in place.
+- Projects without plan-decision opt-in continue using bounded plan schema 2. An
+  opted-in project uses plan schema 3 provenance and the pre-implementation gate.
+  Selective-impact consumers may add optional capabilities on project schema 3,
+  while new integrations use bounded project schema 4. Plan schemas 1 and 2 and the
+  pre-existing fields of project schemas 1-3 retain their published validation
+  behavior instead of being tightened in place.
 - `release.json` is the single release-identity owner. Governed GitHub tag and title
   are both exactly `v<SemVer>`; package metadata, runtime version, artifact names,
   authorization evidence, and later consumer locks must match it. Public-impact PRs

{engineering_process-0.6.0 → engineering_process-0.7.0}/PRODUCTION_STANDARD.md

@@ -55,6 +55,12 @@ canonical command, or installing a consumer wrapper. Durable reports record only
 policy, severity, stream, line number, bounded count, truncation state, and line
 SHA-256. They never copy the diagnostic line into lifecycle evidence.
 
+The portable logical command `python` resolves to the exact absolute interpreter of
+the running immutable process authority across doctor, setup, execution, and
+verification. Ambient `PATH` cannot select another Python installation, managed tools
+cannot shadow the reserved binding, and evidence retains the logical command rather
+than a host-specific activation sequence.
+
 Missing, stale, truncated beyond a declared policy, blocked, or unverifiable evidence
 never becomes a pass. Independent review records each accepted dimension as
 `verified`, `failed`, or `not-applicable-confirmed`; lifecycle submission compares
@@ -109,6 +115,34 @@ evidence boundaries as completion-blocking.
 
 ## Recommendation validity
 
+An opted-in project gates implementation through plan provenance. Every nontrivial
+authored plan receives a fresh read-only semantic assessment for architecture,
+authority, compatibility, external mutation, lifecycle order, owner, rollout, scope,
+and trust boundary. The assignment binds the exact contract, plan, clean source,
+authority, project policy, author, reviewer context, and canonical category set. A
+clear assessment may authorize implementation; a decision-required assessment must
+bind the existing independently reviewed recommendation and explicit owner resolution
+for that exact assessment. Drift in any binding fails closed.
+Each later implementation cycle after a finding or clean post-verification source
+drift requires a newly reserved context and assessment bound to that cycle's source;
+cycle-1 evidence cannot be relabeled or reused.
+
+A process-generated plan bypass is accepted only when the immutable installed core
+recognizes its generator and exactly recomputes the complete plan from bounded
+validated source-owned inputs. Generator labels, risk labels, author
+self-classification, heuristic prose scanning, and partial comparison are not
+provenance. Exact generated plans are not universally sent to semantic review, and
+portable core does not introduce a daemon, scheduler, webhook, hosted reviewer
+platform, vendor, model, or proprietary agent API. Unreviewed prose remains
+candidate-only and grants no decision or lifecycle authority.
+
+The three possible review boundaries never review one another. Plan-decision review
+assesses the authored plan; recommendation review challenges only the recommendation
+and its digest binding; final lifecycle review assesses implemented source and current
+evidence. Reviewer-of-reviewer, meta-assessment, assessment-of-assessment,
+policy-for-policy, dynamically generated approval chains, and generic workflow
+engines are outside the portable contract.
+
 A material owner decision derives recommendation eligibility before optimization.
 Every option assesses every governing hard invariant and references only proven or
 explicitly unproven assumptions. Any violated invariant makes the option invalid; any

{engineering_process-0.6.0 → engineering_process-0.7.0}/README.md

@@ -256,6 +256,14 @@ project-native dependency commands, dependency edges, and remediation. Project s
 does not carry a generic downloader, archive installer, doctor, or setup lifecycle.
 Host prerequisites with no safe automated setup action stay blocking.
 
+The exact logical executable `python` is reserved by the distribution and resolves to
+the absolute interpreter running the selected immutable process authority. This rule
+applies consistently to requirement probes, verification profiles, setup command
+actions, and `processctl exec`; callers do not activate a virtual environment or
+modify `PATH` first. Manifests and reports retain the portable logical token, managed
+tools cannot shadow it, and absolute executables plus non-Python commands keep their
+existing resolution behavior.
+
 Probe `readOnly`, foreground-only execution, and command-action mutation scopes are
 project-owner attestations, not an operating-system sandbox: `processctl` cannot infer
 arbitrary subprocess side effects. Commands must not daemonize, start a detached
@@ -493,6 +501,48 @@ resolution records a selected valid option but grants no lifecycle completion, m
 release, deployment, or adoption authority. Those owning gates remain separate. The
 accepted decision is recorded before dependent work resumes.
 
+Projects may separately adopt the `provenance-gated-authored-review` lifecycle policy.
+Under that policy, every new nontrivial authored plan uses schema 3 and is assessed
+before implementation by a genuinely fresh read-only reviewer. The assessment covers
+architecture, authority, compatibility, external mutation, lifecycle order, owner,
+rollout, scope, and trust boundary for the exact contract, plan, clean source,
+authority, policy, author, and reviewer context. A clear assessment permits
+implementation. A decision-required assessment must complete the existing reviewed
+recommendation and owner-resolution chain, with a dedicated invariant binding the
+exact assessment digest:
+
+~~~text
+processctl change decision start --project-root . --change-id issue-123 \
+  --actor <reviewer> --context <fresh-context> --actor-kind agent \
+  --method isolated-context --attested-by <host> \
+  --attestation-evidence <bounded-attestation>
+processctl contract validate --kind plan-decision-review \
+  plan-decision-review.json
+processctl change decision submit --project-root . --change-id issue-123 \
+  --review plan-decision-review.json
+processctl change decision resolve --project-root . --change-id issue-123 \
+  --actor <coordinator> --context <coordinator-context> --actor-kind agent \
+  --recommendation recommendation.json \
+  --assignment recommendation-review-assignment.json \
+  --recommendation-review recommendation-review.json \
+  --resolution recommendation-resolution.json
+processctl change implement --project-root . --change-id issue-123 \
+  --actor <worker> --context <worker-context> --actor-kind agent
+~~~
+
+The resolve command is used only for `decision-required`; a clear assessment goes
+directly to `change implement`. Unreviewed prose, risk tiers, heuristics, author
+self-classification, and generator labels are candidate-only and grant no authority.
+A generated bypass is valid only for a core-registered generator whose complete plan
+is exactly recomputed from bounded source-owned inputs and the immutable installed
+authority. Exact generated plans are not universally sent to semantic review. Core
+requires no daemon, scheduler, service, webhook receiver, hosted reviewer platform,
+vendor, model, or proprietary agent API.
+Every later implementation cycle after a finding or clean post-verification source
+drift repeats the assessment with a newly reserved reviewer context bound to the new
+source checkpoint. Earlier assignment, assessment, and owner-decision artifacts stay
+historical and cannot authorize the new cycle.
+
 When a schema-3 change selects a project-owned `requiredEvidence` id, local profiles
 alone do not advance it to review. Create the exact no-authority request, run the
 project adapter, and ingest the complete supplemental set first:
@@ -748,9 +798,10 @@ fingerprint, source tree, or publication range.
   exclusively by their hash-locked `requirements/process.txt`. The action invokes the
   producer-owned installer from its immutable action checkout and never downloads or
   executes helper source from the consumer branch.
-- Versioned JSON schemas define change, plan, verification, review, recommendation,
-  independent recommendation assignment and challenge, owner resolution, lifecycle,
-  completion-related artifacts, release-change fragments, and the release
+- Versioned JSON schemas define change, plan provenance, plan-decision assignment and
+  review, verification, review, recommendation, independent recommendation assignment
+  and challenge, owner resolution, lifecycle, completion-related artifacts,
+  release-change fragments, and the release
   classification contract. The generated Release PR gate binds that contract to the
   exact SemVer increment, package version, latest reachable prior tag, reviewed head,
   identical merge tree, immutable checkpoint, and main ancestry.
@@ -763,10 +814,12 @@ fingerprint, source tree, or publication range.
   readable under their released semantics. GitHub's artifact id and digest complete
   the immutable remote reference; this supplements rather than replaces N-1
   lifecycle evidence.
-- New lifecycle work uses bounded plan schema 2. Selective-impact consumers may add
-  the optional capability on project schema 3, while new integrations use bounded
-  project schema 4. Plan schema 1 and the pre-existing fields of project schemas 1-3
-  retain their published validation behavior instead of being tightened in place.
+- Projects without plan-decision opt-in continue using bounded plan schema 2. An
+  opted-in project uses plan schema 3 provenance and the pre-implementation gate.
+  Selective-impact consumers may add optional capabilities on project schema 3,
+  while new integrations use bounded project schema 4. Plan schemas 1 and 2 and the
+  pre-existing fields of project schemas 1-3 retain their published validation
+  behavior instead of being tightened in place.
 - `release.json` is the single release-identity owner. Governed GitHub tag and title
   are both exactly `v<SemVer>`; package metadata, runtime version, artifact names,
   authorization evidence, and later consumer locks must match it. Public-impact PRs

{engineering_process-0.6.0 → engineering_process-0.7.0}/VERSIONING.md

@@ -154,6 +154,32 @@ Completed historical decisions retain their original evidence and require no
 backfill. A recommendation resolution is decision evidence only and never substitutes
 for lifecycle completion or delivery authority.
 
+## Material-decision implementation gate
+
+Plan schema 3 adds explicit `authored` or `process-generated` provenance. The
+plan-decision assignment and review artifacts start at schema 1, while the optional
+project lifecycle policy is additive to project schemas 3 and 4. Released plan
+schemas 1 and 2 retain their historical meaning and remain readable; a project that
+does not adopt the policy retains its released schema-2 planning behavior.
+
+Adopting `provenance-gated-authored-review` changes the pre-implementation lifecycle
+semantics and is therefore a breaking package change before 1.0. Every new
+nontrivial authored plan receives a fresh read-only semantic assessment across the
+canonical material categories. A clear assessment permits `change implement`; a
+decision-required assessment remains blocked until the existing independently
+reviewed recommendation and explicit owner-resolution chain bind that exact
+assessment. A process-generated plan bypasses semantic assessment only when the
+installed immutable authority recognizes its generator and exactly recomputes the
+complete plan from validated source-owned inputs. Unknown generators, claimed
+labels, partial comparison, and stale contract, plan, source, authority, policy,
+context, assessment, recommendation, or resolution evidence fail closed.
+
+The producer ships the opt-in as a target-version adoption migration. Its current
+N-1 release candidate stays on plan schema 2, then self-adoption activates schema 3
+and exact release-plan recomputation for subsequent releases. No package, runtime,
+tag, artifact, or consumer-lock identity changes in the feature PR; the separate
+generated Release PR derives the pre-1.0 minor version.
+
 Remote-verification request and evidence-set schema-1 artifacts, optional project
 requirements, optional change selections, lifecycle references, and receipt content
 are additive serialized surfaces. A project does not gain the gate until a separate

{engineering_process-0.6.0 → engineering_process-0.7.0}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "0.6.0"
+VERSION = "0.7.0"

{engineering_process-0.6.0 → engineering_process-0.7.0}/engineering_process/cli.py

@@ -28,6 +28,8 @@ from .contracts import (
     validate_improvement_resolution,
     validate_improvement_signal,
     validate_plan,
+    validate_plan_decision_review,
+    validate_plan_decision_review_assignment,
     validate_process_lock,
     validate_project,
     validate_recommendation,
@@ -79,10 +81,13 @@ from .lifecycle import (
     lifecycle_status,
     ingest_remote_verification,
     register_plan,
+    resolve_plan_decision,
     request_remote_verification,
     start_change,
+    start_plan_decision_review,
     start_review,
     submit_review,
+    submit_plan_decision_review,
     verify_change,
 )
 from .runner import run_profile, source_state
@@ -295,6 +300,8 @@ def command_contract_validate(args: argparse.Namespace) -> int:
         "improvement-resolution": validate_improvement_resolution,
         "improvement-signal": validate_improvement_signal,
         "plan": validate_plan,
+        "plan-decision-review": validate_plan_decision_review,
+        "plan-decision-review-assignment": validate_plan_decision_review_assignment,
         "recommendation": validate_recommendation,
         "recommendation-resolution": validate_recommendation_resolution,
         "recommendation-review": validate_recommendation_review,
@@ -628,11 +635,80 @@ def command_change_plan(args: argparse.Namespace) -> int:
     return 0
 
 
+def command_change_decision_start(args: argparse.Namespace) -> int:
+    project = _lifecycle_project(args)
+    state, assignment = start_plan_decision_review(
+        args.project_root,
+        project,
+        args.change_id,
+        actor_id=args.actor,
+        context_id=args.context,
+        kind=args.actor_kind,
+        method=args.method,
+        attested_by=args.attested_by,
+        evidence=args.attestation_evidence,
+    )
+    _emit(
+        args,
+        _change_result(
+            "change decision start",
+            state,
+            verdict="pending",
+            assignment=state["planDecision"]["assignment"]["path"],
+            planSha256=assignment["planSha256"],
+        ),
+    )
+    return 0
+
+
+def command_change_decision_submit(args: argparse.Namespace) -> int:
+    project = _lifecycle_project(args)
+    state, review = submit_plan_decision_review(
+        args.project_root, project, args.change_id, args.review
+    )
+    _emit(
+        args,
+        _change_result(
+            "change decision submit",
+            state,
+            verdict=review["verdict"],
+            review=state["planDecision"]["review"]["path"],
+        ),
+    )
+    return 0
+
+
+def command_change_decision_resolve(args: argparse.Namespace) -> int:
+    project = _lifecycle_project(args)
+    state = resolve_plan_decision(
+        args.project_root,
+        project,
+        args.change_id,
+        recommendation_path=args.recommendation,
+        assignment_path=args.assignment,
+        review_path=args.recommendation_review,
+        resolution_path=args.resolution,
+        actor_id=args.actor,
+        context_id=args.context,
+        kind=args.actor_kind,
+    )
+    _emit(
+        args,
+        _change_result(
+            "change decision resolve",
+            state,
+            resolution=state["planDecision"]["resolution"]["path"],
+        ),
+    )
+    return 0
+
+
 def command_change_implement(args: argparse.Namespace) -> int:
-    _lifecycle_project(args)
+    project = _lifecycle_project(args)
     state = begin_implementation(
         args.project_root,
         args.change_id,
+        project=project,
         actor_id=args.actor,
         context_id=args.context,
         kind=args.actor_kind,
@@ -1597,6 +1673,8 @@ def build_parser() -> argparse.ArgumentParser:
             "improvement-resolution",
             "improvement-signal",
             "plan",
+            "plan-decision-review",
+            "plan-decision-review-assignment",
             "recommendation",
             "recommendation-resolution",
             "recommendation-review",
@@ -2361,6 +2439,47 @@ def build_parser() -> argparse.ArgumentParser:
     change_plan.add_argument("--plan", type=Path, required=True)
     change_plan.set_defaults(handler=command_change_plan)
 
+    change_decision = change_commands.add_parser(
+        "decision", help="Assess material decisions in an authored plan"
+    )
+    decision_commands = change_decision.add_subparsers(
+        dest="change_decision_command", required=True
+    )
+    decision_start = decision_commands.add_parser(
+        "start", help="Reserve a fresh reviewer and create the plan assessment assignment"
+    )
+    _add_lifecycle_common(decision_start)
+    _add_actor(decision_start)
+    decision_start.add_argument("--change-id", required=True)
+    decision_start.add_argument(
+        "--method", choices=("isolated-context", "separate-person"), required=True
+    )
+    decision_start.add_argument("--attested-by", required=True)
+    decision_start.add_argument("--attestation-evidence", required=True)
+    decision_start.set_defaults(handler=command_change_decision_start)
+
+    decision_submit = decision_commands.add_parser(
+        "submit", help="Validate and register the fresh material-decision assessment"
+    )
+    _add_lifecycle_common(decision_submit)
+    decision_submit.add_argument("--change-id", required=True)
+    decision_submit.add_argument("--review", type=Path, required=True)
+    decision_submit.set_defaults(handler=command_change_decision_submit)
+
+    decision_resolve = decision_commands.add_parser(
+        "resolve", help="Bind an approved recommendation and owner resolution"
+    )
+    _add_lifecycle_common(decision_resolve)
+    _add_actor(decision_resolve)
+    decision_resolve.add_argument("--change-id", required=True)
+    decision_resolve.add_argument("--recommendation", type=Path, required=True)
+    decision_resolve.add_argument("--assignment", type=Path, required=True)
+    decision_resolve.add_argument(
+        "--recommendation-review", type=Path, required=True
+    )
+    decision_resolve.add_argument("--resolution", type=Path, required=True)
+    decision_resolve.set_defaults(handler=command_change_decision_resolve)
+
     change_implement = change_commands.add_parser(
         "implement", help="Register an implementation actor and begin a cycle"
     )

{engineering_process-0.6.0 → engineering_process-0.7.0}/engineering_process/command_catalog.py

@@ -6,6 +6,9 @@ from __future__ import annotations
 LIFECYCLE_COMMAND_PATHS = frozenset(
     {
         "change finish",
+        "change decision resolve",
+        "change decision start",
+        "change decision submit",
         "change implement",
         "change plan",
         "change remote ingest",