mainsequence 7.0.1__tar.gz → 7.0.2__tar.gz

{mainsequence-7.0.1/mainsequence.egg-info → mainsequence-7.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 7.0.1
+Version: 7.0.2
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: LicenseRef-MainSequence-Proprietary

{mainsequence-7.0.1 → mainsequence-7.0.2}/agent_scaffold/skills/maintenance/project-maintenance/SKILL.md

@@ -37,6 +37,10 @@ attached branch, and exact HEAD commit select the platform Project and
 ProjectBranch. Never ask the user for a ProjectBranch UID, persist Project or
 branch identity in `.env`, or use an environment variable as a branch selector.
 The CLI resolves platform UIDs internally when a branch-owned API requires them.
+The same rule applies inside deployed project-code runtimes: runtime credentials
+authorize the backend target but never replace Git source discovery. A missing,
+detached, or mismatched deployed checkout is a hard runtime-image error; do not
+fall back to credential claims or injected ProjectBranch values.
 
 ## Inspect Before Changing State
 

{mainsequence-7.0.1 → mainsequence-7.0.2}/agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md

@@ -155,7 +155,10 @@ backend prepares the exact initial image and later qualifying immutable
 repository events may atomically promote another exact image. On an existing
 Job, enabling or disabling it retains the current exact image. The backend owns
 repository-event truth, policy evaluation, image preparation, and promotion;
-project code and the SDK must not inspect Git or choose a runtime branch.
+project code and the SDK must not choose a Job's deployment branch or image.
+This deployment-policy rule does not replace ADR-0037 runtime source discovery:
+code executing inside the resulting project image still resolves and validates
+its attached Git branch and exact commit.
 
 For direct creation use:
 

{mainsequence-7.0.1 → mainsequence-7.0.2}/mainsequence/project_context.py

@@ -6,7 +6,7 @@ import re
 import subprocess
 import threading
 from collections.abc import Callable, Mapping
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from typing import Any, Literal
 from urllib.parse import urlsplit
 
@@ -51,7 +51,7 @@ ProjectBranchContextLoader = Callable[[GitProjectSourceContext], Any]
 
 @dataclass(frozen=True, slots=True)
 class ProjectRuntimeContext:
-    source_context: GitProjectSourceContext | None
+    source_context: GitProjectSourceContext
     project_uid: str | None
     project_branch_uid: str | None
     organization_environment_uid: str | None
@@ -61,40 +61,30 @@ class ProjectRuntimeContext:
     project_branch: Any | None
     detail: str = ""
     context_source: ProjectRuntimeContextSource = "git"
-    runtime_repository_branch: str | None = None
 
     @property
     def is_authenticated_runtime(self) -> bool:
         return self.context_source == "authenticated_runtime"
 
-    def _require_git_source_context(self) -> GitProjectSourceContext:
-        if self.source_context is None:
-            raise ProjectRuntimeContextError(
-                "Authenticated deployed runtime context has no local Git source."
-            )
-        return self.source_context
-
     @property
     def repository_root(self) -> pathlib.Path:
-        return self._require_git_source_context().repository_root
+        return self.source_context.repository_root
 
     @property
     def canonical_repository_identity(self) -> str:
-        return self._require_git_source_context().canonical_repository_identity
+        return self.source_context.canonical_repository_identity
 
     @property
     def repository_branch(self) -> str:
-        if self.source_context is not None:
-            return self.source_context.repository_branch
-        return str(self.runtime_repository_branch or "")
+        return self.source_context.repository_branch
 
     @property
     def repository_ref(self) -> str:
-        return self._require_git_source_context().repository_ref
+        return self.source_context.repository_ref
 
     @property
     def commit_sha(self) -> str:
-        return self._require_git_source_context().commit_sha
+        return self.source_context.commit_sha
 
 
 @dataclass(frozen=True, slots=True)
@@ -436,12 +426,10 @@ def _build_project_runtime_context(
     )
 
 
-def _build_authenticated_runtime_project_context(
+def _verify_authenticated_runtime_project_context(
+    context: ProjectRuntimeContext,
     authenticated_context: Mapping[str, str],
 ) -> ProjectRuntimeContext:
-    from mainsequence.client.models_foundry import ProjectBranch
-
-    project_branch = ProjectBranch.get_by_uid(authenticated_context["project_branch_uid"])
     expected_fields = {
         "project_uid": authenticated_context["project_uid"],
         "project_branch_uid": authenticated_context["project_branch_uid"],
@@ -449,40 +437,25 @@ def _build_authenticated_runtime_project_context(
         "organization_environment_uid": authenticated_context["organization_environment_uid"],
     }
     observed_fields = {
-        "project_uid": _normalized_value(project_branch, "project_uid"),
-        "project_branch_uid": _normalized_value(project_branch, "uid"),
-        "repository_branch": _normalized_value(project_branch, "repository_branch"),
-        "organization_environment_uid": _normalized_value(
-            project_branch,
-            "organization_environment_uid",
-        ),
+        "project_uid": str(context.project_uid or "").strip(),
+        "project_branch_uid": str(context.project_branch_uid or "").strip(),
+        "repository_branch": context.repository_branch,
+        "organization_environment_uid": str(
+            context.organization_environment_uid or ""
+        ).strip(),
     }
     mismatched = sorted(
         field for field, expected in expected_fields.items() if observed_fields[field] != expected
     )
     if mismatched:
         raise ProjectRuntimeContextError(
-            "Authenticated runtime project context does not match the target "
-            "ProjectBranch: " + ", ".join(mismatched) + "."
+            "Git-resolved ProjectBranch does not match the authenticated runtime "
+            "target: " + ", ".join(mismatched) + "."
         )
 
-    return ProjectRuntimeContext(
-        source_context=None,
-        project_uid=expected_fields["project_uid"],
-        project_branch_uid=expected_fields["project_branch_uid"],
-        organization_environment_uid=expected_fields["organization_environment_uid"],
-        metatables_data_source=_object_value(
-            project_branch,
-            "metatables_data_source",
-        ),
-        status="resolved",
-        process_id=os.getpid(),
-        project_branch=project_branch,
+    return replace(
+        context,
         context_source="authenticated_runtime",
-        runtime_repository_branch=expected_fields["repository_branch"],
-        detail=(
-            "ProjectBranch context installed from an authenticated runtime credential exchange."
-        ),
     )
 
 
@@ -492,7 +465,7 @@ def get_project_runtime_context(
     project_uid: str | None = None,
     _project_branch_context_loader: ProjectBranchContextLoader | None = None,
 ) -> ProjectRuntimeContext:
-    """Resolve and freeze authenticated runtime or local Git context once per process."""
+    """Resolve and freeze Git-native context, then verify any runtime target."""
 
     global _STATE
 
@@ -518,14 +491,16 @@ def get_project_runtime_context(
 
     try:
         authenticated_context = _authenticated_runtime_context_for_process()
+        context = _build_project_runtime_context(
+            project_dir=normalized_project_dir,
+            project_branch_context_loader=(
+                _project_branch_context_loader or _default_project_branch_context_loader
+            ),
+        )
         if authenticated_context is not None:
-            context = _build_authenticated_runtime_project_context(authenticated_context)
-        else:
-            context = _build_project_runtime_context(
-                project_dir=normalized_project_dir,
-                project_branch_context_loader=(
-                    _project_branch_context_loader or _default_project_branch_context_loader
-                ),
+            context = _verify_authenticated_runtime_project_context(
+                context,
+                authenticated_context,
             )
         if project_uid and str(project_uid).strip() != context.project_uid:
             raise ProjectRuntimeContextError(
@@ -550,8 +525,6 @@ def validate_project_source_context(
     """Fail if the current worktree no longer matches the frozen source context."""
 
     resolved = context or get_project_runtime_context()
-    if resolved.is_authenticated_runtime:
-        return resolved
     observed = _resolve_git_source_context(resolved.repository_root)
     if observed != resolved.source_context:
         raise ProjectSourceContextDriftError(

{mainsequence-7.0.1 → mainsequence-7.0.2/mainsequence.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 7.0.1
+Version: 7.0.2
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: LicenseRef-MainSequence-Proprietary

{mainsequence-7.0.1 → mainsequence-7.0.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "7.0.1"
+version = "7.0.2"
 description = "Main Sequence SDK "
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-7.0.1 → mainsequence-7.0.2}/tests/test_cli.py

@@ -11163,6 +11163,82 @@ def test_project_current_json(cli_mod, runner, monkeypatch, tmp_path):
     assert payload["sdk_status"]["status"] == "match"
 
 
+def test_project_current_debug_reports_authenticated_runtime_git_context(
+    cli_mod,
+    runner,
+    monkeypatch,
+    tmp_path,
+):
+    from mainsequence.project_context import (
+        GitProjectSourceContext,
+        ProjectRuntimeContext,
+    )
+
+    project_path = tmp_path / "org" / "projects" / "demo-project-uid-123"
+    project_path.mkdir(parents=True, exist_ok=True)
+    project_info = types.SimpleNamespace(
+        path=str(project_path),
+        folder="demo-project-uid-123",
+        project_uid="project-uid-123",
+        project_id="123",
+        venv_path=None,
+        python_version="3.13.7",
+    )
+    source_context = GitProjectSourceContext(
+        repository_root=project_path,
+        canonical_repository_identity="github.com/org/demo",
+        repository_branch="development",
+        repository_ref="refs/heads/development",
+        commit_sha="b" * 40,
+    )
+    runtime_context = ProjectRuntimeContext(
+        source_context=source_context,
+        project_uid="project-uid-123",
+        project_branch_uid="project-branch-uid-123",
+        organization_environment_uid="environment-uid-123",
+        metatables_data_source=None,
+        status="resolved",
+        process_id=os.getpid(),
+        project_branch=types.SimpleNamespace(uid="project-branch-uid-123"),
+        context_source="authenticated_runtime",
+    )
+
+    monkeypatch.setattr(
+        cli_mod.cfg,
+        "get_config",
+        lambda: {"mainsequence_path": str(tmp_path)},
+    )
+    monkeypatch.setattr(
+        cli_mod,
+        "detect_current_project",
+        lambda workspaces, base: (
+            project_info,
+            types.SimpleNamespace(reason="detected", checks=[]),
+        ),
+    )
+    monkeypatch.setattr(cli_mod, "get_project_runtime_context", lambda **kwargs: runtime_context)
+    monkeypatch.setattr(cli_mod, "read_local_sdk_version", lambda req: "7.0.2")
+    monkeypatch.setattr(cli_mod, "fetch_latest_sdk_version", lambda: "7.0.2")
+
+    result = runner.invoke(cli_mod.app, ["project", "current", "--debug", "--json"])
+
+    assert result.exit_code == 0
+    payload = json.loads(result.output)
+    assert payload["project"] == {
+        "path": str(project_path),
+        "folder": "demo-project-uid-123",
+        "project_uid": "project-uid-123",
+        "git_branch": "development",
+        "git_repository": "github.com/org/demo",
+        "git_commit": "b" * 40,
+        "project_branch_uid": "project-branch-uid-123",
+        "project_branch_status": "resolved",
+        "project_branch_error": None,
+        "venv_path": None,
+        "python_version": "3.13.7",
+    }
+
+
 def test_project_sdk_status(cli_mod, runner, monkeypatch, tmp_path):
     target = tmp_path / "project"
     target.mkdir(parents=True, exist_ok=True)

{mainsequence-7.0.1 → mainsequence-7.0.2}/tests/test_project_runtime_context.py

@@ -101,6 +101,23 @@ def _resolve(
     )
 
 
+def _install_authenticated_runtime_context(
+    *,
+    project_uid: str = PROJECT_UID,
+    project_branch_uid: str = PROJECT_BRANCH_UID,
+    repository_branch: str = "main",
+    organization_environment_uid: str = ENVIRONMENT_UID,
+):
+    project_context._install_authenticated_runtime_project_context(
+        {
+            "project_uid": project_uid,
+            "project_branch_uid": project_branch_uid,
+            "repository_branch": repository_branch,
+            "organization_environment_uid": organization_environment_uid,
+        }
+    )
+
+
 def _git(repo: pathlib.Path, *args: str) -> str:
     result = subprocess.run(
         ["git", *args],
@@ -283,40 +300,22 @@ def test_identity_environment_variables_never_select_context(monkeypatch):
     assert context.organization_environment_uid == ENVIRONMENT_UID
 
 
-def test_authenticated_runtime_context_resolves_without_git(monkeypatch):
+def test_authenticated_runtime_context_requires_matching_git(monkeypatch):
     data_source = _data_source()
-    branch = _project_branch(data_source=data_source)
-    monkeypatch.setattr(
-        models_foundry.ProjectBranch,
-        "get_by_uid",
-        classmethod(lambda cls, uid: branch),
-    )
-    monkeypatch.setattr(
-        project_context,
-        "_resolve_git_source_context",
-        lambda path: pytest.fail("deployed runtime context must not inspect Git"),
-    )
-    project_context._install_authenticated_runtime_project_context(
-        {
-            "project_uid": PROJECT_UID,
-            "project_branch_uid": PROJECT_BRANCH_UID,
-            "repository_branch": "main",
-            "organization_environment_uid": ENVIRONMENT_UID,
-        }
-    )
+    _install_authenticated_runtime_context()
 
-    context = project_context.get_project_runtime_context()
+    context = _resolve(monkeypatch, data_source=data_source)
 
     assert context.is_authenticated_runtime is True
-    assert context.source_context is None
+    assert context.source_context == _source()
     assert context.project_uid == PROJECT_UID
     assert context.project_branch_uid == PROJECT_BRANCH_UID
     assert context.repository_branch == "main"
+    assert context.repository_ref == "refs/heads/main"
+    assert context.commit_sha == COMMIT_SHA
     assert context.organization_environment_uid == ENVIRONMENT_UID
     assert context.metatables_data_source is data_source
     assert project_context.validate_project_source_context(context=context) is context
-    with pytest.raises(project_context.ProjectRuntimeContextError, match="no local Git"):
-        _ = context.commit_sha
 
     assert models_metatables.MetaTable._sdk_owned_query_context("MetaTable.filter") == {}
     assert metatables_core._with_current_metatable_project_context(
@@ -327,59 +326,102 @@ def test_authenticated_runtime_context_resolves_without_git(monkeypatch):
     ) == {"management_mode": "external_registered"}
 
 
-def test_authenticated_runtime_context_rejects_backend_branch_mismatch(monkeypatch):
+def test_authenticated_runtime_context_has_no_missing_git_fallback(monkeypatch):
+    _install_authenticated_runtime_context()
+
+    def missing_git(path):
+        raise project_context.ProjectRuntimeContextError(
+            "missing deployed Git checkout"
+        )
+
     monkeypatch.setattr(
-        models_foundry.ProjectBranch,
-        "get_by_uid",
-        classmethod(lambda cls, uid: _project_branch(branch="development")),
-    )
-    project_context._install_authenticated_runtime_project_context(
-        {
-            "project_uid": PROJECT_UID,
-            "project_branch_uid": PROJECT_BRANCH_UID,
-            "repository_branch": "main",
-            "organization_environment_uid": ENVIRONMENT_UID,
-        }
+        project_context,
+        "_resolve_git_source_context",
+        missing_git,
     )
 
-    with pytest.raises(project_context.ProjectRuntimeContextError, match="repository_branch"):
+    with pytest.raises(project_context.ProjectRuntimeContextError, match="missing deployed Git"):
         project_context.get_project_runtime_context()
 
 
+@pytest.mark.parametrize(
+    ("field", "value"),
+    [
+        ("project_uid", "different-project"),
+        ("project_branch_uid", "different-project-branch"),
+        ("repository_branch", "development"),
+        ("organization_environment_uid", "different-environment"),
+    ],
+)
+def test_authenticated_runtime_context_rejects_git_resolved_target_mismatch(
+    monkeypatch,
+    field,
+    value,
+):
+    runtime_context = {
+        "project_uid": PROJECT_UID,
+        "project_branch_uid": PROJECT_BRANCH_UID,
+        "repository_branch": "main",
+        "organization_environment_uid": ENVIRONMENT_UID,
+    }
+    runtime_context[field] = value
+    _install_authenticated_runtime_context(**runtime_context)
+
+    with pytest.raises(project_context.ProjectRuntimeContextError, match=field):
+        _resolve(monkeypatch)
+
+
+def test_authenticated_runtime_context_detects_git_drift(monkeypatch):
+    _install_authenticated_runtime_context()
+    context = _resolve(monkeypatch)
+    monkeypatch.setattr(
+        project_context,
+        "_resolve_git_source_context",
+        lambda path: _source(branch="development", commit_sha="b" * 40),
+    )
+
+    with pytest.raises(project_context.ProjectSourceContextDriftError):
+        project_context.validate_project_source_context(context=context)
+
+
 def test_configured_runtime_credential_exchanges_context_before_resolution(monkeypatch):
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "credential-id")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "credential-secret")
-    monkeypatch.setattr(
-        models_foundry.ProjectBranch,
-        "get_by_uid",
-        classmethod(lambda cls, uid: _project_branch()),
-    )
+    events = []
     monkeypatch.setattr(
         project_context,
         "_resolve_git_source_context",
-        lambda path: pytest.fail("credential exchange must precede Git resolution"),
+        lambda path: events.append("git") or _source(),
     )
     exchange_calls = []
 
     def exchange(*, force=False, session=None):
+        events.append("exchange")
         exchange_calls.append((force, session))
-        project_context._install_authenticated_runtime_project_context(
-            {
-                "project_uid": PROJECT_UID,
-                "project_branch_uid": PROJECT_BRANCH_UID,
-                "repository_branch": "main",
-                "organization_environment_uid": ENVIRONMENT_UID,
-            }
-        )
+        _install_authenticated_runtime_context()
         return {"Authorization": "Bearer runtime-access"}
 
     monkeypatch.setattr(client_utils.loaders, "refresh_headers", exchange)
 
-    context = project_context.get_project_runtime_context()
+    def resolve_git_context(source):
+        events.append("backend")
+        return types.SimpleNamespace(
+            canonical_repository_identity=source.canonical_repository_identity,
+            repository_branch=source.repository_branch,
+            repository_ref=source.repository_ref,
+            commit_sha=source.commit_sha,
+            project_branch=_project_branch(branch=source.repository_branch),
+        )
+
+    context = project_context.get_project_runtime_context(
+        _project_branch_context_loader=resolve_git_context,
+    )
 
     assert context.is_authenticated_runtime is True
+    assert context.source_context == _source()
     assert exchange_calls == [(True, None)]
+    assert events == ["exchange", "git", "backend"]
 
 
 def test_unregistered_git_context_is_nonfatal_until_branch_context_is_required(monkeypatch):
@@ -532,20 +574,8 @@ class _ScopedCollection(CurrentProjectBranchCollectionMixin, BaseObjectOrm):
 
 
 def test_authenticated_runtime_collection_omits_project_branch_selector(monkeypatch):
-    branch = _project_branch()
-    monkeypatch.setattr(
-        models_foundry.ProjectBranch,
-        "get_by_uid",
-        classmethod(lambda cls, uid: branch),
-    )
-    project_context._install_authenticated_runtime_project_context(
-        {
-            "project_uid": PROJECT_UID,
-            "project_branch_uid": PROJECT_BRANCH_UID,
-            "repository_branch": "main",
-            "organization_environment_uid": ENVIRONMENT_UID,
-        }
-    )
+    _install_authenticated_runtime_context()
+    _resolve(monkeypatch)
     captured = {}
 
     class Response: