ms-tau-sdk 2.0.26.dev79__tar.gz → 2.0.27.dev80__tar.gz

{ms_tau_sdk-2.0.26.dev79 → ms_tau_sdk-2.0.27.dev80}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## Unreleased
+
+- **Platform providers that this Tau release does not know run from the platform's catalog.**
+  Beside each built-in provider credential, the platform now sends `catalog_definition`: the
+  address and Tau compatibility settings its provider catalog publishes for the selected model.
+  When the pinned `tau-ai==0.4.2` does not know the provider, the runtime builds it from that
+  definition through Tau's OpenAI-compatible constructor, `openai-completions` or
+  `openai-responses` only, and never from an address or headers saved with the credential. The
+  address must pass the checks a custom endpoint's address passes. Providers Tau knows ignore the
+  definition and keep Tau's address and settings. Meta (`meta`, one Meta Model API key per
+  person) is the first such provider; earlier runtimes refuse it. Errors about a provider outside
+  Tau's catalog now say "not in this runtime's Tau catalog" instead of "custom provider". The
+  `tau-ai` pin and the ADR 0016 provider patch are unchanged.
+
 ## 2.0.26 — 2026-10-24
 
 - **The deployed Agent reads its resources only from `.tau/` by default (ADR 0025).** Tau, a

{ms_tau_sdk-2.0.26.dev79 → ms_tau_sdk-2.0.27.dev80}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.26.dev79
+Version: 2.0.27.dev80
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs

{ms_tau_sdk-2.0.26.dev79 → ms_tau_sdk-2.0.27.dev80}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.26.dev79"
+version = "2.0.27.dev80"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.26.dev79 → ms_tau_sdk-2.0.27.dev80}/src/ms_tau_sdk/backend/client.py

@@ -966,6 +966,8 @@ class MainSequenceClient:
                 "base_url": raw.get("base_url"),
                 "headers": raw.get("headers", {}),
                 "api": raw.get("api"),
+                # Server-owned, beside the saved credential and never inside it.
+                "catalog_definition": hydrated.get("catalog_definition"),
                 "metadata": {
                     "version": hydrated.get("version"),
                     "credential_hash": hydrated.get("credential_hash"),

{ms_tau_sdk-2.0.26.dev79 → ms_tau_sdk-2.0.27.dev80}/src/ms_tau_sdk/backend/local.py

@@ -610,6 +610,11 @@ class LocalDevelopmentBackend(MainSequenceClient):
                     "user_uid": credential.owner_user_uid,
                     "credential_kind": credential.credential_kind,
                     "credential": {key: value for key, value in raw.items() if value is not None},
+                    "catalog_definition": (
+                        credential.catalog_definition.model_dump(mode="json")
+                        if credential.catalog_definition is not None
+                        else None
+                    ),
                     "version": credential.metadata.get("version"),
                     "credential_hash": credential.metadata.get("credential_hash"),
                 }

{ms_tau_sdk-2.0.26.dev79 → ms_tau_sdk-2.0.27.dev80}/src/ms_tau_sdk/backend/models.py

@@ -422,6 +422,17 @@ class TauResumeSnapshotUploadResponse(BackendModel):
     canonical_size: int = Field(ge=0)
 
 
+class ProviderCatalogDefinition(BackendModel):
+    """The platform catalog's address and Tau compatibility settings for the selected model.
+
+    The platform sends it beside every built-in credential. The runtime reads it only for a
+    provider its pinned Tau does not know.
+    """
+
+    base_url: str
+    compat: dict[str, Any] = Field(default_factory=dict)
+
+
 class ProviderCredential(BackendModel):
     provider: str
     custom_id: str | None = None
@@ -438,6 +449,7 @@ class ProviderCredential(BackendModel):
     # An organization_custom credential carries its key in a header, so the headers never appear
     # in repr() or str().
     headers: dict[str, str] = Field(default_factory=dict, repr=False)
+    catalog_definition: ProviderCatalogDefinition | None = None
     metadata: dict[str, Any] = Field(default_factory=dict)
 
     def secret(self) -> str:

{ms_tau_sdk-2.0.26.dev79 → ms_tau_sdk-2.0.27.dev80}/src/ms_tau_sdk/providers/factory.py

@@ -116,7 +116,11 @@ class ProviderFactory:
         self.provider_timeout_seconds = provider_timeout_seconds
 
     @staticmethod
-    def _validate_custom_base_url(base_url: str) -> None:
+    def _validate_custom_base_url(
+        base_url: str,
+        *,
+        source: str = "Custom provider credential",
+    ) -> None:
         parsed = urlsplit(base_url)
         hostname = str(parsed.hostname or "").casefold()
         if (
@@ -127,13 +131,13 @@ class ProviderFactory:
             or parsed.query
             or parsed.fragment
         ):
-            raise ConfigurationError("Custom provider credential contains an invalid base_url")
+            raise ConfigurationError(f"{source} contains an invalid base_url")
         if (
             hostname in BLOCKED_CUSTOM_PROVIDER_HOSTS
             or hostname == "localhost"
             or hostname.endswith(".localhost")
         ):
-            raise ConfigurationError("Custom provider base_url targets a prohibited host")
+            raise ConfigurationError(f"{source} base_url targets a prohibited host")
         try:
             address = ipaddress.ip_address(hostname)
         except ValueError:
@@ -145,7 +149,7 @@ class ProviderFactory:
             or address.is_reserved
             or address.is_unspecified
         ):
-            raise ConfigurationError("Custom provider base_url targets a prohibited address")
+            raise ConfigurationError(f"{source} base_url targets a prohibited address")
 
     @staticmethod
     def _thinking_levels(
@@ -193,19 +197,20 @@ class ProviderFactory:
             projected_api = provider_control.model.api
             if projected_api not in CUSTOM_API_TRANSPORTS:
                 raise ConfigurationError(
-                    f"Custom provider {provider_name} uses unsupported Tau API "
-                    f"transport {projected_api}"
+                    f"Provider {provider_name} is not in this runtime's Tau catalog and uses "
+                    f"unsupported Tau API transport {projected_api}"
                 )
             projected_inputs = set(provider_control.model.input)
             if not projected_inputs or not projected_inputs.issubset(CUSTOM_INPUT_KINDS):
                 raise ConfigurationError(
-                    "Platform provider-control input capabilities are invalid for a custom provider"
+                    "Platform provider-control input capabilities are invalid for a provider "
+                    "not in this runtime's Tau catalog"
                 )
             projected_thinking = set(provider_control.model.thinking_levels)
             if not provider_control.model.reasoning and projected_thinking:
                 raise ConfigurationError(
-                    "Platform provider-control thinking levels contradict the "
-                    "custom model reasoning capability"
+                    "Platform provider-control thinking levels contradict the reasoning "
+                    "capability of a model not in this runtime's Tau catalog"
                 )
             self.validate_input_media(
                 provider_control,
@@ -405,7 +410,17 @@ class ProviderFactory:
             timeout_seconds = self.provider_timeout_seconds
         definition = PROVIDER_DEFINITIONS.get(credential.provider)
         catalog_provider = CATALOG_BY_NAME.get(credential.provider)
-        is_custom_provider = catalog_provider is None
+        # A provider this Tau does not know runs only through Tau's OpenAI-compatible constructor,
+        # as an Organization custom provider or as the platform's catalog defines it.
+        outside_tau_catalog = catalog_provider is None
+        is_custom_provider = (
+            outside_tau_catalog and credential.credential_kind == "organization_custom"
+        )
+        catalog_definition = (
+            credential.catalog_definition
+            if outside_tau_catalog and not is_custom_provider
+            else None
+        )
         model_metadata = (
             catalog_provider.model_metadata.get(model)
             if catalog_provider is not None and model is not None
@@ -415,7 +430,8 @@ class ProviderFactory:
             normalize_thinking_level(thinking_level) if thinking_level is not None else None
         )
         if not provider_control.model.reasoning or (
-            is_custom_provider and normalized_thinking not in provider_control.model.thinking_levels
+            outside_tau_catalog
+            and normalized_thinking not in provider_control.model.thinking_levels
         ):
             normalized_thinking = None
         mapped_thinking: str | None = None
@@ -427,37 +443,51 @@ class ProviderFactory:
             ):
                 mapped_thinking = model_metadata.thinking_level_map[normalized_thinking]
         api = provider_control.model.api
-        if is_custom_provider:
-            if credential.credential_kind != "organization_custom":
-                raise ConfigurationError(
-                    "A provider absent from Tau's built-in catalog requires an "
-                    "organization_custom credential"
-                )
+        if outside_tau_catalog:
             if api not in CUSTOM_API_TRANSPORTS:
                 raise ConfigurationError(
-                    f"Custom provider {credential.provider} uses unsupported Tau "
-                    f"API transport {api}"
+                    f"Provider {credential.provider} is not in this runtime's Tau catalog and "
+                    f"uses unsupported Tau API transport {api}"
                 )
-            if credential.api != api:
+            if is_custom_provider:
+                if credential.api != api:
+                    raise ConfigurationError(
+                        "Custom provider credential transport does not match "
+                        "Platform provider-control evidence"
+                    )
+                if not credential.base_url:
+                    raise ConfigurationError(
+                        "Custom provider credential requires an explicit base_url"
+                    )
+                self._validate_custom_base_url(credential.base_url)
+            elif catalog_definition is not None:
+                self._validate_custom_base_url(
+                    catalog_definition.base_url,
+                    source="Platform catalog definition",
+                )
+            else:
                 raise ConfigurationError(
-                    "Custom provider credential transport does not match "
-                    "Platform provider-control evidence"
+                    f"Provider {credential.provider} is not in this runtime's Tau catalog, and "
+                    "the platform sent neither an organization_custom credential nor its "
+                    "catalog definition"
                 )
-            if not credential.base_url:
-                raise ConfigurationError("Custom provider credential requires an explicit base_url")
-            self._validate_custom_base_url(credential.base_url)
-        base_url = credential.base_url or (
-            model_metadata.base_url
-            if model_metadata is not None and model_metadata.base_url
-            else definition.base_url
-            if definition
-            else "https://api.openai.com/v1"
-        )
-        headers = {
-            **(catalog_provider.headers if catalog_provider is not None else {}),
-            **(model_metadata.headers if model_metadata is not None else {}),
-            **credential.headers,
-        }
+        if catalog_definition is not None:
+            # The address comes from the platform's catalog, never from the saved credential.
+            base_url = catalog_definition.base_url
+            headers: dict[str, str] = {}
+        else:
+            base_url = credential.base_url or (
+                model_metadata.base_url
+                if model_metadata is not None and model_metadata.base_url
+                else definition.base_url
+                if definition
+                else "https://api.openai.com/v1"
+            )
+            headers = {
+                **(catalog_provider.headers if catalog_provider is not None else {}),
+                **(model_metadata.headers if model_metadata is not None else {}),
+                **credential.headers,
+            }
         secret = credential.secret()
         if not secret and not is_custom_provider:
             raise ConfigurationError(
@@ -527,7 +557,13 @@ class ProviderFactory:
                 and catalog_provider.thinking_parameter in {"reasoning_effort", "reasoning.effort"}
                 else "reasoning_effort"
             ),
-            compat=model_metadata.compat if model_metadata is not None else {},
+            compat=(
+                catalog_definition.compat
+                if catalog_definition is not None
+                else model_metadata.compat
+                if model_metadata is not None
+                else {}
+            ),
         )
         if api == "google-generative-ai":
             return GoogleGenerativeAIProvider(config)