ms-tau-sdk 2.0.11.dev52__tar.gz → 2.0.15.dev62__tar.gz

{ms_tau_sdk-2.0.11.dev52 → ms_tau_sdk-2.0.15.dev62}/CHANGELOG.md

@@ -1,5 +1,81 @@
 # Changelog
 
+## Unreleased
+
+- **Tau reads skills nested in folders
+  ([#99](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/99)).** Tau read only the skill
+  folders directly in `.tau/skills` and `.agents/skills`, so a skill one folder deeper, such as
+  `.agents/skills/mcp_tools/<skill>/SKILL.md`, the folder an application publishes with the
+  mainsequence SDK's skills publisher, was skipped without a diagnostic. A folder there without a
+  `SKILL.md` now groups skills, at any depth, and its skills are read, listed in the system prompt,
+  reloaded and opened by the skill-scoped `read` like the others. This includes the managed
+  development skills in `.agents/skills/ms_tau_sdk` and `.agents/skills/mainsequence`. A skill
+  name found twice in the same folder keeps the first in path order, with Tau's duplicate diagnostic; a folder inside
+  a skill is not a skill, and a linked group folder is not followed.
+
+## 2.0.14 — 2026-10-13
+
+- **An Agent reads the skills and resources its declared applications publish
+  ([#98](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/98), ADR 0023).** An application
+  that published skills through the MCP Skills extension, as the mainsequence SDK's skills
+  publisher does, reached its Agent only through `<name>__list_tools` and `<name>__call_tool`: the
+  Agent could not discover or read the skills. Each declared application now also gets
+  `<name>__list_resources`, which lists its skills, each with its files, and its other resources,
+  and `<name>__read_resource`, which reads one of them by URI. `<name>__list_tools` says when the
+  application publishes them. An application's session first asks MCP's `server/discover` on
+  protocol `2026-07-28`, where the extension is declared, and opens an application that does not
+  answer it with `initialize`, as before; the platform's own MCP is unchanged. Only what the
+  application lists is read, and a skill file is returned only when its bytes match the size and
+  SHA-256 digest of the skill's list. Every read names the application. Published skills never
+  become the project's skills and grant nothing; with the coding tools, a model that follows one
+  can run commands, which the [Security and access guide](docs/reference/security-model.md#calling-other-applications)
+  now states.
+
+## 2.0.13 — 2026-10-12
+
+- **ms-tau-sdk installs the MCP Python SDK 2.x.** The `mcp` dependency moves from `mcp>=1.27,<2`
+  to `mcp>=2.3,<3`, which brings `httpx2`, the HTTP client MCP 2.x uses. A repository that runs a
+  Harness Agent and also serves an application MCP with `mainsequence[mcp]`, which requires MCP 2.x
+  for the MCP Skills extension, could not lock both packages; it now can. Agent behaviour does not
+  change: platform and application MCP calls keep their time limits, cancellation, the one token
+  renewal on 401, and the same failure texts and details, including the refused, server-error and
+  timeout statuses that MCP 2.x no longer reports by itself. A project that pins `mcp<2` itself,
+  or uses the MCP 1.x API in its own code (`FastMCP`, `McpError`, camelCase fields), must move to
+  MCP 2.x. The time-limits guide shows `MCPServer`, MCP 2.x's name for `FastMCP`.
+
+## 2.0.12 — 2026-10-11
+
+- **A direct Message that runs out of time gets a typed answer
+  ([#94](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/94)).** A `message:send` answered
+  with a Message, or JSON-RPC `message/send`, whose turn reached
+  `MAINSEQUENCE_TAU_TURN_TIMEOUT_SECONDS` got a plain-text HTTP 500 "Internal Server Error". It now
+  gets HTTP 504 `application/a2a+json` with status `DEADLINE_EXCEEDED` and an `ErrorInfo` with
+  reason `MESSAGE_RESPONSE_LIMIT_EXCEEDED`, domain `mainsequence.ai` and `metadata.limitSeconds`,
+  the limit that expired. JSON-RPC returns the same `ErrorInfo` in a JSON-RPC error (`-32000`).
+  The turn is stopped as before; its work is neither rolled back nor replayed. Use Task mode for
+  longer work.
+- **A direct Message has the platform's 90-second limit.** The platform gives a direct A2A
+  Message one strict limit, 90 seconds, and passes it to the runtime it hosts in
+  `MAINSEQUENCE_A2A_MESSAGE_LIMIT_SECONDS`, a platform-set variable that users do not set. The
+  runtime enforces it for every caller, from when it receives the request and over the whole
+  request, including output-contract repair turns: the turn is stopped and the request gets the
+  504 above with the platform's limit. A shorter `MAINSEQUENCE_TAU_TURN_TIMEOUT_SECONDS` still ends
+  the turn first; no setting extends the platform's limit. A Task-mode `message:send` with
+  `returnImmediately: false` waits at most until the same limit and returns the Task, which keeps
+  running. Streams, chat, caller delivery, Task dispatch and Task turns are unchanged. Without the
+  variable, as in local mode (which refuses it), a direct Message has only the turn limit.
+- **Platform MCP tools wait for the limit the platform declares
+  ([#93](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/93), ADR 0022 amendment).** Every
+  Main Sequence MCP tool call waited `MAINSEQUENCE_TAU_BACKEND_READ_TIMEOUT_SECONDS` (60 seconds by
+  default), so an `a2a.send_message` in Message mode whose target answered after 60 seconds was
+  abandoned by the calling Agent while the platform still waited and completed the send. A
+  platform tool whose `_meta` declares its limit under `mainsequence.ai/timeout-seconds/v1`, the
+  key application tools use, is now waited for that long. A tool that declares nothing, or an
+  invalid value, keeps the session default; an invalid value is logged as
+  `runtime.mcp.invalid_timeout`. `MAINSEQUENCE_TAU_BACKEND_READ_TIMEOUT_SECONDS` now covers only
+  ordinary backend reads and platform tools without a declared limit: it has no effect on a Message
+  or any platform limit and can only shorten a wait.
+
 ## 2.0.11 — 2026-10-11
 
 - **Every MCP connection honors per-call response deadlines

{ms_tau_sdk-2.0.11.dev52 → ms_tau_sdk-2.0.15.dev62}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.11.dev52
+Version: 2.0.15.dev62
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs
@@ -18,7 +18,7 @@ Requires-Dist: cryptography>=42
 Requires-Dist: fastapi>=0.116
 Requires-Dist: httpx>=0.28
 Requires-Dist: jsonschema<5,>=4.25
-Requires-Dist: mcp<2,>=1.27
+Requires-Dist: mcp<3,>=2.3
 Requires-Dist: pydantic-settings>=2.10
 Requires-Dist: pydantic>=2.11
 Requires-Dist: pyjwt[crypto]<3,>=2.10.1
@@ -139,12 +139,6 @@ and call the platform or another platform application with `platform_client()`,
 person's delegation by default while the turn serves one; neither exposes a proof or a token. See
 the [public API](docs/reference/public-api.md#current_requester-and-platform_client).
 
-Job-hosted batch execution is an [accepted design](docs/adrs/0015-job-hosted-batch-execution.md)
-with implementation pending. It will run this SDK's configured Tau composition for one assignment
-inside a project Job, close it, and exit without starting Uvicorn. The Job continues to own its
-status and logs. See the [batch guide](docs/guides/job-hosted-batch-execution.md) for the target
-Python integration; the current release does not expose that batch API.
-
 ## Local development without platform sessions
 
 Local mode runs the same workspace Tau runtime without registering an Agent or AgentSession. The
@@ -305,8 +299,8 @@ Kubernetes manifest, runtime image, executor bundle, or container-publication pi
 consuming project owns its dependency lock, deployable artifact, system dependencies, project
 code, prompts, skills, hooks, and extensions.
 
-The project identity and migration are defined by
-[ADR 56](./docs/adrs/adr-56-main-sequence-tau-sdk-workspace-bound-library-deployment.md). See the
+The project identity is defined by
+[ADR 0001](./docs/adrs/0001-workspace-bound-python-sdk.md). See the
 [quickstart](./docs/getting-started/quickstart.md), [documentation index](./docs/README.md), and
 [release guide](./docs/reference/releasing.md) for the complete contracts.
 
@@ -315,12 +309,12 @@ The project identity and migration are defined by
 The repository uses Python 3.13 and `uv`:
 
 ```bash
-uv sync --frozen
+uv sync --frozen --extra tau-board
 uv run pytest
-uv run ruff check .
-uv run mypy
 ```
 
+[Testing and release gates](docs/reference/testing.md) lists every check CI runs.
+
 Releases are immutable, and a merge to `main` is the release. Merging `development` into `main`
 builds and verifies the wheel and source distribution of the version `pyproject.toml` declares,
 publishes them to PyPI through OIDC trusted publishing, and tags the merge—for example, `v1.0.0`.

{ms_tau_sdk-2.0.11.dev52 → ms_tau_sdk-2.0.15.dev62}/README.md

@@ -106,12 +106,6 @@ and call the platform or another platform application with `platform_client()`,
 person's delegation by default while the turn serves one; neither exposes a proof or a token. See
 the [public API](docs/reference/public-api.md#current_requester-and-platform_client).
 
-Job-hosted batch execution is an [accepted design](docs/adrs/0015-job-hosted-batch-execution.md)
-with implementation pending. It will run this SDK's configured Tau composition for one assignment
-inside a project Job, close it, and exit without starting Uvicorn. The Job continues to own its
-status and logs. See the [batch guide](docs/guides/job-hosted-batch-execution.md) for the target
-Python integration; the current release does not expose that batch API.
-
 ## Local development without platform sessions
 
 Local mode runs the same workspace Tau runtime without registering an Agent or AgentSession. The
@@ -272,8 +266,8 @@ Kubernetes manifest, runtime image, executor bundle, or container-publication pi
 consuming project owns its dependency lock, deployable artifact, system dependencies, project
 code, prompts, skills, hooks, and extensions.
 
-The project identity and migration are defined by
-[ADR 56](./docs/adrs/adr-56-main-sequence-tau-sdk-workspace-bound-library-deployment.md). See the
+The project identity is defined by
+[ADR 0001](./docs/adrs/0001-workspace-bound-python-sdk.md). See the
 [quickstart](./docs/getting-started/quickstart.md), [documentation index](./docs/README.md), and
 [release guide](./docs/reference/releasing.md) for the complete contracts.
 
@@ -282,12 +276,12 @@ The project identity and migration are defined by
 The repository uses Python 3.13 and `uv`:
 
 ```bash
-uv sync --frozen
+uv sync --frozen --extra tau-board
 uv run pytest
-uv run ruff check .
-uv run mypy
 ```
 
+[Testing and release gates](docs/reference/testing.md) lists every check CI runs.
+
 Releases are immutable, and a merge to `main` is the release. Merging `development` into `main`
 builds and verifies the wheel and source distribution of the version `pyproject.toml` declares,
 publishes them to PyPI through OIDC trusted publishing, and tags the merge—for example, `v1.0.0`.

{ms_tau_sdk-2.0.11.dev52 → ms_tau_sdk-2.0.15.dev62}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.11.dev52"
+version = "2.0.15.dev62"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"
@@ -22,7 +22,7 @@ dependencies = [
   "fastapi>=0.116",
   "httpx>=0.28",
   "jsonschema>=4.25,<5",
-  "mcp>=1.27,<2",
+  "mcp>=2.3,<3",
   "pydantic>=2.11",
   "pydantic-settings>=2.10",
   "pyjwt[crypto]>=2.10.1,<3",

{ms_tau_sdk-2.0.11.dev52 → ms_tau_sdk-2.0.15.dev62}/src/ms_tau_sdk/agent_skills/tau_a2a_runtime_adapter/SKILL.md

@@ -54,6 +54,11 @@ For a deployed Agent, use the projected `a2a.send_message` MCP operation. The pl
 resolves the target `AgentSession`, waits for its runtime to become ready, and dispatches the
 message. For asynchronous work, use the returned Task handle with `a2a.wait_task`.
 
+The platform gives a direct Message (`response_kind: "message"`) 90 seconds, and no setting
+extends that limit. A target that has not answered by then stops its turn, and the send fails
+because of the limit. Send work that may take longer with `response_kind: "task"`, and do not
+resend a Message that ran out of time: the work it already did is not rolled back.
+
 For local Tau development, start `ms-tau` and wait for its local `/ready` result. The public A2A
 REST and JSON-RPC surfaces support Message and Task execution against the workspace-local SQLite
 store, including streaming, list/get/cancel/subscribe, and continuation. An A2A protocol Task does

{ms_tau_sdk-2.0.11.dev52 → ms_tau_sdk-2.0.15.dev62}/src/ms_tau_sdk/agent_skills/tau_local_development/SKILL.md

@@ -35,9 +35,9 @@ The SDK looks for the CLI in `MAINSEQUENCE_CLI`, then beside the Python interpre
 CLI. Do not add token lines to `.env`. A pair found there still works, but it is deprecated and
 startup logs a warning. `mainsequence refresh-token` run in that directory removes the lines.
 
-Do not set `APP_NAME`, `FASTAPI_PUBLIC_BASE_URL`, `MAINSEQUENCE_CALLER_AUTH_MODE=assertion`, or the
-`MAINSEQUENCE_CALLER_ASSERTION_*` variables. The platform sets them when it hosts a runtime, and
-local mode refuses to start with them.
+Do not set `APP_NAME`, `FASTAPI_PUBLIC_BASE_URL`, `MAINSEQUENCE_CALLER_AUTH_MODE=assertion`, the
+`MAINSEQUENCE_CALLER_ASSERTION_*` variables or `MAINSEQUENCE_A2A_MESSAGE_LIMIT_SECONDS`. The
+platform sets them when it hosts a runtime, and local mode refuses to start with them.
 
 Set `MAINSEQUENCE_ENDPOINT` only for a non-default platform endpoint. The CLI session must be for
 the same endpoint. Local mode binds to `127.0.0.1:8787` by default. Treat an explicit public bind
@@ -118,6 +118,11 @@ To request a Task from `message:send`, send the response-kind extension header
 response. `message:stream` is always Task-oriented and does not accept `responseKind` or
 `returnImmediately`.
 
+Local mode has no platform Message limit: a direct Message ends only at
+`MAINSEQUENCE_TAU_TURN_TIMEOUT_SECONDS`. A hosted Agent answers a direct Message within the
+platform's 90 seconds or with HTTP 504 `DEADLINE_EXCEEDED`, so design work that may take longer as
+a Task.
+
 Task terminality is derived only from its A2A state. `completed`, `failed`, `canceled`, and
 `rejected` are terminal; `input_required` and `auth_required` are resumable. A normal execution
 failure produces a durable failed Task and a standard responder `status.message`. A

{ms_tau_sdk-2.0.11.dev52 → ms_tau_sdk-2.0.15.dev62}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -26,8 +26,13 @@ second SDK-specific prompt override or companion append file. Other resources fo
 version pinned by the installed SDK.
 
 `.agents/skills/ms_tau_sdk/` is different: it contains managed development instructions for coding
-agents working on the repository. It is not loaded as the runtime's `.tau` behavior and must not be
-used as application configuration.
+agents working on the repository. It is not the runtime's `.tau` behavior and must not be used as
+application configuration.
+
+Tau reads skills in `.tau/skills/` and `.agents/skills/` at any depth: a folder without a
+`SKILL.md` groups skills, such as `.agents/skills/mcp_tools/<skill>/SKILL.md`, the folder an
+application can publish with the mainsequence SDK's skills publisher. The managed skills in
+`.agents/skills/ms_tau_sdk/` are read too.
 
 ## Extension ownership
 
@@ -74,7 +79,7 @@ Task controls requires an actual Task context and is specified by ADR 0015.
 The A2A Task controls are `task_request_input` and `task_request_authorization`. They remain
 available in every mode for the agent's own Task; extensions must not register those names.
 Register project tools under `.tau/extensions/` and verify the effective catalog after loading.
-With base tools excluded, the skill-scoped `read` keeps `.tau/skills/` available: it opens a
+With base tools excluded, the skill-scoped `read` keeps the project skills available: it opens a
 discovered skill's `SKILL.md` and the files in its directory, such as `references/*.md`, and
 rejects every other path, including symlinks that resolve outside the skill. Tau lists the skills
 in the system prompt because a tool named `read` exists. Extensions must not register `read` in
@@ -96,6 +101,16 @@ retry guidance for up to `TAU_MCP_APPLICATION_READY_TIMEOUT_SECONDS` (default `1
 turn time. This startup budget is separate from the tool's execution limit; an expired readiness
 wait reports `readiness_timeout`. Cancellation, ended delegation and terminal refusals stop the wait.
 
+## Skills that applications publish
+
+A declared application can publish Agent Skills through the MCP Skills extension, as the
+mainsequence SDK's skills publisher does. The Agent lists them with `<name>__list_resources` and
+reads one file with `<name>__read_resource`; a skill file is returned only when its bytes match the
+size and SHA-256 digest the skill lists. Published skills stay the application's: they are not
+project skills under `.tau/skills/`, and fields such as `allowed-tools` grant nothing. With the
+coding tools, a model that follows a published skill can run commands; set
+`TAU_EXCLUDE_BASE_TOOLS=true` when that must not happen.
+
 ## Invariants extensions must not replace
 
 Extensions may change effective agent capabilities, but they must not replace or bypass:
@@ -167,8 +182,6 @@ Rules for tools that act for the requester:
 - A delegated call uses the person's ordinary permissions, including administrative ones; any other
   call uses the Agent's own. Each operation decides what it needs. Never infer write permission
   from view access.
-- This needs the platform's matching change, deployed in the same cutover; check the deployed
-  platform and the installed SDK before depending on it.
 - Return to the model only business results, such as rows, numbers, and names. Never return the
   response object, its headers, a token, a proof, or a raw error body.
 - Keep nothing for another turn or another person. The delegation ends with the turn, and a task

{ms_tau_sdk-2.0.11.dev52 → ms_tau_sdk-2.0.15.dev62}/src/ms_tau_sdk/agent_skills/tau_security_and_access/SKILL.md

@@ -178,7 +178,13 @@ What makes it safe:
 
 A delegated read returns anything the person can view in the Agent's Environment: what they
 created and what others shared with them, directly or through a team. This holds for Secrets and
-every other object. The platform enforces sharing; which of those objects a tool uses is part of
+other shared resources. Ordinary Teams use explicit membership: the creator is added once and
+can be removed; current Organization admins are protected writer members. Removing the admin
+role keeps membership and writer access but ends protection. Only Organization admins manage
+membership, and managing a workload that created a Team does not grant Team control. A Team's
+members still receive the resources shared with it. The Full directory remains unchanged.
+See the SDK Security and access guide's **Teams and membership** section for platform rollout.
+The platform enforces sharing; which of those objects a tool uses is part of
 the tool's design. For Secrets, the naming convention states that design:
 
 - **A personal credential:** a name tied to the person, such as `QUOTES_API_KEY__<person uid>`.

{ms_tau_sdk-2.0.11.dev52 → ms_tau_sdk-2.0.15.dev62}/src/ms_tau_sdk/api/a2a.py

@@ -382,6 +382,72 @@ def _unsupported_operation_json_rpc_error(
     }
 
 
+class _MessageLimitExceeded(Exception):
+    """A Message-mode request reached its time limit before the Agent answered."""
+
+    def __init__(self, limit_seconds: float) -> None:
+        super().__init__(f"The Message time limit of {limit_seconds} seconds expired")
+        self.limit_seconds = limit_seconds
+
+
+def _message_limit_exceeded(context_id: str, limit_seconds: float) -> _MessageLimitExceeded:
+    logger.warning(
+        "a2a.message.limit_exceeded",
+        message="A Message-mode request reached its time limit before the Agent answered",
+        context_id=context_id,
+        limit_seconds=limit_seconds,
+    )
+    return _MessageLimitExceeded(limit_seconds)
+
+
+def _seconds_text(value: float) -> str:
+    return str(int(value)) if float(value).is_integer() else str(value)
+
+
+def _message_limit_text(limit_seconds: float) -> str:
+    return (
+        f"The Agent did not answer the Message within {_seconds_text(limit_seconds)} seconds. "
+        "Use Task mode for longer work."
+    )
+
+
+def _message_limit_error_info(limit_seconds: float) -> dict[str, Any]:
+    return {
+        "@type": "type.googleapis.com/google.rpc.ErrorInfo",
+        "reason": "MESSAGE_RESPONSE_LIMIT_EXCEEDED",
+        "domain": "mainsequence.ai",
+        # ErrorInfo metadata values are strings.
+        "metadata": {"limitSeconds": _seconds_text(limit_seconds)},
+    }
+
+
+def _message_limit_rest_error(limit_seconds: float) -> JSONResponse:
+    return JSONResponse(
+        status_code=504,
+        media_type="application/a2a+json",
+        content={
+            "error": {
+                "code": 504,
+                "status": "DEADLINE_EXCEEDED",
+                "message": _message_limit_text(limit_seconds),
+                "details": [_message_limit_error_info(limit_seconds)],
+            }
+        },
+    )
+
+
+def _message_limit_json_rpc_error(request_id: object, limit_seconds: float) -> dict[str, Any]:
+    return {
+        "jsonrpc": "2.0",
+        "id": request_id,
+        "error": {
+            "code": -32000,
+            "message": _message_limit_text(limit_seconds),
+            "data": [_message_limit_error_info(limit_seconds)],
+        },
+    }
+
+
 def _without_push_notification_capability(
     agent_card: dict[str, Any] | None,
 ) -> dict[str, Any] | None:
@@ -744,6 +810,7 @@ async def _collect_turn(
     provenance: TurnProvenance,
     turn_uid: str | None = None,
     caller_assertion: CallerAssertion | None = None,
+    deadline: float | None = None,
 ) -> str:
     accumulator = _TurnAccumulator(max_output_bytes=max_output_bytes)
     prompt_options: dict[str, Any] = {"provenance": provenance}
@@ -751,6 +818,8 @@ async def _collect_turn(
         prompt_options["turn_uid"] = turn_uid
     if caller_assertion is not None:
         prompt_options["caller_assertion"] = caller_assertion
+    if deadline is not None:
+        prompt_options["deadline"] = deadline
     async for event in manager.prompt(context_id, prompt, **prompt_options):
         accumulator.consume(event)
     context = active_task_execution()
@@ -779,6 +848,7 @@ async def _collect_validated_turn(
     provenance: TurnProvenance,
     turn_uid: str | None = None,
     caller_assertion: CallerAssertion | None = None,
+    deadline: float | None = None,
 ) -> str:
     text = await _collect_turn(
         manager,
@@ -788,6 +858,7 @@ async def _collect_validated_turn(
         provenance=provenance,
         turn_uid=turn_uid,
         caller_assertion=caller_assertion,
+        deadline=deadline,
     )
     if not contract.enabled:
         return text
@@ -818,6 +889,7 @@ async def _collect_validated_turn(
                 max_output_bytes=max_output_bytes,
                 provenance=provenance,
                 caller_assertion=caller_assertion,
+                deadline=deadline,
             )
     raise AssertionError("strict JSON repair loop did not terminate")
 
@@ -948,6 +1020,16 @@ async def _wait_for_task_return_state(
     return current
 
 
+def _task_wait_seconds(config: TauSDKSettings, deadline: float | None) -> float:
+    """How long a request waits for its Task: the configured wait, ended by the platform's
+    Message limit when the platform sets one. Either way the Task keeps running."""
+
+    if deadline is None:
+        return config.a2a_task_wait_timeout_seconds
+    remaining = deadline - asyncio.get_running_loop().time()
+    return min(config.a2a_task_wait_timeout_seconds, remaining)
+
+
 @dataclass(frozen=True, slots=True)
 class _ClaimedTask:
     attempt_uid: str
@@ -1621,6 +1703,7 @@ async def _execute_message(
     max_output_bytes: int,
     provenance: TurnProvenance,
     caller_assertion: CallerAssertion | None = None,
+    deadline: float | None = None,
 ) -> dict[str, Any]:
     text = await _collect_validated_turn(
         manager,
@@ -1630,6 +1713,7 @@ async def _execute_message(
         max_output_bytes=max_output_bytes,
         provenance=provenance,
         caller_assertion=caller_assertion,
+        deadline=deadline,
     )
     message = _agent_message(
         context_id=context_id,
@@ -2288,6 +2372,32 @@ async def message_send(
         Header(alias="A2A-Extensions"),
     ] = None,
 ) -> dict[str, Any]:
+    try:
+        return await _message_send(body, client, manager, config, request, a2a_extensions)
+    except _MessageLimitExceeded as error:
+        return _message_limit_rest_error(error.limit_seconds)  # type: ignore[return-value]
+
+
+async def _message_send(
+    body: dict[str, Any],
+    client: MainSequenceClient,
+    manager: SessionRuntimeManager,
+    config: TauSDKSettings,
+    request: Request,
+    a2a_extensions: str | None,
+) -> dict[str, Any]:
+    """Answer one ``message:send``, for REST and JSON-RPC alike.
+
+    When the platform sets a Message limit, it runs from the moment the request arrives. It
+    bounds a Message-mode request as a whole, including output-contract repair turns, and it ends
+    the wait of a Task-mode request that does not return immediately. A Message-mode request that
+    reaches its limit, or its turn's own limit, raises ``_MessageLimitExceeded``, which each
+    transport answers in its own form.
+    """
+    platform_limit = config.a2a_message_limit_seconds
+    deadline = (
+        None if platform_limit is None else asyncio.get_running_loop().time() + platform_limit
+    )
     try:
         provenance = _a2a_turn_provenance(config, request)
     except CallerIdentityError as error:
@@ -2362,7 +2472,7 @@ async def message_send(
             client,
             task,
             poll_interval_seconds=config.a2a_task_event_poll_interval_seconds,
-            wait_timeout_seconds=config.a2a_task_wait_timeout_seconds,
+            wait_timeout_seconds=_task_wait_seconds(config, deadline),
         )
         task = await _task_with_history(client, task, history_length=history_length)
         return {"task": _task_payload(task, history_length=history_length)}
@@ -2397,7 +2507,7 @@ async def message_send(
                 client,
                 task,
                 poll_interval_seconds=config.a2a_task_event_poll_interval_seconds,
-                wait_timeout_seconds=config.a2a_task_wait_timeout_seconds,
+                wait_timeout_seconds=_task_wait_seconds(config, deadline),
             )
             task = await _task_with_history(client, task, history_length=history_length)
             return {"task": _task_payload(task, history_length=history_length)}
@@ -2422,31 +2532,52 @@ async def message_send(
                 client,
                 task,
                 poll_interval_seconds=config.a2a_task_event_poll_interval_seconds,
-                wait_timeout_seconds=config.a2a_task_wait_timeout_seconds,
+                wait_timeout_seconds=_task_wait_seconds(config, deadline),
             )
         task = await _task_with_history(client, task, history_length=history_length)
         return {"task": _task_payload(task, history_length=history_length)}
     request_message_id = str(message["messageId"])
+    context_id = str(message["contextId"])
     if config.local_mode:
         replay = await client.begin_local_conversation_message(message_to_protocol(message))
         if replay is not None:
             return {"message": replay}
-    result = await _execute_message(
-        manager,
-        context_id=str(message["contextId"]),
-        prompt=prompt,
-        output_contract=output_contract,
-        max_output_bytes=config.max_turn_output_bytes,
-        provenance=provenance,
-        caller_assertion=request_caller_assertion(request),
-    )
+    if (
+        platform_limit is not None
+        and deadline is not None
+        and asyncio.get_running_loop().time() >= deadline
+    ):
+        # The request used up the platform's limit before its turn could start, so none starts.
+        raise _message_limit_exceeded(context_id, platform_limit)
+    request_limit = asyncio.timeout_at(deadline)
+    try:
+        async with request_limit:
+            result = await _execute_message(
+                manager,
+                context_id=context_id,
+                prompt=prompt,
+                output_contract=output_contract,
+                max_output_bytes=config.max_turn_output_bytes,
+                provenance=provenance,
+                caller_assertion=request_caller_assertion(request),
+                deadline=deadline,
+            )
+    except TimeoutError as error:
+        # The platform's limit for the request or the turn's own limit expired, and the turn was
+        # stopped. The caller learns which limit.
+        raise _message_limit_exceeded(
+            context_id,
+            platform_limit
+            if platform_limit is not None and request_limit.expired()
+            else config.turn_timeout_seconds,
+        ) from error
     if config.local_mode:
         result = await client.complete_local_conversation_message(
-            str(message["contextId"]),
+            context_id,
             request_message_id,
             result,
         )
-    manager.mark_response_delivered(str(message["contextId"]))
+    manager.mark_response_delivered(context_id)
     return {"message": result}
 
 
@@ -2703,14 +2834,17 @@ async def json_rpc(
 
     try:
         if method in {"SendMessage", "message/send"}:
-            result = await message_send(
-                params,
-                client,
-                manager,
-                config,
-                request,
-                a2a_extensions,
-            )
+            try:
+                result = await _message_send(
+                    params,
+                    client,
+                    manager,
+                    config,
+                    request,
+                    a2a_extensions,
+                )
+            except _MessageLimitExceeded as error:
+                return _message_limit_json_rpc_error(request_id, error.limit_seconds)
         elif method in {"SendStreamingMessage", "message/stream"}:
             _response_kind(
                 params,