systems-manager 1.35.2__tar.gz → 2.2.2__tar.gz

{systems_manager-1.35.2 → systems_manager-2.2.2}/.pre-commit-config.yaml

@@ -1,5 +1,11 @@
+# Without this, `pre-commit install` wires ONLY the pre-commit hook, so `git push`
+# runs nothing and every hook staged pre-push is silently dead code.
+default_install_hook_types: [pre-commit, pre-push]
 default_language_version:
   python: python3
+# Phase 0 dev-velocity contract (arbora-completion-program): a hook with no
+# explicit `stages:` below is commit-only, never both.
+default_stages: [pre-commit]
 exclude: 'dotnet'
 ci:
   autofix_prs: true
@@ -8,7 +14,7 @@ ci:
 
 repos:
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v6.0.0
+  rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # v6.0.0
   hooks:
   - id: check-added-large-files
     args: ["--maxkb=2000"]
@@ -25,17 +31,17 @@ repos:
   - id: end-of-file-fixer
   - id: no-commit-to-branch
 - repo: https://github.com/psf/black
-  rev: 26.3.1
+  rev: 258e7dbf348bc23cb70b8cdf693481c04634ebcc  # frozen: 26.10.1
   hooks:
   - id: black
 - repo: https://github.com/astral-sh/ruff-pre-commit
-  rev: v0.15.8
+  rev: 38bfb07c0c64c304f47eb52090f8288150c77730  # frozen: v0.17.1
   hooks:
   - id: ruff
     types_or: [python, pyi, jupyter]
     args: ["--fix", "--ignore=E402"]
 - repo: https://github.com/jendrikseipp/vulture
-  rev: v2.16
+  rev: 258fe6a1974e89a2add9a45519a9e9dd9f46154e  # frozen: v2.16
   hooks:
   - id: vulture
     pass_filenames: false
@@ -43,40 +49,30 @@ repos:
       "--ignore-names", "request"]                                                                                                 # or 100 if you want very high confidence only
     require_serial: true
 - repo: https://github.com/codespell-project/codespell
-  rev: v2.4.2
+  rev: 57b21406f092110c18776e39b0bda50d37c945c8  # frozen: v2.4.3
   hooks:
   - id: codespell
     args: ["-L", "ans,linar,nam,tread,ot,callin,"]
     exclude: (?x)^(systems_manager/skills/git-cli-docs/reference/.*)$
 - repo: https://github.com/PyCQA/bandit
-  rev: 1.8.6
+  rev: 92ae8b82fb422a639f0ed8d99e96cea769594e08  # frozen: 1.9.4
   hooks:
   - id: bandit
     args: ["--skip", "B101,B404,B603"]
     exclude: ^(tests/|test/|scripts/|script/|__tests__/)
 - repo: https://github.com/nbQA-dev/nbQA
-  rev: 1.9.1
+  rev: f96ec7f3b26a32619435686eb5813235f7e3327e  # frozen: 1.9.1
   hooks:
   - id: nbqa-ruff
 - repo: local
   hooks:
-  - id: okf-no-legacy-concepts
-    name: OKF-CIS — no legacy CONCEPT ids
-    entry: python3 /home/apps/workspace/agent-packages/agent-utilities/scripts/check_no_legacy_markers.py .
+  - id: dependency-readiness
+    name: Dependency readiness — every declared intra-fleet constraint is installable
+    entry: bash -c 'P=""; d="$PWD"; while [ "$d" != "/" ]; do [ -d "$d/agent-packages/agents/repository-manager" ] && { P="$d/agent-packages/agents/repository-manager"; break; }; d=$(dirname "$d"); done; [ -n "$P" ] || P=repository-manager; uv run --no-project --python 3.12 --prerelease=allow --with "$P" python -m repository_manager.dependency_readiness .'
     language: system
     pass_filenames: false
     always_run: true
-  - id: check-mermaid
-    name: Check Mermaid syntax
-    entry: python3 /home/apps/workspace/agent-packages/agent-utilities/scripts/mermaid_linter.py
-    language: system
-    files: \.md$
-    pass_filenames: true
-  - id: check-stubs
-    name: Check for Active Stubs and TODOs
-    entry: python3 /home/apps/workspace/agent-packages/agent-utilities/scripts/check_stubs.py
-    language: system
-    types: [python]
+    stages: [manual, pre-push]
   - id: mermaid-validate
     name: mermaid-validate
     entry: mermaid-validate
@@ -91,30 +87,9 @@ repos:
     language: system
     pass_filenames: false
     always_run: true
-  - id: mcp-readme-table
-    name: sync MCP tools table in README
-    entry: |-
-      bash -c 'if [ -f uv.lock ]; then uv run python -m agent_utilities.mcp.readme_tools; else python -m agent_utilities.mcp.readme_tools; fi'
-    language: system
-    files: ^(README\.md|.*/mcp_server\.py|.*/mcp/.*\.py)$
-    pass_filenames: false
-  - id: readme-env-vars
-    name: sync env-vars table in README
-    entry: |-
-      bash -c 'if [ -f uv.lock ]; then uv run python -m agent_utilities.mcp.readme_env_vars; else python -m agent_utilities.mcp.readme_env_vars; fi'
-    language: system
-    files: ^(README\.md|\.env\.example)$
-    pass_filenames: false
-  - id: readme-mcp-examples
-    name: sync mcp_config examples in README + env blocks
-    entry: |-
-      bash -c 'if [ -f uv.lock ]; then uv run python -m agent_utilities.mcp.readme_mcp_examples; else python -m agent_utilities.mcp.readme_mcp_examples; fi'
-    language: system
-    files: ^(README\.md|\.env\.example|mcp_config.*\.json|.*/mcp_config.*\.json|.*/mcp_server\.py)$
-    pass_filenames: false
   - id: env-var-drift
     name: check env-var/config drift
-    entry: bash -c 'if [ -f uv.lock ]; then uv run python -m agent_utilities.mcp.check_env_var_drift --check; else python -m agent_utilities.mcp.check_env_var_drift --check; fi'
+    entry: bash -c 'if [ -f uv.lock ]; then uv run python -m agent_connector_sdk.mcp.env_drift --check; else python -m agent_connector_sdk.mcp.env_drift --check; fi'
     language: system
     pass_filenames: false
     files: ^(README\.md|\.env\.example|mcp_config.*\.json|.*/mcp_config.*\.json|docker/.*compose.*\.ya?ml|.*/auth\.py|.*/mcp_server\.py)$
@@ -133,7 +108,7 @@ repos:
     pass_filenames: false
     always_run: true
 - repo: https://github.com/AleksaC/hadolint-py
-  rev: v2.14.0
+  rev: 6e7504451511eaeb62a3e7f14d63b0296cbf86eb  # frozen: v2.15.1
   hooks:
   - id: hadolint
     args:
@@ -143,7 +118,7 @@ repos:
     - --ignore=DL4006
     - --ignore=SC2102
 - repo: https://github.com/IamTheFij/docker-pre-commit
-  rev: v3.0.1
+  rev: f626253b23de45412865c07fd076ff95d4cd77a7 # v3.0.1
   hooks:
   - id: docker-compose-check
 - repo: local

{systems_manager-1.35.2 → systems_manager-2.2.2}/AGENTS.md

@@ -1,20 +1,32 @@
 # AGENTS.md
 
-> Claude Code loads this file via `CLAUDE.md` (`@AGENTS.md` import) — the two stay
-> in sync. Edit **this** file, not `CLAUDE.md`.
+<!-- agent-contract:start -->
+## Agent contract
+
+Tool-neutral rules for any AI agent or human working in this repository. This block is maintained by the fleet standard; edit outside the markers.
+
+- **Owner boundary:** this repository owns one external system's calls, mappings and MCP tools (spec prefix `CONN-SYSTEMS-MANAGER-`); it depends on the connector SDK only. Feature routing across repositories: [ecosystem boundaries](https://github.com/Knuckles-Team/pipelines/blob/main/reference/ecosystem-boundaries.md).
+- **Setup:** run `scripts/bootstrap.sh`. It is idempotent and non-interactive: it pins uv and Python, syncs the locked environment, installs the git hooks and prints the gate command.
+- **Gates:** `uvx pre-commit run --all-files` must pass before you push. Do not bypass hooks to get green.
+- **Commits:** one logical change per commit with a `Spec: <ID>` trailer (or `Spec: none (<reason>)`), plus a `Co-Authored-By:` trailer naming the assisting agent. Stage explicit paths only; never `git add -A` or `git add .`. Use your own configured Git identity, never a tool or bot name.
+- **Org rules:** [organization AGENTS.md](https://github.com/Knuckles-Team/.github/blob/main/AGENTS.md).
+<!-- agent-contract:end -->
+
+> Canonical guidance for any AI coding agent or human; tool-specific entry files
+> (for example `CLAUDE.md`) only import this file. Edit this file.
 
 ## Tech Stack & Architecture
-- Language/Version: Python 3.10+
-- Core Libraries: `agent-utilities`, `fastmcp`, `pydantic-ai`
+- Language/Version: Python 3.11–3.14
+- Core Libraries: `agent-connector-sdk`, `fastmcp`, `pydantic-ai`, `psutil`, `distro`
 - Key principles: Functional patterns, Pydantic for data validation, asynchronous tool execution.
 - Architecture:
     - `mcp_server.py`: Main MCP server entry point and tool registration.
     - `agent.py`: Pydantic AI agent definition and logic.
     - `storage_health.py`: Physical-disk + BMC drive-fault health (CONCEPT:SM-OS.governance.sys-8/1.5)
       — SMART (incl. RAID `megaraid` passthrough), BMC/IPMI drive-slot faults, RAID PD
-      state, correlated; runs over the manager seam (local or remote host). Reuses the
-      `fan-manager` IPMI wrapper for BMC reads when present (else shells `ipmitool`).
-    - `bmc_credentials.py`: runtime OpenBao read of `apps/idrac` for out-of-band BMC.
+      state, correlated; runs over the manager seam (local or remote host).
+    - `bmc_credentials.py`: consumes an exact runtime credential projection resolved by
+      AgentConfig from an external secret reference.
     - `skills/`: Directory containing modular agent skills (if applicable).
 
 ### Architecture Diagram
@@ -22,14 +34,13 @@
 graph TD
     User([User/A2A]) --> Server[A2A Server / FastAPI]
     Server --> Agent[Pydantic AI Agent]
-    Agent --> Skills[Modular Skills]
     Agent --> MCP[MCP Server / FastMCP]
     MCP --> Client[API Client / Wrapper]
     MCP --> Storage[sm_storage_health — SM-OS.governance.sys-8/1.5]
     Storage --> Mgr[manager.run_command — local or remote]
     Storage --> SMART([smartctl / megaraid])
     Storage --> BMC([fan-manager IPMI / ipmitool])
-    Storage -.OOB creds.-> Bao([OpenBao apps/idrac])
+    Storage -.OOB credential projection.-> Config([AgentConfig secret reference])
     Client --> ExternalAPI([External Service API])
 ```
 
@@ -39,15 +50,21 @@ sequenceDiagram
     participant U as User
     participant S as Server
     participant A as Agent
-    participant T as MCP Tool
-    participant API as External API
+    participant M as MCP Tools
+    participant SM as Systems Manager
+    participant PM as Package Manager
+    participant SYS as System APIs
 
     U->>S: Request
     S->>A: Process Query
-    A->>T: Invoke Tool
-    T->>API: API Request
-    API-->>T: API Response
-    T-->>A: Tool Result
+    A->>M: Invoke Tool
+    M->>SM: Execute System Operation
+    SM->>PM: Package Management
+    SM->>SYS: System APIs
+    PM-->>SM: Package Result
+    SYS-->>SM: System Result
+    SM-->>M: Operation Result
+    M-->>A: Tool Result
     A-->>S: Final Response
     S-->>U: Output
 ```
@@ -59,14 +76,26 @@ pip install .[all]
 # Quality & Linting (run from project root)
 pre-commit run --all-files
 
+# Testing
+pytest tests/ --cov=systems_manager --cov-report=term-missing
+
 # Execution Commands
-# systems-manager\nsystems_manager.systems_manager:systems_manager\n# systems-manager-mcp\nsystems_manager.mcp:mcp_server\n# systems-manager-agent\nsystems_manager.agent:agent_server
+# systems-manager CLI
+python -m systems_manager.systems_manager
+
+# systems-manager MCP
+python -m systems_manager.mcp_server
+
+# systems-manager Agent
+python -m systems_manager.agent_server
 
 ## Project Structure Quick Reference
 - MCP Entry Point → `mcp_server.py`
-- Agent Entry Point → `agent.py`
+- Agent Entry Point → `agent_server.py`
+- Core Systems Manager → `systems_manager.py`
 - Source Code → `systems_manager/`
-- Skills → `skills/` (if exists)
+- Agent Data → `agent_data/`
+- Tests → `tests/`
 
 ### File Tree
 ```text
@@ -75,20 +104,22 @@ pre-commit run --all-files
 
 ## Code Style & Conventions
 **Always:**
-- Use `agent-utilities` for common patterns (e.g., `create_mcp_server`, `create_agent`).
+- Use current direct `agent-connector-sdk` modules for shared patterns.
 - Define input/output models using Pydantic.
 - Include descriptive docstrings for all tools (they are used as tool descriptions for LLMs).
 - Check for optional dependencies using `try/except ImportError`.
+- Use type hints for function signatures.
 
 **Good example:**
 ```python
-from agent_utilities import create_mcp_server
-from mcp.server.fastmcp import FastMCP
+from agent_connector_sdk.mcp.server_factory import create_mcp_server
+from fastmcp import FastMCP
+from pydantic import Field
 
 mcp = create_mcp_server("my-agent")
 
 @mcp.tool()
-async def my_tool(param: str) -> str:
+async def my_tool(param: str = Field(description="Tool parameter")) -> str:
     """Description for LLM."""
     return f"Result: {param}"
 ```
@@ -96,31 +127,56 @@ async def my_tool(param: str) -> str:
 ## Dos and Don'ts
 **Do:**
 - Run `pre-commit` before pushing changes.
-- Use existing patterns from `agent-utilities`.
+- Use existing patterns from `agent-connector-sdk`.
 - Keep tools focused and idempotent where possible.
+- Run pytest with coverage before committing.
+- Mock platform-specific operations in tests for cross-platform compatibility.
 
 **Don't:**
 - Use `cd` commands in scripts; use absolute paths or relative to project root.
 - Add new dependencies to `dependencies` in `pyproject.toml` without checking `optional-dependencies` first.
 - Hardcode secrets; use environment variables or `.env` files.
+- Commit test coverage reports or generated HTML coverage files.
+- Modify the `agent_data/` directory structure without updating agent configuration.
 
 ## Safety & Boundaries
 **Always do:**
 - Run lint/test via `pre-commit`.
-- Use `agent-utilities` base classes.
+- Use `agent-connector-sdk` base classes.
+- Test package manager operations with mocking to avoid accidental system modifications.
+- Validate user inputs before running system commands.
 
 **Ask first:**
-- Major refactors of `mcp_server.py` or `agent.py`.
-- Deleting or renaming public tool functions.
+- Major refactors of `mcp_server.py` or `agent_server.py`.
+- Removing or renaming public tool functions.
+- Changes to platform detection logic.
+- Modifications to the graph orchestration architecture.
 
 **Never do:**
 - Commit `.env` files or secrets.
-- Modify `agent-utilities` or `universal-skills` files from within this package.
+- Modify `agent-connector-sdk` or `universal-skills` files from within this package.
+- Run destructive operations (package installs, system updates) in tests without proper mocking.
+- Hardcode platform-specific paths; use cross-platform path handling.
+
+## Testing
+**Test Coverage:**
+- Overall coverage: 62% (355 tests passing)
+- Key modules with 95%+ coverage: `__init__.py` (96%), `agent_server.py` (96%)
+- Platform-specific code tested with extensive mocking
+- MCP server feature validated through integration tests
+
+**Test Structure:**
+- `conftest.py`: Shared fixtures for platform mocking, subprocess mocking, psutil mocking
+- `test_systems_manager_base.py`: Tests for base class and helper classes (127 tests)
+- `test_linux_managers.py`: Tests for Linux package managers (93 tests)
+- `test_windows_manager.py`: Tests for Windows manager (50 tests)
+- `test_mcp_server.py`: MCP server feature tests (52 tests)
 
 ## When Stuck
 - Propose a plan first before making large changes.
-- Check `agent-utilities` documentation for existing helpers.
-
+- Check `agent-connector-sdk` documentation for existing helpers.
+- Review existing test patterns for platform-specific mocking.
+- Check the `systems_manager.py` implementation for platform-specific patterns.
 
 ## Graph Architecture
 
@@ -140,10 +196,9 @@ stateDiagram-v2
 - **RouterNode**: A fast, lightweight LLM (e.g., `nvidia/nemotron-3-super`) that classifies the user's query into one of the specialized domains.
 - **DomainNode**: The executor node. For the selected domain, it dynamically sets environment variables to temporarily enable ONLY the tools relevant to that domain, creating a highly focused sub-agent (e.g., `gpt-4o`) to complete the request. This preserves LLM context and prevents tool hallucination.
 
-
 ## Testing with Timeout
 
-To run tests with a timeout to prevent hanging, use the `pytest-timeout` plugin. You can combine it with the `-k` flag to run specific tests:
+To run tests with a timeout to prevent hanging, use the `pytest-timeout` plugin. The operator can combine it with the `-k` flag to run specific tests:
 
 ```bash
 uv run pytest --timeout=60 -k "test_name_pattern"
@@ -190,27 +245,27 @@ and erodes a pristine codebase.
 `~/workspace/reports/` (command output); tests go in `tests/` (pytest).
 Before finishing a task, run `git status` and confirm no stray root files were added.
 
-## Working Discipline — think, simplify, stay surgical, verify
+## Working Discipline — think, simplify, stay surgical, check
 
 These four habits cut the most common LLM coding mistakes. For trivial tasks, use
 judgment; the bias here is correctness over speed.
 
-- **Think before coding.** State your assumptions explicitly. If a request has more than
+- **Think before coding.** State the operator's assumptions explicitly. If a request has more than
   one reasonable reading, surface the options instead of silently picking one. If a
   simpler approach exists, say so and push back when warranted. When something is
   genuinely unclear, stop and name what's confusing — ask, don't guess.
 - **Simplicity first.** Write the minimum code that solves the stated problem — no
   speculative features, no abstraction for single-use code, no configurability that
-  wasn't requested, no error handling for impossible states. If you wrote 200 lines and
-  it could be 50, rewrite it. (Name code from its purpose, never `wave0`/`phase2`/`v2`.)
+  wasn't requested, no error handling for impossible states. If the operator wrote 200 lines and
+  it can be 50, rewrite it. (Name code from its purpose, never `wave0`/`phase2`/`v2`.)
 - **Stay surgical.** Every changed line should trace directly to the task. Don't refactor,
-  reformat, or "improve" working code adjacent to your change; match the existing style
-  even where you'd do it differently. Remove only the imports/symbols your own change
-  orphaned; if you spot unrelated dead code, mention it rather than deleting it inline.
+  reformat, or "improve" working code adjacent to the operator's change; match the existing style
+  even where the operator'd do it differently. Remove only the imports/symbols the operator's own change
+  orphaned; if the operator spot unrelated dead code, mention it rather than removing it inline.
   *Exception — the Quality Bar below:* lint/format/type errors the pre-commit gate flags
-  get fixed regardless of who introduced them. In short: **surgical on behavior, clean on
+  get fixed in either case of who introduced them. In short: **surgical on behavior, clean on
   lint.**
-- **Verify against a goal.** Turn the task into a checkable outcome before you start:
+- **Check against a goal.** Turn the task into a checkable outcome before the operator start:
   "fix the bug" → "write a failing test that reproduces it, then make it pass"; "add
   validation" → "tests for the invalid inputs pass". For multi-step work, state the short
   plan and the check for each step, then loop until the checks pass.
@@ -225,8 +280,8 @@ pre-commit run --all-files
 ```
 
 Resolve **every** issue it reports — failures, lint errors, type errors, and
-warnings — **including problems that pre-date your change and were not caused by
-your edits**. The standing goal is a clean, working codebase with **no errors and
+warnings — **including problems that pre-date the operator's change and were not caused by
+the operator's edits**. The standing goal is a clean, working codebase with **no errors and
 no warnings**. Do not silence checks (`# noqa`, `# type: ignore`, `SKIP=`,
 `--no-verify`) to force green unless the exception is already documented in this
 file as a known, unavoidable limitation. Only commit once `pre-commit run
@@ -236,23 +291,23 @@ why rather than bypassing it.
 ## Working with Git Worktrees (multi-session)
 
 Multiple agents/sessions work the `agent-packages/*` repos concurrently. **Do not
-edit the canonical checkout** (`/home/apps/workspace/agent-packages/<repo>`) — a
+edit the canonical checkout** (`${WORKSPACE_ROOT}/agent-packages/<repo>`) — a
 background `repository-manager` sync can reset its working tree and discard
-uncommitted edits. Take your own git worktree on your own branch instead:
+uncommitted edits. Take the operator's own git worktree on the operator's own branch instead:
 
 ```bash
 # preferred — repository-manager MCP:
-rm_worktree add <repo> <your-branch>      # -> /home/apps/worktrees/<repo>/<your-branch>
+rm_worktree add <repo> <your-branch>      # -> ${WORKTREE_ROOT}/<repo>/<your-branch>
 
 # raw-git fallback:
 git -C agent-packages/<repo> checkout main
-git -C agent-packages/<repo> worktree add /home/apps/worktrees/<repo>/<branch> -b <branch>
+git -C agent-packages/<repo> worktree add "${WORKTREE_ROOT}/<repo>/<branch>" -b <branch>
 ```
 
 Work in the worktree and **commit often** (commits survive a working-tree reset).
 Each session must use a **distinct branch** — git allows a branch in only one
 worktree, which is what keeps concurrent sessions from colliding. Worktrees live
-under `/home/apps/worktrees/` (outside the workspace scan, so the sync leaves them
+under `${WORKTREE_ROOT}` (outside the workspace scan, so the sync leaves them
 alone).
 
 **Finishing work in a worktree** — run this sequence before calling it done:
@@ -261,7 +316,7 @@ alone).
 2. **Commit** in the worktree.
 3. **Merge to main locally** — `rm_worktree merge <repo> <branch> --into main`
    (or `git merge --no-ff`). Push only when the user asks.
-4. **Clean up** — remove the worktree and delete the merged branch:
+4. **Clean up** — remove the worktree and remove the merged branch:
    `rm_worktree remove <repo> <branch> --delete-branch`; `rm_worktree prune` clears
    stale entries. (Raw-git: `git worktree remove <path> && git branch -d <branch>`.)
 
@@ -271,10 +326,10 @@ alone).
 Working in parallel with other sessions/worktrees? **Reserve a concept id before you write its `CONCEPT:` marker** so two sessions never collide:
 
 ```bash
-agent-utilities --json concept reserve --ns EG-KG.compute.backend   # or a package prefix, e.g. KEY
+agent-connector-sdk --json concept reserve --ns EG-KG.compute.backend   # or a package prefix, e.g. KEY
 ```
 
-Full protocol (ledger, merge=union, reconcile, MCP/REST): <https://knuckles-team.github.io/agent-utilities/concept_coordination/>
+Full protocol (ledger, merge=union, reconcile, MCP/REST): <https://knuckles-team.github.io/agent-connector-sdk/concept_coordination/>
 <!-- END concept-coordination (generated) -->
 
 ## Version & lockfile drift edict (keep the version mirrors AND the lock in sync)
@@ -287,8 +342,8 @@ is what Dependabot flags. Rules:
 
 1. **Never hand-edit a version string.** Change the version ONLY via
    `bump-my-version bump {patch|minor|major}` (a.k.a. `bump2version`), which rewrites every file
-   registered in `.bumpversion.cfg` in one atomic, tagged commit. If you edited the version in
-   `pyproject.toml` by hand, you created drift — revert and use the bumper.
+   registered in `.bumpversion.cfg` in one atomic, tagged commit. If the operator edited the version in
+   `pyproject.toml` by hand, the operator created drift — revert and use the bumper.
 2. **Every version-bearing file must be registered in `.bumpversion.cfg`** — at minimum
    `pyproject.toml` AND `README.md`, plus `docker/Dockerfile` and any module `__version__`. Never
    add a file that embeds the version without a `[bumpversion:file:...]` entry for it.
@@ -298,3 +353,37 @@ is what Dependabot flags. Rules:
    Dependabot/security surface.
 4. **Patch CVEs with a version floor at the source, then re-lock.** `uv` resolves one version
    graph-wide, so a lower-bound in the extra that pulls a dependency raises it for the whole lock.
+
+## Upstream currency edict — target the newest release; a pin is a hypothesis, not a fact (READ BEFORE capping, deferring, or opt-in-gating an upgrade)
+
+This governs how this repository treat **other people's** releases, deprecations, and version caps in
+this repo (fleet-wide edict, propagated from `agent-connector-sdk/AGENTS.md`).
+
+1. **Latest by default.** Target the newest upstream release -- including a pre-release
+   where the ecosystem has already moved onto it. Sitting on an old major because the
+   upgrade is work is not a reason to defer it.
+2. **A conservative upstream pin is a hypothesis, not a fact -- test it, don't inherit
+   it.** Upstream maintainers cap defensively (an unreleased major, an untested surface)
+   as often as they cap for a known break. Worked example (from `agent-connector-sdk`):
+   `pydantic-ai-slim` 2.18.0 declared `fastmcp-slim[client]>=3.3.0` with no upper bound;
+   2.19.0 added `<4` purely as a defensive guard while fastmcp 4 was still pre-release --
+   not because of an observed incompatibility. Blocking an upgrade on that kind of cap
+   without testing it is the wrong default.
+3. **Forward-fix only.** When an upgrade breaks something, fix the break to proceed --
+   do not pin backwards, vendor a fork, or route around it. If a break is genuinely
+   unfixable inside this repo, say exactly what and why, and carry a plan to unblock it
+   -- never an indefinite pin.
+4. **Deprecations are fixed on sight, in code AND in tests.** A `DeprecationWarning` from
+   an upstream library is a defect to fix now, not noise to filter. **Never** silence one
+   with a warning filter, `# noqa`, or a pytest `filterwarnings` entry to go
+   green.
+5. **Adopt upstream features rather than reimplementing them.** If upstream ships a
+   capability this repo hand-rolled, migrate to theirs and remove the local one.
+6. **Nothing built on an upgrade ships opt-in.** A new capability an upgrade unlocks is
+   default-on unless it genuinely costs compute, in which case it is policy-selected,
+   never flag-gated. An opt-in extra or a dependency-conflict fork is an interim state
+   that must carry a written plan to become the default, never a resting place.
+
+## Specs: extend first
+
+Find the spec row that owns the behavior before any code change. Search with `git grep -n "<term>" -- specs`. Cite the row ID in the commit `Spec:` trailer. Extend the owning spec before any new spec text. Add a child row, a new rollup, or a dated `plan.md` "Amendments" entry. Create a new spec only for a capability that no spec owns. Audits, reviews, and carry-overs land in the owning spec. They never get a spec directory. Reuse an existing function, module, or store before adding one. The rules are the ecosystem [spec standard](https://github.com/Knuckles-Team/pipelines/blob/main/reference/spec-standard.md).

{systems_manager-1.35.2 → systems_manager-2.2.2}/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2012-2023 Audel Rouhi
+Copyright (c) 2012-2023 Project Maintainers
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the