engineering-process 1.2.3__tar.gz → 1.2.5__tar.gz

{engineering_process-1.2.3/engineering_process.egg-info → engineering_process-1.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 1.2.3
+Version: 1.2.5
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -352,6 +352,10 @@ URL; without it, the review remains pending. Earlier plan and review documents r
 readable, and their runs remain registrable or finishable with the version selected by
 the authority that started the relevant phase.
 
+The [finding priority definitions](process_assets/skills/review-change/SKILL.md#finding-priority)
+are the canonical P0-P3 impact convention for this process, including examples and
+their relationship to blocking decisions.
+
 ## Running a change
 
 Create and validate a change contract, then register it:
@@ -437,6 +441,14 @@ At any point:
 
 ## Release to consumer PR
 
+This producer's release identity inputs and text assets declared by
+`tool.setuptools.data-files` use UTF-8 without BOM and LF, matching `.gitattributes`.
+Writers select that representation explicitly; JSON writers use
+`write_json_atomic`. Existing distribution verification checks the declared text
+bytes before building. It rejects CRLF, mixed endings, BOM and invalid UTF-8 even
+when text-mode reads or Git conversion would hide the difference. Binary data and
+fixtures outside that text inventory retain their own format contracts.
+
 Every opted-in consumer uses Renovate's pip-compile manager. Its engineering-process
 package rule keeps the adoption pull request in draft and runs exactly:
 

{engineering_process-1.2.3 → engineering_process-1.2.5}/README.md

@@ -328,6 +328,10 @@ URL; without it, the review remains pending. Earlier plan and review documents r
 readable, and their runs remain registrable or finishable with the version selected by
 the authority that started the relevant phase.
 
+The [finding priority definitions](process_assets/skills/review-change/SKILL.md#finding-priority)
+are the canonical P0-P3 impact convention for this process, including examples and
+their relationship to blocking decisions.
+
 ## Running a change
 
 Create and validate a change contract, then register it:
@@ -413,6 +417,14 @@ At any point:
 
 ## Release to consumer PR
 
+This producer's release identity inputs and text assets declared by
+`tool.setuptools.data-files` use UTF-8 without BOM and LF, matching `.gitattributes`.
+Writers select that representation explicitly; JSON writers use
+`write_json_atomic`. Existing distribution verification checks the declared text
+bytes before building. It rejects CRLF, mixed endings, BOM and invalid UTF-8 even
+when text-mode reads or Git conversion would hide the difference. Binary data and
+fixtures outside that text inventory retain their own format contracts.
+
 Every opted-in consumer uses Renovate's pip-compile manager. Its engineering-process
 package rule keeps the adoption pull request in draft and runs exactly:
 

{engineering_process-1.2.3 → engineering_process-1.2.5}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "1.2.3"
+VERSION = "1.2.5"

{engineering_process-1.2.3 → engineering_process-1.2.5}/engineering_process/production_engineering.py

@@ -98,7 +98,12 @@ def validate_review_assessments(review: dict[str, Any], process_root: Path) -> N
     unlinked = sorted(
         finding_id
         for finding_id, finding in findings.items()
-        if finding["origin"] == "production-invariant" and finding_id not in linked
+        if finding["origin"] == "production-invariant"
+        and finding_id not in linked
+        and not (
+            finding["severity"] == "non-blocking"
+            and finding.get("disposition", {}).get("status") == "resolved"
+        )
     )
     if unlinked:
         raise ProcessError(

{engineering_process-1.2.3 → engineering_process-1.2.5/engineering_process.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 1.2.3
+Version: 1.2.5
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -352,6 +352,10 @@ URL; without it, the review remains pending. Earlier plan and review documents r
 readable, and their runs remain registrable or finishable with the version selected by
 the authority that started the relevant phase.
 
+The [finding priority definitions](process_assets/skills/review-change/SKILL.md#finding-priority)
+are the canonical P0-P3 impact convention for this process, including examples and
+their relationship to blocking decisions.
+
 ## Running a change
 
 Create and validate a change contract, then register it:
@@ -437,6 +441,14 @@ At any point:
 
 ## Release to consumer PR
 
+This producer's release identity inputs and text assets declared by
+`tool.setuptools.data-files` use UTF-8 without BOM and LF, matching `.gitattributes`.
+Writers select that representation explicitly; JSON writers use
+`write_json_atomic`. Existing distribution verification checks the declared text
+bytes before building. It rejects CRLF, mixed endings, BOM and invalid UTF-8 even
+when text-mode reads or Git conversion would hide the difference. Binary data and
+fixtures outside that text inventory retain their own format contracts.
+
 Every opted-in consumer uses Renovate's pip-compile manager. Its engineering-process
 package rule keeps the adoption pull request in draft and runs exactly:
 

{engineering_process-1.2.3 → engineering_process-1.2.5}/process_assets/skills/production-engineering/SKILL.md

@@ -29,6 +29,11 @@ Verification proves only the deterministic properties exercised by its exact
 commands on the unchanged candidate. It must not claim to infer architecture,
 security, intent, or arbitrary prose semantics that those commands do not observe.
 
+When an artifact claim depends on byte identity, make encoding and newline rules
+explicit at its writer and compare bytes at the exported or installed boundary.
+Text-mode newline normalization and a clean Git diff cannot supply that proof;
+follow the artifact owner's format rather than imposing one text policy on consumers.
+
 Independent review reassesses every invariant against the contract, plan, complete
 diff, profile evidence, and readiness result. Mark it `satisfied`, `not-applicable`,
 or `violated`, give a concrete rationale, and cite evidence for `satisfied`. A

{engineering_process-1.2.3 → engineering_process-1.2.5}/process_assets/skills/review-change/SKILL.md

@@ -62,3 +62,28 @@ Follow-up scope is only carried findings, remediation diffs, and regressions aga
 the frozen contract. A new blocker must be either remediation-caused or a P0/P1 late
 violation with a rationale. After two correction cycles, another changes-requested
 verdict blocks the change; it never turns into approval or permission to skip review.
+
+## Finding priority
+
+P0-P3 are this process's review-impact convention. Assess the consequences if the
+finding remains unresolved in a supported scenario. Consumer scheduling and incident
+response deadlines remain consumer-owned.
+
+| Priority | Impact | Illustrative example |
+| --- | --- | --- |
+| P0 - critical | Catastrophic loss of essential operation, authoritative data, or a critical security guarantee. | Irrecoverable loss of the only authoritative dataset. |
+| P1 - high | Severe failure of a core workflow or guarantee, below P0's catastrophic consequences. | A primary workflow produces wrong results that can be regenerated from intact inputs. |
+| P2 - medium | Material but contained incorrect behavior or operational or maintenance cost; core workflows remain usable. | A recoverable failure in a secondary workflow with a safe alternative. |
+| P3 - low | Minor inconvenience or clarity or consistency defect with little effect on behavior or reliability. | An unclear optional explanation when all required steps remain unambiguous. |
+
+Choose the highest level whose consequences the evidence supports. Explain affected
+guarantees, reach, preconditions, recoverability, and safe alternatives. Examples are
+illustrative, not an exhaustive classifier; file type, finding category, keywords,
+and ease of repair do not determine priority.
+
+Severity follows whether the reviewed snapshot violates the accepted contract or an
+applicable production invariant; priority is not a waiver. A P2 or P3 finding can
+therefore be blocking. The existing P0/P1 restriction on a new `critical-late` blocker
+is an eligibility condition, not permission to block without the required bounded
+late rationale. Preserve carried finding priorities and historical reports under the
+existing correction-cycle rules.

{engineering_process-1.2.3 → engineering_process-1.2.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-process"
-version = "1.2.3"
+version = "1.2.5"
 description = "A small agent-neutral engineering lifecycle with managed adoption"
 readme = "README.md"
 license = "MIT"

{engineering_process-1.2.3 → engineering_process-1.2.5}/tests/test_lifecycle.py

@@ -599,6 +599,43 @@ class LifecycleTests(unittest.TestCase):
         self.assertEqual("implementing", state["phase"])
         self.assertEqual({}, state["verification"])
 
+    def test_resolved_invariant_finishes_with_its_identity_and_history_preserved(self) -> None:
+        self.begin()
+        self.verify_all()
+        start_review(self.root, PROCESS_ROOT, "sample-change", actor_id="reviewer", context_id="review-context", kind="agent")
+        first = self.review_document("changes-requested")
+        first["findings"][0]["priority"] = "P2"
+        first_path = self.root / ".process" / "runs" / "first-review.json"
+        write_json(first_path, first)
+        state = submit_review(self.root, PROCESS_ROOT, "sample-change", first_path)
+        self.assertEqual("changes-requested", state["phase"])
+
+        begin_implementation(self.root, PROCESS_ROOT, "sample-change", actor_id="implementer", context_id="implementation-context-2", kind="agent")
+        (self.root / "product.txt").write_text("corrected\n", encoding="utf-8")
+        self.verify_all()
+        start_review(self.root, PROCESS_ROOT, "sample-change", actor_id="reviewer", context_id="review-context", kind="agent")
+        approved = self.review_document("approved")
+        carried = deepcopy(first["findings"][0])
+        carried["severity"] = "non-blocking"
+        carried["disposition"] = {"status": "resolved", "rationale": "The corrected candidate satisfies the invariant with fresh verification."}
+        approved["findings"] = [carried]
+        second_path = self.root / ".process" / "runs" / "second-review.json"
+        for field, changed in (("priority", "P3"), ("origin", "contract")):
+            invalid = deepcopy(approved)
+            invalid["findings"][0][field] = changed
+            write_json(second_path, invalid)
+            with self.subTest(field=field), self.assertRaisesRegex(ProcessError, "identity fields are immutable"):
+                submit_review(self.root, PROCESS_ROOT, "sample-change", second_path)
+        write_json(second_path, approved)
+        state = submit_review(self.root, PROCESS_ROOT, "sample-change", second_path)
+        self.assertEqual("approved", state["phase"])
+        self.assertEqual(first, state["reviewHistory"][0]["document"])
+        self.assertEqual(approved, state["reviewHistory"][1]["document"])
+        state, receipt = finish_change(self.root, PROCESS_ROOT, "sample-change", actor_id="coordinator", context_id="finish-context", kind="agent")
+        self.assertEqual("completed", state["phase"])
+        self.assertEqual(2, state["cycle"])
+        self.assertEqual("approved", receipt["review"]["verdict"])
+
     def test_correction_review_requires_the_original_reviewer_identity(self) -> None:
         self.begin()
         self.verify_all()
@@ -793,6 +830,34 @@ class LifecycleTests(unittest.TestCase):
                     (self.root / ".process" / "runs" / "sample-change").exists()
                 )
 
+    def test_live_producer_policy_requires_its_accepted_issue(self) -> None:
+        project = json.loads((PROCESS_ROOT / ".process" / "project.json").read_text())
+        self.project["lifecycle"]["processChanges"] = project["lifecycle"]["processChanges"]
+        self.contract["consumerEvidence"] = [
+            {"repository": "engineering-process", "incident": "Deferred issue handoff enablement."}
+        ]
+        for source in (
+            "issue-110",
+            "https://github.com/other/process/issues/110",
+            "https://github.com/phuongnse/engineering-process/pull/118",
+        ):
+            with self.subTest(source=source):
+                self.contract["source"] = source
+                write_json(self.contract_path, self.contract)
+                with self.assertRaisesRegex(ProcessError, "numbered issue"):
+                    start_change(
+                        self.root, PROCESS_ROOT, self.project, self.contract_path,
+                        actor_id="author", context_id="author-context", kind="agent",
+                    )
+                self.assertFalse((self.root / ".process" / "runs").exists())
+        self.contract["source"] = "https://github.com/phuongnse/engineering-process/issues/110"
+        write_json(self.contract_path, self.contract)
+        state = start_change(
+            self.root, PROCESS_ROOT, self.project, self.contract_path,
+            actor_id="author", context_id="author-context", kind="agent",
+        )
+        self.assertEqual("specified", state["phase"])
+
     def test_evidence_only_process_change_policy_remains_compatible(self) -> None:
         self.project["lifecycle"]["processChanges"] = {
             "requireConsumerEvidence": True

{engineering_process-1.2.3 → engineering_process-1.2.5}/tests/test_production_engineering.py

@@ -190,6 +190,31 @@ class ProductionEngineeringTests(unittest.TestCase):
         with self.assertRaisesRegex(ProcessError, "blocking finding"):
             validate_review_assessments(violation, ROOT)
 
+    def test_resolved_invariant_findings_do_not_require_a_current_violation(self) -> None:
+        review = deepcopy(self.review)
+        review["findings"] = [{
+            "id": "resolved-invariant",
+            "severity": "non-blocking",
+            "priority": "P2",
+            "criterionId": "works",
+            "origin": "production-invariant",
+            "summary": "The previous invariant violation is resolved on this snapshot.",
+            "disposition": {"status": "resolved", "rationale": "The corrected structure and current evidence satisfy the invariant."},
+        }]
+        validate_document(review, "review", schema_root=SCHEMAS)
+        validate_review_assessments(review, ROOT)
+        for status in ("accepted-risk", "tracked-follow-up"):
+            with self.subTest(status=status):
+                review["findings"][0]["disposition"] = {
+                    "status": status,
+                    "rationale": "The invariant violation remains open.",
+                    "owner": "consumer-owner",
+                    "recordUrl": "https://example.invalid/issues/1",
+                }
+                validate_document(review, "review", schema_root=SCHEMAS)
+                with self.assertRaisesRegex(ProcessError, "must be linked"):
+                    validate_review_assessments(review, ROOT)
+
     def test_review_cannot_approve_a_violation_or_leave_invariant_finding_unlinked(self) -> None:
         violation = deepcopy(self.review)
         assessment = violation["productionEngineering"][0]

{engineering_process-1.2.3 → engineering_process-1.2.5}/tests/test_release.py

@@ -12,12 +12,54 @@ import unittest
 from engineering_process.contracts import ProcessError, read_json, write_json_atomic
 from engineering_process.release import derive_next_version, validate_release
 from verification.normalize_sdist import normalize
+from verification.prepare_release import _replace_once
+from verification.verify_distribution import validate_distribution_text
 
 
 ROOT = Path(__file__).resolve().parent.parent
 
 
 class ReleaseTests(unittest.TestCase):
+    def test_release_replacement_writes_explicit_lf_on_every_host(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory) / "version.txt"
+            for source in (b"version=old\nnext\n", b"version=old\r\nnext\r\n", b"version=old\r\nnext\n"):
+                with self.subTest(source=source):
+                    target.write_bytes(source)
+                    _replace_once(target, "old", "new")
+                    self.assertEqual(b"version=new\nnext\n", target.read_bytes())
+
+    def test_release_replacement_rejects_bom_before_writing(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory) / "version.txt"
+            original = b'\xef\xbb\xbfVERSION = "old"\r\n'
+            target.write_bytes(original)
+            with self.assertRaisesRegex(ProcessError, "UTF-8 without BOM"):
+                _replace_once(target, "old", "new")
+            self.assertEqual(original, target.read_bytes())
+            self.assertFalse(target.with_name(f".{target.name}.release.tmp").exists())
+
+    def test_distribution_text_uses_the_declared_inventory_and_rejects_byte_drift(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "engineering_process").mkdir()
+            (root / "assets").mkdir()
+            (root / "pyproject.toml").write_bytes(b'[tool.setuptools.data-files]\n"share/process" = ["assets/newly-declared.fragment"]\n')
+            (root / "release.json").write_bytes(b"{}\n")
+            (root / "engineering_process" / "__init__.py").write_bytes(b'VERSION = "1.0.0"\n')
+            (root / "opaque.bin").write_bytes(b"\x00\xff\r\n")
+            target = root / "assets" / "newly-declared.fragment"
+            valid = b"first\nsecond\n"
+            target.write_bytes(valid)
+            validate_distribution_text(root)
+            for invalid in (b"first\r\nsecond\r\n", b"first\r\nsecond\n", b"\xef\xbb\xbf" + valid, b"\xff\n"):
+                with self.subTest(invalid=invalid):
+                    target.write_bytes(invalid)
+                    with self.assertRaisesRegex(RuntimeError, "UTF-8 without BOM and use LF"):
+                        validate_distribution_text(root)
+                    target.write_bytes(valid)
+                    validate_distribution_text(root)
+
     def test_current_release_identity_is_consistent(self) -> None:
         release = read_json(ROOT / "release.json")
         result = validate_release(ROOT, ROOT, tag=f"v{release['version']}")
@@ -90,6 +132,7 @@ class ReleaseTests(unittest.TestCase):
             self.assertIn(
                 f'version = "{expected}"', (target / "pyproject.toml").read_text()
             )
+            validate_distribution_text(target)
 
     def test_invalid_change_type_fails(self) -> None:
         with self.assertRaises(ProcessError):