mainsequence 9.0.1.dev31__py3-none-any.whl → 9.0.2.dev32__py3-none-any.whl

agent_scaffold/AGENTS.md

@@ -42,6 +42,7 @@ specific update:
 
 - `mainsequence code-repository update-sdk --path .`
 - `mainsequence code-repository update-agent-skills --path .`
+- `mainsequence code-repository update-platform-skills --path .`
 - `mainsequence code-repository update AGENTS.md --path .`
 - `uv run ms-tau skills sync --path .`
 
@@ -51,6 +52,11 @@ to report, not permission to mutate the repository. The same rule applies to
 requested, use the `code_repository_maintenance` skill. The `mainsequence` CLI
 never owns or updates the `ms_tau_sdk` namespace.
 
+The SDK owns all of `.agents/skills/mainsequence/`. Its skill copy is local,
+requires no sign-in, and deletes everything absent from the installed SDK
+bundle. Platform skills are installed separately under
+`.agents/skills/mainsequence_platform/` by the authenticated platform update.
+
 ## Route By Task
 
 - Product architecture, platform ontology, and CodeRepository Blueprint work:

agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md

@@ -172,22 +172,37 @@ to publish the CodeRepository changes.
 ## Refresh Managed Skills And Instructions
 
 Run either managed-scaffold command only when the user explicitly requests that
-specific update. When both are requested, refresh the SDK-owned and
-platform-owned skills first, then update the managed Main Sequence block in
+specific update. When both are requested, refresh the SDK-owned skills first,
+then update the managed Main Sequence block in
 `AGENTS.md`:
 
 ```bash
-mainsequence code-repository update-agent-skills --path .
-mainsequence code-repository update AGENTS.md --path .
+uv run --offline mainsequence code-repository update-agent-skills --path .
+uv run --offline mainsequence code-repository update AGENTS.md --path .
 ```
 
 Verify `.agents/skills/mainsequence/PINNED_FROM.txt` after success:
 
-- `sdk_version` must match the installed CodeRepository SDK;
-- platform manifest, ontology, and resource hashes must be present;
+- `pinned_version` must match the installed CodeRepository SDK;
+- the namespace must contain exactly the installed SDK's skill folders;
 - repository-owned skills outside `.agents/skills/mainsequence/` must remain
   untouched.
 
+The SDK owns the whole `mainsequence` namespace. Copying it requires no login
+or platform access and deletes obsolete folders, including retired table
+workflow skills. Do not preserve old or platform-owned content in that folder.
+The installed `metatables` package owns table workflows in its own namespace.
+
+When the user requests platform skills, use the separate authenticated command:
+
+```bash
+mainsequence code-repository update-platform-skills --path .
+```
+
+It owns only `.agents/skills/mainsequence_platform/` and records the platform
+manifest, ontology, and resource hashes there. A backend or authentication
+failure in this command must not block a local SDK skill copy.
+
 The skill update is staged and atomic. If it fails, report the failing lane and
 preserve the previous valid managed tree. Because this operation can update
 this skill, reload the refreshed `code_repository_maintenance/SKILL.md` before starting

mainsequence/cli/cli.py

@@ -56,8 +56,9 @@ from ..code_repository_context import (
 )
 from ..code_repository_skills import (
     CodeRepositorySkillAssemblyError,
-    install_dual_source_code_repository_skills,
+    install_platform_code_repository_skills,
 )
+from ..scaffold_skills import ScaffoldSkillCopyBlocked, copy_scaffold_skills
 from . import config as cfg
 from .api import (
     ApiError,
@@ -7845,6 +7846,33 @@ def code_repository_update_sdk(
         run_uv(uv, ["sync"], cwd=code_repository_dir)
 
     success("SDK update complete.")
+    _warn_if_sdk_skills_stale(code_repository_dir)
+
+
+def _warn_if_sdk_skills_stale(code_repository_dir: pathlib.Path) -> None:
+    try:
+        version = _code_repository_installed_package_version(code_repository_dir, "mainsequence")
+        sentinel = code_repository_dir / ".agents" / "skills" / "mainsequence" / "PINNED_FROM.txt"
+        values = (
+            dict(
+                line.split("=", 1)
+                for line in sentinel.read_text(encoding="utf-8").splitlines()
+                if "=" in line
+            )
+            if sentinel.is_file()
+            else {}
+        )
+    except (OSError, ValueError, typer.Exit):
+        warn("Could not check the vendored SDK skill pin. Run update-agent-skills to refresh it.")
+        return
+    pinned = values.get("pinned_version", values.get("sdk_version"))
+    if pinned != version:
+        warn(
+            f"Vendored SDK skills are stale or missing (pinned: {pinned or 'missing'}; installed: {version}). "
+            "No scaffold files were changed. Refresh with "
+            "`uv run --offline mainsequence code-repository update-agent-skills --path .` "
+            "and `uv run --offline mainsequence code-repository update AGENTS.md --path .`."
+        )
 
 
 @code_repository.command("update")
@@ -7935,124 +7963,61 @@ def code_repository_update_agent_skills(
     path: str | None = typer.Option(None, "--path", help="CodeRepository directory"),
 ):
     """
-    Update `.agents/skills/mainsequence` from installed SDK and platform sources.
+    Replace SDK-owned skills with the target checkout's installed SDK bundle.
 
-    The existing command copies SDK-owned execution skills from the target
-    CodeRepository's installed `agent_scaffold/skills` tree and retrieves
-    platform-owned skills from authenticated MCP resources. It validates and
-    stages both sources, then replaces only the managed `mainsequence`
-    namespace and writes one dual-source `PINNED_FROM.txt`. Bundle-root files
-    such as `AGENTS.md` are not copied by this command.
+    No sign-in or backend access is required unless a CodeRepository UID
+    assertion is supplied. The SDK owns all of .agents/skills/mainsequence:
+    files and folders absent from the installed bundle are deleted. Other
+    namespaces are untouched. AGENTS.md is refreshed separately with
+    code-repository update AGENTS.md. Platform skills use update-platform-skills.
 
     Examples
     --------
-    ```bash
-    mainsequence code-repository update-agent-skills
     mainsequence code-repository update-agent-skills --path .
-    mainsequence code-repository update-agent-skills --code-repository-uid code-repository-uid-123
-    ```
     """
-    code_repository_dir = _resolve_code_repository_dir(code_repository_id, path)
-
-    scaffold_bundle_dir = _code_repository_agent_scaffold_bundle_dir(code_repository_dir)
-    skills_dir = scaffold_bundle_dir / "skills"
-    if not skills_dir.exists() or not skills_dir.is_dir():
-        error(f"CodeRepository-installed agent_scaffold bundle is missing skills/: {skills_dir}")
-        raise typer.Exit(1)
-
-    pinned_version = _code_repository_installed_package_version(code_repository_dir, "mainsequence")
-    source_checkout_root = _mainsequence_source_checkout_root()
-    protected_code_repository_roots = (
-        (source_checkout_root,) if source_checkout_root is not None else ()
-    )
+    directory = _resolve_code_repository_dir(code_repository_id, path)
+    skills_dir = _code_repository_agent_scaffold_bundle_dir(directory) / "skills"
+    version = _code_repository_installed_package_version(directory, "mainsequence")
+    source_root = _mainsequence_source_checkout_root()
     try:
-        platform_catalog = fetch_platform_code_repository_skill_catalog()
-        install_result = install_dual_source_code_repository_skills(
-            code_repository_dir=code_repository_dir,
-            sdk_library_name="mainsequence",
+        result = copy_scaffold_skills(
+            code_repository_dir=directory,
+            library_name="mainsequence",
             namespace="mainsequence",
-            sdk_skills_path=skills_dir,
-            sdk_version=pinned_version,
-            platform_catalog=platform_catalog,
+            skills_path=skills_dir,
+            pinned_version=version,
             command="mainsequence code-repository update-agent-skills",
-            protected_code_repository_roots=protected_code_repository_roots,
+            protected_code_repository_roots=(source_root,) if source_root else (),
         )
-    except (
-        ApiError,
-        CodeRepositorySkillAssemblyError,
-        FileNotFoundError,
-        OSError,
-        ValueError,
-    ) as exc:
+    except (ScaffoldSkillCopyBlocked, FileNotFoundError, OSError, ValueError) as exc:
         error(str(exc))
         raise typer.Exit(1) from exc
-
     updated = [
-        {
-            "name": item.name,
-            "owner": item.owner,
-            "source": item.source,
-            "destination": item.destination,
-            "content_sha256": item.content_sha256,
-        }
-        for item in install_result.installed
+        {"name": item.name, "owner": "sdk", "source": item.source, "destination": item.destination}
+        for item in result.copied
     ]
-
     payload = {
-        "code_repository": code_repository_dir,
-        "library_name": install_result.sdk_library_name,
-        "namespace": "mainsequence",
-        "skills_path": install_result.sdk_skills_path,
-        "destination_root": install_result.destination_root,
-        "sentinel_path": install_result.sentinel_path,
-        "pinned_version": install_result.sdk_version,
+        "code_repository": directory,
+        "library_name": result.library_name,
+        "namespace": result.namespace,
+        "skills_path": result.skills_path,
+        "destination_root": result.destination_root,
+        "sentinel_path": result.sentinel_path,
+        "pinned_version": result.pinned_version,
         "sdk": {
-            "library_name": install_result.sdk_library_name,
-            "version": install_result.sdk_version,
-            "skills_path": install_result.sdk_skills_path,
-        },
-        "platform": {
-            "source_url": platform_catalog.source_url,
-            "manifest_version": platform_catalog.manifest_version,
-            "manifest_sha256": platform_catalog.manifest_sha256,
-            "ontology_uri": platform_catalog.ontology_uri,
-            "ontology_sha256": platform_catalog.ontology_sha256,
-            "resources": [
-                {
-                    "name": resource.name,
-                    "uri": resource.uri,
-                    "path": str(resource.resource_path),
-                    "content_sha256": resource.content_sha256,
-                }
-                for resource in platform_catalog.resources
-            ],
-            "skills": [
-                {
-                    "name": skill.name,
-                    "uri": skill.uri,
-                    "path": str(skill.relative_path),
-                    "content_sha256": skill.content_sha256,
-                }
-                for skill in platform_catalog.skills
-            ],
+            "library_name": result.library_name,
+            "version": version,
+            "skills_path": result.skills_path,
         },
         "updated_count": len(updated),
         "updated": updated,
     }
     if _emit_json(payload):
         return
-
-    success("Updated .agents/skills/mainsequence from installed SDK and platform sources.")
+    success("Replaced SDK-owned .agents/skills/mainsequence with the installed bundle.")
     print_kv(
         "CodeRepository Skill Provenance",
-        [
-            ("SDK Library", install_result.sdk_library_name),
-            ("SDK Version", install_result.sdk_version),
-            ("Platform Manifest", platform_catalog.manifest_sha256),
-            ("Platform Resources", len(platform_catalog.resources)),
-            ("Platform Skills", len(platform_catalog.skills)),
-            ("Sentinel", str(install_result.sentinel_path)),
-        ],
+        [("SDK Version", version), ("Sentinel", str(result.sentinel_path))],
     )
     print_table(
         "Updated CodeRepository Skills",
@@ -8061,6 +8026,54 @@ def code_repository_update_agent_skills(
     )
 
 
+@code_repository.command("update-platform-skills")
+def code_repository_update_platform_skills(
+    path: str | None = typer.Option(None, "--path", help="CodeRepository directory"),
+):
+    """Refresh authenticated platform skills in .agents/skills/mainsequence_platform.
+
+    This requires a signed-in session and a reachable backend. The SDK-owned
+    mainsequence namespace and other library namespaces remain untouched.
+    """
+    directory = _resolve_code_repository_dir(None, path)
+    source_root = _mainsequence_source_checkout_root()
+    try:
+        catalog = fetch_platform_code_repository_skill_catalog()
+        destination, installed = install_platform_code_repository_skills(
+            code_repository_dir=directory,
+            platform_catalog=catalog,
+            protected_code_repository_roots=(source_root,) if source_root else (),
+        )
+    except (
+        ApiError,
+        CodeRepositorySkillAssemblyError,
+        ScaffoldSkillCopyBlocked,
+        FileNotFoundError,
+        OSError,
+        ValueError,
+    ) as exc:
+        error(str(exc))
+        raise typer.Exit(1) from exc
+    payload = {
+        "code_repository": directory,
+        "namespace": "mainsequence_platform",
+        "destination_root": destination,
+        "sentinel_path": destination / "PINNED_FROM.txt",
+        "platform": {
+            "source_url": catalog.source_url,
+            "manifest_version": catalog.manifest_version,
+            "manifest_sha256": catalog.manifest_sha256,
+            "ontology_uri": catalog.ontology_uri,
+            "ontology_sha256": catalog.ontology_sha256,
+        },
+        "updated_count": len(installed),
+        "updated": [dataclasses.asdict(item) for item in installed],
+    }
+    if _emit_json(payload):
+        return
+    success("Updated .agents/skills/mainsequence_platform from the authenticated platform catalog.")
+
+
 @skills.command("list")
 def skills_list_cmd():
     """

mainsequence/code_repository_skills.py

@@ -1,25 +1,17 @@
-"""Dual-source Main Sequence code repository skill assembly.
+"""Authenticated platform skill catalog validation and installation.
 
-The existing ``mainsequence code-repository update-agent-skills`` command has two
-canonical inputs:
-
-* SDK-owned execution skills from the target code repository's installed
-  ``agent_scaffold/skills`` tree.
-* Platform-owned skills retrieved from authenticated MCP resources.
-
-Platform content is validated in memory and written only to the target code
-repository. It is never persisted in the installed SDK package.
+SDK-owned skills are mirrored separately by ``copy_scaffold_skills`` into the
+``mainsequence`` namespace. Platform resources use ``mainsequence_platform``;
+they are never mixed into the SDK-owned namespace or installed SDK package.
 """
 
 from __future__ import annotations
 
 import hashlib
 import json
-import os
 import re
 import shutil
 import tempfile
-import uuid
 from collections.abc import Sequence
 from dataclasses import dataclass
 from pathlib import Path, PurePosixPath
@@ -29,11 +21,10 @@ import yaml
 
 from .scaffold_skills import (
     PINNED_FROM_FILENAME,
-    CopiedScaffoldSkill,
-    copy_scaffold_skills,
+    _check_code_repository_guards,
+    _replace_managed_tree,
 )
 
-DUAL_SOURCE_SENTINEL_SCHEMA = "2"
 PLATFORM_RESOURCE_NAMESPACE = "mainsequence://platform/"
 PLATFORM_ONTOLOGY_URI = "mainsequence://platform/ontology"
 PLATFORM_SKILL_URI_PREFIX = f"{PLATFORM_RESOURCE_NAMESPACE}skills/"
@@ -129,20 +120,6 @@ class InstalledCodeRepositorySkill:
     content_sha256: str | None = None
 
 
-@dataclass(frozen=True)
-class DualSourceCodeRepositorySkillInstallResult:
-    """Result of one completed dual-source CodeRepository skill update."""
-
-    code_repository_dir: Path
-    destination_root: Path
-    sentinel_path: Path
-    sdk_library_name: str
-    sdk_version: str
-    sdk_skills_path: Path
-    platform_catalog: PlatformCodeRepositorySkillCatalog
-    installed: tuple[InstalledCodeRepositorySkill, ...]
-
-
 def parse_platform_code_repository_skill_catalog(
     rows: Sequence[dict[str, Any]],
     *,
@@ -463,196 +440,70 @@ def _validate_platform_resource_payload(
     )
 
 
-def install_dual_source_code_repository_skills(
+def install_platform_code_repository_skills(
     *,
     code_repository_dir: Path,
-    sdk_library_name: str,
-    sdk_skills_path: Path,
-    sdk_version: str,
     platform_catalog: PlatformCodeRepositorySkillCatalog,
-    namespace: str = "mainsequence",
-    command: str = "mainsequence code-repository update-agent-skills",
     protected_code_repository_roots: Sequence[Path] = (),
-) -> DualSourceCodeRepositorySkillInstallResult:
-    """Install SDK-owned and platform-owned skills as one validated CodeRepository tree."""
-
-    sdk_plan = copy_scaffold_skills(
-        code_repository_dir=code_repository_dir,
-        library_name=sdk_library_name,
-        namespace=namespace,
-        skills_path=sdk_skills_path,
-        pinned_version=sdk_version,
-        command=command,
-        dry_run=True,
+) -> tuple[Path, tuple[InstalledCodeRepositorySkill, ...]]:
+    """Replace only the platform-owned mainsequence_platform skill namespace."""
+    repository = code_repository_dir.expanduser().resolve()
+    namespace = repository / ".agents" / "skills" / "mainsequence_platform"
+    if namespace.is_symlink():
+        raise CodeRepositorySkillAssemblyError("Platform namespace must not be a symlink.")
+    destination = namespace.resolve()
+    if not destination.is_relative_to(repository):
+        raise CodeRepositorySkillAssemblyError("Platform destination escapes the target checkout.")
+    _check_code_repository_guards(
+        code_repository_dir=repository,
         protected_code_repository_roots=protected_code_repository_roots,
+        code_repository_guard=None,
     )
-    _validate_source_ownership(
-        sdk_skills=sdk_plan.copied,
-        platform_skills=platform_catalog.skills,
+    destination.parent.mkdir(parents=True, exist_ok=True)
+    staging = Path(
+        tempfile.mkdtemp(prefix=".mainsequence_platform.staging-", dir=destination.parent)
     )
-
-    destination_root = sdk_plan.destination_root
-    destination_parent = destination_root.parent
-    destination_parent.mkdir(parents=True, exist_ok=True)
-    staging_root = Path(
-        tempfile.mkdtemp(
-            prefix=f".{destination_root.name}.staging-",
-            dir=destination_parent,
-        )
-    )
-
-    installed: list[InstalledCodeRepositorySkill] = []
+    installed = []
+    lines = [
+        "schema=platform-1",
+        "owner=platform",
+        f"platform_source_url={_sentinel_value(platform_catalog.source_url)}",
+        f"platform_retrieved_at_utc={_utc_timestamp()}",
+        f"platform_manifest_version={platform_catalog.manifest_version}",
+        f"platform_manifest_sha256={platform_catalog.manifest_sha256}",
+        f"platform_ontology_sha256={platform_catalog.ontology_sha256}",
+    ]
     try:
-        for item in sdk_plan.copied:
-            staged_destination = staging_root / item.name
-            shutil.copytree(item.source, staged_destination)
-            installed.append(
-                InstalledCodeRepositorySkill(
-                    name=item.name,
-                    owner="sdk",
-                    source=str(item.source),
-                    destination=destination_root / item.name,
-                )
-            )
-
         for skill in platform_catalog.skills:
-            staged_destination = staging_root.joinpath(*skill.relative_path.parts)
-            staged_destination.parent.mkdir(parents=True, exist_ok=True)
-            staged_destination.write_text(skill.content, encoding="utf-8")
+            target = staging.joinpath(*skill.relative_path.parts)
+            if not target.resolve().is_relative_to(staging):
+                raise CodeRepositorySkillAssemblyError("Platform skill path escapes its namespace.")
+            target.parent.mkdir(parents=True, exist_ok=True)
+            target.write_text(skill.content, encoding="utf-8")
             installed.append(
                 InstalledCodeRepositorySkill(
                     name=skill.name,
                     owner="platform",
                     source=skill.uri,
-                    destination=destination_root.joinpath(*skill.relative_path.parts),
+                    destination=destination.joinpath(*skill.relative_path.parts),
                     content_sha256=skill.content_sha256,
                 )
             )
-
-        sentinel_path = staging_root / PINNED_FROM_FILENAME
-        sentinel_path.write_text(
-            render_dual_source_sentinel(
-                sdk_library_name=sdk_library_name,
-                namespace=namespace,
-                sdk_version=sdk_version,
-                sdk_skills_path=sdk_plan.skills_path,
-                platform_catalog=platform_catalog,
-                command=command,
-            ),
-            encoding="utf-8",
-        )
-        _replace_managed_tree(
-            staging_root=staging_root,
-            destination_root=destination_root,
-        )
+        for resource in platform_catalog.resources:
+            prefix = f"platform_resource.{resource.name}"
+            lines.extend(
+                [
+                    f"{prefix}.uri={_sentinel_value(resource.uri)}",
+                    f"{prefix}.path={_sentinel_value(str(resource.resource_path))}",
+                    f"{prefix}.content_sha256={resource.content_sha256}",
+                ]
+            )
+        (staging / PINNED_FROM_FILENAME).write_text("\n".join([*lines, ""]), encoding="utf-8")
+        _replace_managed_tree(staging_root=staging, destination_root=destination)
     except Exception:
-        if staging_root.exists():
-            shutil.rmtree(staging_root, ignore_errors=True)
-        raise
-
-    return DualSourceCodeRepositorySkillInstallResult(
-        code_repository_dir=sdk_plan.code_repository_dir,
-        destination_root=destination_root,
-        sentinel_path=destination_root / PINNED_FROM_FILENAME,
-        sdk_library_name=sdk_library_name,
-        sdk_version=sdk_version,
-        sdk_skills_path=sdk_plan.skills_path,
-        platform_catalog=platform_catalog,
-        installed=tuple(installed),
-    )
-
-
-def render_dual_source_sentinel(
-    *,
-    sdk_library_name: str,
-    namespace: str,
-    sdk_version: str,
-    sdk_skills_path: Path,
-    platform_catalog: PlatformCodeRepositorySkillCatalog,
-    command: str,
-) -> str:
-    """Render the schema-2 dual-source provenance record."""
-
-    installed_at_utc = _utc_timestamp()
-    lines = [
-        f"schema={DUAL_SOURCE_SENTINEL_SCHEMA}",
-        f"library_name={_sentinel_value(sdk_library_name)}",
-        f"namespace={_sentinel_value(namespace)}",
-        f"pinned_version={_sentinel_value(sdk_version)}",
-        f"skills_path={_sentinel_value(str(sdk_skills_path.resolve()))}",
-        f"copied_at_utc={installed_at_utc}",
-        f"installed_at_utc={installed_at_utc}",
-        f"sdk_library_name={_sentinel_value(sdk_library_name)}",
-        f"sdk_version={_sentinel_value(sdk_version)}",
-        f"sdk_skills_path={_sentinel_value(str(sdk_skills_path.resolve()))}",
-        f"platform_source_url={_sentinel_value(platform_catalog.source_url)}",
-        f"platform_retrieved_at_utc={installed_at_utc}",
-        f"platform_manifest_version={platform_catalog.manifest_version}",
-        f"platform_manifest_sha256={platform_catalog.manifest_sha256}",
-        f"platform_ontology_uri={platform_catalog.ontology_uri}",
-        f"platform_ontology_sha256={platform_catalog.ontology_sha256}",
-        f"platform_resource_count={len(platform_catalog.resources)}",
-        f"platform_skill_count={len(platform_catalog.skills)}",
-    ]
-    for resource in platform_catalog.resources:
-        prefix = f"platform_resource.{resource.name}"
-        lines.extend(
-            [
-                f"{prefix}.uri={_sentinel_value(resource.uri)}",
-                f"{prefix}.path={_sentinel_value(str(resource.resource_path))}",
-                f"{prefix}.content_sha256={resource.content_sha256}",
-            ]
-        )
-    lines.extend(
-        [
-            f"command={_sentinel_value(command)}",
-            "",
-        ]
-    )
-    return "\n".join(lines)
-
-
-def _validate_source_ownership(
-    *,
-    sdk_skills: Sequence[CopiedScaffoldSkill],
-    platform_skills: Sequence[PlatformCodeRepositorySkill],
-) -> None:
-    sdk_roots = {item.name for item in sdk_skills}
-    collisions = sorted(
-        {
-            skill.relative_path.parts[0]
-            for skill in platform_skills
-            if skill.relative_path.parts[0] in sdk_roots
-        }
-    )
-    if collisions:
-        raise CodeRepositorySkillAssemblyError(
-            "SDK/platform skill path ownership collision: "
-            + ", ".join(collisions)
-            + ". Refactor the SDK-owned skill path before updating the CodeRepository."
-        )
-
-
-def _replace_managed_tree(*, staging_root: Path, destination_root: Path) -> None:
-    backup_root = destination_root.parent / (f".{destination_root.name}.backup-{uuid.uuid4().hex}")
-    destination_existed = destination_root.exists()
-    if destination_existed:
-        os.replace(destination_root, backup_root)
-    try:
-        os.replace(staging_root, destination_root)
-    except Exception as install_exc:
-        try:
-            if destination_existed and backup_root.exists():
-                os.replace(backup_root, destination_root)
-        except Exception as rollback_exc:
-            raise CodeRepositorySkillAssemblyError(
-                "CodeRepository skill installation failed and rollback also failed: "
-                f"{rollback_exc}. The previous managed tree remains at "
-                f"{backup_root} for manual recovery."
-            ) from install_exc
+        shutil.rmtree(staging, ignore_errors=True)
         raise
-    if backup_root.exists():
-        shutil.rmtree(backup_root, ignore_errors=True)
+    return destination, tuple(installed)
 
 
 def _safe_platform_resource_path(

mainsequence/scaffold_skills.py

@@ -9,10 +9,13 @@ records the installed library version that supplied the copied skills.
 from __future__ import annotations
 
 import datetime as _datetime
+import os
 import re
 import shutil
+import tempfile
+import uuid
 from collections.abc import Callable, Sequence
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from pathlib import Path
 
 PINNED_FROM_FILENAME = "PINNED_FROM.txt"
@@ -64,9 +67,10 @@ def copy_scaffold_skills(
     """Copy packaged scaffold skills into a managed CodeRepository skill namespace.
 
     The helper copies each immediate child skill directory from `skills_path` to
-    `<code_repository_dir>/.agents/skills/<namespace>/`, overwriting only matching
-    managed skill folders. Files, hidden folders, and folders starting with
-    `__` are skipped.
+    `<code_repository_dir>/.agents/skills/<namespace>/`. That entire namespace is
+    library-owned: folders no longer shipped by the library are removed. The
+    replacement is staged and atomic. Other namespaces are never changed.
+    Source files, hidden folders, and folders starting with `__` are skipped.
 
     `pinned_version` is required and must be the installed version of the
     library that owns `skills_path`. On successful non-dry-run copies, the
@@ -86,10 +90,15 @@ def copy_scaffold_skills(
     if not resolved_skills_path.is_dir():
         raise FileNotFoundError(f"Scaffold skill source directory does not exist: {skills_path}")
 
-    destination_root = (
-        resolved_code_repository_dir / ".agents" / "skills" / resolved_namespace
-    ).resolve(strict=False)
+    destination = resolved_code_repository_dir / ".agents" / "skills" / resolved_namespace
+    if destination.is_symlink():
+        raise ScaffoldSkillCopyBlocked("Blocked: the managed namespace must not be a symlink.")
+    destination_root = destination.resolve(strict=False)
     sentinel_path = destination_root / PINNED_FROM_FILENAME
+    if not destination_root.is_relative_to(resolved_code_repository_dir):
+        raise ScaffoldSkillCopyBlocked(
+            "Blocked: destination namespace escapes the target checkout."
+        )
 
     _check_code_repository_guards(
         code_repository_dir=resolved_code_repository_dir,
@@ -134,13 +143,26 @@ def copy_scaffold_skills(
     if dry_run:
         return result
 
-    for item in copied:
-        _copy_tree_overwrite(item.source, item.destination)
-    _write_pin_sentinel(
-        result,
-        command=command,
-        copied_at_utc=_utc_timestamp(),
+    destination_root.parent.mkdir(parents=True, exist_ok=True)
+    staging_root = Path(
+        tempfile.mkdtemp(prefix=f".{resolved_namespace}.staging-", dir=destination_root.parent)
     )
+    try:
+        for item in copied:
+            shutil.copytree(item.source, staging_root / item.name)
+        _write_pin_sentinel(
+            replace(
+                result,
+                destination_root=staging_root,
+                sentinel_path=staging_root / PINNED_FROM_FILENAME,
+            ),
+            command=command,
+            copied_at_utc=_utc_timestamp(),
+        )
+        _replace_managed_tree(staging_root=staging_root, destination_root=destination_root)
+    except Exception:
+        shutil.rmtree(staging_root, ignore_errors=True)
+        raise
     return result
 
 
@@ -182,11 +204,25 @@ def _iter_skill_roots(skills_path: Path) -> list[Path]:
     ]
 
 
-def _copy_tree_overwrite(source: Path, destination: Path) -> None:
-    if destination.exists():
-        shutil.rmtree(destination)
-    destination.parent.mkdir(parents=True, exist_ok=True)
-    shutil.copytree(source, destination)
+def _replace_managed_tree(*, staging_root: Path, destination_root: Path) -> None:
+    backup_root = destination_root.parent / f".{destination_root.name}.backup-{uuid.uuid4().hex}"
+    destination_existed = destination_root.exists()
+    if destination_existed:
+        os.replace(destination_root, backup_root)
+    try:
+        os.replace(staging_root, destination_root)
+    except Exception as install_exc:
+        try:
+            if destination_existed and backup_root.exists():
+                os.replace(backup_root, destination_root)
+        except Exception as rollback_exc:
+            raise ScaffoldSkillCopyBlocked(
+                f"Skill installation and rollback failed: {rollback_exc}. "
+                f"The previous tree remains at {backup_root} for recovery."
+            ) from install_exc
+        raise
+    if backup_root.exists():
+        shutil.rmtree(backup_root, ignore_errors=True)
 
 
 def _write_pin_sentinel(

{mainsequence-9.0.1.dev31.dist-info → mainsequence-9.0.2.dev32.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.1.dev31
+Version: 9.0.2.dev32
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.1.dev31.dist-info → mainsequence-9.0.2.dev32.dist-info}/RECORD

@@ -1,8 +1,8 @@
-agent_scaffold/AGENTS.md,sha256=dd8vt0Q-ZCw3mUh5tBYG441N1aNZ6VxnlD16wgvad2Q,5828
+agent_scaffold/AGENTS.md,sha256=yLTuL2VuT47JoBa7w7eekcWhenWciySPQmO9mAIBALE,6178
 agent_scaffold/skills/a2a_sdk_execution/SKILL.md,sha256=NKtcXibE8TxZzKzz1KzJ2cVZ_EeuJJkb660U6wLvZ3s,11809
 agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=zETXg2fFCujdorOqI2yjhH4Zv1nS16il8uuohF3jz60,13883
 agent_scaffold/skills/maintenance/bug_auditor/SKILL.md,sha256=pV8g6FbSgZu1ZsrCaWAbrf6MpetxMqoZKO1rBbtZMgs,8591
-agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=U_8TILfdsUIwl0qD1zVbdEFfmjHpK8XCNXbszZfHBtQ,12693
+agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=PczPIOM1YPyXlgd7i5OyN5DkYVwGHrDowsyoxzAqsi8,13396
 agent_scaffold/skills/maintenance/metatables_transition/SKILL.md,sha256=PisgpytcksJnfZMS6aiPCmahsT3fm8DIwk_cefXA2qU,3759
 agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=o1rIlYAC7ejV7gKKf-BaglIZY1YkDO5Y27F6e2eK_94,8571
 agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md,sha256=F2I_pwzhbVW-32pBHQZfLnX6BC76iiILHZU1ewy2VYo,15245
@@ -12,16 +12,16 @@ mainsequence/__main__.py,sha256=KuAP69uduS2ImrPIgNMzbGBRepZzjqvUONu5vFh4v4A,176
 mainsequence/_request_identity.py,sha256=jiroPFVDM8vphEf9VXuggQJKUOGohfk7-pDwJSOILEw,1211
 mainsequence/bootstrap.py,sha256=AvG55Y46RcshVqJZsyqvUDN62CJg4CDbHu0Bvsbwfzs,2910
 mainsequence/code_repository_context.py,sha256=8Q1ammEJr0m8G8aMR4Mf6nLHMPe51sPr4m72PSwp3D4,28588
-mainsequence/code_repository_skills.py,sha256=rytHd9XDaHq8t9o6smNksN8gHm6hfUEPvJIGYgGkPXA,28417
+mainsequence/code_repository_skills.py,sha256=AyC1HFAxQXHXNBGbarVUJS2cHd4X5HwDx6u8XBophbE,23611
 mainsequence/defaults.py,sha256=5r6s7AI-X40rpm1D3IgcNsWam7iJg4_lIxB3F_1u2z0,408
 mainsequence/logconf.py,sha256=7OXSBb8yXrUbIbO4vX-l0vss1R8q1DlNi1-fBNkjX-w,18693
 mainsequence/repository_identity_security.py,sha256=Cdywndhiy1zJFUPh-FfM90RjZ3Hg3tjhxBr64FRhmXs,1035
 mainsequence/runtime_flags.py,sha256=1eTM7VRRhnuZ_GXcmFhqAmdEKwyQYMyZcPsio88vJRQ,378
-mainsequence/scaffold_skills.py,sha256=mhjn7Xy5BSp8711xf7jziOC-DgyI1QUNWDup-fg_7eo,8844
+mainsequence/scaffold_skills.py,sha256=k0V6eKC5AwbHr9wB9UGMJNF-8eJ0_1izF4-BU01KHrg,10606
 mainsequence/cli/__init__.py,sha256=sMWTnomCaISjnureLuXFRqOzkH2Y77uYEivsd-M6_8Y,28
 mainsequence/cli/api.py,sha256=r9D0lSaw2Ah-39i04w9JgNkg3yjq88TLesB63B6nvug,128586
 mainsequence/cli/browser_auth.py,sha256=C-Sbpt0Pr9Pv3Z9dO80TMk7zPcaaZ-4zvW0tbRVMrTU,9863
-mainsequence/cli/cli.py,sha256=RYtT5DDCvoIrZQixAQWycJyqHxa4kD0xxoXj3DU7_0Y,275424
+mainsequence/cli/cli.py,sha256=JnueoyzZ0t99m7RIwmeUNWYNPUo8gNntpcBeaL0bERk,276172
 mainsequence/cli/code_repository_status.py,sha256=SHEnU8YSWFowPG6dEdE4Yd8CS1tIcJSE1MXFLfvD3Os,5975
 mainsequence/cli/config.py,sha256=4AGDEUPAJ1GzoDX3FzYYFvGMKfeAXM38Kh7Yv-OQLQQ,45595
 mainsequence/cli/docker_utils.py,sha256=eAnp9MI042cHWwKasA5IF2I7INL3A6tV2JX-cSIe7rc,10687
@@ -50,9 +50,9 @@ mainsequence/instrumentation/utils.py,sha256=b-ihjSioAepeLfMpudM2SqCtvnxMqIXileH
 mainsequence/server/__init__.py,sha256=559DiiBcCP6veWRmK2mXUEbsl7gbZofTvsbTUFjn0VE,82
 mainsequence/server/caller_assertions.py,sha256=5q8LZrDYozaonG1eBb9P8DojKQlB2i2qUJwO5VhsrW4,9780
 mainsequence/server/fastapi.py,sha256=tD1aVuJOgoBTu7H8bs9IldPNYRT4fhkr1leN3KZP1pI,10521
-mainsequence-9.0.1.dev31.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.1.dev31.dist-info/METADATA,sha256=tBbhF0Sh9XpmEJpvbriT_X9qLEDwZ5tRQqHdiM2wBPU,7435
-mainsequence-9.0.1.dev31.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.1.dev31.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.1.dev31.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.1.dev31.dist-info/RECORD,,
+mainsequence-9.0.2.dev32.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.2.dev32.dist-info/METADATA,sha256=m2rgtp3Cz2nDtlUChD40l1GN8z3VdQcl0pykNLdxDGo,7435
+mainsequence-9.0.2.dev32.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.2.dev32.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.2.dev32.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.2.dev32.dist-info/RECORD,,