mainsequence 5.0.2__tar.gz → 6.0.6__tar.gz

{mainsequence-5.0.2 → mainsequence-6.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 5.0.2
+Version: 6.0.6
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: LicenseRef-MainSequence-Proprietary
@@ -15,7 +15,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: alembic>=1.18.4
 Requires-Dist: cachetools
-Requires-Dist: click>=8.3.0
+Requires-Dist: click>=8.3.3
 Requires-Dist: concurrent-log-handler
 Requires-Dist: numpy
 Requires-Dist: opentelemetry-api
@@ -23,22 +23,24 @@ Requires-Dist: opentelemetry-exporter-otlp
 Requires-Dist: opentelemetry-sdk
 Requires-Dist: packaging>=24.2
 Requires-Dist: pandas
+Requires-Dist: protobuf>=6.33.5
 Requires-Dist: psutil
 Requires-Dist: psycopg2>=2.9.12
 Requires-Dist: pydantic<3,>=2.11
+Requires-Dist: pygments>=2.20.0
 Requires-Dist: pyyaml
-Requires-Dist: requests
+Requires-Dist: requests>=2.33.0
 Requires-Dist: sqlalchemy<3,>=2
 Requires-Dist: starlette
 Requires-Dist: structlog
 Requires-Dist: tqdm
 Requires-Dist: typer
-Requires-Dist: urllib3
+Requires-Dist: urllib3>=2.7.0
+Provides-Extra: fastapi
+Requires-Dist: fastapi<1,>=0.115; extra == "fastapi"
 Provides-Extra: local-data
-Requires-Dist: duckdb; extra == "local-data"
-Requires-Dist: pyarrow; extra == "local-data"
-Provides-Extra: workspace-snapshots
-Requires-Dist: playwright; extra == "workspace-snapshots"
+Requires-Dist: duckdb>=1.4.2; extra == "local-data"
+Requires-Dist: pyarrow>=23.0.1; extra == "local-data"
 Dynamic: license-file
 
 <p align="center">
@@ -107,8 +109,6 @@ Recommended entry points:
   - [Turn Your Project Into an Agent](docs/tutorial/project_to_agent.md)
 - Knowledge:
   - [Data Nodes](docs/knowledge/data_nodes.md)
-  - [Command Center](docs/knowledge/command_center/index.md)
-  - [Command Center Widget Data Contracts](docs/knowledge/command_center/widget_data_contracts.md)
   - [MetaTables](docs/knowledge/meta_tables/index.md)
   - [Constants and Secrets](docs/knowledge/infrastructure/constants_and_secrets.md)
   - [Scheduling Jobs](docs/knowledge/infrastructure/scheduling_jobs.md)
@@ -130,6 +130,12 @@ Authenticate:
 mainsequence login
 ```
 
+An already MCP-authenticated coding agent can establish the same persisted CLI
+session with `mainsequence login --mcp`, then call the printed
+`auth.cli_authorize` tool while the command waits. The backend supplies the
+callback URI; tokens return directly to the CLI and are never exposed through
+MCP.
+
 Check that you can see your projects:
 
 ```bash

{mainsequence-5.0.2 → mainsequence-6.0.6}/README.md

@@ -64,8 +64,6 @@ Recommended entry points:
   - [Turn Your Project Into an Agent](docs/tutorial/project_to_agent.md)
 - Knowledge:
   - [Data Nodes](docs/knowledge/data_nodes.md)
-  - [Command Center](docs/knowledge/command_center/index.md)
-  - [Command Center Widget Data Contracts](docs/knowledge/command_center/widget_data_contracts.md)
   - [MetaTables](docs/knowledge/meta_tables/index.md)
   - [Constants and Secrets](docs/knowledge/infrastructure/constants_and_secrets.md)
   - [Scheduling Jobs](docs/knowledge/infrastructure/scheduling_jobs.md)
@@ -87,6 +85,12 @@ Authenticate:
 mainsequence login
 ```
 
+An already MCP-authenticated coding agent can establish the same persisted CLI
+session with `mainsequence login --mcp`, then call the printed
+`auth.cli_authorize` tool while the command waits. The backend supplies the
+callback URI; tokens return directly to the CLI and are never exposed through
+MCP.
+
 Check that you can see your projects:
 
 ```bash

{mainsequence-5.0.2 → mainsequence-6.0.6}/agent_scaffold/AGENTS.md

@@ -63,11 +63,11 @@ Core responsibilities:
 
 - translate user intent into the correct Main Sequence implementation path:
   - for data publishing and data pipelines, use `DataNode`s and `MetaTable`s
-  - for serving application or widget-facing surfaces, use `FastAPI`
+  - for APIs serving the Command Center frontend, use the contract-authoritative
+    FastAPI release workflow
   - for visualization, confirm the delivery target with the user:
     - if they want a Streamlit app, treat app design and implementation as project-owned code and
       use Main Sequence skills only for platform deployment and release verification
-    - if they want reusable components and a more structured product surface, use Command Center
   - for scheduled execution, releases, and backend operations, use jobs, images, resources, and
     other platform objects through the proper platform skills
 - break work into independent executions according to the skill each part requires
@@ -82,8 +82,9 @@ Typical outcomes include:
 
 - build a `DataNode` to publish a data pipeline
 - build a `MetaTable` to record operational or application data
-- build a `FastAPI` API that reads project data and returns widget-ready or
-  application-ready responses
+- build and release a `FastAPI` API whose Command Center contract-bearing
+  responses conform to a recorded revision of the canonical Command Center SDK
+  GitHub contracts
 - confirm whether a visualization should be a project-owned Streamlit app or a reusable Command
   Center surface before building or deploying it
 - build reusable business logic in `src/` and keep thin integration layers in APIs, jobs, and
@@ -196,22 +197,8 @@ Typical routing:
   `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
 - platform data discovery, published table search, and object identification before implementation:
   `.agents/skills/mainsequence/data_access/exploration/SKILL.md`
-- APIs, FastAPI, request and response contracts, and widget-facing API responses:
+- FastAPI APIs serving the Command Center frontend and their release lifecycle:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
-- Command Center workspace design, widget selection, layout narrative, and visualization strategy:
-  `.agents/skills/mainsequence/command_center/workspace_design/SKILL.md`
-- Command Center workspace JSON creation/update and mounted widget mutation:
-  `.agents/skills/mainsequence/command_center/workspace_builder/SKILL.md`
-- AppComponents, custom forms, and widget input or output contracts:
-  `.agents/skills/mainsequence/command_center/widgets/app_components/SKILL.md`
-- Command Center table/pro-table widgets, tabular frames, table visual metadata, formulas,
-  selections, and live merge mappings:
-  `.agents/skills/mainsequence/command_center/widgets/tables/SKILL.md`
-- Command Center tabular transform widgets, projection, filtering, aggregate, pivot, unpivot,
-  computed columns, and seed/live update bindings:
-  `.agents/skills/mainsequence/command_center/widgets/tabular_transform/SKILL.md`
-- predeployment AppComponent/API contract testing through `apiTargetMode: "mock-json"`:
-  `.agents/skills/mainsequence/command_center/api_mock_prototyping/SKILL.md`
 - jobs, schedules, images, project resources, releases, and Artifacts:
   `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`
 - RBAC, sharing, constants, secrets, and access verification:
@@ -311,8 +298,8 @@ Typical verification commands:
 
 - `mainsequence project current --debug`
 - `mainsequence project jobs list`
-- `mainsequence project jobs runs list <JOB_ID>`
-- `mainsequence project jobs runs logs <JOB_RUN_ID> --max-wait-seconds 900`
+- `mainsequence project jobs runs list <JOB_UID>`
+- `mainsequence project jobs runs logs <JOB_RUN_UID> --max-wait-seconds 900`
 - `mainsequence project images list`
 - `mainsequence project project_resource list`
 

mainsequence-6.0.6/agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -0,0 +1,205 @@
+---
+name: mainsequence-command-center-fastapi
+description: Build, contract-test, release, and verify a FastAPI project resource that serves the Command Center frontend. Use when a Main Sequence API must implement a wire contract defined by the mainsequence-sdk/command-center-sdk GitHub repository and then move through local testing, project sync, image and resource resolution, FastAPI ResourceRelease creation, and deployed frontend validation.
+---
+
+# Command Center FastAPI Release Lifecycle
+
+## Goal
+
+Build a FastAPI provider that the Command Center frontend can use, prove that
+its Command Center contract-bearing payloads conform to the selected Command
+Center SDK repository revision, and release the exact tested commit through the
+Main Sequence platform.
+
+This skill coordinates the provider lifecycle. The canonical
+[`mainsequence-sdk/command-center-sdk`](https://github.com/mainsequence-sdk/command-center-sdk)
+GitHub repository is authoritative for every endpoint that adopts a Command
+Center wire contract.
+
+## Contract Authority
+
+Apply the Command Center SDK default per endpoint, not to the whole API.
+
+- When an endpoint is being created to serve a frontend, first treat the pinned
+  Command Center SDK repository contracts as the default unless the user
+  explicitly names another frontend or contract authority.
+- Classify every endpoint independently. A single FastAPI application can mix
+  Command Center-facing routes with health, internal, administrative, webhook,
+  external-integration, and backend-to-backend routes.
+- Do not force non-frontend endpoints into Command Center contracts merely
+  because they share an application with frontend-serving routes.
+- Do not force every frontend operation into one generic envelope. Select the
+  exact manifest contract whose role and semantics match that endpoint.
+
+For each endpoint classified as Command Center contract-bearing, before
+designing Pydantic models or route serialization:
+
+1. Select a branch, tag, or commit from
+   `https://github.com/mainsequence-sdk/command-center-sdk`. Use `main` unless
+   the user or consuming frontend requires a specific compatible revision, and
+   record the resolved commit SHA.
+2. Open `command-center-sdk/contracts/manifest.json` at that exact revision:
+   `https://github.com/mainsequence-sdk/command-center-sdk/blob/<revision>/command-center-sdk/contracts/manifest.json`.
+3. Select the exact contract by contract ID and role.
+4. Load the manifest-referenced draft-2020-12 JSON Schema and every indexed
+   valid and invalid fixture.
+5. Load the corresponding contract skill from
+   `command-center-sdk/agent_scaffold/skills/contracts/` at the same revision
+   when one exists. Otherwise use `implement-command-center-contract` there.
+
+The manifest, referenced schema, and indexed fixtures define the wire format.
+TypeScript declarations and human documentation explain the contract but do not
+replace that language-neutral definition.
+
+Do not install the Node package in the Python API environment to discover or
+validate these contracts. Read them from a checkout or GitHub URLs pinned to the
+resolved repository commit.
+
+Do not copy schemas, fixture payloads, contract IDs, or field inventories into
+this skill or into Main Sequence SDK client models. Generate or maintain
+provider-side Python models against the selected repository schema and validate
+serialized responses at the HTTP boundary.
+
+If no published contract applies to an application-specific frontend endpoint,
+record that decision and define an explicit application-owned route contract.
+Do not mislabel it as a Command Center SDK contract or distort a nearby schema
+to make it fit.
+
+If the endpoint claims an existing Command Center contract but that contract
+cannot express the required behavior, stop that endpoint implementation and
+produce a Command Center SDK handoff containing:
+
+- Command Center SDK repository commit SHA
+- contract ID and schema `$id`
+- rejected payload or failing fixture
+- exact missing capability or compatibility requirement
+
+Do not invent a local wire extension while waiting for a contract change.
+
+## Lifecycle
+
+### 1. Establish the API boundary
+
+Record:
+
+- the Command Center frontend flow consuming the API
+- the per-endpoint classification: frontend-facing, health, internal,
+  administrative, webhook, external integration, or backend-to-backend
+- the exact contract ID and role for each request or response body
+- route paths, HTTP methods, authentication expectations, and error semantics
+- upstream `APIDataNode`, MetaTable, service, or external data dependencies
+- whether the API uses backend transport or a contract-defined direct
+  development transport
+
+Use `LoggedUserContextMiddleware` when the platform-authenticated request user
+must be available through `request.state`. This middleware binds request headers
+to the SDK request context; it is not an authorization policy by itself.
+
+### 2. Implement the provider
+
+Keep Command Center contract-bearing route code focused on transport and
+application behavior:
+
+1. validate request bodies and parameters
+2. invoke project-owned services and Main Sequence data access
+3. serialize the declared Command Center contract
+4. validate the serialized body against the schema from the selected repository
+   commit before it crosses the HTTP boundary
+
+Python and Pydantic models are implementation tools, not contract authority.
+Preserve schema requirements, nullability, enums, numeric constraints,
+additional-property policy, contract IDs, and semantic rules from the selected
+Command Center SDK repository revision.
+
+### 3. Prove contract conformance
+
+Tests for each selected Command Center contract must:
+
+- compile the selected schema using draft 2020-12
+- accept every manifest-indexed valid fixture
+- reject every manifest-indexed invalid fixture
+- validate representative route responses after JSON serialization
+- test request validation, authentication context, authorization decisions, and
+  declared errors
+- assert that secrets and runtime-only objects never enter response payloads
+- record the Command Center SDK repository commit SHA, contract ID, and schema
+  `$id` in test evidence
+
+An OpenAPI document and passing Pydantic validation are useful but do not replace
+validation against the authoritative Command Center SDK schema and fixtures.
+
+### 4. Test with the frontend before release
+
+Run the FastAPI application locally and exercise it through the actual Command
+Center frontend flow, not only with isolated HTTP calls.
+
+For Adapter From API development, use the direct transport mode defined by the
+selected Command Center SDK repository contract and expose the local API through
+a temporary authenticated Cloudflare tunnel. This allows the workspace
+connection to be tested against local code before creating repeated API
+deployments. Validate discovery, queries, health behavior, exact response
+contracts, and secret redaction through that path.
+
+Do not guess transport field names or values from this skill. Read them from the
+Adapter From API schema and fixtures at the selected repository commit.
+
+### 5. Release the tested commit
+
+Before release, verify local project resolution:
+
+```bash
+mainsequence project current --debug --json
+```
+
+Then move the tested code through the canonical lifecycle:
+
+```bash
+mainsequence project sync -m "Release Command Center API"
+mainsequence project images create
+mainsequence project project_resource list --filter resource_type=fastapi
+mainsequence project project_resource create_fastapi
+```
+
+Verify that:
+
+- project sync used the intended Git branch
+- the selected image contains the exact tested commit
+- resource discovery found the expected FastAPI path at that commit
+- the selected resource UID and image UID refer to the same commit
+- the created release kind is `fastapi`
+- compute and spot settings are intentional
+
+Use `--automatic-deployment` only after the route paths, resource path, and
+frontend contracts are stable and the release should follow future repository
+syncs. Otherwise keep the release pinned and create deliberate replacements.
+
+### 6. Verify the deployed API
+
+Do not treat local success or release creation as completion. Through the
+deployed platform route:
+
+1. verify health and authentication behavior
+2. execute representative contract-bearing requests
+3. validate returned JSON against the same repository-pinned schemas
+4. exercise the consuming Command Center frontend flow
+5. inspect platform logs for serialization, authorization, and runtime failures
+
+When automatic deployment is enabled, also inspect the deployment run and prove
+that it selected the expected repository revision, resource path, and image.
+
+## Completion Evidence
+
+Report:
+
+- Command Center SDK repository URL and resolved commit SHA
+- implemented contract IDs and schema `$id` values
+- conformance and route-test results
+- local frontend integration path used
+- Git commit, project image UID, project resource UID, and release identity
+- deployed contract validation and Command Center frontend result
+- whether automatic deployment is enabled and why
+
+The Command Center-facing release is complete only when the frontend consumes
+the deployed contract-bearing responses and they pass the contracts from the
+recorded Command Center SDK repository revision.

{mainsequence-5.0.2 → mainsequence-6.0.6}/agent_scaffold/skills/data_access/exploration/SKILL.md

@@ -49,12 +49,10 @@ This skill discovers and identifies data. It does not publish, redesign, or defi
   `.agents/skills/mainsequence/data_publishing/data_nodes/SKILL.md`
 - `MetaTable` registration or operation work:
   `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
-- FastAPI or application-facing implementation:
+- FastAPI providers serving the Command Center frontend:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - Streamlit dashboard deployment:
   `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`
-- Command Center surfaces:
-  `.agents/skills/mainsequence/command_center/workspace_builder/SKILL.md`
 - blocker and failure analysis:
   `.agents/skills/mainsequence/maintenance/bug_auditor/SKILL.md`
 
@@ -99,13 +97,13 @@ Discovery priority:
 - use column lookup only when the user is specifically searching for a schema or column name
 - use detail only after you have identified the candidate object you want to inspect
 
-Semantic description discovery searches `MetaTable` metadata rows through:
+Semantic description discovery for published DataNode storage searches
+`TimeIndexMetaTable` metadata rows through:
 
-- `GET /orm/api/ts_manager/meta_table/description-search/?q=<text>`
+- `GET /api/v1/time-index-meta-tables/description-search/?q=<text>`
 
-The same discovery surface applies to `MetaTable` metadata and to published
-`DataNode` storage tables, because `DataNode` storage is represented by
-`TimeIndexMetaTable` metadata.
+This is the DataNode discovery surface because published DataNode storage is
+represented by `TimeIndexMetaTable` metadata.
 
 Typical semantic discovery commands:
 

{mainsequence-5.0.2 → mainsequence-6.0.6}/agent_scaffold/skills/data_publishing/data_nodes/SKILL.md

@@ -56,12 +56,8 @@ If the task depends on one of those areas, route it explicitly instead of guessi
 
 - MetaTables and storage contracts:
   `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
-- APIs and FastAPI:
+- Command Center-serving FastAPI providers:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
-- Command Center workspaces:
-  `.agents/skills/mainsequence/command_center/workspace_builder/SKILL.md`
-- AppComponents and custom forms:
-  `.agents/skills/mainsequence/command_center/widgets/app_components/SKILL.md`
 - Jobs, images, resources, and releases:
   `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`
 - RBAC and sharing:
@@ -349,7 +345,7 @@ delete helpers to clean DataNode storage rows.
 The SDK call targets:
 
 ```text
-POST /orm/api/ts_manager/dynamic_table/<dynamic_table_uid>/delete_after_date/
+POST /api/v1/time-index-meta-tables/<table_uid>/delete-after-date/
 ```
 
 Use a global tail delete only when all streams in the table should be rolled

{mainsequence-5.0.2 → mainsequence-6.0.6}/agent_scaffold/skills/data_publishing/meta_tables/SKILL.md

@@ -28,8 +28,7 @@ This skill is for schema-driven application tables registered through TS Manager
 This skill must not claim ownership of:
 
 - DataNode producer contracts
-- FastAPI route contracts
-- widget response contracts
+- Command Center FastAPI wire contracts
 - workspace payloads
 - job scheduling, image pinning, or releases
 - RBAC or sharing policy
@@ -44,12 +43,8 @@ If the user is still in the discovery process and does not yet know what data ex
   `.agents/skills/mainsequence/data_publishing/meta_table_migrations/SKILL.md`
 - DataNodes:
   `.agents/skills/mainsequence/data_publishing/data_nodes/SKILL.md`
-- APIs and FastAPI:
+- Command Center-serving FastAPI providers:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
-- Command Center workspaces:
-  `.agents/skills/mainsequence/command_center/workspace_builder/SKILL.md`
-- AppComponents and custom forms:
-  `.agents/skills/mainsequence/command_center/widgets/app_components/SKILL.md`
 - Jobs, images, resources, and releases:
   `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`
 
@@ -75,7 +70,7 @@ Before changing code, collect or infer:
 - expected read patterns
 - expected mutation patterns
 - whether TS Manager should create the physical table
-- for `external_registered`, the target `DynamicTableDataSource` UID
+- for `external_registered`, the target canonical `DataSource` UID
 - for contract changes, the selected `AlembicMetaTableMigration` provider or provider module path
 - for contract changes, the provider's `AlembicVersionMetaTable` binding and whether it has been registered
 - for contract changes, the intended Alembic revision, parent/current revision, target revision, and updated SQLAlchemy declarations
@@ -397,7 +392,7 @@ stream cleanup. Route that work to the DataNode skill and use
 The DataNode delete path is:
 
 ```text
-POST /orm/api/ts_manager/dynamic_table/<dynamic_table_uid>/delete_after_date/
+POST /api/v1/time-index-meta-tables/<table_uid>/delete-after-date/
 ```
 
 Use `after_date` for global tail rollback. Use `dimension_filters` or

{mainsequence-5.0.2 → mainsequence-6.0.6}/agent_scaffold/skills/maintenance/bug_auditor/SKILL.md

@@ -53,7 +53,7 @@ This skill audits. It does not implement by default.
   `.agents/skills/mainsequence/data_publishing/data_nodes/SKILL.md`
 - MetaTable implementation issues:
   `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
-- API implementation issues:
+- Command Center FastAPI contract or release issues:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - jobs, images, releases, and runtime environment issues:
   `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`

{mainsequence-5.0.2 → mainsequence-6.0.6}/agent_scaffold/skills/maintenance/project-maintenance/SKILL.md

@@ -24,7 +24,7 @@ Do not own:
 - platform ontology or Project Blueprint design;
 - domain implementation for MetaTables, DataNodes, APIs, jobs, or releases;
 - backend repository reconciliation;
-- MCP authentication or access-token extraction;
+- MCP authorization policy, OAuth token storage, or access-token extraction;
 - project-owned skills outside `.agents/skills/mainsequence/`.
 
 Route architecture changes to `project_design`, implementation routing to
@@ -32,6 +32,13 @@ Route architecture changes to `project_design`, implementation routing to
 `maintenance/bug_auditor` when diagnosis extends beyond the maintenance
 workflow itself.
 
+The local identity contract has one persisted platform identifier:
+`MAIN_SEQUENCE_PROJECT_UID`, the logical Project UID. The checked-out Git
+branch selects the active ProjectBranch. Never ask the user for a
+ProjectBranch UID, persist `MAIN_SEQUENCE_PROJECT_BRANCH_UID`, or treat a
+ProjectBranch UID as local project configuration. The CLI may resolve that UID
+internally when a branch-owned platform API requires it.
+
 ## Inspect Before Changing State
 
 1. Read `AGENTS.md` and the relevant repository skills.
@@ -44,6 +51,12 @@ workflow itself.
    git status --short
    ```
 
+   The `project current` result must report the logical `project_uid`, current
+   `git_branch`, `project_branch_uid`, and `project_branch_status=resolved`.
+   Treat a detached checkout, missing logical Project UID, or unresolved/
+   unregistered Git branch as a maintenance preflight failure before any
+   mutating workflow.
+
 4. Separate existing user changes from changes created by the maintenance
    task. Never assume every uncommitted file belongs to the current task.
 5. Read command help when the installed SDK differs from the instructions in
@@ -77,6 +90,27 @@ documentation.
 
 ## Refresh Project Authentication
 
+Establish CLI authentication before refreshing a project. Select exactly one
+existing authentication lane:
+
+- When `MAINSEQUENCE_AUTH_MODE=runtime_credential`, run `mainsequence login`.
+  The CLI exchanges the injected runtime credential without a browser or a
+  refresh-backed user handoff.
+- When the coding agent has an authenticated Main Sequence MCP connection but
+  the CLI has no session, run `mainsequence login --mcp` in a terminal that can
+  remain active. The command asks the configured backend to create the
+  handoff, prints a JSON object naming `auth.cli_authorize` and its exact
+  `handoff_uid`, and waits. Call that MCP tool with only the printed arguments.
+  The backend-issued callback completes the waiting command and the CLI stores
+  the normal tracked JWT pair locally.
+- When neither lane is available, use the existing interactive browser login.
+
+Never use `--export` with MCP handoff login, pass access or refresh tokens to
+the model, invent a callback URI, or substitute a handoff UID from another
+terminal. If `auth.cli_authorize` returns an error, preserve the pending local
+workflow output and report that exact error rather than starting multiple
+handoffs blindly.
+
 Refresh only the CLI-managed runtime authentication entries in the project
 `.env`:
 
@@ -84,10 +118,18 @@ Refresh only the CLI-managed runtime authentication entries in the project
 mainsequence project refresh_token --path .
 ```
 
-Require normal Main Sequence CLI login first. Never print, inspect, summarize,
-copy, or return access and refresh token values. Do not attempt to extract the
-calling MCP host's protected bearer token. If authentication is unavailable,
-stop and request login through the normal CLI or development integration.
+Require one supported Main Sequence CLI login lane first. Never print,
+inspect, summarize, copy, or return access and refresh token values. Do not
+attempt to extract the calling MCP host's protected bearer token: the handoff
+authorizes a new PKCE grant and the backend returns credentials directly to
+the waiting CLI process.
+
+The command preserves unrelated project configuration and renders only the
+current supported authentication shape. Existing `MAINSEQUENCE_TOKEN` and
+`MAIN_SEQUENCE_PROJECT_ID` entries are not carried into the rewritten file;
+this is not a separate cleanup routine. It preserves the logical
+`MAIN_SEQUENCE_PROJECT_UID` and never writes a ProjectBranch UID; switching Git
+branches changes local branch context without rewriting `.env`.
 
 ## Update The Project SDK
 
@@ -145,6 +187,11 @@ mainsequence project sync --path . -m "<specific commit message>" --dry-run
 Review every pending file because the command stages with `git add -A`. Do not
 continue when unrelated or unexplained changes would be included.
 
+The command performs the same branch preflight even for `--dry-run`: it rejects
+a detached checkout and rejects a Git branch that is not registered under the
+logical Project. Do not bypass that validation or supply a ProjectBranch UID
+manually. Register or select the correct Git branch first.
+
 After review:
 
 ```bash

{mainsequence-5.0.2 → mainsequence-6.0.6}/agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md

@@ -56,12 +56,10 @@ This skill must not claim ownership of:
   `.agents/skills/mainsequence/data_publishing/data_nodes/SKILL.md`
 - MetaTables:
   `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
-- APIs and FastAPI:
+- Command Center-serving FastAPI providers:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - Streamlit dashboard deployment:
   `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`
-- Command Center workspaces:
-  `.agents/skills/mainsequence/command_center/workspace_builder/SKILL.md`
 
 Streamlit dashboard implementation is app-owned project code. This skill only reasons about access to deployed resources such as `ResourceRelease`.