mainsequence-metatable 0.1.29.dev52__tar.gz → 0.1.30__tar.gz

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/.agents/skills/ms_tau_sdk/PINNED_FROM.txt

@@ -1,7 +1,7 @@
 schema=1
 library_name=ms-tau-sdk
 namespace=ms_tau_sdk
-pinned_version=2.0.9
+pinned_version=2.0.10
 skills_path=src/ms_tau_sdk/agent_skills
 skills=tau_a2a_runtime_adapter,tau_local_development,tau_project_customization,tau_repository_integration,tau_security_and_access
 command=ms-tau skills sync --path .

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/.agents/skills/ms_tau_sdk/tau_project_customization/SKILL.md

@@ -91,6 +91,11 @@ the application's tool, not in the Agent. A tool that declares nothing gets
 `harness_agent.spec.env_vars`, the process environment, or
 `TauSDKSettings(mcp_tool_timeout_seconds=...)`. No call outlives its turn.
 
+Before MCP opens, an application's access may be `waking`. Tau waits according to the platform's
+retry guidance for up to `TAU_MCP_APPLICATION_READY_TIMEOUT_SECONDS` (default `120`) or the remaining
+turn time. This startup budget is separate from the tool's execution limit; an expired readiness
+wait reports `readiness_timeout`. Cancellation, ended delegation and terminal refusals stop the wait.
+
 ## Invariants extensions must not replace
 
 Extensions may change effective agent capabilities, but they must not replace or bypass:

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.29.dev52
+Version: 0.1.30
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -51,7 +51,7 @@ Requires-Dist: twine<7,>=6; extra == "dev"
 Provides-Extra: docs
 Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
 Provides-Extra: agent
-Requires-Dist: ms-tau-sdk==2.0.9; extra == "agent"
+Requires-Dist: ms-tau-sdk==2.0.10; extra == "agent"
 Provides-Extra: mysql
 Requires-Dist: PyMySQL[rsa]<1.2,>=1.1.1; extra == "mysql"
 Provides-Extra: mssql

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/docs/adr/agent/0019-metatables-analyst-agent.md

@@ -1,5 +1,15 @@
 # ADR 0019: MetaTables Analyst agent
 
+> Amendment (2026-10-09): Both Environment and Agent discovery allow 30 seconds for
+> the platform lookup, including credential renewal. Environment lookup failures
+> stay outside the one-hour cache, just like Agent lookup failures, so the next
+> request can restore the Analyst after a temporary platform outage. Successful
+> facts still expire normally; an expired verified result is never served on failure.
+> A hosted API also fails startup when its declared database is unavailable,
+> allowing the deployment's restart policy to retry instead of serving a replica
+> whose failed bootstrap cannot recover. Secret lookup allows 30 seconds and
+> distinguishes a missing Secret from a failed platform request in its message.
+>
 > Amendment (2026-10-08): The API names this branch's Analyst to applications.
 > `GET /runtime-context/` returns `hosted_agent` (`uid`, `name`, `status`) beside
 > `hosted_environment`: the Agent the API's own branch deploys, which the API finds with its
@@ -70,7 +80,7 @@ refuses anything else.
 
 | Part | Rule |
 | --- | --- |
-| Runtime | `ms-tau-sdk` 2.0.9, `openai-codex` / `gpt-5.6-luna`, thinking `medium`. |
+| Runtime | `ms-tau-sdk` 2.0.10, `openai-codex` / `gpt-5.6-luna`, thinking `medium`. |
 | Identity | The person each turn serves (ADR 0020); the agent's own identity holds no grants. |
 | Tools | The six tools below, served by the API over MCP when hosted (ADR 0021), and the SDK's skill-scoped `read`. No shell, file writes or Main Sequence MCP. |
 | Instructions | `.tau/SYSTEM.md` covers MetaTables; vendored `pg-aiguide` skills cover PostgreSQL and TimescaleDB. |

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/docs/adr/agent/0021-api-serves-the-analyst-tools-over-mcp.md

@@ -35,6 +35,7 @@ The hosted API serves the read tools at `/mcp`, and the hosted Analyst uses them
 | Analyst | The agent declares `mcp_applications: [{resource: metatables}]` and gets `metatables__list_tools` and `metatables__call_tool`. Its extension registers the tools only in a local `ms-tau` session, where they call the local API as the developer. |
 | Key | The API's workflow key is `metatables`, because MCP keys become tool prefixes and must match `^[a-z][a-z0-9_]{0,39}$`. |
 | Time limits | Each tool declares how long an Agent should wait in its MCP `_meta` under `mainsequence.ai/timeout-seconds/v1` (ms-tau-sdk 2.0.9): 120 s, the bound of one in-process API call, and 300 s for `deep_search`, which the release's 300 s request timeout bounds. An undeclared tool would get the Agent's default of 60 s. |
+| Application readiness | The Analyst pins ms-tau-sdk 2.0.10, which waits when application access is `waking` before opening MCP ([SDK issue 87](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/87)). The SDK's default readiness budget is 120 s, bounded by the remaining turn time; it honors retry guidance and cancellation. This wait is separate from each tool's execution limit, and expiry reports `readiness_timeout`. |
 
 ## Consequences
 

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.29.dev52"
+version = "0.1.30"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"
@@ -59,7 +59,7 @@ Documentation = "https://potential-doodle-wn39mnm.pages.github.io/"
 [project.optional-dependencies]
 dev = ["pytest>=8,<10", "ruff>=0.14", "build>=1,<2", "packaging>=24.2", "twine>=6,<7"]
 docs = ["mkdocs>=1.6,<2"]
-agent = ["ms-tau-sdk==2.0.9"]
+agent = ["ms-tau-sdk==2.0.10"]
 mysql = ["PyMySQL[rsa]>=1.1.1,<1.2"]
 # Keep the published extra name for existing installers; pyodbc is required.
 mssql = []

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/src/mainsequence_metatable.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.29.dev52
+Version: 0.1.30
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -51,7 +51,7 @@ Requires-Dist: twine<7,>=6; extra == "dev"
 Provides-Extra: docs
 Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
 Provides-Extra: agent
-Requires-Dist: ms-tau-sdk==2.0.9; extra == "agent"
+Requires-Dist: ms-tau-sdk==2.0.10; extra == "agent"
 Provides-Extra: mysql
 Requires-Dist: PyMySQL[rsa]<1.2,>=1.1.1; extra == "mysql"
 Provides-Extra: mssql

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/src/mainsequence_metatable.egg-info/requires.txt

@@ -28,7 +28,7 @@ urllib3>=2.7.0
 uvicorn==0.52.4
 
 [agent]
-ms-tau-sdk==2.0.9
+ms-tau-sdk==2.0.10
 
 [dev]
 pytest<10,>=8

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/src/metatables/api/app/routes/runtime_context.py

@@ -20,19 +20,27 @@ router = APIRouter(tags=["Runtime"])
 
 
 def verified_environment(uid: UUID | None) -> HostedEnvironment:
+    """Load a verified fact; let failures escape so they cannot enter the cache."""
     if uid is None:
         return HostedEnvironment(uid=None, status="not_configured")
-    from mainsequence.client.exceptions import ApiError
     from mainsequence.client.models_user import OrganizationEnvironment
+
+    environment = OrganizationEnvironment.get_by_uid(str(uid), timeout=30)
+    if environment.uid != str(uid):
+        raise ValueError("Platform returned a different Environment")
+    return HostedEnvironment(uid=str(uid), status="verified", name=environment.name,
+        is_production=environment.is_production,
+        required_repository_branch=environment.required_repository_branch)
+
+
+def cached_environment(cache: PlatformCache[UUID, HostedEnvironment], uid: UUID | None) -> HostedEnvironment:
+    if uid is None:
+        return HostedEnvironment(uid=None, status="not_configured")
+    from mainsequence.client.exceptions import ApiError
     from mainsequence.client.utils import DoesNotExist
 
     try:
-        environment = OrganizationEnvironment.get_by_uid(str(uid), timeout=(2, 5))
-        if environment.uid != str(uid):
-            return HostedEnvironment(uid=str(uid), status="unavailable")
-        return HostedEnvironment(uid=str(uid), status="verified", name=environment.name,
-            is_production=environment.is_production,
-            required_repository_branch=environment.required_repository_branch)
+        return cache.get(uid, lambda: verified_environment(uid))
     except ApiError as exc:
         logger.warning("Hosted environment lookup failed", exc_info=True)
         return HostedEnvironment(uid=str(uid), status="not_found" if exc.status_code == 404 else "unavailable")
@@ -43,12 +51,6 @@ def verified_environment(uid: UUID | None) -> HostedEnvironment:
         return HostedEnvironment(uid=str(uid), status="unavailable")
 
 
-def cached_environment(cache: PlatformCache[UUID, HostedEnvironment], uid: UUID | None) -> HostedEnvironment:
-    if uid is None:
-        return HostedEnvironment(uid=None, status="not_configured")
-    return cache.get(uid, lambda: verified_environment(uid))
-
-
 def branch_agent() -> HostedAgent:
     """The Harness Agent this API's branch deploys (ADR 0019); a branch deploys at most one.
 
@@ -58,7 +60,7 @@ def branch_agent() -> HostedAgent:
     from mainsequence.code_repository_context import get_code_repository_context
 
     branch_uid = get_code_repository_context().code_repository_branch_uid
-    agents = [agent for agent in Agent.filter(timeout=(2, 5))
+    agents = [agent for agent in Agent.filter(timeout=30)
               if branch_uid and agent.code_repository_branch_uid == branch_uid]
     if len(agents) != 1:
         return HostedAgent(uid=None, status="not_found")

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/src/metatables/api/app/runtime.py

@@ -261,6 +261,12 @@ def initialize_runtime(config: RuntimeConfig) -> RuntimeState:
             bootstrap.error = ("Saved runtime configuration is invalid. Configure the DataSource again in Settings."
                                if config.local_mode else "The declared runtime database configuration is invalid. "
                                "Fix runtime_database in the API's configuration.yaml, then deploy the API.")
+    if not (config.local_mode or config.developer_mode) and bootstrap.status == "unavailable":
+        # A hosted pod cannot repair its database through Settings. Fail startup
+        # so it never advertises readiness with a permanently failed bootstrap;
+        # the deployment's restart policy retries transient platform failures.
+        bootstrap.close()
+        raise RuntimeError(bootstrap.error or "The declared runtime database is unavailable.")
     state = RuntimeState(config=config, identity=identity, bootstrap=bootstrap, credential_store=bootstrap.credential_store)
     if identity is not None and identity.actor_facts is not None:
         state.actor_facts_cache.seed(identity.user_uid, identity.actor_facts,

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/src/metatables/api/app/runtime_database.py

@@ -40,15 +40,19 @@ class RuntimeDatabaseError(RuntimeError):
 def read_secret(name: str) -> tuple[UUID, str]:
     """Read one Secret of the caller's Environment by name."""
     from mainsequence.client import Secret
+    from mainsequence.client.utils import DoesNotExist
     try:
-        secret = Secret.get(name=name, timeout=15)
+        secret = Secret.get(name=name, timeout=30)
         value = secret.value.get_secret_value() if secret.value is not None else ""
         if not secret.uid or not value:
             raise ValueError("Empty Secret")
         return UUID(str(secret.uid)), value
-    except Exception as exc:
+    except DoesNotExist as exc:
         raise RuntimeDatabaseError("unavailable", f"Cannot read the Environment Secret {name}. Create it in this "
                                    "Environment, then deploy the API.") from exc
+    except Exception as exc:
+        raise RuntimeDatabaseError("unavailable", f"Cannot read the Environment Secret {name}. Check platform "
+                                   "connectivity and the API's access to this Secret.") from exc
 
 
 def declaration(config):

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/tests/auth/test_platform_fact_cache.py

@@ -168,10 +168,13 @@ def test_environment_metadata_is_cached_and_expiry_does_not_preserve_verified_st
     now[0], available[0] = 3600, False
     for _ in range(3):
         assert cached_environment(cache, uid).status == "unavailable"
-    assert len(calls) == 3
-    now[0], available[0] = 7200, True
+    assert len(calls) == 5
+    # Recovery must be visible immediately, without waiting another cache TTL.
+    available[0] = True
     assert cached_environment(cache, uid).status == "verified"
-    assert len(calls) == 4
+    assert len(calls) == 6
+    assert cached_environment(cache, uid).status == "verified"
+    assert len(calls) == 6
 
 
 def test_cache_is_bounded_and_failed_lookup_can_recover():

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/tests/auth/test_runtime_database.py

@@ -128,3 +128,22 @@ def test_developer_launcher_uses_the_deployment_declaration(tmp_path, monkeypatc
 def test_packaged_deployment_declares_its_runtime_database():
     declared = DeploymentConfiguration.load(DEPLOYMENT_CONFIGURATION).runtime_database
     assert declared.uri_secret == "METATABLES_RUNTIME_DATABASE" and declared.tls.mode == "require"
+
+
+def test_secret_timeout_fails_hosted_startup_instead_of_serving_a_broken_runtime(tmp_path, monkeypatch):
+    from mainsequence.client import Secret
+    from mainsequence.client.exceptions import TransportError
+
+    from metatables.api.app.runtime import initialize_runtime
+
+    path = tmp_path / "configuration.yaml"
+    path.write_text(POSTGRESQL)
+
+    def timed_out(cls, **kwargs):
+        raise TransportError("private upstream details")
+
+    monkeypatch.setattr(Secret, "get", classmethod(timed_out))
+    with pytest.raises(RuntimeError, match="Check platform connectivity") as raised:
+        initialize_runtime(RuntimeConfig(local_mode=False, configuration_path=path))
+    assert "Create it" not in str(raised.value)
+    assert "private upstream details" not in str(raised.value)

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/tests/auth/test_runtime_selection.py

@@ -121,7 +121,7 @@ def test_hosted_mode_uses_the_deployment_declared_database(tmp_path, monkeypatch
         reads.append(name)
         return secret_uid, "postgresql://metatables:s3cr%40t@tunnel.example.invalid:20989/development"
     monkeypatch.setattr("metatables.api.app.runtime_database.read_secret", read_secret)
-    def inspect_without_remote_connection(self):
+    def inspect_without_remote_connection(self, **kwargs):
         self.status, self.error, self.current = "migration_required", None, []
     monkeypatch.setattr(RuntimeBootstrap, "inspect", inspect_without_remote_connection)
     monkeypatch.setattr(RuntimeBootstrap, "migration_descriptor", lambda self: dict(

{mainsequence_metatable-0.1.29.dev52 → mainsequence_metatable-0.1.30}/uv.lock

@@ -825,7 +825,7 @@ mcp = [
 
 [[package]]
 name = "mainsequence-metatable"
-version = "0.1.29"
+version = "0.1.30"
 source = { editable = "." }
 dependencies = [
     { name = "alembic" },
@@ -888,7 +888,7 @@ requires-dist = [
     { name = "keyring", specifier = ">=25,<26" },
     { name = "mainsequence", extras = ["mcp"], specifier = ">=9.0.19,<10" },
     { name = "mkdocs", marker = "extra == 'docs'", specifier = ">=1.6,<2" },
-    { name = "ms-tau-sdk", marker = "extra == 'agent'", specifier = "==2.0.9" },
+    { name = "ms-tau-sdk", marker = "extra == 'agent'", specifier = "==2.0.10" },
     { name = "numpy" },
     { name = "opentelemetry-api" },
     { name = "opentelemetry-exporter-otlp" },
@@ -1224,7 +1224,7 @@ wheels = [
 
 [[package]]
 name = "ms-tau-sdk"
-version = "2.0.9"
+version = "2.0.10"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -1242,9 +1242,9 @@ dependencies = [
     { name = "tau-ai" },
     { name = "uvicorn", extra = ["standard"] },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/23/29/26341de632c9f2326686552fb090901a225b54d113df65f1c14cfdd10128/ms_tau_sdk-2.0.9.tar.gz", hash = "sha256:b8fc6b08c7491c4830b8931113d8aabd029d9f92b7708ed84588f466a1f5ce65", size = 306226, upload-time = "2026-10-09T09:53:44.962Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ce/6c/1e5c39235dc1967d3200dc42ea907cd1ae5658aea8fb1bb308c0d386220a/ms_tau_sdk-2.0.10.tar.gz", hash = "sha256:f4de037535aaded8aaf83ea35a209eef8f5f8654268c3ea0dc204dc88d433eb6", size = 308370, upload-time = "2026-10-09T15:34:51.335Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/64/e9/a20bc2668b213e91048da187a2f76987a22980340b9666fe4a6dce120823/ms_tau_sdk-2.0.9-py3-none-any.whl", hash = "sha256:3d8833420ce945b8f27392358c2707245532eaf10f057dc12a6cd3f56d931cb5", size = 332535, upload-time = "2026-10-09T09:53:43.388Z" },
+    { url = "https://files.pythonhosted.org/packages/85/7c/2580ba420bf6d795647a9713d76b3d087a9a89158670a53a4fe525074b16/ms_tau_sdk-2.0.10-py3-none-any.whl", hash = "sha256:4e299eff3f477a08568374e6037b645b7512149427d0cd062ec278fcee268589", size = 334357, upload-time = "2026-10-09T15:34:49.885Z" },
 ]
 
 [[package]]