mainsequence-metatable 0.1.26.dev43__tar.gz → 0.1.27__tar.gz

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/.agents/skills/client/metatables-migrations/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: metatables-migrations
-description: "Create and evolve managed application tables through Alembic migration providers with the installed MetaTables Python client. Covers provider scope and placement, scaffolding, revision authoring, local execution, the deployment-workflow migration Job for hosted runtimes, and reservation or finalization failures. Excludes API catalog migrations, client-library implementation, API/server changes and repository tooling."
+description: "Create and evolve managed application tables through Alembic migration providers with the installed MetaTables Python client. Covers provider scope and placement, scaffolding, revision authoring, local execution, the deployment-workflow migration Job for hosted runtimes, the Team that owns an application's tables in each Environment, and reservation or finalization failures. Excludes API catalog migrations, client-library implementation, API/server changes and repository tooling."
 ---
 
 # MetaTables client application migrations
@@ -50,11 +50,21 @@ migrations. Read `docs/client/deploy-application-migrations.md`.
 1. **Develop locally.** Author the revision and apply it to verified local SQLite
    with the [local development skill](../metatables-local-development/SKILL.md).
 2. **Commit the revision with the code that needs it.**
-3. **Deploy.** The application's `.mainsequence/workflows/` file declares a
+3. **Give a Team the tables.** Before the first hosted migration in each
+   Environment, the application's tables need an owning Team: one platform Team
+   per Environment (for example `ledger-development`), whose members are the
+   migration Job's workload User and the workload User of every resource that
+   reads or writes the tables. An Organization admin creates the application's
+   namespace in that Environment and grants the Team Writer on it. Tell the user
+   these steps; they are made in the platform and in MetaTables Security, not in
+   the repository.
+4. **Deploy.** The application's `.mainsequence/workflows/` file declares a
    migration Job that calls `upgrade_application` for each provider, in
-   dependency order, from the candidate image. Every deployed resource that reads
-   or writes the tables (FastAPI, `harness_agent` and others) has a deploy step
-   with `needs: [migrate]`. A failed migration blocks the rollout.
+   dependency order, from the candidate image. The Job and every resource that
+   uses MetaTables declare `access.branches: [{repository: MetaTables, level: view}]`.
+   Every deployed resource that reads or writes the tables (FastAPI,
+   `harness_agent` and others) has a deploy step with `needs: [migrate]`. A failed
+   migration blocks the rollout.
 
 Rules:
 
@@ -69,6 +79,12 @@ Rules:
   during and after a failed rollout. Add first; drop or rename in a later release.
 - Redeploying an older image does not roll back the schema. Downgrade is never a
   deployment step.
+- Tables belong to the Team, never to one workload User. Workload Users change
+  with each Environment and each recreated Job; a new one needs Team membership
+  only. Do not ask for direct table grants to a workload User, and do not run the
+  Job as an Organization admin to get around a refusal.
+- Every table a provider registers goes in the Team's namespace. A table
+  registered in a namespace the caller already writes gets no grant of its own.
 
 ## Source and runtime context
 
@@ -205,8 +221,15 @@ Read `docs/operations/recovery-and-observability.md`.
   another install overwrote it. Move the provider as the
   [legacy upgrade skill](../metatables-upgrade-legacy-app/SKILL.md) describes;
   do not edit files in `site-packages`.
-- If reservation fails, compare provider scope and physical identities before
-  changing code. Do not create a second catalog row for the same table.
+- If reservation fails with `namespace_not_writable` or `table_not_editable`
+  (403), the caller lacks Writer through the owning Team. Add the
+  `caller_user_uid` from the error to the Team with Writer on the namespace, or,
+  when the namespace or Team is missing, set them up as in step 3. A table
+  registered before the Team existed may have only a retired workload User as
+  Writer; an Organization admin grants the Team Writer on its namespace. Do not
+  change code or physical names to get around it.
+- If reservation fails otherwise, compare provider scope and physical identities
+  before changing code. Do not create a second catalog row for the same table.
 - If Alembic succeeds but finalization fails, physical DDL may already be
   committed. Inspect every per-table result and the actual schema before
   retrying.
@@ -220,5 +243,6 @@ Read `docs/operations/recovery-and-observability.md`.
 
 Verify provider scope and placement, revision content, the selected environment
 connection, repeat execution, and final active bindings. Check that the deployment
-workflow runs the migration Job before every resource that uses the tables. Report
+workflow runs the migration Job before every resource that uses the tables, and
+that each Environment has its owning Team with the Job's workload User. Report
 separately what was checked offline and what was exercised against a configured API.

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/.agents/skills/ms_tau_sdk/PINNED_FROM.txt

@@ -1,7 +1,7 @@
 schema=1
 library_name=ms-tau-sdk
 namespace=ms_tau_sdk
-pinned_version=2.0.8.dev44
+pinned_version=2.0.8
 skills_path=src/ms_tau_sdk/agent_skills
 skills=tau_a2a_runtime_adapter,tau_local_development,tau_project_customization,tau_repository_integration,tau_security_and_access
 command=ms-tau skills sync --path .

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/.mainsequence/workflows/metatables-api.yaml

@@ -17,12 +17,16 @@ resources:
       secrets:
         - name: METATABLES_RUNTIME_DATABASE
           level: view
+      # /runtime-context/ tells applications this branch's Analyst (ADR 0019).
+      resources:
+        - key: metatables-analyst-agent
+          level: view
 
   - key: metatables-analyst-agent
     kind: harness_agent
     spec:
       source_path: api/tau/main.py
-      llm_provider: openai
+      llm_provider: openai-codex
       llm_model: gpt-5.6-luna
       llm_thinking: medium
       automatic_deployment: true

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.26.dev43
+Version: 0.1.27
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -51,7 +51,7 @@ Requires-Dist: twine<7,>=6; extra == "dev"
 Provides-Extra: docs
 Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
 Provides-Extra: agent
-Requires-Dist: ms-tau-sdk==2.0.8.dev44; extra == "agent"
+Requires-Dist: ms-tau-sdk==2.0.8; extra == "agent"
 Provides-Extra: mysql
 Requires-Dist: PyMySQL[rsa]<1.2,>=1.1.1; extra == "mysql"
 Provides-Extra: mssql

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/docs/adr/agent/0019-metatables-analyst-agent.md

@@ -1,5 +1,14 @@
 # ADR 0019: MetaTables Analyst agent
 
+> Amendment (2026-10-08): The API names this branch's Analyst to applications.
+> `GET /runtime-context/` returns `hosted_agent` (`uid`, `name`, `status`) beside
+> `hosted_environment`: the Agent the API's own branch deploys, which the API finds with its
+> workload credentials and caches for an hour like the Environment; a failed lookup is
+> `unavailable` and is not cached. The API's `access` names the Analyst by its key so it can
+> see it. An application's assistant, such as the MetaTables Admin rail, takes the Agent and
+> the Environment from there instead of build values. A re-created Analyst reaches it at the
+> API's next deployment, which the same push starts. Local mode reports neither.
+>
 > Amendment (2026-10-08): [ADR 0020](0020-analyst-reads-as-its-requester.md) replaces
 > the agent's own Reader grants: each tool call is answered as the person the turn
 > serves, so nobody reads more through the agent than they can read directly.
@@ -30,7 +39,7 @@ Status: Accepted.
 Implementation status: implemented on `development`; not yet deployed. Tests cover the
 tools against a stand-in catalog, `deep_search`, `describe_table` and `list_namespaces`
 through the client against the API, and the extension, card, workflow and vendored skills with
-ms-tau-sdk 2.0.8.dev44. A local `ms-tau` session and the hosted deployment have not run.
+ms-tau-sdk 2.0.8. A local `ms-tau` session and the hosted deployment have not run.
 
 Owner: this repository deploys the agent. The MetaTables API is unchanged; the agent
 is one more API client.
@@ -61,7 +70,7 @@ refuses anything else.
 
 | Part | Rule |
 | --- | --- |
-| Runtime | `ms-tau-sdk` 2.0.8.dev44, `openai` / `gpt-5.6-luna`, thinking `medium`. |
+| Runtime | `ms-tau-sdk` 2.0.8, `openai-codex` / `gpt-5.6-luna`, thinking `medium`. |
 | Identity | The person each turn serves (ADR 0020); the agent's own identity holds no grants. |
 | Tools | The six tools below, served by the API over MCP when hosted (ADR 0021), and the SDK's skill-scoped `read`. No shell, file writes or Main Sequence MCP. |
 | Instructions | `.tau/SYSTEM.md` covers MetaTables; vendored `pg-aiguide` skills cover PostgreSQL and TimescaleDB. |
@@ -120,7 +129,7 @@ The agent card's two skills, `discover-tables` and `analyze-with-sql` in
 The skills of [timescale/pg-aiguide](https://github.com/timescale/pg-aiguide)
 (Apache-2.0) are vendored at commit `b236d35` with its license and notice, one
 directory per skill under `.tau/skills/`, because Tau discovers skills one level deep.
-The agent opens them through the skill-scoped `read`, which ms-tau-sdk 2.0.8.dev44 registers
+The agent opens them through the skill-scoped `read`, which ms-tau-sdk 2.0.8 registers
 when `TAU_EXCLUDE_BASE_TOOLS=true`. The directive takes precedence over them:
 
 - Discover tables through the MetaTables tools, not `pg_catalog`, which also lists

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/docs/adr/agent/0020-analyst-reads-as-its-requester.md

@@ -3,7 +3,7 @@
 Status: Accepted.
 
 Implementation status: implemented on `development`; not deployed. It builds on platform
-ADR-0051 (requester-bound access, implemented 2026-10-06), ms-tau-sdk 2.0.8.dev44 for the
+ADR-0051 (requester-bound access, implemented 2026-10-06), ms-tau-sdk 2.0.8 for the
 Analyst and mainsequence 9.0.19, whose `User.get_requester()` the API reads. Tests cover
 admission through real signed assertions; a hosted turn has not run.
 

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/docs/adr/api/0002-application-administration-and-table-ownership.md

@@ -344,6 +344,42 @@ their own workload Users, which need to be granted like people.
   `reads_as_caller()`, the User `search` filter, `managed_by_caller`,
   `workload_name` and Team members that may be workload Users.
 
+### Amendment: Teams own application tables (2026-10-09)
+
+Since platform ADR-0048 every Job, release and Agent runs as its own workload
+User. Each Environment, and each recreated Job, has a new one. A table's creator
+grant tied the table to the workload User that first registered it, so the next
+identity of the same application could not re-register its own tables
+([#43](https://github.com/mainsequence-projects/MetaTables/issues/43)).
+
+- **A Team owns an application's tables.** Before an application's first
+  migration in an Environment, an Organization admin creates its namespace and
+  grants Writer on it to a platform Team. The application's migration Job and
+  every workload User that reads or writes its tables are members of that Team.
+  Use one Team per Environment, so that one Environment's workloads are not
+  Writers in another. A new workload User needs Team membership only; the tables
+  keep their owner.
+- **No creator grant under a namespace Writer.** Registering a new table into a
+  namespace where the caller is already a Writer, directly or through a Team, adds
+  no creator grant: the namespace's Writers control the table. Otherwise the
+  creator still receives Writer, including an admin registering into a namespace
+  where they have no grant, so no table starts without a Writer.
+- **Creator attribution is a column.** `meta_table.created_by_user_uid` records
+  who registered each table and grants nothing. System migration
+  `0012_table_creator` adds it and fills it from each table's first self-granted
+  Writer in the grant history.
+- **Refusals say how to recover.** Registration refusals are 403s with a `code`:
+  `table_not_editable` for an existing table the caller cannot edit,
+  `namespace_not_writable` for a namespace that is missing or that the caller
+  cannot write. Both name the caller's User UID and the recovery: add it to the
+  Team with Writer on the namespace, or ask an Organization admin. The table's
+  namespace is named when the caller requested it or can read the table; its
+  Writers are listed only when the caller can read the table.
+
+Tables whose only Writer is a replaced identity are recovered the same way: an
+admin grants the application's Team Writer on their namespace. There is no admin
+bypass and no automatic adoption.
+
 ## Superseded behavior and preserved boundaries
 
 This decision supersedes ADR 0001's pending-runtime configurator/existing-source
@@ -397,6 +433,9 @@ schema baseline/recreation policy remains governed by ADR 0001.
   resources through counts, search, lineage, or error details.
 - A Writer can grant/revoke Reader and Writer access only on tables they control.
   Re-registering an existing table never grants the caller ownership.
+- A new member of the Team with Writer on an application's namespace registers and
+  migrates that application's existing tables; a caller outside it is refused with
+  a recovery path that reveals nothing it cannot read.
 - Team changes and namespace revocation/moves change effective access under the
   documented freshness rules; independent grants remain visible and effective.
 - Non-admins cannot manage DataSources, runtime selection, system migrations,

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/docs/adr/api/0007-database-enforced-table-access.md

@@ -299,8 +299,12 @@ and [MySQL implicit commits](https://dev.mysql.com/doc/refman/8.4/en/implicit-co
 - Physical table names become visible to explorer users.
 - Cascading foreign keys are allowed. Tables that reference a table never change
   who may write it.
-- Team membership reaches the database at the pace of the existing one-hour
-  platform-fact cache.
+- Team membership reaches the database on the caller's next query. Each SQL
+  admission compares the caller's current Teams with the ones its role was last
+  given and reconciles the roles first when they differ. A hosted caller's Teams
+  come from its signed assertion on every request
+  ([ADR 0017](0017-hosted-request-identity.md), 2026-10-05 amendment); only the
+  developer's own facts in Local and developer mode are cached for up to an hour.
 
 ## Implementation
 

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/docs/api/openapi.json

@@ -763,6 +763,49 @@
         "title": "HTTPValidationError",
         "type": "object"
       },
+      "HostedAgent": {
+        "description": "The Harness Agent this API's branch deploys, as the API's workload sees it.",
+        "properties": {
+          "name": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Name"
+          },
+          "status": {
+            "enum": [
+              "verified",
+              "not_found",
+              "unavailable",
+              "not_configured"
+            ],
+            "title": "Status",
+            "type": "string"
+          },
+          "uid": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "title": "Uid"
+          }
+        },
+        "required": [
+          "uid",
+          "status"
+        ],
+        "title": "HostedAgent",
+        "type": "object"
+      },
       "HostedEnvironment": {
         "properties": {
           "is_production": {
@@ -3152,6 +3195,16 @@
             ],
             "title": "Git Source"
           },
+          "hosted_agent": {
+            "anyOf": [
+              {
+                "$ref": "#/components/schemas/HostedAgent"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
           "hosted_environment": {
             "anyOf": [
               {

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/docs/client/deploy-application-migrations.md

@@ -15,10 +15,13 @@ before anything that uses the tables rolls out. See
    [Local storage](local-storage.md).
 2. **Commit the revision with the code that needs it.** Applied revisions are
    immutable; every later schema change is a new revision.
-3. **Deploy.** The application's workflow runs its migration Job from the
+3. **Give a Team the tables.** Before the first hosted migration in each
+   Environment, set up the Team that owns the application's tables
+   ([below](#give-the-job-access-through-a-team)).
+4. **Deploy.** The application's workflow runs its migration Job from the
    candidate image, then deploys the resources that read or write the tables.
 
-Hosted runtimes are migrated only by step 3. Do not run `metatables migrations
+Hosted runtimes are migrated only by step 4. Do not run `metatables migrations
 upgrade` or `downgrade` against a hosted API from a developer machine or agent
 session. Do not migrate at application startup either: several pods would race,
 and a failure would not stop the rollout.
@@ -78,6 +81,56 @@ Give every other deployed resource that reads or writes the tables, such as a
 `harness_agent`, its own deploy step with `needs: [migrate]`. Validate the file
 against the branch's workflow template before committing it.
 
+## Give the Job access through a Team
+
+The Job runs as its own workload User, and each Environment, and each recreated
+Job, has a new one. A table owned by one workload User is lost to the next, so the
+application's tables belong to a platform Team instead:
+
+1. **Create one Team per Environment** for the application, for example
+   `ledger-development` and `ledger-production`. A shared Team would make one
+   Environment's workloads Writers in another.
+2. **Add the workload Users.** Add the migration Job's workload User, and the
+   workload User of every resource that reads or writes the tables (FastAPI
+   release, Agent, other Jobs). Each resource's `workload_user_uid` names it.
+3. **Grant the Team the namespace.** An Organization admin creates the
+   application's namespace in that Environment's MetaTables, under
+   **Security**, or with `POST /security/namespaces/`, and grants the Team Writer
+   on it (`PUT /namespaces/{uid}/permissions`). Every table registered in the
+   namespace inherits the grant.
+
+The Job also needs platform `view` on the Environment's `metatables` release and
+its branch to discover the API; declare it on the Job:
+
+```yaml
+  - key: migrate-ledger
+    kind: job
+    spec:
+      name: Ledger migrations
+      execution_path: jobs/migrate_ledger.py
+    access:
+      branches:
+        - repository: MetaTables
+          level: view
+```
+
+Team membership takes effect on the workload's next request, in the catalog and in
+the database. When a workload User changes, add the new one to the Team; nothing
+in MetaTables changes. A table registered in a namespace the caller already
+writes gets no grant of its own, so the Team stays its only owner.
+
+### When registration is refused
+
+- **`namespace_not_writable`**: the namespace does not exist in this Environment,
+  or the caller is not its Writer. Do steps 1 to 3 for the `caller_user_uid` the
+  error names.
+- **`table_not_editable`**: the table is already registered and the caller is not
+  its Writer. Add the `caller_user_uid` to the Team with Writer on the table's
+  namespace. When the table was registered before the Team existed, its only
+  Writer may be a workload User that no longer runs: an Organization admin
+  grants the Team Writer on the namespace, and the table inherits it. The error
+  lists the table's Writers when the caller can read the table.
+
 ## What the Job guarantees
 
 - It runs on every deployment. A database already at head is left unchanged and
@@ -89,7 +142,8 @@ against the branch's workflow template before committing it.
 - The Job finds the Environment's MetaTables API the same way any client does
   ([installation and connection](installation-and-connection.md)). That API must
   be deployed with its system migrations applied; otherwise the Job fails. Its
-  SDK user needs the same API access a developer needs to run the provider.
+  workload User needs Writer on the application's namespace through the Team
+  above.
 
 ## Keep each release compatible with the previous one
 

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/docs/security/ownership-and-sharing.md

@@ -2,15 +2,23 @@
 
 ## Ownership is Writer access
 
-The creator receives Writer access when a new table is registered. A Writer can
-grant Reader or Writer access to other platform Users and Teams, change a direct
-grant, or revoke it. Readers cannot change grants.
+The creator receives Writer access when a new table is registered, unless the
+table's namespace already makes the creator a Writer, directly or through a Team.
+Then the namespace's Writers control the table and no creator grant is added. A
+Writer can grant Reader or Writer access to other platform Users and Teams, change
+a direct grant, or revoke it. Readers cannot change grants.
 
 Several principals can be Writers. The original creator has no permanent
-permission separate from grants: creator attribution records who created the
+permission separate from grants: `created_by_user_uid` records who created the
 table, while effective access determines who controls it now. Organization admins
 can restore access when no Writer remains.
 
+Deployed Jobs, releases and Agents run as their own workload Users, which change
+with each Environment and each recreated Job. Give an application's tables to a
+Team instead: grant the Team Writer on the application's namespace and make the
+workload Users members. See
+[Migrate in the deployment workflow](../client/deploy-application-migrations.md#give-the-job-access-through-a-team).
+
 ## One central table-access model
 
 `MetaTableGrant` is the foundation of the central access model. Each direct grant

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/docs/security/permissions.md

@@ -22,7 +22,8 @@ Organization admin status comes from the platform through the SDK.
 
 Creation checks the selected DataSource's storage access mode and the table's
 lifecycle requirements. The table and its creator's Writer grant are recorded
-together. Re-registering an existing table cannot give another caller ownership.
+together, unless the namespace already makes the creator a Writer. Re-registering
+an existing table cannot give another caller ownership.
 
 Initial runtime setup must check the platform admin fact before the application
 grant tables exist. Configuring a pending database does not make the first caller

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.26.dev43"
+version = "0.1.27"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"
@@ -59,7 +59,7 @@ Documentation = "https://potential-doodle-wn39mnm.pages.github.io/"
 [project.optional-dependencies]
 dev = ["pytest>=8,<10", "ruff>=0.14", "build>=1,<2", "packaging>=24.2", "twine>=6,<7"]
 docs = ["mkdocs>=1.6,<2"]
-agent = ["ms-tau-sdk==2.0.8.dev44"]
+agent = ["ms-tau-sdk==2.0.8"]
 mysql = ["PyMySQL[rsa]>=1.1.1,<1.2"]
 # Keep the published extra name for existing installers; pyodbc is required.
 mssql = []

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/scripts/check_boundaries.py

@@ -15,7 +15,7 @@ RETIRED_TERMS = (
 )
 SDK_MODULES = frozenset({
     'mainsequence.scaffold_skills',
-    'mainsequence.client', 'mainsequence.client.base', 'mainsequence.client.exceptions',
+    'mainsequence.client', 'mainsequence.client.agent_runtime_models', 'mainsequence.client.base', 'mainsequence.client.exceptions',
     'mainsequence.client.models_helpers',
     'mainsequence.client.models_user', 'mainsequence.client.utils', 'mainsequence.client.value_sets',
     'mainsequence.cli.config', 'mainsequence.code_repository_context',

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/src/mainsequence_metatable.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.26.dev43
+Version: 0.1.27
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -51,7 +51,7 @@ Requires-Dist: twine<7,>=6; extra == "dev"
 Provides-Extra: docs
 Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
 Provides-Extra: agent
-Requires-Dist: ms-tau-sdk==2.0.8.dev44; extra == "agent"
+Requires-Dist: ms-tau-sdk==2.0.8; extra == "agent"
 Provides-Extra: mysql
 Requires-Dist: PyMySQL[rsa]<1.2,>=1.1.1; extra == "mysql"
 Provides-Extra: mssql

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/src/mainsequence_metatable.egg-info/SOURCES.txt

@@ -320,6 +320,7 @@ src/metatables/api/backend/migrations/versions/0008_upload_receipts.py
 src/metatables/api/backend/migrations/versions/0009_timescale_policies.py
 src/metatables/api/backend/migrations/versions/0010_cascade_targets.py
 src/metatables/api/backend/migrations/versions/0011_table_search.py
+src/metatables/api/backend/migrations/versions/0012_table_creator.py
 src/metatables/api/backend/migrations/versions/__init__.py
 src/metatables/api/backend/operations/__init__.py
 src/metatables/api/backend/operations/bootstrap_migrations.py
@@ -443,6 +444,7 @@ tests/analyst/test_tools.py
 tests/auth/test_bootstrap_failure_cause.py
 tests/auth/test_data_source_identity.py
 tests/auth/test_development_client.py
+tests/auth/test_hosted_agent.py
 tests/auth/test_hosted_environment_target.py
 tests/auth/test_local_mode.py
 tests/auth/test_platform_fact_cache.py

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/src/mainsequence_metatable.egg-info/requires.txt

@@ -28,7 +28,7 @@ urllib3>=2.7.0
 uvicorn==0.52.4
 
 [agent]
-ms-tau-sdk==2.0.8.dev44
+ms-tau-sdk==2.0.8
 
 [dev]
 pytest<10,>=8

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/src/metatables/api/app/routes/runtime_context.py

@@ -12,7 +12,7 @@ from metatables.api.app.runtime import data_source_provider
 from metatables.api.app.runtime_control import runtime_instance_id
 from metatables.api.backend.integrations.local_workspace import source_descriptor
 from metatables.api.backend.integrations.runtime_data_sources import DataSourceIntegrationError
-from metatables.runtime_contract import HostedEnvironment, RuntimeContext
+from metatables.runtime_contract import HostedAgent, HostedEnvironment, RuntimeContext
 
 logger = logging.getLogger(__name__)
 
@@ -49,6 +49,32 @@ def cached_environment(cache: PlatformCache[UUID, HostedEnvironment], uid: UUID
     return cache.get(uid, lambda: verified_environment(uid))
 
 
+def branch_agent() -> HostedAgent:
+    """The Harness Agent this API's branch deploys (ADR 0019); a branch deploys at most one.
+
+    A failed lookup raises, so the cache keeps no failure.
+    """
+    from mainsequence.client.agent_runtime_models import Agent
+    from mainsequence.code_repository_context import get_code_repository_context
+
+    branch_uid = get_code_repository_context().code_repository_branch_uid
+    agents = [agent for agent in Agent.filter(timeout=(2, 5))
+              if branch_uid and agent.code_repository_branch_uid == branch_uid]
+    if len(agents) != 1:
+        return HostedAgent(uid=None, status="not_found")
+    return HostedAgent(uid=agents[0].uid, status="verified", name=agents[0].name)
+
+
+def cached_agent(cache: PlatformCache[UUID, HostedAgent], environment_uid: UUID | None) -> HostedAgent:
+    if environment_uid is None:
+        return HostedAgent(uid=None, status="not_configured")
+    try:
+        return cache.get(environment_uid, branch_agent)
+    except Exception:
+        logger.exception("Hosted agent lookup failed")
+        return HostedAgent(uid=None, status="unavailable")
+
+
 @router.get("/runtime-context/", response_model=RuntimeContext, response_model_exclude_unset=True)
 def runtime_context(
     request: Request, response: Response,
@@ -73,6 +99,8 @@ def runtime_context(
         "runtime_instance_id": runtime_instance_id(state) if control else None,
         "api_endpoint": f"http://{state.config.expected_host}" if state.config.local_mode else str(request.base_url).rstrip("/"),
         "hosted_environment": environment,
+        # The Analyst an application's assistant talks to, in the same Environment (ADR 0019).
+        "hosted_agent": None if state.config.local_mode else cached_agent(state.agent_cache, caller.environment_uid),
         "git_source": source_descriptor(workspace.source) if workspace else None,
         "data_source_selection": selection,
         "bootstrap": state.bootstrap.descriptor(caller.user_uid, is_admin=caller.is_admin) if state.bootstrap else None,

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/src/metatables/api/app/routes/table_registration.py

@@ -25,7 +25,7 @@ from metatables.api.backend.backends.operations import (
 from metatables.api.backend.backends.timescale import TimescaleError, convert_time_index_table
 from metatables.api.backend.contracts.storage_layouts import StorageLayoutValidationError
 from metatables.api.backend.contracts.table_contracts import ContractValidationError
-from metatables.api.backend.domain.catalog_rules import CatalogInvariantError
+from metatables.api.backend.domain.catalog_rules import CatalogAccessError, CatalogInvariantError
 from metatables.api.backend.domain.data_source_rules import DataSourceAdmissionError
 from metatables.api.backend.domain.permission_rules import TrustedActorFacts
 from metatables.api.backend.integrations.runtime_data_sources import DataSourceIntegrationError
@@ -164,6 +164,8 @@ def _failure(session, exc, *, item=None):
     cause = exc
     if isinstance(exc, HTTPException):
         status, detail, cause = exc.status_code, exc.detail, exc.__cause__
+    elif isinstance(exc, CatalogAccessError):
+        status, detail = 403, exc.detail
     elif isinstance(exc, DataSourceAdmissionError):
         # Contract rejections name the offending column or index, as contract validation does.
         status = exc.status_code

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/src/metatables/api/app/runtime.py

@@ -37,7 +37,7 @@ from metatables.api.backend.integrations.runtime_binding import (
     RuntimeBindingError,
     RuntimeStorageBinding,
 )
-from metatables.runtime_contract import HostedEnvironment
+from metatables.runtime_contract import HostedAgent, HostedEnvironment
 
 logger = logging.getLogger(__name__)
 
@@ -221,6 +221,8 @@ class RuntimeState:
         default_factory=PlatformCache, repr=False, compare=False)
     environment_cache: PlatformCache[UUID, HostedEnvironment] = field(
         default_factory=PlatformCache, repr=False, compare=False)
+    agent_cache: PlatformCache[UUID, HostedAgent] = field(
+        default_factory=PlatformCache, repr=False, compare=False)
 
     @property
     def workspace(self) -> LocalWorkspace | None:

{mainsequence_metatable-0.1.26.dev43 → mainsequence_metatable-0.1.27}/src/metatables/api/backend/domain/catalog_rules.py

@@ -14,6 +14,15 @@ class CatalogInvariantError(ValueError):
     """A proposed catalog transition violates a MetaTables invariant."""
 
 
+class CatalogAccessError(CatalogInvariantError):
+    """The caller lacks the Writer access a registration needs; ``detail`` says how to recover."""
+
+    def __init__(self, code: str, message: str, **context):
+        super().__init__(message)
+        self.code = code
+        self.detail = {"code": code, "message": message, **context}
+
+
 @dataclass(frozen=True)
 class TimeIndexSpec:
     time_index_name: str
@@ -51,6 +60,7 @@ class TableRegistration:
     migration_namespace: str | None = None
     migration_provider_key: str | None = None
     time_index: TimeIndexSpec | None = None
+    created_by_user_uid: UUID | None = None
 
     @property
     def kind(self) -> str: