ms-tau-sdk 2.0.23.dev75__tar.gz → 2.0.24.dev76__tar.gz

{ms_tau_sdk-2.0.23.dev75 → ms_tau_sdk-2.0.24.dev76}/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 2.0.24 — 2026-10-22
+
+- **Agent deployment and recovery guidance uses the repository workflow.** The runtime
+  contract, Security and access guide and troubleshooting guide retire the manual
+  `agent.update_runtime` operation and runtime-update REST endpoint. Discovery no longer
+  supplies manual-update remediation; A2A uses the active deployed image. No SDK runtime
+  behavior changes.
+
+- **The quickstart, the README, troubleshooting and the Tau repository skills say what a hosted
+  runtime installs and runs.** When Main Sequence hosts the runtime, it now installs the packages
+  that the committed `requirements.txt` at the repository root lists (without that file, the
+  dependencies the root `pyproject.toml` declares), reuses them for every later commit until the
+  file changes, and runs the repository's files from `/workspace`, with `/workspace/src` and
+  `/workspace` on `PYTHONPATH`, without installing the project. The quickstart said that the
+  lockfile records the versions that will execute, and the README and `tau_repository_integration`
+  only said to add the SDK through the project's dependency manager. The new
+  [hosted Agents](docs/getting-started/quickstart.md#hosted-agents) section, the README and
+  `tau_repository_integration` now say to run `mainsequence code-repository sync` and commit
+  `requirements.txt` with `uv.lock` after adding or upgrading the SDK or a package that project
+  code or an extension imports, because a package that `pyproject.toml` declares but the file does
+  not list fails its import in the hosted runtime; to pin the SDK from the package index or a Git
+  commit, not a local path; and that project code must not rely on `importlib.metadata` for the
+  project's own package, its own console scripts or extensions compiled from its sources.
+  `tau_project_customization` says what an extension must list and import there, and
+  troubleshooting covers the import failures. No SDK behavior changes.
+
 ## 2.0.23 — 2026-10-21
 
 - **A hosted Task's answer reaches the platform in a few writes, and none of it is lost

{ms_tau_sdk-2.0.23.dev75 → ms_tau_sdk-2.0.24.dev76}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.23.dev75
+Version: 2.0.24.dev76
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs
@@ -84,6 +84,12 @@ uv add --prerelease=allow ms-tau-sdk   # or pin one exactly: uv add "ms-tau-sdk=
 See the [release process](docs/reference/releasing.md#registry-publication) for what each workflow
 publishes.
 
+When Main Sequence hosts the runtime, it installs what the repository's committed
+`requirements.txt` lists and runs the repository's files, not an installed copy of the project.
+After adding or upgrading the SDK, run `mainsequence code-repository sync` and commit
+`requirements.txt` with `uv.lock`. See
+[hosted Agents](docs/getting-started/quickstart.md#hosted-agents).
+
 Provide the runtime credential that Main Sequence assigned to the deployment, and the file that
 holds the runtime's projected workload identity token:
 

{ms_tau_sdk-2.0.23.dev75 → ms_tau_sdk-2.0.24.dev76}/README.md

@@ -51,6 +51,12 @@ uv add --prerelease=allow ms-tau-sdk   # or pin one exactly: uv add "ms-tau-sdk=
 See the [release process](docs/reference/releasing.md#registry-publication) for what each workflow
 publishes.
 
+When Main Sequence hosts the runtime, it installs what the repository's committed
+`requirements.txt` lists and runs the repository's files, not an installed copy of the project.
+After adding or upgrading the SDK, run `mainsequence code-repository sync` and commit
+`requirements.txt` with `uv.lock`. See
+[hosted Agents](docs/getting-started/quickstart.md#hosted-agents).
+
 Provide the runtime credential that Main Sequence assigned to the deployment, and the file that
 holds the runtime's projected workload identity token:
 

{ms_tau_sdk-2.0.23.dev75 → ms_tau_sdk-2.0.24.dev76}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.23.dev75"
+version = "2.0.24.dev76"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.23.dev75 → ms_tau_sdk-2.0.24.dev76}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -38,7 +38,10 @@ application can publish with the mainsequence SDK's skills publisher. The manage
 
 Project extensions belong under `.tau/extensions/` and may add tools, hooks, and lifecycle
 behavior. Keep reusable business logic in the normal application package and make extension
-adapters thin and structured.
+adapters thin and structured. When Main Sequence hosts the runtime, list every package an
+extension imports in the repository's committed `requirements.txt`, and import the project's own
+packages from `src/` or the repository root, because the project itself is not installed;
+`tau-repository-integration` says how to keep that file current.
 
 The project author owns:
 

{ms_tau_sdk-2.0.23.dev75 → ms_tau_sdk-2.0.24.dev76}/src/ms_tau_sdk/agent_skills/tau_repository_integration/SKILL.md

@@ -58,6 +58,25 @@ only with that declaration, read from the object it serves. Therefore:
   repository. The platform sets them when it hosts the runtime, and local mode refuses to start
   with them.
 
+## Hosted dependencies and code
+
+When Main Sequence hosts the runtime, it installs the packages that the committed
+`requirements.txt` at the repository root lists, or, without that file, the dependencies that the
+root `pyproject.toml` declares, and reuses them for every later commit until the file or the base
+image changes. A package that `pyproject.toml` declares but `requirements.txt` does not list,
+`ms-tau-sdk` included, is not installed, and its import fails in the hosted runtime. After adding
+or upgrading the SDK, or a package that project code or an extension imports, run
+`mainsequence code-repository sync` and commit `requirements.txt` with `uv.lock`. Pin the SDK from
+the package index or a Git commit, never from a local path: the hosted build refuses local paths
+other than the repository itself, and `-r` or `-c` references.
+
+The hosted runtime runs the repository's files from `/workspace`, its working directory and
+therefore the SDK workspace, with `/workspace/src` and `/workspace` on `PYTHONPATH`. The project
+itself is not installed. Keep its top-level packages directly under `src/` or the repository root,
+and do not make project code or extensions depend on `importlib.metadata` for the project's own
+version or entry points, on the project's own console scripts, or on extensions compiled from its
+sources.
+
 ## Job-hosted batch execution
 
 ADR 0015 accepts a Python batch entry point, but it is **not implemented in this SDK version**.
@@ -96,7 +115,8 @@ JobRun UID in the SDK.
 ## Repository integration procedure
 
 1. Inspect the project's Python constraint, dependency manager, lockfile, and application layout.
-2. Add and pin `ms-tau-sdk` through that existing dependency workflow.
+2. Add and pin `ms-tau-sdk` through that existing dependency workflow. For a runtime that Main
+   Sequence hosts, refresh and commit `requirements.txt` as "Hosted dependencies and code" says.
 3. Synchronize these skills explicitly with `uv run ms-tau skills sync --path .`.
 4. For a service, use `uv run ms-tau` unless the repository needs an importable ASGI module.
    For a finite Job, follow the batch design only after the installed SDK supports it.
@@ -126,5 +146,12 @@ uv run python -c "from api.tau.main import app; print(app.state.mainsequence_req
 The second command prints `{'installed': True, 'mode': 'local', 'public_ingress': ()}` outside
 hosting.
 
+For a runtime that Main Sequence hosts, also check that the committed `requirements.txt` pins the
+SDK; the command prints its line:
+
+```bash
+grep -i '^ms-tau-sdk' requirements.txt
+```
+
 Do not require the `mainsequence` Python distribution in the TAU dependency graph. Authentication
 and Main Sequence transport are implemented directly by `ms-tau-sdk`.