EngineeringSpec 0.1.0-rc.17

[0.1.0-rc.17] - 2026-08-29

Prepared release candidate; it is not published until separate publication authority is reviewed and approved for the exact release-source SHA.

Changed

• next and work default JSON now project compact permission tickets; --verbose restores their previous full reports and exit behavior.
• next exposes the existing current-change classification separately from permission, names approved and draft/proposed IDs, and gives executable directory explain commands for routing blockers.
• work retains base identity, policy-bearing writable/protected paths, constraints, technical contracts, verifier identities, and stop conditions without predicting a lane or finish mode.
• RFC 0012 and shared agent guidance document the compact authority envelope, the --verbose compatibility path, executable blocker recovery, and the authorized all-specification governance case.

Security

• Compact tickets remain projections of existing trusted-base decisions. finish, routing decisions, specification-runner inertness, and authorization semantics are unchanged.
• The stale-proposal governance regression preserves the separation between trusted implementation permission and current-diff classification.

EngineeringSpec 0.1.0-rc.16

Added

• Explicit replay simulations for historical review and finish readiness using one immutable Git snapshot for configuration, EngineeringSpecs, ProductSpecs, and repository-local references.
• Optional exact-path engineering-authority-controls for independently approved, subtractive maintenance sequencing.
• Deterministic ceremony benchmark scenarios A–G and machine-readable historical replay and ceremony schemas.

Changed

• Routing, review, preparation, catalogue, status, and authority-diff reports expose stable sequencing identities and outcomes without executable runner payloads.
• next reports deterministic remediation recommendations for work, approval, ambiguity resolution, historical replay, and finish.

Security

• Historical replay always reports historical_read_only and currentAuthorityGranted: false; it cannot write, transition lifecycle state, inspect mutable Git state, or execute runners or trusted verifiers.
• Maintenance sequencing can only subtract a pinned positive claim on an exact path also writable by the trusted controller. Denials and remaining ambiguity continue to fail closed.
• Workspace-only, stale, broad, duplicated, chained, cyclic, competing, and self-authorizing controls have no authority effect and fail closed.

v0.1.0-rc.15

Fixed

• finish --write-closure now accepts base-approved EngineeringSpecs containing repository-local ProductSpec references while preserving strict structural, semantic, lifecycle, routing, and exact-close validation.

Security

• Trusted-base EngineeringSpec Git blobs used by review and finish no longer resolve local ProductSpec references against mutable workspace or head content. Workspace ProductSpec changes cannot authorize or alter base authority or its semantic digest.
• Ordinary explicit-root ProductSpec validation remains enabled and unchanged. RC15 introduces no EngineeringSpec contract-format or schema change.

EngineeringSpec v0.1.0-rc.14

EngineeringSpec RC14 introduces a lower-ceremony workflow for AI-assisted coding while preserving trusted-base authorization.

Highlights

• next -> work -> finish is the normal agent workflow.
• Reviewed authority must merge into the trusted base before implementation begins.
• An implementation PR may include the exact approved -> implemented monotonic close of the contract it spends.
• Repository-wide routing remains fail-closed for uncovered, ambiguous, denied, unsafe mixed-close, and unrelated-close changes.
• Generated GitHub Actions enforcement pins immutable runtime anchor 1b9fe313353584862456d607c495f4e660e3fdf3.
• EngineeringSpec remains agent-neutral across Codex, Claude Code, Cursor, GitHub Copilot, and generic coding agents.
• Specification-declared runners remain inert and are never executed merely because they appear in a contract.
• Lower-level deterministic commands remain available for CI, advanced integrations, and debugging.

Install

npm install --save-dev @engineeringspec/cli@0.1.0-rc.14

For production GitHub Actions enforcement, prefer the immutable anchor:

uses: majilesh/engineeringspec@1b9fe313353584862456d607c495f4e660e3fdf3

This is a prerelease. Downstream consumers are not updated automatically.

EngineeringSpec v0.1.0-rc.13 — Post-rewrite recovery release

EngineeringSpec RC13 restores a clean, supported release path after the repository history maintenance and withdrawal of npm RC9–RC12.

Highlights

Repository-relative ProductSpec resolution

Local ProductSpec references now resolve from the repository root rather than the directory containing the EngineeringSpec.

- id: SRC-1
  type: productspec
  path: docs/product/product-spec.md

EngineeringSpec v0.1.0-rc.12 — Routing-derived evidence

EngineeringSpec v0.1.0-rc.12

RC12 makes EngineeringSpec’s evidence layer use the same immutable, repository-wide routing decision as enforcement.

What’s new

• Added deterministic concrete-paths-v2 measurement receipts
• Added canonical candidate-set, routing-decision and path-set digests
• Measurement now loads every approved contract from the immutable base
• Requested contracts are projections over repository routing, not separate authority
• Corrected finite authority calculations, including unexercised exact create paths
• Retains paths selected for other contracts, denied, ambiguous or uncovered
• Added stronger paired-run provenance for prompts, revisions, agents, harnesses, timestamps and review blinding
• Added scope-measurement schema 0.2
• Preserved schema 0.1, v1 receipts and sparse historical benchmark records

Evidence integrity

Complete negative routing outcomes remain publishable observations when otherwise valid. They are not removed from the sample.

When a run has open authority or negative routing outcomes, single-contract scope precision is reported as unavailable instead of producing a misleading number.

Manual and v1 scope evidence remains readable and summarizable, but does not qualify as RC12 publishable quantitative scope evidence.

Trust boundaries

• Authority is loaded only from immutable base Git state
• Candidate loading is bounded at 10,000 documents
• Strict validation warnings and duplicate approved IDs fail closed
• Dirty workspace state is excluded from measurement
• Specification runners remain inert
• Receipt paths remain private unless explicitly requested
• Receipts grant no authority and prove neither correctness nor trusted-check execution
• EngineeringSpec format 0.1 and existing enforcement semantics are unchanged

Verification

• 216 tests passed
• 59 conformance tests passed
• 94.82% coverage
• Clean package installation passed
• Installed-package v2 measurement passed
• Deterministic site regeneration passed
• Strict EngineeringSpec release check passed with zero violations

Upgrade

npx --yes @engineeringspec/cli@0.1.0-rc.12 doctor . \
  --spec-dir docs/engineering-specs \
  --base origin/main \
  --strict

EngineeringSpec v0.1.0-rc.11 — Evidence integrity

EngineeringSpec v0.1.0-rc.11

RC11 strengthens the evidence layer before the external paired pilot while preserving EngineeringSpec’s approved-base change-control boundary.

Added

• Deterministic engineeringspec measure receipts derived from committed base and head revisions
• Exact approved-contract selection from immutable base authority
• Privacy-preserving path-set digests with individual paths omitted by default
• Benchmark evidence-quality and publishability reporting
• benchmark --require-publishable
• Paired time-limit, opaque reviewer and condition-order metadata
• Finite, open-create-namespace and repository-wide authority classification
• Embedded measurement-receipt consistency checks

Changed

• ESG006 is now informational
• Strict mode accepts interface_only path authorization while continuing to disclose that semantic API, ABI, AST or schema verification is separate
• Current agent guidance, documentation, generated site and adoption scaffolding use RC11 identities
• EngineeringSpec is positioned as the open change-control layer for AI coding agents, powered by an agent-neutral contract format

Security and trust boundaries

• Measurement loads authority only from immutable Git state
• Dirty workspace state is excluded
• Renames expand to their old and new paths
• Existing change policies and deny-overrides are reused
• Receipts execute no declared runners or trusted checks
• Receipts grant no authorization and do not prove correctness
• Impossible and contradictory scope counts fail closed
• prepare and review remove the complete Unicode Bidi_Control set and safely render arbitrary inline-code backtick runs

Evidence limitations

Publishability means the retained evidence satisfies the declared completeness policy. It does not establish causality, correctness, productivity or generalizability.

Scope precision remains unavailable for open-create and repository-wide authority.

The external pilot still contains zero retained comparative observations.

Verification

• 212 tests passed
• 59 conformance tests passed
• 94.82% statement coverage
• Deterministic site generation verified
• Fail-closed demo passed
• Clean tarball installation passed with zero vulnerabilities
• Package contents verified
• Clean-installed RC11 CLI, measurement and benchmark commands verified
• Final EngineeringSpec check: 24 changed paths, 0 violations
• Final scope receipt: 24 actual, 24 authorized, 0 unauthorized

Immutable identities

• CLI/package: @engineeringspec/cli@0.1.0-rc.11
• Git tag: v0.1.0-rc.11
• Recommended Action pin:
  majilesh/engineeringspec@a23486e3bf4e4b175c06390406c2fd401a0f2515

The Action SHA remains preferred for supply-chain-sensitive repositories.

EngineeringSpec v0.1.0-rc.10

EngineeringSpec v0.1.0-rc.10

RC10 introduces a base-pinned pre-code preparation brief for coding agents, strengthening the workflow from post-change enforcement to guidance before implementation begins.

Added

• New engineeringspec prepare <contract-id> command.
• Deterministic text, Markdown, and JSON preparation briefs.
• Explicit writable, protected, and repository-read boundaries.
• Technical-contract, constraint, verifier, source-intent, digest, and unresolved-question reporting.
• Evidence-quality benchmark fields for:
  • Contract authoring and review effort.
  • Amendment frequency.
  • First-pass gate success.
  • Review cycles.
  • Exploration breadth.
  • Unauthorized paths.
  • Concrete-path scope precision.
• Consent-aware external adopter pilot kit with honest missing-data and negative-result reporting.

Security and trust

• prepare loads authority exclusively from an immutable Git base.
• Missing, ambiguous, invalid, or non-approved contracts fail closed.
• Workspace contract edits cannot widen preparation authority.
• Verifier runner commands, environment values, and payloads remain inert and undisclosed.
• Agent-facing output strips newline, terminal/ANSI, control, and bidirectional characters.
• Markdown output escapes unsafe HTML and Markdown content.
• interface_only is explicitly described as path-level write access, not semantic API enforcement.
• Final path authorization remains subject to deterministic select, check, and CI enforcement.

Agent workflow

RC10 now provides three complementary control points:

1. Before coding: prepare
2. During and after coding: context, explain, review, and check
3. Independent enforcement: the EngineeringSpec GitHub Action

prepare guides an agent using approved authority; it does not approve changes, infer scope, execute verification runners, or replace CI.

Evidence status

The benchmark and pilot infrastructure is available, but no external comparative outcome is claimed yet.

Current retained pilot status:

• 0 of 10 paired tasks completed.
• 0 external participants.
• 0 external repositories.

Productivity, correctness, and adoption benefits remain hypotheses until retained external evidence is collected and reviewed.

Installation

npx --yes @engineeringspec/cli@0.1.0-rc.10 --version

EngineeringSpec v0.1.0-rc.9 — Agent Change Control

EngineeringSpec RC9 makes governed AI-assisted coding easier to adopt and operate.

Highlights

• Added a frictionless pre-code workflow for turning engineering intent into explicit, reviewable change boundaries.
• Improved agent-facing guidance for exploring, proposing, approving, implementing, verifying and closing changes.
• Added clearer adoption paths for existing repositories and teams.
• Strengthened documentation, examples and generated integration guidance.
• Improved release consistency across the CLI, GitHub Action, Agent Skill and documentation site.
• Preserved the core trust boundary: implementation authority comes only from approved, base-pinned contracts.

Install

npx --yes @engineeringspec/cli@0.1.0-rc.9 --help

EngineeringSpec v0.1.0-rc.8

EngineeringSpec v0.1.0-rc.8

RC8 makes EngineeringSpec easier for coding agents and engineering teams to adopt, operate and understand.

Highlights

• Offline CLI, Action and guidance version-health diagnostics
• Safe managed adoption upgrades
• Validated lifecycle transition previews
• Actionable mixed-change diagnostics
• Deterministic specification catalogue and search
• Static searchable EngineeringSpec Explorer
• Read-only Backstage architecture mapping with provenance
• Improved Codex, Claude Code, Cursor and agent-neutral guidance
• Expanded onboarding, lifecycle, upgrade and troubleshooting documentation

Trust boundaries

• Architecture metadata cannot grant implementation authority
• Base-pinned authorization remains unchanged
• Specification-declared runners remain inert
• Routing, governance and format 0.1 compatibility are preserved

Install

npx --yes @engineeringspec/cli@0.1.0-rc.8 --version