engineering-process 1.2.4__tar.gz → 1.2.6__tar.gz

{engineering_process-1.2.4 → engineering_process-1.2.6}/MANIFEST.in

@@ -1,4 +1,4 @@
 include process-graph.json
 recursive-include process_assets/skills SKILL.md *.json
 recursive-include schemas *.json
-recursive-include templates *.md *.py
+recursive-include templates *.md *.py *.json

{engineering_process-1.2.4/engineering_process.egg-info → engineering_process-1.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 1.2.4
+Version: 1.2.6
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -441,6 +441,14 @@ At any point:
 
 ## Release to consumer PR
 
+This producer's release identity inputs and text assets declared by
+`tool.setuptools.data-files` use UTF-8 without BOM and LF, matching `.gitattributes`.
+Writers select that representation explicitly; JSON writers use
+`write_json_atomic`. Existing distribution verification checks the declared text
+bytes before building. It rejects CRLF, mixed endings, BOM and invalid UTF-8 even
+when text-mode reads or Git conversion would hide the difference. Binary data and
+fixtures outside that text inventory retain their own format contracts.
+
 Every opted-in consumer uses Renovate's pip-compile manager. Its engineering-process
 package rule keeps the adoption pull request in draft and runs exactly:
 
@@ -463,6 +471,39 @@ authorizes that merge.
 This repository opts in through .github/renovate.json, so it receives the same
 adoption PR as every other consumer. See SELF_HOSTING.md and RELEASING.md.
 
+The optional [Renovate preset](templates/renovate.json) is generated from the
+canonical public template. It supplies only `prHeader` and `prBodyTemplate`;
+dependency selection, supported platforms, schedules, major-update approval,
+commands, draft policy, and merge authority remain consumer-owned. Regenerate it
+with `python verification/generate_renovate_preset.py`; `--check` rejects drift.
+
+Consumers add `github>phuongnse/engineering-process//templates/renovate#COMMIT_SHA`
+to their existing `extends` array, replacing `COMMIT_SHA` with the full source
+commit of a verified release that contains the preset. Remove obsolete inline
+`prHeader` and `prBodyTemplate` overrides, including matching package-rule overrides.
+The preset targets the canonical draft grammar used by 1.2.4 and this distribution;
+it does not claim compatibility with earlier publication contracts. A future
+grammar change must preserve this adapter or ship an explicit consumer migration.
+
+Renovate resolves presets from the protected base configuration before dependency
+updates and post-upgrade tasks. Bootstrap the compatible preset in that base before
+relying on its generated drafts; changing the candidate configuration alone cannot
+repair the same run's body. Verify the native rendered body against both the base
+and candidate process authority during adoption. Pending fields and unchecked
+Completion gate items are proposals, never evidence or approval.
+
+Before collecting lifecycle evidence for a bot PR, apply its configured
+`stopUpdatingLabel` (Renovate's default is `stop-updating`) and confirm the head is
+unchanged after any in-flight bot run finishes. Keep the label through verification,
+independent review, receipt and the consumer-owned merge. Do not request a native
+rebase or dashboard retry while reviewing: an explicit retry can resume updates.
+If the candidate changes, open a new implementation cycle and collect fresh
+evidence. Remove the pause label only when returning the PR to automation.
+
+These are native [shared preset](https://docs.renovatebot.com/config-presets/) and
+[review pause](https://docs.renovatebot.com/configuration-options/#stopupdatinglabel)
+boundaries; the control plane does not become a second PR publisher.
+
 ## Compatibility
 
 Version 1.x retains a few small pre-1.0 command shapes so existing consumers can

{engineering_process-1.2.4 → engineering_process-1.2.6}/README.md

@@ -417,6 +417,14 @@ At any point:
 
 ## Release to consumer PR
 
+This producer's release identity inputs and text assets declared by
+`tool.setuptools.data-files` use UTF-8 without BOM and LF, matching `.gitattributes`.
+Writers select that representation explicitly; JSON writers use
+`write_json_atomic`. Existing distribution verification checks the declared text
+bytes before building. It rejects CRLF, mixed endings, BOM and invalid UTF-8 even
+when text-mode reads or Git conversion would hide the difference. Binary data and
+fixtures outside that text inventory retain their own format contracts.
+
 Every opted-in consumer uses Renovate's pip-compile manager. Its engineering-process
 package rule keeps the adoption pull request in draft and runs exactly:
 
@@ -439,6 +447,39 @@ authorizes that merge.
 This repository opts in through .github/renovate.json, so it receives the same
 adoption PR as every other consumer. See SELF_HOSTING.md and RELEASING.md.
 
+The optional [Renovate preset](templates/renovate.json) is generated from the
+canonical public template. It supplies only `prHeader` and `prBodyTemplate`;
+dependency selection, supported platforms, schedules, major-update approval,
+commands, draft policy, and merge authority remain consumer-owned. Regenerate it
+with `python verification/generate_renovate_preset.py`; `--check` rejects drift.
+
+Consumers add `github>phuongnse/engineering-process//templates/renovate#COMMIT_SHA`
+to their existing `extends` array, replacing `COMMIT_SHA` with the full source
+commit of a verified release that contains the preset. Remove obsolete inline
+`prHeader` and `prBodyTemplate` overrides, including matching package-rule overrides.
+The preset targets the canonical draft grammar used by 1.2.4 and this distribution;
+it does not claim compatibility with earlier publication contracts. A future
+grammar change must preserve this adapter or ship an explicit consumer migration.
+
+Renovate resolves presets from the protected base configuration before dependency
+updates and post-upgrade tasks. Bootstrap the compatible preset in that base before
+relying on its generated drafts; changing the candidate configuration alone cannot
+repair the same run's body. Verify the native rendered body against both the base
+and candidate process authority during adoption. Pending fields and unchecked
+Completion gate items are proposals, never evidence or approval.
+
+Before collecting lifecycle evidence for a bot PR, apply its configured
+`stopUpdatingLabel` (Renovate's default is `stop-updating`) and confirm the head is
+unchanged after any in-flight bot run finishes. Keep the label through verification,
+independent review, receipt and the consumer-owned merge. Do not request a native
+rebase or dashboard retry while reviewing: an explicit retry can resume updates.
+If the candidate changes, open a new implementation cycle and collect fresh
+evidence. Remove the pause label only when returning the PR to automation.
+
+These are native [shared preset](https://docs.renovatebot.com/config-presets/) and
+[review pause](https://docs.renovatebot.com/configuration-options/#stopupdatinglabel)
+boundaries; the control plane does not become a second PR publisher.
+
 ## Compatibility
 
 Version 1.x retains a few small pre-1.0 command shapes so existing consumers can

{engineering_process-1.2.4 → engineering_process-1.2.6}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "1.2.4"
+VERSION = "1.2.6"

{engineering_process-1.2.4 → engineering_process-1.2.6}/engineering_process/contracts.py

@@ -67,9 +67,9 @@ def digest_json(value: Any) -> str:
     return "sha256:" + hashlib.sha256(canonical_bytes(value)).hexdigest()
 
 
-def write_json_atomic(path: Path, value: Any) -> None:
-    """Write canonical human-readable JSON without exposing a partial file."""
-    data = (
+def formatted_json_bytes(value: Any) -> bytes:
+    """Serialize human-readable JSON as UTF-8 without BOM, using LF."""
+    return (
         json.dumps(
             value,
             ensure_ascii=False,
@@ -79,6 +79,11 @@ def write_json_atomic(path: Path, value: Any) -> None:
         )
         + "\n"
     ).encode("utf-8")
+
+
+def write_json_atomic(path: Path, value: Any) -> None:
+    """Write canonical human-readable JSON without exposing a partial file."""
+    data = formatted_json_bytes(value)
     path.parent.mkdir(parents=True, exist_ok=True)
     temporary = path.with_name(f".{path.name}.tmp")
     try:

{engineering_process-1.2.4 → engineering_process-1.2.6}/engineering_process/production_engineering.py

@@ -98,7 +98,12 @@ def validate_review_assessments(review: dict[str, Any], process_root: Path) -> N
     unlinked = sorted(
         finding_id
         for finding_id, finding in findings.items()
-        if finding["origin"] == "production-invariant" and finding_id not in linked
+        if finding["origin"] == "production-invariant"
+        and finding_id not in linked
+        and not (
+            finding["severity"] == "non-blocking"
+            and finding.get("disposition", {}).get("status") == "resolved"
+        )
     )
     if unlinked:
         raise ProcessError(

{engineering_process-1.2.4 → engineering_process-1.2.6/engineering_process.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 1.2.4
+Version: 1.2.6
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -441,6 +441,14 @@ At any point:
 
 ## Release to consumer PR
 
+This producer's release identity inputs and text assets declared by
+`tool.setuptools.data-files` use UTF-8 without BOM and LF, matching `.gitattributes`.
+Writers select that representation explicitly; JSON writers use
+`write_json_atomic`. Existing distribution verification checks the declared text
+bytes before building. It rejects CRLF, mixed endings, BOM and invalid UTF-8 even
+when text-mode reads or Git conversion would hide the difference. Binary data and
+fixtures outside that text inventory retain their own format contracts.
+
 Every opted-in consumer uses Renovate's pip-compile manager. Its engineering-process
 package rule keeps the adoption pull request in draft and runs exactly:
 
@@ -463,6 +471,39 @@ authorizes that merge.
 This repository opts in through .github/renovate.json, so it receives the same
 adoption PR as every other consumer. See SELF_HOSTING.md and RELEASING.md.
 
+The optional [Renovate preset](templates/renovate.json) is generated from the
+canonical public template. It supplies only `prHeader` and `prBodyTemplate`;
+dependency selection, supported platforms, schedules, major-update approval,
+commands, draft policy, and merge authority remain consumer-owned. Regenerate it
+with `python verification/generate_renovate_preset.py`; `--check` rejects drift.
+
+Consumers add `github>phuongnse/engineering-process//templates/renovate#COMMIT_SHA`
+to their existing `extends` array, replacing `COMMIT_SHA` with the full source
+commit of a verified release that contains the preset. Remove obsolete inline
+`prHeader` and `prBodyTemplate` overrides, including matching package-rule overrides.
+The preset targets the canonical draft grammar used by 1.2.4 and this distribution;
+it does not claim compatibility with earlier publication contracts. A future
+grammar change must preserve this adapter or ship an explicit consumer migration.
+
+Renovate resolves presets from the protected base configuration before dependency
+updates and post-upgrade tasks. Bootstrap the compatible preset in that base before
+relying on its generated drafts; changing the candidate configuration alone cannot
+repair the same run's body. Verify the native rendered body against both the base
+and candidate process authority during adoption. Pending fields and unchecked
+Completion gate items are proposals, never evidence or approval.
+
+Before collecting lifecycle evidence for a bot PR, apply its configured
+`stopUpdatingLabel` (Renovate's default is `stop-updating`) and confirm the head is
+unchanged after any in-flight bot run finishes. Keep the label through verification,
+independent review, receipt and the consumer-owned merge. Do not request a native
+rebase or dashboard retry while reviewing: an explicit retry can resume updates.
+If the candidate changes, open a new implementation cycle and collect fresh
+evidence. Remove the pause label only when returning the PR to automation.
+
+These are native [shared preset](https://docs.renovatebot.com/config-presets/) and
+[review pause](https://docs.renovatebot.com/configuration-options/#stopupdatinglabel)
+boundaries; the control plane does not become a second PR publisher.
+
 ## Compatibility
 
 Version 1.x retains a few small pre-1.0 command shapes so existing consumers can

{engineering_process-1.2.4 → engineering_process-1.2.6}/engineering_process.egg-info/SOURCES.txt

@@ -57,6 +57,7 @@ templates/AGENTS.process.md
 templates/PULL_REQUEST_TEMPLATE.md
 templates/adopt-process-windows-job.py
 templates/adopt-process.py
+templates/renovate.json
 tests/test_adoption.py
 tests/test_architecture.py
 tests/test_automation.py

{engineering_process-1.2.4 → engineering_process-1.2.6}/process_assets/skills/production-engineering/SKILL.md

@@ -29,6 +29,11 @@ Verification proves only the deterministic properties exercised by its exact
 commands on the unchanged candidate. It must not claim to infer architecture,
 security, intent, or arbitrary prose semantics that those commands do not observe.
 
+When an artifact claim depends on byte identity, make encoding and newline rules
+explicit at its writer and compare bytes at the exported or installed boundary.
+Text-mode newline normalization and a clean Git diff cannot supply that proof;
+follow the artifact owner's format rather than imposing one text policy on consumers.
+
 Independent review reassesses every invariant against the contract, plan, complete
 diff, profile evidence, and readiness result. Mark it `satisfied`, `not-applicable`,
 or `violated`, give a concrete rationale, and cite evidence for `satisfied`. A

{engineering_process-1.2.4 → engineering_process-1.2.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-process"
-version = "1.2.4"
+version = "1.2.6"
 description = "A small agent-neutral engineering lifecycle with managed adoption"
 readme = "README.md"
 license = "MIT"
@@ -42,6 +42,7 @@ dev = {file = ["engineering_process/requirements-dev.txt"]}
 "share/engineering-process/templates" = [
   "templates/AGENTS.process.md",
   "templates/PULL_REQUEST_TEMPLATE.md",
+  "templates/renovate.json",
   "templates/adopt-process.py",
   "templates/adopt-process-windows-job.py",
 ]

engineering_process-1.2.6/templates/renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "description": "Pending process draft; generated from templates/PULL_REQUEST_TEMPLATE.md.",
+  "prBodyTemplate": "{{{header}}}",
+  "prHeader": "## Summary\n\n- Outcome: Update {{#each upgrades}}{{depName}} from {{currentValue}}{{#if currentDigest}} ({{currentDigest}}){{/if}} to {{newValue}}{{#if newDigest}} ({{newDigest}}){{/if}}{{#unless @last}}; {{/unless}}{{/each}}.\n- Scope: {{#each upgrades}}{{packageFile}}{{#unless @last}}; {{/unless}}{{/each}}.\n\n## Contract and risk\n\n- Source: pending\n- Risk: pending\n- Compatibility: pending\n- Stack: pending\n\n## Verification\n\n- Profiles: pending\n- Snapshot: pending\n- Completion receipt: pending\n\n## Independent review\n\n- Verdict: pending\n- Cycles: pending\n- Blocking findings: pending\n- Non-blocking dispositions: pending\n\n## Completion gate\n\n- [ ] Accepted scope is implemented without silent expansion.\n- [ ] Required profiles pass on the reviewed snapshot.\n- [ ] Independent review approved with no blocking finding.\n- [ ] Every non-blocking finding has a recorded disposition.\n"
+}

{engineering_process-1.2.4 → engineering_process-1.2.6}/tests/test_automation.py

@@ -3,9 +3,14 @@ from __future__ import annotations
 import json
 from pathlib import Path
 import re
+import tempfile
 import unittest
+from unittest.mock import patch
 
-from engineering_process.publication_compat import validate_pull_request
+from engineering_process.contracts import ProcessError
+from engineering_process.publication_compat import _pull_request_body_issues, validate_pull_request
+from verification.generate_renovate_preset import generate_preset
+from verification import generate_renovate_preset
 
 
 ROOT = Path(__file__).resolve().parent.parent
@@ -15,6 +20,45 @@ ACTIVE_PROCESS_PIN = re.compile(
 
 
 class AutomationTests(unittest.TestCase):
+    def test_renovate_preset_matches_the_canonical_pending_template(self) -> None:
+        template = (ROOT / "templates" / "PULL_REQUEST_TEMPLATE.md").read_text(encoding="utf-8")
+        preset = json.loads((ROOT / "templates" / "renovate.json").read_text(encoding="utf-8"))
+        self.assertEqual(generate_preset(template), preset)
+        self.assertEqual([], _pull_request_body_issues(preset["prHeader"], "draft"))
+        self.assertTrue(_pull_request_body_issues(preset["prHeader"], "ready"))
+
+    def test_renovate_preset_rejects_an_incomplete_public_contract(self) -> None:
+        template = (ROOT / "templates" / "PULL_REQUEST_TEMPLATE.md").read_text(encoding="utf-8")
+        with self.assertRaises(ProcessError):
+            generate_preset(template.replace("## Completion gate", "## Other"))
+
+    def test_renovate_generator_rejects_changed_bytes_and_recovers(self) -> None:
+        template = (ROOT / "templates" / "PULL_REQUEST_TEMPLATE.md").read_bytes()
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "templates").mkdir()
+            (root / "templates" / "PULL_REQUEST_TEMPLATE.md").write_bytes(template)
+            target = root / "templates" / "renovate.json"
+            with patch.object(generate_renovate_preset, "PROJECT_ROOT", root), patch("sys.argv", ["generate"]):
+                self.assertEqual(0, generate_renovate_preset.main())
+                expected = target.read_bytes()
+                self.assertNotIn(b"\r", expected)
+                self.assertFalse(expected.startswith(b"\xef\xbb\xbf"))
+                for changed in (
+                    expected.replace(b"\n", b"\r\n"),
+                    expected.replace(b"\n", b"\r\n", 1),
+                    b"\xef\xbb\xbf" + expected,
+                ):
+                    with self.subTest(changed=changed[:20]):
+                        target.write_bytes(changed)
+                        with patch("sys.argv", ["generate", "--check"]):
+                            with self.assertRaisesRegex(ProcessError, "is stale"):
+                                generate_renovate_preset.main()
+                        self.assertEqual(0, generate_renovate_preset.main())
+                        self.assertEqual(expected, target.read_bytes())
+                with patch("sys.argv", ["generate", "--check"]):
+                    self.assertEqual(0, generate_renovate_preset.main())
+
     def test_pull_request_template_defines_public_evidence_hierarchy(self) -> None:
         template = (ROOT / "templates" / "PULL_REQUEST_TEMPLATE.md").read_text(
             encoding="utf-8"

{engineering_process-1.2.4 → engineering_process-1.2.6}/tests/test_contracts.py

@@ -2,11 +2,18 @@ from __future__ import annotations
 
 from copy import deepcopy
 from pathlib import Path
+import tempfile
 import unittest
 
 from jsonschema import Draft202012Validator
 
-from engineering_process.contracts import ProcessError, read_json, validate_document
+from engineering_process.contracts import (
+    ProcessError,
+    formatted_json_bytes,
+    read_json,
+    validate_document,
+    write_json_atomic,
+)
 from engineering_process.distribution import schemas_root
 from engineering_process.project import (
     load_project,
@@ -21,6 +28,16 @@ SCHEMAS = schemas_root(ROOT)
 
 
 class ContractTests(unittest.TestCase):
+    def test_json_documents_have_one_utf8_lf_representation(self) -> None:
+        document = {"z": "\u0111", "a": 1}
+        expected = b'{\n  "a": 1,\n  "z": "\xc4\x91"\n}\n'
+        self.assertEqual(expected, formatted_json_bytes(document))
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory) / "document.json"
+            write_json_atomic(target, document)
+            self.assertEqual(expected, target.read_bytes())
+            self.assertEqual(document, read_json(target))
+
     def test_every_schema_is_valid_and_is_used(self) -> None:
         expected = {
             "change",

{engineering_process-1.2.4 → engineering_process-1.2.6}/tests/test_lifecycle.py

@@ -599,6 +599,43 @@ class LifecycleTests(unittest.TestCase):
         self.assertEqual("implementing", state["phase"])
         self.assertEqual({}, state["verification"])
 
+    def test_resolved_invariant_finishes_with_its_identity_and_history_preserved(self) -> None:
+        self.begin()
+        self.verify_all()
+        start_review(self.root, PROCESS_ROOT, "sample-change", actor_id="reviewer", context_id="review-context", kind="agent")
+        first = self.review_document("changes-requested")
+        first["findings"][0]["priority"] = "P2"
+        first_path = self.root / ".process" / "runs" / "first-review.json"
+        write_json(first_path, first)
+        state = submit_review(self.root, PROCESS_ROOT, "sample-change", first_path)
+        self.assertEqual("changes-requested", state["phase"])
+
+        begin_implementation(self.root, PROCESS_ROOT, "sample-change", actor_id="implementer", context_id="implementation-context-2", kind="agent")
+        (self.root / "product.txt").write_text("corrected\n", encoding="utf-8")
+        self.verify_all()
+        start_review(self.root, PROCESS_ROOT, "sample-change", actor_id="reviewer", context_id="review-context", kind="agent")
+        approved = self.review_document("approved")
+        carried = deepcopy(first["findings"][0])
+        carried["severity"] = "non-blocking"
+        carried["disposition"] = {"status": "resolved", "rationale": "The corrected candidate satisfies the invariant with fresh verification."}
+        approved["findings"] = [carried]
+        second_path = self.root / ".process" / "runs" / "second-review.json"
+        for field, changed in (("priority", "P3"), ("origin", "contract")):
+            invalid = deepcopy(approved)
+            invalid["findings"][0][field] = changed
+            write_json(second_path, invalid)
+            with self.subTest(field=field), self.assertRaisesRegex(ProcessError, "identity fields are immutable"):
+                submit_review(self.root, PROCESS_ROOT, "sample-change", second_path)
+        write_json(second_path, approved)
+        state = submit_review(self.root, PROCESS_ROOT, "sample-change", second_path)
+        self.assertEqual("approved", state["phase"])
+        self.assertEqual(first, state["reviewHistory"][0]["document"])
+        self.assertEqual(approved, state["reviewHistory"][1]["document"])
+        state, receipt = finish_change(self.root, PROCESS_ROOT, "sample-change", actor_id="coordinator", context_id="finish-context", kind="agent")
+        self.assertEqual("completed", state["phase"])
+        self.assertEqual(2, state["cycle"])
+        self.assertEqual("approved", receipt["review"]["verdict"])
+
     def test_correction_review_requires_the_original_reviewer_identity(self) -> None:
         self.begin()
         self.verify_all()

{engineering_process-1.2.4 → engineering_process-1.2.6}/tests/test_production_engineering.py

@@ -190,6 +190,31 @@ class ProductionEngineeringTests(unittest.TestCase):
         with self.assertRaisesRegex(ProcessError, "blocking finding"):
             validate_review_assessments(violation, ROOT)
 
+    def test_resolved_invariant_findings_do_not_require_a_current_violation(self) -> None:
+        review = deepcopy(self.review)
+        review["findings"] = [{
+            "id": "resolved-invariant",
+            "severity": "non-blocking",
+            "priority": "P2",
+            "criterionId": "works",
+            "origin": "production-invariant",
+            "summary": "The previous invariant violation is resolved on this snapshot.",
+            "disposition": {"status": "resolved", "rationale": "The corrected structure and current evidence satisfy the invariant."},
+        }]
+        validate_document(review, "review", schema_root=SCHEMAS)
+        validate_review_assessments(review, ROOT)
+        for status in ("accepted-risk", "tracked-follow-up"):
+            with self.subTest(status=status):
+                review["findings"][0]["disposition"] = {
+                    "status": status,
+                    "rationale": "The invariant violation remains open.",
+                    "owner": "consumer-owner",
+                    "recordUrl": "https://example.invalid/issues/1",
+                }
+                validate_document(review, "review", schema_root=SCHEMAS)
+                with self.assertRaisesRegex(ProcessError, "must be linked"):
+                    validate_review_assessments(review, ROOT)
+
     def test_review_cannot_approve_a_violation_or_leave_invariant_finding_unlinked(self) -> None:
         violation = deepcopy(self.review)
         assessment = violation["productionEngineering"][0]

{engineering_process-1.2.4 → engineering_process-1.2.6}/tests/test_release.py

@@ -12,12 +12,54 @@ import unittest
 from engineering_process.contracts import ProcessError, read_json, write_json_atomic
 from engineering_process.release import derive_next_version, validate_release
 from verification.normalize_sdist import normalize
+from verification.prepare_release import _replace_once
+from verification.verify_distribution import validate_distribution_text
 
 
 ROOT = Path(__file__).resolve().parent.parent
 
 
 class ReleaseTests(unittest.TestCase):
+    def test_release_replacement_writes_explicit_lf_on_every_host(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory) / "version.txt"
+            for source in (b"version=old\nnext\n", b"version=old\r\nnext\r\n", b"version=old\r\nnext\n"):
+                with self.subTest(source=source):
+                    target.write_bytes(source)
+                    _replace_once(target, "old", "new")
+                    self.assertEqual(b"version=new\nnext\n", target.read_bytes())
+
+    def test_release_replacement_rejects_bom_before_writing(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            target = Path(directory) / "version.txt"
+            original = b'\xef\xbb\xbfVERSION = "old"\r\n'
+            target.write_bytes(original)
+            with self.assertRaisesRegex(ProcessError, "UTF-8 without BOM"):
+                _replace_once(target, "old", "new")
+            self.assertEqual(original, target.read_bytes())
+            self.assertFalse(target.with_name(f".{target.name}.release.tmp").exists())
+
+    def test_distribution_text_uses_the_declared_inventory_and_rejects_byte_drift(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "engineering_process").mkdir()
+            (root / "assets").mkdir()
+            (root / "pyproject.toml").write_bytes(b'[tool.setuptools.data-files]\n"share/process" = ["assets/newly-declared.fragment"]\n')
+            (root / "release.json").write_bytes(b"{}\n")
+            (root / "engineering_process" / "__init__.py").write_bytes(b'VERSION = "1.0.0"\n')
+            (root / "opaque.bin").write_bytes(b"\x00\xff\r\n")
+            target = root / "assets" / "newly-declared.fragment"
+            valid = b"first\nsecond\n"
+            target.write_bytes(valid)
+            validate_distribution_text(root)
+            for invalid in (b"first\r\nsecond\r\n", b"first\r\nsecond\n", b"\xef\xbb\xbf" + valid, b"\xff\n"):
+                with self.subTest(invalid=invalid):
+                    target.write_bytes(invalid)
+                    with self.assertRaisesRegex(RuntimeError, "UTF-8 without BOM and use LF"):
+                        validate_distribution_text(root)
+                    target.write_bytes(valid)
+                    validate_distribution_text(root)
+
     def test_current_release_identity_is_consistent(self) -> None:
         release = read_json(ROOT / "release.json")
         result = validate_release(ROOT, ROOT, tag=f"v{release['version']}")
@@ -90,6 +132,7 @@ class ReleaseTests(unittest.TestCase):
             self.assertIn(
                 f'version = "{expected}"', (target / "pyproject.toml").read_text()
             )
+            validate_distribution_text(target)
 
     def test_invalid_change_type_fails(self) -> None:
         with self.assertRaises(ProcessError):