mainsequence 9.0.0__tar.gz → 9.0.1.dev30__tar.gz

mainsequence-9.0.1.dev30/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 MainSequence GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mainsequence-9.0.1.dev30/PKG-INFO

@@ -0,0 +1,178 @@
+Metadata-Version: 2.4
+Name: mainsequence
+Version: 9.0.1.dev30
+Summary: Main Sequence SDK
+Author-email: Main Sequence GmbH <dev@main-sequence.io>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/mainsequence-sdk/mainsequence-sdk
+Project-URL: Issues, https://github.com/mainsequence-sdk/mainsequence-sdk/issues
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.13
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cachetools
+Requires-Dist: click>=8.3.3
+Requires-Dist: concurrent-log-handler
+Requires-Dist: keyring<26,>=25.7.0
+Requires-Dist: opentelemetry-api
+Requires-Dist: opentelemetry-exporter-otlp
+Requires-Dist: opentelemetry-sdk
+Requires-Dist: packaging>=24.2
+Requires-Dist: protobuf>=6.33.5
+Requires-Dist: psutil
+Requires-Dist: pydantic<3,>=2.11
+Requires-Dist: pygments>=2.20.0
+Requires-Dist: pyyaml
+Requires-Dist: requests>=2.33.0
+Requires-Dist: structlog
+Requires-Dist: typer
+Requires-Dist: urllib3>=2.7.0
+Provides-Extra: server
+Requires-Dist: PyJWT[crypto]<3,>=2.10; extra == "server"
+Dynamic: license-file
+
+<p align="center">
+  <img src="https://www.main-sequence.io/images/logos/MS_logo_long_black.png" alt="Main Sequence Logo" width="500"/>
+</p>
+
+# Main Sequence Python SDK
+
+[![Docs](https://img.shields.io/badge/docs-online-blue)](https://mainsequence-sdk.github.io/mainsequence-sdk/)
+[![Open Issues](https://img.shields.io/github/issues/mainsequence-sdk/mainsequence-sdk)](https://github.com/mainsequence-sdk/mainsequence-sdk/issues)
+[![Last Commit](https://img.shields.io/github/last-commit/mainsequence-sdk/mainsequence-sdk)](https://github.com/mainsequence-sdk/mainsequence-sdk/commits/main/)
+[![Maintained](https://img.shields.io/badge/maintained-actively-green.svg)](https://github.com/mainsequence-sdk/mainsequence-sdk/commits/main/)
+
+The Main Sequence Python SDK is the client and development toolkit for the Main
+Sequence platform. It provides authentication, typed platform resources,
+CodeRepository development and release operations, Agent and A2A workflows,
+jobs, sharing, observability, logging, tracing, and reusable scaffold tooling.
+
+MetaTables is now an independent domain package, installed as
+`mainsequence-metatable` and imported as `metatables`. Table models, time-index
+table updates, SQLAlchemy schemas, local database interfaces, and Alembic
+execution are no longer implemented by this distribution.
+
+## Repository Status
+
+- Status: actively maintained
+- Open issues: [GitHub Issues](https://github.com/mainsequence-sdk/mainsequence-sdk/issues)
+- Documentation: [Documentation Site](https://mainsequence-sdk.github.io/mainsequence-sdk/)
+- Security policy: [SECURITY.md](SECURITY.md)
+- Release history: [CHANGELOG.md](CHANGELOG.md)
+- Major-version migrations: [Migration guides](docs/migrations/v8-code-repository-ontology.md)
+
+## What This Repository Contains
+
+Main package areas:
+
+- `mainsequence.client`: API client models for users, CodeRepositories, jobs,
+  Agents, artifacts, constants, secrets, sharing, releases, and other platform
+  resources
+- `mainsequence.cli`: the complete `mainsequence` command-line interface for
+  authentication, platform resources, and local CodeRepository operations
+- `mainsequence.instrumentation` and `mainsequence.logconf`: SDK tracing and
+  logging integration
+- `mainsequence.server`: optional server-side caller assertion verification
+- `mainsequence.scaffold_skills`: reusable, version-pinned skill copying for
+  this SDK and extension libraries
+
+Repository areas:
+
+- `agent_scaffold/`: version-matched SDK skills and managed `AGENTS.md` content
+- `docs/`: knowledge guides, CLI docs, architecture decisions, and generated
+  reference docs
+- `tests/`: offline tests plus explicitly marked live-backend tests
+
+## Documentation Map
+
+Recommended entry points:
+
+- [Documentation home](docs/index.md)
+- [Authentication](docs/knowledge/infrastructure/auth.md)
+- [CLI overview](docs/cli/index.md)
+- [Git source and Environment context](docs/knowledge/infrastructure/context.md)
+- [Constants and Secrets](docs/knowledge/infrastructure/constants_and_secrets.md)
+- [Scheduling Jobs](docs/knowledge/infrastructure/scheduling_jobs.md)
+- [Resource releases](docs/knowledge/infrastructure/resource_releases.md)
+- [Generated API reference](docs/reference/index.md)
+- [MetaTables extraction guide](docs/migrations/metatables-sdk-removal.md)
+- [ADR 0034](docs/adr/0034-extract-metatables-python-package.md)
+
+The beginner tutorial is maintained in the separate
+[MainSequence SDK tutorial CodeRepository](https://github.com/mainsequence-projects/mainsequence-sdk-tutorial).
+
+## Quick Start
+
+Install and authenticate:
+
+```bash
+pip install mainsequence
+mainsequence login
+mainsequence doctor
+```
+
+An already MCP-authenticated coding agent can establish the same persisted CLI
+session with `mainsequence login --mcp`, then call the printed
+`auth.cli_authorize` tool while the command waits. The backend supplies the
+callback URI; tokens return directly to the CLI and are never exposed through
+MCP.
+
+Inspect and create CodeRepositories:
+
+```bash
+mainsequence code-repository search
+mainsequence code-repository create my-first-repository
+mainsequence code-repository set-up-locally <CODE_REPOSITORY_UID>
+cd my-first-repository
+mainsequence code-repository build-local-venv --path .
+```
+
+Use `mainsequence --help` and `mainsequence code-repository --help` for the
+installed command surface. The CLI includes Agent and AgentSession,
+CodeRepository, jobs and runs, images, resources and releases, constants,
+secrets, teams, sharing, scaffold, Docker, and local-development commands.
+
+## Python Client
+
+`mainsequence.client` provides `AuthLoaders`, `MainSequenceClient`, generic
+request and response helpers, and typed platform adapters. The platform owns
+authorization and lifecycle policy. The SDK resolves CodeRepository source
+identity from the current Git checkout when an operation requires that context.
+
+Discover deployments with `ResourceRelease.filter(name=...)` or resolve a known
+release UID with `ResourceRelease.get(pk=...)`. For shared deployments owned by
+another repository, use the explicitly scoped `filter_admin` path. See
+[Resource releases](docs/knowledge/infrastructure/resource_releases.md) for
+supported filters and examples.
+
+Server integrations can install `mainsequence[server]` for the
+framework-independent [caller assertion verifier](docs/knowledge/server/caller_assertions.md).
+Applications remain responsible for resource authorization and storage
+operations.
+
+Install `mainsequence-metatable` and import `metatables` for table-domain work.
+See the [MetaTables migration guide](docs/migrations/metatables-sdk-removal.md)
+for the install step, old and new imports, retired table CLI commands, and the
+legacy SDK option.
+
+## Development
+
+This repository requires Python 3.13 or newer and uses `pyproject.toml` with a
+development dependency group.
+
+```bash
+uv sync --group dev
+pytest
+ruff check .
+mkdocs build --strict
+```
+
+Live-backend tests are marked `live` and excluded from a normal test run. Run
+them explicitly with `pytest -m live` when credentials and a target backend are
+available.
+
+Package metadata is defined in [pyproject.toml](pyproject.toml). This repository
+is licensed under the MIT License; see [LICENSE](LICENSE).

mainsequence-9.0.1.dev30/README.md

@@ -0,0 +1,142 @@
+<p align="center">
+  <img src="https://www.main-sequence.io/images/logos/MS_logo_long_black.png" alt="Main Sequence Logo" width="500"/>
+</p>
+
+# Main Sequence Python SDK
+
+[![Docs](https://img.shields.io/badge/docs-online-blue)](https://mainsequence-sdk.github.io/mainsequence-sdk/)
+[![Open Issues](https://img.shields.io/github/issues/mainsequence-sdk/mainsequence-sdk)](https://github.com/mainsequence-sdk/mainsequence-sdk/issues)
+[![Last Commit](https://img.shields.io/github/last-commit/mainsequence-sdk/mainsequence-sdk)](https://github.com/mainsequence-sdk/mainsequence-sdk/commits/main/)
+[![Maintained](https://img.shields.io/badge/maintained-actively-green.svg)](https://github.com/mainsequence-sdk/mainsequence-sdk/commits/main/)
+
+The Main Sequence Python SDK is the client and development toolkit for the Main
+Sequence platform. It provides authentication, typed platform resources,
+CodeRepository development and release operations, Agent and A2A workflows,
+jobs, sharing, observability, logging, tracing, and reusable scaffold tooling.
+
+MetaTables is now an independent domain package, installed as
+`mainsequence-metatable` and imported as `metatables`. Table models, time-index
+table updates, SQLAlchemy schemas, local database interfaces, and Alembic
+execution are no longer implemented by this distribution.
+
+## Repository Status
+
+- Status: actively maintained
+- Open issues: [GitHub Issues](https://github.com/mainsequence-sdk/mainsequence-sdk/issues)
+- Documentation: [Documentation Site](https://mainsequence-sdk.github.io/mainsequence-sdk/)
+- Security policy: [SECURITY.md](SECURITY.md)
+- Release history: [CHANGELOG.md](CHANGELOG.md)
+- Major-version migrations: [Migration guides](docs/migrations/v8-code-repository-ontology.md)
+
+## What This Repository Contains
+
+Main package areas:
+
+- `mainsequence.client`: API client models for users, CodeRepositories, jobs,
+  Agents, artifacts, constants, secrets, sharing, releases, and other platform
+  resources
+- `mainsequence.cli`: the complete `mainsequence` command-line interface for
+  authentication, platform resources, and local CodeRepository operations
+- `mainsequence.instrumentation` and `mainsequence.logconf`: SDK tracing and
+  logging integration
+- `mainsequence.server`: optional server-side caller assertion verification
+- `mainsequence.scaffold_skills`: reusable, version-pinned skill copying for
+  this SDK and extension libraries
+
+Repository areas:
+
+- `agent_scaffold/`: version-matched SDK skills and managed `AGENTS.md` content
+- `docs/`: knowledge guides, CLI docs, architecture decisions, and generated
+  reference docs
+- `tests/`: offline tests plus explicitly marked live-backend tests
+
+## Documentation Map
+
+Recommended entry points:
+
+- [Documentation home](docs/index.md)
+- [Authentication](docs/knowledge/infrastructure/auth.md)
+- [CLI overview](docs/cli/index.md)
+- [Git source and Environment context](docs/knowledge/infrastructure/context.md)
+- [Constants and Secrets](docs/knowledge/infrastructure/constants_and_secrets.md)
+- [Scheduling Jobs](docs/knowledge/infrastructure/scheduling_jobs.md)
+- [Resource releases](docs/knowledge/infrastructure/resource_releases.md)
+- [Generated API reference](docs/reference/index.md)
+- [MetaTables extraction guide](docs/migrations/metatables-sdk-removal.md)
+- [ADR 0034](docs/adr/0034-extract-metatables-python-package.md)
+
+The beginner tutorial is maintained in the separate
+[MainSequence SDK tutorial CodeRepository](https://github.com/mainsequence-projects/mainsequence-sdk-tutorial).
+
+## Quick Start
+
+Install and authenticate:
+
+```bash
+pip install mainsequence
+mainsequence login
+mainsequence doctor
+```
+
+An already MCP-authenticated coding agent can establish the same persisted CLI
+session with `mainsequence login --mcp`, then call the printed
+`auth.cli_authorize` tool while the command waits. The backend supplies the
+callback URI; tokens return directly to the CLI and are never exposed through
+MCP.
+
+Inspect and create CodeRepositories:
+
+```bash
+mainsequence code-repository search
+mainsequence code-repository create my-first-repository
+mainsequence code-repository set-up-locally <CODE_REPOSITORY_UID>
+cd my-first-repository
+mainsequence code-repository build-local-venv --path .
+```
+
+Use `mainsequence --help` and `mainsequence code-repository --help` for the
+installed command surface. The CLI includes Agent and AgentSession,
+CodeRepository, jobs and runs, images, resources and releases, constants,
+secrets, teams, sharing, scaffold, Docker, and local-development commands.
+
+## Python Client
+
+`mainsequence.client` provides `AuthLoaders`, `MainSequenceClient`, generic
+request and response helpers, and typed platform adapters. The platform owns
+authorization and lifecycle policy. The SDK resolves CodeRepository source
+identity from the current Git checkout when an operation requires that context.
+
+Discover deployments with `ResourceRelease.filter(name=...)` or resolve a known
+release UID with `ResourceRelease.get(pk=...)`. For shared deployments owned by
+another repository, use the explicitly scoped `filter_admin` path. See
+[Resource releases](docs/knowledge/infrastructure/resource_releases.md) for
+supported filters and examples.
+
+Server integrations can install `mainsequence[server]` for the
+framework-independent [caller assertion verifier](docs/knowledge/server/caller_assertions.md).
+Applications remain responsible for resource authorization and storage
+operations.
+
+Install `mainsequence-metatable` and import `metatables` for table-domain work.
+See the [MetaTables migration guide](docs/migrations/metatables-sdk-removal.md)
+for the install step, old and new imports, retired table CLI commands, and the
+legacy SDK option.
+
+## Development
+
+This repository requires Python 3.13 or newer and uses `pyproject.toml` with a
+development dependency group.
+
+```bash
+uv sync --group dev
+pytest
+ruff check .
+mkdocs build --strict
+```
+
+Live-backend tests are marked `live` and excluded from a normal test run. Run
+them explicitly with `pytest -m live` when credentials and a target backend are
+available.
+
+Package metadata is defined in [pyproject.toml](pyproject.toml). This repository
+is licensed under the MIT License; see [LICENSE](LICENSE).

{mainsequence-9.0.0 → mainsequence-9.0.1.dev30}/agent_scaffold/AGENTS.md

@@ -64,14 +64,13 @@ never owns or updates the `ms_tau_sdk` namespace.
   `.agents/skills/mainsequence/maintenance/code_repository_maintenance/SKILL.md`
 - Blocker analysis, failure classification, and SDK/platform contract mismatches:
   `.agents/skills/mainsequence/maintenance/bug_auditor/SKILL.md`
-- Platform data discovery before implementation:
-  `.agents/skills/mainsequence/data_access/exploration/SKILL.md`
-- TimeIndexTableUpdaters and update behavior:
-  `.agents/skills/mainsequence/data_publishing/time_index_table_updates/SKILL.md`
-- MetaTables and governed table operations:
-  `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
-- Alembic-managed MetaTable schema changes:
-  `.agents/skills/mainsequence/data_publishing/meta_table_migrations/SKILL.md`
+- MetaTable modeling, queries, external registration, table updates, Alembic
+  schema changes, and data discovery: use the skills the `metatables` package
+  installs under `.agents/skills/metatables/` and its documentation.
+- Code that still imports `mainsequence.meta_tables` or
+  `mainsequence.client.metatables`, or calls the retired `mainsequence` table
+  and migration commands:
+  `.agents/skills/mainsequence/maintenance/metatables_transition/SKILL.md`
 - FastAPI APIs serving the Command Center frontend:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - Jobs, schedules, images, resources, releases, and Artifacts:
@@ -96,7 +95,7 @@ never owns or updates the `ms_tau_sdk` namespace.
   not ask users to inject CodeRepositoryBranch or Environment identity.
 - Use the `mainsequence` CLI as the default platform control surface. Prefer
   `--json` when output will be parsed or used as evidence.
-- Use the data-exploration skill before designing against unknown platform data.
+- Use the owning domain package before designing against an unfamiliar domain contract.
 - Keep reusable business logic under `src/` and keep API, job, and other
   integration layers thin.
 - Verify only the platform objects relevant to the requested outcome.

{mainsequence-9.0.0 → mainsequence-9.0.1.dev30}/agent_scaffold/skills/a2a_sdk_execution/SKILL.md

@@ -43,14 +43,16 @@ internally and sends a standard A2A message.
 
 ```bash
 mainsequence agent search "<discoveryPrompt>" \
-  --environment-uid "<organizationEnvironmentUid>" \
   --limit 10 \
   --json
 ```
 
-Use the canonical Organization Environment UID associated with the target
-CodeRepositoryBranch. It scopes discovery only; it does not create, assign, or override an
-Agent's environment.
+The SDK resolves the active Git branch once for the process and scopes discovery
+to its Organization Environment. Do not supply a branch or Environment UID.
+An unregistered branch fails only when discovery is attempted.
+For an exact Python lookup, use `Agent.filter(name="SentinelExecutor")` and
+inspect the returned Agent UID and `code_repository_branch_uid`; names are not
+unique routing authority.
 
 4. Treat the CLI output as authoritative.
 5. Prefer the highest `combined_score` when present.
@@ -321,7 +323,7 @@ handle for a different task or conversation.
 ## Deterministic Execution Path
 
 1. Build the discovery prompt.
-2. Run `mainsequence agent search "<discoveryPrompt>" --environment-uid "<organizationEnvironmentUid>" --limit <n> --json`.
+2. Run `mainsequence agent search "<discoveryPrompt>" --limit <n> --json`.
 3. Select the target agent.
 4. Create or resolve the target session with `mainsequence agent session get_or_create`.
 5. Use the returned session `uid`.

{mainsequence-9.0.0 → mainsequence-9.0.1.dev30}/agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: mainsequence-command-center-fastapi
-description: Build, contract-test, release, and verify a FastAPI code repository resource that serves the Command Center frontend. Use when a Main Sequence API must implement a wire contract defined by the mainsequence-sdk/command-center-sdk GitHub repository and then move through local testing, code-repository sync, image and resource resolution, FastAPI ResourceRelease creation, and deployed frontend validation.
+description: Build, contract-test, release, and verify a FastAPI code repository resource serving the Command Center frontend, including applications with public OAuth callback or webhook routes. Use when implementing a Command Center wire contract, declaring exact public ingress, or validating the deployed API.
 ---
 
 # Command Center FastAPI Release Lifecycle
@@ -88,11 +88,11 @@ Record:
   administrative, webhook, external integration, or backend-to-backend
 - the exact contract ID and role for each request or response body
 - route paths, HTTP methods, authentication expectations, and error semantics
-- upstream `TimeIndexTableRef`, MetaTable, service, or external data dependencies
+- upstream domain-package, service, or external data dependencies
 - whether the API uses backend transport or a contract-defined direct
   development transport
 
-FastAPI releases receive the authenticated human from the Main Sequence
+Authenticated FastAPI routes receive the human caller from the Main Sequence
 platform through injected request state. No SDK authentication setup is
 required in repository code:
 
@@ -111,21 +111,74 @@ def get_me(request: Request) -> dict[str, str | None]:
     }
 ```
 
-Route code must not detect local versus deployed execution, parse
-authentication headers, or resolve the request user itself. Consume only the
+Protected route code must not detect local versus deployed execution, parse
+authentication headers, or resolve the request user itself. Consume the
 platform-injected human caller identity:
 
 - `request.state.user` contains canonical `uid` and optional `username`
 - `request.state.user_uid` is the canonical public user UUID
 - `request.state.user_id` does not exist
 
-This identity is the human making the current HTTP request. It is not the
-release creator, deployment owner, runtime workload principal, or runtime
-target. Pass request state explicitly to shared services; do not use
-`User.get_logged_user()` as a FastAPI entry point. Platform-injected identity is
+On a protected route, this identity is the human making the current HTTP
+request. It is not the release creator, deployment owner, runtime workload
+principal, or runtime target. Pass request state explicitly to shared services;
+do not use `User.get_logged_user()` as a FastAPI entry point. Platform-injected identity is
 not resource authorization; use `request.state.user_uid` when applying the
 endpoint's authorization policy.
 
+### Public provider callbacks and webhooks
+
+An external OAuth redirect or webhook cannot supply a Main Sequence Bearer token.
+For a FastAPI release that needs one, use the platform's exact `public_ingress`
+policy. CORS configuration and an app-declared route alone do not make a path
+public. Ordinary routes remain Bearer authenticated.
+
+1. Implement the provider handler in the FastAPI app loaded by the workflow's
+   `source_path`. Declare only its exact `GET` or `POST` method and literal
+   root-relative path under the `kind: fastapi` resource's
+   `spec.public_ingress`. The policy is not inferred from decorators or OpenAPI.
+   Do not include query strings, route parameters, wildcards, or a hostname.
+   The default empty list exposes no public paths. In a validated workflow
+   resource, the declaration has this shape:
+
+   ```yaml
+   kind: fastapi
+   spec:
+     source_path: api/provider/main.py
+     public_ingress:
+       - method: GET
+         path: /integrations/provider/oauth/callback/
+       - method: POST
+         path: /integrations/provider/webhook/
+   ```
+
+2. Fetch the exact CodeRepositoryBranch's current workflow template; use its
+   advertised version and fields. Validate the proposed workflow file through
+   the branch's `validate-workflow` action, then commit the handler and workflow
+   file and push the intended branch. Do not set the reserved
+   `FASTAPI_PUBLIC_INGRESS` environment value yourself.
+3. Follow the repository event and DeploymentRun to a ready active revision.
+   A validated file or successful push is not proof of public admission. Read
+   `resource_release.get` and confirm the pair appears in both desired
+   `public_ingress` and active `effective_public_ingress`. Only then append the
+   declared path to the backend-returned `public_url` and register that full
+   callback or webhook URI with the provider. Do not construct a hostname.
+4. Send a provider-style request without a Main Sequence Bearer token to the
+   exact public pair. Check that an unlisted path or wrong method is denied.
+   An admitted request has `request.state.user` and `user_uid` set to `None`
+   and `request.state.auth_outcome == "public_ingress"`. The handler must verify
+   OAuth state and exchange codes, or verify the webhook signature against the
+   original body and reject replays. Public admission supplies no User or
+   provider identity. Keep provider secrets and live codes out of workflow YAML,
+   logs, and test evidence.
+
+An existing release can change its desired policy through the canonical
+`resource_release.update` operation. Adding a pair still requires a later ready
+revision containing the route before it becomes public. Removing a desired pair
+denies it immediately. The platform skill
+`mainsequence://platform/skills/code-repository-workflows` owns the detailed
+automatic deployment procedure and current workflow shape.
+
 ### 2. Implement the provider
 
 Keep Command Center contract-bearing route code focused on transport and
@@ -187,35 +240,38 @@ Before release, verify local CodeRepository resolution:
 mainsequence code-repository current --debug --json
 ```
 
-Then move the tested code through the canonical lifecycle:
+Declare the FastAPI resource in `.mainsequence/workflows/`, validate the
+workflow against the backend template, then move the tested commit through the
+canonical lifecycle:
 
 ```bash
 mainsequence code-repository sync -m "Release Command Center API"
-mainsequence code-repository images create
 mainsequence code-repository resources list --filter resource_type=fastapi
-mainsequence code-repository resources create_fastapi
 ```
 
 Verify that:
 
 - code-repository sync used the intended Git branch
-- the selected image contains the exact tested commit
-- resource discovery found the expected FastAPI path at that commit
-- the selected resource UID and image UID refer to the same commit
-- the created release kind is `fastapi`
+- the workflow declaration identifies the tested FastAPI source path
+- resource discovery found that path at the exact deployed commit
+- Django resolved and built the exact image for the workflow event
+- the resulting release kind is `fastapi`
+- any declared `public_ingress` pair matches a mounted FastAPI handler
 - compute and spot settings are intentional
 
-Use `--automatic-deployment` only after the route paths, resource path, and
-frontend contracts are stable and the release should follow future repository
-syncs. Otherwise keep the release pinned and create deliberate replacements.
+Enable automatic deployment in the repository workflow when the route paths,
+resource path, and frontend contracts are stable enough for future repository
+events to promote exact images.
 
 ### 6. Verify the deployed API
 
-Request runtime access for the deployed FastAPI `ResourceRelease` through
-Django and wait for Django's ready result. Use the returned access bundle for
-the deployed checks:
+Request runtime access for protected routes on the deployed FastAPI
+`ResourceRelease` through Django and wait for Django's ready result. Use the
+returned access bundle for authenticated checks. For declared public routes,
+use the provider URI without a Main Sequence Bearer token:
 
-1. verify authentication behavior
+1. verify protected-route authentication and, when configured, exact
+   unauthenticated public-ingress method/path behavior
 2. execute representative contract-bearing requests
 3. validate returned JSON against the same repository-pinned schemas
 4. exercise the consuming Command Center frontend flow
@@ -235,6 +291,9 @@ Report:
 - Git commit, code repository image UID, code repository resource UID, and release identity
 - deployed contract validation and Command Center frontend result
 - whether automatic deployment is enabled and why
+- for public provider routes, the declared method/path pairs, observed
+  `effective_public_ingress`, backend-returned provider URI, and unauthenticated
+  positive and negative request results
 
 The Command Center-facing release is complete only when the frontend consumes
 the deployed contract-bearing responses and they pass the contracts from the

{mainsequence-9.0.0 → mainsequence-9.0.1.dev30}/agent_scaffold/skills/maintenance/bug_auditor/SKILL.md

@@ -52,10 +52,8 @@ This skill audits. It does not implement by default.
   platform catalog; do not assume its filesystem path
 - bootstrap, routing, and repository structure:
   `.agents/skills/mainsequence/sdk_code_repository_execution/SKILL.md`
-- TimeIndexTableUpdater implementation issues:
-  `.agents/skills/mainsequence/data_publishing/time_index_table_updates/SKILL.md`
-- MetaTable implementation issues:
-  `.agents/skills/mainsequence/data_publishing/meta_tables/SKILL.md`
+- MetaTable and table-update implementation issues: use the installed
+  `metatables` package skill that owns the affected contract
 - Command Center FastAPI contract or release issues:
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - jobs, images, releases, and runtime environment issues: