mainsequence 9.0.14.dev56__py3-none-any.whl → 9.0.15.dev57__py3-none-any.whl

agent_scaffold/AGENTS.md

@@ -81,7 +81,8 @@ bundle. Platform skills are installed separately under
   `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`
 - Jobs, schedules, images, resources, releases, and Artifacts:
   `.agents/skills/mainsequence/platform_operations/orchestration_and_releases/SKILL.md`
-- RBAC, sharing, constants, secrets, and access verification:
+- RBAC, sharing, constants, secrets, access verification, and whether an
+  application uses its own grants or acts for its requester:
   `.agents/skills/mainsequence/platform_operations/access_control_and_sharing/SKILL.md`
 - Direct recorded model calls, structured extraction, thinking/provider options,
   inference history and idempotent replay:

agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -160,6 +160,57 @@ connection is active. See the version-matched
 [FastAPI identity documentation](https://mainsequence-sdk.github.io/mainsequence-sdk/knowledge/fastapi/)
 for the lifecycle and trust contract.
 
+### Requester-bound calls
+
+Another application, for example an Agent, can call the API while it works for
+a person: the requester. The platform signs the requester into the caller
+assertion it sends to the API. `User.get_logged_user()` still returns the
+caller, the acting application. `User.get_requester()` returns the requester,
+or `None` when the call is not requester-bound:
+
+```python
+from fastapi import HTTPException
+from mainsequence.client import RequestUserIdentity, User
+
+
+def require_requester() -> RequestUserIdentity:
+    """The person this call works for; refuse the call when there is none."""
+    requester = User.get_requester()
+    if requester is None:
+        raise HTTPException(status_code=403, detail="This operation needs a requester.")
+    return requester
+
+
+@app.get("/team-reports/{team_uid}")
+def team_report(team_uid: str) -> dict[str, str]:
+    requester = require_requester()
+    if team_uid not in requester.team_uids:
+        raise HTTPException(status_code=403, detail="The requester is not in this team.")
+    return {"team_uid": team_uid, "requested_by": requester.uid}
+```
+
+- Authorize a requester-bound call against the requester. The acting
+  application has no rights of its own unless the API's policy grants them.
+- Fail closed: an operation that needs a person refuses the call when
+  `User.get_requester()` is `None`. Never fall back to the caller's rights.
+- Never read a person's UID from the request body, a header or a query
+  parameter, and never let a caller name whom it acts for. Anyone can write a
+  UID there. Only the signed assertion names the requester, and the SDK has
+  verified that it is addressed to this release.
+- The requester carries the `team_uids` the platform signed, and its
+  `is_organization_admin` is always `False`: a requester's access reaches the
+  API at member level only.
+- Inside a requester-bound call, `reads_as_caller()` raises
+  `RequestIdentityError`: the requester's access is not passed on.
+- Test both paths: the requester-bound call authorized against the requester,
+  and the same operation refused without a requester.
+
+Which applications may act for their requester, what that access covers, and
+what people are told:
+`.agents/skills/mainsequence/platform_operations/access_control_and_sharing/SKILL.md`.
+See also
+[Requester-bound calls](https://mainsequence-sdk.github.io/mainsequence-sdk/knowledge/fastapi/#requester-bound-calls).
+
 ### Public provider callbacks and webhooks
 
 An external OAuth redirect or webhook cannot supply a Main Sequence Bearer token.

agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: mainsequence-access-control-and-sharing
-description: Use this skill when the task is about RBAC, resource sharing, or access verification in a Main Sequence CodeRepository. This skill owns organization and team access concepts, view and edit semantics, choosing the correct shareable resource boundary, and access checks across CodeRepositories, constants, secrets, buckets, artifacts, and releases. It does not own job scheduling, domain-package data behavior, or API route design.
+description: Use this skill when the task is about RBAC, resource sharing, or access verification in a Main Sequence CodeRepository. This skill owns organization and team access concepts, view and edit semantics, choosing the correct shareable resource boundary, access checks across CodeRepositories, constants, secrets, buckets, artifacts, and releases, and whether an application uses its own grants or acts for its requester (`acts_for_requester`). It does not own job scheduling, domain-package data behavior, or API route design.
 ---
 
 # Main Sequence Access Control And Sharing
@@ -34,6 +34,8 @@ This skill is for:
 - choose whether configuration belongs in a `Constant` or a `Secret`
 - review CLI sharing flows for existing resources
 - verify access assumptions before claiming a workflow is shareable
+- decide whether an application uses its own grants or acts for its
+  requester, and explain what acting for the requester allows
 
 ## This Skill Must Not Claim
 
@@ -192,6 +194,81 @@ If the task claims a resource is shareable, readable, or maintainable by another
 
 Do not claim access based only on naming, role titles, or intuition.
 
+## Application Access: Own Grants Or Acting For Its Requester
+
+This section is the reference for how a deployed application, a FastAPI
+release or an Agent, reaches platform data.
+
+### Its own access: grants to its workload User
+
+An application runs as its own workload User (`workload_user_uid` on the
+`ResourceRelease`, `Job` or `Agent`). Its own access comes from grants to that
+User: share what it needs with that User as with any person, with `view`
+unless it must maintain the object. These grants cover every call the
+application makes for itself.
+
+### Acting for its requester: `acts_for_requester`
+
+An application can instead be enabled to act for its requester: the person
+whose own request it is serving. The platform setting is `acts_for_requester`.
+
+- It is `false` by default. Nothing changes for an application that leaves it
+  off.
+- Only Organization admins enable it, in one of two ways:
+  - after the application exists, with
+    `PATCH /api/v1/workload-users/<workload_user_uid>/`;
+  - in code, by declaring `acts_for_requester: true` on the resource, a
+    `fastapi` or `harness_agent` one, in the repository workflow file:
+
+    ```yaml
+    resources:
+      - key: api
+        kind: fastapi
+        spec:
+          source_path: api/main.py
+        acts_for_requester: true
+    ```
+
+    Take the exact field from the branch's workflow template and validate the
+    file before committing it. A declaration takes effect only when the person
+    who pushed it is an Organization admin. Otherwise that resource fails
+    before it deploys.
+- An application that should act only for people, for example a data analyst
+  Agent, holds no grants of its own. Do not share data with its workload User
+  to make it work: everyone who can use the application could then reach that
+  data through it.
+
+### What the requester's access covers
+
+- Read only: the application never changes, shares or deletes anything with it.
+- The requester's member level, never an admin's, even when the requester is
+  an Organization admin.
+- Never secret values.
+- At most 24 hours after the person's request, and only while the work for that
+  request runs.
+- Checked again on every call, so it stops the moment the person's access ends.
+- Never passed on to another application.
+
+### Never accept a person's UID from a request
+
+The requester comes only from the platform. An application never accepts a
+person's UID from a request body, header or query parameter, and never lets a
+caller choose whom it acts for. A FastAPI application that receives a
+requester-bound call reads the requester with `User.get_requester()` and
+authorizes the call against that person:
+`.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`.
+
+### What people are told
+
+Every client that shows an application with `acts_for_requester` shows this
+statement:
+
+> **This Agent works with your identity, securely.** It reads only what you can already read, only to answer your own requests, and for at most 24 hours after you ask. It cannot act as anyone else, cannot change, share or delete anything, never sees your secret values, and stops the moment your access ends. Your Organization's administrator approved it to work this way.
+
+Show the plain limit with it: while it works on your request, the Agent's code
+can read what you can read, which is why only administrators decide which
+Agents may work this way.
+
 ## Review Rules
 
 When reviewing an access-control task, look for:
@@ -205,6 +282,10 @@ When reviewing an access-control task, look for:
 - creating a `Constant` or `Secret` blindly without resolving whether the name already exists
 - weak or unverified claims about who can access a resource
 - confusion between access policy and deployment workflow
+- grants to an application that should act only for people
+- an application that takes a person's UID from a request instead of from the
+  platform
+- `acts_for_requester` presented as something a non-admin can enable
 
 ## Validation Checklist
 
@@ -221,6 +302,8 @@ Do not claim success until you have checked:
 - any `Constant` or `Secret` creation path first resolved existence by name when idempotency matters
 - the access claim was verified against the actual resource path
 - the task did not confuse sharing policy with orchestration or producer logic
+- an application that acts for its requester takes the person only from the
+  platform, and its own grants are intentional
 
 ## This Skill Must Stop And Escalate When
 
@@ -230,5 +313,7 @@ Do not claim success until you have checked:
 - the task asks for sensitive data to be stored in a `Constant`
 - the task assumes cross-organization sharing without explicit documentation
 - the request requires a policy decision the user has not made
+- the task needs `acts_for_requester` and no Organization admin has decided to
+  enable it
 
 Do not guess through security boundaries.

mainsequence/_request_identity.py

@@ -20,6 +20,10 @@ class _RequestScope:
     # The verified assertion of a hosted HTTP request, kept only so that
     # reads_as_caller() can present it (ADR-0036, amended for #198).
     caller_assertion: str | None = field(default=None, repr=False)
+    # The person a requester-bound request works for, verified from its
+    # assertion; None on any other request. The user stays the caller, the
+    # acting application (ADR-0036, requester-bound calls).
+    requester: Any = None
 
 
 _current_scope: ContextVar[_RequestScope | None] = ContextVar(
@@ -42,17 +46,27 @@ def _request_scope():
         scope.active = False
         scope.user = None
         scope.caller_assertion = None
+        scope.requester = None
         _current_scope.reset(token)
 
 
-def _get_request_identity():
+def _authenticated_scope(getter: str) -> _RequestScope:
     scope = _current_scope.get()
     if scope is None or not scope.active or scope.user is None:
         raise RequestIdentityError(
             "No authenticated request user is available. Install request identity "
-            "once in the application and call User.get_logged_user() inside a request."
+            f"once in the application and call {getter} inside a request."
         )
-    return scope.user
+    return scope
+
+
+def _get_request_identity():
+    return _authenticated_scope("User.get_logged_user()").user
+
+
+def _get_requester():
+    """The requester of the current request; None when it is not requester-bound."""
+    return _authenticated_scope("User.get_requester()").requester
 
 
 @contextmanager
@@ -63,6 +77,11 @@ def _reads_as_caller():
             "Reading as the caller needs an authenticated request. Install request "
             "identity once in the application and call reads_as_caller() inside a request."
         )
+    if scope.requester is not None:
+        raise RequestIdentityError(
+            "This request is requester-bound. The requester's access is not passed on, "
+            "so a requester-bound request cannot read as its caller."
+        )
     if scope.caller_assertion is None:
         raise RequestIdentityError(
             "This request carries no caller assertion. Reading as the caller needs a "

mainsequence/client/models_user.py

@@ -10,6 +10,7 @@ from mainsequence._request_identity import (
     RequestIdentityError,
     _caller_read_headers,
     _get_request_identity,
+    _get_requester,
 )
 from mainsequence.defaults import STANDARD_BACKEND_URL
 
@@ -30,7 +31,9 @@ class RequestUserIdentity(BaseModel):
     """Minimal identity of the caller of the current runtime request.
 
     The caller is a person or a workload identity; ``User.get_by_uid(uid)``
-    reads its User.
+    reads its User. ``User.get_requester()`` returns the same type for the
+    requester of a requester-bound request, the person the calling
+    application works for; its ``is_organization_admin`` is always ``False``.
     """
 
     model_config = ConfigDict(extra="forbid", frozen=True)
@@ -52,8 +55,9 @@ class RequestUserIdentity(BaseModel):
         (),
         title="Team UIDs",
         description=(
-            "Canonical UIDs of the caller's active teams, as signed by the platform "
-            "in the caller assertion. Empty when the request carries no such facts."
+            "Canonical UIDs of the caller's active teams, or the requester's, as signed "
+            "by the platform in the caller assertion. Empty when the request carries no "
+            "such facts."
         ),
     )
     is_organization_admin: bool = Field(
@@ -61,7 +65,8 @@ class RequestUserIdentity(BaseModel):
         title="Organization admin",
         description=(
             "Whether the platform signed the caller as an admin of the application's "
-            "Organization. False when the request carries no such facts."
+            "Organization. False when the request carries no such facts, and always "
+            "False for the requester of a requester-bound request."
         ),
     )
 
@@ -1299,3 +1304,30 @@ class User(_CallerDirectoryReadMixin, UserApiBaseObjectOrm, BasePydanticModel):
         if not isinstance(user, RequestUserIdentity):
             raise RequestIdentityError("Invalid request user context value.")
         return user
+
+    @classmethod
+    def get_requester(cls) -> RequestUserIdentity | None:
+        """Return the requester of a requester-bound request, or ``None``.
+
+        A requester-bound request comes from another application, for example
+        an Agent, while it works for a person: the requester. The platform
+        signs the requester into the caller assertion. ``get_logged_user()``
+        still returns the caller, the acting application. The requester has
+        the ``team_uids`` the platform signed and ``is_organization_admin``
+        ``False``: the requester's access reaches the application at member
+        level only.
+
+        Returns ``None`` when the request is not requester-bound, including
+        local mode and WebSockets. Raises ``RequestIdentityError`` outside an
+        authenticated request, as ``get_logged_user()`` does.
+
+        Authorize a requester-bound request against the requester, and give the
+        acting application no rights of its own unless your policy grants them.
+        An operation that needs a person fails closed when this is ``None``.
+        Never take a person's UID from a request body, header or query
+        parameter instead.
+        """
+        requester = _get_requester()
+        if requester is not None and not isinstance(requester, RequestUserIdentity):
+            raise RequestIdentityError("Invalid request requester context value.")
+        return requester

mainsequence/server/caller_assertions.py

@@ -57,6 +57,14 @@ def _canonical_uid(value: object) -> str:
     return canonical
 
 
+@dataclass(frozen=True)
+class _VerifiedRequester:
+    """The person a requester-bound call works for, as the platform signed it."""
+
+    user_uid: str
+    team_uids: tuple[str, ...] = ()
+
+
 @dataclass(frozen=True)
 class AuthenticatedCaller:
     user_uid: str
@@ -66,25 +74,51 @@ class AuthenticatedCaller:
     expires_at: int
     team_uids: tuple[str, ...] = ()
     is_organization_admin: bool = False
+    # The requester of a requester-bound call, None on any other call. The
+    # fields above stay the caller's: the acting application (ADR-0036).
+    _requester: _VerifiedRequester | None = None
+
+
+def _team_uids(value: object, *, owner: str) -> tuple[str, ...]:
+    if not isinstance(value, list):
+        raise InvalidCallerAssertion(f"{owner} team UIDs are invalid.")
+    team_uids = tuple(_canonical_uid(item) for item in value)
+    if list(team_uids) != sorted(set(team_uids)):
+        raise InvalidCallerAssertion(f"{owner} team UIDs must be sorted and unique.")
+    return team_uids
 
 
 def _caller_facts(payload: dict) -> tuple[tuple[str, ...], bool]:
     facts = set(payload) & CALLER_FACT_CLAIMS
-    if set(payload) - facts != REQUIRED_CLAIMS or facts not in (set(), set(CALLER_FACT_CLAIMS)):
+    # A requester-bound call also carries "requester", which _requester() checks.
+    claims = set(payload) - facts - {"requester"}
+    if claims != REQUIRED_CLAIMS or facts not in (set(), set(CALLER_FACT_CLAIMS)):
         raise InvalidCallerAssertion("Caller assertion claims are invalid.")
     if not facts:
         return (), False
-    raw_team_uids = payload["team_uids"]
-    if not isinstance(raw_team_uids, list):
-        raise InvalidCallerAssertion("Caller team UIDs are invalid.")
-    team_uids = tuple(_canonical_uid(value) for value in raw_team_uids)
-    if list(team_uids) != sorted(set(team_uids)):
-        raise InvalidCallerAssertion("Caller team UIDs must be sorted and unique.")
+    team_uids = _team_uids(payload["team_uids"], owner="Caller")
     if type(payload["is_organization_admin"]) is not bool:
         raise InvalidCallerAssertion("Caller admin flag is invalid.")
     return team_uids, payload["is_organization_admin"]
 
 
+def _requester(payload: dict) -> _VerifiedRequester | None:
+    """The requester of a requester-bound call: exactly ``sub`` and ``team_uids``.
+
+    It never carries an admin flag: the requester's access reaches the
+    application at member level only.
+    """
+    if "requester" not in payload:
+        return None
+    claim = payload["requester"]
+    if not isinstance(claim, dict) or set(claim) != {"sub", "team_uids"}:
+        raise InvalidCallerAssertion("Caller assertion requester is invalid.")
+    return _VerifiedRequester(
+        user_uid=_canonical_uid(claim["sub"]),
+        team_uids=_team_uids(claim["team_uids"], owner="Requester"),
+    )
+
+
 class CallerAssertionVerifier:
     """Verify the signed actor proof against deployment-owned target values.
 
@@ -231,6 +265,7 @@ class CallerAssertionVerifier:
                 options={"require": list(REQUIRED_CLAIMS)},
             )
             team_uids, is_organization_admin = _caller_facts(payload)
+            requester = _requester(payload)
             if (
                 payload["aud"] != f"urn:mainsequence:fapi:{self.release_uid}"
                 or _canonical_uid(payload["resource_release_uid"]) != self.release_uid
@@ -251,6 +286,7 @@ class CallerAssertionVerifier:
                 expires_at=exp,
                 team_uids=team_uids,
                 is_organization_admin=is_organization_admin,
+                _requester=requester,
             )
         except (InvalidTokenError, KeyError, TypeError, ValueError) as exc:
             raise InvalidCallerAssertion("Caller assertion is invalid.") from exc

mainsequence/server/fastapi.py

@@ -222,6 +222,12 @@ class _RequestIdentityMiddleware:
                         state["resource_release_uid"] = caller.release_uid
                         state["organization_environment_uid"] = caller.environment_uid
                         context.caller_assertion = assertion
+                        if caller._requester is not None:
+                            # Never an admin: the requester's access is member level.
+                            context.requester = RequestUserIdentity(
+                                uid=caller._requester.user_uid,
+                                team_uids=caller._requester.team_uids,
+                            )
                     else:
                         user = await asyncio.to_thread(_local_user, scope)
                     context.user = user
@@ -245,7 +251,11 @@ class _RequestIdentityMiddleware:
 
 
 def install_request_identity(app):
-    """Install once at application creation. Handlers use User.get_logged_user()."""
+    """Install once at application creation.
+
+    Handlers use User.get_logged_user() for the caller and, on a
+    requester-bound call, User.get_requester() for the person it works for.
+    """
     if getattr(app.state, _INSTALLATION, None) is not None:
         raise RuntimeError("Request identity is already installed.")
     mode = _mode()
@@ -278,7 +288,9 @@ def reads_as_caller():
     and the platform answers with what the caller may see. No other call sends
     it. Raises ``RequestIdentityError`` outside an authenticated request or when
     the request carries no assertion (local mode, WebSockets); it never reads as
-    the application instead. See ADR-0036.
+    the application instead. It also raises in a requester-bound request
+    (``User.get_requester()`` is not ``None``): the requester's access is not
+    passed on. See ADR-0036.
     """
     with _reads_as_caller():
         yield

{mainsequence-9.0.14.dev56.dist-info → mainsequence-9.0.15.dev57.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.14.dev56
+Version: 9.0.15.dev57
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.14.dev56.dist-info → mainsequence-9.0.15.dev57.dist-info}/RECORD

@@ -1,16 +1,16 @@
-agent_scaffold/AGENTS.md,sha256=W91rpnyQuoQIa-3dsebIYyuwnbGLvkmuq_8X5k2hTAw,6399
+agent_scaffold/AGENTS.md,sha256=-tK1zUP6j3QAlFXmwFVSNPfbzchZRJSzj26L-RU9Gis,6471
 agent_scaffold/skills/a2a_sdk_execution/SKILL.md,sha256=NKtcXibE8TxZzKzz1KzJ2cVZ_EeuJJkb660U6wLvZ3s,11809
-agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=jYuZvxtfKh9MpWPxmT1EqPnkW_i4BbZfvDnWRiJHqRk,16659
+agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=HODSJCgm6Wdpd-nBsbMCb4Ls67P7DqK-j_S4GLFdfIk,19087
 agent_scaffold/skills/mainsequence-inference/SKILL.md,sha256=yv8aAHLQ2FBBSWPIFadY7pGNTwtR-yiR_-UzaGRN9-g,12502
 agent_scaffold/skills/maintenance/bug_auditor/SKILL.md,sha256=CCKs7edyZ9RK-WtAgXJXucokJFXZxk8sRUe0_imFtu8,8610
 agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=pPsZaERlfokSJ6b6vLjpA5U0KuKxbOFzzcxOVW_ikiI,17935
 agent_scaffold/skills/maintenance/metatables_transition/SKILL.md,sha256=PisgpytcksJnfZMS6aiPCmahsT3fm8DIwk_cefXA2qU,3759
-agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=o1rIlYAC7ejV7gKKf-BaglIZY1YkDO5Y27F6e2eK_94,8571
+agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=Y3V5EJtA2K7BvvAg6mPLZn1nYcMH4N0fKpmdelfbpa0,12626
 agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md,sha256=_84nnJKl_w-JrcbiTIairbFf9ptoQvW5Y1kMxn_XzkU,16871
 agent_scaffold/skills/sdk_code_repository_execution/SKILL.md,sha256=zly7MheB-Sjd0x6l_oPCOTBqkL2E4SSXwTlfSwdIPfQ,10196
 mainsequence/__init__.py,sha256=70CbIo7ZG1mzi5uwkqDtVESunBE0RanHjeFg4ptfsA0,385
 mainsequence/__main__.py,sha256=KuAP69uduS2ImrPIgNMzbGBRepZzjqvUONu5vFh4v4A,176
-mainsequence/_request_identity.py,sha256=BZVboogZPnRoka9vNYa3DOzex1qYDNOCiJ-2be9Jzqw,3406
+mainsequence/_request_identity.py,sha256=YsrfCRzIawYbvjn-DPFqBtjVbD_ujVFttjXpOwP8WKM,4189
 mainsequence/bootstrap.py,sha256=AvG55Y46RcshVqJZsyqvUDN62CJg4CDbHu0Bvsbwfzs,2910
 mainsequence/code_repository_context.py,sha256=JRrWjwpnUy8I-OjSd9hHlrcq8-Ow3Zeh_N6cYvmtA3o,28545
 mainsequence/code_repository_skills.py,sha256=AyC1HFAxQXHXNBGbarVUJS2cHd4X5HwDx6u8XBophbE,23611
@@ -45,18 +45,18 @@ mainsequence/client/github_issues.py,sha256=pSTUw3UPrmE6wqnpoJctartTaNSq6iu6PQRr
 mainsequence/client/inference.py,sha256=tYKHRxLR6mA5iLmgd3qURwweWc2OPQuw0__tD3LQgSI,7748
 mainsequence/client/models_foundry.py,sha256=JwQdPLDSO4dZI-KC0SUdmN6izmNIKMb9IzZlYXy0Mig,36488
 mainsequence/client/models_helpers.py,sha256=nlbHuQAylTOHAZOq4ltJQp6QvC3NW_kw7tZFosGc5rM,47311
-mainsequence/client/models_user.py,sha256=MpxapK3QQL_PQjVpRkazOjNWg08EfrHLI4t4gdGiCEo,43481
+mainsequence/client/models_user.py,sha256=tOngVHxkoEeV-kLLK3cmfESN9gzyXrLlZHFNGVv014Q,45241
 mainsequence/client/observability.py,sha256=_WrDKCaNk_TXmKElKCXC1inork6Exxxe8FRY4m1GI9s,16008
 mainsequence/client/utils.py,sha256=C0h0U-fOBZw3UxIwHcBTLf8CDClAOatf_oRgjvqFth4,31637
 mainsequence/client/value_sets.py,sha256=7TA-mpuAd3hOduNgO1WTQQTuNOGaFgue-VqCsDWKaC8,6181
 mainsequence/instrumentation/__init__.py,sha256=J_9XmfjprElvz0u2t9rTyJT0kFdyKpxdbkdQiaw28_U,316
 mainsequence/instrumentation/utils.py,sha256=b-ihjSioAepeLfMpudM2SqCtvnxMqIXileHx3klBCQU,3377
 mainsequence/server/__init__.py,sha256=BHUAhtdWPDRdxX07NYO_6wrBv5mf0GsXflecO52PmUc,73
-mainsequence/server/caller_assertions.py,sha256=Me8of2Ku8in-97LWU2oY-0oD1OW6zF-xOVVpEQ0eoe4,11010
-mainsequence/server/fastapi.py,sha256=zclo7ARHKUKSTmOc0KdxUSwfsxlx6SJuaiAe-19nzWg,11465
-mainsequence-9.0.14.dev56.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.14.dev56.dist-info/METADATA,sha256=eUPDEhgdLHhUALR4CBwwjQmWCQmad55W0OLB4WtBnoQ,7403
-mainsequence-9.0.14.dev56.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.14.dev56.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.14.dev56.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.14.dev56.dist-info/RECORD,,
+mainsequence/server/caller_assertions.py,sha256=Ix94Kvei31lKb861q6LqKzcB5H1mWnuH_wYwpXEKS1E,12351
+mainsequence/server/fastapi.py,sha256=1l5uIx4jqw092NJwXaA57nI6sAt9a_zXzJKgD4I1NRk,12090
+mainsequence-9.0.15.dev57.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.15.dev57.dist-info/METADATA,sha256=AxjdXTfjT_TVHTrYRdQljivI9c15SpW9jhtZWyKUzgc,7403
+mainsequence-9.0.15.dev57.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.15.dev57.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.15.dev57.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.15.dev57.dist-info/RECORD,,