mainsequence 9.0.23.dev66__py3-none-any.whl → 9.0.24.dev67__py3-none-any.whl

agent_scaffold/skills/maintenance/bug_auditor/SKILL.md

@@ -67,7 +67,7 @@ This skill audits. It does not implement by default.
 
 ## Read First
 
-1. `AGENTS.md`
+1. Repository instructions, including `AGENTS.md` when present.
 2. the relevant installed skill and version-aligned documentation for the failing workflow
 
 ## Inputs This Skill Needs

agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: mainsequence-code-repository-maintenance
-description: Maintain an existing Main Sequence CodeRepository checkout using the SDK-version-matched CLI. Use for inspecting repository state, building or repairing .venv, refreshing local authentication, performing explicitly requested SDK, skill, or AGENTS.md updates, refreshing dependency files with CodeRepository sync, publishing changes with Git, or diagnosing a partially completed maintenance workflow.
+description: Maintain an existing Main Sequence CodeRepository checkout using the SDK-version-matched CLI. Use for inspecting repository state, building or repairing .venv, refreshing local authentication, performing explicitly requested SDK or skill updates, refreshing dependency files with CodeRepository sync, publishing changes with Git, or diagnosing a partially completed maintenance workflow.
 ---
 
 # Main Sequence CodeRepository Maintenance
@@ -16,7 +16,7 @@ workflows.
 Own:
 
 - local CodeRepository inspection and maintenance sequencing;
-- `.venv`, SDK, managed skill, `AGENTS.md`, dependency sync, and Git publishing
+- `.venv`, SDK, managed skill, dependency sync, and Git publishing
   workflows;
 - precondition checks, explicit approval gates, and partial-failure diagnosis.
 
@@ -45,7 +45,8 @@ fall back to credential claims or injected CodeRepositoryBranch values.
 
 ## Inspect Before Changing State
 
-1. Read `AGENTS.md` and the relevant repository skills.
+1. Follow repository instructions, including `AGENTS.md` when present, and read
+   the relevant skills. The SDK never scaffolds or edits repository `AGENTS.md`.
 2. Confirm the repository root and the user's requested maintenance outcome.
 3. Inspect code repository and Git state:
 
@@ -55,11 +56,10 @@ fall back to credential claims or injected CodeRepositoryBranch values.
    git status --short
    ```
 
-   The `code-repository current` result must report the logical `code_repository_uid`, current
-   `git_branch`, `code_repository_branch_uid`, and `code_repository_branch_status=resolved`.
-   Treat a detached checkout, unresolved repository, or unresolved/unregistered
-   Git branch as a maintenance preflight failure before any
-   mutating workflow.
+   Before branch-owned platform operations, require the current Git branch,
+   `code_repository_branch_uid`, and `code_repository_branch_status=resolved`.
+   Local environment and skill updates do not require a registered platform
+   branch or a signed-in session.
 
 4. Separate existing user changes from changes created by the maintenance
    task. Never assume every uncommitted file belongs to the current task.
@@ -173,17 +173,14 @@ the failure. On success, reload this maintenance skill before continuing.
 Do not automatically commit or push an SDK update unless the user also asked
 to publish the CodeRepository changes.
 
-## Refresh Managed Skills And Instructions
+## Refresh SDK Skills And Instructions
 
-Outside the skill refresh included in `update-sdk`, run either managed-scaffold
-command only when the user explicitly requests that specific update. When both
-are requested, refresh the SDK-owned skills first,
-then update the managed Main Sequence block in
-`AGENTS.md`:
+SDK instructions and domain skills are one versioned bundle. Outside the
+refresh included in `update-sdk`, run this command only when the user explicitly
+requests a skill update:
 
 ```bash
 uv run --offline mainsequence code-repository update-agent-skills --path .
-uv run --offline mainsequence code-repository update AGENTS.md --path .
 ```
 
 Verify `.agents/skills/mainsequence/PINNED_FROM.txt` after success:
@@ -198,6 +195,13 @@ or platform access and deletes obsolete folders, including retired table
 workflow skills. Do not preserve old or platform-owned content in that folder.
 The installed `metatables` package owns table workflows in its own namespace.
 
+A missing or mismatched sentinel is a condition to report, not permission to
+update. The same applies to other libraries' sentinels. The `mainsequence` CLI
+does not manage `.agents/skills/ms_tau_sdk/`; its owner refreshes that namespace
+with `uv run ms-tau skills sync --path .` when requested. Keep repository-owned
+`AGENTS.md` as written, including any older managed blocks. Removing such a
+block is a separate repository edit requested by its owner.
+
 When the user requests platform skills, use the separate authenticated command:
 
 ```bash
@@ -419,7 +423,7 @@ Never rerun an entire mutating workflow blindly.
 
 ## Validate And Report
 
-Run only repository-relevant validation discovered from `AGENTS.md`, repository
+Run only repository-relevant validation discovered from existing repository instructions,
 documentation, and the changed files. Report:
 
 - the maintenance routine performed;

agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md

@@ -58,7 +58,7 @@ This skill only reasons about access to deployed resources such as `ResourceRele
 
 ## Read First
 
-1. `AGENTS.md`
+1. Repository instructions, including `AGENTS.md` when present.
 2. <https://mainsequence-sdk.github.io/mainsequence-sdk/knowledge/infrastructure/users_and_access/>
 3. <https://mainsequence-sdk.github.io/mainsequence-sdk/knowledge/infrastructure/constants_and_secrets/>
 

agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md

@@ -48,7 +48,7 @@ This skill must not claim ownership of:
 
 ## Read First
 
-1. `AGENTS.md`
+1. Repository instructions, including `AGENTS.md` when present.
 2. <https://mainsequence-sdk.github.io/mainsequence-sdk/knowledge/infrastructure/scheduling_jobs/>
 3. <https://mainsequence-sdk.github.io/mainsequence-sdk/knowledge/infrastructure/artifacts/>
 4. <https://mainsequence-sdk.github.io/mainsequence-sdk/knowledge/infrastructure/owner_observability/> when inspecting logs or resource usage

agent_scaffold/skills/sdk_code_repository_execution/SKILL.md

@@ -1,241 +1,131 @@
 ---
 name: mainsequence-sdk-code-repository-execution
-description: Use the installed Main Sequence SDK and repository-local tools to verify CodeRepository context, apply local scaffold conventions, and route concrete implementation work. Use a platform-owned design skill first only when architecture or ontology is unresolved.
+description: Use the installed Main Sequence SDK and CLI for Git-derived CodeRepository context, version-matched contract authority, and selecting the relevant SDK or domain-package skill. Use for repository integration and SDK execution questions; use a platform-owned design skill when architecture or ontology is unresolved.
 ---
 
 # Main Sequence SDK CodeRepository Execution
 
-## Overview
-
-Use this SDK-owned skill for local SDK, CLI, filesystem, repository mechanics,
-and implementation routing. A platform-owned design skill is required first
-only when product architecture, ontology, or the CodeRepository Blueprint is
-unresolved. Maintenance, audits, and already-scoped implementation work do not
-require a design-first sequence.
-
-This skill is for:
-
-- establishing code repository context
-- defining success up front
-- enforcing a docs-first workflow
-- verifying platform context before making claims
-- routing work to the correct specialized skill
-
-## This Skill Can Do
-
-- determine the correct startup and read order
-- define a concrete success condition before implementation starts
-- verify current code repository and platform context
-- decide which specialized skill owns the actual domain work
-- enforce standard Main Sequence repository structure expectations
-- separate verified facts from assumptions
-- surface documentation mismatches to the user
-
-## This Skill Must Not Claim
-
-This skill must not claim ownership of:
-
-- domain-package data modeling and execution
-- Command Center-serving FastAPI contract and release design
-- jobs, schedules, images, resources, or releases
-- RBAC or sharing semantics
-- domain assets, translation tables, or construction logic
-- unsupported application deployment targets
-- pricing-runtime semantics
-
-Do not let this skill become a domain manual.
-
-## Route Adjacent Work
-
-- MetaTables, table updates, and domain data discovery: use the installed
-  `metatables` package skills and documentation
-- FastAPI APIs serving the Command Center frontend, and MCP tools and skills
-  served from a FastAPI release:
-  `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
-- CodeRepository audits, blocker analysis, and upstream SDK assessment:
-  `.agents/skills/mainsequence/maintenance/bug_auditor/SKILL.md`
-- local environment repair, CodeRepository authentication refresh, SDK updates,
-  managed skill refresh, dependency sync, and publishing with Git:
+Use this skill for SDK execution and CodeRepository integration. Follow the
+repository's own instructions, including `AGENTS.md` when present. A repository
+does not need that file to use the SDK or its skills, and the SDK does not
+create, copy, update, or remove it.
+
+## Contract Authority
+
+- Installed SDK code, CLI help, SDK skills, and version-matched documentation
+  define client behavior.
+- Installed platform skills and backend-advertised schemas, templates, and
+  capabilities define the platform contract.
+- Use the owning domain package and its installed skills before implementing
+  against an unfamiliar domain contract.
+- Treat the public SDK documentation as supplemental when its version differs
+  from the installed package:
+  `https://mainsequence-sdk.github.io/mainsequence-sdk/`
+- When the client and platform disagree, record the exact failing operation
+  and evidence with the bug-auditor skill. Do not guess or upgrade automatically.
+
+## Select The Relevant Skill
+
+Use skill descriptions to select the domain involved in the request. This skill
+is not a mandatory first step for maintenance, audits, or already-scoped domain
+work. A platform design skill is useful when product architecture, ontology, or
+the CodeRepository Blueprint is unresolved; select it from the installed
+platform catalog rather than assuming its filesystem path.
+Use that catalog to select platform-owned CodeRepository-to-Agent setup and
+other platform capabilities as well.
+
+- Environment repair, authentication, explicitly requested updates, dependency
+  sync, and Git publishing:
   `.agents/skills/mainsequence/maintenance/code_repository_maintenance/SKILL.md`
-- jobs, schedules, artifacts, images, resources, and releases:
+- Failure classification and SDK/platform contract mismatches:
+  `.agents/skills/mainsequence/maintenance/bug_auditor/SKILL.md`
+- FastAPI APIs serving Command Center, including MCP tools and skills:
+  `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
+- Jobs, schedules, images, resources, releases, and Artifacts:
   `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`
-- RBAC and sharing:
+- RBAC, sharing, constants, secrets, and acting for a requester:
   `.agents/skills/mainsequence/platform_operations/access_control_and_sharing/SKILL.md`
-- direct recorded inference, structured extraction, thinking/provider controls,
-  conversation history and safe replay:
+- Recorded model calls, structured extraction, provider options, history, and replay:
   `.agents/skills/mainsequence/mainsequence-inference/SKILL.md`
-- TAU-based Harness Agent repository integration, local development, project
-  customization, and runtime A2A adaptation: use the version-matched skills in
-  `.agents/skills/ms_tau_sdk/` after the platform-owned skill defines the
-  platform contract. If the namespace is absent, report it; synchronize it with
+- A2A session discovery, messages, files, and SDK response handling:
+  `.agents/skills/mainsequence/a2a_sdk_execution/SKILL.md`
+- Retired SDK MetaTables imports or commands:
+  `.agents/skills/mainsequence/maintenance/metatables_transition/SKILL.md`
+- Current MetaTable modeling, queries, table updates, and Alembic changes:
+  use the installed `metatables` package's skills and documentation.
+- TAU Harness Agent implementation: use the version-matched skills under
+  `.agents/skills/ms_tau_sdk/` after the relevant platform skill establishes
+  its contract. If those skills are missing, report that; run
   `uv run ms-tau skills sync --path .` only when the user requests that update.
 
-## Read First
-
-1. `AGENTS.md`
-2. the relevant documentation for the installed SDK and current platform contract
-
-Canonical documentation root:
-`https://mainsequence-sdk.github.io/mainsequence-sdk/`
-
-## Inputs This Skill Needs
-
-Before starting non-trivial work, collect or infer:
-
-- the user goal
-- the concrete success condition
-- the repository path and current code repository context
-- whether live platform verification is required
-- which specialized skill should own the domain behavior
-
-If the user goal or code repository context is unclear, stop before routing domain work.
-
-## Resolve Local CodeRepository Context From Git
+## Resolve CodeRepository Context From Git
 
 The containing Git worktree is the only source of repository, attached branch,
 and exact commit identity. The SDK normalizes the non-secret repository remote,
-maps it to CodeRepository and CodeRepositoryBranch through the platform API, resolves once for
-the process, and reuses the immutable result. Authentication selects credentials
-and permissions; it does not select source identity. A `git switch` performed in
-a long-running process takes effect only in the next CLI invocation, worker,
-script, or other process run.
-
-Use `mainsequence code-repository current --debug --json` to verify that Git context resolves
-to `code_repository_branch_status=resolved` and a nonempty `code_repository_branch_uid`. The UID
-is an internal resolution result for branch-owned platform calls; it is not a
-local or environment configuration input. Never require the user to look it up,
-persist CodeRepository identity in `.env`, accept a branch environment override, or
-infer a branch from collection order. Local and deployed code repository images use the
-same Git algorithm. A detached checkout or an unregistered Git branch is
-unresolved context and must block only live branch-owned operations.
-
-Keep the platform boundaries explicit:
-
-- use the Git-resolved logical CodeRepository UID for aggregate identity and CodeRepository operations;
-- let the SDK resolve the current Git branch to CodeRepositoryBranch only when Jobs,
-  images, releases, resources, pods, or other branch-owned APIs require it;
-- treat GitHubRepositoryBinding as repository metadata and clone-location ownership;
+maps it to CodeRepository and CodeRepositoryBranch through the platform API,
+resolves once for the process, and reuses the immutable result. Authentication
+selects credentials and permissions; it does not select source identity.
+A `git switch` in a long-running process takes effect in the next CLI invocation,
+worker, script, or other process run.
+
+For a live branch-owned operation, use
+`mainsequence code-repository current --debug --json` to verify that Git context
+resolves to `code_repository_branch_status=resolved` and a nonempty
+`code_repository_branch_uid`. The UID is an internal resolution result, not a
+local configuration input. Never ask the user to look it up, persist repository
+identity in `.env`, accept a branch environment override, or infer a branch
+from collection order. Local and deployed images use the same Git algorithm.
+
+A detached checkout or an unregistered Git branch remains usable for ordinary
+local development but has no resolved CodeRepositoryBranch or Environment.
+Only operations requiring that context fail. Register the branch before
+using branch-owned Jobs, images, releases, resources, pods, or other platform
+APIs. Never fall back to another branch.
+
+Keep these platform identities distinct:
+
+- Git-resolved CodeRepository UID: aggregate identity and repository operations.
+- CodeRepositoryBranch: resolved by the SDK when branch-owned APIs require it.
+- GitHubRepositoryBinding: repository metadata and clone-location ownership;
   `git_ssh_url` is not CodeRepositoryBranch state.
 
-For ordinary local implementation, work naturally in the current Git branch.
-Do not make CodeRepositoryBranch selection a separate user workflow.
-An unregistered local branch remains valid for ordinary local development, but
-it has no CodeRepositoryBranch or Environment. Only branch-owned operations
-fail. Register the branch before using Jobs, images, releases, resources, pods,
-or other branch-owned platform APIs. Never fall back to another branch.
-
-## Required Decisions
-
-For every non-trivial task, decide:
-
-1. What does success look like in observable terms?
-2. Which specialized skill owns the domain behavior?
-3. Does platform state need live verification?
-4. Are the docs and local implementation aligned, or is there a discrepancy to surface?
-
-## Build Rules
-
-### 1. Use the authority that owns the contract
-
-Use installed SDK skills, CLI help, and version-matched documentation for
-client behavior. Use installed platform-owned skills and backend-advertised
-schemas, templates, and capabilities for platform behavior. Treat the public
-documentation site as supplemental when it describes another SDK version. If
-the client and platform contracts disagree, stop and route the evidence to the
-bug-auditor skill instead of guessing or updating automatically.
-
-The `mainsequence` CLI owns `.agents/skills/mainsequence/`. It must not copy,
-refresh, or remove `.agents/skills/ms_tau_sdk/`; that independent namespace is
-owned by the installed `ms-tau-sdk` command.
-
-### 2. Maintain the standard Main Sequence CodeRepository structure
-
-Also maintain these standard repository areas when relevant:
-
-- `src/`
-- `scripts/`
-- `tests/`
-- `docs/`
-- `api/`
-
-If the CodeRepository has recurring scheduled jobs or repository-managed releases,
-keep backend-managed declarations as direct `.yaml` or `.yml` children of
-`.mainsequence/workflows/`. Never create `scheduled_jobs.yaml`; retrieve and
-validate the current workflow contract through the backend-owned CodeRepositoryBranch
-workflow endpoints.
-
-Use the standard Main Sequence CodeRepository structure unless the repository explicitly documents a different layout.
-
-Repository-local execution paths for jobs must:
-
-- be relative to the repository root
-- use forward slashes, even on Windows
-- point to a supported file inside the repository
-
-Do not treat:
-
-- `.env` as long-term documentation
-- `.venv` as source code
-- local absolute paths as reusable repository instructions
-
-### 3. Define success before implementation
-
-Make the end state explicit before changing code, docs, or platform objects.
-
-Do not start domain work with a vague target.
-
-### 4. Verify code repository context before making platform claims
-
-Use the CLI to confirm the active CodeRepository and the saved session before live checks when needed.
-
-When the result will be consumed programmatically or used as machine-readable evidence, prefer the CLI `--json` flag.
-
-Typical bootstrap checks:
-
-- `mainsequence code-repository current --debug`
-- `mainsequence auth status --check`
-- `mainsequence refresh-token`
-
-The session lives in the operating system credential store, not in `.env`, and
-belongs to the machine, not to a checkout. `auth status` reports it without
-printing a token value. `refresh-token` renews it; run in a checkout, it also
-removes credential entries an earlier version left in `.env`.
-
-Do not proceed with a live branch-owned check unless `code-repository current` reports
-the current Git branch and a resolved CodeRepositoryBranch UID.
-
-### 5. Route domain work instead of expanding the bootstrap skill
-
-Once the task boundary is clear, move into the correct specialized skill.
-
-Do not teach domain semantics here.
+## Use The Installed CLI
 
-## Review Rules
+Use `mainsequence` as the default platform control surface for SDK-supported
+operations. Prefer `--json` when parsing output or collecting evidence. Check
+installed command help when documentation and local behavior differ.
 
-When reviewing bootstrap behavior, look for:
+Before live platform checks, inspect the saved session with
+`mainsequence auth status --check` when needed. Authentication belongs to the
+machine, not to a checkout. The SDK reads the saved operating-system credential
+store session; credentials must not be copied into repository instructions.
 
-- domain work happening without a clear owner skill
-- implementation starting without a concrete success condition
-- platform claims made without verification
-- docs mismatches that were noticed but not surfaced
-- the bootstrap skill growing back into a catch-all domain manual
+Verify only the platform objects relevant to the requested outcome. Separate
+verified facts from assumptions, and state any live checks that could not be
+performed.
 
-## Validation Checklist
+## SDK Skills And Repository Files
 
-Do not claim bootstrap success until you have checked:
+The SDK owns `.agents/skills/mainsequence/`. Its copier installs SDK guidance
+and domain skills together from the target repository's installed package,
+removes retired files, and writes `PINNED_FROM.txt` with the installed version.
+SDK skill copying needs no sign-in or platform catalog.
 
-- the correct code repository context is selected
-- the relevant docs were checked
-- the success condition is explicit
-- the correct specialized skill was chosen
-- any platform-state claims were verified with CLI or platform tooling
+An explicit `update-sdk` also refreshes SDK skills after installing the package.
+Other skill refreshes require the user's request; a stale or missing sentinel
+is a condition to report, not permission to update. Use the maintenance skill
+for the update workflow.
 
-## This Skill Must Stop And Escalate When
+Platform skills belong to `.agents/skills/mainsequence_platform/` and use the
+authenticated platform updater. Other libraries, including `metatables` and
+`ms-tau-sdk`, own their independent namespaces and update commands.
 
-- the relevant docs cannot be accessed
-- the code repository context is unclear
-- the success condition is still ambiguous
-- live platform state is required but has not been verified
-- domain work is proceeding without the relevant specialized skill or docs
+Follow the repository's existing layout. The SDK does not require `src/`,
+`scripts/`, `tests/`, `docs/`, or `api/` directories merely because it is
+installed. When recurring Jobs or releases use backend-managed workflow
+declarations, keep their YAML files as direct children of
+`.mainsequence/workflows/` and validate the current backend workflow contract.
 
-Do not guess through missing context.
+Repository-local execution paths passed to platform Jobs must be relative to
+the repository root, use forward slashes on every operating system, and refer
+to supported files inside the checkout.

mainsequence/cli/cli.py

@@ -1059,117 +1059,6 @@ def _resolve_installed_agent_scaffold_skill(skill_name: str) -> dict[str, pathli
     raise typer.Exit(1)
 
 
-AGENTS_MD_MANAGED_BLOCK_START_PREFIX = "<!-- mainsequence-agent-scaffold:start"
-AGENTS_MD_MANAGED_BLOCK_END = "<!-- mainsequence-agent-scaffold:end -->"
-AGENTS_MD_MANAGED_BLOCK_SCHEMA = "1"
-AGENTS_MD_MANAGED_BLOCK_START_LINE_RE = re.compile(
-    rf"(?m)^[ \t]*{re.escape(AGENTS_MD_MANAGED_BLOCK_START_PREFIX)}\b[^\n]*-->[ \t]*$"
-)
-AGENTS_MD_MANAGED_BLOCK_END_LINE_RE = re.compile(
-    rf"(?m)^[ \t]*{re.escape(AGENTS_MD_MANAGED_BLOCK_END)}[ \t]*$"
-)
-
-
-@dataclasses.dataclass(frozen=True)
-class AgentsMdManagedBlockUpdate:
-    action: str
-    changed: bool
-
-
-def _installed_agent_scaffold_agents_md_file() -> pathlib.Path:
-    source = _installed_agent_scaffold_bundle_dir() / "AGENTS.md"
-    if not source.is_file():
-        error(f"Installed agent_scaffold bundle is missing {source.name}: {source}")
-        raise typer.Exit(1)
-    return source
-
-
-def _agents_md_managed_block_line_matches(
-    source_content: str,
-) -> tuple[list[re.Match[str]], list[re.Match[str]]]:
-    start_matches = list(AGENTS_MD_MANAGED_BLOCK_START_LINE_RE.finditer(source_content))
-    end_matches = list(AGENTS_MD_MANAGED_BLOCK_END_LINE_RE.finditer(source_content))
-    return start_matches, end_matches
-
-
-def _extract_agents_md_managed_block(source_content: str) -> str:
-    start_matches, end_matches = _agents_md_managed_block_line_matches(source_content)
-    if len(start_matches) != 1 or len(end_matches) != 1:
-        raise ValueError(
-            "Installed agent_scaffold AGENTS.md must contain exactly one Main Sequence "
-            "managed block."
-        )
-
-    start_match = start_matches[0]
-    end_match = end_matches[0]
-    if end_match.start() < start_match.start():
-        raise ValueError(
-            "Installed agent_scaffold AGENTS.md contains malformed Main Sequence managed "
-            "block markers."
-        )
-
-    return source_content[start_match.start() : end_match.end()]
-
-
-def _load_installed_agents_md_template() -> tuple[pathlib.Path, str, str]:
-    source = _installed_agent_scaffold_agents_md_file()
-    content = source.read_text(encoding="utf-8")
-    managed_block = _extract_agents_md_managed_block(content)
-    return source, content, managed_block
-
-
-def _apply_agents_md_managed_block(
-    content: str,
-    bootstrap_content: str,
-    managed_block: str,
-) -> tuple[str, str]:
-    start_matches, end_matches = _agents_md_managed_block_line_matches(content)
-
-    if len(start_matches) > 1 or len(end_matches) > 1:
-        raise ValueError(
-            "AGENTS.md contains multiple Main Sequence managed block markers; resolve it manually."
-        )
-    if len(start_matches) != len(end_matches):
-        raise ValueError(
-            "AGENTS.md contains malformed Main Sequence managed block markers; resolve it manually."
-        )
-
-    if not start_matches:
-        return bootstrap_content, "replaced"
-
-    start_match = start_matches[0]
-    end_match = end_matches[0]
-    if end_match.start() < start_match.start():
-        raise ValueError(
-            "AGENTS.md contains malformed Main Sequence managed block markers; resolve it manually."
-        )
-
-    updated = (
-        f"{content[: start_match.start()]}{managed_block.rstrip()}{content[end_match.end() :]}"
-    )
-    action = "unchanged" if updated == content else "updated"
-    return updated, action
-
-
-def _update_agents_md_managed_block_file(
-    destination: pathlib.Path,
-    bootstrap_content: str,
-    managed_block: str,
-) -> AgentsMdManagedBlockUpdate:
-    destination.parent.mkdir(parents=True, exist_ok=True)
-
-    if not destination.exists():
-        destination.write_text(bootstrap_content, encoding="utf-8")
-        return AgentsMdManagedBlockUpdate(action="created", changed=True)
-
-    original = destination.read_text(encoding="utf-8")
-    updated, action = _apply_agents_md_managed_block(original, bootstrap_content, managed_block)
-    changed = updated != original
-    if changed:
-        destination.write_text(updated, encoding="utf-8")
-    return AgentsMdManagedBlockUpdate(action=action, changed=changed)
-
-
 def _parse_env_var_entries(entries: list[str]) -> dict[str, str]:
     """
     Parse env var entries from repeated KEY=VALUE args and/or comma-separated chunks.
@@ -7698,84 +7587,6 @@ def code_repository_update_sdk(
     success("SDK update and SDK skill refresh complete.")
 
 
-@code_repository.command("update")
-def code_repository_update_scaffold_target(
-    target: str = typer.Argument(
-        ..., help="Scaffold target to update. Currently supported: AGENTS.md"
-    ),
-    code_repository_id: str | None = typer.Option(
-        None,
-        "--code-repository-uid",
-        help="Optional CodeRepository UID assertion against the current Git worktree",
-    ),
-    path: str | None = typer.Option(None, "--path", help="CodeRepository directory"),
-):
-    """
-    Update a scaffold-managed file in the local CodeRepository root.
-
-    Currently this command supports only `AGENTS.md`.
-    If the Main Sequence managed marker is present, only that block is updated.
-    If the marker is absent, the whole file is replaced from the installed
-    scaffold template.
-
-    Examples
-    --------
-    ```bash
-    mainsequence code-repository update AGENTS.md
-    mainsequence code-repository update AGENTS.md --path .
-    mainsequence code-repository update AGENTS.md --code-repository-uid code-repository-uid-123
-    ```
-    """
-    if target != "AGENTS.md":
-        error(f"Unsupported scaffold update target: {target}. Supported target: AGENTS.md")
-        raise typer.Exit(1)
-
-    code_repository_dir = _resolve_code_repository_dir(code_repository_id, path)
-    destination = code_repository_dir / "AGENTS.md"
-
-    try:
-        source, bootstrap_content, managed_block = _load_installed_agents_md_template()
-        update_result = _update_agents_md_managed_block_file(
-            destination,
-            bootstrap_content,
-            managed_block,
-        )
-    except ValueError as exc:
-        error(str(exc))
-        raise typer.Exit(1) from exc
-
-    payload = {
-        "target": target,
-        "code_repository": code_repository_dir,
-        "source": source,
-        "destination": destination,
-        "action": update_result.action,
-        "changed": update_result.changed,
-        "overwritten": False,
-        "managed_block": {
-            "start": AGENTS_MD_MANAGED_BLOCK_START_PREFIX,
-            "end": AGENTS_MD_MANAGED_BLOCK_END,
-        },
-    }
-    if _emit_json(payload):
-        return
-
-    if update_result.action == "unchanged":
-        success(f"{target} Main Sequence managed block already current.")
-    else:
-        success(f"Updated scaffold-managed {target}.")
-    print_kv(
-        "Scaffold Update",
-        [
-            ("Target", target),
-            ("Action", update_result.action),
-            ("CodeRepository", str(code_repository_dir)),
-            ("Source", str(source)),
-            ("Destination", str(destination)),
-        ],
-    )
-
-
 @code_repository.command("update-agent-skills")
 def code_repository_update_agent_skills(
     code_repository_id: str | None = typer.Option(
@@ -7791,8 +7602,8 @@ def code_repository_update_agent_skills(
     No sign-in or backend access is required unless a CodeRepository UID
     assertion is supplied. The SDK owns all of .agents/skills/mainsequence:
     files and folders absent from the installed bundle are deleted. Other
-    namespaces are untouched. AGENTS.md is refreshed separately with
-    code-repository update AGENTS.md. Platform skills use update-platform-skills.
+    namespaces and repository-owned AGENTS.md are untouched. SDK instructions
+    ship inside the skills. Platform skills use update-platform-skills.
 
     Examples
     --------

{mainsequence-9.0.23.dev66.dist-info → mainsequence-9.0.24.dev67.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.23.dev66
+Version: 9.0.24.dev67
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -82,7 +82,8 @@ Main package areas:
 
 Repository areas:
 
-- `agent_scaffold/`: version-matched SDK skills and managed `AGENTS.md` content
+- `agent_scaffold/skills/`: version-matched SDK guidance and domain skills;
+  repository-owned `AGENTS.md` files are never scaffolded or updated
 - `docs/`: knowledge guides, CLI docs, architecture decisions, and generated
   reference docs
 - `tests/`: offline tests plus explicitly marked live-backend tests

{mainsequence-9.0.23.dev66.dist-info → mainsequence-9.0.24.dev67.dist-info}/RECORD

@@ -1,13 +1,12 @@
-agent_scaffold/AGENTS.md,sha256=Y_alRuPiX82gfu1ChPCOtBMvF44YiWr4wHxUq3hL43w,6529
 agent_scaffold/skills/a2a_sdk_execution/SKILL.md,sha256=NcwIQ1QgD4Ku0mG2Hb-Izee8p9fm9LTPHa6gDEWTOSQ,13200
 agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=gdoe860TEQyrMIVcN1L3Cf8lBYv3ErMkTNWcNrWjOKo,24427
 agent_scaffold/skills/mainsequence-inference/SKILL.md,sha256=yv8aAHLQ2FBBSWPIFadY7pGNTwtR-yiR_-UzaGRN9-g,12502
-agent_scaffold/skills/maintenance/bug_auditor/SKILL.md,sha256=CCKs7edyZ9RK-WtAgXJXucokJFXZxk8sRUe0_imFtu8,8610
-agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=vJ7ksmqvgjdQGS3QYGb6oD7HaRi5LNIo1PYKTEV_eyU,18283
+agent_scaffold/skills/maintenance/bug_auditor/SKILL.md,sha256=8RRZNmC3omhZoxNbmu50MdhBFTQ2CU2THeyNu07Ax18,8659
+agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=pNQICoVW6nRr0HfvyB0Q64TdsqCXTWQUuImpBL-4XUQ,18575
 agent_scaffold/skills/maintenance/metatables_transition/SKILL.md,sha256=PisgpytcksJnfZMS6aiPCmahsT3fm8DIwk_cefXA2qU,3759
-agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=rB_52v63tR5dptYYviaAHzYmnhLPgWsex2lpZkYDDuk,14765
-agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md,sha256=_84nnJKl_w-JrcbiTIairbFf9ptoQvW5Y1kMxn_XzkU,16871
-agent_scaffold/skills/sdk_code_repository_execution/SKILL.md,sha256=_CzYF7p0slC8m9oeKgGbWjCjvXW607SCCFC8dClujtE,10254
+agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=hDXkctBgMsd_pJYmAq7lR8M_zulIAmgYVx1ii5qBcp0,14814
+agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md,sha256=KfTptbOMO-b8hiVFPgKxRMjmQWZCLB9Sr_kli7kp4hs,16920
+agent_scaffold/skills/sdk_code_repository_execution/SKILL.md,sha256=g4C0Cp5oqQg2LBjT-piWXunmt_hNd5yTK33RMYPAE8I,7313
 mainsequence/__init__.py,sha256=70CbIo7ZG1mzi5uwkqDtVESunBE0RanHjeFg4ptfsA0,385
 mainsequence/__main__.py,sha256=KuAP69uduS2ImrPIgNMzbGBRepZzjqvUONu5vFh4v4A,176
 mainsequence/_request_identity.py,sha256=vsbnQeJ9ycRB2p8oFTUxfPkzDh7-SBQ5Pxzn04pjqVM,4183
@@ -24,7 +23,7 @@ mainsequence/scaffold_skills.py,sha256=k0V6eKC5AwbHr9wB9UGMJNF-8eJ0_1izF4-BU01KH
 mainsequence/cli/__init__.py,sha256=sMWTnomCaISjnureLuXFRqOzkH2Y77uYEivsd-M6_8Y,28
 mainsequence/cli/api.py,sha256=u3vjwJ5w_u4o76ufkePXKIh6dixOHDok_r8Os0iA_04,128865
 mainsequence/cli/browser_auth.py,sha256=Vb5MBOnPC05HLZzVNUDODobJ_p5wEIzH_h8rIlpShlE,9984
-mainsequence/cli/cli.py,sha256=4t0vf-gi_Ez4MjvAEOAfGYwVuSxb1HECRRyaruQvp6M,269468
+mainsequence/cli/cli.py,sha256=PPc3cWvESPZ0gNfj1ktDBaYIcniguL9yAIWOFaNMrLE,262839
 mainsequence/cli/code_repository_status.py,sha256=SHEnU8YSWFowPG6dEdE4Yd8CS1tIcJSE1MXFLfvD3Os,5975
 mainsequence/cli/config.py,sha256=TJYnM11kg5pH2O7AGWFLpNEkC9UEu0g7k2RLjhAHCzo,45724
 mainsequence/cli/docker_utils.py,sha256=eAnp9MI042cHWwKasA5IF2I7INL3A6tV2JX-cSIe7rc,10687
@@ -58,9 +57,9 @@ mainsequence/server/mcp_skills.py,sha256=-krRwAHCAMipScgGJ19uVkzznhTop1Nz4C_wRY1
 mainsequence/server/_mcp_skills_upstream/__init__.py,sha256=px283qBMf3z1nxCfN3WHrH9v8Y8jOb1xoBqZMRZcaD8,2694
 mainsequence/server/_mcp_skills_upstream/server.py,sha256=laHsfpoaYX3LcwQ04-GN7r0_C63fG6CzyXDci2rmbHE,7695
 mainsequence/server/_mcp_skills_upstream/shared.py,sha256=JmnX9PoLoyi93nBYnUEPWCdPXor_nQHjHptQDXpFzPs,11978
-mainsequence-9.0.23.dev66.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.23.dev66.dist-info/METADATA,sha256=wt6keqLEOGf1mggNThtqGuZ-O6fh7s_6SnT0O-9H51k,7466
-mainsequence-9.0.23.dev66.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.23.dev66.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.23.dev66.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.23.dev66.dist-info/RECORD,,
+mainsequence-9.0.24.dev67.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.24.dev67.dist-info/METADATA,sha256=9xRrpjtRTzI9nv1EEHAtY2iVu8e_gOy5BR1UQABgN-E,7531
+mainsequence-9.0.24.dev67.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.24.dev67.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.24.dev67.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.24.dev67.dist-info/RECORD,,

agent_scaffold/AGENTS.md

@@ -1,122 +0,0 @@
-# AGENTS.md
-
-You are a dual-mandate agent. Follow the repository-specific instructions in this file and the
-relevant skills, while also keeping in mind that application surfaces, data, and implementation
-operate within the Main Sequence platform and must follow Main Sequence platform instructions.
-
-## Repository-Specific Instructions
-
-[ HERE SHOULD BE THE REPOSITORY-SPECIFIC ACTIONS, RULES, CONTEXT, AND LOCAL NOTES. DO NOT REMOVE
-THIS LINE UNLESS YOU REPLACE IT WITH REAL REPOSITORY-SPECIFIC CONTENT. ]
-
-Do not remove the `<!-- mainsequence-agent-scaffold:start schema=1 source=agent_scaffold -->`
-or `<!-- mainsequence-agent-scaffold:end -->` markers. `mainsequence code-repository update AGENTS.md`
-uses them to update only the Main Sequence section below.
-
-
-<!-- mainsequence-agent-scaffold:start schema=1 source=agent_scaffold -->
-## Main Sequence Instructions
-
-Use this managed section to select the correct Main Sequence skill. Detailed
-procedures belong in those skills and their referenced documentation.
-
-## Authority
-
-- Repository-specific instructions above this block define local intent and
-  repository conventions.
-- The installed SDK code, CLI help, SDK-owned skills, and version-matched SDK
-  documentation define client behavior.
-- Installed platform-owned skills and backend-advertised schemas, templates,
-  and capabilities define the current platform contract.
-- The public documentation site is supplemental when its SDK version differs
-  from the installed package:
-  `https://mainsequence-sdk.github.io/mainsequence-sdk/`
-- If the installed client and platform contract disagree, do not guess or
-  update automatically. Use the bug-auditor skill to record the evidence and
-  identify the owning side.
-
-## Updates Are Explicit
-
-Do not run any of these commands unless the user explicitly requests that
-specific update:
-
-- `mainsequence code-repository update-sdk --path .`
-- `mainsequence code-repository update-agent-skills --path .`
-- `mainsequence code-repository update-platform-skills --path .`
-- `mainsequence code-repository update AGENTS.md --path .`
-- `uv run ms-tau skills sync --path .`
-
-A missing or mismatched `.agents/skills/mainsequence/PINNED_FROM.txt` is state
-to report, not permission to mutate the repository. The same rule applies to
-`.agents/skills/ms_tau_sdk/PINNED_FROM.txt`. When a Main Sequence update is
-requested, use the `code_repository_maintenance` skill. The `mainsequence` CLI
-never owns or updates the `ms_tau_sdk` namespace.
-
-The SDK owns all of `.agents/skills/mainsequence/`. Its skill copy is local,
-requires no sign-in, and deletes everything absent from the installed SDK
-bundle. Platform skills are installed separately under
-`.agents/skills/mainsequence_platform/` by the authenticated platform update.
-
-## Route By Task
-
-- Product architecture, platform ontology, and CodeRepository Blueprint work:
-  use the matching platform-owned design skill declared by the installed
-  platform catalog. Do not assume its filesystem path.
-- CodeRepository context, local SDK execution, repository structure, and
-  implementation routing:
-  `.agents/skills/mainsequence/sdk_code_repository_execution/SKILL.md`
-- Local environment repair, authentication, explicitly requested updates,
-  dependency sync after a dependency change, and publishing with Git:
-  `.agents/skills/mainsequence/maintenance/code_repository_maintenance/SKILL.md`
-- Blocker analysis, failure classification, and SDK/platform contract mismatches:
-  `.agents/skills/mainsequence/maintenance/bug_auditor/SKILL.md`
-- MetaTable modeling, queries, external registration, table updates, Alembic
-  schema changes, and data discovery: use the skills the `metatables` package
-  installs under `.agents/skills/metatables/` and its documentation.
-- Code that still imports `mainsequence.meta_tables` or
-  `mainsequence.client.metatables`, or calls the retired `mainsequence` table
-  and migration commands:
-  `.agents/skills/mainsequence/maintenance/metatables_transition/SKILL.md`
-- FastAPI APIs serving the Command Center frontend, and MCP tools and skills
-  served from a FastAPI release:
-  `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
-- Jobs, schedules, images, resources, releases, and Artifacts:
-  `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`
-- RBAC, sharing, constants, secrets, access verification, and whether an
-  application uses its own grants or acts for its requester:
-  `.agents/skills/mainsequence/platform_operations/access_control_and_sharing/SKILL.md`
-- Direct recorded model calls, structured extraction, thinking/provider options,
-  inference history and idempotent replay:
-  `.agents/skills/mainsequence/mainsequence-inference/SKILL.md`
-- A2A session discovery, messages, files, and SDK response handling:
-  `.agents/skills/mainsequence/a2a_sdk_execution/SKILL.md`
-- Turning a CodeRepository into a platform coding agent or selecting other
-  platform-owned capabilities: use the matching skill declared by the installed
-  platform catalog. Do not hardcode a platform-owned skill path.
-- Implementing or debugging a TAU-based Harness Agent: after the platform skill
-  establishes the platform contract, use the version-matched skills under
-  `.agents/skills/ms_tau_sdk/`. If they are absent and the user requested the
-  update, run `uv run ms-tau skills sync --path .`; do not reconstruct those
-  SDK instructions from platform documentation.
-
-## Core Working Rules
-
-- Read the relevant skill before acting on a Main Sequence domain.
-- Use the current Git checkout as repository, branch, and commit identity. Do
-  not ask users to inject CodeRepositoryBranch or Environment identity.
-- Use the `mainsequence` CLI as the default platform control surface. Prefer
-  `--json` when output will be parsed or used as evidence.
-- Use the owning domain package before designing against an unfamiliar domain contract.
-- Keep reusable business logic under `src/` and keep API, job, and other
-  integration layers thin.
-- Verify only the platform objects relevant to the requested outcome.
-- Separate verified facts from assumptions and report blockers with the exact
-  failing operation.
-
-## Completion
-
-Before implementation, identify the requested end state and the evidence that
-will prove it. Do not claim completion until the relevant code or documentation
-checks pass and any required platform state has been verified. If live
-verification is unavailable, state what remains unverified.
-<!-- mainsequence-agent-scaffold:end -->