meridian-client 0.1.0__tar.gz

meridian_client-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 knjpollard
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

meridian_client-0.1.0/PKG-INFO

@@ -0,0 +1,193 @@
+Metadata-Version: 2.4
+Name: meridian-client
+Version: 0.1.0
+Summary: Python SDK for Meridian Governance Router
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/knjpollard/meridian
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.28.0
+Dynamic: license-file
+
+---
+name: meridian-integration
+description: How to call Meridian (the governance router) correctly from a new, standalone client — auth, the onboarding sequence, and what's still house/console-only.
+---
+
+# Integrating with Meridian
+
+Meridian is a policy-governed inference router: you ask it "which model should
+`agent_name` use right now", and it answers using project/agent policy
+(quality, cost, risk, allowed/denied hubs, data classification) rather than
+you hardcoding a model name. It knows nothing about MTA specifically — any
+client that holds a valid key can use it standalone.
+
+Full generated route-by-route reference: `docs/api/api-reference.md` in this
+repo (regenerate with `python3 scripts/gen_api_docs.py` after any route
+change — it reads the live FastAPI app, so it can't go stale the way a
+hand-written doc can).
+
+## Install
+
+```bash
+pip install meridian-client          # published — the normal path, or
+pip install -e meridian-client/      # editable, from this repo (contributing to the SDK itself)
+```
+
+Prefer a terminal to Python? `pip install meridian-governance-cli` wraps
+this same SDK as subcommands (`meridian signup`, `meridian resolve
+my_agent`, `meridian keys list`, ...) — installs as the `meridian` command;
+see `meridian-cli/README.md` (not to be confused with the unrelated
+`meridian-cli` package also on PyPI). No chat loop, no personas; it's a
+management CLI over the API, not a clone of `mta-cli`'s consumer-companion
+command set.
+
+## Auth — read this before anything else
+
+Meridian accepts a key two ways; it doesn't matter which:
+
+```
+Authorization: Bearer mdn_xxxxxxxx
+x-api-key: mdn_xxxxxxxx
+```
+
+With no key at all: **on-prem only**, and only if that instance was started
+without `MERIDIAN_AUTH_REQUIRED=true`. The request resolves to the instance's
+single default org. Every cloud deployment (`dev-meridian.mytrustworthy.ai`
+and any other `MERIDIAN_DEPLOYMENT=cloud` instance) requires a key — no key
+gets a flat 401, not a default org.
+
+## Getting your first key
+
+```python
+from meridian import Meridian
+
+m = Meridian.signup("https://dev-meridian.mytrustworthy.ai",
+    org_name="my-project", email="me@example.com", password="...")
+# m is now an authenticated client. m.org_id and m.signup_response are set.
+```
+
+One call: creates a new org (always `free` tier — self-serve can't grant
+itself more than that), its first user, and its first key, and returns a
+`Meridian` already authenticated with it. This is the *only* unauthenticated
+write on the whole API — everywhere else, minting a key or registering a
+user needs an `org_id` that a cold caller doesn't have yet, which is exactly
+the chicken-and-egg problem this one call exists to break.
+
+If you already have a key (an account team provisioned you directly, or
+you're adding a second client to an org that already signed up):
+
+```python
+m = Meridian("https://dev-meridian.mytrustworthy.ai", api_key="mdn_...")
+```
+
+## Three tiers, one engine
+
+There's one governance engine underneath all of this — the tiers below are
+just how much of it you choose to use, not three different products:
+
+- **Individual / fast start:** pin a model and go. `pinned_model` skips
+  scoring entirely (`resolver.py`'s "Step 3: Pinned model — skip scoring") —
+  deterministic, zero policy to configure.
+- **Business / small team:** the quality/cost/risk sliders. Same `create_agent`
+  call, just set overrides instead of (or in addition to) a pin; invite
+  teammates into the same org via `POST /api/v1/auth/register` once you're
+  authenticated.
+- **Enterprise / custom governance:** change-requests and approval
+  (`create_change_request` → `approve_change_request`), hub allow/denylists,
+  data classification enforcement (`pii` hard-forces risk to 1, on-prem only).
+  All already built; nothing here is Enterprise-only code, just the parts a
+  fast-start integration doesn't need to touch.
+
+## The onboarding sequence
+
+A tenant key can do all of this itself — no console needed past signup:
+
+```python
+# 1. A project: your governance boundary. One org can have many.
+project = m.create_project(
+    org_id=m.org_id,
+    name="my-standalone-agent",
+    quality=7, cost=5, risk=5,          # 0-10 sliders, project-level defaults
+    classification="general",            # "pii" forces risk=1 regardless of the slider
+)
+
+# 2. An agent inside it. This is the identity you resolve against — not a
+#    user, not an API key, an AGENT. One project can have many, each with its
+#    own overrides.
+agent = m.create_agent(
+    project.id, "my_agent",
+    quality_override=9,                  # omit to inherit the project default
+    allowed_hubs=["anthropic-direct", "bedrock"],  # omit for no hub restriction
+)
+
+# 3. Resolve. Call this every time you're about to make an inference call —
+#    it's cheap, and policy can change between calls.
+decision = m.resolve("my_agent", project_id=project.id)
+print(decision.model, decision.hub)      # e.g. "claude-opus-5" "anthropic-direct"
+
+# 4. After the real inference call, report usage so cost tracking means
+#    something.
+m.audit(decision.routing_log_id, input_tokens=512, output_tokens=128,
+         latency_ms=840)
+```
+
+That's the whole golden path. `m.explain(decision.routing_log_id)` gets you
+the full candidate breakdown (every model considered, why each one was
+eliminated or scored where it scored) if you need to show your work.
+
+## Without the SDK (raw HTTP)
+
+```bash
+curl -X POST https://dev-meridian.mytrustworthy.ai/api/v1/resolve \
+  -H "Authorization: Bearer mdn_..." -H "Content-Type: application/json" \
+  -d '{"agent_name": "my_agent", "project_id": 123}'
+```
+
+Every route in `docs/api/api-reference.md` works the same way — method, path,
+JSON body of the fields listed, same two auth headers.
+
+## What a tenant key cannot do (yet)
+
+`docs/api/api-reference.md` marks every route **tenant key: yes/no**. The
+"no" routes answer `403 "This route is not yet tenant-scoped; refused for
+tenant keys"` regardless of whether your key is valid — it's a blanket
+refusal by path, not a permission check. As of this writing that's mainly:
+hub/model/deployment registration and edits, org creation and edits, and most
+cost/governance console views. Those need a house key or the console. Project
+and agent create/update/delete, resolve, audit, explain, simulate, and
+change-requests are all tenant-reachable.
+
+## Gotchas
+
+- **`PUT /api/v1/projects/{id}/lifecycle` is a stub.** It validates the
+  request and echoes the current row back — it does not change anything.
+  Don't build on it (`meridian#7`'s predecessor finding).
+- **The SDK's response objects have an `.extra` dict.** Every typed field the
+  SDK knows about is a real attribute (`agent.allowed_hubs`); anything the
+  server returns that this SDK version doesn't model yet lands in
+  `agent.extra` instead of silently vanishing. If a field you expect is
+  `None`, check `.extra` before assuming the server didn't send it.
+- **`resolve_failover` only writes an audit record if you pass
+  `agent_name`.** Without it you get a plain hub-allowlist fallback with no
+  governance and no audit trail — fine for "just get me anything that
+  works", wrong for anything that needs to explain itself later.
+- **Tool-access governance does not exist yet.** Meridian governs *which
+  model* an agent may use. It does not yet govern *which tools* an agent may
+  call — there's no route for it, and the schema slots for it
+  (`agent.agent_tools`, `agent.skill_ids`) are unpopulated. If your new agent
+  needs Meridian to gate tool access rather than just model choice, that's a
+  real gap, not a documentation gap — see
+  `obsidian-vault-kb/relays/meridian/2026-10-12-should-meridian-govern-tools-and-what-that-costs-in-apis.md`
+  for the live design discussion.
+- **Forgot a built-in-auth password? `POST /auth/forgot-password` /
+  `POST /auth/reset-password`** (meridian#10), also reachable from the
+  console's "Forgot password?" link. Requires `RESEND_API_KEY` to actually
+  be configured on the instance — without it the request fails loudly
+  rather than handing the token back in the response. That's deliberate:
+  an earlier version of this capability did exactly that and was removed on
+  2026-09-12 because it let anyone who knew an email address take over that
+  account. There is no magic-link *login* — only password reset; you still
+  need to know a password to sign in, the email only proves you own the
+  inbox.

meridian_client-0.1.0/README.md

@@ -0,0 +1,22 @@
+# meridian-client
+
+Python SDK for [Meridian Governance Router](https://dev-meridian.mytrustworthy.ai/) — one class over the REST API, no database access.
+
+```python
+from meridian import Meridian
+
+m = Meridian.signup("https://dev-meridian.mytrustworthy.ai",
+    org_name="acme", email="me@acme.com", password="...")
+
+project  = m.create_project(org_id=m.org_id, name="support", quality=8, cost=4, risk=5)
+agent    = m.create_agent(project.id, "ticket_summariser", cost_override=8)
+decision = m.resolve("ticket_summariser")
+
+print(decision.model, decision.hub, decision.routing_log_id)
+```
+
+Already have a key? `Meridian(base_url, api_key="mdn_...")` — skip signup.
+
+Full quickstart, tiers, and gotchas: [dev-meridian.mytrustworthy.ai/docs](https://dev-meridian.mytrustworthy.ai/docs/index.html#quickstart). Full generated API reference, every route: [dev-meridian.mytrustworthy.ai/docs/#api-reference](https://dev-meridian.mytrustworthy.ai/docs/index.html#api-reference).
+
+Prefer a terminal to Python? See [`meridian-governance-cli`](https://pypi.org/project/meridian-governance-cli/) — a command-line client over this same SDK.

meridian_client-0.1.0/SKILL.md

@@ -0,0 +1,181 @@
+---
+name: meridian-integration
+description: How to call Meridian (the governance router) correctly from a new, standalone client — auth, the onboarding sequence, and what's still house/console-only.
+---
+
+# Integrating with Meridian
+
+Meridian is a policy-governed inference router: you ask it "which model should
+`agent_name` use right now", and it answers using project/agent policy
+(quality, cost, risk, allowed/denied hubs, data classification) rather than
+you hardcoding a model name. It knows nothing about MTA specifically — any
+client that holds a valid key can use it standalone.
+
+Full generated route-by-route reference: `docs/api/api-reference.md` in this
+repo (regenerate with `python3 scripts/gen_api_docs.py` after any route
+change — it reads the live FastAPI app, so it can't go stale the way a
+hand-written doc can).
+
+## Install
+
+```bash
+pip install meridian-client          # published — the normal path, or
+pip install -e meridian-client/      # editable, from this repo (contributing to the SDK itself)
+```
+
+Prefer a terminal to Python? `pip install meridian-governance-cli` wraps
+this same SDK as subcommands (`meridian signup`, `meridian resolve
+my_agent`, `meridian keys list`, ...) — installs as the `meridian` command;
+see `meridian-cli/README.md` (not to be confused with the unrelated
+`meridian-cli` package also on PyPI). No chat loop, no personas; it's a
+management CLI over the API, not a clone of `mta-cli`'s consumer-companion
+command set.
+
+## Auth — read this before anything else
+
+Meridian accepts a key two ways; it doesn't matter which:
+
+```
+Authorization: Bearer mdn_xxxxxxxx
+x-api-key: mdn_xxxxxxxx
+```
+
+With no key at all: **on-prem only**, and only if that instance was started
+without `MERIDIAN_AUTH_REQUIRED=true`. The request resolves to the instance's
+single default org. Every cloud deployment (`dev-meridian.mytrustworthy.ai`
+and any other `MERIDIAN_DEPLOYMENT=cloud` instance) requires a key — no key
+gets a flat 401, not a default org.
+
+## Getting your first key
+
+```python
+from meridian import Meridian
+
+m = Meridian.signup("https://dev-meridian.mytrustworthy.ai",
+    org_name="my-project", email="me@example.com", password="...")
+# m is now an authenticated client. m.org_id and m.signup_response are set.
+```
+
+One call: creates a new org (always `free` tier — self-serve can't grant
+itself more than that), its first user, and its first key, and returns a
+`Meridian` already authenticated with it. This is the *only* unauthenticated
+write on the whole API — everywhere else, minting a key or registering a
+user needs an `org_id` that a cold caller doesn't have yet, which is exactly
+the chicken-and-egg problem this one call exists to break.
+
+If you already have a key (an account team provisioned you directly, or
+you're adding a second client to an org that already signed up):
+
+```python
+m = Meridian("https://dev-meridian.mytrustworthy.ai", api_key="mdn_...")
+```
+
+## Three tiers, one engine
+
+There's one governance engine underneath all of this — the tiers below are
+just how much of it you choose to use, not three different products:
+
+- **Individual / fast start:** pin a model and go. `pinned_model` skips
+  scoring entirely (`resolver.py`'s "Step 3: Pinned model — skip scoring") —
+  deterministic, zero policy to configure.
+- **Business / small team:** the quality/cost/risk sliders. Same `create_agent`
+  call, just set overrides instead of (or in addition to) a pin; invite
+  teammates into the same org via `POST /api/v1/auth/register` once you're
+  authenticated.
+- **Enterprise / custom governance:** change-requests and approval
+  (`create_change_request` → `approve_change_request`), hub allow/denylists,
+  data classification enforcement (`pii` hard-forces risk to 1, on-prem only).
+  All already built; nothing here is Enterprise-only code, just the parts a
+  fast-start integration doesn't need to touch.
+
+## The onboarding sequence
+
+A tenant key can do all of this itself — no console needed past signup:
+
+```python
+# 1. A project: your governance boundary. One org can have many.
+project = m.create_project(
+    org_id=m.org_id,
+    name="my-standalone-agent",
+    quality=7, cost=5, risk=5,          # 0-10 sliders, project-level defaults
+    classification="general",            # "pii" forces risk=1 regardless of the slider
+)
+
+# 2. An agent inside it. This is the identity you resolve against — not a
+#    user, not an API key, an AGENT. One project can have many, each with its
+#    own overrides.
+agent = m.create_agent(
+    project.id, "my_agent",
+    quality_override=9,                  # omit to inherit the project default
+    allowed_hubs=["anthropic-direct", "bedrock"],  # omit for no hub restriction
+)
+
+# 3. Resolve. Call this every time you're about to make an inference call —
+#    it's cheap, and policy can change between calls.
+decision = m.resolve("my_agent", project_id=project.id)
+print(decision.model, decision.hub)      # e.g. "claude-opus-5" "anthropic-direct"
+
+# 4. After the real inference call, report usage so cost tracking means
+#    something.
+m.audit(decision.routing_log_id, input_tokens=512, output_tokens=128,
+         latency_ms=840)
+```
+
+That's the whole golden path. `m.explain(decision.routing_log_id)` gets you
+the full candidate breakdown (every model considered, why each one was
+eliminated or scored where it scored) if you need to show your work.
+
+## Without the SDK (raw HTTP)
+
+```bash
+curl -X POST https://dev-meridian.mytrustworthy.ai/api/v1/resolve \
+  -H "Authorization: Bearer mdn_..." -H "Content-Type: application/json" \
+  -d '{"agent_name": "my_agent", "project_id": 123}'
+```
+
+Every route in `docs/api/api-reference.md` works the same way — method, path,
+JSON body of the fields listed, same two auth headers.
+
+## What a tenant key cannot do (yet)
+
+`docs/api/api-reference.md` marks every route **tenant key: yes/no**. The
+"no" routes answer `403 "This route is not yet tenant-scoped; refused for
+tenant keys"` regardless of whether your key is valid — it's a blanket
+refusal by path, not a permission check. As of this writing that's mainly:
+hub/model/deployment registration and edits, org creation and edits, and most
+cost/governance console views. Those need a house key or the console. Project
+and agent create/update/delete, resolve, audit, explain, simulate, and
+change-requests are all tenant-reachable.
+
+## Gotchas
+
+- **`PUT /api/v1/projects/{id}/lifecycle` is a stub.** It validates the
+  request and echoes the current row back — it does not change anything.
+  Don't build on it (`meridian#7`'s predecessor finding).
+- **The SDK's response objects have an `.extra` dict.** Every typed field the
+  SDK knows about is a real attribute (`agent.allowed_hubs`); anything the
+  server returns that this SDK version doesn't model yet lands in
+  `agent.extra` instead of silently vanishing. If a field you expect is
+  `None`, check `.extra` before assuming the server didn't send it.
+- **`resolve_failover` only writes an audit record if you pass
+  `agent_name`.** Without it you get a plain hub-allowlist fallback with no
+  governance and no audit trail — fine for "just get me anything that
+  works", wrong for anything that needs to explain itself later.
+- **Tool-access governance does not exist yet.** Meridian governs *which
+  model* an agent may use. It does not yet govern *which tools* an agent may
+  call — there's no route for it, and the schema slots for it
+  (`agent.agent_tools`, `agent.skill_ids`) are unpopulated. If your new agent
+  needs Meridian to gate tool access rather than just model choice, that's a
+  real gap, not a documentation gap — see
+  `obsidian-vault-kb/relays/meridian/2026-10-12-should-meridian-govern-tools-and-what-that-costs-in-apis.md`
+  for the live design discussion.
+- **Forgot a built-in-auth password? `POST /auth/forgot-password` /
+  `POST /auth/reset-password`** (meridian#10), also reachable from the
+  console's "Forgot password?" link. Requires `RESEND_API_KEY` to actually
+  be configured on the instance — without it the request fails loudly
+  rather than handing the token back in the response. That's deliberate:
+  an earlier version of this capability did exactly that and was removed on
+  2026-09-12 because it let anyone who knew an email address take over that
+  account. There is no magic-link *login* — only password reset; you still
+  need to know a password to sign in, the email only proves you own the
+  inbox.

meridian_client-0.1.0/meridian/__init__.py

@@ -0,0 +1,17 @@
+"""Meridian Governance Router — Python SDK.
+
+from meridian import Meridian
+m = Meridian("http://meridian:8080")
+decision = m.resolve("my_agent")
+"""
+
+from .client import Meridian
+from .models import Org, Project, Agent, Hub, Model, Deployment, Principal, Decision, ChangeRequest
+from .exceptions import MeridianError, NotFoundError, ConflictError, ValidationError, ServerError
+
+__version__ = "0.1.0"
+__all__ = [
+    "Meridian",
+    "Org", "Project", "Agent", "Hub", "Model", "Deployment", "Principal", "Decision", "ChangeRequest",
+    "MeridianError", "NotFoundError", "ConflictError", "ValidationError", "ServerError",
+]

meridian_client-0.1.0/meridian/client.py

@@ -0,0 +1,405 @@
+"""Meridian SDK — one class, all methods.
+
+from meridian import Meridian
+m = Meridian("http://meridian:8080")
+decision = m.resolve("my_agent")
+
+Against a deployment with auth enabled (every cloud instance; any on-prem
+instance that has API keys configured), pass `api_key`:
+
+from meridian import Meridian
+m = Meridian("https://dev-meridian.mytrustworthy.ai", api_key="mdn_...")
+
+Without `api_key`, no Authorization/x-api-key header is sent at all. That is
+only valid against an on-prem instance running with MERIDIAN_AUTH_REQUIRED
+unset — it resolves to that instance's default org. Every other deployment
+answers 401.
+"""
+
+import time
+import logging
+from typing import Optional, List, Dict, Any
+
+import requests
+
+from .models import Org, Project, Agent, Hub, Model, Deployment, Principal, Decision, ChangeRequest, ApiKey
+from .exceptions import MeridianError, NotFoundError, ConflictError, ValidationError, ServerError
+
+logger = logging.getLogger("meridian-client")
+
+
+class Meridian:
+    """Meridian Governance Router client.
+
+    One class, all methods. HTTP only — no DB, no SQL.
+    """
+
+    def __init__(self, base_url: str = "http://localhost:8080",
+                 api_key: Optional[str] = None, auth_scheme: str = "bearer",
+                 principal: Optional[str] = None,
+                 timeout: int = 30, retries: int = 3):
+        """
+        api_key: a key minted by POST /api/v1/keys (format `mdn_...`). Scopes
+            every call to that key's org and is required by any deployment
+            running with auth enforced (cloud, always).
+        auth_scheme: "bearer" sends `Authorization: Bearer <key>`; "x-api-key"
+            sends `x-api-key: <key>`. Meridian accepts both — pick whichever a
+            surrounding gateway or proxy already standardises on.
+        principal: an external identity to attribute requests to (sent as
+            `X-Meridian-Principal`). Optional; falls back to the key alone.
+        """
+        self.base_url = base_url.rstrip("/")
+        self.api_key = api_key
+        self.auth_scheme = auth_scheme
+        self.principal = principal
+        self.timeout = timeout
+        self.retries = retries
+        self._session = requests.Session()
+
+    def _auth_headers(self) -> Dict[str, str]:
+        headers = {}
+        if self.api_key:
+            if self.auth_scheme == "x-api-key":
+                headers["x-api-key"] = self.api_key
+            else:
+                headers["Authorization"] = f"Bearer {self.api_key}"
+        if self.principal:
+            headers["X-Meridian-Principal"] = self.principal
+        return headers
+
+    def _request(self, method: str, path: str, **kwargs) -> dict:
+        """Make an HTTP request with retry and error handling."""
+        url = f"{self.base_url}{path}"
+        kwargs.setdefault("timeout", self.timeout)
+        headers = self._auth_headers()
+        headers.update(kwargs.pop("headers", None) or {})
+        if headers:
+            kwargs["headers"] = headers
+
+        last_err = None
+        for attempt in range(self.retries):
+            try:
+                resp = self._session.request(method, url, **kwargs)
+
+                if resp.status_code == 200 or resp.status_code == 201:
+                    return resp.json()
+                elif resp.status_code == 404:
+                    raise NotFoundError(f"Not found: {path}", 404, resp.json() if resp.text else None)
+                elif resp.status_code == 409:
+                    raise ConflictError(f"Already exists: {path}", 409, resp.json() if resp.text else None)
+                elif resp.status_code == 422:
+                    detail = resp.json() if resp.text else {}
+                    raise ValidationError(
+                        detail.get("message") or detail.get("detail", {}).get("error", "Validation failed"),
+                        422, detail)
+                elif resp.status_code >= 500:
+                    last_err = ServerError(f"Server error {resp.status_code}", resp.status_code)
+                    time.sleep(2 ** attempt)
+                    continue
+                else:
+                    raise MeridianError(f"HTTP {resp.status_code}: {resp.text[:200]}", resp.status_code)
+
+            except (requests.ConnectionError, requests.Timeout) as e:
+                last_err = MeridianError(f"Connection failed: {e}")
+                if attempt < self.retries - 1:
+                    time.sleep(2 ** attempt)
+                    continue
+                raise last_err
+
+        if last_err:
+            raise last_err
+
+    def _get(self, path: str, **params) -> Any:
+        return self._request("GET", path, params=params)
+
+    def _post(self, path: str, data: dict) -> dict:
+        return self._request("POST", path, json=data)
+
+    def _put(self, path: str, data: dict) -> dict:
+        return self._request("PUT", path, json=data)
+
+    def _delete(self, path: str) -> dict:
+        return self._request("DELETE", path)
+
+    @staticmethod
+    def _wrap(cls, data: dict):
+        """Build a typed response, routing fields the SDK doesn't know yet
+        into `.extra` instead of dropping them."""
+        known = cls.__dataclass_fields__
+        matched = {k: v for k, v in data.items() if k in known and k != "extra"}
+        matched["extra"] = {k: v for k, v in data.items() if k not in known}
+        return cls(**matched)
+
+    # ── Health ──
+
+    def health(self) -> dict:
+        return self._get("/health")
+
+    # ── Signup ──
+
+    @classmethod
+    def signup(cls, base_url: str, org_name: str, email: str, password: str,
+               name: str = None, **client_kwargs) -> "Meridian":
+        """Create a brand-new org, its first user, and its first key, then
+        return a Meridian client already authenticated as that key.
+
+        The only call on the whole API that needs no existing org or key —
+        everywhere else, bootstrapping a tenant is a chicken-and-egg problem
+        on a multi-tenant deployment. Always creates a 'free'-tier org; ask
+        your account team for anything above that.
+        """
+        tmp = cls(base_url)
+        data = tmp._post("/api/v1/auth/signup", {
+            "org_name": org_name, "email": email, "password": password, "name": name,
+        })
+        client = cls(base_url, api_key=data["api_key"], **client_kwargs)
+        client.org_id = data["org_id"]
+        client.signup_response = data
+        return client
+
+    @classmethod
+    def login(cls, base_url: str, email: str, password: str,
+              key_name: str = None, **client_kwargs) -> "Meridian":
+        """Authenticate with email + password, then mint a new API key and
+        return a client holding it.
+
+        /auth/login itself returns a short-lived JWT (session token for a
+        browser), not an api key — fine for a console tab open for an hour,
+        wrong for a CLI or script meant to keep working for months without
+        asking you to log in again. So this does both calls: login to prove
+        who you are, then POST /keys (authenticated by the JWT it just got,
+        since Meridian accepts either credential shape) to get a durable
+        key, and discards the JWT. Login again anytime to mint another key;
+        existing keys are unaffected.
+        """
+        tmp = cls(base_url)
+        login_data = tmp._post("/api/v1/auth/login", {"email": email, "password": password})
+        jwt_client = cls(base_url, api_key=login_data["token"], **client_kwargs)
+        key_data = jwt_client._post("/api/v1/keys", {
+            "org_id": login_data["org_id"], "name": key_name or "meridian-client login",
+        })
+        client = cls(base_url, api_key=key_data["api_key"], **client_kwargs)
+        client.org_id = login_data["org_id"]
+        client.login_response = login_data
+        return client
+
+    # ── Keys ──
+
+    def create_key(self, org_id: int, name: str = None) -> dict:
+        """Returns the raw key ONCE — {"api_key": ..., "key_prefix": ..., ...}.
+        Not wrapped as ApiKey: the raw key itself isn't a stored field, and
+        .list_keys()'s rows never carry it back."""
+        return self._post("/api/v1/keys", {"org_id": org_id, "name": name})
+
+    def list_keys(self) -> List[ApiKey]:
+        """Keys for the authenticated org — prefix only, never the full key."""
+        return [self._wrap(ApiKey, k) for k in self._get("/api/v1/keys")]
+
+    def revoke_key(self, key_id: int) -> dict:
+        return self._delete(f"/api/v1/keys/{key_id}")
+
+    # ── Organizations ──
+
+    def create_org(self, name: str, quality: int = 5, cost: int = 5, risk: int = 5,
+                   tier: str = "standard", budget: float = None) -> Org:
+        data = self._post("/api/v1/orgs", {
+            "name": name, "default_quality": quality, "default_cost": cost,
+            "default_risk": risk, "subscription_tier": tier, "monthly_budget_usd": budget,
+        })
+        return self._wrap(Org, data)
+
+    def update_org(self, org_id: int, **kwargs) -> Org:
+        data = self._put(f"/api/v1/orgs/{org_id}", kwargs)
+        return self._wrap(Org, data)
+
+    # ── Projects ──
+
+    def create_project(self, org_id: int, name: str, quality: int = None, cost: int = None,
+                       risk: int = None, classification: str = "general", **kwargs) -> Project:
+        payload = {"org_id": org_id, "name": name, "data_classification": classification, **kwargs}
+        if quality is not None: payload["quality_default"] = quality
+        if cost is not None: payload["cost_default"] = cost
+        if risk is not None: payload["risk_default"] = risk
+        data = self._post("/api/v1/projects", payload)
+        return self._wrap(Project, data)
+
+    def update_project(self, project_id: int, **kwargs) -> Project:
+        data = self._put(f"/api/v1/projects/{project_id}", kwargs)
+        return self._wrap(Project, data)
+
+    def projects(self) -> List[dict]:
+        return self._get("/api/v1/projects")
+
+    # ── Agents ──
+
+    def create_agent(self, project_id: int, agent_name: str, quality_override: int = None,
+                     cost_override: int = None, risk_override: int = None,
+                     pinned_model: str = None, **kwargs) -> Agent:
+        payload = {"agent_name": agent_name, **kwargs}
+        if quality_override is not None: payload["quality_override"] = quality_override
+        if cost_override is not None: payload["cost_override"] = cost_override
+        if risk_override is not None: payload["risk_override"] = risk_override
+        if pinned_model: payload["pinned_model"] = pinned_model
+        data = self._post(f"/api/v1/projects/{project_id}/agents", payload)
+        return self._wrap(Agent, data)
+
+    def update_agent(self, project_id: int, agent_name: str, **kwargs) -> Agent:
+        data = self._put(f"/api/v1/projects/{project_id}/agents/{agent_name}", kwargs)
+        return self._wrap(Agent, data)
+
+    def delete_agent(self, project_id: int, agent_name: str) -> dict:
+        return self._delete(f"/api/v1/projects/{project_id}/agents/{agent_name}")
+
+    def agents(self, project_id: int) -> List[dict]:
+        return self._get(f"/api/v1/projects/{project_id}/agents")
+
+    # ── Hubs ──
+
+    def create_hub(self, name: str, hub_type: str, base_url: str = None,
+                   risk_score: int = 5, **kwargs) -> Hub:
+        data = self._post("/api/v1/hubs", {
+            "name": name, "hub_type": hub_type, "base_url": base_url,
+            "risk_score": risk_score, **kwargs,
+        })
+        return self._wrap(Hub, data)
+
+    def update_hub(self, hub_id: int, **kwargs) -> Hub:
+        data = self._put(f"/api/v1/hubs/{hub_id}", kwargs)
+        return self._wrap(Hub, data)
+
+    def delete_hub(self, hub_id: int) -> dict:
+        return self._delete(f"/api/v1/hubs/{hub_id}")
+
+    def hubs(self) -> List[dict]:
+        return self._get("/api/v1/hubs")
+
+    # ── Models ──
+
+    def create_model(self, name: str, provider: str, quality_tier: float = 5,
+                     supports_tools: bool = False, **kwargs) -> Model:
+        data = self._post("/api/v1/models", {
+            "name": name, "provider": provider, "quality_tier": quality_tier,
+            "supports_tools": supports_tools, **kwargs,
+        })
+        return self._wrap(Model, data)
+
+    def models(self) -> List[dict]:
+        return self._get("/api/v1/models")
+
+    # ── Deployments ──
+
+    def create_deployment(self, hub_id: int, model_id: int, deployment_key: str,
+                          backend_model_id: str, cost_input: float = 0,
+                          cost_output: float = 0, **kwargs) -> Deployment:
+        data = self._post(f"/api/v1/hubs/{hub_id}/deployments", {
+            "model_id": model_id, "deployment_key": deployment_key,
+            "backend_model_id": backend_model_id,
+            "cost_per_1m_input": cost_input, "cost_per_1m_output": cost_output, **kwargs,
+        })
+        return self._wrap(Deployment, data)
+
+    def update_deployment(self, deployment_id: int, **kwargs) -> Deployment:
+        data = self._put(f"/api/v1/deployments/{deployment_id}", kwargs)
+        return self._wrap(Deployment, data)
+
+    # ── Principals ──
+
+    def create_principal(self, external_id: str, name: str = None, email: str = None,
+                         type: str = "human", source: str = None) -> Principal:
+        data = self._post("/api/v1/principals", {
+            "external_id": external_id, "name": name, "email": email,
+            "type": type, "source": source,
+        })
+        return self._wrap(Principal, data)
+
+    def principals(self, source: str = None) -> List[dict]:
+        params = {"source": source} if source else {}
+        return self._get("/api/v1/principals", **params)
+
+    # ── Resolve (runtime) ──
+
+    def resolve(self, agent_name: str, project_id: int = None,
+                user_id: int = None, trace_id: str = None) -> Decision:
+        data = self._post("/api/v1/resolve", {
+            "agent_name": agent_name, "project_id": project_id,
+            "user_id": user_id, "trace_id": trace_id,
+        })
+        return self._wrap(Decision, data)
+
+    def resolve_failover(self, failed_key: str, agent_name: str = None,
+                         reason: str = None, trace_id: str = None,
+                         user_id: int = None,
+                         allowed_hubs: List[str] = None,
+                         denied_hubs: List[str] = None) -> dict:
+        """Find a replacement for a deployment that failed.
+
+        Pass `agent_name` — with it the replacement is chosen under the same
+        governance policy as the original decision and the failover is
+        recorded in the audit trail. Without it the call falls back to a plain
+        hub allowlist and writes no audit record.
+        """
+        return self._post("/api/v1/resolve/failover", {
+            "failed_deployment_key": failed_key,
+            "agent_name": agent_name, "reason": reason,
+            "trace_id": trace_id, "user_id": user_id,
+            "allowed_hubs": allowed_hubs, "denied_hubs": denied_hubs,
+        })
+
+    # ── Audit ──
+
+    def audit(self, routing_log_id: int, input_tokens: int = 0,
+              output_tokens: int = 0, latency_ms: int = None,
+              model_key: str = None) -> dict:
+        return self._post("/api/v1/audit", {
+            "routing_log_id": routing_log_id, "input_tokens": input_tokens,
+            "output_tokens": output_tokens, "latency_ms": latency_ms,
+            "model_key": model_key,
+        })
+
+    # ── Explain ──
+
+    def explain(self, routing_log_id: int) -> dict:
+        return self._get(f"/api/v1/explain/{routing_log_id}")
+
+    # ── Simulate ──
+
+    def simulate(self, project_id: int, quality: int = None, cost: int = None,
+                 risk: int = None, agent_name: str = None, **kwargs) -> dict:
+        payload = {"project_id": project_id, **kwargs}
+        if agent_name: payload["agent_name"] = agent_name
+        if quality is not None: payload["quality"] = quality
+        if cost is not None: payload["cost"] = cost
+        if risk is not None: payload["risk"] = risk
+        return self._post(f"/api/v1/projects/{project_id}/simulate", payload)
+
+    # ── Change Requests ──
+
+    def create_change_request(self, project_id: int, requested_by: int = None,
+                              agent_name: str = None, **kwargs) -> ChangeRequest:
+        payload = {"agent_name": agent_name, "requested_by": requested_by, **kwargs}
+        data = self._post(f"/api/v1/projects/{project_id}/change-requests", payload)
+        return self._wrap(ChangeRequest, data)
+
+    def approve_change_request(self, cr_id: int, reviewed_by: int = None,
+                               notes: str = None) -> dict:
+        return self._post(f"/api/v1/change-requests/{cr_id}/approve",
+                          {"reviewed_by": reviewed_by, "notes": notes})
+
+    def reject_change_request(self, cr_id: int, reviewed_by: int = None,
+                              notes: str = None) -> dict:
+        return self._post(f"/api/v1/change-requests/{cr_id}/reject",
+                          {"reviewed_by": reviewed_by, "notes": notes})
+
+    def change_requests(self, project_id: int = None, status: str = None) -> List[dict]:
+        params = {}
+        if project_id: params["project_id"] = project_id
+        if status: params["status"] = status
+        return self._get("/api/v1/change-requests", **params)
+
+    # ── Catalog / Config ──
+
+    def catalog(self) -> List[dict]:
+        return self._get("/api/v1/catalog")
+
+    def config(self) -> dict:
+        return self._get("/api/v1/config")

meridian_client-0.1.0/meridian/exceptions.py

@@ -0,0 +1,29 @@
+"""Meridian SDK exceptions."""
+
+
+class MeridianError(Exception):
+    """Base exception for Meridian SDK."""
+    def __init__(self, message: str, status_code: int = None, detail: dict = None):
+        super().__init__(message)
+        self.status_code = status_code
+        self.detail = detail
+
+
+class NotFoundError(MeridianError):
+    """Resource not found (404)."""
+    pass
+
+
+class ConflictError(MeridianError):
+    """Resource already exists (409)."""
+    pass
+
+
+class ValidationError(MeridianError):
+    """Invalid configuration — e.g. zero candidates survive (422)."""
+    pass
+
+
+class ServerError(MeridianError):
+    """Meridian server error (5xx)."""
+    pass

meridian_client-0.1.0/meridian/models.py

@@ -0,0 +1,166 @@
+"""Meridian SDK response models — typed responses, not raw dicts.
+
+Each dataclass lists the fields the server is known to return as of this
+SDK version. `extra` catches anything the server adds later that this SDK
+doesn't know about yet — `client.py`'s `_wrap()` routes unmatched keys there
+instead of silently dropping them, which is what used to happen (a v1 SDK
+build that pre-dated allowed_hubs/denied_hubs/agent_type on Agent returned
+them with those fields missing from the object with no indication anything
+was lost). Check `.extra` if a field you expect is missing from the typed
+attributes.
+"""
+
+from dataclasses import dataclass, field
+from typing import Optional, List, Dict, Any
+
+
+@dataclass
+class Org:
+    id: int
+    name: str
+    default_quality: int = 5
+    default_cost: int = 5
+    default_risk: int = 5
+    subscription_tier: str = "standard"
+    monthly_budget_usd: Optional[float] = None
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class Project:
+    id: int
+    org_id: int
+    name: str
+    display_name: Optional[str] = None
+    project_type: Optional[str] = None
+    lifecycle: Optional[str] = None
+    quality_default: Optional[int] = None
+    cost_default: Optional[int] = None
+    risk_default: Optional[int] = None
+    data_classification: str = "general"
+    allowed_models: Optional[List[str]] = None
+    denied_models: Optional[List[str]] = None
+    allowed_hubs: Optional[List[str]] = None
+    denied_hubs: Optional[List[str]] = None
+    monthly_budget_usd: Optional[float] = None
+    enabled: bool = True
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class Agent:
+    # No `id` — project_agents has no id column at all (its primary key is
+    # the (project_id, agent_name) pair; the same fact that made the old
+    # DELETE ... RETURNING id 500 on every call, fixed earlier in meridian's
+    # own repo). A dataclass with `id: int` required meant every real
+    # create_agent() call raised trying to construct it — caught only once
+    # something actually called it end to end, here, building the CLI.
+    project_id: int
+    agent_name: str
+    display_name: Optional[str] = None
+    agent_type: Optional[str] = None
+    quality_override: Optional[int] = None
+    cost_override: Optional[int] = None
+    risk_override: Optional[int] = None
+    pinned_model: Optional[str] = None
+    data_classification: Optional[str] = None
+    system_prompt: Optional[str] = None
+    allowed_hubs: Optional[List[str]] = None
+    denied_hubs: Optional[List[str]] = None
+    enabled: bool = True
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class Hub:
+    id: int
+    name: str
+    hub_type: str
+    org_id: Optional[int] = None
+    base_url: Optional[str] = None
+    region: Optional[str] = None
+    risk_score: int = 5
+    enabled: bool = True
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class Model:
+    id: int
+    name: str
+    provider: str
+    display_name: Optional[str] = None
+    family: Optional[str] = None
+    quality_tier: float = 5
+    supports_tools: bool = False
+    supports_vision: bool = False
+    supports_streaming: bool = True
+    context_window: Optional[int] = None
+    model_type: str = "chat"
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class Deployment:
+    id: int
+    model_id: int
+    hub_id: int
+    deployment_key: str
+    backend_model_id: Optional[str] = None
+    cost_per_1m_input: float = 0
+    cost_per_1m_output: float = 0
+    latency_ms: Optional[int] = None
+    risk_score: Optional[int] = None
+    depreciation_factor: Optional[float] = None
+    enabled: bool = True
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class ApiKey:
+    id: int
+    org_id: int
+    key_prefix: str
+    name: Optional[str] = None
+    created_at: Optional[str] = None
+    last_used_at: Optional[str] = None
+    enabled: bool = True
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class Principal:
+    id: int
+    external_id: str
+    name: Optional[str] = None
+    email: Optional[str] = None
+    type: str = "human"
+    source: Optional[str] = None
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class Decision:
+    model: Optional[str] = None
+    hub: Optional[str] = None
+    source: str = "scored"
+    routing_log_id: Optional[int] = None
+    project_id: Optional[int] = None
+    project_name: Optional[str] = None
+    sliders: Optional[Dict[str, int]] = None
+    candidates_evaluated: Optional[List[Dict]] = None
+    eliminated: Optional[List[Dict]] = None
+    data_classification: Optional[str] = None
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class ChangeRequest:
+    id: int
+    project_id: int
+    status: str = "pending"
+    field_changes: Optional[Dict] = None
+    resolved_model_before: Optional[str] = None
+    resolved_model_after: Optional[str] = None
+    applied_fields: Optional[List[str]] = None
+    extra: Dict[str, Any] = field(default_factory=dict)

meridian_client-0.1.0/meridian_client.egg-info/PKG-INFO

@@ -0,0 +1,193 @@
+Metadata-Version: 2.4
+Name: meridian-client
+Version: 0.1.0
+Summary: Python SDK for Meridian Governance Router
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/knjpollard/meridian
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests>=2.28.0
+Dynamic: license-file
+
+---
+name: meridian-integration
+description: How to call Meridian (the governance router) correctly from a new, standalone client — auth, the onboarding sequence, and what's still house/console-only.
+---
+
+# Integrating with Meridian
+
+Meridian is a policy-governed inference router: you ask it "which model should
+`agent_name` use right now", and it answers using project/agent policy
+(quality, cost, risk, allowed/denied hubs, data classification) rather than
+you hardcoding a model name. It knows nothing about MTA specifically — any
+client that holds a valid key can use it standalone.
+
+Full generated route-by-route reference: `docs/api/api-reference.md` in this
+repo (regenerate with `python3 scripts/gen_api_docs.py` after any route
+change — it reads the live FastAPI app, so it can't go stale the way a
+hand-written doc can).
+
+## Install
+
+```bash
+pip install meridian-client          # published — the normal path, or
+pip install -e meridian-client/      # editable, from this repo (contributing to the SDK itself)
+```
+
+Prefer a terminal to Python? `pip install meridian-governance-cli` wraps
+this same SDK as subcommands (`meridian signup`, `meridian resolve
+my_agent`, `meridian keys list`, ...) — installs as the `meridian` command;
+see `meridian-cli/README.md` (not to be confused with the unrelated
+`meridian-cli` package also on PyPI). No chat loop, no personas; it's a
+management CLI over the API, not a clone of `mta-cli`'s consumer-companion
+command set.
+
+## Auth — read this before anything else
+
+Meridian accepts a key two ways; it doesn't matter which:
+
+```
+Authorization: Bearer mdn_xxxxxxxx
+x-api-key: mdn_xxxxxxxx
+```
+
+With no key at all: **on-prem only**, and only if that instance was started
+without `MERIDIAN_AUTH_REQUIRED=true`. The request resolves to the instance's
+single default org. Every cloud deployment (`dev-meridian.mytrustworthy.ai`
+and any other `MERIDIAN_DEPLOYMENT=cloud` instance) requires a key — no key
+gets a flat 401, not a default org.
+
+## Getting your first key
+
+```python
+from meridian import Meridian
+
+m = Meridian.signup("https://dev-meridian.mytrustworthy.ai",
+    org_name="my-project", email="me@example.com", password="...")
+# m is now an authenticated client. m.org_id and m.signup_response are set.
+```
+
+One call: creates a new org (always `free` tier — self-serve can't grant
+itself more than that), its first user, and its first key, and returns a
+`Meridian` already authenticated with it. This is the *only* unauthenticated
+write on the whole API — everywhere else, minting a key or registering a
+user needs an `org_id` that a cold caller doesn't have yet, which is exactly
+the chicken-and-egg problem this one call exists to break.
+
+If you already have a key (an account team provisioned you directly, or
+you're adding a second client to an org that already signed up):
+
+```python
+m = Meridian("https://dev-meridian.mytrustworthy.ai", api_key="mdn_...")
+```
+
+## Three tiers, one engine
+
+There's one governance engine underneath all of this — the tiers below are
+just how much of it you choose to use, not three different products:
+
+- **Individual / fast start:** pin a model and go. `pinned_model` skips
+  scoring entirely (`resolver.py`'s "Step 3: Pinned model — skip scoring") —
+  deterministic, zero policy to configure.
+- **Business / small team:** the quality/cost/risk sliders. Same `create_agent`
+  call, just set overrides instead of (or in addition to) a pin; invite
+  teammates into the same org via `POST /api/v1/auth/register` once you're
+  authenticated.
+- **Enterprise / custom governance:** change-requests and approval
+  (`create_change_request` → `approve_change_request`), hub allow/denylists,
+  data classification enforcement (`pii` hard-forces risk to 1, on-prem only).
+  All already built; nothing here is Enterprise-only code, just the parts a
+  fast-start integration doesn't need to touch.
+
+## The onboarding sequence
+
+A tenant key can do all of this itself — no console needed past signup:
+
+```python
+# 1. A project: your governance boundary. One org can have many.
+project = m.create_project(
+    org_id=m.org_id,
+    name="my-standalone-agent",
+    quality=7, cost=5, risk=5,          # 0-10 sliders, project-level defaults
+    classification="general",            # "pii" forces risk=1 regardless of the slider
+)
+
+# 2. An agent inside it. This is the identity you resolve against — not a
+#    user, not an API key, an AGENT. One project can have many, each with its
+#    own overrides.
+agent = m.create_agent(
+    project.id, "my_agent",
+    quality_override=9,                  # omit to inherit the project default
+    allowed_hubs=["anthropic-direct", "bedrock"],  # omit for no hub restriction
+)
+
+# 3. Resolve. Call this every time you're about to make an inference call —
+#    it's cheap, and policy can change between calls.
+decision = m.resolve("my_agent", project_id=project.id)
+print(decision.model, decision.hub)      # e.g. "claude-opus-5" "anthropic-direct"
+
+# 4. After the real inference call, report usage so cost tracking means
+#    something.
+m.audit(decision.routing_log_id, input_tokens=512, output_tokens=128,
+         latency_ms=840)
+```
+
+That's the whole golden path. `m.explain(decision.routing_log_id)` gets you
+the full candidate breakdown (every model considered, why each one was
+eliminated or scored where it scored) if you need to show your work.
+
+## Without the SDK (raw HTTP)
+
+```bash
+curl -X POST https://dev-meridian.mytrustworthy.ai/api/v1/resolve \
+  -H "Authorization: Bearer mdn_..." -H "Content-Type: application/json" \
+  -d '{"agent_name": "my_agent", "project_id": 123}'
+```
+
+Every route in `docs/api/api-reference.md` works the same way — method, path,
+JSON body of the fields listed, same two auth headers.
+
+## What a tenant key cannot do (yet)
+
+`docs/api/api-reference.md` marks every route **tenant key: yes/no**. The
+"no" routes answer `403 "This route is not yet tenant-scoped; refused for
+tenant keys"` regardless of whether your key is valid — it's a blanket
+refusal by path, not a permission check. As of this writing that's mainly:
+hub/model/deployment registration and edits, org creation and edits, and most
+cost/governance console views. Those need a house key or the console. Project
+and agent create/update/delete, resolve, audit, explain, simulate, and
+change-requests are all tenant-reachable.
+
+## Gotchas
+
+- **`PUT /api/v1/projects/{id}/lifecycle` is a stub.** It validates the
+  request and echoes the current row back — it does not change anything.
+  Don't build on it (`meridian#7`'s predecessor finding).
+- **The SDK's response objects have an `.extra` dict.** Every typed field the
+  SDK knows about is a real attribute (`agent.allowed_hubs`); anything the
+  server returns that this SDK version doesn't model yet lands in
+  `agent.extra` instead of silently vanishing. If a field you expect is
+  `None`, check `.extra` before assuming the server didn't send it.
+- **`resolve_failover` only writes an audit record if you pass
+  `agent_name`.** Without it you get a plain hub-allowlist fallback with no
+  governance and no audit trail — fine for "just get me anything that
+  works", wrong for anything that needs to explain itself later.
+- **Tool-access governance does not exist yet.** Meridian governs *which
+  model* an agent may use. It does not yet govern *which tools* an agent may
+  call — there's no route for it, and the schema slots for it
+  (`agent.agent_tools`, `agent.skill_ids`) are unpopulated. If your new agent
+  needs Meridian to gate tool access rather than just model choice, that's a
+  real gap, not a documentation gap — see
+  `obsidian-vault-kb/relays/meridian/2026-10-12-should-meridian-govern-tools-and-what-that-costs-in-apis.md`
+  for the live design discussion.
+- **Forgot a built-in-auth password? `POST /auth/forgot-password` /
+  `POST /auth/reset-password`** (meridian#10), also reachable from the
+  console's "Forgot password?" link. Requires `RESEND_API_KEY` to actually
+  be configured on the instance — without it the request fails loudly
+  rather than handing the token back in the response. That's deliberate:
+  an earlier version of this capability did exactly that and was removed on
+  2026-09-12 because it let anyone who knew an email address take over that
+  account. There is no magic-link *login* — only password reset; you still
+  need to know a password to sign in, the email only proves you own the
+  inbox.

meridian_client-0.1.0/meridian_client.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+SKILL.md
+pyproject.toml
+meridian/__init__.py
+meridian/client.py
+meridian/exceptions.py
+meridian/models.py
+meridian_client.egg-info/PKG-INFO
+meridian_client.egg-info/SOURCES.txt
+meridian_client.egg-info/dependency_links.txt
+meridian_client.egg-info/requires.txt
+meridian_client.egg-info/top_level.txt

meridian_client-0.1.0/meridian_client.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

meridian_client-0.1.0/meridian_client.egg-info/requires.txt

@@ -0,0 +1 @@
+requests>=2.28.0

meridian_client-0.1.0/meridian_client.egg-info/top_level.txt

@@ -0,0 +1 @@
+meridian

meridian_client-0.1.0/pyproject.toml

@@ -0,0 +1,15 @@
+[project]
+name = "meridian-client"
+version = "0.1.0"
+description = "Python SDK for Meridian Governance Router"
+readme = "SKILL.md"
+license = "MIT"
+requires-python = ">=3.9"
+dependencies = ["requests>=2.28.0"]
+
+[project.urls]
+Homepage = "https://github.com/knjpollard/meridian"
+
+[build-system]
+requires = ["setuptools>=68.0"]
+build-backend = "setuptools.build_meta"

meridian_client-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+