mainsequence 9.0.6.dev37__tar.gz → 9.0.6.dev39__tar.gz

{mainsequence-9.0.6.dev37 → mainsequence-9.0.6.dev39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.6.dev37
+Version: 9.0.6.dev39
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -25,13 +25,12 @@ Requires-Dist: protobuf>=6.33.5
 Requires-Dist: psutil
 Requires-Dist: pydantic<3,>=2.11
 Requires-Dist: pygments>=2.20.0
+Requires-Dist: PyJWT[crypto]<3,>=2.10
 Requires-Dist: pyyaml
 Requires-Dist: requests>=2.33.0
 Requires-Dist: structlog
 Requires-Dist: typer
 Requires-Dist: urllib3>=2.7.0
-Provides-Extra: server
-Requires-Dist: PyJWT[crypto]<3,>=2.10; extra == "server"
 Dynamic: license-file
 
 <p align="center">
@@ -75,7 +74,7 @@ Main package areas:
   authentication, platform resources, and local CodeRepository operations
 - `mainsequence.instrumentation` and `mainsequence.logconf`: SDK tracing and
   logging integration
-- `mainsequence.server`: optional server-side caller assertion verification
+- `mainsequence.server`: server-side caller assertion verification
 - `mainsequence.scaffold_skills`: reusable, version-pinned skill copying for
   this SDK and extension libraries
 
@@ -148,7 +147,7 @@ another repository, use the explicitly scoped `filter_admin` path. See
 [Resource releases](docs/knowledge/infrastructure/resource_releases.md) for
 supported filters and examples.
 
-Server integrations can install `mainsequence[server]` for the
+The standard `mainsequence` installation includes PyJWT and cryptography for the
 framework-independent [caller assertion verifier](docs/knowledge/server/caller_assertions.md).
 Applications remain responsible for resource authorization and storage
 operations.

{mainsequence-9.0.6.dev37 → mainsequence-9.0.6.dev39}/README.md

@@ -39,7 +39,7 @@ Main package areas:
   authentication, platform resources, and local CodeRepository operations
 - `mainsequence.instrumentation` and `mainsequence.logconf`: SDK tracing and
   logging integration
-- `mainsequence.server`: optional server-side caller assertion verification
+- `mainsequence.server`: server-side caller assertion verification
 - `mainsequence.scaffold_skills`: reusable, version-pinned skill copying for
   this SDK and extension libraries
 
@@ -112,7 +112,7 @@ another repository, use the explicitly scoped `filter_admin` path. See
 [Resource releases](docs/knowledge/infrastructure/resource_releases.md) for
 supported filters and examples.
 
-Server integrations can install `mainsequence[server]` for the
+The standard `mainsequence` installation includes PyJWT and cryptography for the
 framework-independent [caller assertion verifier](docs/knowledge/server/caller_assertions.md).
 Applications remain responsible for resource authorization and storage
 operations.

{mainsequence-9.0.6.dev37 → mainsequence-9.0.6.dev39}/agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md

@@ -374,10 +374,29 @@ another branch, deploys nothing for that target.
 
 ### Going Back To An Older Version
 
-Revert the change and release a new version: `git revert <commit>`, raise the
-patch version with `uv version --bump patch`, commit, push, and let CI tag the
-result. The version keeps moving forward and every deployed commit matches its
-tag.
+Two ways work. Use either only when the user asks for it.
+
+- Revert and release a new version: `git revert <commit>`, raise the patch
+  version with `uv version --bump patch`, commit, push, and let CI tag the
+  result. This works for every target, including every-push targets, and keeps
+  the version moving forward.
+- For a target with a `tag_regex`, push the older version's tag again. GitHub
+  sends an event only when a tag is created, so delete the tag on GitHub and
+  push it again; it still points at the same commit:
+
+  ```bash
+  git fetch --tags origin
+  git push origin :refs/tags/v1.2.0
+  git push origin v1.2.0
+  ```
+
+  The target redeploys that commit exactly as it was released: its code, its
+  image and its workflow file, whose settings replace the current ones. The
+  commit must still be on the branch and the tag must match the target's
+  current `tag_regex`. Every-push targets ignore the tag. Re-pushing a tag
+  also re-runs any GitHub Actions workflow that the tag triggers, and a tag
+  ruleset may forbid deleting it; use the revert route then. The next release
+  tag deploys a newer version again.
 
 ## Diagnose Partial Completion Before Retrying
 

mainsequence-9.0.6.dev39/mainsequence/server/__init__.py

@@ -0,0 +1 @@
+"""Server-side platform integrations. Import integrations explicitly."""

{mainsequence-9.0.6.dev37 → mainsequence-9.0.6.dev39}/mainsequence/server/caller_assertions.py

@@ -11,14 +11,10 @@ from collections.abc import Callable
 from dataclasses import dataclass
 from urllib.parse import urlsplit
 
+import jwt
 import requests
-
-try:
-    import jwt
-    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
-    from jwt import InvalidKeyError, InvalidTokenError
-except ImportError as exc:
-    raise ImportError("Caller verification requires the mainsequence[server] extra.") from exc
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from jwt import InvalidKeyError, InvalidTokenError
 
 ASSERTION_HEADER = "X-MainSequence-Caller-Assertion"
 ASSERTION_TYPE = "mainsequence-caller-assertion+jwt"

{mainsequence-9.0.6.dev37 → mainsequence-9.0.6.dev39}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.6.dev37
+Version: 9.0.6.dev39
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -25,13 +25,12 @@ Requires-Dist: protobuf>=6.33.5
 Requires-Dist: psutil
 Requires-Dist: pydantic<3,>=2.11
 Requires-Dist: pygments>=2.20.0
+Requires-Dist: PyJWT[crypto]<3,>=2.10
 Requires-Dist: pyyaml
 Requires-Dist: requests>=2.33.0
 Requires-Dist: structlog
 Requires-Dist: typer
 Requires-Dist: urllib3>=2.7.0
-Provides-Extra: server
-Requires-Dist: PyJWT[crypto]<3,>=2.10; extra == "server"
 Dynamic: license-file
 
 <p align="center">
@@ -75,7 +74,7 @@ Main package areas:
   authentication, platform resources, and local CodeRepository operations
 - `mainsequence.instrumentation` and `mainsequence.logconf`: SDK tracing and
   logging integration
-- `mainsequence.server`: optional server-side caller assertion verification
+- `mainsequence.server`: server-side caller assertion verification
 - `mainsequence.scaffold_skills`: reusable, version-pinned skill copying for
   this SDK and extension libraries
 
@@ -148,7 +147,7 @@ another repository, use the explicitly scoped `filter_admin` path. See
 [Resource releases](docs/knowledge/infrastructure/resource_releases.md) for
 supported filters and examples.
 
-Server integrations can install `mainsequence[server]` for the
+The standard `mainsequence` installation includes PyJWT and cryptography for the
 framework-independent [caller assertion verifier](docs/knowledge/server/caller_assertions.md).
 Applications remain responsible for resource authorization and storage
 operations.

{mainsequence-9.0.6.dev37 → mainsequence-9.0.6.dev39}/mainsequence.egg-info/requires.txt

@@ -10,11 +10,9 @@ protobuf>=6.33.5
 psutil
 pydantic<3,>=2.11
 pygments>=2.20.0
+PyJWT[crypto]<3,>=2.10
 pyyaml
 requests>=2.33.0
 structlog
 typer
 urllib3>=2.7.0
-
-[server]
-PyJWT[crypto]<3,>=2.10

{mainsequence-9.0.6.dev37 → mainsequence-9.0.6.dev39}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.6.dev37"
+version = "9.0.6.dev39"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"
@@ -34,6 +34,7 @@ dependencies = [
   "psutil",
   "pydantic>=2.11,<3",
   "pygments>=2.20.0",
+  "PyJWT[crypto]>=2.10,<3",
   "pyyaml",
   "requests>=2.33.0",
   "structlog",
@@ -41,9 +42,6 @@ dependencies = [
   "urllib3>=2.7.0",
 ]
 
-[project.optional-dependencies]
-server = ["PyJWT[crypto]>=2.10,<3"]
-
 [project.urls]
 Homepage = "https://github.com/mainsequence-sdk/mainsequence-sdk"
 Issues = "https://github.com/mainsequence-sdk/mainsequence-sdk/issues"
@@ -56,7 +54,6 @@ ms = "mainsequence.cli.cli:app"
 dev = [
   "fastapi>=0.110,<1",
   "httpx>=0.27,<1",
-  "PyJWT[crypto]>=2.10,<3",
   "black>=26.3.1",
   "IPython",
   "mkdocs",

{mainsequence-9.0.6.dev37 → mainsequence-9.0.6.dev39}/tests/test_caller_assertions.py

@@ -4,13 +4,12 @@ import json
 import time
 from uuid import uuid4
 
+import jwt
 import pytest
 import requests
+from cryptography.hazmat.primitives.asymmetric import ed25519
 
-jwt = pytest.importorskip("jwt")
-ed25519 = pytest.importorskip("cryptography.hazmat.primitives.asymmetric.ed25519")
-
-from mainsequence.server.caller_assertions import (  # noqa: E402
+from mainsequence.server.caller_assertions import (
     ASSERTION_TYPE,
     CallerAssertionUnavailable,
     CallerAssertionVerifier,

{mainsequence-9.0.6.dev37 → mainsequence-9.0.6.dev39}/tests/test_dependency_extras.py

@@ -6,6 +6,7 @@ import tomllib
 import types
 
 import pytest
+from packaging.requirements import Requirement
 
 
 def _snapshot_mainsequence_modules() -> dict[str, types.ModuleType]:
@@ -57,3 +58,34 @@ def test_streamlit_is_absent_from_dependency_contracts() -> None:
     )
     assert '\nname = "streamlit"\n' not in (repo_root / "uv.lock").read_text(encoding="utf-8")
     assert "streamlit" not in (repo_root / "requirements.txt").read_text(encoding="utf-8").lower()
+
+
+def test_caller_verification_dependencies_are_required() -> None:
+    repo_root = pathlib.Path(__file__).resolve().parents[1]
+    project = tomllib.loads((repo_root / "pyproject.toml").read_text(encoding="utf-8"))["project"]
+    dependencies = {
+        requirement.name.lower(): requirement
+        for requirement in map(Requirement, project["dependencies"])
+    }
+
+    assert "pyjwt" in dependencies
+    assert dependencies["pyjwt"].marker is None
+    assert "crypto" in dependencies["pyjwt"].extras
+    assert "server" not in project.get("optional-dependencies", {})
+
+    lock = tomllib.loads((repo_root / "uv.lock").read_text(encoding="utf-8"))
+    sdk = next(package for package in lock["package"] if package["name"] == "mainsequence")
+    jwt_dependency = next(item for item in sdk["dependencies"] if item["name"] == "pyjwt")
+    assert "crypto" in jwt_dependency["extra"]
+    assert "server" not in sdk.get("optional-dependencies", {})
+    assert "server" not in sdk["metadata"].get("provides-extras", [])
+
+    requirements = {
+        requirement.name.lower(): requirement
+        for line in (repo_root / "requirements.txt").read_text(encoding="utf-8").splitlines()
+        if line.strip() and not line.lstrip().startswith(("#", "-"))
+        for requirement in [Requirement(line)]
+    }
+    for name in ("pyjwt", "cryptography"):
+        assert name in requirements
+        assert requirements[name].marker is None

mainsequence-9.0.6.dev37/mainsequence/server/__init__.py

@@ -1 +0,0 @@
-"""Optional server-side platform integrations. Import integrations explicitly."""