ms-tau-sdk 2.0.3.dev35__tar.gz → 2.0.3.dev36__tar.gz

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/CHANGELOG.md

@@ -11,6 +11,46 @@
   and its result are unchanged. Direct-runtime clients that call the operation themselves are
   unaffected. See the 2026-10-06 amendment of ADR 0002
   ([issue #65](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/65)).
+- Extension tools can read with the access of the person a turn serves, its requester, when an
+  Organization admin enabled the Agent for it. When a hosted runtime starts a chat or A2A Message
+  turn, it sends the verified caller assertion of the request in `X-MainSequence-Caller-Assertion`
+  with the `PATCH /api/v1/agent-sessions/<uid>/tau-runtime-activity/` transition that marks the
+  turn active. The platform answers with `requester_user_uid`, the person it recorded as the turn's
+  requester, or null. A hosted request that creates a Task (`POST /api/v1/agent-tasks/`) or
+  continues one (`POST /api/v1/agent-tasks/<uid>/continue/`) sends the same header with that call,
+  so that the platform records the Task's requester. A Task attempt that the request runs itself
+  serves the request's verified caller when the platform's Task answer names that User as
+  `requester_user_uid` with `requester_identity_type` `human`; a Task attempt started by the
+  platform's dispatch takes its requester from the dispatch's same two facts. Two new public
+  functions:
+  - `current_requester()` returns that person inside the turn (`uid`, `team_uids`), or `None` for
+    Agent callers, the platform's own calls, local mode, a runtime that is not hosted, and code
+    outside a turn;
+  - `requester_client()` returns a client bound to the turn. `request(method, path, ...)` calls a
+    platform API path with the runtime's credential and `X-MainSequence-Acting-For-Session`,
+    `X-MainSequence-Lease-Holder` and `X-MainSequence-Lease-Token`, sent only to the platform base
+    URL. `call_release(release_uid, method, path, ...)` obtains access through
+    `resolve-runtime-access` and calls the application with only its bearer token, kept for the
+    turn while it is valid. A 403 whose `code` is `requester_binding_invalid` or starts with
+    `runtime_lease_` raises a `PermissionError` with that code, and without a requester
+    `requester_client()` raises one at once.
+
+  The assertion stays in its request's scope and goes only to the turn start, Task creation or Task
+  continuation of that request. It is not sent once expired, never by the turn start of a Task
+  attempt, never on the platform's own calls, and never in local mode. The assertion, the lease
+  proof, the runtime credential and application tokens never reach a log line, a persisted entry,
+  model context, a tool result, the UI stream or history, and the binding ends with the turn. The
+  `tau-project-customization` skill teaches tools to use both functions, to return only business
+  results, and states what people are told about this access. Upgrade note: nothing changes for
+  an Agent that does not use them. Requester-bound calls need a platform that records turn and Task
+  requesters; until it does, `current_requester()` returns `None`. See the 2026-10-06 amendment of
+  ADR 0019 ([issue #66](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/66)).
+- `MainSequenceClient.list_model_providers(organization_environment_uid=...)` reads the
+  model-provider catalog of that Organization Environment. It raised `TypeError` instead, so
+  local-mode chat could not list the providers of a configured Environment through
+  `GET /api/chat/model-providers`. The Environment is now sent as the `organization_environment_uid`
+  query parameter, as the other list calls send theirs; the call without an Environment is
+  unchanged ([issue #68](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/68)).
 
 ## 2.0.2 — 2026-10-06
 

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.3.dev35
+Version: 2.0.3.dev36
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs
@@ -132,6 +132,11 @@ only an application that declares it, so serve the application `create_app()` re
 hosting, requests are handled as before. See
 [request identity](docs/reference/runtime-contract.md#request-identity).
 
+An Agent that an Organization admin enabled for it can read with the access of the person whose
+request a turn is serving. Project tools read that person with `current_requester()` and call the
+platform or another platform application for them with `requester_client()`; neither exposes a
+proof or a token. See the [public API](docs/reference/public-api.md#current_requester-and-requester_client).
+
 Job-hosted batch execution is an [accepted design](docs/adrs/0015-job-hosted-batch-execution.md)
 with implementation pending. It will run this SDK's configured Tau composition for one assignment
 inside a project Job, close it, and exit without starting Uvicorn. The Job continues to own its

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/README.md

@@ -99,6 +99,11 @@ only an application that declares it, so serve the application `create_app()` re
 hosting, requests are handled as before. See
 [request identity](docs/reference/runtime-contract.md#request-identity).
 
+An Agent that an Organization admin enabled for it can read with the access of the person whose
+request a turn is serving. Project tools read that person with `current_requester()` and call the
+platform or another platform application for them with `requester_client()`; neither exposes a
+proof or a token. See the [public API](docs/reference/public-api.md#current_requester-and-requester_client).
+
 Job-hosted batch execution is an [accepted design](docs/adrs/0015-job-hosted-batch-execution.md)
 with implementation pending. It will run this SDK's configured Tau composition for one assignment
 inside a project Job, close it, and exit without starting Uvicorn. The Job continues to own its

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.3.dev35"
+version = "2.0.3.dev36"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/src/ms_tau_sdk/__init__.py

@@ -9,6 +9,7 @@ from .runtime.deployment_health import (
     RUNTIME_HEALTH_ABI_VERSION,
     register_deployment_readiness_hook,
 )
+from .runtime.requester import current_requester, requester_client
 from .settings import TauSDKSettings
 
 __all__ = [
@@ -16,5 +17,7 @@ __all__ = [
     "TauSDKSettings",
     "__version__",
     "create_app",
+    "current_requester",
     "register_deployment_readiness_hook",
+    "requester_client",
 ]

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/src/ms_tau_sdk/agent_skills/tau_a2a_runtime_adapter/SKILL.md

@@ -28,6 +28,10 @@ The SDK owns:
 - verifying the platform's signed caller or platform assertion on every inbound request of a
   hosted runtime, and admitting a request to a session or its Tasks only for the session's owner
   or an Organization admin;
+- presenting the verified caller assertion of the request that starts a chat or A2A Message turn
+  only when it marks that turn active, so that the platform can record the turn's requester, and
+  giving extension tools that requester and requester-bound calls through `current_requester()`
+  and `requester_client()` without exposing the assertion, the lease proof, or any token;
 - translating inbound A2A requests into the shared TAU runtime; and
 - translating runtime events and results into validated A2A responses.
 

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -87,7 +87,7 @@ Extensions may change effective agent capabilities, but they must not replace or
 
 - Main Sequence runtime or user authentication;
 - provider-control evidence and credential hydration;
-- caller identity and active-session proof;
+- caller identity, the turn's requester, and active-session proof;
 - persistence ordering, leases, cancellation, or task settlement;
 - secret redaction and payload limits; or
 - HTTP, SSE, Responses, and A2A wire validation.
@@ -95,6 +95,77 @@ Extensions may change effective agent capabilities, but they must not replace or
 When Main Sequence MCP is enabled, use its canonical operations for live platform state. Project
 tools do not grant new platform permissions merely because they run inside TAU.
 
+## Acting for the person a turn serves
+
+An Agent that an Organization admin enabled for it can read platform data, and ask other platform
+applications, with the access of the person whose request a turn is serving: the requester. The
+platform keeps that authority and finds the person in its own records; the runtime only proves
+which of its sessions it is working on. Extension tools use two SDK functions and nothing else:
+
+```python
+import json
+
+from tau_agent.messages import TextContent
+from tau_agent.tools import AgentToolResult
+
+from ms_tau_sdk import current_requester, requester_client
+
+ANALYST_DATA_RELEASE_UID = "..."  # the release of the application to ask
+
+
+async def revenue_by_region(tool_call_id, arguments, signal=None, on_update=None):
+    if current_requester() is None:
+        return AgentToolResult(content=[TextContent(text="Ask me from your own conversation.")])
+    try:
+        answer = await requester_client().call_release(
+            ANALYST_DATA_RELEASE_UID,
+            "POST",
+            "/query",
+            json={"question": "revenue by region"},
+        )
+    except PermissionError:
+        return AgentToolResult(content=[TextContent(text="Your access for this request ended.")])
+    return AgentToolResult(content=[TextContent(text=json.dumps(answer.json()["rows"]))])
+```
+
+- `current_requester()` returns the turn's verified requester, with `uid` and `team_uids`, or
+  `None`. It is `None` for Agent callers, the platform's own calls, local mode, and code outside a
+  turn. Only it names the requester:
+  never take a person's UID from tool arguments, the prompt, history, or a header.
+- `requester_client()` returns a client bound to the turn. `await client.request("GET",
+  "/api/v1/...")` reads a platform API path for the requester. `await client.call_release(
+  release_uid, method, path, ...)` asks another platform application, which answers as the
+  requester. Both return an `httpx.Response`.
+- Without a requester, `requester_client()` raises a `PermissionError`. So does a call that the
+  platform refuses because the requester's access ended (`code` `requester_binding_invalid` or
+  `runtime_lease_*`): the turn is over, the access was removed, more than 24 hours passed, or the
+  Agent is not enabled. Catch it, say in plain words that the request cannot be served, and never
+  fall back to the Agent's own access.
+
+Rules for tools that act for the requester:
+
+- Never handle proofs or tokens. The SDK attaches the session, the lease proof, and the
+  credentials itself. A tool never reads, logs, stores, or forwards them, passes a path rather than
+  a URL, and never sets `Authorization` or an `X-MainSequence-*` header.
+- Requester-bound calls are read-only. The platform refuses writes, sharing, and Secret values;
+  do not build tools that try them.
+- Return to the model only business results, such as rows, numbers, and names. Never return the
+  response object, its headers, a token, a proof, or a raw error body.
+- Keep nothing for another turn or another person. The binding ends with the turn, and a task the
+  tool leaves running has no access afterwards.
+- What a tool reads for a person belongs to that person's conversation. Do not write it to shared
+  stores, other Agents, or external systems.
+
+People who use such an Agent are told:
+
+> **This Agent works with your identity, securely.** It reads only what you can already read, only
+> to answer your own requests, and for at most 24 hours after you ask. It cannot act as anyone else,
+> cannot change, share or delete anything, never sees your secret values, and stops the moment your
+> access ends. Your Organization's administrator approved it to work this way.
+
+The limit is plain: while it works on your request, the Agent's code can read what you can read,
+which is why only administrators decide which Agents may work this way.
+
 ## Validation
 
 Verify each project-owned capability through its observable interface and focused tests. Check

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/src/ms_tau_sdk/api/a2a.py

@@ -20,6 +20,7 @@ from fastapi.responses import JSONResponse, StreamingResponse
 from structlog.contextvars import bind_contextvars
 from tau_agent.types import JSONValue
 
+from ms_tau_sdk.backend.assertions import CallerAssertion
 from ms_tau_sdk.backend.client import MainSequenceClient
 from ms_tau_sdk.backend.models import (
     AgentTask,
@@ -62,6 +63,7 @@ from ms_tau_sdk.runtime.provenance import (
     TurnProvenance,
     turn_provenance_from_request,
 )
+from ms_tau_sdk.runtime.requester import Requester, canonical_requester_uid
 from ms_tau_sdk.runtime.task_context import (
     TaskExecutionContext,
     active_task_execution,
@@ -72,6 +74,7 @@ from ms_tau_sdk.settings import TauSDKSettings
 from .dependencies import backend, runtime_manager, settings
 from .request_identity import (
     SessionAccessDeniedError,
+    request_caller_assertion,
     require_session_access,
     sessions_the_caller_may_address,
     verified_user_uid,
@@ -740,11 +743,14 @@ async def _collect_turn(
     max_output_bytes: int,
     provenance: TurnProvenance,
     turn_uid: str | None = None,
+    caller_assertion: CallerAssertion | None = None,
 ) -> str:
     accumulator = _TurnAccumulator(max_output_bytes=max_output_bytes)
     prompt_options: dict[str, Any] = {"provenance": provenance}
     if turn_uid is not None:
         prompt_options["turn_uid"] = turn_uid
+    if caller_assertion is not None:
+        prompt_options["caller_assertion"] = caller_assertion
     async for event in manager.prompt(context_id, prompt, **prompt_options):
         accumulator.consume(event)
     context = active_task_execution()
@@ -772,6 +778,7 @@ async def _collect_validated_turn(
     max_output_bytes: int,
     provenance: TurnProvenance,
     turn_uid: str | None = None,
+    caller_assertion: CallerAssertion | None = None,
 ) -> str:
     text = await _collect_turn(
         manager,
@@ -780,6 +787,7 @@ async def _collect_validated_turn(
         max_output_bytes=max_output_bytes,
         provenance=provenance,
         turn_uid=turn_uid,
+        caller_assertion=caller_assertion,
     )
     if not contract.enabled:
         return text
@@ -809,6 +817,7 @@ async def _collect_validated_turn(
                 ),
                 max_output_bytes=max_output_bytes,
                 provenance=provenance,
+                caller_assertion=caller_assertion,
             )
     raise AssertionError("strict JSON repair loop did not terminate")
 
@@ -855,6 +864,7 @@ async def _create_backend_task(
     local_mode: bool,
     output_contract: StrictJsonContract | None = None,
     provenance: TurnProvenance | None = None,
+    caller_assertion: CallerAssertion | None = None,
 ) -> AgentTaskCreateResult:
     context_id = str(message["contextId"])
     initial_message = _task_message_for_backend(
@@ -883,10 +893,51 @@ async def _create_backend_task(
                     "provenance": dict(provenance or {}),
                 },
             },
-        }
+        },
+        **_presented_assertion(caller_assertion),
     )
 
 
+def _task_caller_assertion(
+    request: Request,
+    config: TauSDKSettings,
+) -> CallerAssertion | None:
+    """Return the request's verified caller assertion while it is valid, to present for a Task.
+
+    Presented beside the runtime's credential when the request creates or continues a Task, it
+    lets the platform record the request's person as the Task's requester. Local mode and the
+    platform's own calls have none.
+    """
+
+    caller_assertion = request_caller_assertion(request)
+    if config.local_mode or caller_assertion is None:
+        return None
+    return caller_assertion if caller_assertion.unexpired_token() else None
+
+
+def _presented_assertion(caller_assertion: CallerAssertion | None) -> dict[str, str]:
+    token = caller_assertion.unexpired_token() if caller_assertion is not None else None
+    return {"caller_assertion": token} if token else {}
+
+
+def _requester_named_by_task(
+    task: AgentTask,
+    caller_assertion: CallerAssertion | None,
+) -> Requester | None:
+    """Return the request's verified caller when the platform recorded that person as requester.
+
+    This is the requester of a Task attempt that the request itself runs: the platform's Task
+    answer must name the same User, as a person, as ``requester_user_uid``.
+    """
+
+    if caller_assertion is None:
+        return None
+    caller = caller_assertion.caller
+    if task.requester_identity_type != "human" or task.requester_user_uid != caller.uid:
+        return None
+    return Requester(uid=caller.uid, team_uids=caller.team_uids)
+
+
 async def _wait_for_task_return_state(
     client: MainSequenceClient,
     task: AgentTask,
@@ -1238,6 +1289,7 @@ async def _execute_task(
     config: TauSDKSettings | None = None,
     dispatch_uid: str | None = None,
     claim: _ClaimedTask | None = None,
+    requester: Requester | None = None,
 ) -> dict[str, Any]:
     bind_contextvars(
         a2a_task_id=task.task_id,
@@ -1270,6 +1322,7 @@ async def _execute_task(
         attempt_uid=claim.attempt_uid,
         holder_id=claim.holder_id,
         lease_token=claim.lease_token,
+        requester=requester,
     )
     try:
         await writer.ensure_not_canceled(force=True)
@@ -1355,6 +1408,7 @@ async def _schedule_task_accelerator(
     max_output_bytes: int,
     provenance: TurnProvenance,
     config: TauSDKSettings,
+    requester: Requester | None = None,
 ) -> bool:
     """Best-effort local start after durable creation; dispatch remains recovery owner."""
 
@@ -1386,6 +1440,7 @@ async def _schedule_task_accelerator(
         provenance=provenance,
         config=config,
         claim=claim,
+        requester=requester,
     )
     try:
         _background, scheduled = manager.create_a2a_task_execution(
@@ -1573,6 +1628,7 @@ async def _execute_message(
     output_contract: StrictJsonContract,
     max_output_bytes: int,
     provenance: TurnProvenance,
+    caller_assertion: CallerAssertion | None = None,
 ) -> dict[str, Any]:
     text = await _collect_validated_turn(
         manager,
@@ -1581,6 +1637,7 @@ async def _execute_message(
         output_contract,
         max_output_bytes=max_output_bytes,
         provenance=provenance,
+        caller_assertion=caller_assertion,
     )
     message = _agent_message(
         context_id=context_id,
@@ -1623,6 +1680,7 @@ async def _stream_task_events(
     provenance: TurnProvenance,
     config: TauSDKSettings | None = None,
     history_length: int = DEFAULT_TASK_HISTORY_LENGTH,
+    requester: Requester | None = None,
 ) -> AsyncIterator[dict[str, Any]]:
     claim = await _claim_backend_task(client, manager, task)
     resolved = config or manager.settings
@@ -1642,6 +1700,7 @@ async def _stream_task_events(
         attempt_uid=claim.attempt_uid,
         holder_id=claim.holder_id,
         lease_token=claim.lease_token,
+        requester=requester,
     )
     working = await client.get_task(task.uid)
     working = await _task_with_history(client, working, history_length=history_length)
@@ -1819,6 +1878,7 @@ def _message_stream_response(
     history_length: int = DEFAULT_TASK_HISTORY_LENGTH,
     json_rpc: bool = False,
     request_id: object = None,
+    requester: Requester | None = None,
 ) -> StreamingResponse:
     async def stream() -> AsyncIterator[bytes]:
         try:
@@ -1832,6 +1892,7 @@ def _message_stream_response(
                 provenance=provenance,
                 config=config,
                 history_length=history_length,
+                requester=requester,
             ):
                 yield _sse(
                     _stream_payload(
@@ -2088,6 +2149,21 @@ def _durable_task_execution_input(
     return prompt, contract, provenance
 
 
+def _dispatched_requester(body: dict[str, Any], config: TauSDKSettings) -> Requester | None:
+    """Return the Task's requester as the platform's verified dispatch names it.
+
+    Only a person is a requester: an Agent's workload User never is. A runtime that does not
+    verify the platform's assertion on its internal routes takes no requester from them.
+    """
+
+    if config.local_mode or config.request_identity_mode != "assertion":
+        return None
+    if body.get("requester_identity_type") != "human":
+        return None
+    uid = canonical_requester_uid(body.get("requester_user_uid"))
+    return Requester(uid=uid) if uid is not None else None
+
+
 @router.post("/internal/a2a/task-dispatch", status_code=200)
 async def task_dispatch_available(
     body: dict[str, Any],
@@ -2123,6 +2199,7 @@ async def task_dispatch_available(
             provenance=provenance,
             config=config,
             claim=claim,
+            requester=_dispatched_requester(body, config),
         ),
         name=f"a2a-task-{task.task_id}",
     )
@@ -2273,7 +2350,12 @@ async def message_send(
             task_id=existing_task.task_id,
             local_mode=config.local_mode,
         )
-        task = await client.continue_task(existing_task.uid, continued_message)
+        caller_assertion = _task_caller_assertion(request, config)
+        task = await client.continue_task(
+            existing_task.uid,
+            continued_message,
+            **_presented_assertion(caller_assertion),
+        )
         if config.local_mode:
             task = await _persist_local_recovery_contract(
                 client,
@@ -2290,6 +2372,7 @@ async def message_send(
             max_output_bytes=config.max_turn_output_bytes,
             provenance=provenance,
             config=config,
+            requester=_requester_named_by_task(task, caller_assertion),
         )
         if return_immediately:
             task = await _task_with_history(client, task, history_length=history_length)
@@ -2303,6 +2386,7 @@ async def message_send(
         task = await _task_with_history(client, task, history_length=history_length)
         return {"task": _task_payload(task, history_length=history_length)}
     if response_kind is ResponseKind.TASK:
+        caller_assertion = _task_caller_assertion(request, config)
         creation = await _create_backend_task(
             client,
             message=message,
@@ -2310,6 +2394,7 @@ async def message_send(
             local_mode=config.local_mode,
             output_contract=output_contract,
             provenance=provenance,
+            caller_assertion=caller_assertion,
         )
         task = creation.task
         if creation.created:
@@ -2322,6 +2407,7 @@ async def message_send(
                 max_output_bytes=config.max_turn_output_bytes,
                 provenance=provenance,
                 config=config,
+                requester=_requester_named_by_task(task, caller_assertion),
             )
             if return_immediately:
                 task = await _task_with_history(client, task, history_length=history_length)
@@ -2371,6 +2457,7 @@ async def message_send(
         output_contract=output_contract,
         max_output_bytes=config.max_turn_output_bytes,
         provenance=provenance,
+        caller_assertion=request_caller_assertion(request),
     )
     if config.local_mode:
         result = await client.complete_local_conversation_message(
@@ -2418,6 +2505,7 @@ async def message_stream(
     output_contract = _output_contract(body)
     if config.local_mode:
         await manager.get(str(message["contextId"]))
+    caller_assertion = _task_caller_assertion(request, config)
     creation = await _create_backend_task(
         client,
         message=message,
@@ -2425,6 +2513,7 @@ async def message_stream(
         local_mode=config.local_mode,
         output_contract=output_contract,
         provenance=provenance,
+        caller_assertion=caller_assertion,
     )
     task = creation.task
     if not creation.created:
@@ -2458,6 +2547,7 @@ async def message_stream(
         provenance=provenance,
         config=config,
         history_length=history_length,
+        requester=_requester_named_by_task(task, caller_assertion),
     )
 
 
@@ -2662,6 +2752,7 @@ async def json_rpc(
             output_contract = _output_contract(params)
             if config.local_mode:
                 await manager.get(str(message["contextId"]))
+            caller_assertion = _task_caller_assertion(request, config)
             creation = await _create_backend_task(
                 client,
                 message=message,
@@ -2669,6 +2760,7 @@ async def json_rpc(
                 local_mode=config.local_mode,
                 output_contract=output_contract,
                 provenance=provenance,
+                caller_assertion=caller_assertion,
             )
             task = creation.task
             if not creation.created:
@@ -2707,6 +2799,7 @@ async def json_rpc(
                 history_length=history_length,
                 json_rpc=True,
                 request_id=request_id,
+                requester=_requester_named_by_task(task, caller_assertion),
             )
         elif method in {"GetTask", "tasks/get"}:
             result = await get_task(

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/src/ms_tau_sdk/api/chat.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import asyncio
 from collections.abc import AsyncIterator
-from typing import Annotated
+from typing import Annotated, Any
 
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, Request
@@ -22,7 +22,11 @@ from ms_tau_sdk.runtime.provenance import (
 
 from .dependencies import runtime_manager
 from .models import ChatRequest
-from .request_identity import require_session_access, verified_user_uid
+from .request_identity import (
+    request_caller_assertion,
+    require_session_access,
+    verified_user_uid,
+)
 
 router = APIRouter(prefix="/api")
 RuntimeManagerDep = Annotated[SessionRuntimeManager, Depends(runtime_manager)]
@@ -110,10 +114,16 @@ async def chat(
         if manager.settings.local_mode
         else None
     )
+    # A hosted turn presents its request's verified caller assertion when it starts, so that the
+    # platform can record who asked for it.
+    caller_assertion = None if local_turn is not None else request_caller_assertion(request)
+    turn_options: dict[str, Any] = {"provenance": provenance}
+    if caller_assertion is not None:
+        turn_options["caller_assertion"] = caller_assertion
     events = (
         local_turn.events()
         if local_turn is not None
-        else manager.prompt(session_uid, prompt, provenance=provenance)
+        else manager.prompt(session_uid, prompt, **turn_options)
     )
 
     async def stream() -> AsyncIterator[bytes]:

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev36}/src/ms_tau_sdk/api/request_identity.py

@@ -11,6 +11,9 @@ other route. Handlers read the verified caller with ``current_caller()``, or fro
 A request that addresses an existing session must also come from the session's owner or from an
 Organization admin; see ``require_session_access()``. Outside hosted mode nothing here changes how
 requests are handled.
+
+The raw caller assertion stays private to the request: ``request_caller_assertion()`` hands it
+only to the turn that request starts, which presents it when it marks the turn active.
 """
 
 from __future__ import annotations
@@ -19,7 +22,7 @@ from collections.abc import Iterable
 from contextvars import ContextVar
 
 import structlog
-from fastapi import FastAPI, HTTPException
+from fastapi import FastAPI, HTTPException, Request
 from starlette.responses import JSONResponse
 from starlette.types import ASGIApp, Receive, Scope, Send
 from starlette.websockets import WebSocketClose
@@ -29,6 +32,7 @@ from ms_tau_sdk.backend.assertions import (
     AssertionKeysUnavailableError,
     AssertionKind,
     AssertionVerifier,
+    CallerAssertion,
     InvalidAssertionError,
     VerifiedCaller,
 )
@@ -59,6 +63,9 @@ _current_caller: ContextVar[VerifiedCaller | None] = ContextVar(
     "ms_tau_sdk_verified_caller",
     default=None,
 )
+# The verified raw caller assertion is kept in the request's own scope, not in request.state and
+# not in a context variable, so that only the code that starts the request's turn reads it.
+_CALLER_ASSERTION_SCOPE_KEY = "ms_tau_sdk.caller_assertion"
 
 
 class SessionAccessDeniedError(HTTPException):
@@ -77,6 +84,18 @@ def current_caller() -> VerifiedCaller | None:
     return _current_caller.get()
 
 
+def request_caller_assertion(request: Request) -> CallerAssertion | None:
+    """Return the verified caller assertion of ``request`` for the turn it starts.
+
+    It is None outside hosted mode and on the platform's own calls. Only the chat and A2A Message
+    routes read it, to present it when they mark their turn active; it is never logged, persisted,
+    or passed to the model, a tool, a stream, or history.
+    """
+
+    value = request.scope.get(_CALLER_ASSERTION_SCOPE_KEY)
+    return value if isinstance(value, CallerAssertion) else None
+
+
 def verified_user_uid(settings: TauSDKSettings) -> str | None:
     """Return the verified caller's User UID in hosted mode, and None otherwise.
 
@@ -196,7 +215,8 @@ class RequestIdentityMiddleware:
             return
         kind = required_assertion(scope)
         try:
-            verified = await self.verifier.verify(_assertion(scope), kind=kind)
+            token = _assertion(scope)
+            verified = await self.verifier.verify(token, kind=kind)
         except AssertionKeysUnavailableError as error:
             await self._deny(scope, receive, send, kind=kind, status_code=503, reason=str(error))
             return
@@ -213,11 +233,18 @@ class RequestIdentityMiddleware:
             organization_environment_uid=self.verifier.organization_environment_uid,
         )
         bind_request_identity_log_fields(scope, user_uid=user_uid, auth_outcome="authenticated")
-        token = _current_caller.set(caller)
+        if caller is not None:
+            scope[_CALLER_ASSERTION_SCOPE_KEY] = CallerAssertion(
+                caller=caller,
+                expires_at=verified.expires_at,
+                token=token,
+            )
+        caller_token = _current_caller.set(caller)
         try:
             await self.app(scope, receive, send)
         finally:
-            _current_caller.reset(token)
+            _current_caller.reset(caller_token)
+            scope.pop(_CALLER_ASSERTION_SCOPE_KEY, None)
 
     async def _deny(
         self,
@@ -277,6 +304,7 @@ __all__ = [
     "SessionAccessDeniedError",
     "current_caller",
     "install_request_identity",
+    "request_caller_assertion",
     "require_session_access",
     "required_assertion",
     "sessions_the_caller_may_address",