mainsequence 9.0.12.dev51__tar.gz → 9.0.13__tar.gz

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.12.dev51
+Version: 9.0.13
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/mainsequence/cli/config.py

@@ -75,6 +75,8 @@ KEYCHAIN_ACCOUNT = "default"
 AUTH_RECORD_VERSION = 1
 # Credential entries a project `.env` must not hold. The CLI removes them and
 # never writes them; the session lives in the operating system credential store.
+# The runtime credential secret and `MAINSEQUENCE_TOKEN` are no longer read: they
+# stay listed so that an entry an earlier version left in a checkout is removed.
 PROJECT_ENV_CREDENTIAL_KEYS = (
     "MAINSEQUENCE_ACCESS_TOKEN",
     "MAINSEQUENCE_REFRESH_TOKEN",
@@ -805,7 +807,7 @@ def session_report() -> dict:
     refresh_expires_at = token_expiry(refresh)
 
     if auth_mode == "runtime_credential":
-        # The credential is an ID with a bootstrap secret or an identity token file.
+        # The credential is an ID with the identity token file that proves it.
         authenticated = bool(access or runtime_credential_configured())
         session_expires_at = None
     elif refresh:

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/mainsequence/client/models_user.py

@@ -983,8 +983,10 @@ class User(_CallerDirectoryReadMixin, UserApiBaseObjectOrm, BasePydanticModel):
     ``User.filter(identity_type="workload")``. Its row carries ``uid``,
     ``identity_type`` (``"workload"``), ``is_active`` and the UID of its
     workload in ``job_uid``, ``resource_release_uid`` or ``agent_uid``, without
-    a username, email, join date or name. Fields the row does not carry are
-    ``None``, or empty for lists.
+    a username, email, join date or person's name. A listed row of a workload
+    the caller can view also carries ``workload_name``, the name of that Job,
+    release or Agent; a lookup by UID does not. Fields the row does not carry
+    are ``None``, or empty for lists.
 
     The reverse direction is ``workload_user_uid`` on ``Job``,
     ``ResourceRelease`` and ``Agent``: the UID of the User that workload runs
@@ -1059,6 +1061,16 @@ class User(_CallerDirectoryReadMixin, UserApiBaseObjectOrm, BasePydanticModel):
         description="UID of the Agent a workload identity belongs to; None otherwise.",
         examples=[None],
     )
+    workload_name: str | None = Field(
+        None,
+        title="Workload Name",
+        description=(
+            "Name of the Job, release or Agent a workload identity belongs to, on a "
+            "listed row of a workload the caller can view. None otherwise, including "
+            "on a lookup by UID and on a person."
+        ),
+        examples=["nightly-prices"],
+    )
     managed_by_caller: bool | None = Field(
         None,
         title="Managed By Caller",

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/mainsequence/client/utils.py

@@ -23,8 +23,6 @@ from mainsequence.defaults import resolve_backend_endpoint
 from mainsequence.logconf import logger
 from mainsequence.runtime_credential_exchange import (
     RUNTIME_CREDENTIAL_ID_ENV,
-    RUNTIME_CREDENTIAL_SECRET_ENV,
-    RUNTIME_IDENTITY_TOKEN_FILE_ENV,
     RuntimeIdentityTokenError,
     exchange_runtime_credential,
     identity_token_file_from_environment,
@@ -321,17 +319,16 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
     """
     Exchange the runtime credential the platform injected for short-lived access tokens.
 
-    The proof is the projected workload identity token when
-    `MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE` is set: the file is read for every
-    exchange, and `MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET` is never read or sent.
-    Otherwise the proof is that bootstrap secret. The token is never kept on the
-    provider, and the secret is left out of `repr()` and `str()`. Throttled
-    (`429`) and temporarily unavailable (`503`) exchanges are retried within the
-    timeout budget; a rejected one (`401`) fails at once.
+    The proof is the projected workload identity token in the file named by
+    `MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`, read for every exchange. It is the
+    only proof: an unset variable, or a missing, unreadable or empty file, raises
+    `AuthError` instead of sending the exchange. The token is never kept on the
+    provider.
+    Throttled (`429`) and temporarily unavailable (`503`) exchanges are retried
+    within the timeout budget; a rejected one (`401`) fails at once.
     """
 
     credential_id: str | None = None
-    credential_secret: str | None = field(default=None, repr=False)
     token_url: str | None = None
     token_type: str = "Bearer"
     refresh_skew_seconds: int = 30
@@ -347,8 +344,6 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
             self.identity_token_file = identity_token_file_from_environment()
         else:
             self.identity_token_file = str(self.identity_token_file).strip() or None
-        if self.credential_secret is None and not self.identity_token_file:
-            self.credential_secret = os.getenv(RUNTIME_CREDENTIAL_SECRET_ENV)
         if not self.token_url:
             self.token_url = f"{API_ENDPOINT}/runtime-credentials/token/"
 
@@ -376,19 +371,11 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
 
     def _exchange(self) -> requests.Response:
         credential_id = (self.credential_id or "").strip()
-        identity_token_file = self.identity_token_file
-        credential_secret = None if identity_token_file else (self.credential_secret or "").strip()
         if not credential_id:
             raise AuthError(
                 "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID is required when "
                 "MAINSEQUENCE_AUTH_MODE=runtime_credential."
             )
-        if not identity_token_file and not credential_secret:
-            raise AuthError(
-                "MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET is required when "
-                "MAINSEQUENCE_AUTH_MODE=runtime_credential and "
-                f"{RUNTIME_IDENTITY_TOKEN_FILE_ENV} is not set."
-            )
         try:
             # One budget for every attempt and wait, inside the caller's budget if any.
             with request_budget(self.timeout) as budget:
@@ -405,8 +392,7 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
                 return exchange_runtime_credential(
                     post,
                     credential_id=credential_id,
-                    credential_secret=credential_secret,
-                    identity_token_file=identity_token_file,
+                    identity_token_file=self.identity_token_file,
                     deadline=budget.deadline,
                     on_retry=self._log_exchange_retry,
                 )

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/mainsequence/logconf.py

@@ -25,7 +25,6 @@ from .instrumentation import OTelJSONRenderer
 from .repository_identity_security import UNSUPPORTED_SOURCE_IDENTITY_ENV_NAMES
 from .runtime_credential_exchange import (
     RUNTIME_CREDENTIAL_ID_ENV,
-    RUNTIME_CREDENTIAL_SECRET_ENV,
     exchange_runtime_credential,
     identity_token_file_from_environment,
     runtime_credential_configured,
@@ -104,7 +103,6 @@ def _request_job_startup_state(*, timeout_s: float = 10.0) -> dict[str, Any]:
     def _exchange_runtime_credential() -> bool:
         if not runtime_credential_configured():
             return False
-        identity_token_file = identity_token_file_from_environment()
         token_url = f"{_backend_base_url()}/api/v1/runtime-credentials/token/"
 
         def _post(body: dict[str, str]) -> requests.Response:
@@ -120,12 +118,7 @@ def _request_job_startup_state(*, timeout_s: float = 10.0) -> dict[str, Any]:
             token_resp = exchange_runtime_credential(
                 _post,
                 credential_id=(os.getenv(RUNTIME_CREDENTIAL_ID_ENV) or "").strip(),
-                credential_secret=(
-                    None
-                    if identity_token_file
-                    else (os.getenv(RUNTIME_CREDENTIAL_SECRET_ENV) or "").strip()
-                ),
-                identity_token_file=identity_token_file,
+                identity_token_file=identity_token_file_from_environment(),
                 deadline=time.monotonic() + timeout_s,
             )
         except Exception:

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/mainsequence/runtime_credential_exchange.py

@@ -3,13 +3,11 @@ The runtime credential exchange, shared by the auth provider and the logger.
 
 A runtime started with ``MAINSEQUENCE_AUTH_MODE=runtime_credential`` exchanges its
 credential at ``POST /api/v1/runtime-credentials/token/`` for a short-lived access
-token. The request carries ``credential_id`` and exactly one proof:
-
-* ``workload_identity_token`` when ``MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`` is
-  set: the projected token read from that file for every exchange, because the
-  file is rotated. The bootstrap secret is then never read or sent, and a missing,
-  unreadable or empty file is an error, never a fallback to the secret.
-* ``credential_secret`` otherwise: ``MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET``.
+token. The request carries exactly ``credential_id`` and ``workload_identity_token``:
+the projected token read from the file named by
+``MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`` for every exchange, because the file is
+rotated. That token is the only proof. An unset variable and a missing, unreadable
+or empty file are errors, raised instead of sending the request.
 
 The token exists only inside one exchange request. It is not kept on any object,
 written to the environment or a file, logged, or included in an error message.
@@ -29,7 +27,6 @@ from urllib3.exceptions import InvalidHeader
 from urllib3.util import Retry
 
 RUNTIME_CREDENTIAL_ID_ENV = "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID"
-RUNTIME_CREDENTIAL_SECRET_ENV = "MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET"
 RUNTIME_IDENTITY_TOKEN_FILE_ENV = "MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE"
 
 # 429: the exchange is throttled. 503: verification is temporarily unavailable.
@@ -42,7 +39,7 @@ _RETRY_AFTER = Retry(total=0)
 
 
 class RuntimeIdentityTokenError(Exception):
-    """The runtime identity token file cannot be used. The message never holds its content."""
+    """The identity token file is unset or cannot be used. The message never holds its content."""
 
 
 def _environment_value(name: str) -> str:
@@ -58,18 +55,22 @@ def runtime_credential_configured() -> bool:
     """
     Say whether the environment holds a runtime credential to exchange.
 
-    That is a credential ID and one proof: the identity token file, or else the
-    bootstrap secret. Only the presence of the setting is checked. The token file
-    is read by the exchange itself, which reports a missing or empty file.
+    That is a credential ID and the identity token file that proves it. Only the
+    presence of both settings is checked. The token file is read by the exchange
+    itself, which reports a missing or empty file.
     """
-    if not _environment_value(RUNTIME_CREDENTIAL_ID_ENV):
-        return False
-    if identity_token_file_from_environment():
-        return True
-    return bool(_environment_value(RUNTIME_CREDENTIAL_SECRET_ENV))
+    return bool(
+        _environment_value(RUNTIME_CREDENTIAL_ID_ENV) and identity_token_file_from_environment()
+    )
 
 
-def _read_identity_token(path: str) -> str:
+def _read_identity_token(path: str | None) -> str:
+    if not path:
+        raise RuntimeIdentityTokenError(
+            f"{RUNTIME_IDENTITY_TOKEN_FILE_ENV} is required when "
+            "MAINSEQUENCE_AUTH_MODE=runtime_credential: a runtime credential is exchanged "
+            "only with the projected workload identity token in that file."
+        )
     source = f"The runtime identity token file {path} ({RUNTIME_IDENTITY_TOKEN_FILE_ENV})"
     try:
         with open(path, "rb") as token_file:
@@ -92,17 +93,11 @@ def _read_identity_token(path: str) -> str:
     return token
 
 
-def _request_body(
-    credential_id: str,
-    credential_secret: str | None,
-    identity_token_file: str | None,
-) -> dict[str, str]:
-    if identity_token_file:
-        return {
-            "credential_id": credential_id,
-            "workload_identity_token": _read_identity_token(identity_token_file),
-        }
-    return {"credential_id": credential_id, "credential_secret": credential_secret or ""}
+def _request_body(credential_id: str, identity_token_file: str | None) -> dict[str, str]:
+    return {
+        "credential_id": credential_id,
+        "workload_identity_token": _read_identity_token(identity_token_file),
+    }
 
 
 def _retry_delay(response: Any, attempt: int) -> float:
@@ -120,7 +115,6 @@ def exchange_runtime_credential(
     send: Callable[[dict[str, str]], Any],
     *,
     credential_id: str,
-    credential_secret: str | None,
     identity_token_file: str | None,
     deadline: float,
     on_retry: Callable[[int, float], None] | None = None,
@@ -135,8 +129,6 @@ def exchange_runtime_credential(
         response. It is called once per attempt.
     credential_id:
         The runtime credential ID.
-    credential_secret:
-        The bootstrap secret. Ignored when ``identity_token_file`` is set.
     identity_token_file:
         The projected token file. It is read again for every attempt.
     deadline:
@@ -147,12 +139,12 @@ def exchange_runtime_credential(
     A ``429`` or ``503`` answer is retried up to ``EXCHANGE_RETRIES`` times. The
     wait is the exponential backoff or the answer's ``Retry-After``, whichever is
     longer; a wait that would not end before ``deadline`` ends the retries. Any
-    other answer, ``401`` included, is returned at once and the proof is never
-    switched. ``RuntimeIdentityTokenError`` is raised when the token file cannot
-    be used.
+    other answer, ``401`` included, is returned at once. ``RuntimeIdentityTokenError``
+    is raised instead of sending an attempt when ``identity_token_file`` is not set
+    or the file cannot be used.
     """
     for attempt in range(EXCHANGE_RETRIES + 1):
-        response = send(_request_body(credential_id, credential_secret, identity_token_file))
+        response = send(_request_body(credential_id, identity_token_file))
         status = response.status_code
         if status not in RETRYABLE_EXCHANGE_STATUSES or attempt == EXCHANGE_RETRIES:
             return response

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.12.dev51
+Version: 9.0.13
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.12.dev51"
+version = "9.0.13"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/tests/test_auth_precedence.py

@@ -41,6 +41,13 @@ def _jwt_with_exp(exp: int) -> str:
     return f"{header}.{payload}.signature"
 
 
+def _use_identity_token_file(monkeypatch, directory) -> str:
+    token_file = directory / "token"
+    token_file.write_text("projected-token", encoding="utf-8")
+    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", str(token_file))
+    return str(token_file)
+
+
 def test_build_default_auth_provider_uses_jwt(monkeypatch):
     monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
     monkeypatch.delenv("MAINSEQUENCE_REFRESH_TOKEN", raising=False)
@@ -110,12 +117,12 @@ def test_logconf_refreshes_jwt_before_startup_state_request(monkeypatch):
     assert get_calls[0]["headers"]["Authorization"] == "Bearer jwt-access"
 
 
-def test_logconf_runtime_credential_exchanges_before_startup_state_request(monkeypatch):
+def test_logconf_runtime_credential_exchanges_before_startup_state_request(monkeypatch, tmp_path):
     monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
     monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", "must-not-be-used")
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    _use_identity_token_file(monkeypatch, tmp_path)
     monkeypatch.setenv("JOB_RUN_UID", "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa")
     monkeypatch.setenv("MAINSEQUENCE_ENDPOINT", "https://backend.example")
 
@@ -147,7 +154,7 @@ def test_logconf_runtime_credential_exchanges_before_startup_state_request(monke
             "headers": {"Content-Type": "application/json"},
             "json": {
                 "credential_id": "cred-id",
-                "credential_secret": "cred-secret",
+                "workload_identity_token": "projected-token",
             },
             "timeout": 10.0,
             "allow_redirects": False,
@@ -158,12 +165,12 @@ def test_logconf_runtime_credential_exchanges_before_startup_state_request(monke
     assert get_calls[0]["headers"]["Authorization"] == "Bearer runtime-access"
 
 
-def test_logconf_runtime_credential_retries_after_auth_failure(monkeypatch):
+def test_logconf_runtime_credential_retries_after_auth_failure(monkeypatch, tmp_path):
     monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", "stale-runtime-access")
     monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", "must-not-be-used")
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    _use_identity_token_file(monkeypatch, tmp_path)
     monkeypatch.setenv("JOB_RUN_UID", "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa")
     monkeypatch.setenv("MAINSEQUENCE_ENDPOINT", "https://backend.example")
 
@@ -197,11 +204,11 @@ def test_logconf_runtime_credential_retries_after_auth_failure(monkeypatch):
     assert os.environ["MAINSEQUENCE_ACCESS_TOKEN"] == "fresh-runtime-access"
 
 
-def test_runtime_credential_provider_exchanges_and_writes_access_token(monkeypatch):
+def test_runtime_credential_provider_exchanges_and_writes_access_token(monkeypatch, tmp_path):
     monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
     monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", "must-not-be-used")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    _use_identity_token_file(monkeypatch, tmp_path)
 
     utils = _load_mainsequence_submodule("mainsequence.client.utils")
     runtime_context_module = importlib.import_module("mainsequence.code_repository_context")
@@ -238,7 +245,7 @@ def test_runtime_credential_provider_exchanges_and_writes_access_token(monkeypat
     assert headers["Authorization"] == "Bearer runtime-access"
     assert calls[0]["json"] == {
         "credential_id": "cred-id",
-        "credential_secret": "cred-secret",
+        "workload_identity_token": "projected-token",
     }
     assert calls[0]["url"].endswith("/api/v1/runtime-credentials/token/")
     assert calls[0]["headers"]["Content-Type"] == "application/json"
@@ -254,11 +261,11 @@ def test_runtime_credential_provider_exchanges_and_writes_access_token(monkeypat
     ]
 
 
-def test_runtime_credential_provider_reuses_valid_exchanged_access_token(monkeypatch):
+def test_runtime_credential_provider_reuses_valid_exchanged_access_token(monkeypatch, tmp_path):
     monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
     monkeypatch.delenv("MAINSEQUENCE_REFRESH_TOKEN", raising=False)
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    _use_identity_token_file(monkeypatch, tmp_path)
 
     utils = _load_mainsequence_submodule("mainsequence.client.utils")
     calls = {"count": 0}
@@ -286,11 +293,11 @@ def test_runtime_credential_provider_reuses_valid_exchanged_access_token(monkeyp
 
 
 def test_runtime_credential_provider_does_not_mutate_unsupported_identity_environment(
-    monkeypatch,
+    monkeypatch, tmp_path
 ):
     monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    _use_identity_token_file(monkeypatch, tmp_path)
     monkeypatch.setenv(
         _UNSUPPORTED_REPOSITORY_BRANCH_UID_ENV,
         "caller-supplied-value-must-be-ignored",
@@ -325,11 +332,11 @@ def test_runtime_credential_provider_does_not_mutate_unsupported_identity_enviro
     )
 
 
-def test_runtime_credential_provider_force_refresh_exchanges_again(monkeypatch):
+def test_runtime_credential_provider_force_refresh_exchanges_again(monkeypatch, tmp_path):
     monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
     monkeypatch.delenv("MAINSEQUENCE_REFRESH_TOKEN", raising=False)
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    _use_identity_token_file(monkeypatch, tmp_path)
 
     utils = _load_mainsequence_submodule("mainsequence.client.utils")
     calls = {"count": 0}
@@ -355,11 +362,11 @@ def test_runtime_credential_provider_force_refresh_exchanges_again(monkeypatch):
     assert calls["count"] == 2
 
 
-def test_runtime_credential_provider_exchanges_near_expiry_access_token(monkeypatch):
+def test_runtime_credential_provider_exchanges_near_expiry_access_token(monkeypatch, tmp_path):
     monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", _jwt_with_exp(int(time.time()) + 10))
     monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", "must-not-be-used")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    _use_identity_token_file(monkeypatch, tmp_path)
 
     utils = _load_mainsequence_submodule("mainsequence.client.utils")
     calls: list[dict] = []
@@ -386,12 +393,12 @@ def test_runtime_credential_provider_exchanges_near_expiry_access_token(monkeypa
     assert len(calls) == 1
 
 
-def test_runtime_credential_make_request_401_forces_exchange_and_retry(monkeypatch):
+def test_runtime_credential_make_request_401_forces_exchange_and_retry(monkeypatch, tmp_path):
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", "stale-runtime-access")
     monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", "must-not-be-used")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    _use_identity_token_file(monkeypatch, tmp_path)
 
     utils = _load_mainsequence_submodule("mainsequence.client.utils")
     post_calls: list[dict] = []
@@ -441,7 +448,7 @@ def test_runtime_credential_make_request_401_forces_exchange_and_retry(monkeypat
     assert len(post_calls) == 1
     assert post_calls[0]["json"] == {
         "credential_id": "cred-id",
-        "credential_secret": "cred-secret",
+        "workload_identity_token": "projected-token",
     }
     assert os.environ["MAINSEQUENCE_ACCESS_TOKEN"] == "fresh-runtime-access"
     assert os.environ["MAINSEQUENCE_REFRESH_TOKEN"] == "must-not-be-used"
@@ -451,7 +458,7 @@ def test_runtime_credential_provider_requires_credential_env(monkeypatch):
     monkeypatch.delenv("MAINSEQUENCE_ACCESS_TOKEN", raising=False)
     monkeypatch.delenv("MAINSEQUENCE_REFRESH_TOKEN", raising=False)
     monkeypatch.delenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", raising=False)
-    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", raising=False)
+    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", raising=False)
 
     utils = _load_mainsequence_submodule("mainsequence.client.utils")
 
@@ -463,12 +470,12 @@ def test_runtime_credential_provider_requires_credential_env(monkeypatch):
         assert "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID is required" in str(exc)
 
 
-def test_build_default_auth_provider_uses_runtime_credential_mode(monkeypatch):
+def test_build_default_auth_provider_uses_runtime_credential_mode(monkeypatch, tmp_path):
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", "jwt-access")
     monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", "jwt-refresh")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    token_file = _use_identity_token_file(monkeypatch, tmp_path)
 
     utils = _load_mainsequence_submodule("mainsequence.client.utils")
 
@@ -476,15 +483,15 @@ def test_build_default_auth_provider_uses_runtime_credential_mode(monkeypatch):
 
     assert isinstance(provider, utils.RuntimeCredentialAuthProvider)
     assert provider.credential_id == "cred-id"
-    assert provider.credential_secret == "cred-secret"
+    assert provider.identity_token_file == token_file
 
 
-def test_auth_loaders_switch_to_runtime_credential_mode(monkeypatch):
+def test_auth_loaders_switch_to_runtime_credential_mode(monkeypatch, tmp_path):
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", "jwt-access")
     monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", "jwt-refresh")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    token_file = _use_identity_token_file(monkeypatch, tmp_path)
 
     utils = _load_mainsequence_submodule("mainsequence.client.utils")
     loaders = utils.AuthLoaders()
@@ -494,7 +501,7 @@ def test_auth_loaders_switch_to_runtime_credential_mode(monkeypatch):
 
     assert isinstance(provider, utils.RuntimeCredentialAuthProvider)
     assert provider.credential_id == "cred-id"
-    assert provider.credential_secret == "cred-secret"
+    assert provider.identity_token_file == token_file
 
 
 def test_build_default_auth_provider_defaults_to_jwt_when_mode_unset(monkeypatch):

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/tests/test_canonical_api_route_contract.py

@@ -107,10 +107,7 @@ def test_client_auth_provider_routes_match_backend_contract(monkeypatch):
         access_token="access",
         refresh_token="refresh",
     )
-    runtime_provider = utils.RuntimeCredentialAuthProvider(
-        credential_id="credential-id",
-        credential_secret="credential-secret",
-    )
+    runtime_provider = utils.RuntimeCredentialAuthProvider(credential_id="credential-id")
 
     assert jwt_provider.obtain_url == "https://backend.example/auth/jwt-token/token/"
     assert jwt_provider.refresh_url == "https://backend.example/auth/jwt-token/token/refresh/"

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/tests/test_cli_secure_storage.py

@@ -1011,30 +1011,28 @@ def test_session_report_judges_the_session_by_its_refresh_token(monkeypatch, tmp
 def test_session_report_for_a_runtime_credential_has_no_session_expiry(monkeypatch, tmp_path):
     _isolate_auth(monkeypatch, tmp_path, None)
     monkeypatch.setattr(config, "auth_persistence_label", lambda: "test store")
+    token_file = tmp_path / "token"
+    token_file.write_text("projected-token", encoding="utf-8")
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "cred-secret")
+    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", str(token_file))
 
     report = config.session_report()
 
     assert report["authenticated"] is True
     assert report["session_expires_at"] is None
     assert report["auth_mode"] == "runtime_credential"
-    assert "cred-secret" not in json.dumps(report)
+    assert "projected-token" not in json.dumps(report)
 
 
-def test_session_report_accepts_a_runtime_identity_token_file(monkeypatch, tmp_path):
+def test_session_report_needs_the_runtime_identity_token_file(monkeypatch, tmp_path):
     _isolate_auth(monkeypatch, tmp_path, None)
     monkeypatch.setattr(config, "auth_persistence_label", lambda: "test store")
-    token_file = tmp_path / "token"
-    token_file.write_text("projected-token", encoding="utf-8")
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", raising=False)
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", str(token_file))
+    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", raising=False)
 
     report = config.session_report()
 
-    assert report["authenticated"] is True
-    assert report["session_expires_at"] is None
-    assert "projected-token" not in json.dumps(report)
+    assert report["authenticated"] is False
+    assert report["auth_mode"] == "runtime_credential"

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/tests/test_code_repository_runtime_context.py

@@ -368,21 +368,12 @@ def test_authenticated_runtime_context_detects_git_drift(monkeypatch):
         code_repository_context.validate_code_repository_source_context(context=context)
 
 
-@pytest.mark.parametrize(
-    ("proof_variable", "proof_value"),
-    [
-        ("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "credential-secret"),
-        ("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", "/var/run/secrets/runtime-identity/token"),
-    ],
-)
-def test_configured_runtime_credential_exchanges_context_before_resolution(
-    monkeypatch, proof_variable, proof_value
-):
+def test_configured_runtime_credential_exchanges_context_before_resolution(monkeypatch):
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "credential-id")
-    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", raising=False)
-    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", raising=False)
-    monkeypatch.setenv(proof_variable, proof_value)
+    monkeypatch.setenv(
+        "MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", "/var/run/secrets/runtime-identity/token"
+    )
     events = []
     monkeypatch.setattr(
         code_repository_context,

{mainsequence-9.0.12.dev51 → mainsequence-9.0.13}/tests/test_credential_repr.py

@@ -15,21 +15,15 @@ from mainsequence.cli.browser_auth import BrowserAuthCallback
 from mainsequence.client.agent_runtime_models import AgentSessionRuntimeAccess
 from mainsequence.client.models_foundry import Secret
 from mainsequence.client.models_helpers import ResourceReleaseRuntimeAccess
-from mainsequence.client.utils import (
-    JWTAuthProvider,
-    RuntimeCredentialAuthProvider,
-    SessionJWTAuthProvider,
-)
+from mainsequence.client.utils import JWTAuthProvider, SessionJWTAuthProvider
 from tests.client.support import _ready_runtime_contract, _runtime_access_payload
 
-BOOTSTRAP_SECRET = "bootstrap-secret-7c1d"
 ACCESS_TOKEN = "access-token-5e2a"
 REFRESH_TOKEN = "refresh-token-9b4f"
 GATEWAY_TOKEN = "gateway-token-3a8e"
 RELEASE_TOKEN = "release-token-6d0c"
 AUTHORIZATION_CODE = "authorization-code-2f7b"
 SECRET_VALUE = "secret-value-8e5a"
-TOKEN_URL = "https://backend.example/api/v1/runtime-credentials/token/"
 
 
 def _shown(obj, caplog) -> str:
@@ -44,26 +38,6 @@ def _error_text(raised: pytest.ExceptionInfo) -> str:
     return f"{raised.value}\n{raised.value!r}"
 
 
-@pytest.mark.parametrize("source", ["environment", "argument"])
-def test_runtime_credential_provider_leaves_the_bootstrap_secret_out(monkeypatch, caplog, source):
-    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", raising=False)
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
-    if source == "environment":
-        monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", BOOTSTRAP_SECRET)
-        provider = RuntimeCredentialAuthProvider(token_url=TOKEN_URL)
-    else:
-        monkeypatch.delenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", raising=False)
-        provider = RuntimeCredentialAuthProvider(
-            credential_secret=BOOTSTRAP_SECRET, token_url=TOKEN_URL
-        )
-
-    shown = _shown(provider, caplog)
-
-    assert provider.credential_secret == BOOTSTRAP_SECRET
-    assert BOOTSTRAP_SECRET not in shown
-    assert "credential_id='cred-id'" in shown
-
-
 def test_jwt_provider_leaves_its_tokens_out(monkeypatch, caplog):
     monkeypatch.setenv("MAINSEQUENCE_ACCESS_TOKEN", ACCESS_TOKEN)
     monkeypatch.setenv("MAINSEQUENCE_REFRESH_TOKEN", REFRESH_TOKEN)