mainsequence-metatable 0.1.20.dev32__tar.gz → 0.1.21.dev33__tar.gz

{mainsequence_metatable-0.1.20.dev32/src/mainsequence_metatable.egg-info → mainsequence_metatable-0.1.21.dev33}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.20.dev32
+Version: 0.1.21.dev33
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

mainsequence_metatable-0.1.21.dev33/docs/adr/api/0017-hosted-request-identity.md

@@ -0,0 +1,99 @@
+# ADR 0017: Hosted caller identity through the SDK request identity
+
+Date: 2026-10-04
+
+Status: Accepted.
+
+Implementation status: implemented for 0.1.21. Tests cover the hosted entrypoint's
+launcher declaration, genuine EdDSA caller assertions verified by the SDK, rejected
+callers, Local isolation, and PodDeploymentOrchestrator's own launcher run against
+the deployed entrypoint. A hosted rollout has not yet been verified.
+
+Owner: MetaTables API. The SDK owns caller verification
+([SDK 9.0.6 ADR 0036: Request-scoped logged user](https://github.com/mainsequence-sdk/mainsequence-sdk/blob/v9.0.6/docs/adr/0036-request-scoped-logged-user.md));
+the platform's FastAPI launcher owns the startup check.
+
+Related decisions: [ADR 0001](0001-unified-api-storage-and-local-sqlite.md) (one API
+execution path, with Local for development), [ADR 0002](0002-application-administration-and-table-ownership.md)
+(admission and platform facts) and [ADR 0007](0007-database-enforced-table-access.md)
+(the API authenticates the caller; the database enforces grants).
+
+## Context
+
+Since 2026-09-28 the platform's FastAPI launcher serves an application only when
+`app.state.mainsequence_request_identity` declares the installed SDK integration,
+the deployment's caller mode (`assertion` when hosted) and its public ingress
+(`FASTAPI_PUBLIC_INGRESS`). The SDK's `install_request_identity(app)` sets that
+declaration. MetaTables verified caller assertions itself, in its admission
+dependency, and never installed the integration. Every hosted revision after
+0.1.13 therefore stopped at startup with "Application request identity is not
+installed" while traffic stayed on the 0.1.13 revision
+([#34](https://github.com/mainsequence-projects/MetaTables/issues/34)).
+
+## Decision
+
+- The application factory installs the SDK request identity once, after mounting
+  every route, for the hosted runtime only. Its middleware is the outermost
+  application middleware, so callers are verified before local admission,
+  transfer limits or any route.
+- It installs it when the process carries the platform's caller-authentication
+  configuration: any of `MAINSEQUENCE_CALLER_AUTH_MODE`, `APP_NAME`,
+  `FASTAPI_PUBLIC_BASE_URL`, `MAINSEQUENCE_CALLER_ASSERTION_ISSUER` or
+  `MAINSEQUENCE_CALLER_ASSERTION_JWKS_URL`. The SDK and the launcher select their
+  mode from the same variables, and every hosted deployment carries them.
+- The hosted API accepts only platform caller assertions. If the SDK would select
+  another mode, creating the app fails; incomplete trust configuration also fails
+  at startup. Without any of these variables nothing is installed, no caller is
+  ever bound, and admission rejects every caller with 401.
+- The SDK verifies each assertion once, before the route: missing or invalid proof
+  is 401 and unavailable key discovery is 503. Admission takes the caller's User UID
+  from `User.get_logged_user()` and the verified target Environment from the request
+  state the SDK records. It no longer reads the assertion header or calls the
+  verifier. The SDK verifier keeps no replay record, so assertions are not
+  single-use; a second verification would only repeat key discovery and could
+  disagree at the expiry boundary.
+- Local and developer runtimes never install it. The SDK's local mode requires a
+  Bearer token on every request and validates it against the platform, while Local
+  admits requests through its loopback listener and the launcher's private token
+  with the developer's SDK user resolved at startup. Local clients send no Bearer
+  token, so the SDK would reject every Local request. `metatables serve --local`
+  runs its own uvicorn worker, which the platform launcher never checks.
+- `metatables.api.app.main:app` is created on first access. Importing the factory,
+  as the Local worker and the hosted entrypoint do, builds no extra app and cannot
+  fail because a shell carries a platform variable.
+- MetaTables declares no anonymous route. The SDK copies the deployment's
+  `FASTAPI_PUBLIC_INGRESS` into the declaration unchanged; every other route,
+  including `/`, `/docs` and `/openapi.json`, requires a caller.
+- The direct verifier dependency, `metatables.api.app.auth.caller_assertions`, is
+  removed so that no route can verify an assertion a second time.
+
+## Consequences
+
+- Who may call what is unchanged. The caller is still the User in a platform-signed
+  assertion for this release and Environment. Admin and Team facts, the one-hour
+  fact cache, table and namespace grants and database enforcement are unchanged.
+  Unsigned User headers, the runtime's own SDK account and Bearer tokens never
+  identify a hosted caller.
+- New hosted revisions pass the launcher's check and can roll out. The SDK
+  requirement stays `mainsequence>=9.0.6,<10`, which provides the integration.
+- Hosted routes without an admission dependency (`/` and the OpenAPI pages) now also
+  require a verified caller; the platform ingress already authenticated those
+  requests. A numeric `X-User-Id` header is rejected with 401.
+- The SDK answers rejected callers itself with `{"detail": ...}`, so MetaTables'
+  error handler no longer logs them. The launcher's request log records each
+  request's authentication outcome.
+- The SDK and the launcher look for public ingress routes among the app's top-level
+  routes. FastAPI 0.142 keeps included routers unflattened, so a route mounted
+  through a router cannot be declared public; startup would refuse it. MetaTables
+  declares none.
+
+## Verification
+
+`tests/auth/test_request_identity.py` imports the deployed entrypoint under a
+simulated hosted environment and checks its declaration, verifies genuine EdDSA
+assertions signed with a test key served as the platform's key document, and checks
+rejected callers, a key outage, the other runtimes and the refused modes. With
+`PYTHONPATH` naming PodDeploymentOrchestrator's `src` directory, it also runs that
+launcher's `require_request_identity` and `serve_fastapi` against the entrypoint.
+`tests/auth/test_local_mode.py` shows Local admission is unchanged when a shell
+carries hosted variables, and that the SDK's local mode would reject Local clients.

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/docs/adr/index.md

@@ -37,3 +37,4 @@ decisions belong in the SDK repository and are linked as dependencies.
 | [0014: System migrations in the deployment workflow](api/0014-main-sequence-release-jobs-and-production-migrations.md) | Accepted; implemented on development; hosted verification pending | A Main Sequence Job verifies, migrates and registers the declared runtime database from the candidate image before each API rollout, including the first. |
 | [0015: TimescaleDB compression and retention policies](api/0015-timescale-compression-and-retention-policies.md) | Accepted; implemented on branch; TimescaleDB verification pending | Time-index tables on TimescaleDB become hypertables; Writers set compression and retention through the API/Admin; Timescale keeps the jobs, and the Admin shows their status. |
 | [0016: Impact pre-flight for cascades and deletes](api/0016-impact-preflight.md) | Accepted; implemented; container engine verification pending | `get_impact` returns what a row delete, key update or table drop reaches, every blocker and whether the caller may write each table, from the planner the confirmed delete runs; cascade effects never block. Projects render it in their own UIs. |
+| [0017: Hosted caller identity through the SDK request identity](api/0017-hosted-request-identity.md) | Accepted; implemented for 0.1.21; hosted rollout verification pending | The hosted API installs the SDK request identity that the platform launcher requires; the SDK verifies each caller assertion once and admission reads `User.get_logged_user()`. Local keeps its loopback token admission. |

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/docs/api/authentication-and-errors.md

@@ -5,11 +5,22 @@ Reader/Writer ownership, live namespace inheritance, and sharing endpoints.
 
 ## Hosted requests
 
-The API's request boundary calls the verifier from the `mainsequence` SDK for
-platform-signed caller assertions. The SDK owns issuer, key discovery, claim,
-request-target, signature, and expiry verification. MetaTables only maps
-its verified identity and exceptions into request context and HTTP responses.
-Unsigned user headers are not identity evidence.
+The hosted API installs the `mainsequence` SDK's request identity once, when it is
+created; the platform's FastAPI launcher requires it before serving a deployment
+([ADR 0017](../adr/api/0017-hosted-request-identity.md)). The SDK verifies the
+platform-signed caller assertion before any route runs and owns issuer, key
+discovery, claim, request-target, signature, and expiry verification. It answers a
+missing or invalid assertion with 401 and unavailable key discovery with 503.
+Admission then reads the caller from `User.get_logged_user()` and never verifies the
+assertion again. Unsigned user headers, Bearer tokens and the runtime's own SDK
+account are not identity evidence.
+
+The API installs the integration when the process carries the platform's
+caller-assertion configuration, as every hosted deployment does, and accepts no
+other SDK mode. Once it is installed, every route not declared in the deployment's
+`FASTAPI_PUBLIC_INGRESS` requires a caller, including `/` and the OpenAPI pages;
+MetaTables declares no anonymous route. A hosted API started without that
+configuration installs nothing, and admission rejects every caller.
 
 After verification, the API reads the admitted User through the SDK to obtain
 current admin status and active Team UIDs. It evaluates table/namespace grants
@@ -26,7 +37,9 @@ A local server binds only a loopback listener supplied by `metatables serve
 one-hour fact cache used by subsequent requests. Each request checks
 loopback peer, exact Host, the private local process token, and browser-origin
 policy. Hosted caller assertions are rejected in local mode; request headers
-cannot choose an authentication mode or supply another user.
+cannot choose an authentication mode or supply another user. Local does not install
+the SDK request identity, whose local mode would require a platform Bearer token on
+every request.
 
 `METATABLES_LOCAL_ALLOWED_ORIGINS` lists exact loopback browser origins with ports.
 The default permits no browser-origin write requests. Native requests without

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/docs/client/installation-and-connection.md

@@ -11,7 +11,7 @@ require running another service locally.
 Install in your application's Python environment on macOS or Linux:
 
 ```bash
-python -m pip install "mainsequence-metatable==0.1.20" "mainsequence==9.0.6"
+python -m pip install "mainsequence-metatable==0.1.21" "mainsequence==9.0.6"
 mainsequence login
 metatables init --local
 metatables serve --local --admin
@@ -20,9 +20,9 @@ metatables serve --local --admin
 Run from an application Git checkout with a commit and an `origin` remote. Python
 3.13+ is required. Admin also needs Node.js 22.12+ (or 20.19+) and npm. The package
 requires published `mainsequence>=9.0.6,<10`; no SDK checkout is needed.
-The next stable release is MetaTables 0.1.20, paired with published SDK 9.0.6.
+The next stable release is MetaTables 0.1.21, paired with published SDK 9.0.6.
 The pinned command above applies after that stable release is published; before
-then, install the exact `0.1.20.devN` artifact produced by the development publishing
+then, install the exact `0.1.21.devN` artifact produced by the development publishing
 workflow alongside `mainsequence==9.0.6`. SDK 8 is outside this release's
 dependency range.
 `python -m metatables.sdk_compat` checks the required SDK interfaces without network

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/docs/contributing/releasing.md

@@ -39,11 +39,17 @@ distribution.
 
 CI installs dependencies from `uv.lock` and PyPI. An editable SDK checkout cannot
 substitute for the published SDK in a release. The selected SDK artifact must
-provide ordinary `Secret.get_by_uid`, independent Git source context, and
-`CallerAssertionVerifier.from_environment`.
-
-The next MetaTables stable release is `0.1.20`; its supported SDK range is
-`mainsequence>=9.0.6,<10`. Development builds use `0.1.20.devN`.
+provide ordinary `Secret.get_by_uid`, independent Git source context,
+`CallerAssertionVerifier.from_environment`, and the FastAPI request identity:
+`mainsequence.server.fastapi.install_request_identity` and `User.get_logged_user`.
+
+The next MetaTables stable release is `0.1.21`; its supported SDK range is
+`mainsequence>=9.0.6,<10`. Development builds use `0.1.21.devN`.
+0.1.21 is the first release whose hosted API installs the SDK request identity.
+Since 2026-09-28 the platform's FastAPI launcher refuses an app without it, so a new
+hosted API revision needs 0.1.21
+([#34](https://github.com/mainsequence-projects/MetaTables/issues/34),
+[ADR 0017](../adr/api/0017-hosted-request-identity.md)).
 The minimum and lockfile now select published SDK `9.0.6`. SDK 9.0.4 is the first
 whose caller-assertion verifier accepts the platform's EdDSA (Ed25519) caller
 assertions; earlier SDKs verify only RS256, so a hosted API built with them cannot

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/docs/contributing/testing.md

@@ -30,6 +30,22 @@ scaffold/TLS tests, and executable example tests. Loopback tests need permission
 to bind local sockets. Tests inject identity and SDK responses where appropriate;
 they do not claim a hosted SDK deployment has been verified.
 
+## Hosted request identity
+
+The `platform_caller_assertions` fixture simulates a hosted deployment's trust
+configuration and signs genuine EdDSA caller assertions that the SDK verifies.
+`tests/auth/test_request_identity.py` also runs PodDeploymentOrchestrator's
+`require_request_identity` and `serve_fastapi` against the deployed entrypoint when
+that launcher is importable; otherwise those two tests are skipped:
+
+```bash
+PYTHONPATH=/path/to/PodDeploymentOrchestrator/src python -m pytest -q tests/auth/test_request_identity.py
+```
+
+The suite removes platform caller-authentication variables inherited from the
+shell. These checks do not establish a hosted rollout
+([ADR 0017](../adr/api/0017-hosted-request-identity.md)).
+
 ## Local CLI workflow
 
 Focused manual checks for ADR 0011:

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/docs/operations/configuration.md

@@ -31,7 +31,8 @@ Shared deployments use `local_mode_available: false`; the developer checkout use
 `true`. The launcher always runs Local; see [Local only](local-runtime.md#local-only).
 
 Configure the API’s SDK session for ordinary platform Secret access and supply
-trusted caller-verifier settings. Use the SDK's own configuration contract;
+the platform's caller-assertion trust configuration, which the SDK request identity
+reads ([ADR 0017](../adr/api/0017-hosted-request-identity.md)). Use the SDK's own configuration contract;
 MetaTables passes no user-supplied issuer, key URL, or target scope to verification.
 The [SDK capability check](../client/installation-and-connection.md) establishes
 interface availability, not deployment credentials or network readiness.

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/docs/operations/hosted-runtime.md

@@ -31,8 +31,11 @@ deployment; resolve duplicates within it. Hosted clients leave
 `METATABLES_API_URL` unset; that variable accepts only loopback development URLs.
 
 Serve `metatables.api.app.main:app` with hosted execution and one runtime DataSource. Start one
-worker per runtime instance, configure the ordinary SDK session and caller verifier,
-and set `local_mode_available: false` in `configuration.yaml` on shared deployments.
+worker per runtime instance, configure the ordinary SDK session and the platform's
+caller-assertion trust configuration (`MAINSEQUENCE_CALLER_AUTH_MODE=assertion`,
+`MAINSEQUENCE_CALLER_ASSERTION_ISSUER`, `MAINSEQUENCE_CALLER_ASSERTION_JWKS_URL`,
+`APP_NAME` and `MAINSEQUENCE_ORGANIZATION_ENVIRONMENT_UID`), and set
+`local_mode_available: false` in `configuration.yaml` on shared deployments.
 
 ```bash
 uvicorn metatables.api.app.main:app --host 0.0.0.0 --port 18473
@@ -42,6 +45,13 @@ The ingress must provide signed caller assertions. Unsigned User UIDs and the
 runtime's own workload token cannot identify the human requesting a table
 operation. The SDK verifies caller proof; MetaTables applies local resource policy.
 
+The app installs the SDK request identity when it is created, and the platform's
+FastAPI launcher checks that declaration before it serves a revision
+([ADR 0017](../adr/api/0017-hosted-request-identity.md)). Releases before 0.1.21 do
+not install it, so the launcher refuses their new hosted revisions. Without the
+trust configuration the app installs nothing and admits no caller; an incomplete
+configuration stops startup.
+
 ## Declare the runtime database
 
 The deployment configuration is `src/metatables/api/metatables/configuration.yaml`,

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/docs/security/index.md

@@ -97,9 +97,11 @@ choice, not an authorization mechanism.
 
 The platform User response must supply `is_organization_admin` and
 `active_team_uids`; use the compatible published SDK prerequisite described in
-[installation](../client/installation-and-connection.md). Hosted admission verifies
-the existing signed caller assertion, then obtains that User's facts through the
-SDK User detail operation. Local admission resolves facts for the running SDK user.
+[installation](../client/installation-and-connection.md). In hosted mode the SDK
+request identity verifies the existing signed caller assertion; admission takes that
+User from `User.get_logged_user()` and obtains the User's facts through the SDK User
+detail operation ([ADR 0017](../adr/api/0017-hosted-request-identity.md)). Local
+admission resolves facts for the running SDK user.
 The deployment's existing User-directory access must permit that lookup.
 
 The API caches successful User facts for one hour per caller and runtime. Startup

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/mkdocs.yml

@@ -83,3 +83,4 @@ nav:
           - "0014: System migrations in the deployment workflow": adr/api/0014-main-sequence-release-jobs-and-production-migrations.md
           - "0015: TimescaleDB compression and retention policies": adr/api/0015-timescale-compression-and-retention-policies.md
           - "0016: Impact pre-flight": adr/api/0016-impact-preflight.md
+          - "0017: Hosted request identity": adr/api/0017-hosted-request-identity.md

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.20.dev32"
+version = "0.1.21.dev33"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/scripts/check_boundaries.py

@@ -20,6 +20,7 @@ SDK_MODULES = frozenset({
     'mainsequence.client.models_user', 'mainsequence.client.utils', 'mainsequence.client.value_sets',
     'mainsequence.cli.config', 'mainsequence.code_repository_context',
     'mainsequence.instrumentation', 'mainsequence.logconf', 'mainsequence.server.caller_assertions',
+    'mainsequence.server.fastapi',
 })
 SHARED_MODULES = frozenset({'metatables.local_connection', 'metatables.local_files', 'metatables.sdk_compat', 'metatables.update_configuration_contract',
                            'metatables.transfer_contract', 'metatables.runtime_contract', 'metatables.log_contract', 'metatables.local_run_logs',

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33/src/mainsequence_metatable.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.20.dev32
+Version: 0.1.21.dev33
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/src/mainsequence_metatable.egg-info/SOURCES.txt

@@ -31,6 +31,7 @@ docs/adr/api/0013-application-owned-migrations.md
 docs/adr/api/0014-main-sequence-release-jobs-and-production-migrations.md
 docs/adr/api/0015-timescale-compression-and-retention-policies.md
 docs/adr/api/0016-impact-preflight.md
+docs/adr/api/0017-hosted-request-identity.md
 docs/adr/client/0003-api-endpoint-resolution.md
 docs/adr/client/0011-cli-local-development-with-managed-admin.md
 docs/api/authentication-and-errors.md
@@ -183,7 +184,6 @@ src/metatables/api/app/source_passwords.py
 src/metatables/api/app/transfer.py
 src/metatables/api/app/auth/__init__.py
 src/metatables/api/app/auth/boundary.py
-src/metatables/api/app/auth/caller_assertions.py
 src/metatables/api/app/auth/local_actor.py
 src/metatables/api/app/routes/__init__.py
 src/metatables/api/app/routes/column_search.py
@@ -412,12 +412,12 @@ src/metatables/updaters/updaters.py
 src/metatables/updaters/utils.py
 tests/conftest.py
 tests/auth/test_bootstrap_failure_cause.py
-tests/auth/test_caller_assertions.py
 tests/auth/test_data_source_identity.py
 tests/auth/test_development_client.py
 tests/auth/test_hosted_environment_target.py
 tests/auth/test_local_mode.py
 tests/auth/test_platform_fact_cache.py
+tests/auth/test_request_identity.py
 tests/auth/test_runtime_bootstrap.py
 tests/auth/test_runtime_database.py
 tests/auth/test_runtime_scaffold.py

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/src/metatables/api/app/auth/boundary.py

@@ -1,4 +1,4 @@
-"""Shared request admission for hosted assertions and local SDK identity."""
+"""Shared request admission for hosted callers and local SDK identity."""
 
 from __future__ import annotations
 
@@ -7,12 +7,6 @@ from uuid import UUID
 
 from fastapi import Depends, HTTPException, Request
 
-from metatables.api.app.auth.caller_assertions import (
-    ASSERTION_HEADER,
-    CallerAssertionUnavailable,
-    InvalidCallerAssertion,
-    configured_verifier,
-)
 from metatables.api.app.runtime import RuntimeState
 from metatables.api.backend.domain.permission_rules import TrustedActorFacts
 
@@ -43,25 +37,32 @@ def admit_request(request: Request) -> AdmittedCaller:
             user_uid=state.identity.user_uid, active_team_uids=teams, is_admin=admin,
             environment_uid=UUID(environment_uid) if environment_uid else None,
         )
-    assertion = request.headers.get(ASSERTION_HEADER)
-    if assertion is None:
-        raise HTTPException(status_code=401, detail="Caller assertion is required.")
-    try:
-        caller = configured_verifier().verify(assertion)
-    except InvalidCallerAssertion as exc:
-        raise HTTPException(status_code=401, detail="Invalid caller assertion.") from exc
-    except CallerAssertionUnavailable as exc:
-        raise HTTPException(status_code=503, detail="Caller authentication is unavailable.") from exc
-    user_uid = UUID(caller.user_uid)
+    user_uid = logged_user_uid()
     teams, admin = state.actor_facts_cache.get(
         (False, user_uid), lambda: sdk_actor_facts(user_uid, local=False),
     )
+    # The verified assertion's target, recorded by the SDK request identity.
+    environment_uid = getattr(request.state, "organization_environment_uid", None)
     return AdmittedCaller(
-        user_uid=UUID(caller.user_uid), active_team_uids=teams, is_admin=admin,
-        environment_uid=UUID(caller.environment_uid) if getattr(caller, "environment_uid", None) else None,
+        user_uid=user_uid, active_team_uids=teams, is_admin=admin,
+        environment_uid=UUID(environment_uid) if environment_uid else None,
     )
 
 
+def logged_user_uid() -> UUID:
+    """Return the caller that the SDK request identity verified for this request.
+
+    The SDK verifies the platform-signed caller assertion once, before any route
+    runs, and answers missing or invalid proof itself. When no caller is bound, for
+    example on a hosted API started without the platform's trust configuration,
+    admission fails; there is no header or process-account fallback.
+    """
+    from mainsequence.client import RequestIdentityError, User
+    try:
+        return UUID(User.get_logged_user().uid)
+    except RequestIdentityError:
+        raise HTTPException(status_code=401, detail="Caller assertion is required.") from None
+
 
 def platform_facts(identity):
     """Consume facts supplied by SDK User responses for the already verified caller."""

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/src/metatables/api/app/main.py

@@ -1,5 +1,6 @@
 """MetaTables API application and route composition."""
 
+import os
 from contextlib import asynccontextmanager
 from uuid import UUID
 
@@ -7,6 +8,7 @@ from fastapi import Depends, FastAPI, HTTPException, Request
 from fastapi.exception_handlers import http_exception_handler
 from fastapi.responses import JSONResponse
 from fastapi.routing import APIRoute
+from mainsequence.server.fastapi import install_request_identity
 from sqlalchemy.orm import Session
 from starlette.exceptions import HTTPException as StarletteHTTPException
 
@@ -100,6 +102,38 @@ def time_index_aliases(router):
 
 from metatables.api.app.routes.update_crud import router as update_crud_router
 
+# The platform projects caller-assertion trust configuration into every hosted
+# FastAPI deployment. The SDK request identity and the platform launcher select
+# their caller-authentication mode from these variables (ADR 0017).
+PLATFORM_CALLER_AUTHENTICATION = (
+    "MAINSEQUENCE_CALLER_AUTH_MODE",
+    "APP_NAME",
+    "FASTAPI_PUBLIC_BASE_URL",
+    "MAINSEQUENCE_CALLER_ASSERTION_ISSUER",
+    "MAINSEQUENCE_CALLER_ASSERTION_JWKS_URL",
+)
+
+
+def install_hosted_request_identity(service: FastAPI, config: RuntimeConfig) -> None:
+    """Install the SDK request identity once on the platform-served hosted API.
+
+    Local and developer runtimes admit requests through their loopback listener and
+    private launcher token, with the SDK user resolved at startup; they never install
+    it. The hosted API installs it when the platform's caller-authentication
+    configuration is present and accepts only signed caller assertions. Without that
+    configuration no caller is ever bound, so admission rejects every caller.
+    """
+    if config.local_mode or config.developer_mode:
+        return
+    if not any(os.environ.get(name) for name in PLATFORM_CALLER_AUTHENTICATION):
+        return
+    install_request_identity(service)
+    if service.state.mainsequence_request_identity["mode"] != "assertion":
+        raise RuntimeError(
+            "The hosted MetaTables API accepts only platform caller assertions. "
+            "Use 'metatables serve --local' for local development."
+        )
+
 
 def create_app(config: RuntimeConfig | None = None) -> FastAPI:
     configure_logging()
@@ -223,7 +257,21 @@ def create_app(config: RuntimeConfig | None = None) -> FastAPI:
     async def hello() -> dict[str, str]:
         return {"message": "Hello, world!"}
 
+    # Installed last, its middleware is the outermost application middleware:
+    # callers are verified before local admission, transfer limits or any route.
+    install_hosted_request_identity(service, selected)
     return service
 
 
-app = create_app()
+def __getattr__(name: str) -> FastAPI:
+    """Create the default app served as ``metatables.api.app.main:app`` on first use.
+
+    Importing the factory, as the local worker, the hosted entrypoint and the
+    reference scripts do, therefore builds no unused app and installs no request
+    identity in processes that never serve it.
+    """
+    if name != "app":
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+    service = create_app()
+    globals()["app"] = service
+    return service

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/src/metatables/sdk_compat.py

@@ -21,10 +21,15 @@ def require_sdk_capabilities(*, server: bool = False) -> None:
             from mainsequence.server.caller_assertions import CallerAssertionVerifier
             if not callable(getattr(CallerAssertionVerifier, "from_environment", None)):
                 raise ImportError("CallerAssertionVerifier.from_environment is unavailable")
+            from mainsequence.client import RequestIdentityError
+            from mainsequence.server.fastapi import install_request_identity
+            if not (callable(install_request_identity) and issubclass(RequestIdentityError, Exception)
+                    and callable(getattr(User, "get_logged_user", None))):
+                raise ImportError("SDK FastAPI request identity is unavailable")
     except ImportError as exc:
         raise ImportError(
             "MetaTables requires a compatible mainsequence SDK with platform Secrets "
-            "and caller-assertion verification. Install a compatible SDK artifact or the documented local checkout; "
+            "and FastAPI request identity. Install a compatible SDK artifact or the documented local checkout; "
             "see docs/client/installation-and-connection.md."
         ) from exc
 

{mainsequence_metatable-0.1.20.dev32 → mainsequence_metatable-0.1.21.dev33}/tests/auth/test_local_mode.py

@@ -15,8 +15,7 @@ from sqlalchemy import create_engine
 from sqlalchemy.orm import Session, sessionmaker
 
 from metatables.api.app import runtime
-from metatables.api.app.auth import boundary, local_actor
-from metatables.api.app.auth.caller_assertions import AuthenticatedCaller, InvalidCallerAssertion
+from metatables.api.app.auth import local_actor
 from metatables.api.app.main import create_app
 from metatables.api.app.runtime import LocalIdentity, RuntimeConfig
 from metatables.api.backend.domain.catalog_rules import TableRegistration
@@ -296,19 +295,9 @@ def test_local_protected_route_needs_no_seed_and_keeps_current_grant_checks(monk
         engine.dispose()
 
 
-def test_hosted_verified_caller_needs_no_membership_or_protection_row(monkeypatch, tmp_path):
+def test_hosted_verified_caller_needs_no_membership_or_protection_row(monkeypatch, tmp_path,
+                                                                     platform_caller_assertions):
     user_uid = uuid4()
-
-    class Verifier:
-        def verify(self, assertion):
-            return SimpleNamespace(
-                user_uid=str(user_uid),
-                release_uid=str(uuid4()),
-                issued_at=1,
-                expires_at=2,
-            )
-
-    monkeypatch.setattr(boundary, "configured_verifier", lambda: Verifier())
     monkeypatch.setattr(runtime, "resolve_sdk_identity", lambda: pytest.fail("SDK called"))
     engine = create_engine(f"sqlite+pysqlite:///{tmp_path / 'hosted.sqlite'}")
     Base.metadata.create_all(engine)
@@ -319,7 +308,7 @@ def test_hosted_verified_caller_needs_no_membership_or_protection_row(monkeypatc
 
             from metatables.api.backend.integrations.runtime_binding import RuntimeStorageBinding
             client.app.state.runtime = replace(client.app.state.runtime, bootstrap=None, binding=RuntimeStorageBinding("postgresql://fixture/catalog"))
-            headers = {"X-MainSequence-Caller-Assertion": "verified"}
+            headers = platform_caller_assertions.headers(user_uid)
             filters = { "limit": 10}
             assert client.post("/meta-tables/filter/", json=filters, headers=headers).status_code == 200
             with Session(engine) as session, session.begin():
@@ -374,36 +363,62 @@ def test_local_rejects_non_loopback_peer_even_with_token(monkeypatch, make_local
 def test_hosted_does_not_use_local_sdk_or_accept_unsigned_uid(monkeypatch):
     monkeypatch.setattr(runtime, "resolve_sdk_identity", lambda: pytest.fail("SDK called"))
     with TestClient(create_app(RuntimeConfig.from_environment({}))) as client:
+        # Without the platform's trust configuration no caller is ever bound.
+        assert getattr(client.app.state, "mainsequence_request_identity", None) is None
         assert client.get("/time-index-table-update-constants", headers={"X-User-UID": str(uuid4())}).status_code == 401
 
 
-def test_hosted_route_uses_verifier_without_local_fallback(monkeypatch):
+def test_hosted_route_uses_sdk_identity_without_local_fallback(monkeypatch, platform_caller_assertions):
     user_uid = uuid4()
-
-    class Verifier:
-        def verify(self, assertion):
-            if assertion != "verified":
-                raise InvalidCallerAssertion("invalid")
-            return SimpleNamespace(
-                user_uid=str(user_uid),
-                release_uid=str(uuid4()),
-                issued_at=1,
-                expires_at=2,
-            )
-
-    monkeypatch.setattr(boundary, "configured_verifier", lambda: Verifier())
     monkeypatch.setattr(runtime, "resolve_sdk_identity", lambda: pytest.fail("SDK called"))
     with TestClient(create_app(RuntimeConfig.from_environment({}))) as client:
         assert client.get(
             "/time-index-table-update-constants",
-            headers={"X-MainSequence-Caller-Assertion": "invalid"},
+            headers={platform_caller_assertions.header: "invalid"},
         ).status_code == 401
         assert client.get(
             "/time-index-table-update-constants",
-            headers={"X-MainSequence-Caller-Assertion": "verified"},
+            headers={"X-User-UID": str(user_uid), "X-MetaTables-Local-Token": TOKEN},
+        ).status_code == 401
+        assert client.get(
+            "/time-index-table-update-constants",
+            headers=platform_caller_assertions.headers(user_uid),
         ).status_code == 200
 
 
+def test_local_runtime_never_installs_request_identity(monkeypatch, make_local_identity,
+                                                        platform_caller_assertions):
+    # Even a shell that carries a hosted deployment's variables keeps local admission.
+    monkeypatch.setattr(runtime, "resolve_sdk_identity", lambda: make_local_identity(uuid4(), uuid4()))
+    with local_client(local_config()) as client:
+        assert getattr(client.app.state, "mainsequence_request_identity", None) is None
+        assert not [entry for entry in client.app.user_middleware
+                    if entry.cls.__module__.startswith("mainsequence")]
+        assert client.get("/time-index-table-update-constants").status_code == 200
+        assert client.get(
+            "/time-index-table-update-constants",
+            headers=platform_caller_assertions.headers(uuid4()),
+        ).status_code == 401  # Caller assertions are still rejected locally.
+        assert client.get(
+            "/time-index-table-update-constants", headers={"X-MetaTables-Local-Token": "bad"}
+        ).status_code == 401
+    assert platform_caller_assertions.verified == []
+
+
+def test_sdk_bearer_mode_would_reject_every_local_launcher_request(monkeypatch, make_local_identity):
+    """Why Local keeps its own admission: the SDK's local mode needs a Bearer token
+    on every request, and local clients send only the launcher's private token."""
+    from mainsequence.server.fastapi import install_request_identity
+
+    monkeypatch.setattr(runtime, "resolve_sdk_identity", lambda: make_local_identity(uuid4(), uuid4()))
+    app = create_app(local_config())
+    install_request_identity(app)
+    assert app.state.mainsequence_request_identity["mode"] == "local"
+    with TestClient(app, base_url=BASE_URL, client=("127.0.0.1", 52000),
+                    headers={"X-MetaTables-Local-Token": TOKEN}) as client:
+        assert client.get("/time-index-table-update-constants").status_code == 401
+
+
 def test_sdk_identity_comes_from_authenticated_user_and_git_source(monkeypatch):
     from mainsequence import code_repository_context
     from mainsequence.client.models_user import User