mainsequence-metatable 0.1.23.dev38__tar.gz → 0.1.24.dev39__tar.gz

mainsequence_metatable-0.1.24.dev39/.mainsequence/workflows/metatables-api.yaml

@@ -0,0 +1,78 @@
+api_version: "2.3.0"
+name: metatables-api
+resources:
+  - key: metatables-api
+    kind: fastapi
+    spec:
+      source_path: api/metatables/main.py
+      automatic_deployment: true
+      automatic_redeployment:
+        enabled: true
+        tag_regex: null
+      min_scale: 1
+      revision_retention_count: 3
+    access:
+      secrets:
+        - name: METATABLES_RUNTIME_DATABASE
+          level: view
+
+  - key: metatables-analyst-agent
+    kind: harness_agent
+    spec:
+      source_path: api/tau/main.py
+      llm_provider: openai
+      llm_model: gpt-5.6-luna
+      llm_thinking: medium
+      automatic_deployment: true
+      automatic_redeployment:
+        enabled: true
+        tag_regex: null
+      revision_retention_count: 3
+      cpu_request: "1"
+      memory_request: 2Gi
+      env_vars:
+        - name: TAU_EXCLUDE_BASE_TOOLS
+          value: "true"
+        - name: TAU_EXCLUDE_MAINSEQUENCE_MCP
+          value: "true"
+    access:
+      branch: view
+
+  - key: migrate-system
+    kind: job
+    spec:
+      name: MetaTables system migrations
+      execution_path: jobs/migrate_system.py
+      cpu_request: "1"
+      memory_request: "1"
+      max_runtime_seconds: 1800
+      automatic_redeployment:
+        enabled: true
+        tag_regex: null
+    access:
+      secrets:
+        - name: METATABLES_RUNTIME_DATABASE
+          level: view
+
+execution:
+  steps:
+    image:
+      prepare_image: metatables-api
+
+    agent_image:
+      prepare_image: metatables-analyst-agent
+
+    migrate:
+      run_job: migrate-system
+      image_from: image
+      needs: [image]
+
+    deploy_api:
+      deploy: metatables-api
+      image_from: image
+      needs: [migrate]
+
+    deploy_agent:
+      deploy: metatables-analyst-agent
+      image_from: agent_image
+      needs: [agent_image, deploy_api]

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.23.dev38
+Version: 0.1.24.dev39
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev39}/docs/adr/agent/0019-metatables-analyst-agent.md

@@ -1,5 +1,15 @@
 # ADR 0019: MetaTables Analyst agent
 
+> Amendment (2026-10-06): One workflow deploys the API and the agent.
+> `.mainsequence/workflows/metatables-api.yaml` declares the `harness_agent` beside the
+> FastAPI and its migration Job; its execution graph prepares the agent's own image and
+> deploys the agent after the API. The separate agent workflow file is removed. The
+> platform keeps the branch's Agent and release when its declaration moves between
+> files, and the API keeps its file and keys, so neither is recreated. The API's graph
+> already ran the system migration Job on every push; the agent now also waits for it
+> and for the API deployment, so a failed migration leaves the agent on its previous
+> revision.
+>
 > Amendment (2026-10-05): The agent always runs a deep search before writing SQL.
 > `deep_search` replaces the single-phrase `search_tables`: it searches with several
 > phrasings, merges the hits, describes the best candidates and lists the tables
@@ -116,10 +126,13 @@ agent's questions to a third party.
 
 ### Deployment
 
-`.mainsequence/workflows/metatables-analyst-agent.yaml` declares one `harness_agent`
-with `source_path: api/tau/main.py`, a thin `create_app()` module, and sets
-`TAU_EXCLUDE_BASE_TOOLS` and `TAU_EXCLUDE_MAINSEQUENCE_MCP` to `true`. It is separate
-from the API workflow, so a prompt change never runs system migrations.
+`.mainsequence/workflows/metatables-api.yaml`, the API's workflow, declares one
+`harness_agent` (`metatables-analyst-agent`) with `source_path: api/tau/main.py`, a thin
+`create_app()` module, and sets `TAU_EXCLUDE_BASE_TOOLS` and
+`TAU_EXCLUDE_MAINSEQUENCE_MCP` to `true`. Its execution graph prepares the agent's image
+alongside the API's and deploys the agent after the API, so the agent never runs
+against an API that has not migrated. The agent declares `access: branch: view`, which
+lets its workload User find the API release and request runtime access to it.
 `.agents/agent_card.json` advertises the two skills with `message` responses.
 `ms-tau-sdk` is the `agent` extra and part of the deployment `requirements.txt`, never
 a dependency of `mainsequence-metatable`.
@@ -143,9 +156,10 @@ a dependency of `mainsequence-metatable`.
 `describe_table` and `list_namespaces` through the client against the API, loads the extension and
 calls its tools, checks the card and workflow, and opens a vendored skill reference
 through the SDK's skill-scoped `read`. Before the first deployment, run a local
-`ms-tau` session to confirm the effective tool catalog, confirm which User the agent's
-requests resolve to under ADR 0017 so its Reader grants can be assigned, and check
-whether `run-query` accepts `EXPLAIN`, which `pg-aiguide` uses to validate queries.
+`ms-tau` session to confirm the effective tool catalog and check whether `run-query`
+accepts `EXPLAIN`, which `pg-aiguide` uses to validate queries. The agent's requests
+resolve to its Agent's workload User; it sees nothing until that User is granted
+Reader in Admin ([Workload Users](../../security/ownership-and-sharing.md#workload-users)).
 
 ## Later
 

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev39}/docs/operations/hosted-runtime.md

@@ -9,7 +9,9 @@ new image, and a failure stops the rollout. API pods only open it. See
 [ADR 0014](../adr/api/0014-main-sequence-release-jobs-and-production-migrations.md).
 
 The repository's `.mainsequence/workflows/metatables-api.yaml` declares the
-automatic FastAPI deployment at `api/metatables/main.py`. This file imports
+automatic FastAPI deployment at `api/metatables/main.py`, and the MetaTables Analyst
+Harness Agent at `api/tau/main.py`
+([ADR 0019](../adr/agent/0019-metatables-analyst-agent.md)), which deploys after the API. This file imports
 `metatables.api.metatables.main:app`; the server and its deployment-specific
 `configuration.yaml` are installed under `metatables.api`. That configuration
 disables local controls and declares the runtime database. The workflow uses no
@@ -120,7 +122,10 @@ lists what MetaTables requires.
 In `.mainsequence/workflows/metatables-api.yaml`, the `migrate-system` Job
 (`jobs/migrate_system.py`, exactly `metatables runtime upgrade`) runs from the
 candidate image before the API rolls out, on every deployment. It reads
-`configuration.yaml` and the Secret itself; it does not call the running API. It:
+`configuration.yaml` and the Secret itself; it does not call the running API.
+The Job and the API run as their own workload Users, so each declares
+`access.secrets` view on the `uri_secret` Secret, and on any TLS Secret you set;
+the platform grants it on push. It:
 
 1. checks that the login can secure the database: `CREATEROLE`, `CREATE` on the
    database or ownership of the `metatables` schema, and `CREATE` on the default schema;

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev39}/docs/security/ownership-and-sharing.md

@@ -70,6 +70,12 @@ through a Team an Organization admin adds it to:
   table's Writer. Everything else needs a Writer or an admin.
 - A workload User whose workload was deleted is inactive and cannot be granted.
 
+The MetaTables Analyst ([ADR 0019](../adr/agent/0019-metatables-analyst-agent.md))
+is such a workload: it reads as its Agent's workload User and never writes. Until
+that User holds Reader on tables or namespaces, granted in Admin, the Analyst sees
+nothing. Its manager can grant Reader on any table they can read. Everyone who can
+use the Analyst reads what those grants allow.
+
 ## Who you can find
 
 Sharing candidates, search and principal checks show what you can see in the

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev39}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.23.dev38"
+version = "0.1.24.dev39"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev39}/src/mainsequence_metatable.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.23.dev38
+Version: 0.1.24.dev39
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev39}/tests/analyst/test_agent_surface.py

@@ -44,10 +44,22 @@ def test_card_workflow_and_entrypoint_describe_one_read_only_agent():
     assert all((ROOT / s["path"]).is_file() for s in card["skills"])
     assert card["capabilities"]["extensions"][0]["params"]["supportedResponseKinds"] == ["message"]
 
-    workflow = yaml.safe_load((ROOT / ".mainsequence/workflows/metatables-analyst-agent.yaml").read_text())
-    [resource] = workflow["resources"]
+    # One workflow deploys the API and the agent; the agent follows the API (ADR 0019).
+    workflow = yaml.safe_load((ROOT / ".mainsequence/workflows/metatables-api.yaml").read_text())
+    assert sorted((ROOT / ".mainsequence/workflows").iterdir()) == [ROOT / ".mainsequence/workflows/metatables-api.yaml"]
+    by_kind = {}
+    for row in workflow["resources"]:
+        by_kind.setdefault(row["kind"], []).append(row)
+    [api], [resource] = by_kind["fastapi"], by_kind["harness_agent"]
+    assert api["key"] == "metatables-api" and resource["key"] == "metatables-analyst-agent"
+    steps = workflow["execution"]["steps"]
+    assert steps["agent_image"] == {"prepare_image": "metatables-analyst-agent"}
+    assert steps["deploy_agent"] == {"deploy": "metatables-analyst-agent", "image_from": "agent_image",
+                                     "needs": ["agent_image", "deploy_api"]}
+    # The agent finds and calls the API release as its own workload User; it never reads Secrets.
+    assert resource["access"] == {"branch": "view"}
     spec = resource["spec"]
-    assert resource["kind"] == "harness_agent" and spec["source_path"] == "api/tau/main.py"
+    assert spec["source_path"] == "api/tau/main.py"
     assert (spec["llm_provider"], spec["llm_model"], spec["llm_thinking"]) == ("openai", "gpt-5.6-luna", "medium")
     assert {e["name"]: e["value"] for e in spec["env_vars"]} == {
         "TAU_EXCLUDE_BASE_TOOLS": "true", "TAU_EXCLUDE_MAINSEQUENCE_MCP": "true"}

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev39}/uv.lock

@@ -820,7 +820,7 @@ wheels = [
 
 [[package]]
 name = "mainsequence-metatable"
-version = "0.1.23"
+version = "0.1.24"
 source = { editable = "." }
 dependencies = [
     { name = "alembic" },

mainsequence_metatable-0.1.23.dev38/.mainsequence/workflows/metatables-api.yaml

@@ -1,40 +0,0 @@
-api_version: "2.3.0"
-name: metatables-api
-resources:
-  - key: metatables-api
-    kind: fastapi
-    spec:
-      source_path: api/metatables/main.py
-      automatic_deployment: true
-      automatic_redeployment:
-        enabled: true
-        tag_regex: null
-      min_scale: 1
-      revision_retention_count: 3
-
-  - key: migrate-system
-    kind: job
-    spec:
-      name: MetaTables system migrations
-      execution_path: jobs/migrate_system.py
-      cpu_request: "1"
-      memory_request: "1"
-      max_runtime_seconds: 1800
-      automatic_redeployment:
-        enabled: true
-        tag_regex: null
-
-execution:
-  steps:
-    image:
-      prepare_image: metatables-api
-
-    migrate:
-      run_job: migrate-system
-      image_from: image
-      needs: [image]
-
-    deploy_api:
-      deploy: metatables-api
-      image_from: image
-      needs: [migrate]