mainsequence-metatable 0.1.36.dev67__tar.gz → 0.1.37.dev69__tar.gz

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/.agents/skills/ms_tau_sdk/PINNED_FROM.txt

@@ -1,7 +1,7 @@
 schema=1
 library_name=ms-tau-sdk
 namespace=ms_tau_sdk
-pinned_version=2.0.10
+pinned_version=2.0.16
 skills_path=src/ms_tau_sdk/agent_skills
 skills=tau_a2a_runtime_adapter,tau_local_development,tau_project_customization,tau_repository_integration,tau_security_and_access
 command=ms-tau skills sync --path .

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/.agents/skills/ms_tau_sdk/tau_a2a_runtime_adapter/SKILL.md

@@ -54,6 +54,11 @@ For a deployed Agent, use the projected `a2a.send_message` MCP operation. The pl
 resolves the target `AgentSession`, waits for its runtime to become ready, and dispatches the
 message. For asynchronous work, use the returned Task handle with `a2a.wait_task`.
 
+The platform gives a direct Message (`response_kind: "message"`) 90 seconds, and no setting
+extends that limit. A target that has not answered by then stops its turn, and the send fails
+because of the limit. Send work that may take longer with `response_kind: "task"`, and do not
+resend a Message that ran out of time: the work it already did is not rolled back.
+
 For local Tau development, start `ms-tau` and wait for its local `/ready` result. The public A2A
 REST and JSON-RPC surfaces support Message and Task execution against the workspace-local SQLite
 store, including streaming, list/get/cancel/subscribe, and continuation. An A2A protocol Task does

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/.agents/skills/ms_tau_sdk/tau_local_development/SKILL.md

@@ -35,9 +35,9 @@ The SDK looks for the CLI in `MAINSEQUENCE_CLI`, then beside the Python interpre
 CLI. Do not add token lines to `.env`. A pair found there still works, but it is deprecated and
 startup logs a warning. `mainsequence refresh-token` run in that directory removes the lines.
 
-Do not set `APP_NAME`, `FASTAPI_PUBLIC_BASE_URL`, `MAINSEQUENCE_CALLER_AUTH_MODE=assertion`, or the
-`MAINSEQUENCE_CALLER_ASSERTION_*` variables. The platform sets them when it hosts a runtime, and
-local mode refuses to start with them.
+Do not set `APP_NAME`, `FASTAPI_PUBLIC_BASE_URL`, `MAINSEQUENCE_CALLER_AUTH_MODE=assertion`, the
+`MAINSEQUENCE_CALLER_ASSERTION_*` variables or `MAINSEQUENCE_A2A_MESSAGE_LIMIT_SECONDS`. The
+platform sets them when it hosts a runtime, and local mode refuses to start with them.
 
 Set `MAINSEQUENCE_ENDPOINT` only for a non-default platform endpoint. The CLI session must be for
 the same endpoint. Local mode binds to `127.0.0.1:8787` by default. Treat an explicit public bind
@@ -118,6 +118,11 @@ To request a Task from `message:send`, send the response-kind extension header
 response. `message:stream` is always Task-oriented and does not accept `responseKind` or
 `returnImmediately`.
 
+Local mode has no platform Message limit: a direct Message ends only at
+`MAINSEQUENCE_TAU_TURN_TIMEOUT_SECONDS`. A hosted Agent answers a direct Message within the
+platform's 90 seconds or with HTTP 504 `DEADLINE_EXCEEDED`, so design work that may take longer as
+a Task.
+
 Task terminality is derived only from its A2A state. `completed`, `failed`, `canceled`, and
 `rejected` are terminal; `input_required` and `auth_required` are resumable. A normal execution
 failure produces a durable failed Task and a standard responder `status.message`. A

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/.agents/skills/ms_tau_sdk/tau_project_customization/SKILL.md

@@ -26,8 +26,13 @@ second SDK-specific prompt override or companion append file. Other resources fo
 version pinned by the installed SDK.
 
 `.agents/skills/ms_tau_sdk/` is different: it contains managed development instructions for coding
-agents working on the repository. It is not loaded as the runtime's `.tau` behavior and must not be
-used as application configuration.
+agents working on the repository. It is not the runtime's `.tau` behavior and must not be used as
+application configuration.
+
+Tau reads skills in `.tau/skills/` and `.agents/skills/` at any depth: a folder without a
+`SKILL.md` groups skills, such as `.agents/skills/mcp_tools/<skill>/SKILL.md`, the folder an
+application can publish with the mainsequence SDK's skills publisher. The managed skills in
+`.agents/skills/ms_tau_sdk/` are read too.
 
 ## Extension ownership
 
@@ -74,7 +79,7 @@ Task controls requires an actual Task context and is specified by ADR 0015.
 The A2A Task controls are `task_request_input` and `task_request_authorization`. They remain
 available in every mode for the agent's own Task; extensions must not register those names.
 Register project tools under `.tau/extensions/` and verify the effective catalog after loading.
-With base tools excluded, the skill-scoped `read` keeps `.tau/skills/` available: it opens a
+With base tools excluded, the skill-scoped `read` keeps the project skills available: it opens a
 discovered skill's `SKILL.md` and the files in its directory, such as `references/*.md`, and
 rejects every other path, including symlinks that resolve outside the skill. Tau lists the skills
 in the system prompt because a tool named `read` exists. Extensions must not register `read` in
@@ -96,6 +101,16 @@ retry guidance for up to `TAU_MCP_APPLICATION_READY_TIMEOUT_SECONDS` (default `1
 turn time. This startup budget is separate from the tool's execution limit; an expired readiness
 wait reports `readiness_timeout`. Cancellation, ended delegation and terminal refusals stop the wait.
 
+## Skills that applications publish
+
+A declared application can publish Agent Skills through the MCP Skills extension, as the
+mainsequence SDK's skills publisher does. The Agent lists them with `<name>__list_resources` and
+reads one file with `<name>__read_resource`; a skill file is returned only when its bytes match the
+size and SHA-256 digest the skill lists. Published skills stay the application's: they are not
+project skills under `.tau/skills/`, and fields such as `allowed-tools` grant nothing. With the
+coding tools, a model that follows a published skill can run commands; set
+`TAU_EXCLUDE_BASE_TOOLS=true` when that must not happen.
+
 ## Invariants extensions must not replace
 
 Extensions may change effective agent capabilities, but they must not replace or bypass:
@@ -143,10 +158,13 @@ async def revenue_by_region(tool_call_id, arguments, signal=None, on_update=None
     return AgentToolResult(content=[TextContent(text=json.dumps(answer.json()["rows"]))])
 ```
 
-- `current_requester()` returns the person the turn serves, with `uid` and `team_uids`, or
-  `None`. The platform names that person when the turn starts, whoever called; it is `None` when
-  the platform names nobody, in local mode, and in code outside a turn. Only it names the
-  requester: never take a person's UID from tool arguments, the prompt, history, or a header.
+- `current_requester()` returns the person the turn serves, with `uid` and
+  `await in_teams(team_uids, *, max_age_seconds=None)`, or `None`. `in_teams()` answers while the
+  person is the verified caller of the turn's request (see `tau_security_and_access`, "Checking the
+  person's teams"); `team_uids` is deprecated. The platform names that person when the turn
+  starts, whoever called; it is `None` when the platform names nobody, in local mode, and in code
+  outside a turn. Only it names the requester: never take a person's UID from tool arguments, the
+  prompt, history, or a header.
 - `platform_client()` returns a client. `await client.request("GET", "/api/v1/...")` calls a
   platform API path, and `await client.call_release(release_uid, method, path, ...)` calls another
   platform application. Both return an `httpx.Response`.
@@ -167,8 +185,6 @@ Rules for tools that act for the requester:
 - A delegated call uses the person's ordinary permissions, including administrative ones; any other
   call uses the Agent's own. Each operation decides what it needs. Never infer write permission
   from view access.
-- This needs the platform's matching change, deployed in the same cutover; check the deployed
-  platform and the installed SDK before depending on it.
 - Return to the model only business results, such as rows, numbers, and names. Never return the
   response object, its headers, a token, a proof, or a raw error body.
 - Keep nothing for another turn or another person. The delegation ends with the turn, and a task

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/.agents/skills/ms_tau_sdk/tau_security_and_access/SKILL.md

@@ -178,7 +178,13 @@ What makes it safe:
 
 A delegated read returns anything the person can view in the Agent's Environment: what they
 created and what others shared with them, directly or through a team. This holds for Secrets and
-every other object. The platform enforces sharing; which of those objects a tool uses is part of
+other shared resources. Ordinary Teams use explicit membership: the creator is added once and
+can be removed; current Organization admins are protected writer members. Removing the admin
+role keeps membership and writer access but ends protection. Only Organization admins manage
+membership, and managing a workload that created a Team does not grant Team control. A Team's
+members still receive the resources shared with it. The Full directory remains unchanged.
+See the SDK Security and access guide's **Teams and membership** section for platform rollout.
+The platform enforces sharing; which of those objects a tool uses is part of
 the tool's design. For Secrets, the naming convention states that design:
 
 - **A personal credential:** a name tied to the person, such as `QUOTES_API_KEY__<person uid>`.
@@ -201,6 +207,33 @@ How sharing works:
   tool can use them when its design needs to, for example to refuse a team key where it expects a
   personal one. That is a choice of the tool, not a platform rule.
 
+## Checking the person's teams
+
+A delegated call already reaches exactly what the person can, including what is shared with their
+teams, so a tool rarely checks teams itself. When the tool's own policy names teams, ask the
+platform with `in_teams()`:
+
+```python
+person = current_requester()
+if person is None or REPORTS_TEAM_UID not in await person.in_teams([REPORTS_TEAM_UID]):
+    return AgentToolResult(content=[TextContent(text="These reports are for the team's members.")])
+```
+
+- `await in_teams(team_uids, *, max_age_seconds=None)` returns the subset of `team_uids` the
+  person is an active member of, as a `frozenset`. Unknown and inactive teams are left out.
+- On the turn's requester it answers only while that person is the verified caller of the request
+  the turn runs in, such as a chat or A2A Message they sent. A turn with no such request raises
+  `TauSDKError`: a Task attempt the platform dispatches, a turn that resumes a caller delivery, or
+  work another Agent asked for. Refuse the action then; never read the error as a membership
+  answer. An HTTP handler asks for its caller with `await request.state.user.in_teams(...)`.
+- The process reuses an answer across requests for `TAU_TEAM_MEMBERSHIP_CACHE_SECONDS` (default
+  `0`: only within its request); set it in `harness_agent.spec.env_vars`. `max_age_seconds=0`
+  always asks the platform: use it before a write that must see a removal at once.
+- A check the platform cannot answer raises `BackendError`; it never answers "not a member".
+- `team_uids` on the requester is deprecated and warns when read. It is empty when the turn does
+  not know the person's teams, and raises when the caller's assertion carried no team list, as
+  every assertion will once the platform stops signing them. Use `in_teams()`.
+
 ## What never reaches the model
 
 Tool results, their `details`, and errors can reach the model provider and the session history.

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.36.dev67
+Version: 0.1.37.dev69
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -14,7 +14,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: mainsequence[mcp]<10,>=9.0.19
+Requires-Dist: mainsequence[mcp]<10,>=9.0.26
 Requires-Dist: alembic<2,>=1.18
 Requires-Dist: cachetools
 Requires-Dist: cryptography<51,>=46
@@ -51,7 +51,7 @@ Requires-Dist: twine<7,>=6; extra == "dev"
 Provides-Extra: docs
 Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
 Provides-Extra: agent
-Requires-Dist: ms-tau-sdk==2.0.10; extra == "agent"
+Requires-Dist: ms-tau-sdk==2.0.16; extra == "agent"
 Provides-Extra: mysql
 Requires-Dist: PyMySQL[rsa]<1.2,>=1.1.1; extra == "mysql"
 Provides-Extra: mssql

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/docs/adr/api/0017-hosted-request-identity.md

@@ -9,6 +9,16 @@ launcher declaration, genuine EdDSA caller assertions verified by the SDK, rejec
 callers, Local isolation, and PodDeploymentOrchestrator's own launcher run against
 the deployed entrypoint. A hosted rollout has not yet been verified.
 
+> Amendment (2026-10-15, SDK #225): caller assertions stop carrying Team UIDs.
+> Admission asks the platform with `in_teams()` which of the Teams that MetaTables
+> grants name the caller, or the requester of a delegated call, belongs to. The SDK
+> reuses an answer for 24 hours (`team_membership_cache_seconds`). SQL writes act
+> on an answer at most a minute old; migration credentials, table deletion,
+> finalization and permission changes ask at once. A SQL login's stored Teams, and
+> so its database role memberships, change only on a fresh answer, so pods holding
+> answers of different ages cannot flip them. A failed check is a 503, never "not a
+> member".
+
 Owner: MetaTables API. The SDK owns caller verification
 ([SDK 9.0.6 ADR 0036: Request-scoped logged user](https://github.com/mainsequence-sdk/mainsequence-sdk/blob/v9.0.6/docs/adr/0036-request-scoped-logged-user.md));
 the platform's FastAPI launcher owns the startup check.

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/docs/api/authentication-and-errors.md

@@ -22,11 +22,13 @@ other SDK mode. Once it is installed, every route not declared in the deployment
 MetaTables declares no anonymous route. A hosted API started without that
 configuration installs nothing, and admission rejects every caller.
 
-The assertion also carries the caller's active Team UIDs and admin flag, which
-the SDK exposes on `User.get_logged_user()`. Admission uses them as signed and
-performs no User lookup, so workload Users, such as applications and Jobs that run
-as their own User, are admitted like people. Each request's assertion states
-current facts, so hosted facts are not cached. The API evaluates table/namespace
+The assertion also carries the caller's admin flag, which the SDK exposes on
+`User.get_logged_user()`. Admission uses it as signed and performs no User lookup,
+so workload Users, such as applications and Jobs that run as their own User, are
+admitted like people. Team membership is asked of the platform with `in_teams()`,
+only for the Teams MetaTables grants name, and reused for 24 hours; writes use an
+answer at most a minute old, and credential, deletion and permission requests ask
+at once. When the platform cannot answer, the request fails with 503. The API evaluates table/namespace
 grants in its runtime database. User and Team facts remain platform-owned; no local
 membership registry is used. This adds no authentication mechanism.
 

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/docs/api/openapi.json

@@ -5025,7 +5025,7 @@
     },
     "/caller/": {
       "get": {
-        "description": "Who this request runs as: the User, Teams and admin flag the API admitted, named\nthrough the platform directory as that User sees it.\n\nHosted, the identity comes from the platform-signed caller assertion (ADR 0017);\nLocal and developer runtimes admit the developer's own SDK session.",
+        "description": "Who this request runs as: the User, Teams and admin flag the API admitted, named\nthrough the platform directory as that User sees it.\n\nHosted, the identity comes from the platform-signed caller assertion (ADR 0017),\nand the Teams are those MetaTables grants name that the caller belongs to (SDK\n#225); Local and developer runtimes admit the developer's own SDK session.",
         "operationId": "admitted_caller_caller__get",
         "responses": {
           "200": {

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/docs/concepts/identity-and-scope.md

@@ -20,7 +20,8 @@ TimescaleDB, MySQL or MSSQL runtime DataSource their deployment declares, for bo
 roles; the deployment's migration Job initializes it. Local Settings initializes or
 selects the SQLite file. Both use the same bootstrap operation.
 
-The SDK supplies trusted User identity, active Team UIDs, Organization admin status,
+The SDK supplies trusted User identity, membership answers for the Teams MetaTables
+grants name, Organization admin status,
 and independent Git source facts. MetaTables owns workspace identity and
 Reader/Writer table/namespace grants. It does not store an independent membership
 registry or replicate platform Organization policy. See the implemented

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/docs/contributing/releasing.md

@@ -66,6 +66,8 @@ The minimum and lockfile now select published SDK `9.0.19`. SDK 9.0.14 is the fi
 caller and to name workloads
 ([ADR 0002](../adr/api/0002-application-administration-and-table-ownership.md)).
 SDK 9.0.10 is the first whose `User` reads workload User rows.
+The repository requires SDK 9.0.26, whose request identity asks Team membership on
+demand with `in_teams()` (SDK #225); caller assertions stop carrying Team UIDs.
 SDK 9.0.9 is the first whose request identity exposes the caller's signed Team UIDs
 and admin flag; hosted admission needs them to admit workload Users
 ([#37](https://github.com/mainsequence-projects/MetaTables/issues/37)). SDK 9.0.4 is the first

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/docs/security/index.md

@@ -98,11 +98,17 @@ choice, not an authorization mechanism.
 Use the compatible published SDK prerequisite described in
 [installation](../client/installation-and-connection.md). In hosted mode the SDK
 request identity verifies the existing signed caller assertion. Admission takes the
-caller, its active Team UIDs and its admin flag from `User.get_logged_user()`, as
-the platform signed them, and looks up no User
+caller and its admin flag from `User.get_logged_user()`, as the platform signed
+them, and looks up no User
 ([ADR 0017](../adr/api/0017-hosted-request-identity.md)). Workload Users are
-admitted like people. An assertion without those facts admits the caller with no
-Teams and no admin access. Local admission resolves facts for the running SDK user,
+admitted like people. The assertion carries no Teams: admission asks the platform,
+with `in_teams()`, which of the Teams that MetaTables grants name the caller belongs
+to. Each pod reuses an answer for 24 hours, so a person removed from a Team can
+keep reading through that Team's grants for up to a day. Writes act on an answer
+at most a minute old. Migration credentials, table deletion, finalization and
+permission changes always ask the platform at once, and a login's database role
+memberships change only on such a fresh answer. A failed check fails the request;
+it never counts as "not a member". Local admission resolves facts for the running SDK user,
 whose platform User response must supply `is_organization_admin` and
 `active_team_uids`.
 

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.36.dev67"
+version = "0.1.37.dev69"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"
@@ -18,7 +18,7 @@ classifiers = [
   "Operating System :: OS Independent",
 ]
 dependencies = [
-  "mainsequence[mcp]>=9.0.19,<10",
+  "mainsequence[mcp]>=9.0.26,<10",
   "alembic>=1.18,<2",
   "cachetools",
   "cryptography>=46,<51",
@@ -59,7 +59,7 @@ Documentation = "https://potential-doodle-wn39mnm.pages.github.io/"
 [project.optional-dependencies]
 dev = ["pytest>=8,<10", "ruff>=0.14", "build>=1,<2", "packaging>=24.2", "twine>=6,<7"]
 docs = ["mkdocs>=1.6,<2"]
-agent = ["ms-tau-sdk==2.0.10"]
+agent = ["ms-tau-sdk==2.0.16"]
 mysql = ["PyMySQL[rsa]>=1.1.1,<1.2"]
 # Keep the published extra name for existing installers; pyodbc is required.
 mssql = []

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/src/mainsequence_metatable.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.36.dev67
+Version: 0.1.37.dev69
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT
@@ -14,7 +14,7 @@ Classifier: Operating System :: OS Independent
 Requires-Python: >=3.13
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: mainsequence[mcp]<10,>=9.0.19
+Requires-Dist: mainsequence[mcp]<10,>=9.0.26
 Requires-Dist: alembic<2,>=1.18
 Requires-Dist: cachetools
 Requires-Dist: cryptography<51,>=46
@@ -51,7 +51,7 @@ Requires-Dist: twine<7,>=6; extra == "dev"
 Provides-Extra: docs
 Requires-Dist: mkdocs<2,>=1.6; extra == "docs"
 Provides-Extra: agent
-Requires-Dist: ms-tau-sdk==2.0.10; extra == "agent"
+Requires-Dist: ms-tau-sdk==2.0.16; extra == "agent"
 Provides-Extra: mysql
 Requires-Dist: PyMySQL[rsa]<1.2,>=1.1.1; extra == "mysql"
 Provides-Extra: mssql

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/src/mainsequence_metatable.egg-info/SOURCES.txt

@@ -206,6 +206,7 @@ src/metatables/api/app/transfer.py
 src/metatables/api/app/auth/__init__.py
 src/metatables/api/app/auth/boundary.py
 src/metatables/api/app/auth/local_actor.py
+src/metatables/api/app/auth/team_membership.py
 src/metatables/api/app/routes/__init__.py
 src/metatables/api/app/routes/access_map.py
 src/metatables/api/app/routes/caller.py
@@ -468,6 +469,7 @@ tests/auth/test_runtime_scaffold.py
 tests/auth/test_runtime_selection.py
 tests/auth/test_runtime_storage_binding.py
 tests/auth/test_source_passwords.py
+tests/auth/test_team_membership.py
 tests/catalog/test_catalog_foundation.py
 tests/catalog/test_contract_projection.py
 tests/catalog/test_database_config.py

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/src/mainsequence_metatable.egg-info/requires.txt

@@ -1,4 +1,4 @@
-mainsequence[mcp]<10,>=9.0.19
+mainsequence[mcp]<10,>=9.0.26
 alembic<2,>=1.18
 cachetools
 cryptography<51,>=46
@@ -28,7 +28,7 @@ urllib3>=2.7.0
 uvicorn==0.52.4
 
 [agent]
-ms-tau-sdk==2.0.10
+ms-tau-sdk==2.0.16
 
 [dev]
 pytest<10,>=8

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/src/metatables/api/app/auth/boundary.py

@@ -2,11 +2,13 @@
 
 from __future__ import annotations
 
-from dataclasses import dataclass
+from collections.abc import Callable
+from dataclasses import dataclass, field
 from uuid import UUID
 
 from fastapi import Depends, HTTPException, Request
 
+from metatables.api.app.auth.team_membership import request_max_age, team_checker
 from metatables.api.app.runtime import RuntimeState
 from metatables.api.backend.domain.permission_rules import TrustedActorFacts
 from metatables.api.request_timing import thread_started
@@ -22,6 +24,8 @@ class AdmittedCaller:
     environment_uid: UUID | None = None
     active_team_uids: frozenset[UUID] = frozenset()
     is_admin: bool = False
+    check_teams: Callable[[float | None], frozenset[UUID]] | None = field(
+        default=None, compare=False, repr=False)
 
 
 def admit_request(request: Request) -> AdmittedCaller:
@@ -55,13 +59,16 @@ def admit_request(request: Request) -> AdmittedCaller:
         route = getattr(request.scope.get("route"), "path", None)
         if request.method not in {"GET", "HEAD", "OPTIONS"} and route not in DELEGATED_READ_POSTS:
             raise HTTPException(403, "A call made for a person by another application can only read.")
+        check = team_checker(request, requester)
         return AdmittedCaller(
             user_uid=UUID(requester.uid), environment_uid=environment_uid,
-            active_team_uids=frozenset(UUID(uid) for uid in requester.team_uids),
+            active_team_uids=check(request_max_age(request)), check_teams=check,
         )
+    # The assertion no longer lists teams: ask about the teams MetaTables grants name.
+    check = team_checker(request, caller)
     return AdmittedCaller(
         user_uid=UUID(caller.uid), is_admin=caller.is_organization_admin,
-        active_team_uids=frozenset(UUID(uid) for uid in caller.team_uids),
+        active_team_uids=check(request_max_age(request)), check_teams=check,
         environment_uid=environment_uid,
     )
 
@@ -70,9 +77,9 @@ def logged_user():
     """Return the caller that the SDK request identity verified for this request.
 
     The SDK verifies the platform-signed caller assertion once, before any route
-    runs, and answers missing or invalid proof itself. The assertion also carries
-    the caller's active Team UIDs and admin flag, so hosted admission needs no User
-    lookup and admits people and workload Users alike. When no caller is bound, for
+    runs, and answers missing or invalid proof itself. The assertion carries the
+    caller's admin flag; team membership is asked of the platform on demand (SDK
+    #225). Admission admits people and workload Users alike. When no caller is bound, for
     example on a hosted API started without the platform's trust configuration,
     admission fails; there is no header or process-account fallback.
     """
@@ -103,7 +110,8 @@ def platform_facts(identity):
 
 def trusted_actor_facts(caller: AdmittedCaller = Depends(admit_request)) -> TrustedActorFacts:
     return TrustedActorFacts(user_uid=caller.user_uid, user_active=True,
-                             active_team_uids=caller.active_team_uids, is_admin=caller.is_admin)
+                             active_team_uids=caller.active_team_uids, is_admin=caller.is_admin,
+                             check_teams=caller.check_teams)
 
 
 def require_admin(caller: AdmittedCaller = Depends(admit_request)) -> AdmittedCaller:

mainsequence_metatable-0.1.37.dev69/src/metatables/api/app/auth/team_membership.py

@@ -0,0 +1,104 @@
+"""Team membership of hosted callers, asked of the platform on demand (SDK #225).
+
+The caller assertion no longer carries a team list. MetaTables asks the platform,
+with ``in_teams()``, about the only teams that can matter here: the teams its own
+namespace and table grants name. How old an answer may be depends on what the
+request does:
+
+- reads reuse an answer for a day (Jose, 2026-10-15): a person removed from a team
+  can keep reading through that team's grants for up to 24 hours;
+- data and SQL writes accept an answer at most a minute old;
+- issuing migration credentials, deleting tables, finalizing and changing
+  permissions always ask the platform now.
+"""
+
+from __future__ import annotations
+
+import itertools
+from collections.abc import Callable
+from uuid import UUID
+
+from fastapi import HTTPException, Request
+from sqlalchemy import event, select, union
+from sqlalchemy.orm import Session
+
+from metatables.api.backend.persistence.models import MetaTableGrant, NamespaceGrant
+
+TEAM_MEMBERSHIP_CACHE_SECONDS = 24 * 60 * 60
+# Routes whose effect a stale "member" answer must never authorize.
+FRESH_ROUTES = frozenset({
+    ("POST", "/meta-tables/{table_uid}/migration-connection/"),
+    ("POST", "/meta-tables/finalize-managed/"),
+    ("DELETE", "/meta-tables/{table_uid}/"),
+    ("POST", "/meta-tables/{table_uid}/delete-with-cascade/"),
+    ("POST", "/time-index-meta-tables/{table_uid}/delete-after-date/"),
+    ("PUT", "/meta-tables/{uid}/permissions"),
+    ("PUT", "/namespaces/{uid}/permissions"),
+})
+
+_grant_changes = itertools.count()
+_grant_generation = 0
+
+
+def _grants_flushed(session: Session, _context) -> None:
+    if any(isinstance(row, (NamespaceGrant, MetaTableGrant))
+           for row in (*session.new, *session.dirty, *session.deleted)):
+        session.info["grant_teams_changed"] = True
+
+
+def _grants_committed(session: Session) -> None:
+    global _grant_generation
+    if session.info.pop("grant_teams_changed", False):
+        _grant_generation = next(_grant_changes) + 1
+
+
+event.listen(Session, "after_flush", _grants_flushed)
+event.listen(Session, "after_commit", _grants_committed)
+event.listen(Session, "after_rollback", lambda session: session.info.pop("grant_teams_changed", None))
+
+
+def grant_teams(request: Request) -> frozenset[str]:
+    """The teams this catalog's grants name; none before a catalog is active."""
+    from metatables.api.app.auth.local_actor import active_catalog_factory
+
+    factory = active_catalog_factory(request.app)
+    if factory is None:
+        return frozenset()
+
+    def load() -> frozenset[str]:
+        query = union(
+            select(NamespaceGrant.principal_uid).where(NamespaceGrant.principal_kind == "team"),
+            select(MetaTableGrant.principal_uid).where(MetaTableGrant.principal_kind == "team"),
+        )
+        with factory() as session:
+            return frozenset(str(uid) for uid in session.scalars(query))
+
+    try:
+        return request.app.state.runtime.grant_teams.get(_grant_generation, load)
+    except Exception as exc:
+        raise HTTPException(503, "MetaTables catalog is unavailable.") from exc
+
+
+def team_checker(request: Request, person) -> Callable[[float | None], frozenset[UUID]]:
+    """Ask which of the grant teams ``person`` belongs to, no older than ``max_age``.
+
+    ``None`` reuses the day-long answer; failures fail the request and are never
+    read as "not a member".
+    """
+    teams = grant_teams(request)
+
+    def check(max_age: float | None) -> frozenset[UUID]:
+        if not teams:
+            return frozenset()
+        try:
+            members = person.in_teams(teams, max_age_seconds=max_age)
+        except Exception as exc:
+            raise HTTPException(503, "Team membership is unavailable.") from exc
+        return frozenset(UUID(uid) for uid in members)
+
+    return check
+
+
+def request_max_age(request: Request) -> float | None:
+    route = getattr(request.scope.get("route"), "path", None)
+    return 0 if (request.method, route) in FRESH_ROUTES else None

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/src/metatables/api/app/main.py

@@ -128,7 +128,9 @@ def install_hosted_request_identity(service: FastAPI, config: RuntimeConfig) ->
         return
     if not any(os.environ.get(name) for name in PLATFORM_CALLER_AUTHENTICATION):
         return
-    install_request_identity(service)
+    from metatables.api.app.auth.team_membership import TEAM_MEMBERSHIP_CACHE_SECONDS
+    # Membership answers are reused for a day; writes and credentials ask sooner (SDK #225).
+    install_request_identity(service, team_membership_cache_seconds=TEAM_MEMBERSHIP_CACHE_SECONDS)
     if service.state.mainsequence_request_identity["mode"] != "assertion":
         raise RuntimeError(
             "The hosted MetaTables API accepts only platform caller assertions. "

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/src/metatables/api/app/mcp.py

@@ -37,22 +37,21 @@ class ApiCallError(RuntimeError):
 
 def install_metatables_mcp(app) -> None:
     """Serve the read tools at ``/mcp``; request identity must already be installed."""
-    server = Server("MetaTables", instructions=INSTRUCTIONS)
     tools = {tool.name: tool for tool in TOOLS}
 
-    @server.list_tools()
-    async def list_tools() -> list[types.Tool]:
-        # `_meta` is the field's wire alias; `meta=` would be dropped as an unknown key.
-        return [types.Tool(name=tool.name, title=tool.label, description=tool.description,
-                           inputSchema=tool.parameters,
-                           **{"_meta": {TIMEOUT_META_KEY: tool.timeout_seconds}}) for tool in TOOLS]
+    async def list_tools(ctx, params) -> types.ListToolsResult:
+        return types.ListToolsResult(tools=[
+            types.Tool(name=tool.name, title=tool.label, description=tool.description,
+                       input_schema=tool.parameters, meta={TIMEOUT_META_KEY: tool.timeout_seconds})
+            for tool in TOOLS
+        ])
 
-    @server.call_tool()
-    async def call_tool(name: str, arguments: dict[str, Any]) -> types.CallToolResult:
-        tool = tools.get(name)
+    async def call_tool(ctx, params: types.CallToolRequestParams) -> types.CallToolResult:
+        tool = tools.get(params.name)
         if tool is None:
-            raise ValueError(f"Unknown tool: {name}.")
-        assertion = server.request_context.request.headers.get(ASSERTION_HEADER)
+            raise ValueError(f"Unknown tool: {params.name}.")
+        arguments: dict[str, Any] = dict(params.arguments or {})
+        assertion = ctx.request.headers.get(ASSERTION_HEADER)
         loop = asyncio.get_running_loop()
 
         def api(method: str, path: str, *, params: dict | None = None, json: Any = None) -> Any:
@@ -67,9 +66,10 @@ def install_metatables_mcp(app) -> None:
             result = {"error": str(exc)}
         return types.CallToolResult(
             content=[types.TextContent(type="text", text=json.dumps(result, default=str))],
-            isError="error" in result,
+            is_error="error" in result,
         )
 
+    server = Server("MetaTables", instructions=INSTRUCTIONS, on_list_tools=list_tools, on_call_tool=call_tool)
     manager = StreamableHTTPSessionManager(app=server, json_response=True, stateless=True)
     install_mcp(app, manager.handle_request, lifespan=manager.run)
 

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/src/metatables/api/app/platform_cache.py

@@ -7,6 +7,8 @@ from threading import Lock
 from time import monotonic
 
 PLATFORM_FACTS_TTL_SECONDS = 60 * 60
+# Other pods see a new team grant within this time; the pod that wrote it at once.
+GRANT_TEAMS_SECONDS = 60
 
 
 class PlatformCache[K, V]:

{mainsequence_metatable-0.1.36.dev67 → mainsequence_metatable-0.1.37.dev69}/src/metatables/api/app/routes/caller.py

@@ -12,8 +12,9 @@ def admitted_caller(request: Request, caller: AdmittedCaller = Depends(admit_req
     """Who this request runs as: the User, Teams and admin flag the API admitted, named
     through the platform directory as that User sees it.
 
-    Hosted, the identity comes from the platform-signed caller assertion (ADR 0017);
-    Local and developer runtimes admit the developer's own SDK session.
+    Hosted, the identity comes from the platform-signed caller assertion (ADR 0017),
+    and the Teams are those MetaTables grants name that the caller belongs to (SDK
+    #225); Local and developer runtimes admit the developer's own SDK session.
     """
     config = request.app.state.runtime.config
     user = describe_user(caller.user_uid)