mainsequence-metatable 0.1.8.dev14__tar.gz → 0.1.8.dev15__tar.gz

{mainsequence_metatable-0.1.8.dev14/src/mainsequence_metatable.egg-info → mainsequence_metatable-0.1.8.dev15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev14
+Version: 0.1.8.dev15
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/docs/adr/api/0001-unified-api-storage-and-local-sqlite.md

@@ -28,6 +28,7 @@ does not cache this API's runtime context or select its runtime mode or DataSour
 Updated 2026-09-28: application Environment policy and relationships are removed.
 Amended 2026-09-29: one enforced runtime binding and explicit bootstrap select one
 database for system and user tables.
+Amended 2026-10-02: each runtime mode lists and selects only its own DataSources.
 
 Companion decision: [Main Sequence SDK ADR 0035: Independent Git source and platform execution context](https://github.com/mainsequence-sdk/mainsequence-sdk/blob/metatables_removal/docs/adr/0035-independent-git-source-and-platform-context.md).
 The SDK prerequisite is implemented on `metatables_removal`; the current local
@@ -81,6 +82,55 @@ API requirement. The guides and examples describe the implemented shared path.
 
 ## Decision
 
+### Each runtime mode selects only its own DataSources (amended 2026-10-02)
+
+Implemented 2026-10-02 in the API and Admin; the PostgreSQL runtime-transition test
+was updated but not run.
+
+A DataSource belongs to the runtime mode that registered it. Data Sources and
+Settings show only the current mode's registrations:
+
+| Mode | Registrations | Credential references |
+| --- | --- | --- |
+| Local | The workspace SQLite catalog | Local CredentialStore |
+| Hosted | The Hosted registry until activation, then the hosted catalog | SDK Secrets |
+
+Neither mode lists, selects or copies the other mode's registrations. This applies
+ADR 0009's rule against automatic credential transfers to selection. A Hosted
+DataSource is registered and selected after switching to Hosted. Local mode offers
+**Switch to Hosted** without choosing a source; Hosted starts with its saved
+selection or uninitialized, as the supervised-selection amendment below requires.
+
+Gap observed 2026-10-02: in Local mode, the Settings Hosted picker listed the local
+catalog (`GET /data-sources/`). Selecting a TimescaleDB registered there made
+`POST /runtime-bootstrap/hosted/select/` copy the row, with its local password
+reference, into `.local/runtime-source-candidates.json`. SDK Secrets could not
+resolve that reference ("SDK Secret access failed"). Local mode also offered no
+way to register a Hosted source: **Add DataSource** writes the local catalog, and
+the Admin disables **Switch to Hosted** until a Hosted source is selected. The
+operations guide documents this cross-mode flow.
+
+Fix:
+
+1. API: remove Local-mode Hosted preselection: `POST /runtime-bootstrap/hosted/select/`,
+   the Local `hosted_bootstrap` and its runtime-context field. Remove the
+   local-catalog lookup and `remember()` from `registered_hosted_source`. Hosted
+   `POST /runtime-bootstrap/select/` resolves only the Hosted registry or the
+   active hosted catalog.
+2. Admin: in Local mode, Settings enables **Switch to Hosted** with no source
+   picker. The Hosted picker and its **Add DataSource** render only in Hosted
+   mode, where Data Sources is the Hosted registry.
+3. Docs: `docs/operations/local-runtime.md` describes the order Switch to Hosted,
+   register in Data Sources, select in Settings, then run MetaTables migrations
+   or use the existing catalog.
+4. Tests: the Local-mode selection route no longer exists; Hosted selection
+   rejects a local-catalog UID; a fresh Hosted runtime registers a source with an
+   SDK Secret reference and selects it; Settings in Local mode switches without a
+   selection.
+
+Hosted registry entries already copied from a local catalog carry unusable
+references; developers remove them. No data migration is provided.
+
 ### One local runtime across branches (amended 2026-09-30)
 
 MetaTables owns one persistent local SQLite runtime for a checkout. Git branches,

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/docs/adr/index.md

@@ -23,7 +23,7 @@ decisions belong in the SDK repository and are linked as dependencies.
 
 | ADR | Status | Scope |
 | --- | --- | --- |
-| [0001: One API execution path with SQLite for local development](api/0001-unified-api-storage-and-local-sqlite.md) | Accepted and implemented | Shared execution, API-owned local storage, SDK context dependency, and DuckDB removal. |
+| [0001: One API execution path with SQLite for local development](api/0001-unified-api-storage-and-local-sqlite.md) | Accepted and implemented | Shared execution, API-owned local storage, SDK context dependency, and DuckDB removal; each runtime mode lists and selects only its own DataSources. |
 | [0002: Application administration and table ownership](api/0002-application-administration-and-table-ownership.md) | Accepted and implemented | Platform admin facts, table Reader/Writer ownership, User/Team grants, live namespace inheritance, and application-owned access management. |
 | [0004: Execute approved application migrations inside the API](api/0004-approved-application-migrations.md) | Superseded by ADR 0013 | Historical API-installed provider execution model. |
 | [0005: Shared run logs with local file capture](api/0005-run-logs-and-local-file-capture.md) | Accepted and implemented; live hosted verification pending | Shared run correlation and log API, runtime-bound local JSONL files, and hosted retrieval through the SDK. |

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/docs/api/data-sources.md

@@ -30,10 +30,10 @@ These operations do not reconcile runtime table grants. If database permissions
 need repair in Security, caller queries remain blocked while external DataSource
 management remains available.
 
-Settings lists eligible PostgreSQL, TimescaleDB, MySQL and MSSQL DataSources from
-that same registry and selects one by UID through `/runtime-bootstrap/hosted/select/`
-while Local is active or `/runtime-bootstrap/select/` in Hosted mode. Selection does
-not itself switch runtime mode. Registration preserves the UID when its catalog is
+Each runtime mode lists only its own registrations: Local the workspace catalog,
+Hosted its registry. In Hosted mode, Settings lists eligible PostgreSQL, TimescaleDB,
+MySQL and MSSQL DataSources and selects one by UID through `/runtime-bootstrap/select/`.
+Local mode cannot select a Hosted DataSource; switch to Hosted first. Registration preserves the UID when its catalog is
 initialized. The API's private pre-initialization storage is an implementation detail.
 
 The active runtime DataSource hosts the system catalog and default application

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/docs/api/openapi.json

@@ -3127,16 +3127,6 @@
             ],
             "title": "Git Source"
           },
-          "hosted_bootstrap": {
-            "anyOf": [
-              {
-                "$ref": "#/components/schemas/RuntimeBootstrapDescriptor"
-              },
-              {
-                "type": "null"
-              }
-            ]
-          },
           "hosted_environment": {
             "anyOf": [
               {
@@ -6510,48 +6500,6 @@
         ]
       }
     },
-    "/runtime-bootstrap/hosted/select/": {
-      "post": {
-        "description": "Select a registered hosted DataSource without changing the active local runtime.",
-        "operationId": "select_hosted_before_switch_runtime_bootstrap_hosted_select__post",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/RuntimeSourceSelection"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/RuntimeBootstrapDescriptor"
-                }
-              }
-            },
-            "description": "Successful Response"
-          },
-          "422": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/HTTPValidationError"
-                }
-              }
-            },
-            "description": "Validation Error"
-          }
-        },
-        "summary": "Select Hosted Before Switch",
-        "tags": [
-          "Runtime bootstrap"
-        ]
-      }
-    },
     "/runtime-bootstrap/migrate/": {
       "post": {
         "operationId": "migrate_runtime_bootstrap_migrate__post",

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/docs/api/reference.md

@@ -51,7 +51,6 @@ These methods and paths are mounted by the current application. See the [OpenAPI
 | POST | `/runtime-bootstrap/activate/` | Activate | 200 |
 | POST | `/runtime-bootstrap/configure/` | Configure | 200 |
 | POST | `/runtime-bootstrap/destroy-local/` | Destroy Local | 200 |
-| POST | `/runtime-bootstrap/hosted/select/` | Select Hosted Before Switch | 200 |
 | POST | `/runtime-bootstrap/migrate/` | Migrate | 200 |
 | POST | `/runtime-bootstrap/select/` | Select Hosted Runtime Source | 200 |
 | GET | `/runtime-context/` | Runtime Context | 200 |

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/docs/operations/catalog-migrations.md

@@ -31,7 +31,6 @@ The API owns these endpoints in both modes:
 | --- | --- |
 | `GET /runtime-context/` | Read runtime and bootstrap status, including before any catalog exists. |
 | `GET/POST /data-sources/` | List or register DataSources, including before hosted bootstrap. |
-| `POST /runtime-bootstrap/hosted/select/` | Select a registered hosted DataSource while Local remains active. |
 | `POST /runtime-bootstrap/select/` | Select a registered DataSource in Hosted mode. |
 | `POST /runtime-bootstrap/configure/` | Hold and inspect a proposed `{display_name, class_type, configuration}`. |
 | `POST /runtime-bootstrap/migrate/` | Explicitly migrate, register the runtime source, and activate. |

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/docs/operations/hosted-runtime.md

@@ -42,8 +42,8 @@ The injected SDKCredentialStore saves the password as a managed platform Secret
 and stores its UID. Hosted never provisions a local key or applies MetaTables AES
 encryption to that Secret. Then select it
 from the registered DataSources list in **Settings → Runtime → DataSource**. In the
-developer launcher, this selection can be saved while Local mode remains active;
-**Switch to Hosted** is a separate action.
+developer launcher, switch to Hosted first: Local mode lists only its workspace
+DataSources and cannot register or select Hosted ones.
 If MetaTables is absent or outdated, explicitly click **Run MetaTables migrations**.
 If its schema is already compatible, choose **Use this DataSource**. The selected
 database stores both the system catalog and user tables; the source registration is
@@ -55,9 +55,10 @@ returns HTTP 200 with a null active DataSource; application routes remain unavai
 This lets the Vite site show Settings even on the first launch. Once active, the descriptor
 supplies the source UID, dialect, parameter style and schema to both clients.
 
-DataSources are registered through `/data-sources/` in either runtime mode. Private
+Each runtime mode registers through `/data-sources/` into its own registry. Hosted
 pre-initialization persistence retains the legacy `.local/runtime-source-candidates.json`
-filename for compatibility; it is not a second resource. Selection saves
+filename for compatibility; it is not a second resource, and Local mode never reads
+or writes it. Selection saves
 public connection settings and Secret references to `.local/runtime-data-sources.json`.
 Persist that directory across restarts. Startup verifies
 the existing schema and reopens the selected source; it never upgrades. An incompatible

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/docs/operations/local-runtime.md

@@ -67,10 +67,18 @@ Apply application providers through the client with
 
 ## Switch modes in one Admin site
 
-Register a hosted connection under **MetaTables → Data Sources**, then choose Hosted under
-**Settings → Runtime mode** and select the registered DataSource. **Switch to Hosted**
-stops the old worker before starting the selected mode; it never copies data. A fresh
-Hosted runtime can start without a database, so Settings remains available.
+Each mode lists and selects only its own DataSources. Local shows the workspace
+catalog and keeps its passwords in the local CredentialStore; Hosted shows the
+Hosted registry and keeps passwords as managed Main Sequence Secrets. A DataSource
+registered in Local never appears in Hosted, and neither mode copies the other's
+registrations or credentials.
+
+To use a hosted database, choose Hosted under **Settings → Runtime mode** and click
+**Switch to Hosted**; no DataSource selection is needed first. The worker restarts in
+Hosted with its saved selection, or uninitialized with Settings available. Register
+the database under **MetaTables → Data Sources**, select it in **Settings → Runtime →
+DataSource**, then click **Run MetaTables migrations** or **Use this DataSource**.
+Switching stops the old worker before starting the selected mode; it never copies data.
 Failed worker startup restores the previous worker. Mode selection is recorded in
 `.local/runtime-selection.json`; successful DataSource selection is recorded separately
 in `.local/runtime-data-sources.json` using public settings and Secret references only.

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.8.dev14"
+version = "0.1.8.dev15"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15/src/mainsequence_metatable.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev14
+Version: 0.1.8.dev15
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/src/metatables/api/app/bootstrap.py

@@ -544,46 +544,12 @@ def persist_registered_selection(candidate):
         candidate.persist_selection()
 
 
-@router.post("/hosted/select/", response_model=RuntimeBootstrapDescriptor)
-def select_hosted_before_switch(body: RuntimeSourceSelection, request: Request,
-                                   caller: AdmittedCaller = Depends(require_admin)):
-    """Select a registered hosted DataSource without changing the active local runtime."""
-    state = request.app.state.runtime
-    current = state.hosted_bootstrap
-    if not state.config.local_mode or current is None:
-        raise HTTPException(403, "Hosted DataSource preparation is available only in Local mode.")
-    if not current.lock.acquire(blocking=False):
-        raise HTTPException(409, "Hosted DataSource configuration is already in progress.")
-    try:
-        if request.app.state.runtime.hosted_bootstrap is not current:
-            raise HTTPException(409, "Hosted DataSource configuration changed. Refresh Settings.")
-        source = registered_hosted_source(request, body.source_uid)
-        candidate = RuntimeBootstrap(replace(state.config, local_mode=False),
-                                     replace(state.identity, workspace=None))
-        try:
-            candidate.selected_source_uid = str(body.source_uid)
-            candidate.configure(source, caller.user_uid)
-            if candidate.status == "unavailable":
-                raise BootstrapError(candidate.error or "Cannot verify the hosted DataSource connection.")
-            persist_registered_selection(candidate)
-            request.app.state.runtime = replace(request.app.state.runtime, hosted_bootstrap=candidate)
-            current.close()
-            return candidate.descriptor(caller.user_uid, is_admin=caller.is_admin)
-        except BootstrapError as exc:
-            candidate.close()
-            raise HTTPException(409, str(exc)) from None
-        except Exception:
-            candidate.close()
-            raise HTTPException(503, "Unable to save the hosted DataSource configuration.") from None
-    finally:
-        current.lock.release()
-
-
 @router.post("/select/", response_model=RuntimeBootstrapDescriptor)
 def select_hosted_runtime_source(body: RuntimeSourceSelection, request: Request,
                                  caller: AdmittedCaller = Depends(require_admin)):
+    # Each mode selects only its own registrations; Local never prepares Hosted.
     if request.app.state.runtime.config.local_mode:
-        raise HTTPException(409, "Use hosted selection while Local mode is active.")
+        raise HTTPException(409, "Switch to Hosted before selecting its DataSource.")
     source = registered_hosted_source(request, body.source_uid)
     with mutation(request, caller) as current:
         state = request.app.state.runtime

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/src/metatables/api/app/main.py

@@ -115,9 +115,6 @@ def create_app(config: RuntimeConfig | None = None) -> FastAPI:
         finally:
             if bootstrap:
                 bootstrap.close()
-            hosted_bootstrap = _app.state.runtime.hosted_bootstrap
-            if hosted_bootstrap:
-                hosted_bootstrap.close()
 
     service = FastAPI(title="MetaTables API", version="0.1.0", lifespan=lifespan)
     from metatables.api.backend.backends.contracts import SQLExecutionError

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/src/metatables/api/app/routes/data_sources.py

@@ -54,8 +54,14 @@ def registrations():
     return source_registrations
 
 
+def hosted_registry(request):
+    # The saved registry holds Hosted registrations only; Local lists its catalog.
+    runtime = request.app.state.runtime
+    return runtime.bootstrap is not None and not runtime.config.local_mode
+
+
 def saved_rows(request):
-    if request.app.state.runtime.bootstrap is None:
+    if not hosted_registry(request):
         return {}
     store = registrations()
     return store.read_registry(store.registry_path(request))
@@ -67,7 +73,7 @@ def saved_source(uid, request, session):
 
 
 def remember_source(row, request):
-    if request.app.state.runtime.bootstrap is not None:
+    if hosted_registry(request):
         registrations().remember(row, request)
 
 class SourceRoute(APIRoute):
@@ -179,7 +185,7 @@ def payload(row, actor, binding, request=None):
 
 
 def selected_source(uid, request):
-    if request is None or request.app.state.runtime.bootstrap is None:
+    if request is None or not hosted_registry(request):
         return False
     return registrations().selected_uid(request) == str(uid)
 
@@ -372,7 +378,7 @@ def delete_source(uid: UUID, request: Request, actor: TrustedActorFacts = Depend
         raise HTTPException(409, "Default or referenced DataSources cannot be removed.")
     session.delete(row)
     session.commit()
-    if request.app.state.runtime.bootstrap is not None:
+    if hosted_registry(request):
         registrations().forget(uid, request)
     return Response(status_code=204)
 

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/src/metatables/api/app/routes/runtime_context.py

@@ -87,7 +87,6 @@ def runtime_context(
         "git_source": source_descriptor(workspace.source) if workspace else None,
         "data_source_selection": selection,
         "bootstrap": state.bootstrap.descriptor(caller.user_uid, is_admin=caller.is_admin) if state.bootstrap else None,
-        "hosted_bootstrap": state.hosted_bootstrap.descriptor(caller.user_uid, is_admin=caller.is_admin) if state.hosted_bootstrap else None,
         "data_source_error": None,
         "data_source": None, "dialect": None, "paramstyle": None,
         "default_schema": None,

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/src/metatables/api/app/runtime.py

@@ -211,7 +211,6 @@ class RuntimeState:
     credential_store: CredentialStore = field(default_factory=UnavailableCredentialStore, repr=False, compare=False)
     binding: RuntimeStorageBinding = field(default_factory=RuntimeStorageBinding)
     bootstrap: object | None = None
-    hosted_bootstrap: object | None = None
     actor_facts_cache: PlatformCache[tuple[bool, UUID], tuple[frozenset[UUID], bool]] = field(
         default_factory=PlatformCache, repr=False, compare=False)
     environment_cache: PlatformCache[UUID, HostedEnvironment] = field(
@@ -247,18 +246,7 @@ def initialize_runtime(config: RuntimeConfig) -> RuntimeState:
         except Exception:
             bootstrap.status = "unavailable"
             bootstrap.error = "Saved runtime configuration is invalid. Configure the DataSource again in Settings."
-    hosted_bootstrap = None
-    if config.local_mode:
-        hosted_bootstrap = RuntimeBootstrap(replace(config, local_mode=False), replace(identity, workspace=None))
-        hosted_candidate = hosted_bootstrap.initial_candidate()
-        if hosted_candidate:
-            try:
-                hosted_bootstrap.configure(hosted_candidate, None)
-            except Exception:
-                hosted_bootstrap.status = "unavailable"
-                hosted_bootstrap.error = "Saved hosted DataSource is invalid. Configure it again in Settings."
-    state = RuntimeState(config=config, identity=identity, bootstrap=bootstrap, hosted_bootstrap=hosted_bootstrap,
-                         credential_store=credentials)
+    state = RuntimeState(config=config, identity=identity, bootstrap=bootstrap, credential_store=credentials)
     if identity is not None and identity.actor_facts is not None:
         state.actor_facts_cache.seed((True, identity.user_uid), identity.actor_facts,
                                     expires_at=identity.facts_expires_at)

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/src/metatables/runtime_contract.py

@@ -61,7 +61,6 @@ class RuntimeContext(BaseModel):
     data_source_selection: Literal["local_workspace", "catalog_default", "runtime_override", "runtime_binding"] = "catalog_default"
     data_source_error: str | None = None
     bootstrap: RuntimeBootstrapDescriptor | None = None
-    hosted_bootstrap: RuntimeBootstrapDescriptor | None = None
     dialect: Literal["sqlite", "postgresql", "mysql", "mssql"] | None
     paramstyle: Literal["named", "pyformat", "qmark"] | None
     data_source: dict | None

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/tests/auth/test_hosted_environment_target.py

@@ -53,7 +53,7 @@ def test_runtime_descriptor_distinguishes_switch_target_from_active_environment(
     uid = uuid4()
     environment = HostedEnvironment(uid=str(uid), name="Development", status="verified")
     state = SimpleNamespace(config=SimpleNamespace(local_mode=local, developer_mode=True,
-        configuration_path=None, expected_host="127.0.0.1:18473"), workspace=None, bootstrap=None, hosted_bootstrap=None,
+        configuration_path=None, expected_host="127.0.0.1:18473"), workspace=None, bootstrap=None,
         binding=SimpleNamespace(source_uid=None), environment_cache=PlatformCache(),
         credential_store=SimpleNamespace(descriptor=lambda: dict(provider="unconfigured", status="uninitialized", error=None)))
     control = SimpleNamespace(instance_id="worker", error=None, shutdown=lambda: None) if switch_available else None

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/tests/auth/test_runtime_selection.py

@@ -83,53 +83,64 @@ def test_switch_drains_and_hands_off_without_changing_binding(runtime):
     assert runtime.client.get("/data-sources/").status_code == 503
 
 
-def test_hosted_source_can_be_saved_before_switch_without_changing_local_binding(runtime, monkeypatch):
-    from metatables.api.app.bootstrap import RuntimeBootstrap
-
-    inspect = RuntimeBootstrap.inspect
-    migrations = RuntimeBootstrap.migration_descriptor
-    def inspect_without_remote_connection(self):
-        if self.config.local_mode:
-            return inspect(self)
-        self.status, self.error, self.current = "migration_required", None, []
-    def migration_without_remote_connection(self):
-        if self.config.local_mode:
-            return migrations(self)
-        return dict(current_revisions=[], required_revisions=self.expected,
-                    pending_revisions=self.expected, migration_status="pending", migration_error=None)
-    monkeypatch.setattr(RuntimeBootstrap, "inspect", inspect_without_remote_connection)
-    monkeypatch.setattr(RuntimeBootstrap, "migration_descriptor", migration_without_remote_connection)
-
-    before = runtime.client.get("/runtime-context/").json()
-    candidate = {"display_name": "Hosted catalog", "class_type": "postgresql", "configuration": {
-        "host": "db.example.invalid", "port": 5432, "database_name": "metatables",
-        "database_user": "metatables", "ssl_mode": "disable"}}
-    registered = runtime.client.post("/data-sources/", json=candidate)
+def test_local_mode_lists_and_selects_only_its_own_sources(runtime):
+    registered = runtime.client.post("/data-sources/", json={"display_name": "Reporting", "class_type": "postgresql",
+        "configuration": {"host": "db.example.invalid", "database_name": "reports", "database_user": "reader"}})
     assert registered.status_code == 201, registered.text
     uid = registered.json()["uid"]
+    registry = runtime.root / ".local/runtime-source-candidates.json"
+    assert not registry.exists()
+    # A Hosted registration never appears in, or becomes selectable from, Local.
+    hosted_uid = str(uuid4())
+    registry.write_text(json.dumps({hosted_uid: {
+        "uid": hosted_uid, "display_name": "Hosted catalog", "class_type": "postgresql",
+        "storage_access_mode": "read_write", "status": "REGISTERED", "is_default": False,
+        "created_at": "2026-10-02T10:00:00+00:00", "configuration": {
+            "host": "db.example.invalid", "database_name": "metatables", "database_user": "metatables",
+            "password_secret_uid": str(uuid4())}}}))
     listed = runtime.client.get("/data-sources/").json()
     assert {row["uid"] for row in listed["results"]} == {uid, str(runtime.workspace.data_source.uid)}
-    assert next(row for row in listed["results"] if row["class_type"] == "sqlite")["can_manage"] is False
-    assert runtime.client.get(f"/data-sources/{uid}/summary/").status_code == 200
-    response = runtime.client.post("/runtime-bootstrap/hosted/select/", json={"source_uid": uid})
-    assert response.status_code == 200, response.text
-    after = runtime.client.get("/runtime-context/").json()
-    assert after["local_mode"] is True
-    assert after["runtime_instance_id"] == before["runtime_instance_id"]
-    assert after["bootstrap"]["active"] is True
-    assert after["data_source"] == before["data_source"]
-    assert after["hosted_bootstrap"]["candidate"]["display_name"] == "Hosted catalog"
-    assert after["hosted_bootstrap"]["selected_source_uid"] == uid
-    assert runtime.client.get(f"/data-sources/{uid}/").json()["can_manage"] is False
-    assert runtime.client.patch(f"/data-sources/{uid}/", json={"display_name": "Changed"}).status_code == 409
-    assert runtime.client.delete(f"/data-sources/{uid}/").status_code == 409
-    assert not runtime.events and not (runtime.root / "request.json").exists()
-    saved = json.loads((runtime.root / ".local/runtime-data-sources.json").read_text())
-    assert saved["hosted"]["display_name"] == "Hosted catalog"
-    assert saved["local"]["class_type"] == "sqlite"
-    rejected = runtime.client.post("/runtime-bootstrap/hosted/select/", json={"source_uid": str(uuid4())})
-    assert rejected.status_code == 404
-    assert runtime.client.get("/runtime-context/").json()["hosted_bootstrap"]["candidate"]["display_name"] == "Hosted catalog"
+    assert runtime.client.get(f"/data-sources/{hosted_uid}/").status_code == 404
+    for source_uid in (uid, hosted_uid):
+        response = runtime.client.post("/runtime-bootstrap/select/", json={"source_uid": source_uid})
+        assert response.status_code == 409, response.text
+    assert runtime.client.post("/runtime-bootstrap/hosted/select/", json={"source_uid": uid}).status_code == 404
+    assert "hosted_bootstrap" not in runtime.client.get("/runtime-context/").json()
+    assert runtime.client.patch(f"/data-sources/{uid}/", json={"display_name": "Reporting warehouse"}).status_code == 200
+    assert json.loads(registry.read_text()).keys() == {hosted_uid}
+
+
+def test_hosted_mode_registers_and_selects_with_sdk_secret_references(tmp_path, monkeypatch):
+    from mainsequence.client import Secret
+
+    from metatables.api.app.auth.boundary import AdmittedCaller, admit_request
+    from metatables.api.app.bootstrap import RuntimeBootstrap
+    configuration = tmp_path / "configuration.yaml"
+    configuration.write_text("local_mode_available: false\n")
+    secret_uid = uuid4()
+    monkeypatch.setattr(Secret, "create", lambda **kwargs: SimpleNamespace(uid=str(secret_uid)))
+    def inspect_without_remote_connection(self):
+        self.status, self.error, self.current = "migration_required", None, []
+    monkeypatch.setattr(RuntimeBootstrap, "inspect", inspect_without_remote_connection)
+    monkeypatch.setattr(RuntimeBootstrap, "migration_descriptor", lambda self: dict(
+        current_revisions=[], required_revisions=self.expected, pending_revisions=self.expected,
+        migration_status="pending", migration_error=None))
+    app = create_app(RuntimeConfig(local_mode=False, configuration_path=configuration))
+    app.dependency_overrides[admit_request] = lambda: AdmittedCaller(user_uid=uuid4(), is_admin=True)
+    with TestClient(app) as client:
+        created = client.post("/data-sources/", json={"display_name": "Hosted catalog", "class_type": "timescale_db",
+            "password": "hosted-test-password", "configuration": {"host": "db.example.invalid",
+                "database_name": "metatables", "database_user": "metatables", "ssl_mode": "disable"}})
+        assert created.status_code == 201, created.text
+        uid = created.json()["uid"]
+        assert created.json()["configuration"]["password_secret_uid"] == str(secret_uid)
+        selected = client.post("/runtime-bootstrap/select/", json={"source_uid": uid})
+        assert selected.status_code == 200, selected.text
+        assert selected.json()["selected_source_uid"] == uid
+        assert selected.json()["candidate"]["configuration"]["password_secret_uid"] == str(secret_uid)
+        assert client.post("/runtime-bootstrap/select/", json={"source_uid": str(uuid4())}).status_code == 404
+    saved = json.loads((tmp_path / ".local/runtime-data-sources.json").read_text())
+    assert saved["hosted_source_uid"] == uid and "local" not in saved
 
 
 def test_registered_sources_can_be_managed_before_runtime_selection(runtime, monkeypatch):
@@ -151,10 +162,9 @@ def test_registered_sources_can_be_managed_before_runtime_selection(runtime, mon
     assert runtime.client.get("/runtime-source-candidates/").status_code == 404
 
 
-def test_password_registration_and_rotation_store_only_secret_uid_before_switch(runtime, monkeypatch):
+def test_local_password_registration_and_rotation_use_local_credentials(runtime, monkeypatch):
     from mainsequence.client import Secret
 
-    from metatables.api.app.source_registrations import registry_path
     created = []
     from metatables.api.backend.integrations.local_credentials import LocalCredentialStore
     original_create = LocalCredentialStore.create
@@ -173,10 +183,9 @@ def test_password_registration_and_rotation_store_only_secret_uid_before_switch(
     response = runtime.client.patch(f"/data-sources/{uid}/", json={"password": "second-password"})
     assert response.status_code == 200, response.text
     assert response.json()["configuration"]["password_secret_uid"] == str(created[1][0])
-    saved = registry_path(SimpleNamespace(app=runtime.app)).read_text()
-    assert "first-password" not in saved and "second-password" not in saved
+    # Local registrations stay in the local catalog; nothing reaches the Hosted registry.
+    assert not (runtime.root / ".local/runtime-source-candidates.json").exists()
     assert created[0][1] == "first-password" and created[1][1] == "second-password"
-    assert "password" not in json.loads(saved)[uid]
 
 
 def test_disabled_capability_and_unsupervised_process_cannot_switch(runtime):

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/tests/e2e/test_data_source_registry.py

@@ -225,8 +225,7 @@ def test_management_is_admin_only_and_no_plaintext_configuration(registry):
     listed = next(row for row in listing.json()['results'] if row['uid'] == uid)
     assert listed['configuration'] is None and not listed['can_manage']
     assert f.http.get(f'/data-sources/{uid}/summary/').status_code == 200
-    for path in ('/runtime-bootstrap/select/', '/runtime-bootstrap/hosted/select/'):
-        assert f.http.post(path, json={'source_uid': uid}).status_code == 403
+    assert f.http.post('/runtime-bootstrap/select/', json={'source_uid': uid}).status_code == 403
     assert f.http.patch(f'/data-sources/{uid}/', json={'display_name': 'stolen'}).status_code == 403
     assert f.http.delete(f'/data-sources/{uid}/').status_code == 403
     # Creator identity does not grant access after admin rights are removed.

{mainsequence_metatable-0.1.8.dev14 → mainsequence_metatable-0.1.8.dev15}/tests/e2e/test_runtime_transition.py

@@ -127,22 +127,23 @@ def test_switch_local_hosted_and_back_restarts_worker_and_preserves_stores(tmp_p
                 local = client.get("/runtime-context/").json()
                 assert local["dialect"] == "sqlite"
                 original_pid = workers[-1].pid
+                # Hosted starts uninitialized; its DataSource is registered and
+                # selected there, never prepared from Local.
+                switched = post_when_idle("/runtime-mode/", json={"mode": "hosted"})
+                assert switched.status_code == 202, switched.text
+                hosted = ready(False, local["runtime_instance_id"])
+                assert hosted["bootstrap"]["candidate"] is None
+                assert workers[-1].pid != original_pid
+                assert client.get("/data-sources/", headers={"X-MetaTables-Runtime-Instance": local["runtime_instance_id"]}).status_code == 409
                 from sqlalchemy.engine import make_url
                 parsed = make_url(catalog)
                 registered = post_when_idle("/data-sources/", json={"display_name": "Hosted runtime", "class_type": "postgresql", "configuration": {
                     "host": parsed.host, "port": parsed.port, "database_name": parsed.database, "database_user": parsed.username, "ssl_mode": "disable", "password_secret_uid": str(uuid4())}})
                 assert registered.status_code == 201, registered.text
-                response = post_when_idle("/runtime-bootstrap/hosted/select/", json={"source_uid": registered.json()["uid"]})
+                response = post_when_idle("/runtime-bootstrap/select/", json={"source_uid": registered.json()["uid"]})
                 assert response.status_code == 200, response.text
                 assert response.json()["status"] == "migration_required"
-                assert client.get("/runtime-context/").json()["data_source"] == local["data_source"]
-                assert workers[-1].pid == original_pid
-                switched = post_when_idle("/runtime-mode/", json={"mode": "hosted"})
-                assert switched.status_code == 202, switched.text
-                hosted = ready(False, local["runtime_instance_id"])
-                assert hosted["bootstrap"]["candidate"]["display_name"] == "Hosted runtime"
-                assert workers[-1].pid != original_pid
-                assert client.get("/data-sources/", headers={"X-MetaTables-Runtime-Instance": local["runtime_instance_id"]}).status_code == 409
+                assert response.json()["candidate"]["display_name"] == "Hosted runtime"
                 response = post_when_idle("/runtime-bootstrap/migrate/", timeout=30)
                 assert response.status_code == 200, response.text
                 hosted = client.get("/runtime-context/").json()
@@ -154,18 +155,13 @@ def test_switch_local_hosted_and_back_restarts_worker_and_preserves_stores(tmp_p
                 assert post_when_idle("/runtime-mode/", json={"mode": "local"}).status_code == 202
                 back = ready(True, hosted["runtime_instance_id"])
                 assert back["data_source"]["uid"] == local["data_source"]["uid"]
-                # Saved registrations remain selectable across runtime switches.
-                # Only the local SQLite source is the active default on return.
+                # Each mode lists only its own registrations.
                 sources = client.get("/data-sources/").json()["results"]
-                assert {row["uid"] for row in sources} == {
-                    local["data_source"]["uid"], registered.json()["uid"], hosted_uid,
-                }
-                assert [row["uid"] for row in sources if row["is_default"]] == [
-                    local["data_source"]["uid"]
-                ]
+                assert [row["uid"] for row in sources] == [local["data_source"]["uid"]]
                 assert post_when_idle("/runtime-mode/", json={"mode": "hosted"}).status_code == 202
                 ready(False, back["runtime_instance_id"])
                 assert client.get(f"/data-sources/{hosted_uid}/").status_code == 200
+                assert client.get(f"/data-sources/{registered.json()['uid']}/").status_code == 200
                 deadline = time.monotonic() + 2
                 while json.loads(supervisor.selection.read_text())["mode"] != "hosted" and time.monotonic() < deadline:
                     time.sleep(.02)