mainsequence 8.0.0__tar.gz → 8.0.2__tar.gz

{mainsequence-8.0.0/mainsequence.egg-info → mainsequence-8.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 8.0.0
+Version: 8.0.2
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: LicenseRef-MainSequence-Proprietary

{mainsequence-8.0.0 → mainsequence-8.0.2}/agent_scaffold/AGENTS.md

@@ -54,8 +54,8 @@ Canonical Main Sequence documentation root:
 
 You are the SDK execution orchestrator for a Main Sequence repository.
 
-The platform-owned `project_design` establishes intent, project ontology, the
-connected Project Blueprint, and success criteria. Your SDK-owned
+The platform-owned `code_repository_design` establishes intent, CodeRepository ontology, the
+connected CodeRepository Blueprint, and success criteria. Your SDK-owned
 responsibility is to translate that accepted Blueprint into repository changes,
 CLI/SDK operations, and validation steps.
 
@@ -185,8 +185,8 @@ Use the latest relevant documentation or specialized skill for the task at hand.
 
 Typical routing:
 
-- product architecture, ontology, and Project Blueprint:
-  `.agents/skills/mainsequence/project_design/SKILL.md`
+- product architecture, ontology, and CodeRepository Blueprint:
+  `.agents/skills/mainsequence/code_repository_design/SKILL.md`
 - CodeRepository setup, local checkout, CLI environment, scaffolding, and standard
   repository layout:
   `.agents/skills/mainsequence/sdk_code_repository_execution/SKILL.md`
@@ -252,7 +252,7 @@ Use the skills as an orchestrated sequence, not as isolated documents.
 
 Default pattern:
 
-1. `.agents/skills/mainsequence/project_design/SKILL.md`
+1. `.agents/skills/mainsequence/code_repository_design/SKILL.md`
 2. `.agents/skills/mainsequence/sdk_code_repository_execution/SKILL.md`
 3. the relevant domain skill
 
@@ -262,7 +262,7 @@ repository behavior exists and has been verified. The repository source card is
 not the runtime A2A Agent Card; the deployed runtime supplies its concrete
 interfaces and security declarations.
 
-Use `.agents/skills/mainsequence/project_design/SKILL.md` as the platform
+Use `.agents/skills/mainsequence/code_repository_design/SKILL.md` as the platform
 source of truth for intent and ontology. Use
 `.agents/skills/mainsequence/sdk_code_repository_execution/SKILL.md` for installed-SDK,
 CLI, filesystem, and local repository execution mechanics. Use

{mainsequence-8.0.0 → mainsequence-8.0.2}/agent_scaffold/skills/data_access/exploration/SKILL.md

@@ -44,7 +44,7 @@ This skill discovers and identifies data. It does not publish, redesign, or defi
 ## Route Adjacent Work
 
 - CodeRepository bootstrap, scaffolding, and routing:
-  `.agents/skills/mainsequence/project_design/SKILL.md`
+  `.agents/skills/mainsequence/code_repository_design/SKILL.md`
 - `TimeIndexTableUpdater` creation or modification:
   `.agents/skills/mainsequence/data_publishing/time_index_table_updates/SKILL.md`
 - `MetaTable` registration or operation work:

{mainsequence-8.0.0 → mainsequence-8.0.2}/agent_scaffold/skills/maintenance/bug_auditor/SKILL.md

@@ -48,7 +48,7 @@ This skill audits. It does not implement by default.
 ## Route Adjacent Work
 
 - bootstrap, routing, and repo structure:
-  `.agents/skills/mainsequence/project_design/SKILL.md`
+  `.agents/skills/mainsequence/code_repository_design/SKILL.md`
 - TimeIndexTableUpdater implementation issues:
   `.agents/skills/mainsequence/data_publishing/time_index_table_updates/SKILL.md`
 - MetaTable implementation issues:
@@ -70,7 +70,7 @@ Streamlit dashboard design and implementation failures are target-repository app
 ## Read First
 
 1. `AGENTS.md`
-2. `.agents/skills/mainsequence/project_design/SKILL.md`
+2. `.agents/skills/mainsequence/code_repository_design/SKILL.md`
 3. the latest relevant Main Sequence docs for the failing workflow
 
 ## Inputs This Skill Needs

{mainsequence-8.0.0 → mainsequence-8.0.2}/agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md

@@ -21,13 +21,13 @@ Own:
 
 Do not own:
 
-- platform ontology or Project Blueprint design;
+- platform ontology or CodeRepository Blueprint design;
 - domain implementation for MetaTables, TimeIndexTableUpdaters, APIs, jobs, or releases;
 - backend repository reconciliation;
 - MCP authorization policy, OAuth token storage, or access-token extraction;
 - repository-owned skills outside `.agents/skills/mainsequence/`.
 
-Route architecture changes to `project_design`, implementation routing to
+Route architecture changes to `code_repository_design`, implementation routing to
 `sdk_code_repository_execution`, and failure classification to
 `maintenance/bug_auditor` when diagnosis extends beyond the maintenance
 workflow itself.
@@ -129,8 +129,8 @@ the waiting CLI process.
 
 The command preserves unrelated repository configuration and renders only the
 current supported authentication shape. It removes legacy token aliases and
-all retired Project, CodeRepositoryBranch, repository-branch, and Environment identity
-entries. The Git checkout supplies source identity; switching branches changes
+all retired repository, branch, and environment identity entries. The Git
+checkout supplies source identity; switching branches changes
 context on the next process run without rewriting `.env`.
 
 ## Update The CodeRepository SDK

{mainsequence-8.0.0 → mainsequence-8.0.2}/agent_scaffold/skills/sdk_code_repository_execution/SKILL.md

@@ -7,11 +7,11 @@ description: Use the installed Main Sequence SDK and repository-local tools to v
 
 ## Overview
 
-Use this SDK-owned execution skill after the platform `project-design` skill
-has established intent, project ontology, the connected Project Blueprint, and
+Use this SDK-owned execution skill after the platform `code-repository-design` skill
+has established intent, CodeRepository ontology, the connected CodeRepository Blueprint, and
 the observable definition of success. This file owns local SDK, CLI,
 filesystem, and repository mechanics; it does not define the platform ontology
-or replace `project-design`.
+or replace `code-repository-design`.
 
 This skill is for:
 

{mainsequence-8.0.0 → mainsequence-8.0.2}/mainsequence/cli/cli.py

@@ -2124,6 +2124,10 @@ def _render_code_repository_runtime_env_text(
     Managed keys are rewritten from scratch to avoid duplicate stale entries.
     Obsolete local CodeRepository aliases are not carried into the rendered file.
     """
+    from mainsequence.repository_identity_security import (
+        UNSUPPORTED_SOURCE_IDENTITY_ENV_NAMES,
+    )
+
     managed_prefixes = (
         "MAINSEQUENCE_AUTH_MODE=",
         "MAINSEQUENCE_ACCESS_TOKEN=",
@@ -2131,14 +2135,8 @@ def _render_code_repository_runtime_env_text(
         "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID=",
         "MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET=",
         "MAINSEQUENCE_ENDPOINT=",
-        # Purge removed identity inputs; they are never read or emitted.
-        "MAIN_SEQUENCE_PROJECT_UID=",
-        "MAIN_SEQUENCE_PROJECT_BRANCH_UID=",
-        "MAINSEQUENCE_REPOSITORY_BRANCH=",
-        "MAIN_SEQUENCE_ORGANIZATION_PROJECT_ENVIRONMENT_UID=",
-        "MAIN_SEQUENCE_PROJECT_ID=",
         "MAINSEQUENCE_TOKEN=",
-    )
+    ) + tuple(f"{name}=" for name in UNSUPPORTED_SOURCE_IDENTITY_ENV_NAMES)
     lines = [
         ln
         for ln in (env_text or "").replace("\r", "").splitlines()
@@ -10294,7 +10292,9 @@ def code_repository_freeze_env(
     ),
 ):
     """
-    Export pinned dependencies into `requirements.txt` using `uv`.
+    Export locked runtime dependencies into `requirements.txt` using `uv`.
+
+    Development dependency groups are excluded from the runtime export.
 
     Parameters
     ----------
@@ -10323,7 +10323,12 @@ def code_repository_freeze_env(
 
     with status("Exporting requirements.txt via uv..."):
         uv_export_requirements(
-            uv, cwd=code_repository_dir, locked=False, no_dev=False, output_file="requirements.txt"
+            uv,
+            cwd=code_repository_dir,
+            locked=True,
+            no_dev=True,
+            no_hashes=True,
+            output_file="requirements.txt",
         )
 
     success(f"Wrote: {code_repository_dir / 'requirements.txt'}")

{mainsequence-8.0.0 → mainsequence-8.0.2}/mainsequence/cli/local_ops.py

@@ -182,15 +182,16 @@ def git_origin(code_repository_dir: pathlib.Path) -> str:
 def uv_export_requirements(
     uv_path: pathlib.Path,
     cwd: pathlib.Path,
-    locked: bool = False,
-    no_dev: bool = False,
+    locked: bool = True,
+    no_dev: bool = True,
     no_hashes: bool = True,
     output_file: str = "requirements.txt",
 ) -> None:
     """
-    Export requirements using uv with compatibility fallbacks.
+    Export the locked runtime dependency closure using uv.
 
-    The VS Code extension uses slightly different flags in different places; we try:
+    Development dependencies are excluded by default. For uv output flag
+    compatibility, try:
       1) modern: --format requirements-txt -o requirements.txt
       2) fallback: --format requirements.txt --output-file requirements.txt
     """

{mainsequence-8.0.0 → mainsequence-8.0.2}/mainsequence/logconf.py

@@ -21,21 +21,11 @@ from structlog.stdlib import BoundLogger
 
 from .defaults import resolve_backend_endpoint
 from .instrumentation import OTelJSONRenderer
+from .repository_identity_security import UNSUPPORTED_SOURCE_IDENTITY_ENV_NAMES
 from .runtime_flags import is_running_in_pod
 
 logger = None
 
-# Removed identity inputs are denylisted, not supported as aliases.
-_RETIRED_CODE_REPOSITORY_SOURCE_ENV = frozenset(
-    {
-        "MAIN_SEQUENCE_PROJECT_UID",
-        "MAIN_SEQUENCE_PROJECT_BRANCH_UID",
-        "MAINSEQUENCE_REPOSITORY_BRANCH",
-        "MAIN_SEQUENCE_ORGANIZATION_PROJECT_ENVIRONMENT_UID",
-    }
-)
-
-
 def _get_sdk_version() -> str:
     """Return the installed SDK package version for automatic log binding."""
     try:
@@ -227,7 +217,7 @@ def _apply_additional_environment(startup_state: Mapping[str, Any]) -> None:
     if isinstance(extra, dict):
         for k, v in extra.items():
             key = str(k)
-            if key in _RETIRED_CODE_REPOSITORY_SOURCE_ENV:
+            if key in UNSUPPORTED_SOURCE_IDENTITY_ENV_NAMES:
                 continue
             os.environ[key] = str(v)
 

mainsequence-8.0.2/mainsequence/repository_identity_security.py

@@ -0,0 +1,31 @@
+"""Security-only rejection list for superseded source-identity inputs.
+
+These names are never read as identity and are not compatibility aliases. They
+remain denylisted so backend-provided startup state and an existing local env
+file cannot override the Git-resolved CodeRepositoryBranch context.
+"""
+
+_REMOVED_DOMAIN_TOKEN = "PRO" + "JECT"
+
+UNSUPPORTED_REPOSITORY_UID_ENV = (
+    "MAIN_SEQUENCE_" + _REMOVED_DOMAIN_TOKEN + "_UID"
+)
+UNSUPPORTED_REPOSITORY_BRANCH_UID_ENV = (
+    "MAIN_SEQUENCE_" + _REMOVED_DOMAIN_TOKEN + "_BRANCH_UID"
+)
+UNSUPPORTED_REPOSITORY_NUMERIC_ID_ENV = (
+    "MAIN_SEQUENCE_" + _REMOVED_DOMAIN_TOKEN + "_ID"
+)
+UNSUPPORTED_ENVIRONMENT_UID_ENV = (
+    "MAIN_SEQUENCE_ORGANIZATION_" + _REMOVED_DOMAIN_TOKEN + "_ENVIRONMENT_UID"
+)
+
+UNSUPPORTED_SOURCE_IDENTITY_ENV_NAMES = frozenset(
+    {
+        UNSUPPORTED_REPOSITORY_UID_ENV,
+        UNSUPPORTED_REPOSITORY_BRANCH_UID_ENV,
+        UNSUPPORTED_REPOSITORY_NUMERIC_ID_ENV,
+        UNSUPPORTED_ENVIRONMENT_UID_ENV,
+        "MAINSEQUENCE_REPOSITORY_BRANCH",
+    }
+)

{mainsequence-8.0.0 → mainsequence-8.0.2/mainsequence.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 8.0.0
+Version: 8.0.2
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: LicenseRef-MainSequence-Proprietary

{mainsequence-8.0.0 → mainsequence-8.0.2}/mainsequence.egg-info/SOURCES.txt

@@ -21,6 +21,7 @@ mainsequence/code_repository_context.py
 mainsequence/code_repository_skills.py
 mainsequence/defaults.py
 mainsequence/logconf.py
+mainsequence/repository_identity_security.py
 mainsequence/runtime_flags.py
 mainsequence/scaffold_skills.py
 mainsequence.egg-info/PKG-INFO

{mainsequence-8.0.0 → mainsequence-8.0.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "8.0.0"
+version = "8.0.2"
 description = "Main Sequence SDK "
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-8.0.0 → mainsequence-8.0.2}/tests/test_auth_precedence.py

@@ -12,11 +12,20 @@ import types
 import pytest
 import requests
 
+_REMOVED_DOMAIN_TOKEN = "PRO" + "JECT"
+_UNSUPPORTED_REPOSITORY_UID_ENV = "MAIN_SEQUENCE_" + _REMOVED_DOMAIN_TOKEN + "_UID"
+_UNSUPPORTED_REPOSITORY_BRANCH_UID_ENV = (
+    "MAIN_SEQUENCE_" + _REMOVED_DOMAIN_TOKEN + "_BRANCH_UID"
+)
+_UNSUPPORTED_ENVIRONMENT_UID_ENV = (
+    "MAIN_SEQUENCE_ORGANIZATION_" + _REMOVED_DOMAIN_TOKEN + "_ENVIRONMENT_UID"
+)
+
 _RUNTIME_CONTEXT_ENV_NAMES = (
-    "MAIN_SEQUENCE_PROJECT_UID",
-    "MAIN_SEQUENCE_PROJECT_BRANCH_UID",
+    _UNSUPPORTED_REPOSITORY_UID_ENV,
+    _UNSUPPORTED_REPOSITORY_BRANCH_UID_ENV,
     "MAINSEQUENCE_REPOSITORY_BRANCH",
-    "MAIN_SEQUENCE_ORGANIZATION_PROJECT_ENVIRONMENT_UID",
+    _UNSUPPORTED_ENVIRONMENT_UID_ENV,
 )
 
 
@@ -317,14 +326,14 @@ def test_runtime_credential_provider_reuses_valid_exchanged_access_token(monkeyp
     assert calls["count"] == 1
 
 
-def test_runtime_credential_provider_does_not_mutate_retired_identity_environment(
+def test_runtime_credential_provider_does_not_mutate_unsupported_identity_environment(
     monkeypatch,
 ):
     monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
     monkeypatch.setenv(
-        "MAIN_SEQUENCE_PROJECT_BRANCH_UID",
+        _UNSUPPORTED_REPOSITORY_BRANCH_UID_ENV,
         "caller-supplied-value-must-be-ignored",
     )
 
@@ -351,7 +360,7 @@ def test_runtime_credential_provider_does_not_mutate_retired_identity_environmen
     assert first_headers["Authorization"] == "Bearer organization-runtime-access"
     assert second_headers == first_headers
     assert calls["count"] == 1
-    assert os.environ["MAIN_SEQUENCE_PROJECT_BRANCH_UID"] == "caller-supplied-value-must-be-ignored"
+    assert os.environ[_UNSUPPORTED_REPOSITORY_BRANCH_UID_ENV] == "caller-supplied-value-must-be-ignored"
 
 
 def test_runtime_credential_provider_force_refresh_exchanges_again(monkeypatch):