mainsequence 8.1.25.dev26__py3-none-any.whl → 8.1.26.dev27__py3-none-any.whl

agent_scaffold/AGENTS.md

@@ -64,14 +64,13 @@ never owns or updates the `ms_tau_sdk` namespace.
   `.agents/skills/mainsequence/maintenance/code_repository_maintenance/SKILL.md`
 - Blocker analysis, failure classification, and SDK/platform contract mismatches:
   `.agents/skills/mainsequence/maintenance/bug_auditor/SKILL.md`
-- Platform data discovery before implementation:
-  `.agents/skills/mainsequence/data_access/exploration/SKILL.md`
-- TimeIndexTableUpdaters and update behavior:
-  `.agents/skills/mainsequence/data_publishing/time_index_table_updates/SKILL.md`
-- MetaTables and governed table operations:
-  `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
-- Alembic-managed MetaTable schema changes:
-  `.agents/skills/mainsequence/data_publishing/meta_table_migrations/SKILL.md`
+- MetaTable modeling, queries, external registration, table updates, Alembic
+  schema changes, and data discovery: use the skills the `metatables` package
+  installs under `.agents/skills/metatables/` and its documentation.
+- Code that still imports `mainsequence.meta_tables` or
+  `mainsequence.client.metatables`, or calls the retired `mainsequence` table
+  and migration commands:
+  `.agents/skills/mainsequence/maintenance/metatables_transition/SKILL.md`
 - FastAPI APIs serving the Command Center frontend:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - Jobs, schedules, images, resources, releases, and Artifacts:
@@ -96,7 +95,7 @@ never owns or updates the `ms_tau_sdk` namespace.
   not ask users to inject CodeRepositoryBranch or Environment identity.
 - Use the `mainsequence` CLI as the default platform control surface. Prefer
   `--json` when output will be parsed or used as evidence.
-- Use the data-exploration skill before designing against unknown platform data.
+- Use the owning domain package before designing against an unfamiliar domain contract.
 - Keep reusable business logic under `src/` and keep API, job, and other
   integration layers thin.
 - Verify only the platform objects relevant to the requested outcome.

agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -88,7 +88,7 @@ Record:
   administrative, webhook, external integration, or backend-to-backend
 - the exact contract ID and role for each request or response body
 - route paths, HTTP methods, authentication expectations, and error semantics
-- upstream `TimeIndexTableRef`, MetaTable, service, or external data dependencies
+- upstream domain-package, service, or external data dependencies
 - whether the API uses backend transport or a contract-defined direct
   development transport
 

agent_scaffold/skills/maintenance/bug_auditor/SKILL.md

@@ -52,10 +52,8 @@ This skill audits. It does not implement by default.
   platform catalog; do not assume its filesystem path
 - bootstrap, routing, and repository structure:
   `.agents/skills/mainsequence/sdk_code_repository_execution/SKILL.md`
-- TimeIndexTableUpdater implementation issues:
-  `.agents/skills/mainsequence/data_publishing/time_index_table_updates/SKILL.md`
-- MetaTable implementation issues:
-  `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
+- MetaTable and table-update implementation issues: use the installed
+  `metatables` package skill that owns the affected contract
 - Command Center FastAPI contract or release issues:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - jobs, images, releases, and runtime environment issues:

agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: code_repository_maintenance
+name: mainsequence-code-repository-maintenance
 description: Maintain an existing Main Sequence CodeRepository checkout using the SDK-version-matched CLI. Use for inspecting repository state, building or repairing .venv, refreshing local authentication, performing explicitly requested SDK, skill, or AGENTS.md updates, publishing changes with CodeRepository sync, or diagnosing a partially completed maintenance workflow.
 ---
 
@@ -22,7 +22,7 @@ Own:
 Do not own:
 
 - platform ontology or CodeRepository Blueprint design;
-- domain implementation for MetaTables, TimeIndexTableUpdaters, APIs, jobs, or releases;
+- domain implementation for data packages, APIs, jobs, or releases;
 - backend repository reconciliation;
 - MCP authorization policy, OAuth token storage, or access-token extraction;
 - repository-owned skills outside `.agents/skills/mainsequence/`.
@@ -91,10 +91,10 @@ mainsequence code-repository build-local-venv --path . --recreate
 Treat `.venv` as generated state, never as source code or durable repository
 documentation.
 
-## Refresh CodeRepository Authentication
+## Refresh Authentication
 
-Establish CLI authentication before refreshing a CodeRepository. Select exactly one
-existing authentication lane:
+Authentication belongs to the machine, not to a CodeRepository. Establish the
+CLI session through exactly one existing authentication lane:
 
 - When `MAINSEQUENCE_AUTH_MODE=runtime_credential`, run `mainsequence login`.
   The CLI exchanges the injected runtime credential without a browser or a
@@ -114,24 +114,39 @@ terminal. If `auth.cli_authorize` returns an error, preserve the pending local
 workflow output and report that exact error rather than starting multiple
 handoffs blindly.
 
-Refresh only the CLI-managed runtime authentication entries in the CodeRepository
-`.env`:
+The session is one record per backend in the operating system credential
+store. A login made from any CodeRepository serves every other one on the
+machine, and the SDK reads the saved session when it is imported. No
+CodeRepository holds a copy: `.env` has the backend endpoint and no credential.
+
+Renew the saved session and confirm that it works:
 
 ```bash
-mainsequence code-repository refresh-token --path .
+mainsequence refresh-token
 ```
 
+The command takes no path, because the session does not belong to a checkout.
+It renews the access token, saves it, and reports the session without printing
+a token value. When the directory it runs in has a `.env` with an access token,
+a refresh token, or a runtime credential left by an earlier version or another
+tool, it removes those entries and reports them by name only; it changes
+nothing else in that file.
+
 Require one supported Main Sequence CLI login lane first. Never print,
 inspect, summarize, copy, or return access and refresh token values. Do not
 attempt to extract the calling MCP host's protected bearer token: the handoff
 authorizes a new PKCE grant and the backend returns credentials directly to
 the waiting CLI process.
 
-The command preserves unrelated repository configuration and renders only the
-current supported authentication shape. It removes legacy token aliases and
-all retired repository, branch, and environment identity entries. The Git
-checkout supplies source identity; switching branches changes
-context on the next process run without rewriting `.env`.
+Never write a token into `.env` to make a tool work. `mainsequence auth status`
+reports whether a session exists, when it expires, and whether the process
+takes its credentials from its environment or from the saved session; it
+prints no token value. `mainsequence auth token` exists for local tools that
+consume a short-lived access token programmatically. Do not run it to read a
+token into the conversation.
+
+The Git checkout supplies source identity; switching branches changes context
+on the next process run without rewriting `.env`.
 
 ## Update The CodeRepository SDK
 

agent_scaffold/skills/maintenance/metatables_transition/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: mainsequence-metatables-transition
+description: "Use when a repository still depends on the MetaTables code that used to ship inside `mainsequence`: imports from `mainsequence.meta_tables` or `mainsequence.client.metatables`, table classes imported from `mainsequence.client`, or the retired `mainsequence meta-table`, `time-index-table`, `code-repository time-index-table-updates`, and `migrations` commands. Covers only the one-time move to the `mainsequence-metatable` package; all MetaTables usage after the move belongs to the skills that package installs."
+---
+
+# Move a repository to the `metatables` package
+
+MetaTables no longer ships inside `mainsequence`. This skill moves one
+repository's code and dependencies to the package that now owns it, and stops
+there. It does not move tables or catalog records. For table modeling, queries,
+DataSources, updaters, and Alembic migrations, use the skills installed in
+step 2.
+
+## 1. Find what the repository uses
+
+Search code, scripts, workflow files, and `pyproject.toml` for:
+
+- `mainsequence.meta_tables` and `mainsequence.client.metatables`
+- `MetaTable`, `TimeIndexMetaTable`, `TimeIndexTableUpdate`, or `DataSource`
+  imported from `mainsequence.client`
+- `mainsequence meta-table`, `mainsequence time-index-table`,
+  `mainsequence code-repository time-index-table-updates`, and
+  `mainsequence migrations`
+- the `mainsequence[local-data]` extra
+
+Report what you found before editing. If nothing matches, there is nothing to
+move.
+
+## 2. Install the package and its skills
+
+```bash
+uv add mainsequence-metatable
+uv run python -m metatables.sdk_compat
+uv run metatables copy-metatables-skills --path .
+```
+
+The distribution is `mainsequence-metatable`; the import and the command are
+`metatables`. Do not install the PyPI project named `metatables`: it is
+unrelated. The compatibility check must pass before you continue. If it fails,
+the installed `mainsequence` is not compatible; upgrading it is an update the
+user has to request.
+
+The last command copies the package's skills into `.agents/skills/metatables/`.
+
+`mainsequence-metatable` brings back `alembic`, `sqlalchemy`, `pandas`,
+`numpy`, `psycopg2-binary`, and `tqdm`, which the SDK no longer installs. The
+`local-data` extra is gone: remove it, and declare `duckdb` and `pyarrow`
+directly if the repository imports them.
+
+## 3. Rewrite imports
+
+| Old | New |
+| --- | --- |
+| `mainsequence.meta_tables` | `metatables` |
+| `mainsequence.meta_tables.<module>` | `metatables.<module>` |
+| `mainsequence.meta_tables.time_index_table_updates.<module>` | `metatables.updaters.<module>` |
+| `mainsequence.client.metatables`, `mainsequence.client.metatables.core` | `metatables.models` |
+| table classes from `mainsequence.client` | `metatables` |
+
+Change module paths only. In an existing Alembic provider, update the provider
+module and `env.py` the same way, and leave applied revision files untouched.
+If a name is missing from `metatables`, report it instead of guessing a
+substitute.
+
+`CodeRepositoryBranch.get_time_index_table_updates()` and DataSource resolution
+through `CodeRepositoryContext` have no SDK replacement. The `metatables` skills
+cover what to use instead.
+
+## 4. Replace commands
+
+The four command groups keep their names: `mainsequence <group> ...` becomes
+`metatables <group> ...`. Confirm each one with `metatables <group> --help`. If
+a subcommand is missing or refuses to run, stop and report it. Do not pin an
+older `mainsequence`, connect to the database directly, or register tables by
+hand to get around it.
+
+## 5. Check the result
+
+- The search from step 1 returns nothing.
+- The changed modules import and the repository's tests pass.
+- `.agents/skills/metatables/` exists.
+
+Then hand over to those skills.

agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: mainsequence-access-control-and-sharing
-description: Use this skill when the task is about RBAC, resource sharing, or access verification in a Main Sequence CodeRepository. This skill owns organization and team access concepts, view and edit semantics, choosing the correct shareable resource boundary, and access checks across CodeRepositories, TimeIndexMetaTable, constants, secrets, buckets, artifacts, and releases. It does not own job scheduling, TimeIndexTableUpdater producer logic, or API route design.
+description: Use this skill when the task is about RBAC, resource sharing, or access verification in a Main Sequence CodeRepository. This skill owns organization and team access concepts, view and edit semantics, choosing the correct shareable resource boundary, and access checks across CodeRepositories, constants, secrets, buckets, artifacts, and releases. It does not own job scheduling, domain-package data behavior, or API route design.
 ---
 
 # Main Sequence Access Control And Sharing
@@ -26,13 +26,11 @@ This skill is for:
 - decide whether a user needs `view` or `edit`
 - identify the correct shareable object boundary:
   - `CodeRepository`
-  - `TimeIndexMetaTable`
   - `Constant`
   - `Secret`
   - `Bucket`
   - `Artifact`
   - `ResourceRelease`
-- explain that sharing an updater's published output means sharing its `TimeIndexMetaTable`
 - choose whether configuration belongs in a `Constant` or a `Secret`
 - review CLI sharing flows for existing resources
 - verify access assumptions before claiming a workflow is shareable
@@ -42,8 +40,7 @@ This skill is for:
 This skill must not claim ownership of:
 
 - job scheduling or image pinning
-- TimeIndexTableUpdater producer implementation
-- MetaTable schema design
+- domain-package data production and schema design
 - FastAPI route design
 - application UI design or implementation
 
@@ -51,10 +48,8 @@ This skill must not claim ownership of:
 
 - jobs, schedules, images, code repository resources, releases, and Artifacts as operational workflows:
   `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`
-- TimeIndexTableUpdaters:
-  `.agents/skills/mainsequence/data_publishing/time_index_table_updates/SKILL.md`
-- MetaTables:
-  `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
+- MetaTables and table updates: use the installed `metatables` package skills
+  and documentation
 - Command Center-serving FastAPI providers:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 This skill only reasons about access to deployed resources such as `ResourceRelease`.
@@ -108,7 +103,6 @@ Do not speak loosely about sharing "the code" when the operational boundary is a
 
 Examples:
 
-- sharing an updater's published output usually means sharing the `TimeIndexMetaTable`
 - sharing a deployed experience usually means sharing the `ResourceRelease`
 - sharing runtime configuration means sharing the `Constant` or `Secret`
 

agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md

@@ -32,18 +32,15 @@ This skill is for:
 
 This skill must not claim ownership of:
 
-- TimeIndexTableUpdater producer behavior
-- MetaTable schema and row semantics
+- domain-package data production and schema semantics
 - Command Center FastAPI wire contracts
 - RBAC or sharing policy
 - application UI implementation details
 
 ## Route Adjacent Work
 
-- TimeIndexTableUpdaters:
-  `.agents/skills/mainsequence/data_publishing/time_index_table_updates/SKILL.md`
-- MetaTables:
-  `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
+- MetaTables, table updates, and table schemas: use the installed `metatables`
+  package skills and documentation
 - Command Center FastAPI provider implementation and contract validation:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - RBAC and sharing:

agent_scaffold/skills/sdk_code_repository_execution/SKILL.md

@@ -30,14 +30,12 @@ This skill is for:
 - enforce standard Main Sequence repository structure expectations
 - separate verified facts from assumptions
 - surface documentation mismatches to the user
-- enforce the namespace-first safety rule for new or modified TimeIndexTableUpdaters
 
 ## This Skill Must Not Claim
 
 This skill must not claim ownership of:
 
-- TimeIndexTableUpdater engineering
-- MetaTable design
+- domain-package data modeling and execution
 - Command Center-serving FastAPI contract and release design
 - jobs, schedules, images, resources, or releases
 - RBAC or sharing semantics
@@ -49,12 +47,8 @@ Do not let this skill become a domain manual.
 
 ## Route Adjacent Work
 
-- TimeIndexTableUpdaters:
-  `.agents/skills/mainsequence/data_publishing/time_index_table_updates/SKILL.md`
-- MetaTables:
-  `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
-- platform data discovery before implementation:
-  `.agents/skills/mainsequence/data_access/exploration/SKILL.md`
+- MetaTables, table updates, and domain data discovery: use the installed
+  `metatables` package skills and documentation
 - FastAPI APIs serving the Command Center frontend:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - CodeRepository audits, blocker analysis, and upstream SDK assessment:
@@ -122,11 +116,9 @@ Keep the platform boundaries explicit:
 For ordinary local implementation, work naturally in the current Git branch.
 Do not make CodeRepositoryBranch selection a separate user workflow.
 An unregistered local branch remains valid for ordinary local development, but
-it has no CodeRepositoryBranch, Environment, or branch-derived MetaTables DataSource.
-Only branch-owned operations fail. Register the branch before using Jobs,
-images, releases, resources, platform-managed MetaTables/TimeIndexTableUpdaters, migrations,
-pods, or other branch-owned platform APIs. Never fall back to another branch or
-to an aggregate-level default DataSource.
+it has no CodeRepositoryBranch or Environment. Only branch-owned operations
+fail. Register the branch before using Jobs, images, releases, resources, pods,
+or other branch-owned platform APIs. Never fall back to another branch.
 
 ## Required Decisions
 
@@ -190,14 +182,20 @@ Do not start domain work with a vague target.
 
 ### 4. Verify code repository context before making platform claims
 
-Use the CLI to confirm the active CodeRepository and refresh credentials before live checks when needed.
+Use the CLI to confirm the active CodeRepository and the saved session before live checks when needed.
 
 When the result will be consumed programmatically or used as machine-readable evidence, prefer the CLI `--json` flag.
 
 Typical bootstrap checks:
 
 - `mainsequence code-repository current --debug`
-- `mainsequence code-repository refresh-token --path .`
+- `mainsequence auth status --check`
+- `mainsequence refresh-token`
+
+The session lives in the operating system credential store, not in `.env`, and
+belongs to the machine, not to a checkout. `auth status` reports it without
+printing a token value. `refresh-token` renews it; run in a checkout, it also
+removes credential entries an earlier version left in `.env`.
 
 Do not proceed with a live branch-owned check unless `code-repository current` reports
 the current Git branch and a resolved CodeRepositoryBranch UID.
@@ -208,10 +206,6 @@ Once the task boundary is clear, move into the correct specialized skill.
 
 Do not teach domain semantics here.
 
-### 6. Use namespaces first for new or modified TimeIndexTableUpdaters
-
-Before first-running or validating a new or changed TimeIndexTableUpdater, use an explicit namespace before any non-namespaced run.
-
 ## Review Rules
 
 When reviewing bootstrap behavior, look for:

mainsequence/__init__.py

@@ -1,5 +1,15 @@
+# ruff: noqa: E402
 from .bootstrap import prime_runtime_env
 
+# Restore CLI credentials before any client module freezes its endpoint/provider.
 prime_runtime_env()
 
-from .logconf import logger, refresh_application_logger_bindings, set_local_run_app
+from .logconf import (
+    logger as logger,
+)
+from .logconf import (
+    refresh_application_logger_bindings as refresh_application_logger_bindings,
+)
+from .logconf import (
+    set_local_run_app as set_local_run_app,
+)

mainsequence/_request_identity.py

@@ -0,0 +1,44 @@
+"""Private lifecycle shared by the request integration and the public user getter."""
+
+from contextlib import contextmanager
+from contextvars import ContextVar
+from dataclasses import dataclass
+from typing import Any
+
+
+class RequestIdentityError(RuntimeError):
+    """No authenticated caller is bound to the current request."""
+
+
+@dataclass
+class _RequestScope:
+    user: Any = None
+    active: bool = True
+
+
+_current_scope: ContextVar[_RequestScope | None] = ContextVar(
+    "mainsequence_request_identity", default=None
+)
+
+
+@contextmanager
+def _request_scope():
+    scope = _RequestScope()
+    token = _current_scope.set(scope)
+    try:
+        yield scope
+    finally:
+        # Copied child-task contexts hold this same frame and must also expire.
+        scope.active = False
+        scope.user = None
+        _current_scope.reset(token)
+
+
+def _get_request_identity():
+    scope = _current_scope.get()
+    if scope is None or not scope.active or scope.user is None:
+        raise RequestIdentityError(
+            "No authenticated request user is available. Install request identity "
+            "once in the application and call User.get_logged_user() inside a request."
+        )
+    return scope.user

mainsequence/bootstrap.py

@@ -4,6 +4,26 @@ import os
 import pathlib
 import re
 
+CREDENTIALS_FROM_ENVIRONMENT = "environment"
+CREDENTIALS_FROM_STORE = "store"
+_TOKEN_ENVIRONMENT_NAMES = (
+    "MAINSEQUENCE_ACCESS_TOKEN",
+    "MAINSEQUENCE_REFRESH_TOKEN",
+    "MAIN_SEQUENCE_USER_TOKEN",
+    "MAIN_SEQUENCE_REFRESH_TOKEN",
+)
+_credential_source: str | None = None
+
+
+def credential_source() -> str | None:
+    """
+    Say where this process's JWT credentials came from.
+
+    `environment` when a token was already set before the SDK started, `store`
+    when the SDK filled it from the saved CLI session, None when it found neither.
+    """
+    return _credential_source
+
 
 def _set_if_missing(key: str, value: str | None) -> None:
     if value and not os.environ.get(key):
@@ -31,7 +51,16 @@ def prime_runtime_env() -> None:
     """
     Best-effort bootstrap so CLI/SDK imports can discover runtime config without
     requiring the user to source the checkout `.env` manually.
+
+    Only the endpoint is read from the checkout `.env`. Credentials come from the
+    process environment when it already has them, and otherwise from the saved
+    CLI session.
     """
+    global _credential_source
+
+    had_tokens = any((os.environ.get(name) or "").strip() for name in _TOKEN_ENVIRONMENT_NAMES)
+    _credential_source = CREDENTIALS_FROM_ENVIRONMENT if had_tokens else None
+
     local_values = _read_local_env_values(pathlib.Path.cwd() / ".env")
 
     _set_if_missing("MAINSEQUENCE_ENDPOINT", local_values.get("MAINSEQUENCE_ENDPOINT"))
@@ -53,5 +82,13 @@ def prime_runtime_env() -> None:
     except Exception:
         tokens = {}
 
-    _set_if_missing("MAINSEQUENCE_ACCESS_TOKEN", (tokens.get("access") or "").strip())
-    _set_if_missing("MAINSEQUENCE_REFRESH_TOKEN", (tokens.get("refresh") or "").strip())
+    access = (tokens.get("access") or "").strip()
+    refresh = (tokens.get("refresh") or "").strip()
+    if not had_tokens and (access or refresh):
+        _credential_source = CREDENTIALS_FROM_STORE
+        # The saved session's user name goes with its tokens. A renewal saves the
+        # session again, and without the name it would save it nameless.
+        _set_if_missing("MAINSEQUENCE_USERNAME", (tokens.get("username") or "").strip())
+
+    _set_if_missing("MAINSEQUENCE_ACCESS_TOKEN", access)
+    _set_if_missing("MAINSEQUENCE_REFRESH_TOKEN", refresh)

mainsequence/cli/__init__.py

@@ -1 +1 @@
-from .cli import app
+from .cli import app as app