ms-tau-sdk 1.2.8.dev13__tar.gz → 1.2.8.dev14__tar.gz

{ms_tau_sdk-1.2.8.dev13 → ms_tau_sdk-1.2.8.dev14}/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.2.8 — 2026-09-24
+
+- Added independent `TAU_EXCLUDE_BASE_TOOLS` and `TAU_EXCLUDE_MAINSEQUENCE_MCP` process settings.
+  Deployments can expose only project extension tools plus the two required A2A Task controls.
+  The runtime skips MCP connection and resource guidance when excluded, rejects project overrides
+  of the Task controls, and checks the effective catalog on load and after extension reload.
+- Documented the settings for managed workflow `env_vars` and local runtimes in ADR 0011, the
+  reference guides, and the version-matched `tau-project-customization` skill.
+
 ## 1.2.7 — 2026-09-21
 
 - Bundle the local Tau Board command, Python package, and UI assets in the `ms-tau-sdk` wheel.

{ms_tau_sdk-1.2.8.dev13 → ms_tau_sdk-1.2.8.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 1.2.8.dev13
+Version: 1.2.8.dev14
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs
@@ -169,10 +169,10 @@ the board process's safe environment values and edits named non-secret variables
 file; Tau or the board must restart before saved startup values take effect.
 
 Platform discovery of the unregistered process, internal backend dispatch/caller-delivery hooks,
-push notifications, and `resume_caller` remain unavailable. Outbound A2A through Main Sequence MCP
-supports Messages and Tasks with polling under authenticated-user semantics. Local mode binds to
-`127.0.0.1` unless a host was explicitly configured. Main Sequence MCP remains live, so its tools
-can still read or mutate real platform resources.
+push notifications, and `resume_caller` remain unavailable. When Main Sequence MCP is enabled,
+outbound A2A supports Messages and Tasks with polling under authenticated-user semantics, and MCP
+tools can read or mutate real platform resources. Local mode binds to `127.0.0.1` unless a host was
+explicitly configured.
 
 ## Workspace-owned Tau behavior
 
@@ -201,7 +201,7 @@ are not bundled into the SDK. Main Sequence transport and protocol behavior rema
 - durable Tau sessions, leases, restore, persistence, cancellation, eviction, and shutdown
 - local Tau execution without backend AgentSession pre-creation
 - chat, SSE, A2A, health, and readiness transports
-- Main Sequence MCP and protocol-required task controls
+- optional Main Sequence MCP and always-present protocol-required task controls
 - packaged defaults that participate in Tau's normal workspace configuration
 - explicit, version-matched development skills for repository integration, local debugging,
   project customization, and TAU's A2A host adapter

{ms_tau_sdk-1.2.8.dev13 → ms_tau_sdk-1.2.8.dev14}/README.md

@@ -138,10 +138,10 @@ the board process's safe environment values and edits named non-secret variables
 file; Tau or the board must restart before saved startup values take effect.
 
 Platform discovery of the unregistered process, internal backend dispatch/caller-delivery hooks,
-push notifications, and `resume_caller` remain unavailable. Outbound A2A through Main Sequence MCP
-supports Messages and Tasks with polling under authenticated-user semantics. Local mode binds to
-`127.0.0.1` unless a host was explicitly configured. Main Sequence MCP remains live, so its tools
-can still read or mutate real platform resources.
+push notifications, and `resume_caller` remain unavailable. When Main Sequence MCP is enabled,
+outbound A2A supports Messages and Tasks with polling under authenticated-user semantics, and MCP
+tools can read or mutate real platform resources. Local mode binds to `127.0.0.1` unless a host was
+explicitly configured.
 
 ## Workspace-owned Tau behavior
 
@@ -170,7 +170,7 @@ are not bundled into the SDK. Main Sequence transport and protocol behavior rema
 - durable Tau sessions, leases, restore, persistence, cancellation, eviction, and shutdown
 - local Tau execution without backend AgentSession pre-creation
 - chat, SSE, A2A, health, and readiness transports
-- Main Sequence MCP and protocol-required task controls
+- optional Main Sequence MCP and always-present protocol-required task controls
 - packaged defaults that participate in Tau's normal workspace configuration
 - explicit, version-matched development skills for repository integration, local debugging,
   project customization, and TAU's A2A host adapter

{ms_tau_sdk-1.2.8.dev13 → ms_tau_sdk-1.2.8.dev14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "1.2.8.dev13"
+version = "1.2.8.dev14"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-1.2.8.dev13 → ms_tau_sdk-1.2.8.dev14}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -46,6 +46,33 @@ The project author owns:
 The SDK does not sandbox these extensions. Web, fetch, search, browser, video, and other optional
 tools are project choices and are not part of the base SDK.
 
+## Runtime tool composition
+
+Two independent process settings select the host-provided tools. Both default to `false`:
+
+| Setting | Effect when `true` |
+| --- | --- |
+| `TAU_EXCLUDE_BASE_TOOLS` | Omit Tau's `read`, `write`, `edit`, and `bash`. |
+| `TAU_EXCLUDE_MAINSEQUENCE_MCP` | Skip Main Sequence MCP connection, tools, resources, and resource prompt. |
+
+Set them in `harness_agent.spec.env_vars` in a managed repository workflow, in the process
+environment for local `ms-tau`, or through explicit `TauSDKSettings` fields in a Python host. They
+apply to all sessions in that process; neither Agent Card skills nor prompt text removes tools.
+
+| Exclude base tools | Exclude Main Sequence MCP | Model-facing sources |
+| --- | --- | --- |
+| `false` | `false` | Coding tools, Main Sequence MCP, project extension tools, A2A Task controls. |
+| `true` | `false` | Main Sequence MCP, project extension tools, A2A Task controls. |
+| `false` | `true` | Coding tools, project extension tools, A2A Task controls. |
+| `true` | `true` | Project extension tools and A2A Task controls. |
+
+The A2A Task controls are `task_request_input` and `task_request_authorization`. They remain
+available in every mode for the agent's own Task; extensions must not register those names.
+Register project tools under `.tau/extensions/` and verify the effective catalog after loading.
+With `read` excluded, Tau 0.4.2 does not insert discovered skills into the system prompt. Put
+needed guidance in the effective `.tau/SYSTEM.md` or expose it through a declared retrieval tool.
+Excluding coding tools does not sandbox extension Python code.
+
 ## Invariants extensions must not replace
 
 Extensions may change effective agent capabilities, but they must not replace or bypass:
@@ -57,8 +84,8 @@ Extensions may change effective agent capabilities, but they must not replace or
 - secret redaction and payload limits; or
 - HTTP, SSE, Responses, and A2A wire validation.
 
-Use canonical Main Sequence MCP operations for live platform state. Project tools do not grant new
-platform permissions merely because they run inside TAU.
+When Main Sequence MCP is enabled, use its canonical operations for live platform state. Project
+tools do not grant new platform permissions merely because they run inside TAU.
 
 ## Validation
 

ms_tau_sdk-1.2.8.dev14/src/ms_tau_sdk/resources/SYSTEM.md

@@ -0,0 +1,11 @@
+You are an agent running through the Main Sequence TAU SDK in the current project workspace.
+
+Work directly toward the user's requested outcome. Follow relevant project instructions, keep
+changes focused, preserve unrelated work, and verify material changes when appropriate tools exist.
+
+Use the tools available in this runtime for the work they support. When Main Sequence MCP tools and
+resources are available, use them for Main Sequence platform knowledge and operations. Never expose runtime
+credentials, access tokens, or other secrets in code, logs, diagnostics, or responses.
+
+Project-owned Tau configuration, instructions, skills, hooks, and extensions are authoritative for
+project behavior within the host's safety and protocol boundaries.

{ms_tau_sdk-1.2.8.dev13 → ms_tau_sdk-1.2.8.dev14}/src/ms_tau_sdk/runtime/extensions.py

@@ -7,8 +7,40 @@ from dataclasses import dataclass
 from tau_agent.types import JSONValue
 from tau_coding import CodingSession
 
+from ms_tau_sdk.errors import ConfigurationError
 from ms_tau_sdk.runtime.snapshots import sha256_json
 
+TASK_CONTROL_TOOL_NAMES = frozenset({"task_request_input", "task_request_authorization"})
+
+
+def validate_tool_catalog(
+    session: CodingSession,
+    *,
+    sdk_tool_names: frozenset[str],
+    require_complete_project_catalog: bool,
+) -> None:
+    """Reject extension overrides and catalog drift before a model can use tools."""
+    sources = session.extension_tool_sources
+    reserved = TASK_CONTROL_TOOL_NAMES & sources.keys()
+    if reserved:
+        raise ConfigurationError(
+            "Project extensions cannot replace A2A Task controls: " + ", ".join(sorted(reserved))
+        )
+    names = [tool.name for tool in session.tools]
+    expected = sdk_tool_names | sources.keys()
+    if len(names) != len(set(names)) or set(names) != expected:
+        raise ConfigurationError("Effective Tau tool catalog differs from configured tool sources")
+    if require_complete_project_catalog:
+        metadata = session.extension_runtime.extension_metadata
+        for owner in set(sources.values()):
+            matches = [item for item in metadata if item.name == owner]
+            if len(matches) != 1 or matches[0].source != "project":
+                raise ConfigurationError("Tool-only runtime includes a non-project extension tool")
+    if require_complete_project_catalog and any(
+        diagnostic.severity == "error" for diagnostic in session.extension_runtime.diagnostics
+    ):
+        raise ConfigurationError("Project extension loading failed in tool-only runtime mode")
+
 
 @dataclass(slots=True)
 class ProjectExtensionState:

{ms_tau_sdk-1.2.8.dev13 → ms_tau_sdk-1.2.8.dev14}/src/ms_tau_sdk/runtime/manager.py

@@ -38,7 +38,7 @@ from ms_tau_sdk.logging import conversation_log_fields
 from ms_tau_sdk.providers.factory import ProviderFactory
 from ms_tau_sdk.resources.loader import tau_resource_paths
 from ms_tau_sdk.runtime.events import TauRuntimeEvent
-from ms_tau_sdk.runtime.extensions import ProjectExtensionState
+from ms_tau_sdk.runtime.extensions import ProjectExtensionState, validate_tool_catalog
 from ms_tau_sdk.runtime.observability import TauTurnObserver
 from ms_tau_sdk.runtime.provenance import TurnProvenance
 from ms_tau_sdk.runtime.snapshots import (
@@ -139,7 +139,8 @@ class SessionRuntimeManager:
             if prefetch_provider is not None:
                 await prefetch_provider()
                 self._provider_control_ready = True
-            await self._get_mcp_client()
+            if not self.settings.exclude_mainsequence_mcp:
+                await self._get_mcp_client()
         self._startup_ready = True
         if self._eviction_task is None:
             self._eviction_task = asyncio.create_task(
@@ -158,6 +159,10 @@ class SessionRuntimeManager:
         }
         return {
             "mode": "local" if self.settings.local_mode else "managed",
+            "exclude_base_tools": self.settings.exclude_base_tools,
+            "exclude_mainsequence_mcp": self.settings.exclude_mainsequence_mcp,
+            "base_tool_count": 0 if self.settings.exclude_base_tools else 4,
+            "task_control_tool_count": 2,
             "workspace_digest": self.settings.workspace_digest,
             "holder_id": self.holder_id,
             "loaded_sessions": len(self._runtimes),
@@ -396,7 +401,9 @@ class SessionRuntimeManager:
                     provider_control=bootstrap.provider_control,
                 ),
             )
-            mcp_client = await self._get_mcp_client()
+            mcp_client = (
+                None if self.settings.exclude_mainsequence_mcp else await self._get_mcp_client()
+            )
             cwd = self._resolve_cwd()
             project_extension_state = ProjectExtensionState(enabled=True)
             caller_session_proof = None
@@ -406,15 +413,32 @@ class SessionRuntimeManager:
                     "lease_holder_id": lease.holder_id,
                     "lease_token": lease.lease_token,
                 }
-            tools = [
-                *create_coding_tools(cwd=cwd),
-                *create_mainsequence_mcp_tools(
-                    mcp_client,
-                    caller_session_proof=caller_session_proof,
-                    allow_missing_session_proof=self.settings.local_mode,
-                ),
-                *create_task_control_tools(),
-            ]
+            tools = []
+            if not self.settings.exclude_base_tools:
+                tools.extend(create_coding_tools(cwd=cwd))
+            if mcp_client is not None:
+                tools.extend(
+                    create_mainsequence_mcp_tools(
+                        mcp_client,
+                        caller_session_proof=caller_session_proof,
+                        allow_missing_session_proof=self.settings.local_mode,
+                    )
+                )
+            tools.extend(create_task_control_tools())
+            sdk_tool_names = frozenset(tool.name for tool in tools)
+            if len(sdk_tool_names) != len(tools):
+                raise ConfigurationError("SDK tool sources contain duplicate names")
+            require_complete_project_catalog = (
+                self.settings.exclude_base_tools and self.settings.exclude_mainsequence_mcp
+            )
+
+            def check_catalog(session: CodingSession) -> None:
+                validate_tool_catalog(
+                    session,
+                    sdk_tool_names=sdk_tool_names,
+                    require_complete_project_catalog=require_complete_project_catalog,
+                )
+
             coding_session = await CodingSession.load(
                 CodingSessionConfig(
                     provider=provider_runtime.provider,
@@ -425,7 +449,11 @@ class SessionRuntimeManager:
                     cwd=cwd,
                     tools=tools,
                     session_id=session_uid,
-                    append_system_prompt=mainsequence_mcp_resource_prompt(mcp_client),
+                    append_system_prompt=(
+                        mainsequence_mcp_resource_prompt(mcp_client)
+                        if mcp_client is not None
+                        else None
+                    ),
                     resource_paths=tau_resource_paths(
                         cwd,
                         state_home=self.settings.tau_state_home,
@@ -434,6 +462,12 @@ class SessionRuntimeManager:
                     trust_override="approve",
                 )
             )
+            try:
+                check_catalog(coding_session)
+            except BaseException:
+                with contextlib.suppress(Exception):
+                    await coding_session.aclose()
+                raise
             project_extension_state.update_from_session(coding_session)
             self._log_project_extension_diagnostics(
                 session_uid=session_uid,
@@ -454,6 +488,7 @@ class SessionRuntimeManager:
                 provider_control_schema=bootstrap.provider_control.schema_version,
                 catalog_digest=bootstrap.provider_control.catalog_digest,
                 project_extension_state=project_extension_state,
+                validate_tool_catalog=check_catalog,
             )
             state = bootstrap.runtime_state
             runtime.runtime_activity = state.runtime_activity or "loading"
@@ -479,8 +514,8 @@ class SessionRuntimeManager:
                 snapshot_selected=snapshot_selected,
                 snapshot_fallback_reason=fallback_reason,
                 history_entry_count=len(initial_entries),
-                mcp_tool_count=len(mcp_client.tools),
-                mcp_resource_count=len(mcp_client.resources),
+                mcp_tool_count=len(mcp_client.tools) if mcp_client is not None else 0,
+                mcp_resource_count=len(mcp_client.resources) if mcp_client is not None else 0,
                 provider_control_schema=bootstrap.provider_control.schema_version,
                 catalog_digest=bootstrap.provider_control.catalog_digest,
                 project_extensions_enabled=project_extension_state.enabled,

{ms_tau_sdk-1.2.8.dev13 → ms_tau_sdk-1.2.8.dev14}/src/ms_tau_sdk/runtime/session.py

@@ -9,6 +9,7 @@ from dataclasses import dataclass, field
 
 from tau_agent.types import JSONValue
 from tau_coding import CodingSession
+from tau_coding.reload import CodingReloadSummary
 
 from ms_tau_sdk.backend.mcp import MainSequenceMCPClient
 from ms_tau_sdk.backend.models import TauTurnCommit
@@ -46,6 +47,17 @@ class ActiveSessionRuntime:
     provider_control_schema: int = 0
     catalog_digest: str = ""
     project_extension_state: ProjectExtensionState | None = None
+    validate_tool_catalog: Callable[[CodingSession], None] | None = None
+
+    async def reload(self) -> CodingReloadSummary:
+        """Reload Tau resources and reject an invalid replacement catalog."""
+        async with self.lock:
+            summary = await self.coding_session.reload()
+            if self.validate_tool_catalog is not None:
+                self.validate_tool_catalog(self.coding_session)
+            if self.project_extension_state is not None:
+                self.project_extension_state.update_from_session(self.coding_session)
+            return summary
 
     async def prompt(
         self,
@@ -64,6 +76,8 @@ class ActiveSessionRuntime:
         async with self.lock:
             if self.evicting:
                 raise RuntimeError("Session runtime is being reconfigured")
+            if self.validate_tool_catalog is not None:
+                self.validate_tool_catalog(self.coding_session)
             self.last_used_at = time.monotonic()
             settled_event: TauRuntimeEvent | None = None
             if provenance:

{ms_tau_sdk-1.2.8.dev13 → ms_tau_sdk-1.2.8.dev14}/src/ms_tau_sdk/settings.py

@@ -55,6 +55,11 @@ class TauSDKSettings(BaseSettings):
         validation_alias="MAINSEQUENCE_REFRESH_TOKEN",
     )
     local_mode: bool = Field(default=False, validation_alias="TAU_LOCAL_MODE")
+    exclude_base_tools: bool = Field(default=False, validation_alias="TAU_EXCLUDE_BASE_TOOLS")
+    exclude_mainsequence_mcp: bool = Field(
+        default=False,
+        validation_alias="TAU_EXCLUDE_MAINSEQUENCE_MCP",
+    )
     local_provider: str | None = Field(default=None, validation_alias="TAU_LOCAL_PROVIDER")
     local_model: str | None = Field(default=None, validation_alias="TAU_LOCAL_MODEL")
     local_thinking: (

ms_tau_sdk-1.2.8.dev13/src/ms_tau_sdk/resources/SYSTEM.md

@@ -1,12 +0,0 @@
-You are a coding agent running through the Main Sequence TAU SDK in the current project workspace.
-
-Work directly toward the user's requested outcome. Inspect relevant project instructions and files
-before editing, keep changes focused, preserve unrelated work, and verify material changes with the
-project's available tests or checks.
-
-Use the available coding tools for workspace work. Use the injected Main Sequence MCP tools and
-advertised resources for Main Sequence platform knowledge and operations. Never expose runtime
-credentials, access tokens, or other secrets in code, logs, diagnostics, or responses.
-
-Project-owned Tau configuration, instructions, skills, hooks, and extensions are authoritative for
-project behavior within the host's safety and protocol boundaries.