digitalkin 1.0.0.dev21__tar.gz → 1.0.0.dev23__tar.gz

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: digitalkin
-Version: 1.0.0.dev21
+Version: 1.0.0.dev23
 Summary: SDK to build kin used in DigitalKin
 Author-email: "DigitalKin.ai" <contact@digitalkin.ai>
 License: Attribution-NonCommercial-ShareAlike 4.0 International
@@ -453,7 +453,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: ag-ui-protocol>=0.1.18
-Requires-Dist: agentic-mesh-protocol==1.0.0a0
+Requires-Dist: agentic-mesh-protocol==1.0.0a2
 Requires-Dist: anyio>=4.13.0
 Requires-Dist: grpcio-health-checking==1.81.0
 Requires-Dist: grpcio-reflection==1.81.0

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/pyproject.toml

@@ -28,7 +28,7 @@
 
     dependencies = [
         "ag-ui-protocol>=0.1.18",
-        "agentic-mesh-protocol==1.0.0a0",
+        "agentic-mesh-protocol==1.0.0a2",
         "anyio>=4.13.0",
         "grpcio-health-checking==1.81.0",
         "grpcio-reflection==1.81.0",
@@ -37,7 +37,7 @@
         "pydantic-settings>=2.14.1",
         "redis[hiredis]>=7.4.0,<9",
     ]
-    version = "1.0.0.dev21"
+    version = "1.0.0.dev23"
 
     [project.optional-dependencies]
         performance = [ "uvloop>=0.21" ]

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/__version__.py

@@ -5,4 +5,4 @@ from importlib.metadata import PackageNotFoundError, version
 try:
     __version__ = version("digitalkin")
 except PackageNotFoundError:
-    __version__ = "1.0.0.dev21"
+    __version__ = "1.0.0.dev23"

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/core/task_manager/module_runner.py

@@ -13,6 +13,7 @@ from redis.exceptions import RedisError
 from digitalkin.core.exceptions import BackpressureTimeoutError
 from digitalkin.core.profiling.step_timer import StepTimer
 from digitalkin.core.profiling.task_profiler import TaskProfiler
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError
 from digitalkin.grpc_servers.interceptors.request_ids import RequestContext
 from digitalkin.logger import logger
 from digitalkin.models.grpc_servers.stream_error_codes import StreamErrorCode
@@ -226,6 +227,9 @@ class ModuleRunner:
                 StreamErrorCode.REDIS_UNAVAILABLE.value,
                 f"redis unavailable: {type(exc).__name__}: {exc}",
             )
+        except PermissionDeniedError as exc:
+            logger.warning("ModuleRunner: setup access denied: %s", exc, extra=log_extra)
+            await on_fatal(StreamErrorCode.SETUP_ACCESS_DENIED.value, str(exc))
         except Exception as exc:
             logger.exception("ModuleRunner: module job failed", extra=log_extra)
             await on_fatal(

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/grpc_servers/gateway_servicer.py

@@ -7,6 +7,7 @@ import contextlib
 import json
 import random
 import time
+import uuid
 from datetime import datetime, timezone
 from typing import TYPE_CHECKING, Any
 
@@ -158,6 +159,43 @@ class GatewayServicer:
         await self._m2m.stop()
         await self._registry.shutdown()
 
+    async def AssociateTask(
+        self,
+        request: Any,
+        context: grpc.aio.ServicerContext,  # noqa: ARG002
+    ) -> Any:
+        """Mint a sub-task id linked to a running parent task.
+
+        Args:
+            request: AssociateTaskRequest proto.
+            context: gRPC service context.
+
+        Returns:
+            AssociateTaskResponse(task_id, parent_task_id); empty ``task_id`` on rejection.
+        """
+        parent_task_id = request.parent_task_id
+        err = GatewayValidator.validate_id(parent_task_id, "parent_task_id")
+        if err is not None:
+            logger.warning("AssociateTask rejected: %s", err)
+            return gateway_pb2.AssociateTaskResponse(task_id="", parent_task_id=parent_task_id)
+
+        child_task_id = str(uuid.uuid4())
+        ttl = get_gateway_settings().stream.redis_stream_initial_ttl
+        try:
+            await self._redis_client.sadd(f"task:{parent_task_id}:children", child_task_id)
+            await self._redis_client.expire(f"task:{parent_task_id}:children", ttl)
+            await self._redis_client.set(f"task:{child_task_id}:parent", parent_task_id, ex=ttl)
+        except RedisError:
+            logger.warning(
+                "[VALIDATE AT1] AssociateTask persist failed parent=%s → task_id=''",
+                parent_task_id,
+                exc_info=True,
+            )  # TODO(validate): remove after prod validation
+            return gateway_pb2.AssociateTaskResponse(task_id="", parent_task_id=parent_task_id)
+
+        logger.info("AssociateTask: parent=%s child=%s", parent_task_id, child_task_id)
+        return gateway_pb2.AssociateTaskResponse(task_id=child_task_id, parent_task_id=parent_task_id)
+
     async def StartStream(  # noqa: PLR0911, PLR0915
         self,
         request: Any,

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/grpc_servers/module_servicer.py

@@ -14,12 +14,13 @@ from agentic_mesh_protocol.module.v1 import (
     lifecycle_pb2,
     module_service_pb2_grpc,
 )
+from agentic_mesh_protocol.user_profile.v1 import user_profile_pb2
 from google.protobuf import json_format, struct_pb2
 
 from digitalkin.core.job_manager.base_job_manager import BaseJobManager
 from digitalkin.core.job_manager.single_job_manager import SingleJobManager
 from digitalkin.core.task_manager.redis.redis_signal import SharedRedisListener
-from digitalkin.grpc_servers.exceptions import ServicerError
+from digitalkin.grpc_servers.exceptions import PermissionDeniedError, ServicerError
 from digitalkin.logger import logger
 from digitalkin.models.module.module import ModuleCodeModel
 from digitalkin.models.module.setup_types import SetupModel
@@ -31,6 +32,7 @@ from digitalkin.services.registry import GrpcRegistry, RegistryStrategy
 from digitalkin.services.setup.default_setup import DefaultSetup
 from digitalkin.services.setup.grpc_setup import GrpcSetup
 from digitalkin.services.setup.setup_strategy import SetupStrategy, SetupVersionData
+from digitalkin.services.user_profile import DefaultUserProfile, GrpcUserProfile, UserProfileStrategy
 from digitalkin.utils.arg_parser import ArgParser
 from digitalkin.utils.development_mode_action import DevelopmentModeMappingAction
 
@@ -40,6 +42,7 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
 
     args: Namespace
     setup: SetupStrategy
+    user_profile: UserProfileStrategy
     job_manager: BaseJobManager
     _registry_cache: RegistryStrategy | None
     _tool_cache_by_setup: dict[str, tuple[Any, float]]
@@ -82,6 +85,16 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
 
         logger.debug("ModuleServicer initialized with SingleJobManager")
         self.setup = GrpcSetup() if self.args.services_mode == ServicesMode.REMOTE else DefaultSetup()
+        # Access-control client gating the setup cache. Always built, always called (fail-closed).
+        if self.args.services_mode == ServicesMode.REMOTE:
+            up_cfg = self.module_class.services_config_params.get("user_profile") or {}
+            up_client_config = up_cfg.get("client_config")
+            if not up_client_config:
+                msg = "user_profile client_config is required for setup access control"
+                raise RuntimeError(msg)
+            self.user_profile = GrpcUserProfile("", "", "", up_client_config)
+        else:
+            self.user_profile = DefaultUserProfile("", "", "")
         self._setup_cache: dict[str, tuple[float, SetupVersionData]] = {}
         self._setup_inflight: dict[str, asyncio.Future[SetupVersionData]] = {}
 
@@ -97,6 +110,11 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
                 await self.setup.close_channel()
             except Exception:
                 logger.exception("Error closing GrpcSetup channel")
+        if isinstance(self.user_profile, GrpcUserProfile):
+            try:
+                await self.user_profile.close_channel()
+            except Exception:
+                logger.exception("Error closing GrpcUserProfile channel")
         # M8: close the Redis connection pools (were leaked on every server stop).
         logger.info("[VALIDATE M8] closing module servicer Redis pools")  # TODO(validate): remove after prod validation
         await self._redis_client.close()
@@ -245,6 +263,19 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
             del self._setup_cache[oldest_key]
         self._setup_cache[setup_id] = (time.monotonic(), version_data)
 
+    async def _check_setup_access(self, setup_id: str) -> None:
+        """Block if the caller may not access the setup (RESOURCE_TYPE_SETUP).
+
+        Args:
+            setup_id: The setup identifier being resolved.
+
+        Raises:
+            PermissionDeniedError: If access to the setup is denied.
+        """
+        if not await self.user_profile.check_resource_access(user_profile_pb2.RESOURCE_TYPE_SETUP, setup_id):
+            msg = f"access denied to setup {setup_id}"
+            raise PermissionDeniedError(msg)
+
     async def resolve_setup(self, setup_id: str, mission_id: str) -> SetupVersionData:
         """Return setup version data from cache or remote service.
 
@@ -257,7 +288,9 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
 
         Raises:
             LookupError: No setup data found for setup_id.
+            PermissionDeniedError: If the caller may not access this setup.
         """
+        await self._check_setup_access(setup_id)
         # Fast path: cache hit within TTL
         if (cached := self._setup_cache.get(setup_id)) is not None:
             if time.monotonic() - cached[0] < get_module_servicer_settings().setup_cache_ttl:
@@ -326,6 +359,12 @@ class ModuleServicer(module_service_pb2_grpc.ModuleServiceServicer, ArgParser):
             extra={"mission_id": request.mission_id},
         )
         setup_version = request.setup_version
+        if not await self.user_profile.check_resource_access(
+            user_profile_pb2.RESOURCE_TYPE_SETUP, setup_version.setup_id
+        ):
+            context.set_code(grpc.StatusCode.PERMISSION_DENIED)
+            context.set_details(f"access denied to setup {setup_version.setup_id}")
+            return lifecycle_pb2.ConfigSetupModuleResponse(success=False)
         # Invalidate cached setup so concurrent/subsequent starts refetch the reconfigured version
         self._setup_cache.pop(setup_version.setup_id, None)
         config_setup_data = self.module_class.create_config_setup_model(json_format.MessageToDict(request.content))

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/models/grpc_servers/stream_error_codes.py

@@ -23,3 +23,4 @@ class StreamErrorCode(str, Enum):
     MODULE_RUNTIME_ERROR = "MODULE_RUNTIME_ERROR"
     INPUT_VALIDATION_ERROR = "INPUT_VALIDATION_ERROR"
     BACKPRESSURE_TIMEOUT = "BACKPRESSURE_TIMEOUT"
+    SETUP_ACCESS_DENIED = "SETUP_ACCESS_DENIED"

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/models/module/module_context.py

@@ -17,6 +17,7 @@ from digitalkin.services.cost.cost_strategy import CostStrategy
 from digitalkin.services.filesystem.filesystem_strategy import FilesystemStrategy
 from digitalkin.services.identity.identity_strategy import IdentityStrategy
 from digitalkin.services.registry.registry_strategy import RegistryStrategy
+from digitalkin.services.secret.secret_strategy import SecretStrategy
 from digitalkin.services.storage.storage_strategy import StorageStrategy
 from digitalkin.services.task_manager.task_manager_strategy import TaskManagerStrategy
 from digitalkin.services.user_profile.user_profile_strategy import UserProfileStrategy
@@ -95,6 +96,7 @@ class ModuleContext:
     filesystem: FilesystemStrategy
     identity: IdentityStrategy
     registry: RegistryStrategy
+    secret: SecretStrategy
     storage: StorageStrategy
     task_manager: TaskManagerStrategy | None
     user_profile: UserProfileStrategy
@@ -115,6 +117,7 @@ class ModuleContext:
         filesystem: FilesystemStrategy,
         identity: IdentityStrategy,
         registry: RegistryStrategy,
+        secret: SecretStrategy,
         storage: StorageStrategy,
         user_profile: UserProfileStrategy,
         session: dict[str, Any],
@@ -135,6 +138,7 @@ class ModuleContext:
             filesystem: FilesystemStrategy.
             identity: IdentityStrategy.
             registry: RegistryStrategy.
+            secret: SecretStrategy.
             storage: StorageStrategy.
             user_profile: UserProfileStrategy.
             task_manager: Optional, injected by SingleJobManager (RedisTaskManager).
@@ -153,6 +157,7 @@ class ModuleContext:
         self.filesystem = filesystem
         self.identity = identity
         self.registry = registry
+        self.secret = secret
         self.storage = storage
         self.task_manager = task_manager
         self.user_profile = user_profile
@@ -374,6 +379,7 @@ class ModuleContext:
             ("registry", self.registry),
             ("filesystem", self.filesystem),
             ("user_profile", self.user_profile),
+            ("secret", self.secret),
             ("identity", self.identity),
         )
         for name, service in owned:

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/services/communication/grpc_communication.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 
 import asyncio
 import time
-import uuid
 from typing import TYPE_CHECKING, Any
 
 import grpc.aio
@@ -16,6 +15,7 @@ from agentic_mesh_protocol.module.v1 import (
 from google.protobuf import json_format, struct_pb2
 
 from digitalkin.core.profiling.step_timer import StepTimer
+from digitalkin.grpc_servers.interceptors.request_ids import RequestContext
 from digitalkin.grpc_servers.utils.grpc_client_wrapper import GrpcClientWrapper
 from digitalkin.grpc_servers.utils.validators import GatewayValidator
 from digitalkin.logger import logger
@@ -315,8 +315,7 @@ class GrpcCommunication(CommunicationStrategy, GrpcClientWrapper):
             "target_key": target_key,
         }
 
-        task_id = str(uuid.uuid4())
-        log_extra["task_id"] = task_id
+        task_id = ""
         breaker = m2m.breaker_for(target_key)
 
         last_mark = "init"
@@ -342,6 +341,38 @@ class GrpcCommunication(CommunicationStrategy, GrpcClientWrapper):
             timer.mark("acquire_slot")
             last_mark = "acquire_slot"
 
+            self._get_or_create_channel(module_address, module_port)
+            timer.mark("channel_create")
+            last_mark = "channel_create"
+            stub = self._get_or_create_stub(gateway_service_pb2_grpc.GatewayServiceStub)
+            timer.mark("stub_create")
+            last_mark = "stub_create"
+
+            # The gateway mints the sub-task id and links it to the running parent task.
+            try:
+                assoc = await stub.AssociateTask(
+                    gateway_pb2.AssociateTaskRequest(
+                        parent_task_id=RequestContext.current().get("task_id", ""),
+                    ),
+                )
+            except grpc.aio.AioRpcError as exc:
+                breaker.record_failure()
+                logger.warning(
+                    "[m2m] AssociateTask failed: [%s] %s",
+                    exc.code().name,
+                    exc.details() or "",
+                    extra=log_extra,
+                )
+                raise
+            task_id = assoc.task_id
+            if not task_id:
+                breaker.record_failure()
+                msg = f"target {target_key} returned no task_id from AssociateTask"
+                raise RuntimeError(msg)  # noqa: TRY301
+            log_extra["task_id"] = task_id
+            timer.mark("associate_task")
+            last_mark = "associate_task"
+
             output_queue: asyncio.Queue[struct_pb2.Struct | None] = asyncio.Queue(
                 maxsize=m2m_settings.call_queue_maxsize,
             )
@@ -361,13 +392,6 @@ class GrpcCommunication(CommunicationStrategy, GrpcClientWrapper):
             timer.mark("register")
             last_mark = "register"
 
-            self._get_or_create_channel(module_address, module_port)
-            timer.mark("channel_create")
-            last_mark = "channel_create"
-            stub = self._get_or_create_stub(gateway_service_pb2_grpc.GatewayServiceStub)
-            timer.mark("stub_create")
-            last_mark = "stub_create"
-
             try:  # noqa: PLW0717
                 grpc_metadata: list[tuple[str, str]] = []
                 if metadata:
@@ -467,7 +491,7 @@ class GrpcCommunication(CommunicationStrategy, GrpcClientWrapper):
                 cancelled = True
                 raise
             finally:
-                if cancelled and stub is not None:
+                if cancelled and stub is not None and task_id:
                     sig_t0 = time.perf_counter_ns()
                     sig_failure = ""
                     try:

digitalkin-1.0.0.dev23/src/digitalkin/services/secret/__init__.py

@@ -0,0 +1,13 @@
+"""Secret service package."""
+
+from digitalkin.services.secret.default_secret import DefaultSecret
+from digitalkin.services.secret.exceptions import SecretServiceError
+from digitalkin.services.secret.grpc_secret import GrpcSecret
+from digitalkin.services.secret.secret_strategy import SecretStrategy
+
+__all__ = [
+    "DefaultSecret",
+    "GrpcSecret",
+    "SecretServiceError",
+    "SecretStrategy",
+]

digitalkin-1.0.0.dev23/src/digitalkin/services/secret/default_secret.py

@@ -0,0 +1,45 @@
+"""Default secret implementation."""
+
+from typing import Any
+
+from digitalkin.logger import logger
+from digitalkin.services.secret.secret_strategy import SecretStrategy
+
+
+class DefaultSecret(SecretStrategy):
+    """Default secret strategy with in-memory storage."""
+
+    def __init__(
+        self,
+        mission_id: str,
+        setup_id: str,
+        setup_version_id: str,
+    ) -> None:
+        """Initialize the strategy.
+
+        Args:
+            mission_id: The ID of the mission this strategy is associated with
+            setup_id: The ID of the setup
+            setup_version_id: The ID of the setup version
+        """
+        super().__init__(mission_id=mission_id, setup_id=setup_id, setup_version_id=setup_version_id)
+        self.db: dict[str, dict[str, Any]] = {}
+
+    async def get_secret(self) -> dict[str, Any] | None:
+        """Get the secret for this setup from in-memory storage.
+
+        Returns:
+            Secret values, or None if not found.
+        """
+        if self.setup_id not in self.db:
+            logger.warning("No secret found for setup_id: %s", self.setup_id)
+            return None
+        return self.db[self.setup_id]
+
+    def add_secret(self, secret_data: dict[str, Any]) -> None:
+        """Add a secret to the in-memory database (helper for testing).
+
+        Args:
+            secret_data: Dictionary containing secret values.
+        """
+        self.db[self.setup_id] = secret_data

digitalkin-1.0.0.dev23/src/digitalkin/services/secret/exceptions.py

@@ -0,0 +1,5 @@
+"""Exceptions for the secret service."""
+
+
+class SecretServiceError(Exception):
+    """Base exception for Secret service errors."""

digitalkin-1.0.0.dev23/src/digitalkin/services/secret/grpc_secret.py

@@ -0,0 +1,63 @@
+"""Digital Kin Secret Service gRPC Client (wraps UserProfileService.GetSetupSecret)."""
+
+from typing import Any
+
+from agentic_mesh_protocol.user_profile.v1 import (
+    user_profile_pb2,
+    user_profile_service_pb2_grpc,
+)
+
+from digitalkin.grpc_servers.utils.grpc_client_wrapper import GrpcClientWrapper
+from digitalkin.grpc_servers.utils.grpc_error_handler import GrpcErrorHandlerMixin
+from digitalkin.logger import logger
+from digitalkin.models.grpc_servers.models import ClientConfig
+from digitalkin.services.secret.exceptions import SecretServiceError
+from digitalkin.services.secret.secret_strategy import SecretStrategy
+from digitalkin.utils.proto_utils import ProtoUtils
+
+
+class GrpcSecret(SecretStrategy, GrpcClientWrapper, GrpcErrorHandlerMixin):
+    """gRPC client for setup secrets (backed by the UserProfileService)."""
+
+    service_name: str = "UserProfileService"
+
+    def __init__(
+        self,
+        mission_id: str,
+        setup_id: str,
+        setup_version_id: str,
+        client_config: ClientConfig,
+    ) -> None:
+        """Initialize the secret service.
+
+        Args:
+            mission_id: The ID of the mission this strategy is associated with
+            setup_id: The ID of the setup
+            setup_version_id: The ID of the setup version
+            client_config: Client configuration for gRPC connection
+        """
+        super().__init__(mission_id=mission_id, setup_id=setup_id, setup_version_id=setup_version_id)
+        self._init_channel(client_config)
+        self.stub = self._get_or_create_stub(user_profile_service_pb2_grpc.UserProfileServiceStub)
+        logger.debug("Channel client 'Secret' initialized successfully")
+
+    async def close(self) -> None:
+        """Release this instance's pooled gRPC channel ref."""
+        await self.close_channel()
+
+    async def get_secret(self) -> dict[str, Any] | None:
+        """Resolve the secret object attached to this setup.
+
+        Returns:
+            The secret values, or None if not found.
+
+        Raises:
+            SecretServiceError: If the gRPC operation fails.
+        """
+        async with self.handle_grpc_errors("GetSetupSecret", SecretServiceError):
+            request = user_profile_pb2.GetSetupSecretRequest(setup_id=self.setup_id, mission_id=self.mission_id)
+            response = await self.exec_grpc_query("GetSetupSecret", request)
+            if not response.success:
+                logger.warning("No secret found for setup_id: %s", self.setup_id)
+                return None
+            return ProtoUtils.proto_to_dict(response.secret, with_defaults=True)

digitalkin-1.0.0.dev23/src/digitalkin/services/secret/secret_strategy.py

@@ -0,0 +1,21 @@
+"""This module contains the abstract base class for Secret strategies."""
+
+from abc import ABC, abstractmethod
+from typing import Any
+
+from digitalkin.services.base_strategy import BaseStrategy
+
+
+class SecretStrategy(BaseStrategy, ABC):
+    """Abstract base class for Secret strategies."""
+
+    @abstractmethod
+    async def get_secret(self) -> dict[str, Any] | None:
+        """Resolve the secret object attached to this setup.
+
+        Returns:
+            The secret values (matching the module's secret_schema), or None if not found.
+
+        Raises:
+            SecretServiceError: If the service call fails.
+        """

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/services/services_config.py

@@ -10,6 +10,7 @@ from digitalkin.services.cost import CostStrategy, DefaultCost, GrpcCost
 from digitalkin.services.filesystem import DefaultFilesystem, FilesystemStrategy, GrpcFilesystem
 from digitalkin.services.identity import DefaultIdentity, IdentityStrategy
 from digitalkin.services.registry import DefaultRegistry, GrpcRegistry, RegistryStrategy
+from digitalkin.services.secret import DefaultSecret, GrpcSecret, SecretStrategy
 from digitalkin.services.services_models import ServicesStrategy
 from digitalkin.services.storage import DefaultStorage, GrpcStorage, StorageStrategy
 from digitalkin.services.user_profile import DefaultUserProfile, GrpcUserProfile, UserProfileStrategy
@@ -36,6 +37,7 @@ class ServicesConfig(BaseModel):
         "identity",
         "communication",
         "user_profile",
+        "secret",
     }
 
     def __init__(
@@ -67,6 +69,7 @@ class ServicesConfig(BaseModel):
             "identity": ServicesStrategy(local=DefaultIdentity, remote=DefaultIdentity),
             "communication": ServicesStrategy(local=DefaultCommunication, remote=GrpcCommunication),
             "user_profile": ServicesStrategy(local=DefaultUserProfile, remote=GrpcUserProfile),
+            "secret": ServicesStrategy(local=DefaultSecret, remote=GrpcSecret),
         }
 
         # Apply strategy overrides
@@ -75,6 +78,12 @@ class ServicesConfig(BaseModel):
             self._strategies[name] = override if override is not None else defaults[name]
             self._configs[name] = services_config_params.get(name) or {}
 
+        # The secret service is backed by the UserProfileService — reuse the
+        # user_profile client_config (same host/port) when no dedicated secret
+        # config is registered, so GrpcSecret can build its channel.
+        if not self._configs.get("secret"):
+            self._configs["secret"] = self._configs.get("user_profile") or {}
+
     @classmethod
     def valid_strategy_names(cls) -> set[str]:
         """Get the list of valid strategy names.
@@ -162,6 +171,11 @@ class ServicesConfig(BaseModel):
         """The user_profile service strategy class for the current mode."""
         return self._strategies["user_profile"][self.mode.value]
 
+    @property
+    def secret(self) -> type[SecretStrategy]:
+        """The secret service strategy class for the current mode."""
+        return self._strategies["secret"][self.mode.value]
+
     def update_mode(self, mode: ServicesMode) -> None:
         """Update the strategy mode.
 

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/services/services_models.py

@@ -11,6 +11,7 @@ from digitalkin.services.cost import CostStrategy
 from digitalkin.services.filesystem import FilesystemStrategy
 from digitalkin.services.identity import IdentityStrategy
 from digitalkin.services.registry import RegistryStrategy
+from digitalkin.services.secret import SecretStrategy
 from digitalkin.services.storage import StorageStrategy
 from digitalkin.services.task_manager.task_manager_strategy import TaskManagerStrategy
 from digitalkin.services.user_profile import UserProfileStrategy
@@ -23,6 +24,7 @@ T = TypeVar(
     | FilesystemStrategy
     | IdentityStrategy
     | RegistryStrategy
+    | SecretStrategy
     | StorageStrategy
     | UserProfileStrategy
     | TaskManagerStrategy,

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/services/user_profile/default_user_profile.py

@@ -38,6 +38,18 @@ class DefaultUserProfile(UserProfileStrategy):
         logger.debug("Retrieved user profile for mission_id: %s", self.mission_id)
         return self.db[self.mission_id]
 
+    async def check_resource_access(self, resource_type: int, resource_id: str) -> bool:  # noqa: ARG002, PLR6301
+        """Local strategy: grant access (no access backend in local mode).
+
+        Args:
+            resource_type: The ResourceType enum value.
+            resource_id: The resource identifier.
+
+        Returns:
+            True.
+        """
+        return True
+
     def add_user_profile(self, user_profile_data: dict[str, Any]) -> None:
         """Add a user profile to the in-memory database (helper for testing).
 

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/services/user_profile/grpc_user_profile.py

@@ -1,6 +1,6 @@
 """Digital Kin UserProfile Service gRPC Client."""
 
-from typing import Any
+from typing import Any, cast
 
 from agentic_mesh_protocol.user_profile.v1 import (
     user_profile_pb2,
@@ -69,3 +69,24 @@ class GrpcUserProfile(UserProfileStrategy, GrpcClientWrapper, GrpcErrorHandlerMi
 
             logger.debug("Retrieved user profile for mission_id: %s", self.mission_id)
             return user_profile_dict
+
+    async def check_resource_access(self, resource_type: int, resource_id: str) -> bool:
+        """Check whether the caller may access a resource (e.g. a setup).
+
+        Args:
+            resource_type: The ResourceType enum value (e.g. RESOURCE_TYPE_SETUP).
+            resource_id: The resource identifier (e.g. the setup_id).
+
+        Returns:
+            True if access is granted, False otherwise.
+
+        Raises:
+            UserProfileServiceError: If the gRPC operation fails.
+        """
+        async with self.handle_grpc_errors("CheckResourceAccess", UserProfileServiceError):
+            request = user_profile_pb2.CheckResourceAccessRequest(
+                resource_type=cast("user_profile_pb2.ResourceType", resource_type),
+                resource_id=resource_id,
+            )
+            response = await self.exec_grpc_query("CheckResourceAccess", request)
+            return response.allowed

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin/services/user_profile/user_profile_strategy.py

@@ -19,3 +19,18 @@ class UserProfileStrategy(BaseStrategy, ABC):
         Raises:
             UserProfileServiceError: If the service call fails (not for missing profiles).
         """
+
+    @abstractmethod
+    async def check_resource_access(self, resource_type: int, resource_id: str) -> bool:
+        """Check whether the caller may access a resource.
+
+        Args:
+            resource_type: The ResourceType enum value (e.g. RESOURCE_TYPE_SETUP).
+            resource_id: The resource identifier (e.g. the setup_id).
+
+        Returns:
+            True if access is granted, False otherwise.
+
+        Raises:
+            UserProfileServiceError: If the service call fails.
+        """

{digitalkin-1.0.0.dev21 → digitalkin-1.0.0.dev23}/src/digitalkin.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: digitalkin
-Version: 1.0.0.dev21
+Version: 1.0.0.dev23
 Summary: SDK to build kin used in DigitalKin
 Author-email: "DigitalKin.ai" <contact@digitalkin.ai>
 License: Attribution-NonCommercial-ShareAlike 4.0 International
@@ -453,7 +453,7 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: ag-ui-protocol>=0.1.18
-Requires-Dist: agentic-mesh-protocol==1.0.0a0
+Requires-Dist: agentic-mesh-protocol==1.0.0a2
 Requires-Dist: anyio>=4.13.0
 Requires-Dist: grpcio-health-checking==1.81.0
 Requires-Dist: grpcio-reflection==1.81.0