engineering-process 2.0.0__tar.gz → 2.0.2__tar.gz

{engineering_process-2.0.0/engineering_process.egg-info → engineering_process-2.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 2.0.0
+Version: 2.0.2
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -114,6 +114,20 @@ Commands are argument arrays, never shell strings. Each command has a finite tim
 Output has a hard aggregate budget; evidence stores byte counts and hashes, never raw
 stdout or stderr that could contain secrets.
 
+A failed profile also reports a safe `diagnostic` descriptor containing only its
+validated profile identifier, check identifier, canonical one-based profile position,
+and a fixed `processctl` argument array. The position remains unambiguous even when a
+compatible project has duplicate check identifiers. Run that array from the project
+root to reproduce only the failed configured check through the same bounded runner,
+for example:
+
+    processctl verify --profile rust --check-position 3
+
+This selective run is diagnostic only: it does not expose captured output, replace a
+required full-profile run, or count as lifecycle verification evidence. Maintainers
+who need semantic tool output must use a tool-owned structured report or run the
+consumer command in an appropriately trusted environment.
+
 ### Production readiness
 
 A consumer declares `.process/readiness.json` with production as its direction, its

{engineering_process-2.0.0 → engineering_process-2.0.2}/README.md

@@ -90,6 +90,20 @@ Commands are argument arrays, never shell strings. Each command has a finite tim
 Output has a hard aggregate budget; evidence stores byte counts and hashes, never raw
 stdout or stderr that could contain secrets.
 
+A failed profile also reports a safe `diagnostic` descriptor containing only its
+validated profile identifier, check identifier, canonical one-based profile position,
+and a fixed `processctl` argument array. The position remains unambiguous even when a
+compatible project has duplicate check identifiers. Run that array from the project
+root to reproduce only the failed configured check through the same bounded runner,
+for example:
+
+    processctl verify --profile rust --check-position 3
+
+This selective run is diagnostic only: it does not expose captured output, replace a
+required full-profile run, or count as lifecycle verification evidence. Maintainers
+who need semantic tool output must use a tool-owned structured report or run the
+consumer command in an appropriately trusted environment.
+
 ### Production readiness
 
 A consumer declares `.process/readiness.json` with production as its direction, its

{engineering_process-2.0.0 → engineering_process-2.0.2}/engineering_process/__init__.py

@@ -1,3 +1,3 @@
 """Agent-neutral engineering process."""
 
-VERSION = "2.0.0"
+VERSION = "2.0.2"

{engineering_process-2.0.0 → engineering_process-2.0.2}/engineering_process/cli.py

@@ -61,6 +61,16 @@ def _root(value: str) -> Path:
     return path
 
 
+def _check_position(value: str) -> int:
+    try:
+        position = int(value)
+    except ValueError as error:
+        raise argparse.ArgumentTypeError("check position must be an integer") from error
+    if position < 1 or position > 32:
+        raise argparse.ArgumentTypeError("check position must be between 1 and 32")
+    return position
+
+
 def _process_root(args: argparse.Namespace) -> Path:
     return distribution_root(args.process_root)
 
@@ -209,7 +219,12 @@ def command_verify(args: argparse.Namespace) -> Result:
     process_root = _process_root(args)
     project = load_project(args.project_root, process_root)
     before = repository_snapshot(args.project_root)
-    report = run_profile(args.project_root, project, args.profile)
+    report = run_profile(
+        args.project_root,
+        project,
+        args.profile,
+        check_position=args.check_position,
+    )
     after = repository_snapshot(args.project_root)
     if not same_checkpoint(before, after):
         report["status"] = "failed"
@@ -433,6 +448,7 @@ def build_parser() -> argparse.ArgumentParser:
     setup.add_argument("--allow", action="append", default=[])
     verify = _leaf(commands, "verify", command_verify, help="Run a project verification profile")
     verify.add_argument("--profile", required=True)
+    verify.add_argument("--check-position", type=_check_position)
     adoption = commands.add_parser("adoption", help="Apply or check managed adoption")
     adoption_commands = adoption.add_subparsers(dest="adoption_command", required=True)
     for name, handler in (("apply", command_adoption_apply), ("check", command_adoption_check)):

{engineering_process-2.0.0 → engineering_process-2.0.2}/engineering_process/commands.py

@@ -199,20 +199,61 @@ def run_profile(
     project_root: Path,
     project: dict[str, Any],
     profile: str,
+    *,
+    check_position: int | None = None,
 ) -> dict[str, Any]:
-    checks = project["profiles"].get(profile)
-    if checks is None:
+    configured_checks = project["profiles"].get(profile)
+    if configured_checks is None:
         raise ProcessError(f"unknown verification profile: {profile}")
+    if check_position is None:
+        checks = configured_checks
+        positions = range(1, len(checks) + 1)
+    else:
+        if check_position < 1 or check_position > len(configured_checks):
+            raise ProcessError(
+                f"profile {profile} has no check at position: {check_position}"
+            )
+        checks = [configured_checks[check_position - 1]]
+        positions = [check_position]
     reports: list[dict[str, Any]] = []
-    for check in checks:
+    failed_position: int | None = None
+    for position, check in zip(positions, checks, strict=True):
         report = run_check(project_root, check)
         reports.append(report)
         if report["status"] != "passed":
+            failed_position = position
             break
-    return {
+    result = {
         "profile": profile,
         "status": "passed" if len(reports) == len(checks) and all(
             report["status"] == "passed" for report in reports
         ) else "failed",
+        "scope": (
+            {"kind": "profile"}
+            if check_position is None
+            else {
+                "kind": "check",
+                "check": checks[0]["id"],
+                "position": check_position,
+            }
+        ),
         "checks": reports,
     }
+    failed = next((report for report in reports if report["status"] == "failed"), None)
+    if failed is not None:
+        assert failed_position is not None
+        result["diagnostic"] = {
+            "kind": "selective-check-reproduction",
+            "profile": profile,
+            "check": failed["id"],
+            "position": failed_position,
+            "command": [
+                "processctl",
+                "verify",
+                "--profile",
+                profile,
+                "--check-position",
+                str(failed_position),
+            ],
+        }
+    return result

{engineering_process-2.0.0 → engineering_process-2.0.2/engineering_process.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: engineering-process
-Version: 2.0.0
+Version: 2.0.2
 Summary: A small agent-neutral engineering lifecycle with managed adoption
 License-Expression: MIT
 Project-URL: Homepage, https://github.com/phuongnse/engineering-process
@@ -114,6 +114,20 @@ Commands are argument arrays, never shell strings. Each command has a finite tim
 Output has a hard aggregate budget; evidence stores byte counts and hashes, never raw
 stdout or stderr that could contain secrets.
 
+A failed profile also reports a safe `diagnostic` descriptor containing only its
+validated profile identifier, check identifier, canonical one-based profile position,
+and a fixed `processctl` argument array. The position remains unambiguous even when a
+compatible project has duplicate check identifiers. Run that array from the project
+root to reproduce only the failed configured check through the same bounded runner,
+for example:
+
+    processctl verify --profile rust --check-position 3
+
+This selective run is diagnostic only: it does not expose captured output, replace a
+required full-profile run, or count as lifecycle verification evidence. Maintainers
+who need semantic tool output must use a tool-owned structured report or run the
+consumer command in an appropriately trusted environment.
+
 ### Production readiness
 
 A consumer declares `.process/readiness.json` with production as its direction, its

{engineering_process-2.0.0 → engineering_process-2.0.2}/process_assets/skills/change-verify/SKILL.md

@@ -16,6 +16,11 @@ or stream failure, failed descendant cleanup, or tracked repository mutation is
 failure and leaves the change in implementing. Successfully cleaned post-exit
 descendants remain recorded without replacing the foreground command result.
 
+A failed report may include a safe selective-reproduction argument array. It can
+confirm the isolated failure through the same bounded runner, but it remains a
+diagnostic action: never submit it in place of the required full profile, and do not
+expect it to reveal captured stdout or stderr.
+
 The contract must already include conditional profiles required by affected enforced
 capabilities. Run those profiles exactly; do not run every planned production gate for
 an unrelated change, and do not treat a passing baseline profile as evidence for a

{engineering_process-2.0.0 → engineering_process-2.0.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engineering-process"
-version = "2.0.0"
+version = "2.0.2"
 description = "A small agent-neutral engineering lifecycle with managed adoption"
 readme = "README.md"
 license = "MIT"

{engineering_process-2.0.0 → engineering_process-2.0.2}/schemas/run.schema.json

@@ -147,6 +147,51 @@
         "stderr": {"$ref": "#/$defs/stream"}
       }
     },
+    "verificationScope": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind"],
+          "properties": {"kind": {"const": "profile"}}
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "check", "position"],
+          "properties": {
+            "kind": {"const": "check"},
+            "check": {"$ref": "#/$defs/id"},
+            "position": {"type": "integer", "minimum": 1, "maximum": 32}
+          }
+        }
+      ]
+    },
+    "diagnostic": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "profile", "check", "position", "command"],
+      "properties": {
+        "kind": {"const": "selective-check-reproduction"},
+        "profile": {"$ref": "#/$defs/id"},
+        "check": {"$ref": "#/$defs/id"},
+        "position": {"type": "integer", "minimum": 1, "maximum": 32},
+        "command": {
+          "type": "array",
+          "minItems": 6,
+          "maxItems": 6,
+          "prefixItems": [
+            {"const": "processctl"},
+            {"const": "verify"},
+            {"const": "--profile"},
+            {"$ref": "#/$defs/id"},
+            {"const": "--check-position"},
+            {"type": "string", "pattern": "^(?:[1-9]|[12][0-9]|3[0-2])$"}
+          ],
+          "items": false
+        }
+      }
+    },
     "verificationReport": {
       "type": "object",
       "additionalProperties": false,
@@ -154,6 +199,8 @@
       "properties": {
         "profile": {"$ref": "#/$defs/id"},
         "status": {"enum": ["passed", "failed"]},
+        "scope": {"$ref": "#/$defs/verificationScope"},
+        "diagnostic": {"$ref": "#/$defs/diagnostic"},
         "checks": {
           "type": "array",
           "maxItems": 32,

{engineering_process-2.0.0 → engineering_process-2.0.2}/tests/test_automation.py

@@ -269,6 +269,16 @@ class AutomationTests(unittest.TestCase):
             encoding="utf-8"
         )
         self.assertTrue(workflow.startswith("name: CI\n"))
+        events = workflow.split("on:\n", maxsplit=1)[1].split(
+            "\npermissions:\n", maxsplit=1
+        )[0]
+        self.assertEqual(
+            "  pull_request:\n"
+            "    types: [opened, synchronize, reopened, ready_for_review]\n"
+            "  push:\n"
+            "    branches: [main]\n",
+            events,
+        )
         policy_job = "  policy-verification:\n" + workflow.split(
             "  policy-verification:\n", maxsplit=1
         )[1].split("\n  adopted-process:\n", maxsplit=1)[0]

{engineering_process-2.0.0 → engineering_process-2.0.2}/tests/test_cli.py

@@ -38,6 +38,13 @@ class CliTests(unittest.TestCase):
             set(subparsers.choices),
         )
 
+    def test_verify_accepts_an_explicit_diagnostic_check(self) -> None:
+        args = build_parser().parse_args(
+            ["verify", "--profile", "rust", "--check-position", "2"]
+        )
+        self.assertEqual("rust", args.profile)
+        self.assertEqual(2, args.check_position)
+
     def test_skills_validate_emits_machine_readable_result(self) -> None:
         output = io.StringIO()
         with contextlib.redirect_stdout(output):

{engineering_process-2.0.0 → engineering_process-2.0.2}/tests/test_commands.py

@@ -12,6 +12,7 @@ import unittest
 from unittest.mock import Mock, patch
 
 from engineering_process.commands import run_check, run_profile
+from engineering_process.contracts import ProcessError
 from engineering_process.supervision import CleanupOutcome
 
 
@@ -82,6 +83,127 @@ class CommandTests(unittest.TestCase):
             report = run_profile(Path(directory), project, "development")
         self.assertEqual("failed", report["status"])
         self.assertEqual(["fail"], [item["id"] for item in report["checks"]])
+        self.assertEqual({"kind": "profile"}, report["scope"])
+        self.assertEqual(
+            {
+                "kind": "selective-check-reproduction",
+                "profile": "development",
+                "check": "fail",
+                "position": 1,
+                "command": [
+                    "processctl",
+                    "verify",
+                    "--profile",
+                    "development",
+                    "--check-position",
+                    "1",
+                ],
+            },
+            report["diagnostic"],
+        )
+
+    def test_profile_failure_descriptor_excludes_child_details(self) -> None:
+        secret = "TOPSECRET-DIAGNOSTIC-VALUE"
+        project = {
+            "profiles": {
+                "rust": [
+                    {
+                        "id": "format",
+                        "run": [sys.executable, "-c", "raise SystemExit(0)"],
+                        "timeoutSeconds": 10,
+                    },
+                    {
+                        "id": "rust-tests",
+                        "run": [
+                            sys.executable,
+                            "-c",
+                            f"import sys; print({secret!r}); print({secret!r}, file=sys.stderr); raise SystemExit(101)",
+                        ],
+                        "timeoutSeconds": 10,
+                    },
+                ]
+            }
+        }
+        with tempfile.TemporaryDirectory(prefix="secret-working-directory-") as directory:
+            report = run_profile(Path(directory), project, "rust")
+        self.assertEqual(["format", "rust-tests"], [item["id"] for item in report["checks"]])
+        self.assertEqual(101, report["checks"][-1]["exitCode"])
+        self.assertEqual("rust-tests", report["diagnostic"]["check"])
+        self.assertEqual(2, report["diagnostic"]["position"])
+        rendered = repr(report)
+        self.assertNotIn(secret, rendered)
+        self.assertNotIn(sys.executable, rendered)
+        self.assertNotIn("secret-working-directory", rendered)
+
+    def test_selective_reproduction_runs_only_the_named_check(self) -> None:
+        project = {
+            "profiles": {
+                "rust": [
+                    {
+                        "id": "would-fail",
+                        "run": [sys.executable, "-c", "raise SystemExit(7)"],
+                        "timeoutSeconds": 10,
+                    },
+                    {
+                        "id": "rust-tests",
+                        "run": [sys.executable, "-c", "raise SystemExit(0)"],
+                        "timeoutSeconds": 10,
+                    },
+                ]
+            }
+        }
+        with tempfile.TemporaryDirectory() as directory:
+            report = run_profile(Path(directory), project, "rust", check_position=2)
+        self.assertEqual("passed", report["status"])
+        self.assertEqual(
+            {"kind": "check", "check": "rust-tests", "position": 2},
+            report["scope"],
+        )
+        self.assertEqual(["rust-tests"], [item["id"] for item in report["checks"]])
+        self.assertNotIn("diagnostic", report)
+
+    def test_duplicate_ids_reproduce_one_authoritative_position(self) -> None:
+        project = {
+            "profiles": {
+                "rust": [
+                    {
+                        "id": "rust-tests",
+                        "run": [sys.executable, "-c", "raise SystemExit(0)"],
+                        "timeoutSeconds": 10,
+                    },
+                    {
+                        "id": "rust-tests",
+                        "run": [sys.executable, "-c", "raise SystemExit(101)"],
+                        "timeoutSeconds": 10,
+                    }
+                ]
+            }
+        }
+        with tempfile.TemporaryDirectory() as directory:
+            report = run_profile(Path(directory), project, "rust")
+            reproduced = run_profile(
+                Path(directory), project, "rust", check_position=2
+            )
+        self.assertEqual(2, report["diagnostic"]["position"])
+        self.assertEqual(["rust-tests"], [item["id"] for item in reproduced["checks"]])
+        self.assertEqual(101, reproduced["checks"][0]["exitCode"])
+
+    def test_selective_reproduction_rejects_unknown_position(self) -> None:
+        project = {
+            "profiles": {
+                "rust": [
+                    {
+                        "id": "rust-tests",
+                        "run": [sys.executable, "-c", "raise SystemExit(0)"],
+                        "timeoutSeconds": 10,
+                    }
+                ]
+            }
+        }
+        with tempfile.TemporaryDirectory() as directory, self.assertRaisesRegex(
+            ProcessError, "profile rust has no check at position: 2"
+        ):
+            run_profile(Path(directory), project, "rust", check_position=2)
 
     def test_timeout_is_a_failure(self) -> None:
         with tempfile.TemporaryDirectory() as directory:

{engineering_process-2.0.0 → engineering_process-2.0.2}/tests/test_contracts.py

@@ -81,6 +81,62 @@ class ContractTests(unittest.TestCase):
         with self.assertRaisesRegex(ProcessError, "Additional properties"):
             validate_document(project, "project", schema_root=SCHEMAS)
 
+    def test_run_schema_accepts_legacy_and_safe_diagnostic_reports(self) -> None:
+        schema = read_json(SCHEMAS / "run.schema.json")
+        validator = Draft202012Validator(schema).evolve(
+            schema=schema["$defs"]["verificationReport"]
+        )
+        report = {
+            "profile": "rust",
+            "status": "failed",
+            "checks": [
+                {
+                    "id": "rust-tests",
+                    "status": "failed",
+                    "exitCode": 101,
+                    "timedOut": False,
+                    "outputExceeded": False,
+                    "descendantsTerminated": False,
+                    "streamFailed": False,
+                    "durationMs": 1,
+                    "stdout": {
+                        "bytes": 0,
+                        "sha256": f"sha256:{'0' * 64}",
+                        "truncated": False,
+                    },
+                    "stderr": {
+                        "bytes": 0,
+                        "sha256": f"sha256:{'0' * 64}",
+                        "truncated": False,
+                    },
+                }
+            ],
+            "checkpoint": {
+                "head": "0" * 40,
+                "fingerprint": f"sha256:{'0' * 64}",
+                "fileCount": 1,
+                "byteCount": 1,
+            },
+            "recordedAt": "2026-09-07T00:00:00+00:00",
+        }
+        validator.validate(report)
+        report["scope"] = {"kind": "profile"}
+        report["diagnostic"] = {
+            "kind": "selective-check-reproduction",
+            "profile": "rust",
+            "check": "rust-tests",
+            "position": 1,
+            "command": [
+                "processctl",
+                "verify",
+                "--profile",
+                "rust",
+                "--check-position",
+                "1",
+            ],
+        }
+        validator.validate(report)
+
     def test_review_v6_requires_durable_non_blocking_dispositions(self) -> None:
         review = {
             "schemaVersion": 6,

{engineering_process-2.0.0 → engineering_process-2.0.2}/tests/test_lifecycle.py

@@ -256,6 +256,49 @@ class LifecycleTests(unittest.TestCase):
         )
         self.assertIsNone(lifecycle_status(self.root, PROCESS_ROOT, "sample-change")["nextCommand"])
 
+    def test_failed_profile_persists_only_safe_diagnostic_metadata(self) -> None:
+        self.begin()
+        secret = "TOPSECRET-LIFECYCLE-VALUE"
+        self.project["profiles"]["development"] = [
+            {
+                "id": "format",
+                "run": [sys.executable, "-c", "raise SystemExit(0)"],
+                "timeoutSeconds": 10,
+            },
+            {
+                "id": "rust-tests",
+                "run": [
+                    sys.executable,
+                    "-c",
+                    f"import sys; print({secret!r}, file=sys.stderr); raise SystemExit(101)",
+                ],
+                "timeoutSeconds": 10,
+            },
+        ]
+        state, report = verify_change(
+            self.root, PROCESS_ROOT, self.project, "sample-change", "development"
+        )
+        self.assertEqual("implementing", state["phase"])
+        self.assertEqual({"kind": "profile"}, report["scope"])
+        self.assertEqual("rust-tests", report["diagnostic"]["check"])
+        persisted = (
+            self.root / ".process" / "runs" / "sample-change" / "run.json"
+        ).read_text(encoding="utf-8")
+        self.assertNotIn(secret, persisted)
+        self.assertNotIn(sys.executable, persisted)
+
+    def test_existing_run_without_diagnostic_fields_remains_readable(self) -> None:
+        self.begin()
+        verify_change(
+            self.root, PROCESS_ROOT, self.project, "sample-change", "development"
+        )
+        run_path = self.root / ".process" / "runs" / "sample-change" / "run.json"
+        run = json.loads(run_path.read_text(encoding="utf-8"))
+        run["verification"]["development"].pop("scope")
+        write_json(run_path, run)
+        state = lifecycle_status(self.root, PROCESS_ROOT, "sample-change")
+        self.assertEqual("implementing", state["phase"])
+
     def test_plan_registration_requires_every_canonical_invariant(self) -> None:
         start_change(
             self.root,