mainsequence 9.0.1.dev30__py3-none-any.whl → 9.0.2.dev32__py3-none-any.whl

agent_scaffold/AGENTS.md

@@ -42,6 +42,7 @@ specific update:
 
 - `mainsequence code-repository update-sdk --path .`
 - `mainsequence code-repository update-agent-skills --path .`
+- `mainsequence code-repository update-platform-skills --path .`
 - `mainsequence code-repository update AGENTS.md --path .`
 - `uv run ms-tau skills sync --path .`
 
@@ -51,6 +52,11 @@ to report, not permission to mutate the repository. The same rule applies to
 requested, use the `code_repository_maintenance` skill. The `mainsequence` CLI
 never owns or updates the `ms_tau_sdk` namespace.
 
+The SDK owns all of `.agents/skills/mainsequence/`. Its skill copy is local,
+requires no sign-in, and deletes everything absent from the installed SDK
+bundle. Platform skills are installed separately under
+`.agents/skills/mainsequence_platform/` by the authenticated platform update.
+
 ## Route By Task
 
 - Product architecture, platform ontology, and CodeRepository Blueprint work:

agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md

@@ -172,22 +172,37 @@ to publish the CodeRepository changes.
 ## Refresh Managed Skills And Instructions
 
 Run either managed-scaffold command only when the user explicitly requests that
-specific update. When both are requested, refresh the SDK-owned and
-platform-owned skills first, then update the managed Main Sequence block in
+specific update. When both are requested, refresh the SDK-owned skills first,
+then update the managed Main Sequence block in
 `AGENTS.md`:
 
 ```bash
-mainsequence code-repository update-agent-skills --path .
-mainsequence code-repository update AGENTS.md --path .
+uv run --offline mainsequence code-repository update-agent-skills --path .
+uv run --offline mainsequence code-repository update AGENTS.md --path .
 ```
 
 Verify `.agents/skills/mainsequence/PINNED_FROM.txt` after success:
 
-- `sdk_version` must match the installed CodeRepository SDK;
-- platform manifest, ontology, and resource hashes must be present;
+- `pinned_version` must match the installed CodeRepository SDK;
+- the namespace must contain exactly the installed SDK's skill folders;
 - repository-owned skills outside `.agents/skills/mainsequence/` must remain
   untouched.
 
+The SDK owns the whole `mainsequence` namespace. Copying it requires no login
+or platform access and deletes obsolete folders, including retired table
+workflow skills. Do not preserve old or platform-owned content in that folder.
+The installed `metatables` package owns table workflows in its own namespace.
+
+When the user requests platform skills, use the separate authenticated command:
+
+```bash
+mainsequence code-repository update-platform-skills --path .
+```
+
+It owns only `.agents/skills/mainsequence_platform/` and records the platform
+manifest, ontology, and resource hashes there. A backend or authentication
+failure in this command must not block a local SDK skill copy.
+
 The skill update is staged and atomic. If it fails, report the failing lane and
 preserve the previous valid managed tree. Because this operation can update
 this skill, reload the refreshed `code_repository_maintenance/SKILL.md` before starting

mainsequence/cli/cli.py

@@ -56,8 +56,9 @@ from ..code_repository_context import (
 )
 from ..code_repository_skills import (
     CodeRepositorySkillAssemblyError,
-    install_dual_source_code_repository_skills,
+    install_platform_code_repository_skills,
 )
+from ..scaffold_skills import ScaffoldSkillCopyBlocked, copy_scaffold_skills
 from . import config as cfg
 from .api import (
     ApiError,
@@ -7845,6 +7846,33 @@ def code_repository_update_sdk(
         run_uv(uv, ["sync"], cwd=code_repository_dir)
 
     success("SDK update complete.")
+    _warn_if_sdk_skills_stale(code_repository_dir)
+
+
+def _warn_if_sdk_skills_stale(code_repository_dir: pathlib.Path) -> None:
+    try:
+        version = _code_repository_installed_package_version(code_repository_dir, "mainsequence")
+        sentinel = code_repository_dir / ".agents" / "skills" / "mainsequence" / "PINNED_FROM.txt"
+        values = (
+            dict(
+                line.split("=", 1)
+                for line in sentinel.read_text(encoding="utf-8").splitlines()
+                if "=" in line
+            )
+            if sentinel.is_file()
+            else {}
+        )
+    except (OSError, ValueError, typer.Exit):
+        warn("Could not check the vendored SDK skill pin. Run update-agent-skills to refresh it.")
+        return
+    pinned = values.get("pinned_version", values.get("sdk_version"))
+    if pinned != version:
+        warn(
+            f"Vendored SDK skills are stale or missing (pinned: {pinned or 'missing'}; installed: {version}). "
+            "No scaffold files were changed. Refresh with "
+            "`uv run --offline mainsequence code-repository update-agent-skills --path .` "
+            "and `uv run --offline mainsequence code-repository update AGENTS.md --path .`."
+        )
 
 
 @code_repository.command("update")
@@ -7935,124 +7963,61 @@ def code_repository_update_agent_skills(
     path: str | None = typer.Option(None, "--path", help="CodeRepository directory"),
 ):
     """
-    Update `.agents/skills/mainsequence` from installed SDK and platform sources.
+    Replace SDK-owned skills with the target checkout's installed SDK bundle.
 
-    The existing command copies SDK-owned execution skills from the target
-    CodeRepository's installed `agent_scaffold/skills` tree and retrieves
-    platform-owned skills from authenticated MCP resources. It validates and
-    stages both sources, then replaces only the managed `mainsequence`
-    namespace and writes one dual-source `PINNED_FROM.txt`. Bundle-root files
-    such as `AGENTS.md` are not copied by this command.
+    No sign-in or backend access is required unless a CodeRepository UID
+    assertion is supplied. The SDK owns all of .agents/skills/mainsequence:
+    files and folders absent from the installed bundle are deleted. Other
+    namespaces are untouched. AGENTS.md is refreshed separately with
+    code-repository update AGENTS.md. Platform skills use update-platform-skills.
 
     Examples
     --------
-    ```bash
-    mainsequence code-repository update-agent-skills
     mainsequence code-repository update-agent-skills --path .
-    mainsequence code-repository update-agent-skills --code-repository-uid code-repository-uid-123
-    ```
     """
-    code_repository_dir = _resolve_code_repository_dir(code_repository_id, path)
-
-    scaffold_bundle_dir = _code_repository_agent_scaffold_bundle_dir(code_repository_dir)
-    skills_dir = scaffold_bundle_dir / "skills"
-    if not skills_dir.exists() or not skills_dir.is_dir():
-        error(f"CodeRepository-installed agent_scaffold bundle is missing skills/: {skills_dir}")
-        raise typer.Exit(1)
-
-    pinned_version = _code_repository_installed_package_version(code_repository_dir, "mainsequence")
-    source_checkout_root = _mainsequence_source_checkout_root()
-    protected_code_repository_roots = (
-        (source_checkout_root,) if source_checkout_root is not None else ()
-    )
+    directory = _resolve_code_repository_dir(code_repository_id, path)
+    skills_dir = _code_repository_agent_scaffold_bundle_dir(directory) / "skills"
+    version = _code_repository_installed_package_version(directory, "mainsequence")
+    source_root = _mainsequence_source_checkout_root()
     try:
-        platform_catalog = fetch_platform_code_repository_skill_catalog()
-        install_result = install_dual_source_code_repository_skills(
-            code_repository_dir=code_repository_dir,
-            sdk_library_name="mainsequence",
+        result = copy_scaffold_skills(
+            code_repository_dir=directory,
+            library_name="mainsequence",
             namespace="mainsequence",
-            sdk_skills_path=skills_dir,
-            sdk_version=pinned_version,
-            platform_catalog=platform_catalog,
+            skills_path=skills_dir,
+            pinned_version=version,
             command="mainsequence code-repository update-agent-skills",
-            protected_code_repository_roots=protected_code_repository_roots,
+            protected_code_repository_roots=(source_root,) if source_root else (),
         )
-    except (
-        ApiError,
-        CodeRepositorySkillAssemblyError,
-        FileNotFoundError,
-        OSError,
-        ValueError,
-    ) as exc:
+    except (ScaffoldSkillCopyBlocked, FileNotFoundError, OSError, ValueError) as exc:
         error(str(exc))
         raise typer.Exit(1) from exc
-
     updated = [
-        {
-            "name": item.name,
-            "owner": item.owner,
-            "source": item.source,
-            "destination": item.destination,
-            "content_sha256": item.content_sha256,
-        }
-        for item in install_result.installed
+        {"name": item.name, "owner": "sdk", "source": item.source, "destination": item.destination}
+        for item in result.copied
     ]
-
     payload = {
-        "code_repository": code_repository_dir,
-        "library_name": install_result.sdk_library_name,
-        "namespace": "mainsequence",
-        "skills_path": install_result.sdk_skills_path,
-        "destination_root": install_result.destination_root,
-        "sentinel_path": install_result.sentinel_path,
-        "pinned_version": install_result.sdk_version,
+        "code_repository": directory,
+        "library_name": result.library_name,
+        "namespace": result.namespace,
+        "skills_path": result.skills_path,
+        "destination_root": result.destination_root,
+        "sentinel_path": result.sentinel_path,
+        "pinned_version": result.pinned_version,
         "sdk": {
-            "library_name": install_result.sdk_library_name,
-            "version": install_result.sdk_version,
-            "skills_path": install_result.sdk_skills_path,
-        },
-        "platform": {
-            "source_url": platform_catalog.source_url,
-            "manifest_version": platform_catalog.manifest_version,
-            "manifest_sha256": platform_catalog.manifest_sha256,
-            "ontology_uri": platform_catalog.ontology_uri,
-            "ontology_sha256": platform_catalog.ontology_sha256,
-            "resources": [
-                {
-                    "name": resource.name,
-                    "uri": resource.uri,
-                    "path": str(resource.resource_path),
-                    "content_sha256": resource.content_sha256,
-                }
-                for resource in platform_catalog.resources
-            ],
-            "skills": [
-                {
-                    "name": skill.name,
-                    "uri": skill.uri,
-                    "path": str(skill.relative_path),
-                    "content_sha256": skill.content_sha256,
-                }
-                for skill in platform_catalog.skills
-            ],
+            "library_name": result.library_name,
+            "version": version,
+            "skills_path": result.skills_path,
         },
         "updated_count": len(updated),
         "updated": updated,
     }
     if _emit_json(payload):
         return
-
-    success("Updated .agents/skills/mainsequence from installed SDK and platform sources.")
+    success("Replaced SDK-owned .agents/skills/mainsequence with the installed bundle.")
     print_kv(
         "CodeRepository Skill Provenance",
-        [
-            ("SDK Library", install_result.sdk_library_name),
-            ("SDK Version", install_result.sdk_version),
-            ("Platform Manifest", platform_catalog.manifest_sha256),
-            ("Platform Resources", len(platform_catalog.resources)),
-            ("Platform Skills", len(platform_catalog.skills)),
-            ("Sentinel", str(install_result.sentinel_path)),
-        ],
+        [("SDK Version", version), ("Sentinel", str(result.sentinel_path))],
     )
     print_table(
         "Updated CodeRepository Skills",
@@ -8061,6 +8026,54 @@ def code_repository_update_agent_skills(
     )
 
 
+@code_repository.command("update-platform-skills")
+def code_repository_update_platform_skills(
+    path: str | None = typer.Option(None, "--path", help="CodeRepository directory"),
+):
+    """Refresh authenticated platform skills in .agents/skills/mainsequence_platform.
+
+    This requires a signed-in session and a reachable backend. The SDK-owned
+    mainsequence namespace and other library namespaces remain untouched.
+    """
+    directory = _resolve_code_repository_dir(None, path)
+    source_root = _mainsequence_source_checkout_root()
+    try:
+        catalog = fetch_platform_code_repository_skill_catalog()
+        destination, installed = install_platform_code_repository_skills(
+            code_repository_dir=directory,
+            platform_catalog=catalog,
+            protected_code_repository_roots=(source_root,) if source_root else (),
+        )
+    except (
+        ApiError,
+        CodeRepositorySkillAssemblyError,
+        ScaffoldSkillCopyBlocked,
+        FileNotFoundError,
+        OSError,
+        ValueError,
+    ) as exc:
+        error(str(exc))
+        raise typer.Exit(1) from exc
+    payload = {
+        "code_repository": directory,
+        "namespace": "mainsequence_platform",
+        "destination_root": destination,
+        "sentinel_path": destination / "PINNED_FROM.txt",
+        "platform": {
+            "source_url": catalog.source_url,
+            "manifest_version": catalog.manifest_version,
+            "manifest_sha256": catalog.manifest_sha256,
+            "ontology_uri": catalog.ontology_uri,
+            "ontology_sha256": catalog.ontology_sha256,
+        },
+        "updated_count": len(installed),
+        "updated": [dataclasses.asdict(item) for item in installed],
+    }
+    if _emit_json(payload):
+        return
+    success("Updated .agents/skills/mainsequence_platform from the authenticated platform catalog.")
+
+
 @skills.command("list")
 def skills_list_cmd():
     """

mainsequence/cli/config.py

@@ -756,6 +756,24 @@ def secure_store_available() -> bool:
     return _secure_keyring_backend() is not None
 
 
+def saved_session_summary(backend: str | None = None) -> dict:
+    """
+    Describe the saved session of a backend without any token value.
+
+    `usable` says whether its refresh token has not expired by its own claim,
+    `expires_at` is that claim in epoch seconds (None when absent) and
+    `username` is the recorded user. The process environment is not consulted.
+    """
+    tokens = _read_secure_tokens(backend)
+    refresh = (tokens.get("refresh") or "").strip()
+    expires_at = token_expiry(refresh)
+    return {
+        "username": str(tokens.get("username") or ""),
+        "expires_at": expires_at,
+        "usable": bool(refresh) and (expires_at is None or expires_at > int(time.time())),
+    }
+
+
 def stored_session_available(backend: str | None = None) -> bool:
     """
     Return whether the credential store holds a renewable session for a backend.

mainsequence/client/utils.py

@@ -70,42 +70,145 @@ def set_mainsequence_endpoint(endpoint: str) -> None:
     AUTH_ENDPOINT = normalized
 
 
-def _jwt_reauth_hint() -> str:
+_SESSION_TOKEN_VARIABLES = ("MAINSEQUENCE_ACCESS_TOKEN", "MAINSEQUENCE_REFRESH_TOKEN")
+# Renewal answers that refuse the credentials, as opposed to a backend that failed.
+_REFUSED_RENEWAL_STATUSES = frozenset({400, 401, 403})
+
+
+def _format_utc(epoch: int) -> str:
+    return datetime.datetime.fromtimestamp(epoch, tz=datetime.UTC).strftime(
+        "%Y-%m-%d %H:%M UTC"
+    )
+
+
+def _session_backend() -> str:
+    return (AUTH_ENDPOINT or "").rstrip("/")
+
+
+def _login_command(backend: str) -> str:
     """
-    Say how to repair rejected JWT credentials, according to where they came from.
+    Return the CLI command that signs in to `backend`.
 
-    A pair that was already in the process environment wins over the saved CLI
-    session. When that pair is stale the saved session is not tried, because the
-    pair may belong to another user or backend; the message names it instead.
+    `mainsequence login` alone signs in to the configured backend. Another
+    backend needs its address and the folder that holds its repositories.
     """
     try:
-        from mainsequence import bootstrap
         from mainsequence.cli import config as cli_config
 
-        from_environment = bootstrap.credential_source() == bootstrap.CREDENTIALS_FROM_ENVIRONMENT
-        saved_session = from_environment and cli_config.stored_session_available()
+        configured = cli_config.normalize_backend_url(
+            cli_config.get_persistent_config().get("backend_url")
+        )
     except Exception:
-        from_environment, saved_session = False, False
+        configured = ""
+    if not backend or backend == configured:
+        return "`mainsequence login`"
+    return f"`mainsequence login {backend} <base folder>`"
+
+
+def _env_file_holding_process_credentials() -> pathlib.Path | None:
+    """
+    Return the working directory's `.env` when it holds this process's tokens.
+
+    IDE run configurations, launchers and dotenv calls load that file into a
+    process's environment. Values are compared here and never shown.
+    """
+    from mainsequence.cli import config as cli_config
+
+    env_path = pathlib.Path.cwd() / ".env"
+    try:
+        lines = env_path.read_text(encoding="utf-8").splitlines()
+    except (OSError, UnicodeError):
+        return None
+    for line in lines:
+        key = cli_config.env_line_key(line)
+        if key not in _SESSION_TOKEN_VARIABLES:
+            continue
+        value = line.split("=", 1)[1].split(" #", 1)[0].strip().strip("\"'")
+        if value and value == (os.environ.get(key) or "").strip():
+            return env_path
+    return None
+
+
+def _jwt_reauth_hint(refresh_token: str | None = None) -> str:
+    """
+    Say why the backend refused this process's credentials and how to repair them.
+
+    The facts come from this process and this machine: the refresh token's own
+    expiry, whether the credentials were already in the environment when the SDK
+    started (and which `.env` holds them, when one does), and the saved session
+    of the backend. A pair from the environment wins over the saved session, so
+    the saved session is named and not used: the pair may belong to another user
+    or backend. No token value is included.
+    """
+    backend = _session_backend()
+    refresh = refresh_token if refresh_token is not None else os.getenv("MAINSEQUENCE_REFRESH_TOKEN")
+    expiry = _decode_jwt_exp(refresh)
+    try:
+        from mainsequence import bootstrap
+
+        source = bootstrap.credential_source()
+        from_environment = source == bootstrap.CREDENTIALS_FROM_ENVIRONMENT
+        from_store = source == bootstrap.CREDENTIALS_FROM_STORE
+    except Exception:
+        from_environment = from_store = False
+    login = _login_command(backend)
+
+    parts = []
+    if expiry is not None and expiry <= int(time.time()):
+        parts.append(f" The refresh token expired on {_format_utc(expiry)}.")
+    elif expiry is not None:
+        parts.append(
+            " The refresh token has not expired: the backend revoked it, or it was "
+            "issued by another backend."
+        )
 
     if from_environment:
-        return (
-            " The rejected credentials were set in this process's environment "
-            "(MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN) before the SDK "
-            "started: a shell export, an IDE run configuration, or a `.env` file that "
-            "your tooling loads. "
-            + (
-                "A saved CLI session exists for this backend and was not used. Remove "
-                "those variables to use it."
-                if saved_session
-                else "No saved CLI session exists for this backend. Remove those "
-                "variables and run `mainsequence login`."
+        try:
+            env_file = _env_file_holding_process_credentials()
+        except Exception:
+            env_file = None
+        try:
+            from mainsequence.cli import config as cli_config
+
+            saved = cli_config.saved_session_summary(backend)
+        except Exception:
+            saved = {"usable": False, "username": "", "expires_at": None}
+        if env_file is not None:
+            parts.append(
+                f" These credentials come from the token lines of {env_file}, not from "
+                "your saved session."
+            )
+            cleanup = f"run `mainsequence refresh-token` in {env_file.parent} to remove those lines"
+        else:
+            parts.append(
+                " These credentials were in this process's environment "
+                "(MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN) when it started, "
+                "set by the program that started it, not taken from your saved session."
+            )
+            cleanup = "start the process without those two variables"
+        if saved["usable"]:
+            who = f" ({saved['username']})" if saved["username"] else ""
+            until = (
+                f", valid until {_format_utc(saved['expires_at'])}"
+                if saved["expires_at"] is not None
+                else ""
+            )
+            parts.append(
+                f" Your saved session for {backend}{who} is usable{until}: "
+                f"{cleanup}, and the next start uses it."
             )
+        else:
+            parts.append(
+                f" There is no usable saved session for {backend}. Sign in with {login}, "
+                f"then {cleanup}."
+            )
+    elif from_store:
+        parts.append(
+            f" These credentials are your saved session for {backend}. Sign in again with {login}."
         )
-    return (
-        " Refresh your credentials with `mainsequence logout` and "
-        "`mainsequence login`. If this code runs in a separate shell or IDE, "
-        "use `mainsequence login --export` and load the exported env vars there."
-    )
+    else:
+        parts.append(f" Sign in with {login}.")
+    return "".join(parts)
 
 
 def _env_has_value(name: str) -> bool:
@@ -397,10 +500,14 @@ class JWTAuthProvider(BaseAuthProvider):
             if not force and not self._needs_refresh():
                 return
 
+            backend = _session_backend()
             if not self.refresh_token:
                 if self.access_token and not force:
                     return
-                raise AuthError("JWT refresh token is missing." + _jwt_reauth_hint())
+                raise AuthError(
+                    f"Main Sequence cannot renew the session of this process for {backend}: "
+                    "it has no refresh token." + _jwt_reauth_hint(self.refresh_token)
+                )
 
             http_client = session or requests
 
@@ -411,16 +518,24 @@ class JWTAuthProvider(BaseAuthProvider):
                 timeout=self.timeout,
             )
 
+            if r.status_code in _REFUSED_RENEWAL_STATUSES:
+                raise AuthError(
+                    f"Main Sequence refused to renew the session of this process for {backend} "
+                    f"(HTTP {r.status_code})." + _jwt_reauth_hint(self.refresh_token)
+                )
             if r.status_code != 200:
+                # The backend failed; the credentials were not judged.
                 raise AuthError(
-                    f"JWT refresh failed with status {r.status_code}." + _jwt_reauth_hint()
+                    f"Main Sequence could not renew the session of this process for {backend}: "
+                    f"the backend answered HTTP {r.status_code}. Try again when it is available."
                 )
 
             data = r.json()
             access = data.get("access")
             if not access:
                 raise AuthError(
-                    "JWT refresh response did not include access token." + _jwt_reauth_hint()
+                    f"Main Sequence renewed the session for {backend} without an access token."
+                    + _jwt_reauth_hint(self.refresh_token)
                 )
 
             # Important if ROTATE_REFRESH_TOKENS=True
@@ -604,15 +719,12 @@ def make_request(
 
             if r.status_code == 401 and loaders is not None and not auth_retried:
                 logger.warning(f"Error {r.status_code}; forcing auth refresh once")
-                try:
-                    s.headers.update(loaders.refresh_headers(force=True, session=s))
-                    req = get_req(session=s)
-                    auth_retried = True
-                    continue
-                except AuthError:
-                    logger.exception("Auth refresh failed")
-                    keep_request = False
-                    break
+                # A refused renewal raises AuthError: it is reported below with the
+                # reason and the repair, not as a traceback.
+                s.headers.update(loaders.refresh_headers(force=True, session=s))
+                req = get_req(session=s)
+                auth_retried = True
+                continue
 
             keep_request = False
             break

mainsequence/code_repository_skills.py

@@ -1,25 +1,17 @@
-"""Dual-source Main Sequence code repository skill assembly.
+"""Authenticated platform skill catalog validation and installation.
 
-The existing ``mainsequence code-repository update-agent-skills`` command has two
-canonical inputs:
-
-* SDK-owned execution skills from the target code repository's installed
-  ``agent_scaffold/skills`` tree.
-* Platform-owned skills retrieved from authenticated MCP resources.
-
-Platform content is validated in memory and written only to the target code
-repository. It is never persisted in the installed SDK package.
+SDK-owned skills are mirrored separately by ``copy_scaffold_skills`` into the
+``mainsequence`` namespace. Platform resources use ``mainsequence_platform``;
+they are never mixed into the SDK-owned namespace or installed SDK package.
 """
 
 from __future__ import annotations
 
 import hashlib
 import json
-import os
 import re
 import shutil
 import tempfile
-import uuid
 from collections.abc import Sequence
 from dataclasses import dataclass
 from pathlib import Path, PurePosixPath
@@ -29,11 +21,10 @@ import yaml
 
 from .scaffold_skills import (
     PINNED_FROM_FILENAME,
-    CopiedScaffoldSkill,
-    copy_scaffold_skills,
+    _check_code_repository_guards,
+    _replace_managed_tree,
 )
 
-DUAL_SOURCE_SENTINEL_SCHEMA = "2"
 PLATFORM_RESOURCE_NAMESPACE = "mainsequence://platform/"
 PLATFORM_ONTOLOGY_URI = "mainsequence://platform/ontology"
 PLATFORM_SKILL_URI_PREFIX = f"{PLATFORM_RESOURCE_NAMESPACE}skills/"
@@ -129,20 +120,6 @@ class InstalledCodeRepositorySkill:
     content_sha256: str | None = None
 
 
-@dataclass(frozen=True)
-class DualSourceCodeRepositorySkillInstallResult:
-    """Result of one completed dual-source CodeRepository skill update."""
-
-    code_repository_dir: Path
-    destination_root: Path
-    sentinel_path: Path
-    sdk_library_name: str
-    sdk_version: str
-    sdk_skills_path: Path
-    platform_catalog: PlatformCodeRepositorySkillCatalog
-    installed: tuple[InstalledCodeRepositorySkill, ...]
-
-
 def parse_platform_code_repository_skill_catalog(
     rows: Sequence[dict[str, Any]],
     *,
@@ -463,196 +440,70 @@ def _validate_platform_resource_payload(
     )
 
 
-def install_dual_source_code_repository_skills(
+def install_platform_code_repository_skills(
     *,
     code_repository_dir: Path,
-    sdk_library_name: str,
-    sdk_skills_path: Path,
-    sdk_version: str,
     platform_catalog: PlatformCodeRepositorySkillCatalog,
-    namespace: str = "mainsequence",
-    command: str = "mainsequence code-repository update-agent-skills",
     protected_code_repository_roots: Sequence[Path] = (),
-) -> DualSourceCodeRepositorySkillInstallResult:
-    """Install SDK-owned and platform-owned skills as one validated CodeRepository tree."""
-
-    sdk_plan = copy_scaffold_skills(
-        code_repository_dir=code_repository_dir,
-        library_name=sdk_library_name,
-        namespace=namespace,
-        skills_path=sdk_skills_path,
-        pinned_version=sdk_version,
-        command=command,
-        dry_run=True,
+) -> tuple[Path, tuple[InstalledCodeRepositorySkill, ...]]:
+    """Replace only the platform-owned mainsequence_platform skill namespace."""
+    repository = code_repository_dir.expanduser().resolve()
+    namespace = repository / ".agents" / "skills" / "mainsequence_platform"
+    if namespace.is_symlink():
+        raise CodeRepositorySkillAssemblyError("Platform namespace must not be a symlink.")
+    destination = namespace.resolve()
+    if not destination.is_relative_to(repository):
+        raise CodeRepositorySkillAssemblyError("Platform destination escapes the target checkout.")
+    _check_code_repository_guards(
+        code_repository_dir=repository,
         protected_code_repository_roots=protected_code_repository_roots,
+        code_repository_guard=None,
     )
-    _validate_source_ownership(
-        sdk_skills=sdk_plan.copied,
-        platform_skills=platform_catalog.skills,
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    staging = Path(
+        tempfile.mkdtemp(prefix=".mainsequence_platform.staging-", dir=destination.parent)
     )
-
-    destination_root = sdk_plan.destination_root
-    destination_parent = destination_root.parent
-    destination_parent.mkdir(parents=True, exist_ok=True)
-    staging_root = Path(
-        tempfile.mkdtemp(
-            prefix=f".{destination_root.name}.staging-",
-            dir=destination_parent,
-        )
-    )
-
-    installed: list[InstalledCodeRepositorySkill] = []
+    installed = []
+    lines = [
+        "schema=platform-1",
+        "owner=platform",
+        f"platform_source_url={_sentinel_value(platform_catalog.source_url)}",
+        f"platform_retrieved_at_utc={_utc_timestamp()}",
+        f"platform_manifest_version={platform_catalog.manifest_version}",
+        f"platform_manifest_sha256={platform_catalog.manifest_sha256}",
+        f"platform_ontology_sha256={platform_catalog.ontology_sha256}",
+    ]
     try:
-        for item in sdk_plan.copied:
-            staged_destination = staging_root / item.name
-            shutil.copytree(item.source, staged_destination)
-            installed.append(
-                InstalledCodeRepositorySkill(
-                    name=item.name,
-                    owner="sdk",
-                    source=str(item.source),
-                    destination=destination_root / item.name,
-                )
-            )
-
         for skill in platform_catalog.skills:
-            staged_destination = staging_root.joinpath(*skill.relative_path.parts)
-            staged_destination.parent.mkdir(parents=True, exist_ok=True)
-            staged_destination.write_text(skill.content, encoding="utf-8")
+            target = staging.joinpath(*skill.relative_path.parts)
+            if not target.resolve().is_relative_to(staging):
+                raise CodeRepositorySkillAssemblyError("Platform skill path escapes its namespace.")
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_text(skill.content, encoding="utf-8")
             installed.append(
                 InstalledCodeRepositorySkill(
                     name=skill.name,
                     owner="platform",
                     source=skill.uri,
-                    destination=destination_root.joinpath(*skill.relative_path.parts),
+                    destination=destination.joinpath(*skill.relative_path.parts),
                     content_sha256=skill.content_sha256,
                 )
             )
-
-        sentinel_path = staging_root / PINNED_FROM_FILENAME
-        sentinel_path.write_text(
-            render_dual_source_sentinel(
-                sdk_library_name=sdk_library_name,
-                namespace=namespace,
-                sdk_version=sdk_version,
-                sdk_skills_path=sdk_plan.skills_path,
-                platform_catalog=platform_catalog,
-                command=command,
-            ),
-            encoding="utf-8",
-        )
-        _replace_managed_tree(
-            staging_root=staging_root,
-            destination_root=destination_root,
-        )
+        for resource in platform_catalog.resources:
+            prefix = f"platform_resource.{resource.name}"
+            lines.extend(
+                [
+                    f"{prefix}.uri={_sentinel_value(resource.uri)}",
+                    f"{prefix}.path={_sentinel_value(str(resource.resource_path))}",
+                    f"{prefix}.content_sha256={resource.content_sha256}",
+                ]
+            )
+        (staging / PINNED_FROM_FILENAME).write_text("\n".join([*lines, ""]), encoding="utf-8")
+        _replace_managed_tree(staging_root=staging, destination_root=destination)
     except Exception:
-        if staging_root.exists():
-            shutil.rmtree(staging_root, ignore_errors=True)
-        raise
-
-    return DualSourceCodeRepositorySkillInstallResult(
-        code_repository_dir=sdk_plan.code_repository_dir,
-        destination_root=destination_root,
-        sentinel_path=destination_root / PINNED_FROM_FILENAME,
-        sdk_library_name=sdk_library_name,
-        sdk_version=sdk_version,
-        sdk_skills_path=sdk_plan.skills_path,
-        platform_catalog=platform_catalog,
-        installed=tuple(installed),
-    )
-
-
-def render_dual_source_sentinel(
-    *,
-    sdk_library_name: str,
-    namespace: str,
-    sdk_version: str,
-    sdk_skills_path: Path,
-    platform_catalog: PlatformCodeRepositorySkillCatalog,
-    command: str,
-) -> str:
-    """Render the schema-2 dual-source provenance record."""
-
-    installed_at_utc = _utc_timestamp()
-    lines = [
-        f"schema={DUAL_SOURCE_SENTINEL_SCHEMA}",
-        f"library_name={_sentinel_value(sdk_library_name)}",
-        f"namespace={_sentinel_value(namespace)}",
-        f"pinned_version={_sentinel_value(sdk_version)}",
-        f"skills_path={_sentinel_value(str(sdk_skills_path.resolve()))}",
-        f"copied_at_utc={installed_at_utc}",
-        f"installed_at_utc={installed_at_utc}",
-        f"sdk_library_name={_sentinel_value(sdk_library_name)}",
-        f"sdk_version={_sentinel_value(sdk_version)}",
-        f"sdk_skills_path={_sentinel_value(str(sdk_skills_path.resolve()))}",
-        f"platform_source_url={_sentinel_value(platform_catalog.source_url)}",
-        f"platform_retrieved_at_utc={installed_at_utc}",
-        f"platform_manifest_version={platform_catalog.manifest_version}",
-        f"platform_manifest_sha256={platform_catalog.manifest_sha256}",
-        f"platform_ontology_uri={platform_catalog.ontology_uri}",
-        f"platform_ontology_sha256={platform_catalog.ontology_sha256}",
-        f"platform_resource_count={len(platform_catalog.resources)}",
-        f"platform_skill_count={len(platform_catalog.skills)}",
-    ]
-    for resource in platform_catalog.resources:
-        prefix = f"platform_resource.{resource.name}"
-        lines.extend(
-            [
-                f"{prefix}.uri={_sentinel_value(resource.uri)}",
-                f"{prefix}.path={_sentinel_value(str(resource.resource_path))}",
-                f"{prefix}.content_sha256={resource.content_sha256}",
-            ]
-        )
-    lines.extend(
-        [
-            f"command={_sentinel_value(command)}",
-            "",
-        ]
-    )
-    return "\n".join(lines)
-
-
-def _validate_source_ownership(
-    *,
-    sdk_skills: Sequence[CopiedScaffoldSkill],
-    platform_skills: Sequence[PlatformCodeRepositorySkill],
-) -> None:
-    sdk_roots = {item.name for item in sdk_skills}
-    collisions = sorted(
-        {
-            skill.relative_path.parts[0]
-            for skill in platform_skills
-            if skill.relative_path.parts[0] in sdk_roots
-        }
-    )
-    if collisions:
-        raise CodeRepositorySkillAssemblyError(
-            "SDK/platform skill path ownership collision: "
-            + ", ".join(collisions)
-            + ". Refactor the SDK-owned skill path before updating the CodeRepository."
-        )
-
-
-def _replace_managed_tree(*, staging_root: Path, destination_root: Path) -> None:
-    backup_root = destination_root.parent / (f".{destination_root.name}.backup-{uuid.uuid4().hex}")
-    destination_existed = destination_root.exists()
-    if destination_existed:
-        os.replace(destination_root, backup_root)
-    try:
-        os.replace(staging_root, destination_root)
-    except Exception as install_exc:
-        try:
-            if destination_existed and backup_root.exists():
-                os.replace(backup_root, destination_root)
-        except Exception as rollback_exc:
-            raise CodeRepositorySkillAssemblyError(
-                "CodeRepository skill installation failed and rollback also failed: "
-                f"{rollback_exc}. The previous managed tree remains at "
-                f"{backup_root} for manual recovery."
-            ) from install_exc
+        shutil.rmtree(staging, ignore_errors=True)
         raise
-    if backup_root.exists():
-        shutil.rmtree(backup_root, ignore_errors=True)
+    return destination, tuple(installed)
 
 
 def _safe_platform_resource_path(

mainsequence/scaffold_skills.py

@@ -9,10 +9,13 @@ records the installed library version that supplied the copied skills.
 from __future__ import annotations
 
 import datetime as _datetime
+import os
 import re
 import shutil
+import tempfile
+import uuid
 from collections.abc import Callable, Sequence
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from pathlib import Path
 
 PINNED_FROM_FILENAME = "PINNED_FROM.txt"
@@ -64,9 +67,10 @@ def copy_scaffold_skills(
     """Copy packaged scaffold skills into a managed CodeRepository skill namespace.
 
     The helper copies each immediate child skill directory from `skills_path` to
-    `<code_repository_dir>/.agents/skills/<namespace>/`, overwriting only matching
-    managed skill folders. Files, hidden folders, and folders starting with
-    `__` are skipped.
+    `<code_repository_dir>/.agents/skills/<namespace>/`. That entire namespace is
+    library-owned: folders no longer shipped by the library are removed. The
+    replacement is staged and atomic. Other namespaces are never changed.
+    Source files, hidden folders, and folders starting with `__` are skipped.
 
     `pinned_version` is required and must be the installed version of the
     library that owns `skills_path`. On successful non-dry-run copies, the
@@ -86,10 +90,15 @@ def copy_scaffold_skills(
     if not resolved_skills_path.is_dir():
         raise FileNotFoundError(f"Scaffold skill source directory does not exist: {skills_path}")
 
-    destination_root = (
-        resolved_code_repository_dir / ".agents" / "skills" / resolved_namespace
-    ).resolve(strict=False)
+    destination = resolved_code_repository_dir / ".agents" / "skills" / resolved_namespace
+    if destination.is_symlink():
+        raise ScaffoldSkillCopyBlocked("Blocked: the managed namespace must not be a symlink.")
+    destination_root = destination.resolve(strict=False)
     sentinel_path = destination_root / PINNED_FROM_FILENAME
+    if not destination_root.is_relative_to(resolved_code_repository_dir):
+        raise ScaffoldSkillCopyBlocked(
+            "Blocked: destination namespace escapes the target checkout."
+        )
 
     _check_code_repository_guards(
         code_repository_dir=resolved_code_repository_dir,
@@ -134,13 +143,26 @@ def copy_scaffold_skills(
     if dry_run:
         return result
 
-    for item in copied:
-        _copy_tree_overwrite(item.source, item.destination)
-    _write_pin_sentinel(
-        result,
-        command=command,
-        copied_at_utc=_utc_timestamp(),
+    destination_root.parent.mkdir(parents=True, exist_ok=True)
+    staging_root = Path(
+        tempfile.mkdtemp(prefix=f".{resolved_namespace}.staging-", dir=destination_root.parent)
     )
+    try:
+        for item in copied:
+            shutil.copytree(item.source, staging_root / item.name)
+        _write_pin_sentinel(
+            replace(
+                result,
+                destination_root=staging_root,
+                sentinel_path=staging_root / PINNED_FROM_FILENAME,
+            ),
+            command=command,
+            copied_at_utc=_utc_timestamp(),
+        )
+        _replace_managed_tree(staging_root=staging_root, destination_root=destination_root)
+    except Exception:
+        shutil.rmtree(staging_root, ignore_errors=True)
+        raise
     return result
 
 
@@ -182,11 +204,25 @@ def _iter_skill_roots(skills_path: Path) -> list[Path]:
     ]
 
 
-def _copy_tree_overwrite(source: Path, destination: Path) -> None:
-    if destination.exists():
-        shutil.rmtree(destination)
-    destination.parent.mkdir(parents=True, exist_ok=True)
-    shutil.copytree(source, destination)
+def _replace_managed_tree(*, staging_root: Path, destination_root: Path) -> None:
+    backup_root = destination_root.parent / f".{destination_root.name}.backup-{uuid.uuid4().hex}"
+    destination_existed = destination_root.exists()
+    if destination_existed:
+        os.replace(destination_root, backup_root)
+    try:
+        os.replace(staging_root, destination_root)
+    except Exception as install_exc:
+        try:
+            if destination_existed and backup_root.exists():
+                os.replace(backup_root, destination_root)
+        except Exception as rollback_exc:
+            raise ScaffoldSkillCopyBlocked(
+                f"Skill installation and rollback failed: {rollback_exc}. "
+                f"The previous tree remains at {backup_root} for recovery."
+            ) from install_exc
+        raise
+    if backup_root.exists():
+        shutil.rmtree(backup_root, ignore_errors=True)
 
 
 def _write_pin_sentinel(

{mainsequence-9.0.1.dev30.dist-info → mainsequence-9.0.2.dev32.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.1.dev30
+Version: 9.0.2.dev32
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.1.dev30.dist-info → mainsequence-9.0.2.dev32.dist-info}/RECORD

@@ -1,8 +1,8 @@
-agent_scaffold/AGENTS.md,sha256=dd8vt0Q-ZCw3mUh5tBYG441N1aNZ6VxnlD16wgvad2Q,5828
+agent_scaffold/AGENTS.md,sha256=yLTuL2VuT47JoBa7w7eekcWhenWciySPQmO9mAIBALE,6178
 agent_scaffold/skills/a2a_sdk_execution/SKILL.md,sha256=NKtcXibE8TxZzKzz1KzJ2cVZ_EeuJJkb660U6wLvZ3s,11809
 agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=zETXg2fFCujdorOqI2yjhH4Zv1nS16il8uuohF3jz60,13883
 agent_scaffold/skills/maintenance/bug_auditor/SKILL.md,sha256=pV8g6FbSgZu1ZsrCaWAbrf6MpetxMqoZKO1rBbtZMgs,8591
-agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=U_8TILfdsUIwl0qD1zVbdEFfmjHpK8XCNXbszZfHBtQ,12693
+agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=PczPIOM1YPyXlgd7i5OyN5DkYVwGHrDowsyoxzAqsi8,13396
 agent_scaffold/skills/maintenance/metatables_transition/SKILL.md,sha256=PisgpytcksJnfZMS6aiPCmahsT3fm8DIwk_cefXA2qU,3759
 agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=o1rIlYAC7ejV7gKKf-BaglIZY1YkDO5Y27F6e2eK_94,8571
 agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md,sha256=F2I_pwzhbVW-32pBHQZfLnX6BC76iiILHZU1ewy2VYo,15245
@@ -12,18 +12,18 @@ mainsequence/__main__.py,sha256=KuAP69uduS2ImrPIgNMzbGBRepZzjqvUONu5vFh4v4A,176
 mainsequence/_request_identity.py,sha256=jiroPFVDM8vphEf9VXuggQJKUOGohfk7-pDwJSOILEw,1211
 mainsequence/bootstrap.py,sha256=AvG55Y46RcshVqJZsyqvUDN62CJg4CDbHu0Bvsbwfzs,2910
 mainsequence/code_repository_context.py,sha256=8Q1ammEJr0m8G8aMR4Mf6nLHMPe51sPr4m72PSwp3D4,28588
-mainsequence/code_repository_skills.py,sha256=rytHd9XDaHq8t9o6smNksN8gHm6hfUEPvJIGYgGkPXA,28417
+mainsequence/code_repository_skills.py,sha256=AyC1HFAxQXHXNBGbarVUJS2cHd4X5HwDx6u8XBophbE,23611
 mainsequence/defaults.py,sha256=5r6s7AI-X40rpm1D3IgcNsWam7iJg4_lIxB3F_1u2z0,408
 mainsequence/logconf.py,sha256=7OXSBb8yXrUbIbO4vX-l0vss1R8q1DlNi1-fBNkjX-w,18693
 mainsequence/repository_identity_security.py,sha256=Cdywndhiy1zJFUPh-FfM90RjZ3Hg3tjhxBr64FRhmXs,1035
 mainsequence/runtime_flags.py,sha256=1eTM7VRRhnuZ_GXcmFhqAmdEKwyQYMyZcPsio88vJRQ,378
-mainsequence/scaffold_skills.py,sha256=mhjn7Xy5BSp8711xf7jziOC-DgyI1QUNWDup-fg_7eo,8844
+mainsequence/scaffold_skills.py,sha256=k0V6eKC5AwbHr9wB9UGMJNF-8eJ0_1izF4-BU01KHrg,10606
 mainsequence/cli/__init__.py,sha256=sMWTnomCaISjnureLuXFRqOzkH2Y77uYEivsd-M6_8Y,28
 mainsequence/cli/api.py,sha256=r9D0lSaw2Ah-39i04w9JgNkg3yjq88TLesB63B6nvug,128586
 mainsequence/cli/browser_auth.py,sha256=C-Sbpt0Pr9Pv3Z9dO80TMk7zPcaaZ-4zvW0tbRVMrTU,9863
-mainsequence/cli/cli.py,sha256=RYtT5DDCvoIrZQixAQWycJyqHxa4kD0xxoXj3DU7_0Y,275424
+mainsequence/cli/cli.py,sha256=JnueoyzZ0t99m7RIwmeUNWYNPUo8gNntpcBeaL0bERk,276172
 mainsequence/cli/code_repository_status.py,sha256=SHEnU8YSWFowPG6dEdE4Yd8CS1tIcJSE1MXFLfvD3Os,5975
-mainsequence/cli/config.py,sha256=IT42UzG93uBhR98yUyg8YR-wMlQAgfx8UrybJcpih7Y,44884
+mainsequence/cli/config.py,sha256=4AGDEUPAJ1GzoDX3FzYYFvGMKfeAXM38Kh7Yv-OQLQQ,45595
 mainsequence/cli/docker_utils.py,sha256=eAnp9MI042cHWwKasA5IF2I7INL3A6tV2JX-cSIe7rc,10687
 mainsequence/cli/doctor.py,sha256=_1XHd72jheRDt7dEJHd6hbBSSpCPpMwwFDUOLcdkii8,4550
 mainsequence/cli/local_ops.py,sha256=oeYA2KXDLEjiENVZYJCc5-loNZxK3PK4G4sXldrDfm4,6495
@@ -43,16 +43,16 @@ mainsequence/client/models_foundry.py,sha256=iN1jJzDokfniEQF0Ac5eepAB7L5pVjJnKav
 mainsequence/client/models_helpers.py,sha256=rE7wPc9llKkctAKdJcak0kXJagjLivUzO2ebUGhz1M8,45820
 mainsequence/client/models_user.py,sha256=BU_hfn4-4KqYz3nsaPlXuYZmUG6_-7YM892mkM92Zyo,37613
 mainsequence/client/observability.py,sha256=_WrDKCaNk_TXmKElKCXC1inork6Exxxe8FRY4m1GI9s,16008
-mainsequence/client/utils.py,sha256=ZJNmUh9JNslznNMYvTGy26h0V9SMvYVqMX3Pva8l0lw,27549
+mainsequence/client/utils.py,sha256=fQur4p-ojLWTMcNWlYWx7uZKbGNEc4c2kJq1Wl_w070,31925
 mainsequence/client/value_sets.py,sha256=7TA-mpuAd3hOduNgO1WTQQTuNOGaFgue-VqCsDWKaC8,6181
 mainsequence/instrumentation/__init__.py,sha256=J_9XmfjprElvz0u2t9rTyJT0kFdyKpxdbkdQiaw28_U,316
 mainsequence/instrumentation/utils.py,sha256=b-ihjSioAepeLfMpudM2SqCtvnxMqIXileHx3klBCQU,3377
 mainsequence/server/__init__.py,sha256=559DiiBcCP6veWRmK2mXUEbsl7gbZofTvsbTUFjn0VE,82
 mainsequence/server/caller_assertions.py,sha256=5q8LZrDYozaonG1eBb9P8DojKQlB2i2qUJwO5VhsrW4,9780
 mainsequence/server/fastapi.py,sha256=tD1aVuJOgoBTu7H8bs9IldPNYRT4fhkr1leN3KZP1pI,10521
-mainsequence-9.0.1.dev30.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.1.dev30.dist-info/METADATA,sha256=Q29OofPgcbN1MAT1LORvrCW5DOi5sG1epdwOEw7xqLk,7435
-mainsequence-9.0.1.dev30.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.1.dev30.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.1.dev30.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.1.dev30.dist-info/RECORD,,
+mainsequence-9.0.2.dev32.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.2.dev32.dist-info/METADATA,sha256=m2rgtp3Cz2nDtlUChD40l1GN8z3VdQcl0pykNLdxDGo,7435
+mainsequence-9.0.2.dev32.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.2.dev32.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.2.dev32.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.2.dev32.dist-info/RECORD,,