REQ 003

REQ-003: Consumers bump pins deliberately, never auto

Requirement

Downstream repositories consuming this engine shall bump their pinned tag/commit SHA only as a deliberate, reviewed code change -- never automatically, and never by tracking a floating branch or latest.

Rationale

Matches README.md's documented "Upgrade path"; avoids unreviewed behavior changes reaching a consumer silently.

Fit Criterion

README's Consumption model section explicitly states this; no workflow in this engine auto-bumps a consumer's pin.

Verification

Manual code review; documented in README.md's "Consumption model" section. Scope caveat: this requirement describes this engine's own guarantee (it never auto-bumps anyone) and cannot itself enforce or verify what a given consumer actually does with that guarantee (ISO/IEC/IEEE 29148 S5.2.5 Appropriate/Verifiable) -- e.g. the real SandboxSBOMReporting consumer pins one of its two PROJECTBUDDY_*_REF variables to an untagged commit SHA (labeled by a descriptive comment) rather than a release tag, which is still a deliberate, reviewed pin (satisfying this requirement's actual wording) but not the tagged-release pin a reader might assume "Upgrade path" implies.

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-003

TestArtifact

Manual code review (no automated check yet)

CodeRef

README.md "Upgrade path" bullet

Status

Verified (manual)