ms-tau-sdk 2.0.3.dev35__tar.gz → 2.0.3.dev37__tar.gz

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/CHANGELOG.md

@@ -11,6 +11,59 @@
   and its result are unchanged. Direct-runtime clients that call the operation themselves are
   unaffected. See the 2026-10-06 amendment of ADR 0002
   ([issue #65](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/65)).
+- Extension tools can read with the access of the person a turn serves, its requester, when an
+  Organization admin enabled the Agent for it. When a hosted runtime starts a chat or A2A Message
+  turn, it sends the verified caller assertion of the request in `X-MainSequence-Caller-Assertion`
+  with the `PATCH /api/v1/agent-sessions/<uid>/tau-runtime-activity/` transition that marks the
+  turn active. The platform answers with `requester_user_uid`, the person it recorded as the turn's
+  requester, or null. A hosted request that creates a Task (`POST /api/v1/agent-tasks/`) or
+  continues one (`POST /api/v1/agent-tasks/<uid>/continue/`) sends the same header with that call,
+  so that the platform records the Task's requester. A Task attempt that the request runs itself
+  serves the request's verified caller when the platform's Task answer names that User as
+  `requester_user_uid` with `requester_identity_type` `human`; a Task attempt started by the
+  platform's dispatch takes its requester from the dispatch's same two facts. Two new public
+  functions:
+  - `current_requester()` returns that person inside the turn (`uid`, `team_uids`), or `None` for
+    Agent callers, the platform's own calls, local mode, a runtime that is not hosted, and code
+    outside a turn;
+  - `requester_client()` returns a client bound to the turn. `request(method, path, ...)` calls a
+    platform API path with the runtime's credential and `X-MainSequence-Acting-For-Session`,
+    `X-MainSequence-Lease-Holder` and `X-MainSequence-Lease-Token`, sent only to the platform base
+    URL. `call_release(release_uid, method, path, ...)` obtains access through
+    `resolve-runtime-access` and calls the application with only its bearer token, kept for the
+    turn while it is valid. A 403 whose `code` is `requester_binding_invalid` or starts with
+    `runtime_lease_` raises a `PermissionError` with that code, and without a requester
+    `requester_client()` raises one at once.
+
+  The assertion stays in its request's scope and goes only to the turn start, Task creation or Task
+  continuation of that request. It is not sent once expired, never by the turn start of a Task
+  attempt, never on the platform's own calls, and never in local mode. The assertion, the lease
+  proof, the runtime credential and application tokens never reach a log line, a persisted entry,
+  model context, a tool result, the UI stream or history, and the binding ends with the turn. The
+  `tau-project-customization` skill teaches tools to use both functions, to return only business
+  results, and states what people are told about this access. Upgrade note: nothing changes for
+  an Agent that does not use them. Requester-bound calls need a platform that records turn and Task
+  requesters; until it does, `current_requester()` returns `None`. See the 2026-10-06 amendment of
+  ADR 0019 ([issue #66](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/66)).
+- `MainSequenceClient.list_model_providers(organization_environment_uid=...)` reads the
+  model-provider catalog of that Organization Environment. It raised `TypeError` instead, so
+  local-mode chat could not list the providers of a configured Environment through
+  `GET /api/chat/model-providers`. The Environment is now sent as the `organization_environment_uid`
+  query parameter, as the other list calls send theirs; the call without an Environment is
+  unchanged ([issue #68](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/68)).
+- A hosted runtime admits the Agent that delegated to a child session. When Agent A delegates to
+  Agent B through `a2a.send_message`, the platform creates B's child session for the person who
+  owns A's session, and A addresses it with its own credential, so the caller assertion names A's
+  workload User. B's runtime refused every such request with 403. It now also admits that caller
+  when the session's `parent_session_agent_uid` names an Agent and the platform's directory
+  (`GET /api/v1/users/<uid>/`, read with the runtime credential) shows the caller as a workload
+  User whose `agent_uid` is that Agent: Message send and stream, JSON-RPC, and Task continuation,
+  reads, list and cancel. The `X-Caller-*` headers never admit a caller. A session without a
+  parent, another Agent's workload, and a person who is not the owner still get 403, and a lookup
+  that fails refuses the request. One request looks a User up at most once, and nothing is kept
+  after it. The admitted Agent is never a requester: `current_requester()` stays `None` in its
+  turns and in the Task attempts its requests run. See the 2026-10-06 amendment of ADR 0019
+  ([issue #67](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/67)).
 
 ## 2.0.2 — 2026-10-06
 

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.3.dev35
+Version: 2.0.3.dev37
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs
@@ -126,12 +126,18 @@ app = create_app()
 
 When Main Sequence hosts the runtime, `create_app()` admits a request only with the platform's
 signed assertion in `X-MainSequence-Caller-Assertion`, never on gateway identity headers, and lets
-only a session's owner or an Organization admin address that session. It declares this request
+only a session's owner, an Organization admin, or the Agent that delegated to it address that
+session. It declares this request
 identity to the platform launcher in `app.state.mainsequence_request_identity`; the launcher serves
 only an application that declares it, so serve the application `create_app()` returns. Outside
 hosting, requests are handled as before. See
 [request identity](docs/reference/runtime-contract.md#request-identity).
 
+An Agent that an Organization admin enabled for it can read with the access of the person whose
+request a turn is serving. Project tools read that person with `current_requester()` and call the
+platform or another platform application for them with `requester_client()`; neither exposes a
+proof or a token. See the [public API](docs/reference/public-api.md#current_requester-and-requester_client).
+
 Job-hosted batch execution is an [accepted design](docs/adrs/0015-job-hosted-batch-execution.md)
 with implementation pending. It will run this SDK's configured Tau composition for one assignment
 inside a project Job, close it, and exit without starting Uvicorn. The Job continues to own its

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/README.md

@@ -93,12 +93,18 @@ app = create_app()
 
 When Main Sequence hosts the runtime, `create_app()` admits a request only with the platform's
 signed assertion in `X-MainSequence-Caller-Assertion`, never on gateway identity headers, and lets
-only a session's owner or an Organization admin address that session. It declares this request
+only a session's owner, an Organization admin, or the Agent that delegated to it address that
+session. It declares this request
 identity to the platform launcher in `app.state.mainsequence_request_identity`; the launcher serves
 only an application that declares it, so serve the application `create_app()` returns. Outside
 hosting, requests are handled as before. See
 [request identity](docs/reference/runtime-contract.md#request-identity).
 
+An Agent that an Organization admin enabled for it can read with the access of the person whose
+request a turn is serving. Project tools read that person with `current_requester()` and call the
+platform or another platform application for them with `requester_client()`; neither exposes a
+proof or a token. See the [public API](docs/reference/public-api.md#current_requester-and-requester_client).
+
 Job-hosted batch execution is an [accepted design](docs/adrs/0015-job-hosted-batch-execution.md)
 with implementation pending. It will run this SDK's configured Tau composition for one assignment
 inside a project Job, close it, and exit without starting Uvicorn. The Job continues to own its

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.3.dev35"
+version = "2.0.3.dev37"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/src/ms_tau_sdk/__init__.py

@@ -9,6 +9,7 @@ from .runtime.deployment_health import (
     RUNTIME_HEALTH_ABI_VERSION,
     register_deployment_readiness_hook,
 )
+from .runtime.requester import current_requester, requester_client
 from .settings import TauSDKSettings
 
 __all__ = [
@@ -16,5 +17,7 @@ __all__ = [
     "TauSDKSettings",
     "__version__",
     "create_app",
+    "current_requester",
     "register_deployment_readiness_hook",
+    "requester_client",
 ]

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/src/ms_tau_sdk/agent_skills/tau_a2a_runtime_adapter/SKILL.md

@@ -26,8 +26,13 @@ The SDK owns:
 - privately attaching active caller-session proof when a tool advertises
   `mainsequence.ai/requires-caller-session-proof/v1: true`;
 - verifying the platform's signed caller or platform assertion on every inbound request of a
-  hosted runtime, and admitting a request to a session or its Tasks only for the session's owner
-  or an Organization admin;
+  hosted runtime, and admitting a request to a session or its Tasks only for the session's owner,
+  an Organization admin, or the workload User of the Agent that delegated to that child session,
+  which the platform's own records establish, never the `X-Caller-*` headers;
+- presenting the verified caller assertion of the request that starts a chat or A2A Message turn
+  only when it marks that turn active, so that the platform can record the turn's requester, and
+  giving extension tools that requester and requester-bound calls through `current_requester()`
+  and `requester_client()` without exposing the assertion, the lease proof, or any token;
 - translating inbound A2A requests into the shared TAU runtime; and
 - translating runtime events and results into validated A2A responses.
 

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -87,7 +87,7 @@ Extensions may change effective agent capabilities, but they must not replace or
 
 - Main Sequence runtime or user authentication;
 - provider-control evidence and credential hydration;
-- caller identity and active-session proof;
+- caller identity, the turn's requester, and active-session proof;
 - persistence ordering, leases, cancellation, or task settlement;
 - secret redaction and payload limits; or
 - HTTP, SSE, Responses, and A2A wire validation.
@@ -95,6 +95,77 @@ Extensions may change effective agent capabilities, but they must not replace or
 When Main Sequence MCP is enabled, use its canonical operations for live platform state. Project
 tools do not grant new platform permissions merely because they run inside TAU.
 
+## Acting for the person a turn serves
+
+An Agent that an Organization admin enabled for it can read platform data, and ask other platform
+applications, with the access of the person whose request a turn is serving: the requester. The
+platform keeps that authority and finds the person in its own records; the runtime only proves
+which of its sessions it is working on. Extension tools use two SDK functions and nothing else:
+
+```python
+import json
+
+from tau_agent.messages import TextContent
+from tau_agent.tools import AgentToolResult
+
+from ms_tau_sdk import current_requester, requester_client
+
+ANALYST_DATA_RELEASE_UID = "..."  # the release of the application to ask
+
+
+async def revenue_by_region(tool_call_id, arguments, signal=None, on_update=None):
+    if current_requester() is None:
+        return AgentToolResult(content=[TextContent(text="Ask me from your own conversation.")])
+    try:
+        answer = await requester_client().call_release(
+            ANALYST_DATA_RELEASE_UID,
+            "POST",
+            "/query",
+            json={"question": "revenue by region"},
+        )
+    except PermissionError:
+        return AgentToolResult(content=[TextContent(text="Your access for this request ended.")])
+    return AgentToolResult(content=[TextContent(text=json.dumps(answer.json()["rows"]))])
+```
+
+- `current_requester()` returns the turn's verified requester, with `uid` and `team_uids`, or
+  `None`. It is `None` for Agent callers, the platform's own calls, local mode, and code outside a
+  turn. Only it names the requester:
+  never take a person's UID from tool arguments, the prompt, history, or a header.
+- `requester_client()` returns a client bound to the turn. `await client.request("GET",
+  "/api/v1/...")` reads a platform API path for the requester. `await client.call_release(
+  release_uid, method, path, ...)` asks another platform application, which answers as the
+  requester. Both return an `httpx.Response`.
+- Without a requester, `requester_client()` raises a `PermissionError`. So does a call that the
+  platform refuses because the requester's access ended (`code` `requester_binding_invalid` or
+  `runtime_lease_*`): the turn is over, the access was removed, more than 24 hours passed, or the
+  Agent is not enabled. Catch it, say in plain words that the request cannot be served, and never
+  fall back to the Agent's own access.
+
+Rules for tools that act for the requester:
+
+- Never handle proofs or tokens. The SDK attaches the session, the lease proof, and the
+  credentials itself. A tool never reads, logs, stores, or forwards them, passes a path rather than
+  a URL, and never sets `Authorization` or an `X-MainSequence-*` header.
+- Requester-bound calls are read-only. The platform refuses writes, sharing, and Secret values;
+  do not build tools that try them.
+- Return to the model only business results, such as rows, numbers, and names. Never return the
+  response object, its headers, a token, a proof, or a raw error body.
+- Keep nothing for another turn or another person. The binding ends with the turn, and a task the
+  tool leaves running has no access afterwards.
+- What a tool reads for a person belongs to that person's conversation. Do not write it to shared
+  stores, other Agents, or external systems.
+
+People who use such an Agent are told:
+
+> **This Agent works with your identity, securely.** It reads only what you can already read, only
+> to answer your own requests, and for at most 24 hours after you ask. It cannot act as anyone else,
+> cannot change, share or delete anything, never sees your secret values, and stops the moment your
+> access ends. Your Organization's administrator approved it to work this way.
+
+The limit is plain: while it works on your request, the Agent's code can read what you can read,
+which is why only administrators decide which Agents may work this way.
+
 ## Validation
 
 Verify each project-owned capability through its observable interface and focused tests. Check

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/src/ms_tau_sdk/agent_skills/tau_repository_integration/SKILL.md

@@ -46,9 +46,9 @@ TAU image, overlay, or SDK-owned deployment.
 
 `create_app()` installs the runtime's request identity. When Main Sequence hosts the runtime, the
 application admits only requests that carry the platform's signed assertion, lets only a session's
-owner or an Organization admin address that session, and declares all this in
-`app.state.mainsequence_request_identity`. The platform launcher serves an application only with
-that declaration, read from the object it serves. Therefore:
+owner, an Organization admin, or the Agent that delegated to it address that session, and declares
+all this in `app.state.mainsequence_request_identity`. The platform launcher serves an application
+only with that declaration, read from the object it serves. Therefore:
 
 - export the object `create_app()` returns as the module's `app`. An application that mounts it
   inside another one declares nothing, and the launcher refuses it;

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/src/ms_tau_sdk/api/a2a.py

@@ -20,6 +20,7 @@ from fastapi.responses import JSONResponse, StreamingResponse
 from structlog.contextvars import bind_contextvars
 from tau_agent.types import JSONValue
 
+from ms_tau_sdk.backend.assertions import CallerAssertion
 from ms_tau_sdk.backend.client import MainSequenceClient
 from ms_tau_sdk.backend.models import (
     AgentTask,
@@ -62,6 +63,7 @@ from ms_tau_sdk.runtime.provenance import (
     TurnProvenance,
     turn_provenance_from_request,
 )
+from ms_tau_sdk.runtime.requester import Requester, canonical_requester_uid
 from ms_tau_sdk.runtime.task_context import (
     TaskExecutionContext,
     active_task_execution,
@@ -72,6 +74,7 @@ from ms_tau_sdk.settings import TauSDKSettings
 from .dependencies import backend, runtime_manager, settings
 from .request_identity import (
     SessionAccessDeniedError,
+    request_caller_assertion,
     require_session_access,
     sessions_the_caller_may_address,
     verified_user_uid,
@@ -740,11 +743,14 @@ async def _collect_turn(
     max_output_bytes: int,
     provenance: TurnProvenance,
     turn_uid: str | None = None,
+    caller_assertion: CallerAssertion | None = None,
 ) -> str:
     accumulator = _TurnAccumulator(max_output_bytes=max_output_bytes)
     prompt_options: dict[str, Any] = {"provenance": provenance}
     if turn_uid is not None:
         prompt_options["turn_uid"] = turn_uid
+    if caller_assertion is not None:
+        prompt_options["caller_assertion"] = caller_assertion
     async for event in manager.prompt(context_id, prompt, **prompt_options):
         accumulator.consume(event)
     context = active_task_execution()
@@ -772,6 +778,7 @@ async def _collect_validated_turn(
     max_output_bytes: int,
     provenance: TurnProvenance,
     turn_uid: str | None = None,
+    caller_assertion: CallerAssertion | None = None,
 ) -> str:
     text = await _collect_turn(
         manager,
@@ -780,6 +787,7 @@ async def _collect_validated_turn(
         max_output_bytes=max_output_bytes,
         provenance=provenance,
         turn_uid=turn_uid,
+        caller_assertion=caller_assertion,
     )
     if not contract.enabled:
         return text
@@ -809,6 +817,7 @@ async def _collect_validated_turn(
                 ),
                 max_output_bytes=max_output_bytes,
                 provenance=provenance,
+                caller_assertion=caller_assertion,
             )
     raise AssertionError("strict JSON repair loop did not terminate")
 
@@ -855,6 +864,7 @@ async def _create_backend_task(
     local_mode: bool,
     output_contract: StrictJsonContract | None = None,
     provenance: TurnProvenance | None = None,
+    caller_assertion: CallerAssertion | None = None,
 ) -> AgentTaskCreateResult:
     context_id = str(message["contextId"])
     initial_message = _task_message_for_backend(
@@ -883,10 +893,51 @@ async def _create_backend_task(
                     "provenance": dict(provenance or {}),
                 },
             },
-        }
+        },
+        **_presented_assertion(caller_assertion),
     )
 
 
+def _task_caller_assertion(
+    request: Request,
+    config: TauSDKSettings,
+) -> CallerAssertion | None:
+    """Return the request's verified caller assertion while it is valid, to present for a Task.
+
+    Presented beside the runtime's credential when the request creates or continues a Task, it
+    lets the platform record the request's person as the Task's requester. Local mode and the
+    platform's own calls have none.
+    """
+
+    caller_assertion = request_caller_assertion(request)
+    if config.local_mode or caller_assertion is None:
+        return None
+    return caller_assertion if caller_assertion.unexpired_token() else None
+
+
+def _presented_assertion(caller_assertion: CallerAssertion | None) -> dict[str, str]:
+    token = caller_assertion.unexpired_token() if caller_assertion is not None else None
+    return {"caller_assertion": token} if token else {}
+
+
+def _requester_named_by_task(
+    task: AgentTask,
+    caller_assertion: CallerAssertion | None,
+) -> Requester | None:
+    """Return the request's verified caller when the platform recorded that person as requester.
+
+    This is the requester of a Task attempt that the request itself runs: the platform's Task
+    answer must name the same User, as a person, as ``requester_user_uid``.
+    """
+
+    if caller_assertion is None or caller_assertion.caller_is_workload:
+        return None
+    caller = caller_assertion.caller
+    if task.requester_identity_type != "human" or task.requester_user_uid != caller.uid:
+        return None
+    return Requester(uid=caller.uid, team_uids=caller.team_uids)
+
+
 async def _wait_for_task_return_state(
     client: MainSequenceClient,
     task: AgentTask,
@@ -1238,6 +1289,7 @@ async def _execute_task(
     config: TauSDKSettings | None = None,
     dispatch_uid: str | None = None,
     claim: _ClaimedTask | None = None,
+    requester: Requester | None = None,
 ) -> dict[str, Any]:
     bind_contextvars(
         a2a_task_id=task.task_id,
@@ -1270,6 +1322,7 @@ async def _execute_task(
         attempt_uid=claim.attempt_uid,
         holder_id=claim.holder_id,
         lease_token=claim.lease_token,
+        requester=requester,
     )
     try:
         await writer.ensure_not_canceled(force=True)
@@ -1355,6 +1408,7 @@ async def _schedule_task_accelerator(
     max_output_bytes: int,
     provenance: TurnProvenance,
     config: TauSDKSettings,
+    requester: Requester | None = None,
 ) -> bool:
     """Best-effort local start after durable creation; dispatch remains recovery owner."""
 
@@ -1386,6 +1440,7 @@ async def _schedule_task_accelerator(
         provenance=provenance,
         config=config,
         claim=claim,
+        requester=requester,
     )
     try:
         _background, scheduled = manager.create_a2a_task_execution(
@@ -1573,6 +1628,7 @@ async def _execute_message(
     output_contract: StrictJsonContract,
     max_output_bytes: int,
     provenance: TurnProvenance,
+    caller_assertion: CallerAssertion | None = None,
 ) -> dict[str, Any]:
     text = await _collect_validated_turn(
         manager,
@@ -1581,6 +1637,7 @@ async def _execute_message(
         output_contract,
         max_output_bytes=max_output_bytes,
         provenance=provenance,
+        caller_assertion=caller_assertion,
     )
     message = _agent_message(
         context_id=context_id,
@@ -1623,6 +1680,7 @@ async def _stream_task_events(
     provenance: TurnProvenance,
     config: TauSDKSettings | None = None,
     history_length: int = DEFAULT_TASK_HISTORY_LENGTH,
+    requester: Requester | None = None,
 ) -> AsyncIterator[dict[str, Any]]:
     claim = await _claim_backend_task(client, manager, task)
     resolved = config or manager.settings
@@ -1642,6 +1700,7 @@ async def _stream_task_events(
         attempt_uid=claim.attempt_uid,
         holder_id=claim.holder_id,
         lease_token=claim.lease_token,
+        requester=requester,
     )
     working = await client.get_task(task.uid)
     working = await _task_with_history(client, working, history_length=history_length)
@@ -1819,6 +1878,7 @@ def _message_stream_response(
     history_length: int = DEFAULT_TASK_HISTORY_LENGTH,
     json_rpc: bool = False,
     request_id: object = None,
+    requester: Requester | None = None,
 ) -> StreamingResponse:
     async def stream() -> AsyncIterator[bytes]:
         try:
@@ -1832,6 +1892,7 @@ def _message_stream_response(
                 provenance=provenance,
                 config=config,
                 history_length=history_length,
+                requester=requester,
             ):
                 yield _sse(
                     _stream_payload(
@@ -2088,6 +2149,21 @@ def _durable_task_execution_input(
     return prompt, contract, provenance
 
 
+def _dispatched_requester(body: dict[str, Any], config: TauSDKSettings) -> Requester | None:
+    """Return the Task's requester as the platform's verified dispatch names it.
+
+    Only a person is a requester: an Agent's workload User never is. A runtime that does not
+    verify the platform's assertion on its internal routes takes no requester from them.
+    """
+
+    if config.local_mode or config.request_identity_mode != "assertion":
+        return None
+    if body.get("requester_identity_type") != "human":
+        return None
+    uid = canonical_requester_uid(body.get("requester_user_uid"))
+    return Requester(uid=uid) if uid is not None else None
+
+
 @router.post("/internal/a2a/task-dispatch", status_code=200)
 async def task_dispatch_available(
     body: dict[str, Any],
@@ -2123,6 +2199,7 @@ async def task_dispatch_available(
             provenance=provenance,
             config=config,
             claim=claim,
+            requester=_dispatched_requester(body, config),
         ),
         name=f"a2a-task-{task.task_id}",
     )
@@ -2273,7 +2350,12 @@ async def message_send(
             task_id=existing_task.task_id,
             local_mode=config.local_mode,
         )
-        task = await client.continue_task(existing_task.uid, continued_message)
+        caller_assertion = _task_caller_assertion(request, config)
+        task = await client.continue_task(
+            existing_task.uid,
+            continued_message,
+            **_presented_assertion(caller_assertion),
+        )
         if config.local_mode:
             task = await _persist_local_recovery_contract(
                 client,
@@ -2290,6 +2372,7 @@ async def message_send(
             max_output_bytes=config.max_turn_output_bytes,
             provenance=provenance,
             config=config,
+            requester=_requester_named_by_task(task, caller_assertion),
         )
         if return_immediately:
             task = await _task_with_history(client, task, history_length=history_length)
@@ -2303,6 +2386,7 @@ async def message_send(
         task = await _task_with_history(client, task, history_length=history_length)
         return {"task": _task_payload(task, history_length=history_length)}
     if response_kind is ResponseKind.TASK:
+        caller_assertion = _task_caller_assertion(request, config)
         creation = await _create_backend_task(
             client,
             message=message,
@@ -2310,6 +2394,7 @@ async def message_send(
             local_mode=config.local_mode,
             output_contract=output_contract,
             provenance=provenance,
+            caller_assertion=caller_assertion,
         )
         task = creation.task
         if creation.created:
@@ -2322,6 +2407,7 @@ async def message_send(
                 max_output_bytes=config.max_turn_output_bytes,
                 provenance=provenance,
                 config=config,
+                requester=_requester_named_by_task(task, caller_assertion),
             )
             if return_immediately:
                 task = await _task_with_history(client, task, history_length=history_length)
@@ -2371,6 +2457,7 @@ async def message_send(
         output_contract=output_contract,
         max_output_bytes=config.max_turn_output_bytes,
         provenance=provenance,
+        caller_assertion=request_caller_assertion(request),
     )
     if config.local_mode:
         result = await client.complete_local_conversation_message(
@@ -2418,6 +2505,7 @@ async def message_stream(
     output_contract = _output_contract(body)
     if config.local_mode:
         await manager.get(str(message["contextId"]))
+    caller_assertion = _task_caller_assertion(request, config)
     creation = await _create_backend_task(
         client,
         message=message,
@@ -2425,6 +2513,7 @@ async def message_stream(
         local_mode=config.local_mode,
         output_contract=output_contract,
         provenance=provenance,
+        caller_assertion=caller_assertion,
     )
     task = creation.task
     if not creation.created:
@@ -2458,6 +2547,7 @@ async def message_stream(
         provenance=provenance,
         config=config,
         history_length=history_length,
+        requester=_requester_named_by_task(task, caller_assertion),
     )
 
 
@@ -2662,6 +2752,7 @@ async def json_rpc(
             output_contract = _output_contract(params)
             if config.local_mode:
                 await manager.get(str(message["contextId"]))
+            caller_assertion = _task_caller_assertion(request, config)
             creation = await _create_backend_task(
                 client,
                 message=message,
@@ -2669,6 +2760,7 @@ async def json_rpc(
                 local_mode=config.local_mode,
                 output_contract=output_contract,
                 provenance=provenance,
+                caller_assertion=caller_assertion,
             )
             task = creation.task
             if not creation.created:
@@ -2707,6 +2799,7 @@ async def json_rpc(
                 history_length=history_length,
                 json_rpc=True,
                 request_id=request_id,
+                requester=_requester_named_by_task(task, caller_assertion),
             )
         elif method in {"GetTask", "tasks/get"}:
             result = await get_task(

{ms_tau_sdk-2.0.3.dev35 → ms_tau_sdk-2.0.3.dev37}/src/ms_tau_sdk/api/chat.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import asyncio
 from collections.abc import AsyncIterator
-from typing import Annotated
+from typing import Annotated, Any
 
 import structlog
 from fastapi import APIRouter, Depends, HTTPException, Request
@@ -22,7 +22,11 @@ from ms_tau_sdk.runtime.provenance import (
 
 from .dependencies import runtime_manager
 from .models import ChatRequest
-from .request_identity import require_session_access, verified_user_uid
+from .request_identity import (
+    request_caller_assertion,
+    require_session_access,
+    verified_user_uid,
+)
 
 router = APIRouter(prefix="/api")
 RuntimeManagerDep = Annotated[SessionRuntimeManager, Depends(runtime_manager)]
@@ -110,10 +114,16 @@ async def chat(
         if manager.settings.local_mode
         else None
     )
+    # A hosted turn presents its request's verified caller assertion when it starts, so that the
+    # platform can record who asked for it.
+    caller_assertion = None if local_turn is not None else request_caller_assertion(request)
+    turn_options: dict[str, Any] = {"provenance": provenance}
+    if caller_assertion is not None:
+        turn_options["caller_assertion"] = caller_assertion
     events = (
         local_turn.events()
         if local_turn is not None
-        else manager.prompt(session_uid, prompt, provenance=provenance)
+        else manager.prompt(session_uid, prompt, **turn_options)
     )
 
     async def stream() -> AsyncIterator[bytes]: