engineering-process 1.2.2__tar.gz → 1.2.4__tar.gz

{engineering_process-1.2.2/engineering_process.egg-info → engineering_process-1.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 1.2.2
+Version: 1.2.4
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -352,6 +352,10 @@ URL; without it, the review remains pending. Earlier plan and review documents r
 readable, and their runs remain registrable or finishable with the version selected by
 the authority that started the relevant phase.
 
+The [finding priority definitions](process_assets/skills/review-change/SKILL.md#finding-priority)
+are the canonical P0-P3 impact convention for this process, including examples and
+their relationship to blocking decisions.
+
 ## Running a change
 
 Create and validate a change contract, then register it:

{engineering_process-1.2.2 → engineering_process-1.2.4}/README.md

@@ -328,6 +328,10 @@ URL; without it, the review remains pending. Earlier plan and review documents r
 readable, and their runs remain registrable or finishable with the version selected by
 the authority that started the relevant phase.
 
+The [finding priority definitions](process_assets/skills/review-change/SKILL.md#finding-priority)
+are the canonical P0-P3 impact convention for this process, including examples and
+their relationship to blocking decisions.
+
 ## Running a change
 
 Create and validate a change contract, then register it:

{engineering_process-1.2.2 → engineering_process-1.2.4}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "1.2.2"
+VERSION = "1.2.4"

{engineering_process-1.2.2 → engineering_process-1.2.4/engineering_process.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 1.2.2
+Version: 1.2.4
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -352,6 +352,10 @@ URL; without it, the review remains pending. Earlier plan and review documents r
 readable, and their runs remain registrable or finishable with the version selected by
 the authority that started the relevant phase.
 
+The [finding priority definitions](process_assets/skills/review-change/SKILL.md#finding-priority)
+are the canonical P0-P3 impact convention for this process, including examples and
+their relationship to blocking decisions.
+
 ## Running a change
 
 Create and validate a change contract, then register it:

{engineering_process-1.2.2 → engineering_process-1.2.4}/engineering_process.egg-info/SOURCES.txt

@@ -67,6 +67,7 @@ tests/test_distribution.py
 tests/test_lifecycle.py
 tests/test_production_engineering.py
 tests/test_publication_compat.py
+tests/test_pypi_cache_horizon.py
 tests/test_release.py
 tests/test_repository.py
 tests/test_skills.py

{engineering_process-1.2.2 → engineering_process-1.2.4}/process_assets/skills/review-change/SKILL.md

@@ -62,3 +62,28 @@ Follow-up scope is only carried findings, remediation diffs, and regressions aga
 the frozen contract. A new blocker must be either remediation-caused or a P0/P1 late
 violation with a rationale. After two correction cycles, another changes-requested
 verdict blocks the change; it never turns into approval or permission to skip review.
+
+## Finding priority
+
+P0-P3 are this process's review-impact convention. Assess the consequences if the
+finding remains unresolved in a supported scenario. Consumer scheduling and incident
+response deadlines remain consumer-owned.
+
+| Priority | Impact | Illustrative example |
+| --- | --- | --- |
+| P0 - critical | Catastrophic loss of essential operation, authoritative data, or a critical security guarantee. | Irrecoverable loss of the only authoritative dataset. |
+| P1 - high | Severe failure of a core workflow or guarantee, below P0's catastrophic consequences. | A primary workflow produces wrong results that can be regenerated from intact inputs. |
+| P2 - medium | Material but contained incorrect behavior or operational or maintenance cost; core workflows remain usable. | A recoverable failure in a secondary workflow with a safe alternative. |
+| P3 - low | Minor inconvenience or clarity or consistency defect with little effect on behavior or reliability. | An unclear optional explanation when all required steps remain unambiguous. |
+
+Choose the highest level whose consequences the evidence supports. Explain affected
+guarantees, reach, preconditions, recoverability, and safe alternatives. Examples are
+illustrative, not an exhaustive classifier; file type, finding category, keywords,
+and ease of repair do not determine priority.
+
+Severity follows whether the reviewed snapshot violates the accepted contract or an
+applicable production invariant; priority is not a waiver. A P2 or P3 finding can
+therefore be blocking. The existing P0/P1 restriction on a new `critical-late` blocker
+is an eligibility condition, not permission to block without the required bounded
+late rationale. Preserve carried finding priorities and historical reports under the
+existing correction-cycle rules.

{engineering_process-1.2.2 → engineering_process-1.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-process"
-version = "1.2.2"
+version = "1.2.4"
 description = "A small agent-neutral engineering lifecycle with managed adoption"
 readme = "README.md"
 license = "MIT"

{engineering_process-1.2.2 → engineering_process-1.2.4}/tests/test_automation.py

@@ -105,6 +105,31 @@ class AutomationTests(unittest.TestCase):
             "  dispatch-adoption:\n    name: Dispatch consumer adoption\n", workflow
         )
         self.assertIn("needs: [metadata, publish]", workflow)
+        dispatch_job = workflow.split("\n  dispatch-adoption:\n", maxsplit=1)[1]
+        self.assertIn("    timeout-minutes: 20\n", dispatch_job)
+        cache_wait = dispatch_job.split(
+            "      - name: Wait for consumer Simple caches to expire\n", maxsplit=1
+        )[1].split(
+            "      - name: Create short-lived Renovate event token\n", maxsplit=1
+        )[0]
+        self.assertIn(
+            "python verification/wait_for_pypi_cache_horizon.py",
+            cache_wait,
+        )
+        self.assertIn("${{ steps.release.outputs.published_at }}", cache_wait)
+        self.assertIn(
+            "ref: ${{ github.sha }}",
+            dispatch_job,
+        )
+        self.assertNotIn("ref: ${{ needs.metadata.outputs.source_sha }}", dispatch_job)
+        self.assertIn(
+            'published_at=$(gh release view "$RELEASE_TAG"',
+            dispatch_job,
+        )
+        self.assertLess(
+            dispatch_job.index("      - name: Bind the published distribution\n"),
+            dispatch_job.index("      - name: Wait for consumer Simple caches to expire\n"),
+        )
         self.assertIn("Verify PyPI exposes the exact built hashes", workflow)
         visibility = workflow.split(
             "      - name: Verify PyPI exposes the exact built hashes\n", maxsplit=1
@@ -142,6 +167,8 @@ class AutomationTests(unittest.TestCase):
         publish_job = workflow.split("  publish:\n", maxsplit=1)[1].split(
             "\n  dispatch-adoption:\n", maxsplit=1
         )[0]
+        self.assertIn("ref: ${{ needs.metadata.outputs.source_sha }}", publish_job)
+        self.assertNotIn("ref: ${{ github.sha }}", publish_job)
         self.assertIn("id: release-token", publish_job)
         self.assertIn("repositories: engineering-process", publish_job)
         self.assertIn("permission-contents: write", publish_job)

{engineering_process-1.2.2 → engineering_process-1.2.4}/tests/test_lifecycle.py

@@ -793,6 +793,34 @@ class LifecycleTests(unittest.TestCase):
                     (self.root / ".process" / "runs" / "sample-change").exists()
                 )
 
+    def test_live_producer_policy_requires_its_accepted_issue(self) -> None:
+        project = json.loads((PROCESS_ROOT / ".process" / "project.json").read_text())
+        self.project["lifecycle"]["processChanges"] = project["lifecycle"]["processChanges"]
+        self.contract["consumerEvidence"] = [
+            {"repository": "engineering-process", "incident": "Deferred issue handoff enablement."}
+        ]
+        for source in (
+            "issue-110",
+            "https://github.com/other/process/issues/110",
+            "https://github.com/phuongnse/engineering-process/pull/118",
+        ):
+            with self.subTest(source=source):
+                self.contract["source"] = source
+                write_json(self.contract_path, self.contract)
+                with self.assertRaisesRegex(ProcessError, "numbered issue"):
+                    start_change(
+                        self.root, PROCESS_ROOT, self.project, self.contract_path,
+                        actor_id="author", context_id="author-context", kind="agent",
+                    )
+                self.assertFalse((self.root / ".process" / "runs").exists())
+        self.contract["source"] = "https://github.com/phuongnse/engineering-process/issues/110"
+        write_json(self.contract_path, self.contract)
+        state = start_change(
+            self.root, PROCESS_ROOT, self.project, self.contract_path,
+            actor_id="author", context_id="author-context", kind="agent",
+        )
+        self.assertEqual("specified", state["phase"])
+
     def test_evidence_only_process_change_policy_remains_compatible(self) -> None:
         self.project["lifecycle"]["processChanges"] = {
             "requireConsumerEvidence": True

engineering_process-1.2.4/tests/test_pypi_cache_horizon.py

@@ -0,0 +1,81 @@
+from datetime import datetime, timezone
+from email.message import Message
+import unittest
+from unittest.mock import patch
+
+from verification.wait_for_pypi_cache_horizon import (
+    MAX_SIMPLE_CACHE_SECONDS,
+    read_simple_max_age,
+    parse_max_age,
+    remaining_seconds,
+)
+
+
+class _Response:
+    def __init__(self, headers: Message) -> None:
+        self.headers = headers
+
+    def __enter__(self) -> "_Response":
+        return self
+
+    def __exit__(self, *args: object) -> None:
+        return None
+
+
+class PyPICacheHorizonTests(unittest.TestCase):
+    NOW = datetime(2026, 9, 4, 13, 30, tzinfo=timezone.utc)
+
+    def test_parses_current_bounded_header(self) -> None:
+        self.assertEqual(600, parse_max_age(["max-age=600, public"]))
+        self.assertEqual(
+            MAX_SIMPLE_CACHE_SECONDS,
+            parse_max_age([f"public, max-age={MAX_SIMPLE_CACHE_SECONDS}"]),
+        )
+
+    def test_rejects_missing_duplicate_malformed_and_excessive_max_age(self) -> None:
+        invalid = [
+            None,
+            ["public"],
+            ["max-age=600", "max-age=300"],
+            ["max-age=-1"],
+            ["max-age=invalid"],
+            [f"max-age={MAX_SIMPLE_CACHE_SECONDS + 1}"],
+        ]
+        for values in invalid:
+            with self.subTest(values=values), self.assertRaises(RuntimeError):
+                parse_max_age(values)
+
+    def test_reads_every_cache_control_field(self) -> None:
+        headers = Message()
+        headers["Content-Type"] = "application/vnd.pypi.simple.v1+json"
+        headers["Cache-Control"] = "public, max-age=600"
+        headers["Cache-Control"] = "max-age=300"
+        with patch(
+            "verification.wait_for_pypi_cache_horizon.urlopen",
+            return_value=_Response(headers),
+        ), self.assertRaises(RuntimeError):
+            read_simple_max_age()
+
+    def test_current_horizon_and_elapsed_resume(self) -> None:
+        self.assertEqual(
+            305,
+            remaining_seconds("2026-09-04T13:20:00Z", 900, now=self.NOW),
+        )
+        self.assertEqual(
+            0,
+            remaining_seconds("2026-09-04T13:00:00Z", 600, now=self.NOW),
+        )
+
+    def test_rejects_malformed_naive_and_future_timestamps(self) -> None:
+        invalid = [
+            "invalid",
+            "2026-09-04T13:20:00",
+            "2026-09-04T13:31:01Z",
+        ]
+        for published_at in invalid:
+            with self.subTest(published_at=published_at), self.assertRaises(RuntimeError):
+                remaining_seconds(published_at, 600, now=self.NOW)
+
+
+if __name__ == "__main__":
+    unittest.main()