engineering-process 1.2.4__tar.gz → 1.2.5__tar.gz

{engineering_process-1.2.4/engineering_process.egg-info → engineering_process-1.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 1.2.4
+Version: 1.2.5
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -441,6 +441,14 @@ At any point:
 
 ## Release to consumer PR
 
+This producer's release identity inputs and text assets declared by
+`tool.setuptools.data-files` use UTF-8 without BOM and LF, matching `.gitattributes`.
+Writers select that representation explicitly; JSON writers use
+`write_json_atomic`. Existing distribution verification checks the declared text
+bytes before building. It rejects CRLF, mixed endings, BOM and invalid UTF-8 even
+when text-mode reads or Git conversion would hide the difference. Binary data and
+fixtures outside that text inventory retain their own format contracts.
+
 Every opted-in consumer uses Renovate's pip-compile manager. Its engineering-process
 package rule keeps the adoption pull request in draft and runs exactly:
 

{engineering_process-1.2.4 → engineering_process-1.2.5}/README.md

@@ -417,6 +417,14 @@ At any point:
 
 ## Release to consumer PR
 
+This producer's release identity inputs and text assets declared by
+`tool.setuptools.data-files` use UTF-8 without BOM and LF, matching `.gitattributes`.
+Writers select that representation explicitly; JSON writers use
+`write_json_atomic`. Existing distribution verification checks the declared text
+bytes before building. It rejects CRLF, mixed endings, BOM and invalid UTF-8 even
+when text-mode reads or Git conversion would hide the difference. Binary data and
+fixtures outside that text inventory retain their own format contracts.
+
 Every opted-in consumer uses Renovate's pip-compile manager. Its engineering-process
 package rule keeps the adoption pull request in draft and runs exactly:
 

{engineering_process-1.2.4 → engineering_process-1.2.5}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "1.2.4"
+VERSION = "1.2.5"

{engineering_process-1.2.4 → engineering_process-1.2.5}/engineering_process/production_engineering.py

@@ -98,7 +98,12 @@ def validate_review_assessments(review: dict[str, Any], process_root: Path) -> N
     unlinked = sorted(
         finding_id
         for finding_id, finding in findings.items()
-        if finding["origin"] == "production-invariant" and finding_id not in linked
+        if finding["origin"] == "production-invariant"
+        and finding_id not in linked
+        and not (
+            finding["severity"] == "non-blocking"
+            and finding.get("disposition", {}).get("status") == "resolved"
+        )
     )
     if unlinked:
         raise ProcessError(

{engineering_process-1.2.4 → engineering_process-1.2.5/engineering_process.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 1.2.4
+Version: 1.2.5
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -441,6 +441,14 @@ At any point:
 
 ## Release to consumer PR
 
+This producer's release identity inputs and text assets declared by
+`tool.setuptools.data-files` use UTF-8 without BOM and LF, matching `.gitattributes`.
+Writers select that representation explicitly; JSON writers use
+`write_json_atomic`. Existing distribution verification checks the declared text
+bytes before building. It rejects CRLF, mixed endings, BOM and invalid UTF-8 even
+when text-mode reads or Git conversion would hide the difference. Binary data and
+fixtures outside that text inventory retain their own format contracts.
+
 Every opted-in consumer uses Renovate's pip-compile manager. Its engineering-process
 package rule keeps the adoption pull request in draft and runs exactly:
 

{engineering_process-1.2.4 → engineering_process-1.2.5}/process_assets/skills/production-engineering/SKILL.md

@@ -29,6 +29,11 @@ Verification proves only the deterministic properties exercised by its exact
 commands on the unchanged candidate. It must not claim to infer architecture,
 security, intent, or arbitrary prose semantics that those commands do not observe.
 
+When an artifact claim depends on byte identity, make encoding and newline rules
+explicit at its writer and compare bytes at the exported or installed boundary.
+Text-mode newline normalization and a clean Git diff cannot supply that proof;
+follow the artifact owner's format rather than imposing one text policy on consumers.
+
 Independent review reassesses every invariant against the contract, plan, complete
 diff, profile evidence, and readiness result. Mark it `satisfied`, `not-applicable`,
 or `violated`, give a concrete rationale, and cite evidence for `satisfied`. A

{engineering_process-1.2.4 → engineering_process-1.2.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-process"
-version = "1.2.4"
+version = "1.2.5"
 description = "A small agent-neutral engineering lifecycle with managed adoption"
 readme = "README.md"
 license = "MIT"

{engineering_process-1.2.4 → engineering_process-1.2.5}/tests/test_lifecycle.py

@@ -599,6 +599,43 @@ class LifecycleTests(unittest.TestCase):
         self.assertEqual("implementing", state["phase"])
         self.assertEqual({}, state["verification"])
 
+    def test_resolved_invariant_finishes_with_its_identity_and_history_preserved(self) -> None:
+        self.begin()
+        self.verify_all()
+        start_review(self.root, PROCESS_ROOT, "sample-change", actor_id="reviewer", context_id="review-context", kind="agent")
+        first = self.review_document("changes-requested")
+        first["findings"][0]["priority"] = "P2"
+        first_path = self.root / ".process" / "runs" / "first-review.json"
+        write_json(first_path, first)
+        state = submit_review(self.root, PROCESS_ROOT, "sample-change", first_path)
+        self.assertEqual("changes-requested", state["phase"])
+
+        begin_implementation(self.root, PROCESS_ROOT, "sample-change", actor_id="implementer", context_id="implementation-context-2", kind="agent")
+        (self.root / "product.txt").write_text("corrected\n", encoding="utf-8")
+        self.verify_all()
+        start_review(self.root, PROCESS_ROOT, "sample-change", actor_id="reviewer", context_id="review-context", kind="agent")
+        approved = self.review_document("approved")
+        carried = deepcopy(first["findings"][0])
+        carried["severity"] = "non-blocking"
+        carried["disposition"] = {"status": "resolved", "rationale": "The corrected candidate satisfies the invariant with fresh verification."}
+        approved["findings"] = [carried]
+        second_path = self.root / ".process" / "runs" / "second-review.json"
+        for field, changed in (("priority", "P3"), ("origin", "contract")):
+            invalid = deepcopy(approved)
+            invalid["findings"][0][field] = changed
+            write_json(second_path, invalid)
+            with self.subTest(field=field), self.assertRaisesRegex(ProcessError, "identity fields are immutable"):
+                submit_review(self.root, PROCESS_ROOT, "sample-change", second_path)
+        write_json(second_path, approved)
+        state = submit_review(self.root, PROCESS_ROOT, "sample-change", second_path)
+        self.assertEqual("approved", state["phase"])
+        self.assertEqual(first, state["reviewHistory"][0]["document"])
+        self.assertEqual(approved, state["reviewHistory"][1]["document"])
+        state, receipt = finish_change(self.root, PROCESS_ROOT, "sample-change", actor_id="coordinator", context_id="finish-context", kind="agent")
+        self.assertEqual("completed", state["phase"])
+        self.assertEqual(2, state["cycle"])
+        self.assertEqual("approved", receipt["review"]["verdict"])
+
     def test_correction_review_requires_the_original_reviewer_identity(self) -> None:
         self.begin()
         self.verify_all()

{engineering_process-1.2.4 → engineering_process-1.2.5}/tests/test_production_engineering.py

@@ -190,6 +190,31 @@ class ProductionEngineeringTests(unittest.TestCase):
         with self.assertRaisesRegex(ProcessError, "blocking finding"):
             validate_review_assessments(violation, ROOT)
 
+    def test_resolved_invariant_findings_do_not_require_a_current_violation(self) -> None:
+        review = deepcopy(self.review)
+        review["findings"] = [{
+            "id": "resolved-invariant",
+            "severity": "non-blocking",
+            "priority": "P2",
+            "criterionId": "works",
+            "origin": "production-invariant",
+            "summary": "The previous invariant violation is resolved on this snapshot.",
+            "disposition": {"status": "resolved", "rationale": "The corrected structure and current evidence satisfy the invariant."},
+        }]
+        validate_document(review, "review", schema_root=SCHEMAS)
+        validate_review_assessments(review, ROOT)
+        for status in ("accepted-risk", "tracked-follow-up"):
+            with self.subTest(status=status):
+                review["findings"][0]["disposition"] = {
+                    "status": status,
+                    "rationale": "The invariant violation remains open.",
+                    "owner": "consumer-owner",
+                    "recordUrl": "https://example.invalid/issues/1",
+                }
+                validate_document(review, "review", schema_root=SCHEMAS)
+                with self.assertRaisesRegex(ProcessError, "must be linked"):
+                    validate_review_assessments(review, ROOT)
+
     def test_review_cannot_approve_a_violation_or_leave_invariant_finding_unlinked(self) -> None:
         violation = deepcopy(self.review)
         assessment = violation["productionEngineering"][0]

{engineering_process-1.2.4 → engineering_process-1.2.5}/tests/test_release.py

@@ -12,12 +12,54 @@ import unittest
 from engineering_process.contracts import ProcessError, read_json, write_json_atomic
 from engineering_process.release import derive_next_version, validate_release
 from verification.normalize_sdist import normalize
+from verification.prepare_release import _replace_once
+from verification.verify_distribution import validate_distribution_text
 
 
 ROOT = Path(__file__).resolve().parent.parent
 
 
 class ReleaseTests(unittest.TestCase):
+    def test_release_replacement_writes_explicit_lf_on_every_host(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory) / "version.txt"
+            for source in (b"version=old\nnext\n", b"version=old\r\nnext\r\n", b"version=old\r\nnext\n"):
+                with self.subTest(source=source):
+                    target.write_bytes(source)
+                    _replace_once(target, "old", "new")
+                    self.assertEqual(b"version=new\nnext\n", target.read_bytes())
+
+    def test_release_replacement_rejects_bom_before_writing(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory) / "version.txt"
+            original = b'\xef\xbb\xbfVERSION = "old"\r\n'
+            target.write_bytes(original)
+            with self.assertRaisesRegex(ProcessError, "UTF-8 without BOM"):
+                _replace_once(target, "old", "new")
+            self.assertEqual(original, target.read_bytes())
+            self.assertFalse(target.with_name(f".{target.name}.release.tmp").exists())
+
+    def test_distribution_text_uses_the_declared_inventory_and_rejects_byte_drift(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "engineering_process").mkdir()
+            (root / "assets").mkdir()
+            (root / "pyproject.toml").write_bytes(b'[tool.setuptools.data-files]\n"share/process" = ["assets/newly-declared.fragment"]\n')
+            (root / "release.json").write_bytes(b"{}\n")
+            (root / "engineering_process" / "__init__.py").write_bytes(b'VERSION = "1.0.0"\n')
+            (root / "opaque.bin").write_bytes(b"\x00\xff\r\n")
+            target = root / "assets" / "newly-declared.fragment"
+            valid = b"first\nsecond\n"
+            target.write_bytes(valid)
+            validate_distribution_text(root)
+            for invalid in (b"first\r\nsecond\r\n", b"first\r\nsecond\n", b"\xef\xbb\xbf" + valid, b"\xff\n"):
+                with self.subTest(invalid=invalid):
+                    target.write_bytes(invalid)
+                    with self.assertRaisesRegex(RuntimeError, "UTF-8 without BOM and use LF"):
+                        validate_distribution_text(root)
+                    target.write_bytes(valid)
+                    validate_distribution_text(root)
+
     def test_current_release_identity_is_consistent(self) -> None:
         release = read_json(ROOT / "release.json")
         result = validate_release(ROOT, ROOT, tag=f"v{release['version']}")
@@ -90,6 +132,7 @@ class ReleaseTests(unittest.TestCase):
             self.assertIn(
                 f'version = "{expected}"', (target / "pyproject.toml").read_text()
             )
+            validate_distribution_text(target)
 
     def test_invalid_change_type_fails(self) -> None:
         with self.assertRaises(ProcessError):