mainsequence-metatable 0.1.27.dev46__tar.gz → 0.1.27.dev47__tar.gz

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/.agents/skills/client/metatables-migrations/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: metatables-migrations
-description: "Create and evolve managed application tables through Alembic migration providers with the installed MetaTables Python client. Covers provider scope and placement, scaffolding, revision authoring, local execution, the deployment-workflow migration Job for hosted runtimes, and reservation or finalization failures. Excludes API catalog migrations, client-library implementation, API/server changes and repository tooling."
+description: "Create and evolve managed application tables through Alembic migration providers with the installed MetaTables Python client. Covers provider scope and placement, scaffolding, revision authoring, local execution, the deployment-workflow migration Job for hosted runtimes, the Team that owns an application's tables in each Environment, and reservation or finalization failures. Excludes API catalog migrations, client-library implementation, API/server changes and repository tooling."
 ---
 
 # MetaTables client application migrations
@@ -50,11 +50,21 @@ migrations. Read `docs/client/deploy-application-migrations.md`.
 1. **Develop locally.** Author the revision and apply it to verified local SQLite
    with the [local development skill](../metatables-local-development/SKILL.md).
 2. **Commit the revision with the code that needs it.**
-3. **Deploy.** The application's `.mainsequence/workflows/` file declares a
+3. **Give a Team the tables.** Before the first hosted migration in each
+   Environment, the application's tables need an owning Team: one platform Team
+   per Environment (for example `ledger-development`), whose members are the
+   migration Job's workload User and the workload User of every resource that
+   reads or writes the tables. An Organization admin creates the application's
+   namespace in that Environment and grants the Team Writer on it. Tell the user
+   these steps; they are made in the platform and in MetaTables Security, not in
+   the repository.
+4. **Deploy.** The application's `.mainsequence/workflows/` file declares a
    migration Job that calls `upgrade_application` for each provider, in
-   dependency order, from the candidate image. Every deployed resource that reads
-   or writes the tables (FastAPI, `harness_agent` and others) has a deploy step
-   with `needs: [migrate]`. A failed migration blocks the rollout.
+   dependency order, from the candidate image. The Job and every resource that
+   uses MetaTables declare `access.branches: [{repository: MetaTables, level: view}]`.
+   Every deployed resource that reads or writes the tables (FastAPI,
+   `harness_agent` and others) has a deploy step with `needs: [migrate]`. A failed
+   migration blocks the rollout.
 
 Rules:
 
@@ -69,6 +79,12 @@ Rules:
   during and after a failed rollout. Add first; drop or rename in a later release.
 - Redeploying an older image does not roll back the schema. Downgrade is never a
   deployment step.
+- Tables belong to the Team, never to one workload User. Workload Users change
+  with each Environment and each recreated Job; a new one needs Team membership
+  only. Do not ask for direct table grants to a workload User, and do not run the
+  Job as an Organization admin to get around a refusal.
+- Every table a provider registers goes in the Team's namespace. A table
+  registered in a namespace the caller already writes gets no grant of its own.
 
 ## Source and runtime context
 
@@ -205,8 +221,15 @@ Read `docs/operations/recovery-and-observability.md`.
   another install overwrote it. Move the provider as the
   [legacy upgrade skill](../metatables-upgrade-legacy-app/SKILL.md) describes;
   do not edit files in `site-packages`.
-- If reservation fails, compare provider scope and physical identities before
-  changing code. Do not create a second catalog row for the same table.
+- If reservation fails with `namespace_not_writable` or `table_not_editable`
+  (403), the caller lacks Writer through the owning Team. Add the
+  `caller_user_uid` from the error to the Team with Writer on the namespace, or,
+  when the namespace or Team is missing, set them up as in step 3. A table
+  registered before the Team existed may have only a retired workload User as
+  Writer; an Organization admin grants the Team Writer on its namespace. Do not
+  change code or physical names to get around it.
+- If reservation fails otherwise, compare provider scope and physical identities
+  before changing code. Do not create a second catalog row for the same table.
 - If Alembic succeeds but finalization fails, physical DDL may already be
   committed. Inspect every per-table result and the actual schema before
   retrying.
@@ -220,5 +243,6 @@ Read `docs/operations/recovery-and-observability.md`.
 
 Verify provider scope and placement, revision content, the selected environment
 connection, repeat execution, and final active bindings. Check that the deployment
-workflow runs the migration Job before every resource that uses the tables. Report
+workflow runs the migration Job before every resource that uses the tables, and
+that each Environment has its owning Team with the Job's workload User. Report
 separately what was checked offline and what was exercised against a configured API.

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.27.dev46
+Version: 0.1.27.dev47
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/docs/adr/api/0002-application-administration-and-table-ownership.md

@@ -344,6 +344,42 @@ their own workload Users, which need to be granted like people.
   `reads_as_caller()`, the User `search` filter, `managed_by_caller`,
   `workload_name` and Team members that may be workload Users.
 
+### Amendment: Teams own application tables (2026-10-09)
+
+Since platform ADR-0048 every Job, release and Agent runs as its own workload
+User. Each Environment, and each recreated Job, has a new one. A table's creator
+grant tied the table to the workload User that first registered it, so the next
+identity of the same application could not re-register its own tables
+([#43](https://github.com/mainsequence-projects/MetaTables/issues/43)).
+
+- **A Team owns an application's tables.** Before an application's first
+  migration in an Environment, an Organization admin creates its namespace and
+  grants Writer on it to a platform Team. The application's migration Job and
+  every workload User that reads or writes its tables are members of that Team.
+  Use one Team per Environment, so that one Environment's workloads are not
+  Writers in another. A new workload User needs Team membership only; the tables
+  keep their owner.
+- **No creator grant under a namespace Writer.** Registering a new table into a
+  namespace where the caller is already a Writer, directly or through a Team, adds
+  no creator grant: the namespace's Writers control the table. Otherwise the
+  creator still receives Writer, including an admin registering into a namespace
+  where they have no grant, so no table starts without a Writer.
+- **Creator attribution is a column.** `meta_table.created_by_user_uid` records
+  who registered each table and grants nothing. System migration
+  `0012_table_creator` adds it and fills it from each table's first self-granted
+  Writer in the grant history.
+- **Refusals say how to recover.** Registration refusals are 403s with a `code`:
+  `table_not_editable` for an existing table the caller cannot edit,
+  `namespace_not_writable` for a namespace that is missing or that the caller
+  cannot write. Both name the caller's User UID and the recovery: add it to the
+  Team with Writer on the namespace, or ask an Organization admin. The table's
+  namespace is named when the caller requested it or can read the table; its
+  Writers are listed only when the caller can read the table.
+
+Tables whose only Writer is a replaced identity are recovered the same way: an
+admin grants the application's Team Writer on their namespace. There is no admin
+bypass and no automatic adoption.
+
 ## Superseded behavior and preserved boundaries
 
 This decision supersedes ADR 0001's pending-runtime configurator/existing-source
@@ -397,6 +433,9 @@ schema baseline/recreation policy remains governed by ADR 0001.
   resources through counts, search, lineage, or error details.
 - A Writer can grant/revoke Reader and Writer access only on tables they control.
   Re-registering an existing table never grants the caller ownership.
+- A new member of the Team with Writer on an application's namespace registers and
+  migrates that application's existing tables; a caller outside it is refused with
+  a recovery path that reveals nothing it cannot read.
 - Team changes and namespace revocation/moves change effective access under the
   documented freshness rules; independent grants remain visible and effective.
 - Non-admins cannot manage DataSources, runtime selection, system migrations,

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/docs/adr/api/0007-database-enforced-table-access.md

@@ -299,8 +299,12 @@ and [MySQL implicit commits](https://dev.mysql.com/doc/refman/8.4/en/implicit-co
 - Physical table names become visible to explorer users.
 - Cascading foreign keys are allowed. Tables that reference a table never change
   who may write it.
-- Team membership reaches the database at the pace of the existing one-hour
-  platform-fact cache.
+- Team membership reaches the database on the caller's next query. Each SQL
+  admission compares the caller's current Teams with the ones its role was last
+  given and reconciles the roles first when they differ. A hosted caller's Teams
+  come from its signed assertion on every request
+  ([ADR 0017](0017-hosted-request-identity.md), 2026-10-05 amendment); only the
+  developer's own facts in Local and developer mode are cached for up to an hour.
 
 ## Implementation
 

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/docs/client/deploy-application-migrations.md

@@ -15,10 +15,13 @@ before anything that uses the tables rolls out. See
    [Local storage](local-storage.md).
 2. **Commit the revision with the code that needs it.** Applied revisions are
    immutable; every later schema change is a new revision.
-3. **Deploy.** The application's workflow runs its migration Job from the
+3. **Give a Team the tables.** Before the first hosted migration in each
+   Environment, set up the Team that owns the application's tables
+   ([below](#give-the-job-access-through-a-team)).
+4. **Deploy.** The application's workflow runs its migration Job from the
    candidate image, then deploys the resources that read or write the tables.
 
-Hosted runtimes are migrated only by step 3. Do not run `metatables migrations
+Hosted runtimes are migrated only by step 4. Do not run `metatables migrations
 upgrade` or `downgrade` against a hosted API from a developer machine or agent
 session. Do not migrate at application startup either: several pods would race,
 and a failure would not stop the rollout.
@@ -78,6 +81,56 @@ Give every other deployed resource that reads or writes the tables, such as a
 `harness_agent`, its own deploy step with `needs: [migrate]`. Validate the file
 against the branch's workflow template before committing it.
 
+## Give the Job access through a Team
+
+The Job runs as its own workload User, and each Environment, and each recreated
+Job, has a new one. A table owned by one workload User is lost to the next, so the
+application's tables belong to a platform Team instead:
+
+1. **Create one Team per Environment** for the application, for example
+   `ledger-development` and `ledger-production`. A shared Team would make one
+   Environment's workloads Writers in another.
+2. **Add the workload Users.** Add the migration Job's workload User, and the
+   workload User of every resource that reads or writes the tables (FastAPI
+   release, Agent, other Jobs). Each resource's `workload_user_uid` names it.
+3. **Grant the Team the namespace.** An Organization admin creates the
+   application's namespace in that Environment's MetaTables, under
+   **Security**, or with `POST /security/namespaces/`, and grants the Team Writer
+   on it (`PUT /namespaces/{uid}/permissions`). Every table registered in the
+   namespace inherits the grant.
+
+The Job also needs platform `view` on the Environment's `metatables` release and
+its branch to discover the API; declare it on the Job:
+
+```yaml
+  - key: migrate-ledger
+    kind: job
+    spec:
+      name: Ledger migrations
+      execution_path: jobs/migrate_ledger.py
+    access:
+      branches:
+        - repository: MetaTables
+          level: view
+```
+
+Team membership takes effect on the workload's next request, in the catalog and in
+the database. When a workload User changes, add the new one to the Team; nothing
+in MetaTables changes. A table registered in a namespace the caller already
+writes gets no grant of its own, so the Team stays its only owner.
+
+### When registration is refused
+
+- **`namespace_not_writable`**: the namespace does not exist in this Environment,
+  or the caller is not its Writer. Do steps 1 to 3 for the `caller_user_uid` the
+  error names.
+- **`table_not_editable`**: the table is already registered and the caller is not
+  its Writer. Add the `caller_user_uid` to the Team with Writer on the table's
+  namespace. When the table was registered before the Team existed, its only
+  Writer may be a workload User that no longer runs: an Organization admin
+  grants the Team Writer on the namespace, and the table inherits it. The error
+  lists the table's Writers when the caller can read the table.
+
 ## What the Job guarantees
 
 - It runs on every deployment. A database already at head is left unchanged and
@@ -89,7 +142,8 @@ against the branch's workflow template before committing it.
 - The Job finds the Environment's MetaTables API the same way any client does
   ([installation and connection](installation-and-connection.md)). That API must
   be deployed with its system migrations applied; otherwise the Job fails. Its
-  SDK user needs the same API access a developer needs to run the provider.
+  workload User needs Writer on the application's namespace through the Team
+  above.
 
 ## Keep each release compatible with the previous one
 

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/docs/security/ownership-and-sharing.md

@@ -2,15 +2,23 @@
 
 ## Ownership is Writer access
 
-The creator receives Writer access when a new table is registered. A Writer can
-grant Reader or Writer access to other platform Users and Teams, change a direct
-grant, or revoke it. Readers cannot change grants.
+The creator receives Writer access when a new table is registered, unless the
+table's namespace already makes the creator a Writer, directly or through a Team.
+Then the namespace's Writers control the table and no creator grant is added. A
+Writer can grant Reader or Writer access to other platform Users and Teams, change
+a direct grant, or revoke it. Readers cannot change grants.
 
 Several principals can be Writers. The original creator has no permanent
-permission separate from grants: creator attribution records who created the
+permission separate from grants: `created_by_user_uid` records who created the
 table, while effective access determines who controls it now. Organization admins
 can restore access when no Writer remains.
 
+Deployed Jobs, releases and Agents run as their own workload Users, which change
+with each Environment and each recreated Job. Give an application's tables to a
+Team instead: grant the Team Writer on the application's namespace and make the
+workload Users members. See
+[Migrate in the deployment workflow](../client/deploy-application-migrations.md#give-the-job-access-through-a-team).
+
 ## One central table-access model
 
 `MetaTableGrant` is the foundation of the central access model. Each direct grant

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/docs/security/permissions.md

@@ -22,7 +22,8 @@ Organization admin status comes from the platform through the SDK.
 
 Creation checks the selected DataSource's storage access mode and the table's
 lifecycle requirements. The table and its creator's Writer grant are recorded
-together. Re-registering an existing table cannot give another caller ownership.
+together, unless the namespace already makes the creator a Writer. Re-registering
+an existing table cannot give another caller ownership.
 
 Initial runtime setup must check the platform admin fact before the application
 grant tables exist. Configuring a pending database does not make the first caller

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.27.dev46"
+version = "0.1.27.dev47"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/src/mainsequence_metatable.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.27.dev46
+Version: 0.1.27.dev47
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/src/mainsequence_metatable.egg-info/SOURCES.txt

@@ -320,6 +320,7 @@ src/metatables/api/backend/migrations/versions/0008_upload_receipts.py
 src/metatables/api/backend/migrations/versions/0009_timescale_policies.py
 src/metatables/api/backend/migrations/versions/0010_cascade_targets.py
 src/metatables/api/backend/migrations/versions/0011_table_search.py
+src/metatables/api/backend/migrations/versions/0012_table_creator.py
 src/metatables/api/backend/migrations/versions/__init__.py
 src/metatables/api/backend/operations/__init__.py
 src/metatables/api/backend/operations/bootstrap_migrations.py

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/src/metatables/api/app/routes/table_registration.py

@@ -25,7 +25,7 @@ from metatables.api.backend.backends.operations import (
 from metatables.api.backend.backends.timescale import TimescaleError, convert_time_index_table
 from metatables.api.backend.contracts.storage_layouts import StorageLayoutValidationError
 from metatables.api.backend.contracts.table_contracts import ContractValidationError
-from metatables.api.backend.domain.catalog_rules import CatalogInvariantError
+from metatables.api.backend.domain.catalog_rules import CatalogAccessError, CatalogInvariantError
 from metatables.api.backend.domain.data_source_rules import DataSourceAdmissionError
 from metatables.api.backend.domain.permission_rules import TrustedActorFacts
 from metatables.api.backend.integrations.runtime_data_sources import DataSourceIntegrationError
@@ -164,6 +164,8 @@ def _failure(session, exc, *, item=None):
     cause = exc
     if isinstance(exc, HTTPException):
         status, detail, cause = exc.status_code, exc.detail, exc.__cause__
+    elif isinstance(exc, CatalogAccessError):
+        status, detail = 403, exc.detail
     elif isinstance(exc, DataSourceAdmissionError):
         # Contract rejections name the offending column or index, as contract validation does.
         status = exc.status_code

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/src/metatables/api/backend/domain/catalog_rules.py

@@ -14,6 +14,15 @@ class CatalogInvariantError(ValueError):
     """A proposed catalog transition violates a MetaTables invariant."""
 
 
+class CatalogAccessError(CatalogInvariantError):
+    """The caller lacks the Writer access a registration needs; ``detail`` says how to recover."""
+
+    def __init__(self, code: str, message: str, **context):
+        super().__init__(message)
+        self.code = code
+        self.detail = {"code": code, "message": message, **context}
+
+
 @dataclass(frozen=True)
 class TimeIndexSpec:
     time_index_name: str
@@ -51,6 +60,7 @@ class TableRegistration:
     migration_namespace: str | None = None
     migration_provider_key: str | None = None
     time_index: TimeIndexSpec | None = None
+    created_by_user_uid: UUID | None = None
 
     @property
     def kind(self) -> str:

mainsequence_metatable-0.1.27.dev47/src/metatables/api/backend/migrations/versions/0012_table_creator.py

@@ -0,0 +1,42 @@
+"""Record who registered each table, now that a namespace Writer gets no creator grant (ADR 0002)."""
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "0012_table_creator"
+down_revision = "0011_table_search"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    with op.batch_alter_table("meta_table") as batch:
+        batch.add_column(sa.Column("created_by_user_uid", sa.Uuid(), nullable=True))
+    # Until now the creator's own Writer grant was the only record of who registered
+    # a table: take the earliest grant a User gave itself on each table.
+    audit = sa.table(
+        "grant_audit", sa.column("target_kind"), sa.column("target_uid", sa.Uuid()),
+        sa.column("principal_kind"), sa.column("principal_uid", sa.Uuid()),
+        sa.column("previous_access"), sa.column("new_access"),
+        sa.column("actor_user_uid", sa.Uuid()), sa.column("created_at"),
+    )
+    meta_table = sa.table("meta_table", sa.column("uid", sa.Uuid()), sa.column("created_by_user_uid", sa.Uuid()))
+    connection = op.get_bind()
+    creators = {}
+    for target_uid, actor_uid in connection.execute(
+        sa.select(audit.c.target_uid, audit.c.actor_user_uid).where(
+            audit.c.target_kind == "table", audit.c.principal_kind == "user",
+            audit.c.principal_uid == audit.c.actor_user_uid,
+            audit.c.previous_access.is_(None), audit.c.new_access == "writer",
+        ).order_by(audit.c.created_at.desc())
+    ):
+        creators[target_uid] = actor_uid
+    for target_uid, actor_uid in creators.items():
+        connection.execute(
+            meta_table.update().where(meta_table.c.uid == target_uid).values(created_by_user_uid=actor_uid)
+        )
+
+
+def downgrade():
+    with op.batch_alter_table("meta_table") as batch:
+        batch.drop_column("created_by_user_uid")

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/src/metatables/api/backend/operations/register_catalog.py

@@ -11,6 +11,7 @@ from sqlalchemy.orm import Session
 
 from metatables.api.backend.contracts.table_contracts import normalize_table_contract
 from metatables.api.backend.domain.catalog_rules import (
+    CatalogAccessError,
     CatalogInvariantError,
     TableRegistration,
     TimeIndexSpec,
@@ -70,6 +71,38 @@ def time_index_spec_from_contract(
 DESCRIPTIVE_COLUMN_FIELDS = ("label", "description", "logical_name")
 
 
+def not_editable(session: Session, table: MetaTable, *, actor: TrustedActorFacts,
+                 requested_namespace: str | None) -> CatalogAccessError:
+    """Refuse re-registration with a recovery path, revealing only what the caller may read.
+
+    The table's namespace is named when the caller asked for it or can read the
+    table; its Writers only when the caller can read the table (ADR 0002).
+    """
+    grants = GrantRepository(session)
+    caller = str(actor.user_uid)
+    readable = actor.is_admin or grants.may_access_table(table_uid=table.uid, actor=actor)
+    namespace = session.get(Namespace, table.namespace_uid) if table.namespace_uid else None
+    context = {"caller_user_uid": caller}
+    if namespace is not None and (readable or namespace.name == requested_namespace):
+        context["namespace"] = namespace.name
+        recovery = f"Add {caller} to the Team with Writer on namespace {namespace.name!r}"
+    elif readable and namespace is None:
+        recovery = f"Ask a Writer of the table to grant {caller} Writer"
+    else:
+        recovery = f"Add {caller} to a Team with Writer on the table or its namespace"
+    if readable:
+        context["writers"] = [
+            {key: item[key] for key in ("principal_kind", "principal_uid", "source")}
+            for item in grants.contributions(table=table) if item["access_level"] == "writer"
+        ]
+    return CatalogAccessError(
+        "table_not_editable",
+        f"The table is already registered and caller {caller} is not its Writer. "
+        f"{recovery}, or ask an admin.",
+        **context,
+    )
+
+
 def update_descriptive_metadata(session: Session, table: MetaTable, *, payload: Mapping[str, Any],
                                 contract: Mapping[str, Any], actor: TrustedActorFacts) -> None:
     """Copy non-empty descriptions, labels and column metadata from a registration request.
@@ -188,7 +221,9 @@ def register_catalog_entry(
     ).with_for_update())
     if existing is not None:
         if not GrantRepository(session).may_access_table(table_uid=existing.uid, actor=actor, edit=True):
-            raise CatalogInvariantError("MetaTable is not editable")
+            requested = payload.get("namespace")
+            raise not_editable(session, existing, actor=actor, requested_namespace=(
+                requested.strip().lower() if isinstance(requested, str) else None))
         if existing.management_mode != management_mode or (existing.kind == "time_index") != time_indexed:
             raise CatalogInvariantError("Existing MetaTable has incompatible kind or management mode")
         if time_index_spec is not None:
@@ -205,10 +240,22 @@ def register_catalog_entry(
     namespace_uid: UUID | None = None
     namespace_name = payload.get("namespace")
     repository = CatalogRepository(session)
+    namespace_writer = False
     if isinstance(namespace_name, str) and namespace_name.strip():
         namespace = session.scalar(select(Namespace).where(Namespace.name == namespace_name.strip().lower()))
-        if not actor.is_admin and (namespace is None or not GrantRepository(session).may_assign_namespace(namespace_uid=namespace.uid, actor=actor)):
-            raise CatalogInvariantError("Writer access to the destination namespace is required")
+        namespace_writer = namespace is not None and session.scalar(select(Namespace.uid).where(
+            Namespace.uid == namespace.uid,
+            GrantRepository.namespace_access_predicate(actor, edit=True))) is not None
+        if not actor.is_admin and not namespace_writer:
+            caller = str(actor.user_uid)
+            raise CatalogAccessError(
+                "namespace_not_writable",
+                f"Namespace {namespace_name.strip().lower()!r} does not exist in this Environment or "
+                f"caller {caller} is not its Writer. Ask an admin to create the namespace "
+                f"and grant Writer to the Team that owns the application's tables, then add {caller} "
+                "to that Team.",
+                caller_user_uid=caller, namespace=namespace_name.strip().lower(),
+            )
         namespace, _ = repository.get_or_create_namespace(
             name=namespace_name,
         )
@@ -231,20 +278,24 @@ def register_catalog_entry(
         migration_namespace=alembic.get("migration_namespace"),
         migration_provider_key=alembic.get("provider_key"),
         time_index=time_index_spec,
+        created_by_user_uid=actor.user_uid,
     )
     table = repository.register_table(registration)
     table.protect_from_deletion = (
         table.protect_from_deletion
         or bool(payload.get("protect_from_deletion", False))
     )
-    GrantRepository(session).set_table_grant(
-        table_uid=table.uid,
-        principal_kind="user",
-        principal_uid=actor.user_uid,
-        can_view=True,
-        can_edit=True,
-        granted_by_user_uid=actor.user_uid,
-    )
+    if not namespace_writer:
+        # A namespace Writer, typically the application's Team, already controls the
+        # table; a creator grant would outlive the workload User that made it (ADR 0002).
+        GrantRepository(session).set_table_grant(
+            table_uid=table.uid,
+            principal_kind="user",
+            principal_uid=actor.user_uid,
+            can_view=True,
+            can_edit=True,
+            granted_by_user_uid=actor.user_uid,
+        )
     labels = payload.get("labels") or []
     if not isinstance(labels, list):
         raise CatalogInvariantError("labels must be a list")

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/src/metatables/api/backend/persistence/catalog.py

@@ -137,6 +137,7 @@ class CatalogRepository:
             migration_package=registration.migration_package,
             migration_namespace=registration.migration_namespace,
             migration_provider_key=registration.effective_migration_provider_key(),
+            created_by_user_uid=registration.created_by_user_uid,
         )
         self.session.add(table)
         self.session.flush()

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/src/metatables/api/backend/persistence/models.py

@@ -226,6 +226,8 @@ class MetaTable(Base):
         Uuid(as_uuid=True), ForeignKey("meta_table.uid", ondelete="SET NULL")
     )
     alembic_revision: Mapped[str | None] = mapped_column(String(255))
+    # Attribution only; it grants nothing (ADR 0002, 2026-10-09 amendment).
+    created_by_user_uid: Mapped[UUID | None] = mapped_column(Uuid(as_uuid=True))
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, default=utc_now
     )

{mainsequence_metatable-0.1.27.dev46 → mainsequence_metatable-0.1.27.dev47}/tests/auth/test_runtime_bootstrap.py

@@ -229,8 +229,8 @@ def test_migration_comparison_does_not_initialize_a_missing_database(bootstrap_c
     monkeypatch.setattr(boot, "upgrade_catalog", lambda engine: pytest.fail("Reading migration status must not migrate"))
     descriptor = client.get("/runtime-context/").json()["bootstrap"]
     assert descriptor["current_revisions"] == []
-    assert descriptor["required_revisions"] == ["0011_table_search"]
-    assert descriptor["pending_revisions"] == ["0001_initial", "0002_security_model", "0003_run_log_capture", "0004_historical_run_graphs", "0005_database_access", "0006_local_credentials", "0007_external_relation_names", "0008_upload_receipts", "0009_timescale_policies", "0010_cascade_targets", "0011_table_search"]
+    assert descriptor["required_revisions"] == ["0012_table_creator"]
+    assert descriptor["pending_revisions"] == ["0001_initial", "0002_security_model", "0003_run_log_capture", "0004_historical_run_graphs", "0005_database_access", "0006_local_credentials", "0007_external_relation_names", "0008_upload_receipts", "0009_timescale_policies", "0010_cascade_targets", "0011_table_search", "0012_table_creator"]
     assert descriptor["migration_status"] == "pending"
     assert not path.exists()
 
@@ -240,14 +240,14 @@ def test_migration_comparison_reads_database_changes_after_activation(bootstrap_
     client, _, _ = bootstrap_client
     assert client.post("/runtime-bootstrap/migrate/").status_code == 200
     manager = client.app.state.runtime.bootstrap
-    assert manager.current == ["0011_table_search"]
+    assert manager.current == ["0012_table_creator"]
     with manager.engine.begin() as connection:
         connection.exec_driver_sql("UPDATE metatables_catalog_version SET version_num='0001_initial'")
     monkeypatch.setattr(boot, "upgrade_catalog", lambda engine: pytest.fail("Refreshing must not migrate"))
     descriptor = client.get("/runtime-context/").json()["bootstrap"]
     assert descriptor["current_revisions"] == ["0001_initial"]
-    assert descriptor["required_revisions"] == ["0011_table_search"]
-    assert descriptor["pending_revisions"] == ["0002_security_model", "0003_run_log_capture", "0004_historical_run_graphs", "0005_database_access", "0006_local_credentials", "0007_external_relation_names", "0008_upload_receipts", "0009_timescale_policies", "0010_cascade_targets", "0011_table_search"]
+    assert descriptor["required_revisions"] == ["0012_table_creator"]
+    assert descriptor["pending_revisions"] == ["0002_security_model", "0003_run_log_capture", "0004_historical_run_graphs", "0005_database_access", "0006_local_credentials", "0007_external_relation_names", "0008_upload_receipts", "0009_timescale_policies", "0010_cascade_targets", "0011_table_search", "0012_table_creator"]
     assert descriptor["migration_status"] == "pending"
     assert descriptor["active"] is True
 
@@ -265,14 +265,14 @@ def test_migration_comparison_reads_new_files_without_restarting(bootstrap_clien
     original = Path(boot.migration_config().get_main_option("script_location"))
     shutil.copytree(original / "versions", root / "versions")
     (root / "versions/0007_pending.py").write_text(
-        "revision = '0007_pending'\ndown_revision = '0011_table_search'\n"
+        "revision = '0007_pending'\ndown_revision = '0012_table_creator'\n"
         "branch_labels = None\ndepends_on = None\n")
     configuration = Config()
     configuration.set_main_option("script_location", str(root))
     monkeypatch.setattr(boot, "migration_config", lambda: configuration)
     monkeypatch.setattr(boot, "upgrade_catalog", lambda engine: pytest.fail("Reading files must not migrate"))
     descriptor = client.get("/runtime-context/").json()["bootstrap"]
-    assert descriptor["current_revisions"] == ["0011_table_search"]
+    assert descriptor["current_revisions"] == ["0012_table_creator"]
     assert descriptor["required_revisions"] == ["0007_pending"]
     assert descriptor["pending_revisions"] == ["0007_pending"]
     assert descriptor["migration_status"] == "pending"
@@ -299,7 +299,7 @@ def test_migration_comparison_reports_unknown_revision_and_read_failures(bootstr
     assert response.status_code == 200
     descriptor = response.json()["bootstrap"]
     assert descriptor["migration_status"] == "unavailable"
-    assert descriptor["required_revisions"] == ["0011_table_search"]
+    assert descriptor["required_revisions"] == ["0012_table_creator"]
     assert descriptor["migration_error"]
     assert "private password" not in response.text