mainsequence-metatable 0.1.23.dev38__tar.gz → 0.1.24.dev40__tar.gz

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev40}/.agents/skills/analyze-with-sql/SKILL.md

@@ -19,4 +19,5 @@ Input: a data question. Output: the answer, the SQL that ran and the tables it r
 Report what the data shows, what you infer and what remains unresolved, and say when
 results were truncated. End with the SQL and the tables it read.
 
-Side effects: none. The database enforces the agent's Reader grants and refuses writes.
+Side effects: none. The database enforces the grants of the person you are answering and
+refuses writes.

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev40}/.agents/skills/discover-tables/SKILL.md

@@ -21,4 +21,4 @@ Answer with each table's identifier, namespace, uid and physical name, the colum
 matter, and the join keys between them. When candidates compete, say which you would use
 and why. When nothing fits, say so.
 
-Side effects: none; every tool reads under the agent's own Reader grants.
+Side effects: none; every tool reads with the access of the person you are answering.

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev40}/.agents/skills/ms_tau_sdk/PINNED_FROM.txt

@@ -1,7 +1,7 @@
 schema=1
 library_name=ms-tau-sdk
 namespace=ms_tau_sdk
-pinned_version=1.3.0
+pinned_version=2.0.7
 skills_path=src/ms_tau_sdk/agent_skills
-skills=tau_a2a_runtime_adapter,tau_local_development,tau_project_customization,tau_repository_integration
+skills=tau_a2a_runtime_adapter,tau_local_development,tau_project_customization,tau_repository_integration,tau_security_and_access
 command=ms-tau skills sync --path .

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev40}/.agents/skills/ms_tau_sdk/tau_a2a_runtime_adapter/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: tau-a2a-runtime-adapter
-description: Implement and diagnose the TAU host side of Main Sequence A2A without duplicating the Django-owned protocol, authorization, discovery, and task-lifecycle contract.
+description: Implement and diagnose the TAU host side of Main Sequence A2A without duplicating the platform-owned protocol, authorization, discovery, and task-lifecycle contract.
 ---
 
 # TAU A2A Runtime Adapter
@@ -11,7 +11,7 @@ idempotency, and retry semantics.
 
 ## Ownership boundary
 
-Django owns:
+The platform owns:
 
 - canonical `a2a.*` MCP schemas and platform discovery;
 - AgentSession and AgentTask lifecycle;
@@ -23,8 +23,18 @@ The SDK owns:
 
 - projecting the authenticated Main Sequence MCP catalog into a TAU session;
 - preserving each tool's canonical name and metadata through host normalization;
-- privately attaching active caller-session proof when a tool advertises
-  `mainsequence.ai/requires-caller-session-proof/v1: true`;
+- privately attaching, to every hosted Main Sequence MCP call, the turn's caller-session proof under
+  `mainsequence.ai/caller-session-proof/v1`, and, while the turn serves a person, the same proof as
+  that person's delegation under `mainsequence.ai/delegation/v1`. No tool metadata decides it;
+- verifying the platform's signed caller or platform assertion on every inbound request of a
+  hosted runtime, and admitting a request to a session or its Tasks only for the session's owner,
+  an Organization admin, or the workload User of the Agent that delegated to that child session,
+  which the platform's own records establish, never the `X-Caller-*` headers;
+- presenting the verified caller assertion of the request that starts a chat or A2A Message turn
+  only when it marks that turn active, so that the platform can record the turn's requester;
+  taking the person the turn serves only from the platform's answer to the turn start; and giving
+  extension tools that person and calls for the work through `current_requester()` and
+  `platform_client()` without exposing the assertion, the lease proof, or any token;
 - translating inbound A2A requests into the shared TAU runtime; and
 - translating runtime events and results into validated A2A responses.
 
@@ -40,7 +50,7 @@ log, persist, or reuse the proof as general authorization.
 
 ## Send Work To Another Agent
 
-For a deployed Agent, use the projected `a2a.send_message` MCP operation. Django creates or
+For a deployed Agent, use the projected `a2a.send_message` MCP operation. The platform creates or
 resolves the target `AgentSession`, waits for its runtime to become ready, and dispatches the
 message. For asynchronous work, use the returned Task handle with `a2a.wait_task`.
 
@@ -97,4 +107,4 @@ responder Message; never send the removed ad hoc status-detail shape. Status eve
 Message and consumers reload the Task snapshot.
 
 Change this SDK only for catalog projection, proof attachment, runtime execution, or transport
-translation defects. Platform contract changes belong to Django.
+translation defects. Platform contract changes are made in the platform, not in this SDK.

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev40}/.agents/skills/ms_tau_sdk/tau_local_development/SKILL.md

@@ -35,6 +35,10 @@ The SDK looks for the CLI in `MAINSEQUENCE_CLI`, then beside the Python interpre
 CLI. Do not add token lines to `.env`. A pair found there still works, but it is deprecated and
 startup logs a warning. `mainsequence refresh-token` run in that directory removes the lines.
 
+Do not set `APP_NAME`, `FASTAPI_PUBLIC_BASE_URL`, `MAINSEQUENCE_CALLER_AUTH_MODE=assertion`, or the
+`MAINSEQUENCE_CALLER_ASSERTION_*` variables. The platform sets them when it hosts a runtime, and
+local mode refuses to start with them.
+
 Set `MAINSEQUENCE_ENDPOINT` only for a non-default platform endpoint. The CLI session must be for
 the same endpoint. Local mode binds to `127.0.0.1:8787` by default. Treat an explicit public bind
 as privileged exposure: each accepted request can use the authenticated user's live Main Sequence

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev40}/.agents/skills/ms_tau_sdk/tau_project_customization/SKILL.md

@@ -87,7 +87,7 @@ Extensions may change effective agent capabilities, but they must not replace or
 
 - Main Sequence runtime or user authentication;
 - provider-control evidence and credential hydration;
-- caller identity and active-session proof;
+- caller identity, the turn's requester, and active-session proof;
 - persistence ordering, leases, cancellation, or task settlement;
 - secret redaction and payload limits; or
 - HTTP, SSE, Responses, and A2A wire validation.
@@ -95,6 +95,89 @@ Extensions may change effective agent capabilities, but they must not replace or
 When Main Sequence MCP is enabled, use its canonical operations for live platform state. Project
 tools do not grant new platform permissions merely because they run inside TAU.
 
+## Acting for the person a turn serves
+
+An Agent that an Organization admin enabled for it can call the platform and other platform
+applications with the ordinary permissions of the person whose request a turn is serving: the
+requester. The platform keeps that authority and finds the person in its own records; the runtime
+only proves which of its sessions it is working on. Extension tools use two SDK functions and
+nothing else:
+
+```python
+import json
+
+from tau_agent.messages import TextContent
+from tau_agent.tools import AgentToolResult
+
+from ms_tau_sdk import platform_client
+
+ANALYST_DATA_RELEASE_UID = "..."  # the release of the application to ask
+
+
+async def revenue_by_region(tool_call_id, arguments, signal=None, on_update=None):
+    # This tool answers each person with their own data, so it needs a person.
+    try:
+        answer = await platform_client(delegation="required").call_release(
+            ANALYST_DATA_RELEASE_UID,
+            "POST",
+            "/query",
+            json={"question": "revenue by region"},
+        )
+    except PermissionError:
+        return AgentToolResult(content=[TextContent(text="Ask me from your own conversation.")])
+    return AgentToolResult(content=[TextContent(text=json.dumps(answer.json()["rows"]))])
+```
+
+- `current_requester()` returns the person the turn serves, with `uid` and `team_uids`, or
+  `None`. The platform names that person when the turn starts, whoever called; it is `None` when
+  the platform names nobody, in local mode, and in code outside a turn. Only it names the
+  requester: never take a person's UID from tool arguments, the prompt, history, or a header.
+- `platform_client()` returns a client. `await client.request("GET", "/api/v1/...")` calls a
+  platform API path, and `await client.call_release(release_uid, method, path, ...)` calls another
+  platform application. Both return an `httpx.Response`.
+- By default (`delegation="auto"`) a call carries the person's delegation while the turn serves a
+  person, and is the Agent's own otherwise; the operation or application decides what it may do.
+  `delegation="none"` never carries it. `delegation="required"` raises a `PermissionError` before
+  sending when the turn serves nobody; use it in a tool that only makes sense for a person.
+- A call the platform refuses because the person's access ended (`code`
+  `requester_binding_invalid` or `runtime_lease_*`) raises a `PermissionError`: the turn is over,
+  the access was removed, more than 24 hours passed, or the Agent is not enabled. Catch it, say in
+  plain words that the request cannot be served, and never retry it as the Agent.
+
+Rules for tools that act for the requester:
+
+- Never handle proofs or tokens. The SDK attaches the session, the lease proof, and the
+  credentials itself. A tool never reads, logs, stores, or forwards them, passes a path rather than
+  a URL, and never sets `Authorization` or an `X-MainSequence-*` header.
+- A delegated call uses the person's ordinary permissions, including administrative ones; any other
+  call uses the Agent's own. Each operation decides what it needs. Never infer write permission
+  from view access.
+- This needs the platform's matching change, deployed in the same cutover; check the deployed
+  platform and the installed SDK before depending on it.
+- Return to the model only business results, such as rows, numbers, and names. Never return the
+  response object, its headers, a token, a proof, or a raw error body.
+- Keep nothing for another turn or another person. The delegation ends with the turn, and a task
+  the tool leaves running acts only as the Agent afterwards.
+- What a tool reads for a person belongs to that person's conversation. Do not write it to shared
+  stores, other Agents, or external systems.
+
+People who use such an Agent are told:
+
+> **This Agent works with your identity.** It can read, create, change, run,
+> share or delete only what your permissions allow through supported operations,
+> only while serving your request, and for at most 24 hours after you ask. It
+> uses your ordinary permissions, including administrative permissions, and
+> access is checked on every call. Your Organization's administrator approved it
+> to work this way.
+
+The statement describes delegated calls. The Agent's own grants and trusted extension code remain
+separate authority. Prompt injection can cause unintended changes, sharing, or deletion within the
+person's permissions, and completed writes can outlast the delegation. Only Organization admins
+enable this authority.
+
+For a complete example, a tool that uses a person's Secret without exposing it, and how sharing
+decides what a delegated call can reach, use `tau_security_and_access`.
+
 ## Validation
 
 Verify each project-owned capability through its observable interface and focused tests. Check

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev40}/.agents/skills/ms_tau_sdk/tau_repository_integration/SKILL.md

@@ -44,6 +44,20 @@ Both paths construct the same application. The project owns the dependency lock,
 deployable artifact, system packages, and any surrounding ASGI composition. There is no separate
 TAU image, overlay, or SDK-owned deployment.
 
+`create_app()` installs the runtime's request identity. When Main Sequence hosts the runtime, the
+application admits only requests that carry the platform's signed assertion, lets only a session's
+owner, an Organization admin, or the Agent that delegated to it address that session, and declares
+all this in `app.state.mainsequence_request_identity`. The platform launcher serves an application
+only with that declaration, read from the object it serves. Therefore:
+
+- export the object `create_app()` returns as the module's `app`. An application that mounts it
+  inside another one declares nothing, and the launcher refuses it;
+- do not add middleware or routes that take the caller from `X-User-UID` or other gateway headers,
+  and do not install a second request-identity integration; and
+- do not set `APP_NAME`, `FASTAPI_PUBLIC_BASE_URL`, or the `MAINSEQUENCE_CALLER_*` variables in the
+  repository. The platform sets them when it hosts the runtime, and local mode refuses to start
+  with them.
+
 ## Job-hosted batch execution
 
 ADR 0015 accepts a Python batch entry point, but it is **not implemented in this SDK version**.
@@ -106,7 +120,11 @@ When an ASGI shim exists, also import it without starting a second application i
 
 ```bash
 uv run python -c "from api.tau.main import app; print(type(app).__name__)"
+uv run python -c "from api.tau.main import app; print(app.state.mainsequence_request_identity)"
 ```
 
+The second command prints `{'installed': True, 'mode': 'local', 'public_ingress': ()}` outside
+hosting.
+
 Do not require the `mainsequence` Python distribution in the TAU dependency graph. Authentication
 and Main Sequence transport are implemented directly by `ms-tau-sdk`.

mainsequence_metatable-0.1.24.dev40/.agents/skills/ms_tau_sdk/tau_security_and_access/SKILL.md

@@ -0,0 +1,244 @@
+---
+name: tau-security-and-access
+description: Build and review project tools that call the platform or other applications for the person a turn serves, including tools that use a person's Secret without exposing it, and explain how delegation and sharing decide what those tools can reach.
+---
+
+# TAU Security and Access
+
+Use this skill when a project tool under `.tau/extensions/` calls the platform or another
+platform application, uses a Secret, or must answer each person with their own data. Extension
+mechanics are in `tau_project_customization`. The full model, with the administrator setup, is in
+the SDK's Security and access guide (`docs/reference/security-model.md`). Sharing itself is in
+`.agents/skills/mainsequence/platform_operations/access_control_and_sharing/SKILL.md`.
+
+## Who a call acts as
+
+Every call a tool makes through `platform_client()` follows one rule:
+
+| The call carries | Permissions used |
+| --- | --- |
+| No delegation | The caller's own: the Agent's workload grants, or in local mode your own login. |
+| A valid delegation | The person the turn serves, with their ordinary permissions, including administrative ones. |
+| A delegation that ended or is invalid | None. The call is refused with a `PermissionError` and is never retried as the Agent. |
+
+- The platform names the person when the turn starts, and `current_requester()` returns them. It
+  returns `None` when the Agent is not enabled to act for people (only an Organization admin can
+  enable it, with `acts_for_requester`), for work no person asked for, in local mode and outside a
+  turn.
+- The operation or application that receives the call decides what it may do. No list says which
+  operations accept a delegation. Read access never implies edit, run, share or delete.
+- The call stays the Agent's call, made for the person. It is not impersonation: the platform
+  checks it on every call, only while the turn or Task serving the person runs, for at most 24
+  hours after their request, and only in the Agent's Environment.
+
+## Choose the delegation for each tool
+
+| The tool | `delegation` |
+| --- | --- |
+| Answers each person with their own data, or uses their credentials | `"required"` |
+| Works for anyone, for the person when the turn serves one | `"auto"` (the default) |
+| Uses only the Agent's own resources, the same for everyone | `"none"` |
+
+With `"required"`, a turn that serves nobody raises a `PermissionError` before anything is sent.
+With `"auto"`, the same tool reaches different things for different people, and the Agent's own
+grants when nobody is served: make sure both are what you intend. Local turns serve nobody, so a
+`"required"` tool refuses in local mode; test it with fakes (see [Testing](#testing)).
+
+## Example: a tool that uses a person's own Secret
+
+A person stores an API key for an outside data provider, and the Agent uses it for them without
+ever seeing it:
+
+1. The person creates the Secret themselves. The Agent never asks for the value or accepts it.
+2. The tool that calls the provider reads the Secret as the person, inside that same call.
+3. The tool uses the value and returns only the result.
+
+```python
+"""Quotes from an outside provider, with each person's own API key."""
+
+import json
+
+import httpx
+from tau_agent.messages import TextContent
+from tau_agent.tools import AgentTool, AgentToolResult
+
+from ms_tau_sdk import current_requester, platform_client
+
+PROVIDER_URL = "https://quotes.example.test/v1/latest"
+
+
+def _text(message):
+    return AgentToolResult(content=[TextContent(text=message)])
+
+
+def _secret_name():
+    # The name comes from the person the platform named, never from the model.
+    person = current_requester()
+    return None if person is None else f"QUOTES_API_KEY__{person.uid}"
+
+
+async def _secret_uid(client, name):
+    # Listing returns names and UIDs, never values. Names are unique in the Agent's Environment.
+    answer = await client.request("GET", "/api/v1/secrets/", params={"name": name})
+    if answer.status_code != 200:
+        return None
+    found = answer.json()["results"]
+    return found[0]["uid"] if found else None
+
+
+async def connect_quotes(tool_call_id, arguments, signal=None, on_update=None):
+    name = _secret_name()
+    if name is None:
+        return _text("I can set up your key only while answering your own request.")
+    try:
+        uid = await _secret_uid(platform_client(delegation="required"), name)
+    except PermissionError:
+        return _text("Your access for this request ended. Please ask again.")
+    if uid is not None:
+        return _text(f"Your key is stored as the Secret {name}.")
+    return _text(
+        f"Create a Secret named {name} with your API key, in the Environment this Agent runs in: "
+        f"on the Secrets page in Command Center, or with `mainsequence secrets create {name}`, "
+        "which asks for the value without showing it. Never paste the key into this chat."
+    )
+
+
+async def latest_quote(tool_call_id, arguments, signal=None, on_update=None):
+    name = _secret_name()
+    if name is None:
+        return _text("I can use your key only while answering your own request.")
+    client = platform_client(delegation="required")
+    try:
+        uid = await _secret_uid(client, name)
+        if uid is None:
+            return _text(f"First create the Secret {name}. Ask me how.")
+        secret = await client.request("GET", f"/api/v1/secrets/{uid}/")
+    except PermissionError:
+        return _text("Your access for this request ended. Please ask again.")
+    if secret.status_code != 200:
+        return _text("I could not read your key.")
+    try:
+        async with httpx.AsyncClient(timeout=10.0) as http:
+            quote = await http.get(
+                PROVIDER_URL,
+                params={"symbol": arguments["symbol"]},
+                headers={"Authorization": f"Bearer {secret.json()['value']}"},
+            )
+    except httpx.HTTPError:
+        # The error can carry the request with its headers: never show it.
+        return _text("The quotes provider did not answer.")
+    if quote.status_code != 200:
+        return _text(f"The quotes provider answered {quote.status_code}.")
+    data = quote.json()
+    return _text(json.dumps({"symbol": data["symbol"], "price": data["price"]}))
+
+
+def setup(tau):
+    tau.register_tool(
+        AgentTool(
+            name="connect_quotes",
+            label="Connect Quotes",
+            description="Check or explain how to store your quotes API key as your own Secret.",
+            parameters={"type": "object", "properties": {}, "additionalProperties": False},
+            execute_fn=connect_quotes,
+        )
+    )
+    tau.register_tool(
+        AgentTool(
+            name="latest_quote",
+            label="Latest Quote",
+            description="Get the latest quote for a symbol with your own quotes API key.",
+            parameters={
+                "type": "object",
+                "properties": {"symbol": {"type": "string"}},
+                "required": ["symbol"],
+                "additionalProperties": False,
+            },
+            execute_fn=latest_quote,
+        )
+    )
+```
+
+What makes it safe:
+
+- No tool takes a Secret value or a Secret name from the model. The name is built from
+  `current_requester().uid`, so prompt injection cannot point the tool at another Secret.
+- `delegation="required"` reads the Secret as the person. The platform returns it only if the
+  person can view it; the name is a lookup key, not the protection.
+- The value exists only inside one call. It never goes into the result, `details`, a log, an
+  exception message, a file or a cache for the next turn. It travels in a header, never in a URL,
+  because URLs reach logs. Errors from the outside call are caught, and the provider's raw body is
+  never returned.
+- There is no tool that returns a Secret value, and no tool that calls any platform path the model
+  chooses. With the delegation, such a tool would let the model read every Secret the person can.
+- The Agent's own workload holds no grant on these Secrets, so a call without the person reaches
+  none of them.
+
+## Sharing decides what a delegated call can reach
+
+A delegated read returns anything the person can view in the Agent's Environment: what they
+created and what others shared with them, directly or through a team. This holds for Secrets and
+every other object. The platform enforces sharing; which of those objects a tool uses is part of
+the tool's design. For Secrets, the naming convention states that design:
+
+- **A personal credential:** a name tied to the person, such as `QUOTES_API_KEY__<person uid>`.
+  The person decides whether to share it.
+- **A team credential:** a name the team agrees on, shared with the team for view. The tool reads
+  it for any member.
+- **Someone else's Secret shared with the person:** valid whenever the tool is meant to use it.
+
+Whoever can edit a Secret decides its value, so the tool uses whatever value they set. Granting or
+accepting edit on a Secret means trusting that person with what the tool does with it. That is a
+decision people make through sharing, not one the platform makes for them.
+
+How sharing works:
+
+- The creator of a Secret can always view and edit it, and cannot be removed from it. People who
+  can edit a Secret can share it, for view or for edit, with people and teams.
+- Most people can share only within the teams they belong to; Organization admins can share
+  across their Organization.
+- `GET /api/v1/secrets/<uid>/can-view/` and `can-edit/` list the people and teams with access. A
+  tool can use them when its design needs to, for example to refuse a team key where it expects a
+  personal one. That is a choice of the tool, not a platform rule.
+
+## What never reaches the model
+
+Tool results, their `details`, and errors can reach the model provider and the session history.
+Never return a Secret value, a token, a proof, an assertion, a response object, its headers or a
+raw error body. Return business results: rows, numbers, names, and plain messages. The SDK already
+keeps its own credentials out of that path and never lets a tool set `Authorization` or an
+`X-MainSequence-*` header.
+
+## Limits
+
+- This works in the Agent's own project tools. An application that receives a delegated call
+  learns the person with `User.get_requester()`, but it cannot call the platform as that person.
+- The delegation ends with the turn. A task the tool leaves running acts as the Agent afterwards,
+  and nothing read for one person may be kept for another turn or another person.
+- When the person's access ends (the turn is over, the access was removed, 24 hours passed, or
+  the Agent is not enabled), calls raise a `PermissionError` whose `code` is
+  `requester_binding_invalid` or starts with `runtime_lease_`. Say in plain words that the request
+  cannot be served, and never retry it as the Agent.
+- Every other answer, such as `403` or `404` for an object the person cannot see, is returned as
+  it is: check the status before using the body.
+
+## Testing
+
+Patch the extension module's `current_requester` and `platform_client` with fakes, and test:
+
+- with a person and the Secret: the result holds only business fields, and the value appears in no
+  result text, `details`, log record or exception;
+- with a person and no Secret: the tool explains how to create it and sends no provider call;
+- with nobody: the tool refuses and sends nothing;
+- a `PermissionError` from the client: a plain message, and no second call;
+- a failing or erroring provider: a plain message without the provider's body or the request.
+
+## Review checklist
+
+- Each tool has a deliberate `delegation`: `"required"` for a person's own data or credentials.
+- No person's UID, Secret name or Secret value comes from tool arguments, the prompt or history.
+- No tool returns a credential or calls a platform path the model chooses.
+- Secret values stay inside one call, in headers, never in results, logs, errors, URLs or caches.
+- The naming convention says whose Secrets the tool uses, and the people sharing them know it.
+- A refused delegated call is reported, never retried as the Agent.
+- The Agent's workload holds no grants it does not need, and none on people's Secrets.

mainsequence_metatable-0.1.24.dev40/.mainsequence/workflows/metatables-api.yaml

@@ -0,0 +1,85 @@
+api_version: "2.3.0"
+name: metatables-api
+resources:
+  - key: metatables
+    kind: fastapi
+    spec:
+      source_path: api/metatables/main.py
+      automatic_deployment: true
+      automatic_redeployment:
+        enabled: true
+        tag_regex: null
+      min_scale: 1
+      revision_retention_count: 3
+      # The Analyst's read tools, served at /mcp (ADR 0021).
+      mcp_enabled: true
+    access:
+      secrets:
+        - name: METATABLES_RUNTIME_DATABASE
+          level: view
+
+  - key: metatables-analyst-agent
+    kind: harness_agent
+    spec:
+      source_path: api/tau/main.py
+      llm_provider: openai
+      llm_model: gpt-5.6-luna
+      llm_thinking: medium
+      automatic_deployment: true
+      automatic_redeployment:
+        enabled: true
+        tag_regex: null
+      revision_retention_count: 3
+      cpu_request: "1"
+      memory_request: 2Gi
+      # Hosted tools come from the API's MCP endpoint (ADR 0021).
+      mcp_applications:
+        - resource: metatables
+      env_vars:
+        - name: TAU_EXCLUDE_BASE_TOOLS
+          value: "true"
+        - name: TAU_EXCLUDE_MAINSEQUENCE_MCP
+          value: "true"
+    # The Analyst reads only as the person it serves (ADR 0020); it holds no grants.
+    acts_for_requester: true
+    access:
+      branch: view
+
+  - key: migrate-system
+    kind: job
+    spec:
+      name: MetaTables system migrations
+      execution_path: jobs/migrate_system.py
+      cpu_request: "1"
+      memory_request: "1"
+      max_runtime_seconds: 1800
+      automatic_redeployment:
+        enabled: true
+        tag_regex: null
+    access:
+      secrets:
+        - name: METATABLES_RUNTIME_DATABASE
+          level: view
+
+execution:
+  steps:
+    image:
+      prepare_image: metatables
+
+    agent_image:
+      prepare_image: metatables-analyst-agent
+
+    migrate:
+      run_job: migrate-system
+      image_from: image
+      needs: [image]
+
+    deploy_api:
+      deploy: metatables
+      image_from: image
+      needs: [migrate]
+
+    deploy_agent:
+      deploy: metatables-analyst-agent
+      image_from: agent_image
+      needs: [agent_image, deploy_api]

{mainsequence_metatable-0.1.23.dev38 → mainsequence_metatable-0.1.24.dev40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.23.dev38
+Version: 0.1.24.dev40
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -14,7 +14,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: mainsequence<10,>=9.0.14
+Requires-Dist: mainsequence[mcp]<10,>=9.0.19
 Requires-Dist: alembic<2,>=1.18
 Requires-Dist: cachetools
 Requires-Dist: cryptography<51,>=46
@@ -51,7 +51,7 @@ Requires-Dist: twine<7,>=6; extra == "dev"
 Provides-Extra: docs
 Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
 Provides-Extra: agent
-Requires-Dist: ms-tau-sdk==1.3.0; extra == "agent"
+Requires-Dist: ms-tau-sdk==2.0.7; extra == "agent"
 Provides-Extra: mysql
 Requires-Dist: PyMySQL[rsa]<1.2,>=1.1.1; extra == "mysql"
 Provides-Extra: mssql