mainsequence 9.0.24.dev67__py3-none-any.whl → 9.0.25.dev68__py3-none-any.whl

agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -167,8 +167,9 @@ a person: the requester. The platform signs the requester into the caller
 assertion it sends to the API, and the SDK verifies it before the handler runs.
 `User.get_logged_user()` still returns the caller, the acting application.
 `User.get_requester()` returns the requester, the checked delegation, with the
-person's own `uid`, `team_uids` and `is_organization_admin`, or `None` when the
-call carries no delegation. A requester-bound call carries the person's
+person's own `uid` and `is_organization_admin`, or `None` when the call carries
+no delegation. `in_teams(team_uids)` on either identity asks the platform which
+of those teams the person belongs to; `team_uids` is deprecated. A requester-bound call carries the person's
 ordinary permissions, including administrative ones.
 
 Each handler decides whether it needs a person. One that needs a person fails
@@ -191,7 +192,7 @@ def require_requester() -> RequestUserIdentity:
 @app.get("/team-reports/{team_uid}")
 def team_report(team_uid: str) -> dict[str, str]:
     requester = require_requester()
-    if not (requester.is_organization_admin or team_uid in requester.team_uids):
+    if not (requester.is_organization_admin or requester.in_teams([team_uid])):
         raise HTTPException(status_code=403, detail="The requester cannot read this report.")
     return {"team_uid": team_uid, "requested_by": requester.uid}
 

agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md

@@ -271,8 +271,9 @@ The requester comes only from the platform. An application never accepts a
 person's UID from a request body, header or query parameter, never parses the
 assertion, headers or MCP `_meta` itself, and never lets a caller choose whom
 it acts for. A FastAPI application that receives a requester-bound call reads
-the requester with `User.get_requester()`, the person's own `uid`, `team_uids`
-and `is_organization_admin`, and authorizes reads and writes against that
+the requester with `User.get_requester()`, the person's own `uid` and
+`is_organization_admin`, checks the person's teams with `in_teams()`, and
+authorizes reads and writes against that
 person's object- and operation-specific permissions. Each handler or tool
 decides whether it needs a person. See
 `.agents/skills/mainsequence/application_surfaces/api_surfaces/SKILL.md`.

mainsequence/_request_identity.py

@@ -24,6 +24,15 @@ class _RequestScope:
     # assertion; None on any other request. The user stays the caller, the
     # acting application (ADR-0036, requester-bound calls).
     requester: Any = None
+    # The release and Environment the verifier trusts, from deployment
+    # configuration, never from the request. They key membership answers (#225).
+    release_uid: str | None = None
+    environment_uid: str | None = None
+    # in_teams() answers within this request, and the application's cache of
+    # answers across requests with its lifetime (ADR-0036, #225).
+    team_memberships: dict = field(default_factory=dict, repr=False)
+    team_membership_cache: Any = field(default=None, repr=False)
+    team_membership_cache_seconds: float = 0
 
 
 _current_scope: ContextVar[_RequestScope | None] = ContextVar(
@@ -47,6 +56,8 @@ def _request_scope():
         scope.user = None
         scope.caller_assertion = None
         scope.requester = None
+        scope.team_memberships = {}
+        scope.team_membership_cache = None
         _current_scope.reset(token)
 
 
@@ -64,6 +75,24 @@ def _get_request_identity():
     return _authenticated_scope("User.get_logged_user()").user
 
 
+def _team_membership_scope(person_uid: str) -> _RequestScope:
+    """The request whose caller or requester ``person_uid`` is, for in_teams()."""
+    scope = _authenticated_scope("in_teams()")
+    if scope.caller_assertion is None:
+        raise RequestIdentityError(
+            "This request carries no caller assertion. Team membership checks need a "
+            "hosted HTTP request in assertion mode, not local mode or a WebSocket."
+        )
+    people = {scope.user.uid}
+    if scope.requester is not None:
+        people.add(scope.requester.uid)
+    if person_uid not in people:
+        raise RequestIdentityError(
+            "in_teams() answers only for the request's caller or its requester."
+        )
+    return scope
+
+
 def _get_requester():
     """The requester of the current request; None when it is not requester-bound."""
     return _authenticated_scope("User.get_requester()").requester

mainsequence/_team_memberships.py

@@ -0,0 +1,54 @@
+"""Team membership answers an application may reuse (ADR 0036, #225)."""
+
+from __future__ import annotations
+
+import threading
+import time
+from collections import OrderedDict
+
+# At most this many answers per process, and at most this many teams in one
+# call to the platform, which answers no more in one call.
+MAX_CACHED_ANSWERS = 10_000
+MAX_TEAMS_PER_CALL = 100
+
+# The trusted release UID, Environment UID, person UID and team UID.
+AnswerKey = tuple[str, str, str, str]
+
+
+def _now() -> float:
+    return time.monotonic()
+
+
+class TeamMembershipCache:
+    """Yes-or-no answers across requests, oldest dropped first.
+
+    The key starts with the release and Environment the verifier trusts, so an
+    answer obtained for one never answers the other.
+    """
+
+    def __init__(self, max_answers: int = MAX_CACHED_ANSWERS):
+        self._answers: OrderedDict[AnswerKey, tuple[bool, float]] = OrderedDict()
+        self._max_answers = max_answers
+        self._lock = threading.Lock()
+
+    def get(self, key: AnswerKey, *, max_age: float) -> bool | None:
+        """The stored answer when it is younger than ``max_age`` seconds."""
+        if max_age <= 0:
+            return None
+        with self._lock:
+            entry = self._answers.get(key)
+        if entry is None:
+            return None
+        answer, stored_at = entry
+        return answer if _now() - stored_at < max_age else None
+
+    def put(self, key: AnswerKey, answer: bool) -> None:
+        with self._lock:
+            self._answers[key] = (answer, _now())
+            self._answers.move_to_end(key)
+            while len(self._answers) > self._max_answers:
+                self._answers.popitem(last=False)
+
+    def __len__(self) -> int:
+        with self._lock:
+            return len(self._answers)

mainsequence/client/models_user.py

@@ -1,17 +1,23 @@
 from __future__ import annotations
 
 import datetime
+import math
+import warnings
+from collections.abc import Iterable
 from typing import Any, ClassVar, Literal
 from uuid import UUID
 
 from pydantic import BaseModel, ConfigDict, Field, StrictBool, field_validator, model_validator
 
 from mainsequence._request_identity import (
+    CALLER_ASSERTION_HEADER,
     RequestIdentityError,
     _caller_read_headers,
     _get_request_identity,
     _get_requester,
+    _team_membership_scope,
 )
+from mainsequence._team_memberships import MAX_TEAMS_PER_CALL
 from mainsequence.defaults import STANDARD_BACKEND_URL
 
 from .base import (
@@ -33,11 +39,11 @@ class RequestUserIdentity(BaseModel):
     The caller is a person or a workload identity; ``User.get_by_uid(uid)``
     reads its User. ``User.get_requester()`` returns the same type for the
     requester of a requester-bound request, the person the calling
-    application works for, with that person's own ``team_uids`` and
-    ``is_organization_admin``.
+    application works for, with that person's own ``is_organization_admin``.
+    ``in_teams()`` asks the platform which teams either of them belongs to.
     """
 
-    model_config = ConfigDict(extra="forbid", frozen=True)
+    model_config = ConfigDict(extra="forbid", frozen=True, populate_by_name=True)
 
     uid: str = Field(
         ...,
@@ -52,13 +58,15 @@ class RequestUserIdentity(BaseModel):
         title="Username",
         description="Optional display name authenticated by the runtime gateway.",
     )
-    team_uids: tuple[str, ...] = Field(
+    signed_team_uids: tuple[str, ...] | None = Field(
         (),
-        title="Team UIDs",
+        alias="team_uids",
+        title="Signed team UIDs (deprecated)",
         description=(
             "Canonical UIDs of the active teams the platform signed in the caller "
-            "assertion: the caller's, or for the requester the person's own. Empty in "
-            "local mode and on WebSockets, which carry no such facts."
+            "assertion, None when it signed none. Deprecated: read membership with "
+            "in_teams() (#225). Empty in local mode and on WebSockets, which carry no "
+            "such facts."
         ),
     )
     is_organization_admin: bool = Field(
@@ -79,14 +87,64 @@ class RequestUserIdentity(BaseModel):
         except (AttributeError, TypeError, ValueError) as exc:
             raise ValueError("Request user UID must be a valid UUID.") from exc
 
-    @field_validator("team_uids", mode="before")
+    @field_validator("signed_team_uids", mode="before")
     @classmethod
-    def _canonicalize_team_uids(cls, value: Any) -> tuple[str, ...]:
+    def _canonicalize_team_uids(cls, value: Any) -> tuple[str, ...] | None:
+        if value is None:
+            return None
         try:
-            return tuple(str(UUID(str(item).strip())) for item in value or ())
+            return tuple(str(UUID(str(item).strip())) for item in value)
         except (AttributeError, TypeError, ValueError) as exc:
             raise ValueError("Team UIDs must be valid UUIDs.") from exc
 
+    @property
+    def team_uids(self) -> tuple[str, ...]:
+        """Deprecated: the team UIDs the platform signed. Use ``in_teams()``.
+
+        Warns when read. When the caller assertion carried no team list it
+        raises ``RequestIdentityError``; it never answers an empty list for
+        that. Empty in local mode and on WebSockets, as before (#225).
+        """
+        warnings.warn(
+            "RequestUserIdentity.team_uids is deprecated; check membership with "
+            "in_teams() instead.",
+            DeprecationWarning,
+            stacklevel=2,
+        )
+        if self.signed_team_uids is None:
+            raise RequestIdentityError(
+                "The caller assertion carries no team list. Check team membership "
+                "with in_teams()."
+            )
+        return self.signed_team_uids
+
+    def in_teams(
+        self, team_uids: Iterable[str | UUID], *, max_age_seconds: float | None = None
+    ) -> frozenset[str]:
+        """Which of ``team_uids`` this person is an active member of.
+
+        Works on ``User.get_logged_user()`` and ``User.get_requester()`` inside
+        an authenticated hosted request, and asks the platform for the request's
+        caller or requester only. Returns canonical team UIDs; an empty set
+        means none. Teams the platform does not count, such as unknown or
+        inactive ones, are left out.
+
+        Reuse is the application's choice (``install_request_identity``):
+
+        - within one request the same question is asked once;
+        - across requests an answer is reused while it is younger than
+          ``team_membership_cache_seconds``, or than ``max_age_seconds`` when
+          given; ``0``, the default, reuses none across requests;
+        - ``max_age_seconds=0`` is a fresh check: it always asks the platform,
+          skips both kinds of reuse and stores the new answer. Ask for one
+          before acting on a membership that must be current.
+
+        Raises ``RequestIdentityError`` outside such a request, in local mode
+        and on WebSockets, and the SDK's API error when the platform cannot
+        answer; it never answers "not a member" because a call failed.
+        """
+        return _member_team_uids(self.uid, team_uids, max_age_seconds)
+
     @field_validator("username", mode="before")
     @classmethod
     def _normalize_username(cls, value: Any) -> str | None:
@@ -1314,8 +1372,9 @@ class User(_CallerDirectoryReadMixin, UserApiBaseObjectOrm, BasePydanticModel):
         an Agent, while it works for a person: the requester. The platform
         signs that person into the caller assertion, and the request identity
         integration verifies it before any handler or tool runs. The result is
-        that checked delegation: the person's own ``uid``, ``team_uids`` and
-        ``is_organization_admin``, as the platform signed them.
+        that checked delegation: the person's own ``uid`` and
+        ``is_organization_admin``, as the platform signed them, and
+        ``in_teams()`` for the person's teams.
         ``get_logged_user()`` still returns the caller, the acting application.
 
         Returns ``None`` when the request carries no delegation, including
@@ -1347,3 +1406,73 @@ class User(_CallerDirectoryReadMixin, UserApiBaseObjectOrm, BasePydanticModel):
         if requester is not None and not isinstance(requester, RequestUserIdentity):
             raise RequestIdentityError("Invalid request requester context value.")
         return requester
+
+    @classmethod
+    def _team_memberships(cls, person_uid: str, team_uids: list[str], assertion: str) -> set[str]:
+        """Which of ``team_uids`` the platform says the person belongs to (#225)."""
+        response = make_request(
+            s=cls.build_session(),
+            loaders=cls.LOADERS,
+            r_type="GET",
+            url=f"{cls.get_object_url()}/{person_uid}/team-memberships/",
+            payload={
+                "params": {"team_uid__in": ",".join(team_uids)},
+                "headers": {CALLER_ASSERTION_HEADER: assertion},
+            },
+        )
+        if response.status_code != 200:
+            # Never pass the payload: it holds the caller assertion.
+            raise_for_response(response)
+        answered = response.json().get("team_uids")
+        if not isinstance(answered, list):
+            raise ApiError("Invalid team membership answer.", response=response)
+        return set(_canonical_team_uids(answered)) & set(team_uids)
+
+
+def _canonical_team_uids(team_uids: Iterable[str | UUID]) -> list[str]:
+    if isinstance(team_uids, (str, bytes, UUID)):
+        raise TypeError("in_teams() takes a collection of team UIDs, not a single UID.")
+    try:
+        return sorted({str(UUID(str(team_uid).strip())) for team_uid in team_uids})
+    except (AttributeError, TypeError, ValueError) as exc:
+        raise ValueError("Team UIDs must be valid UUIDs.") from exc
+
+
+def _member_team_uids(
+    person_uid: str, team_uids: Iterable[str | UUID], max_age_seconds: float | None
+) -> frozenset[str]:
+    """RequestUserIdentity.in_teams(): reuse answers as allowed, ask for the rest."""
+    asked = _canonical_team_uids(team_uids)
+    if max_age_seconds is not None and (
+        isinstance(max_age_seconds, bool)
+        or not isinstance(max_age_seconds, (int, float))
+        or not math.isfinite(max_age_seconds)
+        or max_age_seconds < 0
+    ):
+        raise ValueError("max_age_seconds must be None or a non-negative number of seconds.")
+    scope = _team_membership_scope(person_uid)
+    fresh = max_age_seconds == 0
+    lifetime = scope.team_membership_cache_seconds if max_age_seconds is None else max_age_seconds
+    cache = scope.team_membership_cache
+    answers: dict[str, bool] = {}
+    unanswered: list[str] = []
+    for team_uid in asked:
+        key = (scope.release_uid, scope.environment_uid, person_uid, team_uid)
+        reused = None
+        if not fresh:
+            reused = scope.team_memberships.get(key)
+            if reused is None and cache is not None:
+                reused = cache.get(key, max_age=lifetime)
+        if reused is None:
+            unanswered.append(team_uid)
+        else:
+            answers[team_uid] = scope.team_memberships[key] = reused
+    for start in range(0, len(unanswered), MAX_TEAMS_PER_CALL):
+        batch = unanswered[start : start + MAX_TEAMS_PER_CALL]
+        members = User._team_memberships(person_uid, batch, scope.caller_assertion)
+        for team_uid in batch:
+            key = (scope.release_uid, scope.environment_uid, person_uid, team_uid)
+            answers[team_uid] = scope.team_memberships[key] = team_uid in members
+            if cache is not None:
+                cache.put(key, answers[team_uid])
+    return frozenset(team_uid for team_uid, member in answers.items() if member)

mainsequence/server/caller_assertions.py

@@ -32,14 +32,13 @@ REQUIRED_CLAIMS = frozenset(
         "iat",
         "nbf",
         "exp",
-        # What the platform states about the caller: its active team UIDs and
-        # whether it is an admin of the application's Organization.
-        "team_uids",
+        # What the platform states about the caller: whether it is an admin of
+        # the application's Organization.
         "is_organization_admin",
     }
 )
-# The person a requester-bound call works for, with the person's own facts.
-REQUESTER_CLAIMS = frozenset({"sub", "team_uids", "is_organization_admin"})
+# The person a requester-bound call works for, with the person's own admin flag.
+REQUESTER_CLAIMS = frozenset({"sub", "is_organization_admin"})
 
 
 class InvalidCallerAssertion(ValueError):
@@ -64,7 +63,8 @@ class _VerifiedRequester:
     """The person a requester-bound call works for, as the platform signed it."""
 
     user_uid: str
-    team_uids: tuple[str, ...]
+    # None when the assertion carries no team list (#225).
+    team_uids: tuple[str, ...] | None
     is_organization_admin: bool
 
 
@@ -75,7 +75,8 @@ class AuthenticatedCaller:
     environment_uid: str
     issued_at: int
     expires_at: int
-    team_uids: tuple[str, ...]
+    # None when the assertion carries no team list (#225).
+    team_uids: tuple[str, ...] | None
     is_organization_admin: bool
     # The person a requester-bound call works for, None on any other call. The
     # fields above stay the caller's: the acting application (ADR-0036).
@@ -97,13 +98,24 @@ def _admin_flag(value: object, *, owner: str) -> bool:
     return value
 
 
-def _caller_facts(payload: dict) -> tuple[tuple[str, ...], bool]:
-    """The caller's team UIDs and admin flag, which every assertion carries."""
+def _signed_team_uids(claims: dict, *, owner: str) -> tuple[str, ...] | None:
+    """The deprecated ``team_uids`` while the platform still signs it, else None.
+
+    Membership is checked on demand with ``RequestUserIdentity.in_teams()``
+    (#225); a list that is still signed is checked as before.
+    """
+    if "team_uids" not in claims:
+        return None
+    return _team_uids(claims["team_uids"], owner=owner)
+
+
+def _caller_facts(payload: dict) -> tuple[tuple[str, ...] | None, bool]:
+    """The caller's admin flag, and its team UIDs while the platform signs them."""
     # A requester-bound call also carries "requester", which _requester() checks.
-    if set(payload) - {"requester"} != REQUIRED_CLAIMS:
+    if set(payload) - {"requester", "team_uids"} != REQUIRED_CLAIMS:
         raise InvalidCallerAssertion("Caller assertion claims are invalid.")
     return (
-        _team_uids(payload["team_uids"], owner="Caller"),
+        _signed_team_uids(payload, owner="Caller"),
         _admin_flag(payload["is_organization_admin"], owner="Caller"),
     )
 
@@ -111,17 +123,18 @@ def _caller_facts(payload: dict) -> tuple[tuple[str, ...], bool]:
 def _requester(payload: dict) -> _VerifiedRequester | None:
     """The person a requester-bound call works for, or None on any other call.
 
-    The claim has exactly ``sub``, ``team_uids`` and ``is_organization_admin``:
-    the person's own User UID, active team UIDs and Organization-admin flag.
+    The claim has exactly ``sub`` and ``is_organization_admin``, the person's
+    own User UID and Organization-admin flag, and may still carry the
+    deprecated ``team_uids`` (#225).
     """
     if "requester" not in payload:
         return None
     claim = payload["requester"]
-    if not isinstance(claim, dict) or set(claim) != REQUESTER_CLAIMS:
+    if not isinstance(claim, dict) or set(claim) - {"team_uids"} != REQUESTER_CLAIMS:
         raise InvalidCallerAssertion("Caller assertion requester is invalid.")
     return _VerifiedRequester(
         user_uid=_canonical_uid(claim["sub"]),
-        team_uids=_team_uids(claim["team_uids"], owner="Requester"),
+        team_uids=_signed_team_uids(claim, owner="Requester"),
         is_organization_admin=_admin_flag(claim["is_organization_admin"], owner="Requester"),
     )
 

mainsequence/server/fastapi.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import asyncio
 import json
+import math
 import os
 import re
 from contextlib import asynccontextmanager, contextmanager
@@ -18,6 +19,7 @@ from mainsequence._request_identity import (
     _reads_as_caller,
     _request_scope,
 )
+from mainsequence._team_memberships import TeamMembershipCache
 from mainsequence.client.models_user import RequestUserIdentity
 
 from .caller_assertions import (
@@ -175,11 +177,16 @@ async def _deny(scope, receive, send, error):
 
 
 class _RequestIdentityMiddleware:
-    def __init__(self, app, *, mode, verifier, public_ingress, routes):
+    def __init__(
+        self, app, *, mode, verifier, public_ingress, routes, team_membership_cache_seconds=0
+    ):
         self.app = app
         self.mode = mode
         self.verifier = verifier
         self.public_ingress = frozenset(public_ingress)
+        # Membership answers reused across this application's requests (#225).
+        self.team_memberships = TeamMembershipCache()
+        self.team_membership_cache_seconds = team_membership_cache_seconds
         for method, path in public_ingress:
             if not any(
                 getattr(route, "path", None) == path
@@ -228,6 +235,11 @@ class _RequestIdentityMiddleware:
                         state["resource_release_uid"] = caller.release_uid
                         state["organization_environment_uid"] = caller.environment_uid
                         context.caller_assertion = assertion
+                        # The verifier's trusted target keys membership answers.
+                        context.release_uid = caller.release_uid
+                        context.environment_uid = caller.environment_uid
+                        context.team_membership_cache = self.team_memberships
+                        context.team_membership_cache_seconds = self.team_membership_cache_seconds
                         if caller._requester is not None:
                             # The person this call works for, with the person's own facts.
                             context.requester = RequestUserIdentity(
@@ -257,14 +269,28 @@ class _RequestIdentityMiddleware:
             await self.app(scope, receive, send)
 
 
-def install_request_identity(app):
+def install_request_identity(app, *, team_membership_cache_seconds=0):
     """Install once at application creation.
 
     Handlers use User.get_logged_user() for the caller and, on a
     requester-bound call, User.get_requester() for the person it works for.
+    ``in_teams()`` on either asks the platform about team membership.
+
+    ``team_membership_cache_seconds`` is how long a membership answer may be
+    reused across requests in this process. ``0``, the default, reuses an
+    answer only within the same request. A longer lifetime means fewer calls
+    and a membership change seen up to that much later; the choice belongs to
+    the application (ADR 0036, #225).
     """
     if getattr(app.state, _INSTALLATION, None) is not None:
         raise RuntimeError("Request identity is already installed.")
+    if (
+        isinstance(team_membership_cache_seconds, bool)
+        or not isinstance(team_membership_cache_seconds, (int, float))
+        or not math.isfinite(team_membership_cache_seconds)
+        or team_membership_cache_seconds < 0
+    ):
+        raise ValueError("team_membership_cache_seconds must be a non-negative number.")
     mode = _mode()
     public_ingress = _public_routes()
     verifier = CallerAssertionVerifier.from_environment() if mode == "assertion" else None
@@ -274,6 +300,7 @@ def install_request_identity(app):
         verifier=verifier,
         public_ingress=public_ingress,
         routes=app.routes,
+        team_membership_cache_seconds=team_membership_cache_seconds,
     )
     setattr(
         app.state,

{mainsequence-9.0.24.dev67.dist-info → mainsequence-9.0.25.dev68.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.24.dev67
+Version: 9.0.25.dev68
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.24.dev67.dist-info → mainsequence-9.0.25.dev68.dist-info}/RECORD

@@ -1,15 +1,16 @@
 agent_scaffold/skills/a2a_sdk_execution/SKILL.md,sha256=NcwIQ1QgD4Ku0mG2Hb-Izee8p9fm9LTPHa6gDEWTOSQ,13200
-agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=gdoe860TEQyrMIVcN1L3Cf8lBYv3ErMkTNWcNrWjOKo,24427
+agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md,sha256=yyIKgPyyHYM5THOG9vLmxei66wMnOc2NERPAKUpo6pI,24543
 agent_scaffold/skills/mainsequence-inference/SKILL.md,sha256=yv8aAHLQ2FBBSWPIFadY7pGNTwtR-yiR_-UzaGRN9-g,12502
 agent_scaffold/skills/maintenance/bug_auditor/SKILL.md,sha256=8RRZNmC3omhZoxNbmu50MdhBFTQ2CU2THeyNu07Ax18,8659
 agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md,sha256=pNQICoVW6nRr0HfvyB0Q64TdsqCXTWQUuImpBL-4XUQ,18575
 agent_scaffold/skills/maintenance/metatables_transition/SKILL.md,sha256=PisgpytcksJnfZMS6aiPCmahsT3fm8DIwk_cefXA2qU,3759
-agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=hDXkctBgMsd_pJYmAq7lR8M_zulIAmgYVx1ii5qBcp0,14814
+agent_scaffold/skills/platform_operations/access_control_and_sharing/SKILL.md,sha256=i-6Yy6-ANiIdsHbQPasXz4wJwtOqiaYjdOv1VZUqc0w,14846
 agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md,sha256=KfTptbOMO-b8hiVFPgKxRMjmQWZCLB9Sr_kli7kp4hs,16920
 agent_scaffold/skills/sdk_code_repository_execution/SKILL.md,sha256=g4C0Cp5oqQg2LBjT-piWXunmt_hNd5yTK33RMYPAE8I,7313
 mainsequence/__init__.py,sha256=70CbIo7ZG1mzi5uwkqDtVESunBE0RanHjeFg4ptfsA0,385
 mainsequence/__main__.py,sha256=KuAP69uduS2ImrPIgNMzbGBRepZzjqvUONu5vFh4v4A,176
-mainsequence/_request_identity.py,sha256=vsbnQeJ9ycRB2p8oFTUxfPkzDh7-SBQ5Pxzn04pjqVM,4183
+mainsequence/_request_identity.py,sha256=suRjESLA_YY_TAxE2htWHd07gvPhJGr-1GtpFnjaVTc,5543
+mainsequence/_team_memberships.py,sha256=LQsn635Qw2VwhUQ4Ld8qa7utqXsAhO_0IFrf-kqzVk0,1771
 mainsequence/_transport.py,sha256=gFSw5bl4O2o3NwZOk-ueNnTQvySBecyhC2-7OPb-BPk,8425
 mainsequence/bootstrap.py,sha256=AvG55Y46RcshVqJZsyqvUDN62CJg4CDbHu0Bvsbwfzs,2910
 mainsequence/code_repository_context.py,sha256=JRrWjwpnUy8I-OjSd9hHlrcq8-Ow3Zeh_N6cYvmtA3o,28545
@@ -44,22 +45,22 @@ mainsequence/client/github_issues.py,sha256=pSTUw3UPrmE6wqnpoJctartTaNSq6iu6PQRr
 mainsequence/client/inference.py,sha256=tYKHRxLR6mA5iLmgd3qURwweWc2OPQuw0__tD3LQgSI,7748
 mainsequence/client/models_foundry.py,sha256=JwQdPLDSO4dZI-KC0SUdmN6izmNIKMb9IzZlYXy0Mig,36488
 mainsequence/client/models_helpers.py,sha256=CQRjBjx3DsREJLRk0vqFsC-Dcll5lUP2ofu6e5UMvhk,49051
-mainsequence/client/models_user.py,sha256=aOs_ouI1j9sr2oAaV94xhrD6KcN1DYKBcjPMZxkhD88,46235
+mainsequence/client/models_user.py,sha256=FESX_RYmY_qXXJ-VuZUo_C9Hwx0MrdHP_4b8wb4HycU,52256
 mainsequence/client/observability.py,sha256=_WrDKCaNk_TXmKElKCXC1inork6Exxxe8FRY4m1GI9s,16008
 mainsequence/client/utils.py,sha256=Rk2z-78swO6GepibLlQNdxL1eqYy8vHGrjiZdV3G5CM,31641
 mainsequence/client/value_sets.py,sha256=7TA-mpuAd3hOduNgO1WTQQTuNOGaFgue-VqCsDWKaC8,6181
 mainsequence/instrumentation/__init__.py,sha256=J_9XmfjprElvz0u2t9rTyJT0kFdyKpxdbkdQiaw28_U,316
 mainsequence/instrumentation/utils.py,sha256=b-ihjSioAepeLfMpudM2SqCtvnxMqIXileHx3klBCQU,3377
 mainsequence/server/__init__.py,sha256=BHUAhtdWPDRdxX07NYO_6wrBv5mf0GsXflecO52PmUc,73
-mainsequence/server/caller_assertions.py,sha256=7OEgPXxiGv-P98K6-XVKFSiNcYZkEFDmehBc_oJKkFM,12563
-mainsequence/server/fastapi.py,sha256=jdLWtD5roG7kLzZgdsezhDEXVz3mCnpY6rqc2Qio1U4,18667
+mainsequence/server/caller_assertions.py,sha256=AcE9PgkIAu8kMUILSRs6P--wN68DUw5a5D1PC7NQqIs,13116
+mainsequence/server/fastapi.py,sha256=zVPvtlkAZuuD1EgKk_9jPVjfBxOlFjf9aXjDyFlTC54,20250
 mainsequence/server/mcp_skills.py,sha256=-krRwAHCAMipScgGJ19uVkzznhTop1Nz4C_wRY1GUpw,16690
 mainsequence/server/_mcp_skills_upstream/__init__.py,sha256=px283qBMf3z1nxCfN3WHrH9v8Y8jOb1xoBqZMRZcaD8,2694
 mainsequence/server/_mcp_skills_upstream/server.py,sha256=laHsfpoaYX3LcwQ04-GN7r0_C63fG6CzyXDci2rmbHE,7695
 mainsequence/server/_mcp_skills_upstream/shared.py,sha256=JmnX9PoLoyi93nBYnUEPWCdPXor_nQHjHptQDXpFzPs,11978
-mainsequence-9.0.24.dev67.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.24.dev67.dist-info/METADATA,sha256=9xRrpjtRTzI9nv1EEHAtY2iVu8e_gOy5BR1UQABgN-E,7531
-mainsequence-9.0.24.dev67.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.24.dev67.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.24.dev67.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.24.dev67.dist-info/RECORD,,
+mainsequence-9.0.25.dev68.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.25.dev68.dist-info/METADATA,sha256=WYO7f8YBdthLQ_k9mG8qETYoBZlaKFoXk-j3jbyDWuA,7531
+mainsequence-9.0.25.dev68.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.25.dev68.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.25.dev68.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.25.dev68.dist-info/RECORD,,