ms-markets 3.0.0.dev39__tar.gz → 3.0.1.dev41__tar.gz

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project follows versioned releases.
 
 ## [Unreleased]
 
+### Removed
+
+- The registry write allow-list of 3.0.0: `apps.v1.policy` and the Main Sequence
+  Constant `MARKETS_REGISTRY_WRITERS`. Which applications may trigger registry
+  writes is the platform's grant: an application reaches the Markets API only
+  when its workflow grants it the `MainSequenceMarkets` branch, and every
+  caller the API admits may write. `registry_write` still records the acting
+  identity of every write. A deployment that created the constant can delete it.
+
 ## [3.0.0] - 2026-10-26
 
 Breaking release 3.0.0. It renames the DataNode vocabulary to the MetaTables
@@ -287,6 +296,19 @@ portfolio and strategy identities do not change. Dependent packages declare
 
 ### Fixed
 
+- Every hosted rollout since 2026-10-21 stopped at the `migrate-markets` Job
+  with `No package metadata was found for ms-markets`. Main Sequence images no
+  longer install the repository itself (platform ADR-080); Jobs and the Markets
+  API import it from `/workspace`. `msm`, the API and the CLI now read the version
+  through `msm.distribution.package_version()`, which falls back to the
+  checkout's `pyproject.toml` when the distribution is not installed.
+
+- `requirements.txt`, the only dependency input of a Main Sequence image, still
+  pinned `mainsequence-metatable==0.1.51` after the floor moved to 0.1.57, so the
+  image lacked `metatables.envelope_contract`. It is regenerated with
+  `mainsequence code-repository sync`, and a test now fails when its pins differ
+  from `uv.lock`.
+
 - A storage instance built on a provider's declarative base copied each
   referenced Markets table whole, with that table's own foreign keys to tables
   that were not copied, so the provider's `metadata.sorted_tables` and Alembic

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-markets
-Version: 3.0.0.dev39
+Version: 3.0.1.dev41
 Summary: Financial markets ORM, engines, and application management extensions for Main Sequence.
 Project-URL: Changelog, https://github.com/mainsequence-projects/MainSequenceMarkets/blob/main/CHANGELOG.md
 Project-URL: Source, https://github.com/mainsequence-projects/MainSequenceMarkets

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/docs/ADR/0047-markets-api-application-boundary.md

@@ -154,10 +154,11 @@ Organization admin can enable it: the declaration takes effect only when the
 person who pushes it is an Organization admin, and otherwise the resource fails
 before it deploys. Services enforce
 domain policy: ownership and Team scoping for
-portfolios, accounts, indexes and formula definitions, and application-level
-permissions such as "this application may register accounts". Writes keep
-running as the Markets workload, whose Writer grant is the single place writes
-are allowed; the API's policy decides who may trigger them.
+portfolios, accounts, indexes and formula definitions. Writes keep running as
+the Markets workload, whose Writer grant is the single place writes are
+allowed. Which applications may trigger them is the platform's grant: an
+application reaches the Markets API only when its workflow grants it the
+`MainSequenceMarkets` branch.
 
 ### 4. Provider-owned namespaces and sidecars
 
@@ -393,13 +394,9 @@ Deviations and open items:
 - Ownership and Team scoping policies are not enforced yet; the helper gives
   every service one identity to authorize against, and the platform's own
   grants still apply to requester-bound reads.
-- Application-level permission ("this application may register accounts") is
-  enforced by `apps.v1.policy`: an application (workload identity) triggers a
-  registry write only when the `MARKETS_REGISTRY_WRITERS` constant lists its
-  User uid for that resource or for `"*"`; otherwise the route returns `403`.
-  People, requester-bound calls, Organization admins and calls outside a
-  request are not restricted by it. A missing constant allows no application;
-  an unreadable or malformed one fails closed with `503`.
+- Application-level permission is the platform's grant, not a Markets
+  setting: an application whose workflow grants it the `MainSequenceMarkets`
+  branch reaches the API and may trigger registry writes.
 - `acts_for_requester: true` on the `markets-api` resource is required for a
   requester to be present. It is declared in
   `.mainsequence/workflows/ms-markets-api.yaml`, and it takes effect only when
@@ -419,7 +416,7 @@ route for:
   rebalancing uses, and the instance methods `FormulaIndex.activate()` and
   `retire()`. Schedules now read `CalendarSession.filter` with range bounds;
   activation and retirement go through `FormulaIndex.activate_definition` and
-  `retire_definition`, which are policy-checked writes.
+  `retire_definition`, which are registry writes.
 - Added reads: `filter`/`count` range lookups (`__gte`, `__gt`, `__lte`,
   `__lt`); `AssetSnapshots.latest` by identifier, uid or ticker; `offset` on
   `GET /portfolio/values/`, which `MarketsClient.portfolio_values` uses to page
@@ -484,8 +481,8 @@ application still installs `ms-markets`. Deviations and refinements:
   branch, as the Markets API does for MetaTables.
 - Remote `delete` runs the resource's service delete with its preflight
   checks, and exists only where one exists.
-- Registry writes through these routes are subject to the registry write
-  policy of decision 3.
+- Registry writes through these routes run through `registry_write`, like the
+  service routes.
 
 ### 2026-10-25: step 1, missing routes
 

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/docs/fast_api/v1/index.md

@@ -223,42 +223,11 @@ write and, after a successful write, records resource, action, row uid and the
 acting identity's uid and kind on the `apps.v1.identity` logger. No registry
 table has an author or owner column yet; when one does, the same hook supplies
 its value. Writes keep running as the Markets workload, whose `data_writer`
-role on `mainsequence.markets` is the single place writes are allowed; the API's
-policy decides who may trigger them.
-
-That policy is `apps.v1.policy.authorize_registry_write`, which `registry_write`
-runs before every registry write:
-
-| Acting identity | Registry writes |
-|---|---|
-| none (Markets' own Jobs, scripts, direct service calls) | allowed |
-| a requester-bound call (a person acting through an application) | allowed |
-| an Organization admin | allowed |
-| a person calling directly | allowed |
-| an application (workload identity) listed for the resource | allowed |
-| any other application | `403` |
-
-The allow-list is the Main Sequence Constant `MARKETS_REGISTRY_WRITERS` in the
-Markets deployment's Environment: a JSON object that maps a registry resource,
-as `registry_write` names it (`account`, `asset`, `asset-category`, `calendar`,
-`index`, `portfolio`, `portfolio-group`, `portfolio-signal`, `pricing-curve`,
-`pricing-market-data` and the resources added with the provider write routes), or
-`"*"`, to the User uids of the applications allowed to write it:
-
-```json
-{"asset": ["<provider workload user uid>"], "*": ["<trusted workload user uid>"]}
-```
-
-A missing constant allows no application. A value that is not such an object,
-or a constant the Markets workload cannot read, refuses every application write
-with `503`. Whether a caller is a person or an application is read from its
-User once and cached for ten minutes; the SDK caches the constant for ten
-minutes as well, so an edit takes effect within that time. The Markets workload
-needs `reader` on the constant:
-
-```bash
-mainsequence constants access grant <MARKETS_REGISTRY_WRITERS constant uid> reader --user <markets workload user uid>
-```
+role on `mainsequence.markets` is the single place writes are allowed. Who may
+trigger them is the platform's grant: an application's workload reaches the
+Markets API only when its workflow grants it the `MainSequenceMarkets` branch
+(see the [client guide](../../knowledge/msm/client/index.md)), and every caller
+the API admits, person or application, may trigger registry writes.
 
 A requester is only present when the `markets-api` resource declares
 `acts_for_requester: true` in `.mainsequence/workflows/ms-markets-api.yaml`.

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/docs/fast_api/v1/rows.md

@@ -49,8 +49,7 @@ Writes (`create`, `upsert`, `update`, `delete`, `add`, `bulk_delete`,
 `create_from_pandas_calendar`, `reconcile_dataset_availability`, `upsert_many`,
 `add_many`, `create_index_curve_selection`, `upsert_index_curve_selection`,
 `publish`, `register`, `register_signal`, `unregister`, `unregister_signal`, `reconcile`, `activate_definition`,
-`retire_definition`) run through `registry_write`, so the registry write policy
-applies to applications.
+`retire_definition`) run through `registry_write`, which records who made them.
 A table row class's `delete` runs the resource's service delete with its
 preflight checks and exists only for `asset`, `asset-category`, `calendar`,
 `index`, `portfolio` and `portfolio-group`. Composites that implement `delete`
@@ -67,8 +66,7 @@ the `msm_pricing.api` composites (`curve`, `curve-building-details`,
 | Status | Meaning | `error_type` |
 |---|---|---|
 | 400 | Invalid arguments | `ValueError`, `TypeError` |
-| 403 | The registry write policy refused this application | |
+| 403 | The operation refused the acting identity | `PermissionError` or a subclass |
 | 404 | Unknown resource or operation, or the row was not found | `LookupError` |
 | 409 | The operation conflicted with existing rows | the conflict class name |
 | 501 | The operation is not offered remotely | `NotImplementedError` |
-| 503 | The registry write policy could not be read | |

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/docs/knowledge/msm/client/index.md

@@ -61,14 +61,12 @@ access:
 | `MARKETS_API_RELEASE_UID` | Use this release instead of searching. |
 | `MARKETS_API_RELEASE_NAME`, `MARKETS_API_REPOSITORY_NAME` | Search for another release or repository name. |
 
-## Writes And The Registry Write Policy
+## Writes
 
 Every create, upsert, update and delete runs through the Markets API's
-`registry_write`, so the registry write policy applies: an application may
-write a resource only when the Environment's `MARKETS_REGISTRY_WRITERS`
-constant lists its workload User uid for that resource or for `"*"`. A refused
-write raises `msm.api.remote.MarketsAccessError`, a `PermissionError`. See
-[the FastAPI guide](../../../fast_api/v1/index.md) for the constant's format.
+`registry_write`, which records the acting identity on the API's audit log. Any
+workload the platform admits to the Markets API may write; a refused operation
+(`403`) raises `msm.api.remote.MarketsAccessError`, a `PermissionError`.
 
 A table row class's remote `delete` runs the resource's service delete, with
 its preflight checks, and exists only for `asset`, `asset-category`,
@@ -143,7 +141,6 @@ AssetSnapshots.publish([{"asset_identifier": "ACME", "time_index": as_of, "name"
 current = AssetSnapshots.latest(tickers=["ACME"])
 ```
 
-Their write-policy resources are `account-holdings` and `asset-snapshots`.
 `AssetSnapshots.latest` takes exactly one of `asset_identifiers`, `asset_uids`
 or `tickers` and returns each existing asset with its latest snapshot
 (`AssetSnapshotReference`: name, ticker, exchange code, snapshot time; `None`

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/docs/knowledge/msm/indices/formula_indexes.md

@@ -153,7 +153,7 @@ Activating a successor closes the open predecessor at the successor's
 `valid_from`. Retired versions cannot be reactivated. `activate()` and
 `retire()` call the class methods `FormulaIndex.activate_definition(uid)` and
 `FormulaIndex.retire_definition(uid, valid_to=...)`, so they also run under the
-remote row backend (write-policy resource `formula-index`).
+remote row backend.
 
 ## Preview Persisted Formulas
 

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/docs/knowledge/msm_portfolios/portfolios/index.md

@@ -467,7 +467,7 @@ enters `update_hash`.
 An application on the remote row backend registers and reconciles the catalog
 with `msm_portfolios.api.datasets.PortfolioDatasets.register(...)`,
 `.reconcile(...)` and `.get(...)`, which run the services below on the Markets
-API (write-policy resource `portfolio-datasets`). `register` binds the
+API. `register` binds the
 portfolio's current signal; `PortfolioDatasets.register_signal({"signal_uid":
 ..., "signal_meta_table_uid": ...})` binds any other signal, such as the earlier
 signals of a producer whose signal uid changes each run, after verifying the
@@ -587,8 +587,8 @@ first on a rollback. Calendar events are not copied: the engine rebuilds them.
 run the moves a provider callable returns (it receives `rollback=` when it
 accepts that argument); without `--execute` they only count.
 The operator needs `data_viewer` on the tables read, write access to the tables
-written (a rollback writes the core tables) and the write-policy resource
-`portfolio-datasets`; pause the provider's runs while a move or rollback runs.
+written (a rollback writes the core tables); pause the provider's runs while a
+move or rollback runs.
 
 ## Repair legacy midnight-indexed portfolio values
 

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/docs/planning/implementation_tasks/markets_contracts_package_and_client_plan.md

@@ -4,7 +4,7 @@
 
 Design note, drafted 2026-10-25 for [ADR 0047](../../ADR/0047-markets-api-application-boundary.md)
 decision 2 and migration path step 2. Updated 2026-10-26: the remote row
-backend, `msm.client` and the registry write policy are implemented, with the
+backend and `msm.client` are implemented, with the
 deviations recorded in the ADR's "step 2" implementation note (per-method
 dispatch instead of a `RowBackend` protocol, mixed backends per row class,
 release name `api`). The distribution split (order of work, step 5) is not. Step 1

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-markets"
-version = "3.0.0.dev39"
+version = "3.0.1.dev41"
 description = "Financial markets ORM, engines, and application management extensions for Main Sequence."
 readme = "README.md"
 requires-python = ">=3.13,<3.14"

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/src/msm/__init__.py

@@ -1,8 +1,7 @@
 from __future__ import annotations
 
-from importlib.metadata import version as _package_version
-
 from msm.bootstrap import start_engine
+from msm.distribution import package_version
 from msm.constants import (
     ASSET_TYPE_BOND,
     ASSET_TYPE_CRYPTO,
@@ -30,7 +29,7 @@ from msm.constants import (
     INDEX_TYPE_INTEREST_RATE_DEFINITION,
 )
 
-__version__ = _package_version("ms-markets")
+__version__ = package_version()
 
 
 __all__ = [

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/src/msm/api/remote.py

@@ -75,7 +75,7 @@ WRITE_OPERATIONS = frozenset(
     }
 )
 """Operations that create, update or delete registry rows; the API wraps them in
-``registry_write`` so the registry write policy applies."""
+``registry_write``, which records who made them."""
 
 
 class RemoteBackend(Protocol):

ms_markets-3.0.1.dev41/src/msm/distribution.py

@@ -0,0 +1,30 @@
+"""The ms-markets version, whether installed or run from its source checkout."""
+
+from __future__ import annotations
+
+import tomllib
+from importlib.metadata import PackageNotFoundError, version
+from pathlib import Path
+
+DISTRIBUTION_NAME = "ms-markets"
+SOURCE_CHECKOUT_ROOT = Path(__file__).resolve().parents[2]
+
+
+def package_version() -> str:
+    """Return the installed ms-markets version, else the one its checkout declares.
+
+    Main Sequence images run this repository from ``/workspace`` without
+    installing it (platform ADR-080), so a Job or the Markets API has no package
+    metadata for ``ms-markets``. Its ``pyproject.toml`` declares the version.
+    """
+    try:
+        return version(DISTRIBUTION_NAME)
+    except PackageNotFoundError:
+        pyproject = SOURCE_CHECKOUT_ROOT / "pyproject.toml"
+        if not pyproject.is_file():
+            raise RuntimeError("ms-markets package metadata is unavailable.") from None
+        project = tomllib.loads(pyproject.read_text(encoding="utf-8")).get("project", {})
+        declared = project.get("version")
+        if project.get("name") != DISTRIBUTION_NAME or not isinstance(declared, str) or not declared.strip():
+            raise RuntimeError("ms-markets package version is unavailable.") from None
+        return declared

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/src/msm_cli/main.py

@@ -3,8 +3,6 @@ from __future__ import annotations
 import argparse
 import json
 import sys
-import tomllib
-from importlib.metadata import PackageNotFoundError, distribution
 from pathlib import Path
 from typing import Any
 
@@ -149,13 +147,15 @@ def copy_msm_skills_command(
     code_repository_dir = path.expanduser().resolve(strict=False)
     destination_root = code_repository_dir / ".agents" / "skills" / MSM_SKILL_NAMESPACE
     source_label = _source_root_label(source_root)
+    from msm.distribution import package_version
+
     try:
         result = copy_scaffold_skills(
             code_repository_dir=code_repository_dir,
             library_name="ms-markets",
             namespace=MSM_SKILL_NAMESPACE,
             skills_path=source_root,
-            pinned_version=_ms_markets_version(),
+            pinned_version=package_version(),
             command=MSM_SKILL_COPY_COMMAND,
             dry_run=dry_run,
             code_repository_guard=_copy_msm_skills_block_reason,
@@ -359,20 +359,6 @@ def _same_or_inside_path(path: Path, possible_parent: Path) -> bool:
     return resolved_path == resolved_parent or resolved_path.is_relative_to(resolved_parent)
 
 
-def _ms_markets_version() -> str:
-    try:
-        return distribution("ms-markets").version
-    except PackageNotFoundError:
-        pyproject = _ms_markets_source_checkout_root() / "pyproject.toml"
-        if not pyproject.is_file():
-            raise RuntimeError("ms-markets package metadata is unavailable.")
-        project_config = tomllib.loads(pyproject.read_text(encoding="utf-8"))
-        version = project_config.get("project", {}).get("version")
-        if not isinstance(version, str) or not version.strip():
-            raise RuntimeError("ms-markets package version is unavailable.")
-        return version
-
-
 def _print_table(title: str, headers: list[str], rows: list[list[Any]]) -> None:
     print(title)
     if not rows:

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/tests/conftest.py

@@ -129,20 +129,3 @@ def offline_postgresql_runtime(monkeypatch):
 
     monkeypatch.setattr(metatables.runtime_context, "get_runtime_context", get_runtime_context)
     return runtime
-
-
-@pytest.fixture(autouse=True)
-def offline_registry_write_policy(monkeypatch):
-    """Evaluate the registry write policy without the platform (ADR 0047).
-
-    By default no application is on the allow-list and every caller is a
-    person, which is how the API behaved before the policy. Policy tests replace
-    these with ``monkeypatch``.
-    """
-
-    from apps.v1 import policy
-
-    monkeypatch.setattr(
-        policy, "load_registry_writer_policy", lambda: policy.RegistryWriterPolicy(writers={})
-    )
-    monkeypatch.setattr(policy, "resolve_identity_type", lambda uid: "human")

{ms_markets-3.0.0.dev39 → ms_markets-3.0.1.dev41}/tests/msm/client/test_remote_backend.py

@@ -17,7 +17,6 @@ from typing import Any
 import pytest
 from fastapi.testclient import TestClient
 
-from apps.v1 import policy
 from apps.v1.main import app
 from msm.api.accounts import Account
 from msm.api.assets import Asset, AssetCategory, CurrencySpot
@@ -218,28 +217,6 @@ def test_validation_errors_come_back_as_value_errors(remote) -> None:
         Asset.upsert(asset_type="equity")
 
 
-def test_the_write_policy_applies_to_remote_writes(monkeypatch, remote) -> None:
-    monkeypatch.setattr(policy, "resolve_identity_type", lambda uid: "workload")
-    monkeypatch.setattr(
-        "msm.repositories.crud.upsert_model",
-        lambda *args, **kwargs: pytest.fail("a refused write must not reach the runtime"),
-    )
-
-    with pytest.raises(MarketsAccessError, match="MARKETS_REGISTRY_WRITERS"):
-        Asset.upsert(unique_identifier="ACME")
-    assert isinstance(MarketsAccessError("x"), PermissionError)
-
-
-def test_reads_are_not_subject_to_the_write_policy(monkeypatch, remote) -> None:
-    monkeypatch.setattr(policy, "resolve_identity_type", lambda uid: "workload")
-    monkeypatch.setattr(
-        "msm.repositories.crud.get_model_by_uid",
-        lambda context, *, model, uid: {"rows": []},
-    )
-
-    assert Asset.get_by_uid(uuid.uuid4()) is None
-
-
 def test_start_engine_attaches_nothing_under_the_remote_backend(monkeypatch, remote) -> None:
     monkeypatch.setattr(
         "msm.bootstrap.start_engine",
@@ -410,15 +387,20 @@ def test_holdings_and_snapshots_publish_through_markets(monkeypatch, remote) ->
         ("formula-index", "retire_definition", {"definition_uid": str(uuid.uuid4())}),
     ],
 )
-def test_every_publication_and_catalog_write_is_policy_checked(
+def test_every_publication_and_catalog_write_is_a_registry_write(
     monkeypatch, remote, resource, operation, arguments
 ) -> None:
     from msm.api.remote import WRITE_OPERATIONS
 
-    monkeypatch.setattr(policy, "resolve_identity_type", lambda uid: "workload")
+    def resolve() -> None:
+        raise PermissionError("registry_write resolved the acting identity")
+
+    # registry_write resolves the acting identity before the operation runs; the
+    # refusal comes back as the client's PermissionError.
+    monkeypatch.setattr("apps.v1.identity.acting_identity", resolve)
 
     assert operation in WRITE_OPERATIONS
-    with pytest.raises(MarketsAccessError, match="MARKETS_REGISTRY_WRITERS"):
+    with pytest.raises(MarketsAccessError, match="registry_write resolved the acting identity"):
         remote.client.run_row_operation(resource, operation, arguments)
 
 

ms_markets-3.0.1.dev41/tests/msm/test_distribution.py

@@ -0,0 +1,63 @@
+"""ms-markets must know its version when Main Sequence runs it without installing it."""
+
+from __future__ import annotations
+
+import re
+import tomllib
+from importlib.metadata import PackageNotFoundError
+from pathlib import Path
+
+import pytest
+
+from msm import distribution
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
+DECLARED_VERSION = tomllib.loads((REPOSITORY_ROOT / "pyproject.toml").read_text(encoding="utf-8"))[
+    "project"
+]["version"]
+
+
+def _not_installed(name: str) -> str:
+    raise PackageNotFoundError(name)
+
+
+def test_installed_metadata_is_preferred(monkeypatch):
+    monkeypatch.setattr(distribution, "version", lambda name: "9.9.9")
+
+    assert distribution.package_version() == "9.9.9"
+
+
+def test_source_checkout_declares_the_version_when_not_installed(monkeypatch):
+    # Main Sequence images run /workspace via PYTHONPATH without installing it (ADR-080).
+    monkeypatch.setattr(distribution, "version", _not_installed)
+
+    assert distribution.package_version() == DECLARED_VERSION
+
+
+def test_missing_checkout_and_metadata_fail_clearly(monkeypatch, tmp_path):
+    monkeypatch.setattr(distribution, "version", _not_installed)
+    monkeypatch.setattr(distribution, "SOURCE_CHECKOUT_ROOT", tmp_path)
+
+    with pytest.raises(RuntimeError, match="metadata is unavailable"):
+        distribution.package_version()
+
+
+def test_another_projects_pyproject_is_not_read_as_ms_markets(monkeypatch, tmp_path):
+    (tmp_path / "pyproject.toml").write_text('[project]\nname = "other"\nversion = "1.0.0"\n', encoding="utf-8")
+    monkeypatch.setattr(distribution, "version", _not_installed)
+    monkeypatch.setattr(distribution, "SOURCE_CHECKOUT_ROOT", tmp_path)
+
+    with pytest.raises(RuntimeError, match="version is unavailable"):
+        distribution.package_version()
+
+
+def test_only_the_distribution_module_reads_ms_markets_metadata():
+    lookup = re.compile(r"""(version|distribution|metadata)\(\s*["']ms-markets["']""")
+    offenders = [
+        str(path.relative_to(REPOSITORY_ROOT))
+        for root in ("src", "apps", "jobs")
+        for path in (REPOSITORY_ROOT / root).rglob("*.py")
+        if lookup.search(path.read_text(encoding="utf-8"))
+    ]
+
+    assert offenders == []

ms_markets-3.0.1.dev41/tests/packaging/test_requirements_export.py

@@ -0,0 +1,28 @@
+"""Main Sequence images install requirements.txt only, so it must match uv.lock."""
+
+from __future__ import annotations
+
+import re
+import tomllib
+from pathlib import Path
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
+PIN = re.compile(r"^([A-Za-z0-9_.-]+)==([^\s;]+)")
+
+
+def _canonical(name: str) -> str:
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def test_requirements_pins_match_the_lockfile():
+    # Regenerate with `mainsequence code-repository sync` after a dependency change.
+    lock = tomllib.loads((REPOSITORY_ROOT / "uv.lock").read_text(encoding="utf-8"))
+    locked = {_canonical(package["name"]): package["version"] for package in lock["package"]}
+    pins = {
+        _canonical(match[1]): match[2]
+        for line in (REPOSITORY_ROOT / "requirements.txt").read_text(encoding="utf-8").splitlines()
+        if (match := PIN.match(line))
+    }
+
+    assert pins
+    assert {name: version for name, version in pins.items() if locked.get(name) != version} == {}