mainsequence 9.0.9.dev46__tar.gz → 9.0.10__tar.gz

{mainsequence-9.0.9.dev46 → mainsequence-9.0.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.9.dev46
+Version: 9.0.10
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.9.dev46 → mainsequence-9.0.10}/agent_scaffold/skills/application_surfaces/api_surfaces/SKILL.md

@@ -138,11 +138,14 @@ remain projections of the same identity, not a separate resolver. Outside an
 authenticated request, including public routes, `User.get_logged_user()` raises
 `RequestIdentityError`.
 
-On a protected route, this identity is the human making the current HTTP
-request. It is not the release creator, deployment owner, runtime workload
-principal, or the process account returned by `User.get_authenticated_user_details()`.
-Caller authentication is not resource authorization; apply the endpoint's
-application policy using the verified user UID.
+On a protected route, this identity is the caller of the current HTTP request:
+a person, or the workload identity a deployed Job, FastAPI release or Agent runs
+as. It is not the release creator, deployment owner, the application's own
+runtime workload principal, or the process account returned by
+`User.get_authenticated_user_details()`. To tell a workload caller from a
+person, read `User.get_by_uid(uid)`: a workload identity has `identity_type`
+`"workload"`. Caller authentication is not resource authorization; apply the
+endpoint's application policy using the verified user UID.
 
 WebSockets retain the platform's gateway ticket/header contract rather than
 the HTTP Bearer/assertion flow; the getter is available while the authenticated

{mainsequence-9.0.9.dev46 → mainsequence-9.0.10}/agent_scaffold/skills/mainsequence-inference/SKILL.md

@@ -46,6 +46,21 @@ context. Never invent an Environment, use another branch as a fallback, or add
 inference environment variables. Provider secrets remain in existing server-side
 credential storage and must not appear in messages or `provider_options`.
 
+## Select a configured provider
+
+Pass optional `custom_id="openai-work"` to `client.complete()` to select that named
+credential within the caller's Environment. Omit it to retain the first available
+owned credential, then the first shared credential. A missing or ambiguous explicit
+name fails; do not retry using a different credential. Recorded requests retain the
+exact credential UID for replay. Custom endpoints use their existing provider
+identifier and do not accept `custom_id`.
+
+Sharing a configured provider authorizes recipients, including workload users,
+to use its credentials and receive them in local Tau. They may copy those credentials;
+revoking a share cannot remove copies already delivered. Explain this before
+guiding someone through sharing. This inference client executes on the server;
+provider management remains with the existing provider clients.
+
 ## Construct a completion envelope
 
 Every call supplies complete ordered text messages: `system`, `user`, `assistant`.

{mainsequence-9.0.9.dev46 → mainsequence-9.0.10}/mainsequence/client/agent_runtime_models.py

@@ -727,6 +727,7 @@ class Agent(
         llm_provider: str | None = None,
         llm_model: str | None = None,
         llm_thinking: str | None = None,
+        custom_id: str | None = None,
         timeout=None,
     ) -> AgentSession:
         """
@@ -759,6 +760,10 @@ class Agent(
             "llm_provider": llm_provider,
             "llm_model": llm_model,
             "llm_thinking": llm_thinking,
+            "custom_id": (
+                custom_id
+                if custom_id is not None else None
+            ),
         }
         if resolved_session_uid and any(value is not None for value in creation_options.values()):
             raise ValueError("Creation options require handle_unique_id, not session_uid")
@@ -787,7 +792,14 @@ class Agent(
         session_payload = response.json()
         if not isinstance(session_payload, dict):
             raise TypeError("get_or_create_session response must be an AgentSession object")
-        return AgentSession(**session_payload)
+        session = AgentSession(**session_payload)
+        if (
+            custom_id is not None
+            and session.custom_id
+            != creation_options["custom_id"]
+        ):
+            raise ValueError("The returned session does not use the requested configured provider")
+        return session
 
 
 class AgentSessionInsightsBase(BasePydanticModel):
@@ -1745,6 +1757,10 @@ class AgentSession(
         None,
         description="Timestamp when the session was archived.",
     )
+    model_provider_credential_uid: str | None = None
+    custom_id: str | None = Field(
+        None, description="Resolved configured provider name; None for custom endpoints."
+    )
     llm_provider: str = Field(
         ...,
         description="Resolved LLM provider actually used for this session. Unlike Agent defaults, this is intended to be the authoritative runtime record.",

{mainsequence-9.0.9.dev46 → mainsequence-9.0.10}/mainsequence/client/inference.py

@@ -20,6 +20,8 @@ class InferenceResult(BaseModel):
     sequence: int
     provider: str
     model: str
+    custom_id: str | None = None
+    model_provider_credential_uid: str | None = None
     status: str
     error_code: str
     content_available: bool
@@ -125,6 +127,7 @@ class InferenceClient:
         messages: list[dict[str, str]],
         idempotency_key: str,
         conversation_uid: str | UUID | None = None,
+        custom_id: str | None = None,
         thinking_level: str | None = None,
         provider_options: dict[str, Any] | None = None,
         provider_storage: dict[str, Any] | None = None,
@@ -142,6 +145,8 @@ class InferenceClient:
                 "idempotency_key must contain 1–128 letters, digits, dots, underscores, colons or hyphens."
             )
         body = {"provider": provider, "model": model, "messages": deepcopy(messages)}
+        if custom_id is not None:
+            body["custom_id"] = custom_id
         if conversation_uid is not None:
             body["conversation_uid"] = str(UUID(str(conversation_uid)))
         for name, value in (
@@ -153,9 +158,15 @@ class InferenceClient:
         ):
             if value is not None:
                 body[name] = deepcopy(value)
-        return self._request(
+        result = self._request(
             "POST", "inference/completions/", body=body, key=idempotency_key, timeout=timeout
         )
+        if (
+            custom_id is not None
+            and result.custom_id != body["custom_id"]
+        ):
+            raise InferenceTransportError(idempotency_key)
+        return result
 
     def conversations(self, *, limit: int = 25, offset: int = 0) -> dict[str, Any]:
         return self._request(

{mainsequence-9.0.9.dev46 → mainsequence-9.0.10}/mainsequence/client/models_user.py

@@ -23,14 +23,21 @@ from .value_sets import OpenValueSet
 
 
 class RequestUserIdentity(BaseModel):
-    """Minimal identity of the human making the current runtime request."""
+    """Minimal identity of the caller of the current runtime request.
+
+    The caller is a person or a workload identity; ``User.get_by_uid(uid)``
+    reads its User.
+    """
 
     model_config = ConfigDict(extra="forbid", frozen=True)
 
     uid: str = Field(
         ...,
         title="User UID",
-        description="Canonical public UUID of the human making the current request.",
+        description=(
+            "Canonical public UUID of the User making the current request, a person or a "
+            "workload identity."
+        ),
     )
     username: str | None = Field(
         None,
@@ -954,6 +961,17 @@ class ShareableAccessState(BasePydanticModel):
 
 
 class User(UserApiBaseObjectOrm, BasePydanticModel):
+    """A platform User: a person, or the workload identity a deployed Job,
+    FastAPI release or Agent runs as.
+
+    A workload identity is read with ``User.get_by_uid(uid)`` or listed with
+    ``User.filter(identity_type="workload")``. Its row carries ``uid``,
+    ``identity_type`` (``"workload"``), ``is_active`` and the UID of its
+    workload in ``job_uid``, ``resource_release_uid`` or ``agent_uid``, without
+    a username, email, join date or name. Fields the row does not carry are
+    ``None``, or empty for lists.
+    """
+
     # Platform facts, not application authorization policy. None means the
     # connected platform has not supplied the versioned additive contract.
     is_organization_admin: StrictBool | None = None
@@ -963,6 +981,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
     FILTERSET_FIELDS: ClassVar[dict[str, list[str]] | None] = {
         "uid": ["exact", "in"],
         "email": ["exact", "contains", "in"],
+        "identity_type": ["exact"],
     }
     FILTER_VALUE_NORMALIZERS: ClassVar[dict[str, str]] = {
         "uid": "uid",
@@ -970,6 +989,7 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         "email": "str",
         "email__contains": "str",
         "email__in": "str",
+        "identity_type": "str",
     }
 
     id: int | None = Field(
@@ -985,6 +1005,35 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="Stable public unique identifier of the user.",
         examples=["8f5d6b54-2f5e-4a8b-bb10-0b17f3f4c123"],
     )
+    identity_type: (
+        OpenValueSet[Literal["human", "service_account", "deleted_user", "workload"]] | None
+    ) = Field(
+        None,
+        title="Identity Type",
+        description=(
+            "Kind of identity: `workload` for the identity a deployed Job, FastAPI release "
+            "or Agent runs as. None when the response does not carry it."
+        ),
+        examples=["workload"],
+    )
+    job_uid: str | None = Field(
+        None,
+        title="Job UID",
+        description="UID of the Job a workload identity belongs to; None otherwise.",
+        examples=["88888888-8888-4888-8888-888888888888"],
+    )
+    resource_release_uid: str | None = Field(
+        None,
+        title="Resource Release UID",
+        description="UID of the release a workload identity belongs to; None otherwise.",
+        examples=[None],
+    )
+    agent_uid: str | None = Field(
+        None,
+        title="Agent UID",
+        description="UID of the Agent a workload identity belongs to; None otherwise.",
+        examples=[None],
+    )
     profile_picture: str | None = Field(
         None,
         title="Profile Picture URL",
@@ -1022,10 +1071,13 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         examples=["enterprise"],
     )
 
-    date_joined: datetime.datetime = Field(
-        ...,
+    date_joined: datetime.datetime | None = Field(
+        None,
         title="Date Joined",
-        description="Timestamp when the user account was created.",
+        description=(
+            "Timestamp when the user account was created. None when the response does not "
+            "carry it, as for a workload identity."
+        ),
         examples=["2025-01-10T08:15:00Z"],
     )
     is_active: bool = Field(
@@ -1034,16 +1086,22 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="Whether the user account is active.",
         examples=[True],
     )
-    username: str = Field(
-        ...,
+    username: str | None = Field(
+        None,
         title="Username",
-        description="Unique username used by the platform.",
+        description=(
+            "Unique username used by the platform. None when the response does not carry it, "
+            "as for a workload identity."
+        ),
         examples=["jose@main-sequence.io"],
     )
-    email: str = Field(
-        ...,
+    email: str | None = Field(
+        None,
         title="Email",
-        description="Primary email address of the user.",
+        description=(
+            "Primary email address of the user. None when the response does not carry it, "
+            "as for a workload identity."
+        ),
         examples=["jose@main-sequence.io"],
     )
     first_name: str | None = Field(
@@ -1064,16 +1122,22 @@ class User(UserApiBaseObjectOrm, BasePydanticModel):
         description="Timestamp of the last successful login.",
         examples=["2026-03-15T11:20:00Z"],
     )
-    api_request_limit: int = Field(
-        ...,
+    api_request_limit: int | None = Field(
+        None,
         title="API Request Limit",
-        description="Maximum number of API requests available to the user in the current limit window.",
+        description=(
+            "Maximum number of API requests available to the user in the current limit "
+            "window. None when the response does not carry it, as for a workload identity."
+        ),
         examples=[10000],
     )
-    mfa_enabled: bool = Field(
-        ...,
+    mfa_enabled: bool | None = Field(
+        None,
         title="MFA Enabled",
-        description="Whether multi-factor authentication is enabled for the user.",
+        description=(
+            "Whether multi-factor authentication is enabled for the user. None when the "
+            "response does not carry it, as for a workload identity."
+        ),
         examples=[True],
     )
     organization: Organization | None = Field(

{mainsequence-9.0.9.dev46 → mainsequence-9.0.10}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.9.dev46
+Version: 9.0.10
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.9.dev46 → mainsequence-9.0.10}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.9.dev46"
+version = "9.0.10"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-9.0.9.dev46 → mainsequence-9.0.10}/tests/test_inference_client.py

@@ -165,3 +165,33 @@ def test_invalid_success_is_uncertain_and_never_retried(transport, invalid):
     assert exc.value.idempotency_key == "stable"
     assert session.request.call_count == 1
     assert session.request.call_args.kwargs["allow_redirects"] is False
+
+
+@pytest.mark.parametrize("subscription_uid", [None, "11111111-1111-4111-8111-111111111111"])
+def test_completion_subscription_is_optional_and_preserves_request_identity(transport, subscription_uid):
+    session, response, _ = transport
+    response.json.return_value = result(custom_id=subscription_uid)
+    answer = inference.InferenceClient().complete(
+        provider="openai", model="configured-model", messages=[], idempotency_key="stable",
+        custom_id=subscription_uid,
+    )
+    body = session.request.call_args.kwargs["json"]
+    assert answer.custom_id == subscription_uid
+    assert session.request.call_args.kwargs["headers"]["Idempotency-Key"] == "stable"
+    if subscription_uid is None:
+        assert "custom_id" not in body
+    else:
+        assert body["custom_id"] == subscription_uid
+
+
+@pytest.mark.parametrize("resolved", [None, "22222222-2222-4222-8222-222222222222"])
+def test_completion_does_not_accept_ignored_or_different_subscription(transport, resolved):
+    session, response, _ = transport
+    response.json.return_value = result(custom_id=resolved)
+    with pytest.raises(inference.InferenceTransportError) as error:
+        inference.InferenceClient().complete(
+            provider="openai", model="configured-model", messages=[], idempotency_key="stable",
+            custom_id="11111111-1111-4111-8111-111111111111",
+        )
+    assert error.value.idempotency_key == "stable"
+    assert session.request.call_count == 1