Implement engineering policy and assurance platform

Author: suyog19

.github/ISSUE_TEMPLATE/policy-change.yml

@@ -0,0 +1,16 @@
+name: Policy change
+description: Propose a reviewed change to engineering obligations
+body:
+  - type: textarea
+    attributes: {label: Problem and evidence}
+    validations: {required: true}
+  - type: textarea
+    attributes: {label: Proposed obligation and override semantics}
+    validations: {required: true}
+  - type: textarea
+    attributes: {label: Profiles, compatibility, and migration impact}
+    validations: {required: true}
+  - type: textarea
+    attributes: {label: Why native capabilities are insufficient}
+    validations: {required: true}
+

.github/pull_request_template.md

@@ -0,0 +1,12 @@
+## Intent and acceptance
+
+## Policy/profile/schema impact
+
+## Compatibility and upgrade impact
+
+## Native capability considered
+
+## Validation evidence
+
+## Complexity / deferred alternatives
+

.github/workflows/ci.yml

@@ -0,0 +1,16 @@
+name: CI
+on: [pull_request, push]
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: {python-version: "3.12"}
+      - run: python -m pip install '.[dev]' build
+      - run: pytest
+      - run: python tests/verify.py
+      - run: python -m build
+

.gitignore

@@ -0,0 +1,12 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.coverage
+htmlcov/
+.venv/
+dist/
+build/
+*.egg-info/
+.engineering/evidence/
+.engineering/effective-obligations.json
+upload/

.initial

@@ -0,0 +1,4 @@
+# Contributing
+
+Open an issue before implementation. Keep policy technology-neutral and encode obligations rather than generic engineering advice. Add tests for inheritance, classification, evidence, adapters, and migration impact. Run `pytest`, build/install the wheel, and exercise the CLI outside the checkout. Pull requests must explain why new machinery is necessary and identify native alternatives considered.
+

CONTRIBUTING.md

@@ -0,0 +1,4 @@
+# Governance
+
+Policy changes require an issue, rationale, blast-radius and compatibility analysis, affected profiles, schema/migration notes, and tests against representative repositories. Changes to locked controls require explicit maintainer review and may not be bundled with unrelated work. Releases use semantic versions and immutable Git revisions. Security-sensitive reports should not be filed publicly; contact the repository owner privately.
+

GOVERNANCE.md

@@ -0,0 +1,14 @@
+Copyright 2026 Suyog Joshi
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+

LICENSE

@@ -0,0 +1,5 @@
+recursive-include policy *.yaml
+recursive-include schemas *.json
+recursive-include skills SKILL.md *.md
+recursive-include templates *.yml
+recursive-include docs *.md

MANIFEST.in

@@ -0,0 +1,82 @@
+# Software Engineering Process
+
+A technology-neutral Software Engineering Policy and Assurance platform. It resolves **what must be true** for a change and delegates **how** to coding assistants, humans, CI, GitHub, and other native mechanisms.
+
+```text
+Canonical Policy → Domain Profile → Repository Manifest → Trusted Classification
+→ Effective Obligation Set → Skills / Native Controls / Human Boundaries
+→ Execution → Exact-Revision Evidence → Readiness → Merge / Deployment
+```
+
+This is not a coding-agent orchestrator. It is a small policy compiler, evidence join, and set of portable specialist procedures.
+
+## Install
+
+```bash
+python -m pip install .
+engineering-process --help
+```
+
+Python 3.11+ is supported. The wheel includes the policy, schemas, templates, and Skills, so commands work outside this checkout.
+
+## Adopt in a repository
+
+From this process checkout (so the exact Git revision can be pinned):
+
+```bash
+engineering-process --root ../my-web-app init \
+  --profile frontend --repository-name suyog19/my-web-app
+```
+
+Or supply an immutable released revision explicitly with `--revision <40-hex-sha>`. Initialization creates the manifest and lock, compact `AGENTS.md`/`CLAUDE.md`, portable Skills, and a validation workflow. Add repository differences—validation commands, protected path hints, UX triggers—to `.engineering/process.yaml`, then re-render/re-lock using a reviewed process upgrade.
+
+## Change flow
+
+```bash
+engineering-process classify \
+  --sha "$GITHUB_SHA" \
+  --path src/payments/refund.py \
+  --declared '{"observable_behavior":true}'
+
+engineering-process evaluate \
+  --sha "$GITHUB_SHA" \
+  --path src/payments/refund.py \
+  --declared '{"observable_behavior":true}'
+
+engineering-process explain \
+  --sha "$GITHUB_SHA" \
+  --path src/payments/refund.py \
+  --declared '{"observable_behavior":true}'
+
+engineering-process attest --predicate test-result/v1 \
+  --sha "$GITHUB_SHA" --capability ci-automation --verdict pass \
+  --identity github-actions --context-id "$GITHUB_RUN_ID" \
+  --output .engineering/evidence/test.json
+
+engineering-process readiness --sha "$GITHUB_SHA"
+engineering-process validate
+engineering-process metrics --obligations .engineering/effective-obligations.json
+```
+
+`classify` is monotonic: declarations may strengthen routing but may not defeat deterministic Protected signals. Unknown Protected characteristics fail closed. `readiness` rejects malformed, failed, contradictory, wrong-SHA, wrong-process-revision, and invalid fresh-context review evidence.
+
+## Policy model
+
+- **Locked** controls cannot be changed locally (fresh-context independent review, fail-closed Protected routing, exact-revision evidence, secrets, traceability, human production boundary).
+- **Extensible** controls can only be strengthened.
+- **Overridable** mechanics belong to repositories (commands, paths, runtime, framework, environments).
+- Profiles describe engineering/risk domains (`generic`, `frontend`, `backend`), never languages or frameworks.
+- Specialist procedures are portable `SKILL.md` packages and are selected only when obligations require them.
+- Solution Sufficiency classifies feedback as must-address, worth-now, defer, or reject. It cannot suppress mandatory findings and provides an explicit stopping rule.
+
+See [Architecture](docs/architecture.md), [Adoption](docs/adoption.md), [GitHub enforcement](enforcement/github/README.md), [governance](GOVERNANCE.md), and the [authoritative design](docs/design/common-software-engineering-process-design-v4.md).
+
+## Development
+
+```bash
+python -m pip install -e '.[dev]'
+pytest
+python -m build
+```
+
+Policy changes require tests, compatibility/upgrade notes, and stronger review for locked controls. Apache-2.0 licensed.