metamuse-cli 0.1.0a1__tar.gz

metamuse_cli-0.1.0a1/.gitattributes

@@ -0,0 +1,2 @@
+tests/fixtures/corpus/import/posts.csv whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol
+tests/fixtures/corpus/import/posts_bom.csv whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol

metamuse_cli-0.1.0a1/.github/workflows/ci.yml

@@ -0,0 +1,245 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+env:
+  METAMUSE_REQUIRE_BROWSER_TESTS: "1"
+  UV_MANAGED_PYTHON: "true"
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  static-wheel:
+    timeout-minutes: 30
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
+        with:
+          python-version: "3.12.13"
+      - name: Install ffmpeg and ffprobe
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ffmpeg
+      - run: uv sync --locked --python 3.12.13 --group dev --extra remote --extra facebook
+      - name: Verify managed Python runtime
+        run: uv run --locked python -c 'import sys; print(sys.version); print(sys.base_prefix); assert sys.version_info[:3] == (3, 12, 13)'
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run python docs/design/validate_design_pack.py
+      - run: |
+          uv run python -m metamuse.schemas
+          git diff --exit-code
+      - run: uv run python tests/fixtures/corpus/check_corpus.py
+      - run: scripts/smoke_wheel.sh
+        env:
+          TMPDIR: ${{ runner.temp }}
+
+  cohorts:
+    timeout-minutes: 30
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      max-parallel: 5
+      matrix:
+        cohort: [core, muse, media, facebook, privacy]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
+        with:
+          python-version: "3.12.13"
+      - name: Install ffmpeg and ffprobe
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ffmpeg
+      - run: uv sync --locked --python 3.12.13 --group dev --extra remote --extra facebook
+      - name: Verify managed Python runtime
+        run: uv run --locked python -c 'import sys; print(sys.version); print(sys.base_prefix); assert sys.version_info[:3] == (3, 12, 13)'
+      - name: Install Chromium from the locked Playwright package
+        run: uv run --locked python -m playwright install --with-deps chromium
+      - name: Enable Chromium user namespace sandbox on the hosted runner
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+      - name: Collect the full suite and run the ordered cohort
+        run: |
+          pytest_temp_dir="$(mktemp -d "${RUNNER_TEMP}/metamuse-pytest.XXXXXX")"
+          trap 'rm -rf "$pytest_temp_dir"' EXIT
+          mkdir -p ci-evidence
+          set -o pipefail
+          uv run --locked python -u -X faulthandler scripts/ci_cohorts.py run \
+            --cohort "${{ matrix.cohort }}" \
+            --source-sha "$GITHUB_SHA" \
+            --manifest "ci-evidence/${{ matrix.cohort }}.json" -- \
+            -q --maxfail=1 -o faulthandler_timeout=0 --basetemp "$pytest_temp_dir" \
+            2>&1 | tee "ci-evidence/${{ matrix.cohort }}.log"
+      - name: Retain manifest and diagnostic log even on failure
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: ci-${{ github.sha }}-${{ matrix.cohort }}
+          path: ci-evidence/
+          if-no-files-found: error
+          retention-days: 7
+
+  installed-journeys:
+    timeout-minutes: 30
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
+        with:
+          python-version: "3.12.13"
+      - name: Install ffmpeg and ffprobe
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ffmpeg
+      - run: uv sync --locked --python 3.12.13 --group dev --extra remote --extra facebook
+      - name: Verify managed Python runtime
+        run: uv run --locked python -c 'import sys; print(sys.version); print(sys.base_prefix); assert sys.version_info[:3] == (3, 12, 13)'
+      - name: Run exact and bounded journeys from the isolated installed wheel
+        env:
+          CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/installed-journey-evidence"
+          set -o pipefail
+          scripts/check_installed_journeys.sh "$GITHUB_SHA" "$RUNNER_TEMP/installed-journey-evidence" \
+            2>&1 | tee "$RUNNER_TEMP/installed-journey-evidence/installed.log"
+      - name: Retain installed provenance and diagnostics even on failure
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: installed-${{ github.sha }}-journeys
+          path: ${{ runner.temp }}/installed-journey-evidence/
+          if-no-files-found: error
+          retention-days: 7
+
+  privacy-load:
+    timeout-minutes: 30
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
+        with:
+          python-version: "3.12.13"
+      - name: Install ffmpeg and ffprobe
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ffmpeg
+      - run: uv sync --locked --python 3.12.13 --group dev --extra remote --extra facebook
+      - name: Verify managed Python runtime
+        run: uv run --locked python -c 'import sys; print(sys.version); print(sys.base_prefix); assert sys.version_info[:3] == (3, 12, 13)'
+      - name: Run five serial final-tree privacy measurements
+        env:
+          CANDIDATE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          unset LD_LIBRARY_PATH
+          export PATH="$HOME/.local/bin:$PATH"
+          evidence="$RUNNER_TEMP/privacy-load-evidence"
+          mkdir -p "$evidence"
+          printf 'run\tevent\texit_code\n' > "$evidence/results.tsv"
+          run=0
+          pytest_temp_dir=
+          cleanup() {
+            status=$?
+            printf '%s\tjob_exit\t%s\n' "$run" "$status" >> "$evidence/results.tsv"
+            if [ -n "$pytest_temp_dir" ]; then rm -rf -- "$pytest_temp_dir"; fi
+          }
+          trap cleanup EXIT
+          trap 'exit 130' INT
+          trap 'exit 143' TERM
+          case "$(stat -f -c %T "$RUNNER_TEMP")" in
+            tmpfs|ramfs) echo 'Privacy measurements require disk scratch' >&2; exit 1 ;;
+          esac
+          uv run --locked python -u -X faulthandler - <<'PY' | tee "$evidence/identity.json"
+          import hashlib, json, os, subprocess, sys
+          from pathlib import Path
+          def git(*args):
+              return subprocess.check_output(["git", *args], text=True).strip()
+          assert sys.version_info[:3] == (3, 12, 13), sys.version
+          assert git("rev-parse", "HEAD") == os.environ["GITHUB_SHA"]
+          assert not git("status", "--porcelain"), "Privacy measurements require a clean checkout"
+          paths = (
+              "src/metamuse/safety.py", "src/metamuse/_muse_redact.py", "tests/cpu_growth.py",
+              "tests/test_muse_round5_growth.py", "tests/test_muse_round6_growth.py",
+              "tests/test_at042_review_fixes.py",
+          )
+          print(json.dumps({
+              "source_commit": git("rev-parse", "HEAD"), "source_tree": git("rev-parse", "HEAD^{tree}"),
+              "source_parents": git("show", "-s", "--format=%P", "HEAD").split(),
+              "candidate_sha": os.environ["CANDIDATE_SHA"],
+              "python_version": sys.version, "python_executable": sys.executable,
+              "python_base_prefix": sys.base_prefix,
+              "sha256": {path: hashlib.sha256(Path(path).read_bytes()).hexdigest() for path in paths},
+          }, sort_keys=True), flush=True)
+          PY
+          nodes=(
+            'tests/test_muse_round5_growth.py::test_r5_5_ordinary_pairs_core_growth'
+            'tests/test_muse_round6_growth.py::test_r6_2_adversarial_grammars_linear[k=>-False-text]'
+            'tests/test_muse_round6_growth.py::test_r6_2_adversarial_grammars_linear[k=>-True-text]'
+            'tests/test_muse_round6_growth.py::test_r6_2_adversarial_grammars_linear[k=>-False-body]'
+            'tests/test_muse_round6_growth.py::test_r6_2_adversarial_grammars_linear[k=>-True-body]'
+            'tests/test_at042_review_fixes.py::test_b16a_bare_muse_cookie_must_not_leak_into_redacted_bundle'
+          )
+          for run in 1 2 3 4 5; do
+            pytest_temp_dir="$(mktemp -d "$RUNNER_TEMP/metamuse-privacy-load.XXXXXX")"
+            printf '%s\tstarted\t\n' "$run" >> "$evidence/results.tsv"
+            {
+              cat "$evidence/identity.json"
+              printf '\nPRIVACY_LOAD_RUN %s\n' "$run"
+              uv run --locked python -u -X faulthandler -m pytest -q -s \
+                --basetemp "$pytest_temp_dir" "${nodes[@]}"
+            } 2>&1 | tee "$evidence/load-$run.log"
+            printf '%s\tcompleted\t0\n' "$run" >> "$evidence/results.tsv"
+            rm -rf -- "$pytest_temp_dir"
+            pytest_temp_dir=
+          done
+      - name: Retain privacy measurement logs and identity even on failure
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: privacy-load-${{ github.sha }}
+          path: ${{ runner.temp }}/privacy-load-evidence/
+          if-no-files-found: error
+          retention-days: 7
+
+  check:
+    timeout-minutes: 30
+    runs-on: ubuntu-24.04
+    needs: [static-wheel, cohorts, installed-journeys, privacy-load]
+    if: always()
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
+        with:
+          python-version: "3.12.13"
+      - run: uv sync --locked --python 3.12.13 --group dev --extra remote --extra facebook
+      - name: Verify managed Python runtime
+        run: uv run --locked python -c 'import sys; print(sys.version); print(sys.base_prefix); assert sys.version_info[:3] == (3, 12, 13)'
+      - name: Download every cohort manifest and log for this source
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          pattern: ci-${{ github.sha }}-*
+          path: ci-evidence
+          merge-multiple: true
+      - name: Require every job and exact full-suite runtime coverage
+        if: always()
+        env:
+          COHORT_RESULT: ${{ needs.cohorts.result }}
+          STATIC_RESULT: ${{ needs.static-wheel.result }}
+          INSTALLED_RESULT: ${{ needs.installed-journeys.result }}
+          PRIVACY_LOAD_RESULT: ${{ needs.privacy-load.result }}
+        run: |
+          python3 scripts/ci_cohorts.py verify --manifest-dir ci-evidence --source-sha "$GITHUB_SHA"
+          test "$COHORT_RESULT" = success
+          test "$STATIC_RESULT" = success
+          test "$INSTALLED_RESULT" = success
+          test "$PRIVACY_LOAD_RESULT" = success

metamuse_cli-0.1.0a1/.github/workflows/pages.yml

@@ -0,0 +1,57 @@
+name: Deploy project page to GitHub Pages
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "site/**"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Deploy static site
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check out page kit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: teddashh/teddashh.github.io
+          ref: 5e51fb954acef56e9f75b4cfd2b57dc76afcdfd8
+          path: .page-kit
+          persist-credentials: false
+
+      - name: Validate site
+        env:
+          PAGE_KIT_DIR: ${{ github.workspace }}/.page-kit/kit
+        run: python3 scripts/check_site.py
+
+      - name: Configure GitHub Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload site artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: ./site
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

metamuse_cli-0.1.0a1/.github/workflows/publish.yml

@@ -0,0 +1,176 @@
+name: Publish Python package
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Exact reviewed version from pyproject.toml
+        required: true
+        default: 0.1.0a1
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-pypi
+  cancel-in-progress: false
+
+jobs:
+  build:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      checks: read
+    env:
+      RELEASE_VERSION: ${{ inputs.version }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Configure isolated demo directories
+        run: |
+          echo "UV_TOOL_DIR=$RUNNER_TEMP/release-tools" >> "$GITHUB_ENV"
+          echo "UV_TOOL_BIN_DIR=$RUNNER_TEMP/release-bin" >> "$GITHUB_ENV"
+          echo "XDG_DATA_HOME=$RUNNER_TEMP/release-data" >> "$GITHUB_ENV"
+      - name: Require successful CI for this exact source commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/check-runs?per_page=100" > "$RUNNER_TEMP/checks.json"
+          python3 - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          checks = json.loads((Path(os.environ['RUNNER_TEMP']) / 'checks.json').read_text())
+          passed = any(
+              check['name'] == 'check'
+              and check['app']['id'] == 15368
+              and check['head_sha'] == os.environ['GITHUB_SHA']
+              and check['conclusion'] == 'success'
+              for check in checks['check_runs']
+          )
+          if not passed:
+              raise SystemExit('The required Actions check has not passed for this commit.')
+          PY
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
+        with:
+          python-version: "3.12.13"
+      - name: Check version and build both distributions
+        run: |
+          python3 - <<'PY'
+          import os
+          import tomllib
+          from pathlib import Path
+
+          project = tomllib.loads(Path('pyproject.toml').read_text())['project']
+          if project['version'] != os.environ['RELEASE_VERSION']:
+              raise SystemExit('Requested version differs from pyproject.toml.')
+          PY
+          uv build --no-sources
+      - name: Verify metadata and create artifact hashes
+        run: |
+          python3 - <<'PY'
+          import hashlib
+          import os
+          import tarfile
+          import zipfile
+          from email.parser import BytesParser
+          from pathlib import Path
+
+          version = os.environ['RELEASE_VERSION']
+          expected = {
+              f'metamuse_cli-{version}-py3-none-any.whl',
+              f'metamuse_cli-{version}.tar.gz',
+          }
+          files = sorted(p for p in Path('dist').iterdir() if p.name != '.gitignore')
+          if {p.name for p in files} != expected:
+              raise SystemExit('Expected exactly one wheel and one source distribution.')
+          sums = []
+          for path in files:
+              if path.suffix == '.whl':
+                  with zipfile.ZipFile(path) as archive:
+                      name = next(n for n in archive.namelist() if n.endswith('.dist-info/METADATA'))
+                      metadata = BytesParser().parsebytes(archive.read(name))
+              else:
+                  with tarfile.open(path) as archive:
+                      metadata = BytesParser().parsebytes(archive.extractfile(f'metamuse_cli-{version}/PKG-INFO').read())
+              if metadata['Name'] != 'metamuse-cli' or metadata['Version'] != version:
+                  raise SystemExit(f'Unexpected package metadata: {path.name}')
+              sums.append(f'{hashlib.sha256(path.read_bytes()).hexdigest()}  {path.name}')
+          Path('dist/SHA256SUMS').write_text('\n'.join(sums) + '\n')
+          print('\n'.join(sums))
+          PY
+      - name: Install the exact release wheel
+        run: uv tool install --python 3.12.13 dist/*.whl
+      - name: Run bundled example outside the checkout
+        working-directory: ${{ runner.temp }}
+        run: '"$UV_TOOL_BIN_DIR/metamuse" demo > "$RUNNER_TEMP/release-demo.log"'
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: pypi-${{ github.sha }}
+          path: dist/
+          if-no-files-found: error
+          retention-days: 90
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+        with:
+          name: release-demo-${{ github.sha }}
+          path: ${{ runner.temp }}/release-demo.log
+          if-no-files-found: error
+          retention-days: 90
+
+  publish:
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    environment:
+      name: pypi
+      url: https://pypi.org/project/metamuse-cli/${{ inputs.version }}/
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      RELEASE_VERSION: ${{ inputs.version }}
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+        with:
+          name: pypi-${{ github.sha }}
+          path: dist/
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
+      - name: Verify downloaded artifact hashes
+        working-directory: dist
+        run: sha256sum --check SHA256SUMS
+      - name: Publish reviewed artifacts through PyPI OIDC
+        run: uv publish --trusted-publishing always dist/*.whl dist/*.tar.gz
+      - name: Verify PyPI has these exact bytes
+        run: |
+          python3 - <<'PY'
+          import hashlib
+          import json
+          import os
+          import time
+          import urllib.error
+          import urllib.request
+          from pathlib import Path
+
+          version = os.environ['RELEASE_VERSION']
+          expected = {
+              p.name: hashlib.sha256(p.read_bytes()).hexdigest()
+              for p in Path('dist').iterdir()
+              if p.name.endswith(('.whl', '.tar.gz'))
+          }
+          for attempt in range(6):
+              try:
+                  with urllib.request.urlopen(f'https://pypi.org/pypi/metamuse-cli/{version}/json', timeout=20) as response:
+                      release = json.load(response)
+                  actual = {item['filename']: item['digests']['sha256'] for item in release['urls']}
+                  if actual == expected:
+                      print(f'PyPI {version}: both file hashes match the reviewed artifacts.')
+                      break
+              except (urllib.error.URLError, TimeoutError):
+                  pass
+              if attempt == 5:
+                  raise SystemExit('PyPI hashes are unconfirmed; inspect the index before retrying.')
+              time.sleep(5)
+          PY

metamuse_cli-0.1.0a1/.gitignore

@@ -0,0 +1,17 @@
+__pycache__/
+*.py[cod]
+.venv/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+dist/
+build/
+*.egg-info/
+*.sqlite3
+*.sqlite3-*
+.env
+.env.*
+/runtime/
+/workspace-data/

metamuse_cli-0.1.0a1/.python-version

@@ -0,0 +1 @@
+3.12

metamuse_cli-0.1.0a1/AGENTS.md

@@ -0,0 +1,35 @@
+# AGENTS.md — MetaMuse CLI
+
+## Product contract (binding; copied from docs/design/AGENTS.md)
+
+先讀01_PLAN、02_SPEC、03_SDS，再依04_BACKLOG的B01–B04實作。這是單一工具，不是五個repo launcher。
+
+一package、一store、一jobs、一設定。CLI/MCP共用app；不做submodules、runtime git clone、plugin framework或第二個AI orchestrator。
+
+主Agent產問題與文案；Muse是協作者，不接管harness或當逐點擊模型。不帶作者策略、人設、F公式、CTA或黃金時段。
+
+採用第三方程式先記license／commit／原path；沒授權不可機械翻寫。成熟依賴不重造。public包不含秘密、真實私有內容或部署資料。
+
+accepted不等於running；沒worker不得說在背景執行。安全讀取與外部send重試分開，不明送達先對帳。来源保真，partial不冒稱complete，模型內容不能mint permissions。
+
+LIVE只在操作者明確授權後執行。缺憑證則fixture＋blocked，不編造結果。不因本文件自動建立repo、發布、改visibility或操作帳號。
+
+交付每個PR的FR/B/AT、實際命令／證據類別、migration、notice與限制。先離線縱切片，Muse spike早做；不要先做Dashboard。核心models/store/jobs修改先協調owner。
+
+Design baseline: `docs/design/` (01_PLAN, 02_SPEC, 03_SDS, 04_BACKLOG, 05_ACCEPTANCE, 06_SOURCES, contracts/). IDs FR-xxx (requirements), Bxx (backlog), AT-xxx (acceptance) come from there. If code and design disagree, either fix the code or update the design docs/contracts in the same commit and call it out in your report. Never maintain two sources of truth.
+
+## Multi-agent development protocol
+
+Several coding agents (Codex, Grok, Gemini) work in parallel, each in its own git worktree on its own branch. An orchestrator assigns tasks, independently re-runs tests, reviews, and merges into `main`.
+
+- Work only inside your assigned worktree/branch and commit there. Never push, add remotes, create hosted repos, publish packages, or touch other worktrees or `main`. This repo is public. Only the orchestrator pushes branches, opens PRs and merges. Keys, account settings, real data and LIVE evidence live in a separate private repo; never read, copy or reference it unless your task prompt explicitly grants access.
+- Ownership: `src/metamuse/models.py`, `store.py`, `jobs.py`, migrations and generated schemas belong to the core owner (B02–B04). Other tasks must not edit them unless their task prompt grants it. If you need a core change, build against the existing API and add a "Core change requests" section to your report (what, why, proposed diff).
+- Extension points that other tasks may use without editing core files are documented in `docs/dev/CORE_API.md` once it exists (operation handler registry, AppContext, error/envelope helpers).
+- Toolchain: Python 3.12 managed by uv. `uv sync`, `uv run pytest -q`, `uv run ruff check .`. No system pip. Add dependencies only with `uv add` and justify each (license, why a mature dependency instead of hand-rolled code).
+- Tests never touch the network or real accounts. LIVE work is out of scope unless a task prompt explicitly authorizes it; without credentials the result is fixture + `blocked`, never an invented success.
+- No secrets, cookies, real private content, hostnames, account settings or personal data in the repo. Fixtures are synthetic and redistributable.
+- License: Apache-2.0 (`LICENSE`). Third-party code only under a compatible license, with provenance and an entry in `THIRD_PARTY_NOTICES.md`.
+- Runtime data lives outside the repo (platformdirs private root); tests use temporary directories.
+- Evidence classes: OFFLINE, FIXTURE, INTEGRATION, MEASURE, LIVE. Mock, schema or `--help` success is never LIVE.
+- Done means: tests green, ruff clean, work committed on your branch, and the report written to the path in your task prompt. The report lists FR/B/AT covered, files changed, exact commands with real results, evidence class, migrations, third-party notices, known limitations, and core change requests.
+- Commit messages: imperative summary line; body lists the B/FR/AT IDs; trailer `Agent: <cli>/<model>`.