mainsequence 9.0.8.dev44__tar.gz → 9.0.9__tar.gz

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.8.dev44
+Version: 9.0.9
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence/cli/browser_auth.py

@@ -15,7 +15,7 @@ import threading
 import time
 import webbrowser
 from collections.abc import Callable
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import parse_qs, urlparse
 
@@ -37,7 +37,8 @@ class BrowserAuthError(RuntimeError):
 class BrowserAuthCallback:
     """Authorization callback payload captured from the local loopback receiver."""
 
-    code: str | None = None
+    # The authorization code is a bearer credential: it stays out of repr() and str().
+    code: str | None = field(default=None, repr=False)
     state: str | None = None
     error: str | None = None
     error_description: str | None = None

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence/cli/config.py

@@ -29,6 +29,7 @@ from keyring import core as keyring_core
 from keyring import errors as keyring_errors
 
 from mainsequence.defaults import CANONICAL_BACKEND_ENV, STANDARD_BACKEND_URL
+from mainsequence.runtime_credential_exchange import runtime_credential_configured
 
 APP_NAME = "MainSequenceCLI"
 
@@ -804,13 +805,8 @@ def session_report() -> dict:
     refresh_expires_at = token_expiry(refresh)
 
     if auth_mode == "runtime_credential":
-        authenticated = bool(
-            access
-            or (
-                (os.environ.get("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID") or "").strip()
-                and (os.environ.get("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET") or "").strip()
-            )
-        )
+        # The credential is an ID with a bootstrap secret or an identity token file.
+        authenticated = bool(access or runtime_credential_configured())
         session_expires_at = None
     elif refresh:
         authenticated = refresh_expires_at is None or refresh_expires_at > now

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence/client/agent_runtime_models.py

@@ -353,7 +353,8 @@ class AgentRuntimePresence(BasePydanticModel):
 
 
 class AgentSessionRuntimeAccess(BasePydanticModel):
-    model_config = ConfigDict(extra="allow")
+    # A validation error must not echo the input: it holds the bearer token.
+    model_config = ConfigDict(extra="allow", hide_input_in_errors=True)
 
     coding_agent_service_uid: str | None = Field(
         None,
@@ -373,6 +374,7 @@ class AgentSessionRuntimeAccess(BasePydanticModel):
     token: str | None = Field(
         None,
         description="Bearer token that authorizes calls to the coding-agent gateway.",
+        repr=False,
     )
     expires_at: str | None = Field(
         None,

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence/client/models_foundry.py

@@ -7,7 +7,7 @@ from uuid import UUID
 
 import yaml
 from cachetools import TTLCache, cachedmethod
-from pydantic import Field, SecretStr
+from pydantic import ConfigDict, Field, SecretStr
 
 from .base import (
     BaseObjectOrm,
@@ -891,6 +891,10 @@ class Secret(
     BasePydanticModel,
     BaseObjectOrm,
 ):
+    # `value` is a SecretStr once read, but a validation error would echo the
+    # plaintext it was given.
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     HYDRATE_FILTER_GET_FROM_DETAIL: ClassVar[bool] = True
     FILTERSET_FIELDS: ClassVar[dict[str, list[str]]] = {
         "uid": ["in", "exact"],

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence/client/models_helpers.py

@@ -6,7 +6,7 @@ from decimal import Decimal
 from typing import Any, ClassVar, Literal
 from uuid import UUID
 
-from pydantic import BaseModel, Field, PositiveInt
+from pydantic import BaseModel, ConfigDict, Field, PositiveInt
 
 from .base import (
     BaseObjectOrm,
@@ -798,6 +798,10 @@ class ResourceReleaseRuntimePresence(BasePydanticModel):
 
 
 class ResourceReleaseRuntimeAccess(BasePydanticModel):
+    # `access` holds the runtime's bearer token, so neither repr() nor a
+    # validation error shows it.
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     resource_release_uid: str
     # The canonical vocabulary ResourceRelease.release_kind reads (#119): this
     # payload names a release kind, so it names it the same way.
@@ -805,7 +809,7 @@ class ResourceReleaseRuntimeAccess(BasePydanticModel):
     routing: ResourceReleaseRuntimeRouting
     runtime_access: ResourceReleaseRuntimeAdmission
     runtime_presence: ResourceReleaseRuntimePresence
-    access: dict[str, Any] | None = None
+    access: dict[str, Any] | None = Field(default=None, repr=False)
 
 
 class ResourceRelease(

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence/client/utils.py

@@ -21,6 +21,14 @@ from requests.structures import CaseInsensitiveDict
 
 from mainsequence.defaults import resolve_backend_endpoint
 from mainsequence.logconf import logger
+from mainsequence.runtime_credential_exchange import (
+    RUNTIME_CREDENTIAL_ID_ENV,
+    RUNTIME_CREDENTIAL_SECRET_ENV,
+    RUNTIME_IDENTITY_TOKEN_FILE_ENV,
+    RuntimeIdentityTokenError,
+    exchange_runtime_credential,
+    identity_token_file_from_environment,
+)
 
 from ._transport import DEFAULT_ALLOWED_METHODS as DEFAULT_ALLOWED_METHODS
 from ._transport import DEFAULT_STATUS_FORCELIST as DEFAULT_STATUS_FORCELIST
@@ -270,8 +278,9 @@ class BaseAuthProvider:
 
 @dataclass
 class SessionJWTAuthProvider(BaseAuthProvider):
-    access_token: str | None = None
-    refresh_token: str | None = None
+    # Tokens stay out of repr() and str(), so logging the provider never shows them.
+    access_token: str | None = field(default=None, repr=False)
+    refresh_token: str | None = field(default=None, repr=False)
     header_keyword: str = "Bearer"
 
     def __post_init__(self):
@@ -309,20 +318,37 @@ class SessionJWTAuthProvider(BaseAuthProvider):
 
 @dataclass
 class RuntimeCredentialAuthProvider(BaseAuthProvider):
+    """
+    Exchange the runtime credential the platform injected for short-lived access tokens.
+
+    The proof is the projected workload identity token when
+    `MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE` is set: the file is read for every
+    exchange, and `MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET` is never read or sent.
+    Otherwise the proof is that bootstrap secret. The token is never kept on the
+    provider, and the secret is left out of `repr()` and `str()`. Throttled
+    (`429`) and temporarily unavailable (`503`) exchanges are retried within the
+    timeout budget; a rejected one (`401`) fails at once.
+    """
+
     credential_id: str | None = None
-    credential_secret: str | None = None
+    credential_secret: str | None = field(default=None, repr=False)
     token_url: str | None = None
     token_type: str = "Bearer"
     refresh_skew_seconds: int = 30
     timeout: tuple[float, float] = DEFAULT_TIMEOUT
     expires_at: float | None = None
+    identity_token_file: str | None = None
     _lock: threading.RLock = field(default_factory=threading.RLock, init=False, repr=False)
 
     def __post_init__(self):
         if self.credential_id is None:
-            self.credential_id = os.getenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID")
-        if self.credential_secret is None:
-            self.credential_secret = os.getenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET")
+            self.credential_id = os.getenv(RUNTIME_CREDENTIAL_ID_ENV)
+        if self.identity_token_file is None:
+            self.identity_token_file = identity_token_file_from_environment()
+        else:
+            self.identity_token_file = str(self.identity_token_file).strip() or None
+        if self.credential_secret is None and not self.identity_token_file:
+            self.credential_secret = os.getenv(RUNTIME_CREDENTIAL_SECRET_ENV)
         if not self.token_url:
             self.token_url = f"{API_ENDPOINT}/runtime-credentials/token/"
 
@@ -344,20 +370,48 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
 
         return exp <= int(time.time()) + self.refresh_skew_seconds
 
-    def _require_credentials(self) -> tuple[str, str]:
+    @staticmethod
+    def _log_exchange_retry(status: int, delay: float) -> None:
+        logger.warning(f"Runtime credential exchange returned {status}; retrying in {delay:.1f} s.")
+
+    def _exchange(self) -> requests.Response:
         credential_id = (self.credential_id or "").strip()
-        credential_secret = (self.credential_secret or "").strip()
+        identity_token_file = self.identity_token_file
+        credential_secret = None if identity_token_file else (self.credential_secret or "").strip()
         if not credential_id:
             raise AuthError(
                 "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID is required when "
                 "MAINSEQUENCE_AUTH_MODE=runtime_credential."
             )
-        if not credential_secret:
+        if not identity_token_file and not credential_secret:
             raise AuthError(
                 "MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET is required when "
-                "MAINSEQUENCE_AUTH_MODE=runtime_credential."
+                "MAINSEQUENCE_AUTH_MODE=runtime_credential and "
+                f"{RUNTIME_IDENTITY_TOKEN_FILE_ENV} is not set."
             )
-        return credential_id, credential_secret
+        try:
+            # One budget for every attempt and wait, inside the caller's budget if any.
+            with request_budget(self.timeout) as budget:
+
+                def post(body: dict[str, str]) -> requests.Response:
+                    return requests.post(
+                        self.token_url,
+                        json=body,
+                        headers={"Content-Type": "application/json"},
+                        timeout=budget.timeout(),
+                        allow_redirects=False,
+                    )
+
+                return exchange_runtime_credential(
+                    post,
+                    credential_id=credential_id,
+                    credential_secret=credential_secret,
+                    identity_token_file=identity_token_file,
+                    deadline=budget.deadline,
+                    on_retry=self._log_exchange_retry,
+                )
+        except RuntimeIdentityTokenError as exc:
+            raise AuthError(str(exc)) from None
 
     def refresh(
         self,
@@ -370,17 +424,7 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
             if not force and not self._needs_exchange():
                 return
 
-            credential_id, credential_secret = self._require_credentials()
-            response = requests.post(
-                self.token_url,
-                json={
-                    "credential_id": credential_id,
-                    "credential_secret": credential_secret,
-                },
-                headers={"Content-Type": "application/json"},
-                timeout=remaining_timeout(self.timeout),
-                allow_redirects=False,
-            )
+            response = self._exchange()
             if response.status_code < 200 or response.status_code >= 300:
                 raise AuthError(
                     f"Runtime credential exchange failed with status {response.status_code}."
@@ -439,8 +483,9 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
 
 @dataclass
 class JWTAuthProvider(BaseAuthProvider):
-    access_token: str | None = None
-    refresh_token: str | None = None
+    # Tokens stay out of repr() and str(), so logging the provider never shows them.
+    access_token: str | None = field(default=None, repr=False)
+    refresh_token: str | None = field(default=None, repr=False)
     refresh_url: str | None = None
     obtain_url: str | None = None
     header_keyword: str = "Bearer"

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence/code_repository_context.py

@@ -10,6 +10,8 @@ from dataclasses import dataclass, replace
 from typing import Any, Literal
 from urllib.parse import urlsplit
 
+from mainsequence.runtime_credential_exchange import runtime_credential_configured
+
 CodeRepositoryContextStatus = Literal[
     "resolved",
     "code_repository_branch_not_registered",
@@ -204,9 +206,7 @@ def _exchange_authenticated_runtime_context_if_configured() -> None:
         return
     if (os.getenv("MAINSEQUENCE_AUTH_MODE") or "").strip().lower() != "runtime_credential":
         return
-    if not (os.getenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID") or "").strip():
-        return
-    if not (os.getenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET") or "").strip():
+    if not runtime_credential_configured():
         return
 
     from mainsequence.client.utils import AuthError, loaders

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence/logconf.py

@@ -5,6 +5,7 @@ import logging
 import logging.config
 import os
 import sys
+import time
 import traceback
 from collections.abc import Mapping
 from importlib.metadata import PackageNotFoundError
@@ -22,6 +23,13 @@ from structlog.stdlib import BoundLogger
 from .defaults import resolve_backend_endpoint
 from .instrumentation import OTelJSONRenderer
 from .repository_identity_security import UNSUPPORTED_SOURCE_IDENTITY_ENV_NAMES
+from .runtime_credential_exchange import (
+    RUNTIME_CREDENTIAL_ID_ENV,
+    RUNTIME_CREDENTIAL_SECRET_ENV,
+    exchange_runtime_credential,
+    identity_token_file_from_environment,
+    runtime_credential_configured,
+)
 from .runtime_flags import is_running_in_pod
 
 logger = None
@@ -94,20 +102,31 @@ def _request_job_startup_state(*, timeout_s: float = 10.0) -> dict[str, Any]:
         return headers, False
 
     def _exchange_runtime_credential() -> bool:
-        credential_id = (os.getenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID") or "").strip()
-        credential_secret = (os.getenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET") or "").strip()
-        if not credential_id or not credential_secret:
+        if not runtime_credential_configured():
             return False
+        identity_token_file = identity_token_file_from_environment()
+        token_url = f"{_backend_base_url()}/api/v1/runtime-credentials/token/"
 
-        try:
-            token_resp = requests.post(
-                f"{_backend_base_url()}/api/v1/runtime-credentials/token/",
+        def _post(body: dict[str, str]) -> requests.Response:
+            return requests.post(
+                token_url,
                 headers={"Content-Type": "application/json"},
-                json={
-                    "credential_id": credential_id,
-                    "credential_secret": credential_secret,
-                },
+                json=body,
                 timeout=timeout_s,
+                allow_redirects=False,
+            )
+
+        try:
+            token_resp = exchange_runtime_credential(
+                _post,
+                credential_id=(os.getenv(RUNTIME_CREDENTIAL_ID_ENV) or "").strip(),
+                credential_secret=(
+                    None
+                    if identity_token_file
+                    else (os.getenv(RUNTIME_CREDENTIAL_SECRET_ENV) or "").strip()
+                ),
+                identity_token_file=identity_token_file,
+                deadline=time.monotonic() + timeout_s,
             )
         except Exception:
             return False

mainsequence-9.0.9/mainsequence/runtime_credential_exchange.py

@@ -0,0 +1,168 @@
+"""
+The runtime credential exchange, shared by the auth provider and the logger.
+
+A runtime started with ``MAINSEQUENCE_AUTH_MODE=runtime_credential`` exchanges its
+credential at ``POST /api/v1/runtime-credentials/token/`` for a short-lived access
+token. The request carries ``credential_id`` and exactly one proof:
+
+* ``workload_identity_token`` when ``MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`` is
+  set: the projected token read from that file for every exchange, because the
+  file is rotated. The bootstrap secret is then never read or sent, and a missing,
+  unreadable or empty file is an error, never a fallback to the secret.
+* ``credential_secret`` otherwise: ``MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET``.
+
+The token exists only inside one exchange request. It is not kept on any object,
+written to the environment or a file, logged, or included in an error message.
+
+The logger exchanges a runtime credential while it is being configured, so this
+module imports nothing from the SDK.
+"""
+
+from __future__ import annotations
+
+import os
+import time
+from collections.abc import Callable
+from typing import Any
+
+from urllib3.exceptions import InvalidHeader
+from urllib3.util import Retry
+
+RUNTIME_CREDENTIAL_ID_ENV = "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID"
+RUNTIME_CREDENTIAL_SECRET_ENV = "MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET"
+RUNTIME_IDENTITY_TOKEN_FILE_ENV = "MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE"
+
+# 429: the exchange is throttled. 503: verification is temporarily unavailable.
+# Neither exchanged anything, so the same request may be sent again.
+RETRYABLE_EXCHANGE_STATUSES = frozenset({429, 503})
+EXCHANGE_RETRIES = 3
+EXCHANGE_BACKOFF_FACTOR = 0.5
+
+_RETRY_AFTER = Retry(total=0)
+
+
+class RuntimeIdentityTokenError(Exception):
+    """The runtime identity token file cannot be used. The message never holds its content."""
+
+
+def _environment_value(name: str) -> str:
+    return (os.getenv(name) or "").strip()
+
+
+def identity_token_file_from_environment() -> str | None:
+    """Return the path in ``MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE``, or None when unset."""
+    return _environment_value(RUNTIME_IDENTITY_TOKEN_FILE_ENV) or None
+
+
+def runtime_credential_configured() -> bool:
+    """
+    Say whether the environment holds a runtime credential to exchange.
+
+    That is a credential ID and one proof: the identity token file, or else the
+    bootstrap secret. Only the presence of the setting is checked. The token file
+    is read by the exchange itself, which reports a missing or empty file.
+    """
+    if not _environment_value(RUNTIME_CREDENTIAL_ID_ENV):
+        return False
+    if identity_token_file_from_environment():
+        return True
+    return bool(_environment_value(RUNTIME_CREDENTIAL_SECRET_ENV))
+
+
+def _read_identity_token(path: str) -> str:
+    source = f"The runtime identity token file {path} ({RUNTIME_IDENTITY_TOKEN_FILE_ENV})"
+    try:
+        with open(path, "rb") as token_file:
+            raw = token_file.read()
+    except FileNotFoundError:
+        raise RuntimeIdentityTokenError(f"{source} does not exist.") from None
+    except OSError as exc:
+        raise RuntimeIdentityTokenError(
+            f"{source} could not be read ({type(exc).__name__})."
+        ) from None
+    try:
+        token = raw.decode("utf-8").strip()
+    except UnicodeDecodeError:
+        # Raised below, outside this handler: the decode error holds the bytes.
+        token = None
+    if token is None:
+        raise RuntimeIdentityTokenError(f"{source} does not hold a token.")
+    if not token:
+        raise RuntimeIdentityTokenError(f"{source} is empty.")
+    return token
+
+
+def _request_body(
+    credential_id: str,
+    credential_secret: str | None,
+    identity_token_file: str | None,
+) -> dict[str, str]:
+    if identity_token_file:
+        return {
+            "credential_id": credential_id,
+            "workload_identity_token": _read_identity_token(identity_token_file),
+        }
+    return {"credential_id": credential_id, "credential_secret": credential_secret or ""}
+
+
+def _retry_delay(response: Any, attempt: int) -> float:
+    delay = min(EXCHANGE_BACKOFF_FACTOR * 2**attempt, Retry.DEFAULT_BACKOFF_MAX)
+    retry_after = (getattr(response, "headers", None) or {}).get("Retry-After")
+    if retry_after is not None:
+        try:
+            delay = max(delay, _RETRY_AFTER.parse_retry_after(str(retry_after)))
+        except InvalidHeader:
+            pass
+    return delay
+
+
+def exchange_runtime_credential(
+    send: Callable[[dict[str, str]], Any],
+    *,
+    credential_id: str,
+    credential_secret: str | None,
+    identity_token_file: str | None,
+    deadline: float,
+    on_retry: Callable[[int, float], None] | None = None,
+) -> Any:
+    """
+    Send one runtime credential exchange and return the last response.
+
+    Parameters
+    ----------
+    send:
+        Posts the JSON body it is given to the exchange route and returns the
+        response. It is called once per attempt.
+    credential_id:
+        The runtime credential ID.
+    credential_secret:
+        The bootstrap secret. Ignored when ``identity_token_file`` is set.
+    identity_token_file:
+        The projected token file. It is read again for every attempt.
+    deadline:
+        ``time.monotonic()`` value after which no retry starts.
+    on_retry:
+        Called with the status and the delay before each retry.
+
+    A ``429`` or ``503`` answer is retried up to ``EXCHANGE_RETRIES`` times. The
+    wait is the exponential backoff or the answer's ``Retry-After``, whichever is
+    longer; a wait that would not end before ``deadline`` ends the retries. Any
+    other answer, ``401`` included, is returned at once and the proof is never
+    switched. ``RuntimeIdentityTokenError`` is raised when the token file cannot
+    be used.
+    """
+    for attempt in range(EXCHANGE_RETRIES + 1):
+        response = send(_request_body(credential_id, credential_secret, identity_token_file))
+        status = response.status_code
+        if status not in RETRYABLE_EXCHANGE_STATUSES or attempt == EXCHANGE_RETRIES:
+            return response
+        delay = _retry_delay(response, attempt)
+        if delay >= deadline - time.monotonic():
+            return response
+        if on_retry is not None:
+            on_retry(status, delay)
+        close = getattr(response, "close", None)
+        if callable(close):
+            close()
+        time.sleep(delay)
+    raise AssertionError("Unreachable retry state")

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.8.dev44
+Version: 9.0.9
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/mainsequence.egg-info/SOURCES.txt

@@ -20,6 +20,7 @@ mainsequence/code_repository_skills.py
 mainsequence/defaults.py
 mainsequence/logconf.py
 mainsequence/repository_identity_security.py
+mainsequence/runtime_credential_exchange.py
 mainsequence/runtime_flags.py
 mainsequence/scaffold_skills.py
 mainsequence.egg-info/PKG-INFO
@@ -74,6 +75,7 @@ tests/test_code_repository_branch_contract.py
 tests/test_code_repository_documentation_contract.py
 tests/test_code_repository_runtime_context.py
 tests/test_code_repository_skills.py
+tests/test_credential_repr.py
 tests/test_dependency_extras.py
 tests/test_dev_release_version.py
 tests/test_environment_resource_context.py
@@ -90,6 +92,7 @@ tests/test_logconf.py
 tests/test_models_user_request_bound_auth.py
 tests/test_notification_uid_contract.py
 tests/test_observability_client.py
+tests/test_runtime_credential_exchange.py
 tests/test_scaffold_skills.py
 tests/test_secret_client_model.py
 tests/test_source_ownership.py

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.8.dev44"
+version = "9.0.9"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/tests/test_auth_precedence.py

@@ -150,6 +150,7 @@ def test_logconf_runtime_credential_exchanges_before_startup_state_request(monke
                 "credential_secret": "cred-secret",
             },
             "timeout": 10.0,
+            "allow_redirects": False,
         }
     ]
     assert os.environ["MAINSEQUENCE_ACCESS_TOKEN"] == "runtime-access"

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/tests/test_cli_secure_storage.py

@@ -1021,3 +1021,20 @@ def test_session_report_for_a_runtime_credential_has_no_session_expiry(monkeypat
     assert report["session_expires_at"] is None
     assert report["auth_mode"] == "runtime_credential"
     assert "cred-secret" not in json.dumps(report)
+
+
+def test_session_report_accepts_a_runtime_identity_token_file(monkeypatch, tmp_path):
+    _isolate_auth(monkeypatch, tmp_path, None)
+    monkeypatch.setattr(config, "auth_persistence_label", lambda: "test store")
+    token_file = tmp_path / "token"
+    token_file.write_text("projected-token", encoding="utf-8")
+    monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
+    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "cred-id")
+    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", raising=False)
+    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", str(token_file))
+
+    report = config.session_report()
+
+    assert report["authenticated"] is True
+    assert report["session_expires_at"] is None
+    assert "projected-token" not in json.dumps(report)

{mainsequence-9.0.8.dev44 → mainsequence-9.0.9}/tests/test_code_repository_runtime_context.py

@@ -368,10 +368,21 @@ def test_authenticated_runtime_context_detects_git_drift(monkeypatch):
         code_repository_context.validate_code_repository_source_context(context=context)
 
 
-def test_configured_runtime_credential_exchanges_context_before_resolution(monkeypatch):
+@pytest.mark.parametrize(
+    ("proof_variable", "proof_value"),
+    [
+        ("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "credential-secret"),
+        ("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", "/var/run/secrets/runtime-identity/token"),
+    ],
+)
+def test_configured_runtime_credential_exchanges_context_before_resolution(
+    monkeypatch, proof_variable, proof_value
+):
     monkeypatch.setenv("MAINSEQUENCE_AUTH_MODE", "runtime_credential")
     monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_ID", "credential-id")
-    monkeypatch.setenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", "credential-secret")
+    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET", raising=False)
+    monkeypatch.delenv("MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE", raising=False)
+    monkeypatch.setenv(proof_variable, proof_value)
     events = []
     monkeypatch.setattr(
         code_repository_context,