mainsequence 9.0.5__tar.gz → 9.0.6__tar.gz

{mainsequence-9.0.5/mainsequence.egg-info → mainsequence-9.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.5
+Version: 9.0.6
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -25,13 +25,12 @@ Requires-Dist: protobuf>=6.33.5
 Requires-Dist: psutil
 Requires-Dist: pydantic<3,>=2.11
 Requires-Dist: pygments>=2.20.0
+Requires-Dist: PyJWT[crypto]<3,>=2.10
 Requires-Dist: pyyaml
 Requires-Dist: requests>=2.33.0
 Requires-Dist: structlog
 Requires-Dist: typer
 Requires-Dist: urllib3>=2.7.0
-Provides-Extra: server
-Requires-Dist: PyJWT[crypto]<3,>=2.10; extra == "server"
 Dynamic: license-file
 
 <p align="center">
@@ -75,7 +74,7 @@ Main package areas:
   authentication, platform resources, and local CodeRepository operations
 - `mainsequence.instrumentation` and `mainsequence.logconf`: SDK tracing and
   logging integration
-- `mainsequence.server`: optional server-side caller assertion verification
+- `mainsequence.server`: server-side caller assertion verification
 - `mainsequence.scaffold_skills`: reusable, version-pinned skill copying for
   this SDK and extension libraries
 
@@ -148,7 +147,7 @@ another repository, use the explicitly scoped `filter_admin` path. See
 [Resource releases](docs/knowledge/infrastructure/resource_releases.md) for
 supported filters and examples.
 
-Server integrations can install `mainsequence[server]` for the
+The standard `mainsequence` installation includes PyJWT and cryptography for the
 framework-independent [caller assertion verifier](docs/knowledge/server/caller_assertions.md).
 Applications remain responsible for resource authorization and storage
 operations.

{mainsequence-9.0.5 → mainsequence-9.0.6}/README.md

@@ -39,7 +39,7 @@ Main package areas:
   authentication, platform resources, and local CodeRepository operations
 - `mainsequence.instrumentation` and `mainsequence.logconf`: SDK tracing and
   logging integration
-- `mainsequence.server`: optional server-side caller assertion verification
+- `mainsequence.server`: server-side caller assertion verification
 - `mainsequence.scaffold_skills`: reusable, version-pinned skill copying for
   this SDK and extension libraries
 
@@ -112,7 +112,7 @@ another repository, use the explicitly scoped `filter_admin` path. See
 [Resource releases](docs/knowledge/infrastructure/resource_releases.md) for
 supported filters and examples.
 
-Server integrations can install `mainsequence[server]` for the
+The standard `mainsequence` installation includes PyJWT and cryptography for the
 framework-independent [caller assertion verifier](docs/knowledge/server/caller_assertions.md).
 Applications remain responsible for resource authorization and storage
 operations.

{mainsequence-9.0.5 → mainsequence-9.0.6}/agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md

@@ -248,8 +248,8 @@ The platform deploys from the push according to the repository's
 pushes deploy:
 
 - omitted or `null`: every push to the branch deploys;
-- a regular expression: a push deploys only when a matching tag points at the
-  branch's latest commit.
+- a regular expression: a matching tag deploys the commit it points at, whether
+  that is the branch's latest commit or an older commit on the branch.
 
 Automatic deployment and `tag_regex` are set in the workflow file only; a
 `ResourceRelease` or `Job` update does not accept them. The Main Sequence
@@ -300,6 +300,104 @@ only the commits CI tagged. Details:
 Do not call `sync-after-commit` or any backend repair endpoint. The GitHub
 branch-push webhook owns backend repository reconciliation.
 
+### Development Deploys Every Push, Production Deploys Tags
+
+A common setup uses two workflow files scoped to Environments. On the
+production branch only the first applies; on the development branch only the
+second:
+
+```yaml
+# .mainsequence/workflows/api-production.yaml
+api_version: "2.3.0"
+name: api-production
+scope:
+  environments: [production]
+resources:
+  - key: api
+    kind: fastapi
+    spec:
+      source_path: api/main.py
+      automatic_deployment: true
+      automatic_redeployment:
+        enabled: true
+        tag_regex: "^v[0-9]+\\.[0-9]+\\.[0-9]+$"
+```
+
+```yaml
+# .mainsequence/workflows/api-development.yaml
+api_version: "2.3.0"
+name: api-development
+scope:
+  environments: [development]  # the development Environment's exact name
+resources:
+  - key: api
+    kind: fastapi
+    spec:
+      source_path: api/main.py
+      automatic_deployment: true
+      automatic_redeployment:
+        enabled: true
+```
+
+A push to the development branch deploys at once. A merge to `main` deploys
+nothing until a matching tag points at a commit on `main`; with the release job
+above, CI creates that tag after the tests pass. Take the exact fields from the
+branch's workflow template and validate each file through the branch's
+`validate-workflow` action before committing it, as the
+`platform_operations/orchestration_and_releases` skill describes.
+
+### Creating A Release Tag
+
+The platform reacts to the tag push, however the tag was made. The short tag
+name must fully match `tag_regex`, and the tagged commit must be on the
+target's branch (its latest commit or an older one).
+
+- CI, as in the release job above. This is the recommended path.
+- By hand, only when the user asks for it:
+
+  ```bash
+  git tag v1.3.0 <commit>
+  git push origin v1.3.0
+  ```
+
+  Lightweight and annotated tags both work. Push one tag at a time: GitHub
+  sends no event when more than three tags are pushed at once, so
+  `git push --tags` can deploy nothing.
+- A GitHub Release: publishing a release with a new tag, in the web UI or with
+  `gh release create v1.3.0 --target main`, creates the tag, and that tag
+  deploys like a pushed one.
+
+A tag created with the Actions `GITHUB_TOKEN` starts no other GitHub Actions
+workflow, but it still reaches Main Sequence. Deleting a tag deploys nothing
+and removes nothing. A tag that does not match, or whose commit is only on
+another branch, deploys nothing for that target.
+
+### Going Back To An Older Version
+
+Two ways work. Use either only when the user asks for it.
+
+- Revert and release a new version: `git revert <commit>`, raise the patch
+  version with `uv version --bump patch`, commit, push, and let CI tag the
+  result. This works for every target, including every-push targets, and keeps
+  the version moving forward.
+- For a target with a `tag_regex`, push the older version's tag again. GitHub
+  sends an event only when a tag is created, so delete the tag on GitHub and
+  push it again; it still points at the same commit:
+
+  ```bash
+  git fetch --tags origin
+  git push origin :refs/tags/v1.2.0
+  git push origin v1.2.0
+  ```
+
+  The target redeploys that commit exactly as it was released: its code, its
+  image and its workflow file, whose settings replace the current ones. The
+  commit must still be on the branch and the tag must match the target's
+  current `tag_regex`. Every-push targets ignore the tag. Re-pushing a tag
+  also re-runs any GitHub Actions workflow that the tag triggers, and a tag
+  ruleset may forbid deleting it; use the revert route then. The next release
+  tag deploys a newer version again.
+
 ## Diagnose Partial Completion Before Retrying
 
 Never rerun an entire mutating workflow blindly.

{mainsequence-9.0.5 → mainsequence-9.0.6}/agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md

@@ -91,8 +91,16 @@ the SDK or CodeRepository code.
 
 Every file requires the backend-advertised `api_version`, a name, and resource
 declarations. Use the current template for accepted fields and resource kinds.
-There is no prune or strict-delete mode; removing a declaration does not delete
-an existing backend resource.
+A declaration owns its target. On the next push of the branch head, these
+delete the target:
+
+- removing the declaration or its file;
+- a `scope` that excludes the branch's Environment.
+
+Renaming a file or key deletes the old target and creates a new one, with new
+UIDs and URLs. An invalid file deletes nothing. The branch's Harness Agent
+stays while any workflow file declares a `harness_agent`, so moving its
+declaration keeps the same Agent.
 
 Do not hide important recurring schedules in ad hoc shell history or one-off manual commands.
 
@@ -224,7 +232,7 @@ Automatic deployment and its `tag_regex` are set in the repository's `.mainseque
 The declaration's `tag_regex` decides which pushes deploy:
 
 - omitted or `null`: every push to the branch deploys
-- a regular expression: a push deploys only when a matching tag points at the branch's latest commit
+- a regular expression: a matching tag deploys the commit it points at, whether that is the branch's latest commit or an older commit on the branch
 
 The platform does not create or name tags. Release tags come from the repository's own CI, for example a GitHub Actions workflow that tags the version declared in `pyproject.toml` after the tests pass. The maintenance skill `.agents/skills/mainsequence/maintenance/code_repository_maintenance/SKILL.md` has an example. `mainsequence code-repository sync` only refreshes `uv.lock`, the local environment, and `requirements.txt`; it does not commit, tag, or push.
 

mainsequence-9.0.6/mainsequence/client/_transport.py

@@ -0,0 +1,154 @@
+"""One bounded retry policy for SDK HTTP sessions."""
+
+import math
+import time
+from contextlib import contextmanager
+from contextvars import ContextVar
+
+import requests
+from requests.adapters import HTTPAdapter
+from urllib3.exceptions import InvalidHeader
+from urllib3.util import Retry, Timeout
+
+DEFAULT_ALLOWED_METHODS = frozenset({"HEAD", "GET", "OPTIONS"})
+DEFAULT_STATUS_FORCELIST = (429, 500, 502, 503, 504)
+DEFAULT_TIMEOUT = (5.0, 120.0)
+
+
+class RequestBudget:
+    def __init__(self, timeout):
+        if timeout is None:
+            timeout = DEFAULT_TIMEOUT
+        if isinstance(timeout, Timeout):
+            connect, read = timeout.connect_timeout, timeout.read_timeout
+            total = timeout.total
+        elif isinstance(timeout, tuple):
+            connect, read = timeout
+            total = None
+        else:
+            connect = read = total = timeout
+        self.connect = self._seconds(connect)
+        self.read = self._seconds(read)
+        self.deadline = time.monotonic() + self._seconds(
+            self.connect + self.read if total is None else total
+        )
+
+    @staticmethod
+    def _seconds(value):
+        seconds = float(value)
+        if not math.isfinite(seconds) or seconds <= 0:
+            raise ValueError("Request timeouts must be positive, finite seconds.")
+        return seconds
+
+    @property
+    def remaining(self):
+        return self.deadline - time.monotonic()
+
+    def timeout(self):
+        remaining = self.remaining
+        if remaining <= 0:
+            raise requests.Timeout("The SDK request's total timeout budget is exhausted.")
+        return Timeout(
+            total=remaining,
+            connect=min(self.connect, remaining),
+            read=min(self.read, remaining),
+        )
+
+
+_ACTIVE_BUDGET: ContextVar[RequestBudget | None] = ContextVar("sdk_request_budget", default=None)
+
+
+@contextmanager
+def request_budget(timeout):
+    budget = RequestBudget(timeout)
+    parent = _ACTIVE_BUDGET.get()
+    if parent is not None:
+        budget.deadline = min(budget.deadline, parent.deadline)
+    token = _ACTIVE_BUDGET.set(budget)
+    try:
+        yield budget
+    finally:
+        _ACTIVE_BUDGET.reset(token)
+
+
+def remaining_timeout(timeout):
+    budget = _ACTIVE_BUDGET.get()
+    if budget is None:
+        return timeout
+    connect, read = timeout
+    remaining = budget.timeout().total
+    return Timeout(total=remaining, connect=min(connect, remaining), read=min(read, remaining))
+
+
+class DeadlineHTTPAdapter(HTTPAdapter):
+    def __init__(self, *, retries, backoff_factor):
+        if not isinstance(retries, int) or retries < 0:
+            raise ValueError("retries must be a non-negative integer.")
+        if not math.isfinite(backoff_factor) or backoff_factor < 0:
+            raise ValueError("backoff_factor must be non-negative and finite.")
+        # urllib3 must never add a second retry loop or resend a write on connect failure.
+        super().__init__(
+            max_retries=Retry(
+                total=0,
+                connect=0,
+                read=False,
+                status=0,
+                other=0,
+                allowed_methods=DEFAULT_ALLOWED_METHODS,
+            )
+        )
+        self.retries = retries
+        self.backoff_factor = backoff_factor
+
+    def send(self, request, stream=False, timeout=None, verify=True, cert=None, proxies=None):
+        budget = RequestBudget(timeout)
+        parent = _ACTIVE_BUDGET.get()
+        if parent is not None:
+            budget.deadline = min(budget.deadline, parent.deadline)
+        retryable = request.method in DEFAULT_ALLOWED_METHODS
+        for attempt in range(self.retries + 1):
+            response = None
+            error = None
+            try:
+                response = super().send(
+                    request,
+                    stream=stream,
+                    timeout=budget.timeout(),
+                    verify=verify,
+                    cert=cert,
+                    proxies=proxies,
+                )
+                if not stream:
+                    # Read before deciding to retry, so body failures share the same budget.
+                    _ = response.content
+                if not retryable or response.status_code not in DEFAULT_STATUS_FORCELIST:
+                    return response
+            except requests.exceptions.SSLError:
+                raise
+            except (
+                requests.ConnectionError,
+                requests.Timeout,
+                requests.exceptions.ChunkedEncodingError,
+            ) as exc:
+                error = exc
+
+            delay = min(self.backoff_factor * 2**attempt, Retry.DEFAULT_BACKOFF_MAX)
+            if error is None:
+                try:
+                    retry_after = self.max_retries.get_retry_after(response)
+                except InvalidHeader:
+                    retry_after = None
+                if retry_after is not None:
+                    delay = max(delay, retry_after)
+
+            if not retryable or attempt == self.retries or delay >= budget.remaining:
+                if error is not None:
+                    if response is not None:
+                        response.close()
+                    raise error
+                return response
+            if response is not None:
+                response.close()
+            time.sleep(delay)
+
+        raise AssertionError("Unreachable retry state")

{mainsequence-9.0.5 → mainsequence-9.0.6}/mainsequence/client/client.py

@@ -9,7 +9,7 @@ import requests
 from mainsequence.defaults import resolve_backend_endpoint
 
 from .exceptions import raise_for_response
-from .utils import AuthLoaders, build_session
+from .utils import AuthLoaders, build_session, make_request
 from .utils import loaders as _global_loaders
 from .utils import session as _global_session
 
@@ -35,6 +35,7 @@ class MainSequenceClient:
     - Uses ONE shared loaders + session (from utils) by default
     - Can be reconfigured once at startup
     """
+
     _default: MainSequenceClient | None = None
 
     def __init__(
@@ -72,15 +73,18 @@ class MainSequenceClient:
         timeout: tuple[float, float] | float | None = None,
     ) -> Any:
         url = self.config.api_root.rstrip("/") + "/" + path.lstrip("/")
-        to = timeout or self.config.timeout
-
-        r = self.session.request(method.upper(), url, params=params, json=json, files=files, timeout=to)
-
-        # Refresh auth once if needed
-        if r.status_code in (401, 403):
-            self.loaders.refresh_headers()
-            self.session.headers.update(self.loaders.auth_headers)
-            r = self.session.request(method.upper(), url, params=params, json=json, files=files, timeout=to)
+        to = self.config.timeout if timeout is None else timeout
+        payload = {"params": params, "json": json}
+        if files is not None:
+            payload["files"] = files
+        r = make_request(
+            self.session,
+            method,
+            url,
+            self.loaders,
+            payload=payload,
+            time_out=to,
+        )
 
         raise_for_response(r, payload={"params": params, "json": json})
 
@@ -95,7 +99,9 @@ class MainSequenceClient:
         """
         if cls._default is None:
             # Reuse the existing global singletons from utils to avoid two sessions in prod.
-            cls._default = cls(MainSequenceClientConfig(), loaders=_global_loaders, session=_global_session)
+            cls._default = cls(
+                MainSequenceClientConfig(), loaders=_global_loaders, session=_global_session
+            )
         return cls._default
 
     @classmethod

{mainsequence-9.0.5 → mainsequence-9.0.6}/mainsequence/client/inference.py

@@ -69,8 +69,8 @@ class InferenceClient:
         if self.organization_environment_uid is not None:
             query["organization_environment_uid"] = self.organization_environment_uid
         url = f"{utils.API_ENDPOINT.rstrip('/')}/{path}"
-        # The shared make_request loop retries network failures. Inference uses
-        # the same auth loader with a dedicated zero-retry transport instead.
+        # Inference opts out of safe-read retries as well: an uncertain outcome
+        # must preserve the caller's explicit idempotency key.
         with utils.build_session(loaders=utils.loaders, retries=0) as session:
             headers = dict(utils.loaders.refresh_headers(force=False, session=session))
             if key is not None:

{mainsequence-9.0.5 → mainsequence-9.0.6}/mainsequence/client/models_helpers.py

@@ -107,8 +107,8 @@ class AutomaticRedeploymentPolicy(BaseModel):
         description=(
             "Regular expression matched against repository tags, set by `tag_regex` "
             "in the repository's `.mainsequence/workflows/*.yaml`. Null deploys every "
-            "push; a regex deploys only when a matching tag points at the branch's "
-            "latest commit."
+            "push; a regex deploys the commit a matching tag points at, whether it is "
+            "the branch's latest commit or an older commit on the branch."
         ),
         examples=[None, r"^v(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$"],
     )

{mainsequence-9.0.5 → mainsequence-9.0.6}/mainsequence/client/utils.py

@@ -17,26 +17,21 @@ from uuid import UUID, getnode
 
 import psutil
 import requests
-from requests.adapters import HTTPAdapter
 from requests.structures import CaseInsensitiveDict
-from urllib3.util.retry import Retry
 
 from mainsequence.defaults import resolve_backend_endpoint
 from mainsequence.logconf import logger
 
+from ._transport import DEFAULT_ALLOWED_METHODS as DEFAULT_ALLOWED_METHODS
+from ._transport import DEFAULT_STATUS_FORCELIST as DEFAULT_STATUS_FORCELIST
+from ._transport import DEFAULT_TIMEOUT as DEFAULT_TIMEOUT
+from ._transport import DeadlineHTTPAdapter, remaining_timeout, request_budget
+
 # ---- Backend defaults (single source of truth) ----
 MAINSEQUENCE_ENDPOINT = resolve_backend_endpoint()
 API_ENDPOINT = f"{MAINSEQUENCE_ENDPOINT}/api/v1"
 AUTH_ENDPOINT = MAINSEQUENCE_ENDPOINT.rstrip("/")
 
-DEFAULT_STATUS_FORCELIST = (429, 500, 502, 503, 504)
-DEFAULT_ALLOWED_METHODS = frozenset(["HEAD", "GET", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"])
-
-# requests supports either a float or (connect, read). Preserve previous ~120s read behavior,
-# but add a sane connect timeout.
-DEFAULT_TIMEOUT: tuple[float, float] = (5.0, 120.0)
-
-
 DATE_FORMAT = "%Y-%m-%dT%H:%M:%S.%fZ"
 
 
@@ -383,7 +378,7 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
                     "credential_secret": credential_secret,
                 },
                 headers={"Content-Type": "application/json"},
-                timeout=self.timeout,
+                timeout=remaining_timeout(self.timeout),
                 allow_redirects=False,
             )
             if response.status_code < 200 or response.status_code >= 300:
@@ -515,7 +510,7 @@ class JWTAuthProvider(BaseAuthProvider):
                 self.refresh_url,
                 json={"refresh": self.refresh_token},
                 headers={"Content-Type": "application/json"},
-                timeout=self.timeout,
+                timeout=remaining_timeout(self.timeout),
             )
 
             if r.status_code in _REFUSED_RENEWAL_STATUSES:
@@ -564,7 +559,7 @@ class JWTAuthProvider(BaseAuthProvider):
             self.obtain_url,
             json={"username": username, "password": password},
             headers={"Content-Type": "application/json"},
-            timeout=self.timeout,
+            timeout=remaining_timeout(self.timeout),
         )
         r.raise_for_status()
         data = r.json()
@@ -671,63 +666,46 @@ def make_request(
 ):
     from requests.models import Response
 
-    TIMEOFF = 0.25
-    TRIES = int(15 // TIMEOFF)
     timeout = DEFAULT_TIMEOUT if time_out is None else time_out
     payload = {} if payload is None else payload
-
-    def get_req(session):
-        if r_type == "GET":
-            return session.get
-        elif r_type == "POST":
-            return session.post
-        elif r_type == "PUT":
-            return session.put
-        elif r_type == "PATCH":
-            return session.patch
-        elif r_type == "DELETE":
-            return session.delete
-        else:
-            raise NotImplementedError(f"Unsupported method: {r_type}")
+    r_type = r_type.upper()
+    if r_type not in DEFAULT_ALLOWED_METHODS | {"POST", "PUT", "PATCH", "DELETE"}:
+        raise NotImplementedError(f"Unsupported method: {r_type}")
 
     request_kwargs = {}
     if r_type in ("POST", "PATCH") and "files" in payload:
-        request_kwargs["data"] = payload.get("json", {})
-        request_kwargs["files"] = payload["files"]
+        request_kwargs = dict(payload)
+        request_kwargs["data"] = request_kwargs.pop("json", {})
         s.headers.pop("Content-Type", None)
     else:
-        request_kwargs = payload
-
-    req = get_req(session=s)
-    keep_request = True
-    counter = 0
-    auth_retried = False
+        request_kwargs = dict(payload)
+    request_kwargs.setdefault("allow_redirects", False)
+    req = getattr(s, r_type.lower())
 
     if accept_gzip:
         s.headers.setdefault("Accept-Encoding", "gzip")
 
-    while keep_request:
+    with request_budget(timeout) as budget:
         try:
-            if loaders is not None:
-                s.headers.update(loaders.refresh_headers(force=False, session=s))
-
-            start_time = time.perf_counter()
-            logger.debug(f"Requesting {r_type} from {url}")
-            r = req(url, timeout=timeout, **request_kwargs)
-            duration = time.perf_counter() - start_time
-            logger.debug(f"{url} took {duration:.4f} seconds.")
-
-            if r.status_code == 401 and loaders is not None and not auth_retried:
-                logger.warning(f"Error {r.status_code}; forcing auth refresh once")
-                # A refused renewal raises AuthError: it is reported below with the
-                # reason and the repair, not as a traceback.
-                s.headers.update(loaders.refresh_headers(force=True, session=s))
-                req = get_req(session=s)
-                auth_retried = True
-                continue
-
-            keep_request = False
-            break
+            for auth_attempt in range(2):
+                if loaders is not None:
+                    budget.timeout()
+                    s.headers.update(loaders.refresh_headers(force=bool(auth_attempt), session=s))
+
+                start_time = time.perf_counter()
+                logger.debug(f"Requesting {r_type} from {url}")
+                r = req(url, timeout=budget.timeout(), **request_kwargs)
+                duration = time.perf_counter() - start_time
+                logger.debug(f"{url} took {duration:.4f} seconds.")
+                if (
+                    r.status_code != 401
+                    or loaders is None
+                    or auth_attempt
+                    or r_type not in DEFAULT_ALLOWED_METHODS
+                ):
+                    return r
+                r.close()
+                logger.warning("Error 401; forcing auth refresh once within the request budget")
 
         except AuthError as e:
             logger.warning(f"Auth error for {url}: {e}")
@@ -736,32 +714,15 @@ def make_request(
             r.error_type = "auth_error"
             r.status_code = 401
             r._content = str(e).encode("utf-8")
-            keep_request = False
-            break
-
-        except requests.exceptions.ConnectionError:
-            logger.exception(f"Error connecting {url}")
-        except TypeError as e:
-            logger.exception(f"Type error for {url} exception {e}")
-            raise e
-        except Exception as e:
-            logger.exception(f"Error connecting {url} exception {e}")
-
-        counter += 1
-        if counter >= TRIES:
-            keep_request = False
+            return r
+        except requests.RequestException as e:
+            logger.warning(f"Request {r_type} to {url} failed: {e}")
             r = Response()
             r.code = "expired"
             r.error_type = "expired"
             r.status_code = 500
-            break
-
-        logger.debug(
-            f"Trying request again after {TIMEOFF}s - Counter: {counter}/{TRIES} - URL: {url}"
-        )
-        time.sleep(TIMEOFF)
-
-    return r
+            r._content = str(e).encode("utf-8")
+            return r
 
 
 def build_session(
@@ -779,23 +740,7 @@ def build_session(
     if accept_gzip:
         s.headers.setdefault("Accept-Encoding", "gzip")
 
-    retry_kwargs = dict(
-        total=retries,
-        connect=retries,
-        read=retries,
-        status=retries,
-        backoff_factor=backoff_factor,
-        status_forcelist=DEFAULT_STATUS_FORCELIST,
-        respect_retry_after_header=True,
-        raise_on_status=False,
-    )
-
-    try:
-        retry_cfg = Retry(allowed_methods=DEFAULT_ALLOWED_METHODS, **retry_kwargs)
-    except TypeError:
-        retry_cfg = Retry(method_whitelist=DEFAULT_ALLOWED_METHODS, **retry_kwargs)
-
-    adapter = HTTPAdapter(max_retries=retry_cfg)
+    adapter = DeadlineHTTPAdapter(retries=retries, backoff_factor=backoff_factor)
     s.mount("https://", adapter)
     s.mount("http://", adapter)
     return s
@@ -929,24 +874,7 @@ def _install_retry_adapters_in_place(
     Configure retry adapters on an EXISTING session object (do not rebind 'session').
     This is critical so 'from utils import session' users still get the updated behavior.
     """
-    retry_kwargs = dict(
-        total=retries,
-        connect=retries,
-        read=retries,
-        status=retries,
-        backoff_factor=backoff_factor,
-        status_forcelist=DEFAULT_STATUS_FORCELIST,
-        respect_retry_after_header=True,
-        raise_on_status=False,
-    )
-
-    # urllib3 compatibility across versions
-    try:
-        retry_cfg = Retry(allowed_methods=DEFAULT_ALLOWED_METHODS, **retry_kwargs)
-    except TypeError:
-        retry_cfg = Retry(method_whitelist=DEFAULT_ALLOWED_METHODS, **retry_kwargs)
-
-    adapter = HTTPAdapter(max_retries=retry_cfg)
+    adapter = DeadlineHTTPAdapter(retries=retries, backoff_factor=backoff_factor)
 
     # Close old adapters' pools (best-effort), then mount new ones
     for prefix in ("https://", "http://"):