ms-tau-sdk 2.0.3.dev36__tar.gz → 2.0.3.dev38__tar.gz

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+- A turn that a caller delivery resumes serves the person who asked for the delegated work. When
+  `POST /internal/a2a/task-caller-delivery` resumes a hosted session, the turn presents no
+  assertion. It names the delivery in `caller_delivery_uid` on the
+  `PATCH /api/v1/agent-sessions/<uid>/tau-runtime-activity/` transition that marks it active, and
+  the platform answers with the requester it recorded for the turn: the person who asked for the
+  turn that delegated with `resume_caller`. `current_requester()` returns that person, with empty
+  `team_uids`, and `requester_client()` reads for them, only when the delivery signal names the
+  same User with `requester_identity_type` `human`. Local mode and a runtime that is not hosted
+  name no delivery.
 - Main Sequence MCP no longer offers `agent_session.resolve_runtime_access` to the model. Its
   result carries a short-lived runtime token for direct-runtime clients, and Tau's generic MCP
   projection copied that token into model-visible tool content and into tool details, which reach
@@ -24,7 +33,7 @@
   platform's dispatch takes its requester from the dispatch's same two facts. Two new public
   functions:
   - `current_requester()` returns that person inside the turn (`uid`, `team_uids`), or `None` for
-    Agent callers, the platform's own calls, local mode, a runtime that is not hosted, and code
+    Agent callers, the platform's other calls, local mode, a runtime that is not hosted, and code
     outside a turn;
   - `requester_client()` returns a client bound to the turn. `request(method, path, ...)` calls a
     platform API path with the runtime's credential and `X-MainSequence-Acting-For-Session`,
@@ -51,6 +60,19 @@
   `GET /api/chat/model-providers`. The Environment is now sent as the `organization_environment_uid`
   query parameter, as the other list calls send theirs; the call without an Environment is
   unchanged ([issue #68](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/68)).
+- A hosted runtime admits the Agent that delegated to a child session. When Agent A delegates to
+  Agent B through `a2a.send_message`, the platform creates B's child session for the person who
+  owns A's session, and A addresses it with its own credential, so the caller assertion names A's
+  workload User. B's runtime refused every such request with 403. It now also admits that caller
+  when the session's `parent_session_agent_uid` names an Agent and the platform's directory
+  (`GET /api/v1/users/<uid>/`, read with the runtime credential) shows the caller as a workload
+  User whose `agent_uid` is that Agent: Message send and stream, JSON-RPC, and Task continuation,
+  reads, list and cancel. The `X-Caller-*` headers never admit a caller. A session without a
+  parent, another Agent's workload, and a person who is not the owner still get 403, and a lookup
+  that fails refuses the request. One request looks a User up at most once, and nothing is kept
+  after it. The admitted Agent is never a requester: `current_requester()` stays `None` in its
+  turns and in the Task attempts its requests run. See the 2026-10-06 amendment of ADR 0019
+  ([issue #67](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/67)).
 
 ## 2.0.2 — 2026-10-06
 

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.3.dev36
+Version: 2.0.3.dev38
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs
@@ -126,7 +126,8 @@ app = create_app()
 
 When Main Sequence hosts the runtime, `create_app()` admits a request only with the platform's
 signed assertion in `X-MainSequence-Caller-Assertion`, never on gateway identity headers, and lets
-only a session's owner or an Organization admin address that session. It declares this request
+only a session's owner, an Organization admin, or the Agent that delegated to it address that
+session. It declares this request
 identity to the platform launcher in `app.state.mainsequence_request_identity`; the launcher serves
 only an application that declares it, so serve the application `create_app()` returns. Outside
 hosting, requests are handled as before. See

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/README.md

@@ -93,7 +93,8 @@ app = create_app()
 
 When Main Sequence hosts the runtime, `create_app()` admits a request only with the platform's
 signed assertion in `X-MainSequence-Caller-Assertion`, never on gateway identity headers, and lets
-only a session's owner or an Organization admin address that session. It declares this request
+only a session's owner, an Organization admin, or the Agent that delegated to it address that
+session. It declares this request
 identity to the platform launcher in `app.state.mainsequence_request_identity`; the launcher serves
 only an application that declares it, so serve the application `create_app()` returns. Outside
 hosting, requests are handled as before. See

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.3.dev36"
+version = "2.0.3.dev38"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/agent_skills/tau_a2a_runtime_adapter/SKILL.md

@@ -26,8 +26,9 @@ The SDK owns:
 - privately attaching active caller-session proof when a tool advertises
   `mainsequence.ai/requires-caller-session-proof/v1: true`;
 - verifying the platform's signed caller or platform assertion on every inbound request of a
-  hosted runtime, and admitting a request to a session or its Tasks only for the session's owner
-  or an Organization admin;
+  hosted runtime, and admitting a request to a session or its Tasks only for the session's owner,
+  an Organization admin, or the workload User of the Agent that delegated to that child session,
+  which the platform's own records establish, never the `X-Caller-*` headers;
 - presenting the verified caller assertion of the request that starts a chat or A2A Message turn
   only when it marks that turn active, so that the platform can record the turn's requester, and
   giving extension tools that requester and requester-bound calls through `current_requester()`

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -129,8 +129,9 @@ async def revenue_by_region(tool_call_id, arguments, signal=None, on_update=None
 ```
 
 - `current_requester()` returns the turn's verified requester, with `uid` and `team_uids`, or
-  `None`. It is `None` for Agent callers, the platform's own calls, local mode, and code outside a
-  turn. Only it names the requester:
+  `None`. It is `None` for Agent callers, the platform's own calls other than a caller delivery
+  (which resumes delegated work for the person who asked), local mode, and code outside a turn.
+  Only it names the requester:
   never take a person's UID from tool arguments, the prompt, history, or a header.
 - `requester_client()` returns a client bound to the turn. `await client.request("GET",
   "/api/v1/...")` reads a platform API path for the requester. `await client.call_release(

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/agent_skills/tau_repository_integration/SKILL.md

@@ -46,9 +46,9 @@ TAU image, overlay, or SDK-owned deployment.
 
 `create_app()` installs the runtime's request identity. When Main Sequence hosts the runtime, the
 application admits only requests that carry the platform's signed assertion, lets only a session's
-owner or an Organization admin address that session, and declares all this in
-`app.state.mainsequence_request_identity`. The platform launcher serves an application only with
-that declaration, read from the object it serves. Therefore:
+owner, an Organization admin, or the Agent that delegated to it address that session, and declares
+all this in `app.state.mainsequence_request_identity`. The platform launcher serves an application
+only with that declaration, read from the object it serves. Therefore:
 
 - export the object `create_app()` returns as the module's `app`. An application that mounts it
   inside another one declares nothing, and the launcher refuses it;

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/api/a2a.py

@@ -63,7 +63,7 @@ from ms_tau_sdk.runtime.provenance import (
     TurnProvenance,
     turn_provenance_from_request,
 )
-from ms_tau_sdk.runtime.requester import Requester, canonical_requester_uid
+from ms_tau_sdk.runtime.requester import CallerDelivery, Requester, canonical_requester_uid
 from ms_tau_sdk.runtime.task_context import (
     TaskExecutionContext,
     active_task_execution,
@@ -930,7 +930,7 @@ def _requester_named_by_task(
     answer must name the same User, as a person, as ``requester_user_uid``.
     """
 
-    if caller_assertion is None:
+    if caller_assertion is None or caller_assertion.caller_is_workload:
         return None
     caller = caller_assertion.caller
     if task.requester_identity_type != "human" or task.requester_user_uid != caller.uid:
@@ -2150,7 +2150,7 @@ def _durable_task_execution_input(
 
 
 def _dispatched_requester(body: dict[str, Any], config: TauSDKSettings) -> Requester | None:
-    """Return the Task's requester as the platform's verified dispatch names it.
+    """Return the requester that the platform's verified dispatch or caller delivery names.
 
     Only a person is a requester: an Agent's workload User never is. A runtime that does not
     verify the platform's assertion on its internal routes takes no requester from them.
@@ -2213,6 +2213,7 @@ async def _resume_caller_delivery(
     task_id: str,
     task_status: str,
     caller_agent_session_uid: str,
+    delivery: CallerDelivery,
 ) -> None:
     prompt = (
         "A delegated asynchronous A2A Task has new actionable state. "
@@ -2229,6 +2230,9 @@ async def _resume_caller_delivery(
             "actorKind": "platform",
             "actorUid": "mainsequence",
         },
+        # The turn names its delivery, so that the platform records the requester of the
+        # delegated work for it.
+        caller_delivery=delivery,
     ):
         pass
     manager.mark_response_delivered(caller_agent_session_uid)
@@ -2238,6 +2242,7 @@ async def _resume_caller_delivery(
 async def task_caller_delivery_available(
     body: dict[str, Any],
     manager: RuntimeManagerDep,
+    config: SettingsDep,
 ) -> dict[str, Any]:
     delivery_uid = str(body.get("delivery_uid") or "").strip()
     task_uid = str(body.get("task_uid") or "").strip()
@@ -2284,6 +2289,10 @@ async def task_caller_delivery_available(
             task_id=task_id,
             task_status=task_status,
             caller_agent_session_uid=caller_agent_session_uid,
+            delivery=CallerDelivery(
+                uid=delivery_uid,
+                requester=_dispatched_requester(body, config),
+            ),
         ),
         name=f"a2a-caller-delivery-{delivery_uid}",
     )

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/api/request_identity.py

@@ -8,8 +8,9 @@ the kind its route requires: a platform assertion on ``/internal/*``, a caller a
 other route. Handlers read the verified caller with ``current_caller()``, or from
 ``request.state.user`` and ``request.state.user_uid``.
 
-A request that addresses an existing session must also come from the session's owner or from an
-Organization admin; see ``require_session_access()``. Outside hosted mode nothing here changes how
+A request that addresses an existing session must also come from the session's owner, from an
+Organization admin, or, for a delegated child session, from the workload User of the Agent that
+delegated to it; see ``require_session_access()``. Outside hosted mode nothing here changes how
 requests are handled.
 
 The raw caller assertion stays private to the request: ``request_caller_assertion()`` hands it
@@ -18,11 +19,13 @@ only to the turn that request starts, which presents it when it marks the turn a
 
 from __future__ import annotations
 
+import dataclasses
 from collections.abc import Iterable
 from contextvars import ContextVar
 
 import structlog
 from fastapi import FastAPI, HTTPException, Request
+from pydantic import ValidationError
 from starlette.responses import JSONResponse
 from starlette.types import ASGIApp, Receive, Scope, Send
 from starlette.websockets import WebSocketClose
@@ -37,8 +40,8 @@ from ms_tau_sdk.backend.assertions import (
     VerifiedCaller,
 )
 from ms_tau_sdk.backend.client import MainSequenceClient
-from ms_tau_sdk.backend.models import AgentSession
-from ms_tau_sdk.errors import SessionNotFoundError
+from ms_tau_sdk.backend.models import AgentSession, DirectoryUser
+from ms_tau_sdk.errors import SessionNotFoundError, TauSDKError
 from ms_tau_sdk.logging import bind_request_identity_log_fields
 from ms_tau_sdk.runtime.provenance import CallerIdentityError
 from ms_tau_sdk.settings import TauSDKSettings
@@ -66,6 +69,12 @@ _current_caller: ContextVar[VerifiedCaller | None] = ContextVar(
 # The verified raw caller assertion is kept in the request's own scope, not in request.state and
 # not in a context variable, so that only the code that starts the request's turn reads it.
 _CALLER_ASSERTION_SCOPE_KEY = "ms_tau_sdk.caller_assertion"
+# The workload Users that one request looked up, by User UID: the workload, or None for a User
+# that is not a workload or whose lookup failed. It lives only as long as its request.
+_workload_lookups: ContextVar[dict[str, DirectoryUser | None] | None] = ContextVar(
+    "ms_tau_sdk_workload_lookups",
+    default=None,
+)
 
 
 class SessionAccessDeniedError(HTTPException):
@@ -85,15 +94,24 @@ def current_caller() -> VerifiedCaller | None:
 
 
 def request_caller_assertion(request: Request) -> CallerAssertion | None:
-    """Return the verified caller assertion of ``request`` for the turn it starts.
+    """Return the verified caller assertion of ``request`` for the turn or Task it starts.
 
-    It is None outside hosted mode and on the platform's own calls. Only the chat and A2A Message
-    routes read it, to present it when they mark their turn active; it is never logged, persisted,
-    or passed to the model, a tool, a stream, or history.
+    It is None outside hosted mode and on the platform's own calls. Only the chat and A2A routes
+    read it, to present it when they mark their turn active or create or continue a Task; it is
+    never logged, persisted, or passed to the model, a tool, a stream, or history. A caller this
+    request admitted as the Agent that delegated to the session comes back marked as a workload,
+    which is never a requester.
     """
 
     value = request.scope.get(_CALLER_ASSERTION_SCOPE_KEY)
-    return value if isinstance(value, CallerAssertion) else None
+    if not isinstance(value, CallerAssertion):
+        return None
+    lookups = _workload_lookups.get()
+    if lookups is not None and lookups.get(value.caller.uid) is not None:
+        # The request was admitted as the Agent that delegated to the session: its assertion names
+        # a workload, never a requester.
+        return dataclasses.replace(value, caller_is_workload=True)
+    return value
 
 
 def verified_user_uid(settings: TauSDKSettings) -> str | None:
@@ -111,15 +129,63 @@ def verified_user_uid(settings: TauSDKSettings) -> str | None:
     return caller.uid
 
 
+async def _workload_of(client: MainSequenceClient, user_uid: str) -> DirectoryUser | None:
+    """Return the workload User ``user_uid`` names, as the platform's directory shows it, or None.
+
+    A User that is not a workload, and a lookup that fails, give None, so the check fails closed.
+    The answer is kept for the rest of the request only.
+    """
+
+    lookups = _workload_lookups.get()
+    if lookups is not None and user_uid in lookups:
+        return lookups[user_uid]
+    workload: DirectoryUser | None = None
+    try:
+        found = await client.get_user(user_uid)
+    except (TauSDKError, ValidationError) as error:
+        logger.warning(
+            "request_identity.caller_lookup.failed",
+            message="The caller's User could not be looked up; the session is refused",
+            error_type=type(error).__name__,
+        )
+    else:
+        if found.uid == user_uid and found.identity_type == "workload" and found.agent_uid:
+            workload = found
+    if lookups is not None:
+        lookups[user_uid] = workload
+    return workload
+
+
+async def _delegated_to_caller(
+    client: MainSequenceClient,
+    session: AgentSession,
+    caller: VerifiedCaller,
+) -> bool:
+    """Whether ``session`` is a child session that the caller's own Agent delegated to.
+
+    The session must name its parent session's Agent, the caller must be a workload User as the
+    platform's directory shows it, and that workload must serve the same Agent. No request header
+    is read.
+    """
+
+    parent_agent_uid = session.parent_session_agent_uid
+    if not parent_agent_uid:
+        return False
+    workload = await _workload_of(client, caller.uid)
+    return workload is not None and workload.agent_uid == parent_agent_uid
+
+
 async def require_session_access(
     client: MainSequenceClient,
     session_uid: str,
 ) -> AgentSession | None:
-    """Admit the current request to ``session_uid`` only for its owner or an Organization admin.
+    """Admit the current request to ``session_uid`` only for a caller allowed to address it.
 
-    The owner is the User the platform recorded as the session's creator,
-    ``created_by_user_uid``. The check applies in hosted mode only and raises
-    ``SessionAccessDeniedError`` (403). It returns the session when it had to read it.
+    That is the session's owner, the User the platform recorded as its creator
+    (``created_by_user_uid``); an Organization admin; or, for a delegated child session, the
+    workload User of the Agent that delegated to it (``parent_session_agent_uid``). The check
+    applies in hosted mode only and raises ``SessionAccessDeniedError`` (403). It returns the
+    session when it had to read it.
     """
 
     if client.settings.request_identity_mode != "assertion":
@@ -130,16 +196,19 @@ async def require_session_access(
     if caller.is_organization_admin:
         return None
     session = await client.get_session(session_uid)
-    if session.created_by_user_uid != caller.uid:
-        raise SessionAccessDeniedError()
-    return session
+    if session.created_by_user_uid == caller.uid:
+        return session
+    if await _delegated_to_caller(client, session, caller):
+        return session
+    raise SessionAccessDeniedError()
 
 
 async def sessions_the_caller_may_address(
     client: MainSequenceClient,
     session_uids: Iterable[str],
 ) -> set[str] | None:
-    """Return which of ``session_uids`` the current caller may address.
+    """Return which of ``session_uids`` the current caller may address, by the rule of
+    ``require_session_access()``.
 
     None means every session: outside hosted mode, or for an Organization admin. A session that
     no longer exists is left out.
@@ -160,7 +229,9 @@ async def sessions_the_caller_may_address(
             session = await client.get_session(session_uid)
         except SessionNotFoundError:
             continue
-        if session.created_by_user_uid == caller.uid:
+        if session.created_by_user_uid == caller.uid or await _delegated_to_caller(
+            client, session, caller
+        ):
             allowed.add(session_uid)
     return allowed
 
@@ -240,9 +311,11 @@ class RequestIdentityMiddleware:
                 token=token,
             )
         caller_token = _current_caller.set(caller)
+        lookups_token = _workload_lookups.set({})
         try:
             await self.app(scope, receive, send)
         finally:
+            _workload_lookups.reset(lookups_token)
             _current_caller.reset(caller_token)
             scope.pop(_CALLER_ASSERTION_SCOPE_KEY, None)
 

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/backend/assertions.py

@@ -113,6 +113,9 @@ class CallerAssertion:
     caller: VerifiedCaller
     expires_at: int
     token: str = field(repr=False)
+    # True when the platform's directory showed the caller to be a workload User. A workload is
+    # never a turn's or a Task's requester.
+    caller_is_workload: bool = False
 
     def unexpired_token(self, *, now: float | None = None) -> str | None:
         """Return the raw assertion while it is valid, and None once it has expired."""

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/backend/client.py

@@ -35,6 +35,7 @@ from .models import (
     AgentTaskEventPage,
     AgentTaskExecutionAttempt,
     AgentTaskSnapshot,
+    DirectoryUser,
     LocalChatSessionPage,
     LocalChatTranscript,
     LocalConversationMessagePage,
@@ -77,6 +78,7 @@ from .routes import (
     agent_task_operation,
     model_provider_credentials,
     resource_release_runtime_access,
+    user,
 )
 
 T = TypeVar("T")
@@ -404,6 +406,12 @@ class MainSequenceClient:
                 detail=error.errors(include_input=False),
             ) from error
 
+    async def get_user(self, user_uid: str) -> DirectoryUser:
+        """Look a User of the Organization up, as the platform's directory shows it."""
+
+        data = await self._request("GET", user(user_uid), idempotent=True)
+        return DirectoryUser.model_validate(data)
+
     async def list_model_providers(
         self, *, organization_environment_uid: str | None = None
     ) -> dict[str, Any]:

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/backend/models.py

@@ -74,6 +74,9 @@ class AgentSession(BackendModel):
     )
     status: str | None = None
     created_by_user_uid: str | None = None
+    # The Agent of the parent session, or None for a session without a parent. The Agent that
+    # delegated to a child session addresses it with its own workload User.
+    parent_session_agent_uid: str | None = None
     runtime_capabilities: dict[str, str] = Field(default_factory=dict)
 
     @model_validator(mode="after")
@@ -87,6 +90,18 @@ class AgentSession(BackendModel):
         return self
 
 
+class DirectoryUser(BackendModel):
+    """A User of the Organization as the platform's directory shows it to the runtime.
+
+    A workload User's row carries ``identity_type`` ``workload`` and, for the workload of an
+    Agent's release, ``agent_uid``.
+    """
+
+    uid: str
+    identity_type: str | None = None
+    agent_uid: str | None = None
+
+
 class AgentCardEnvelope(BackendModel):
     agent_session_uid: str
     agent_uid: str
@@ -280,7 +295,8 @@ class RuntimeState(BackendModel):
     cancel_requested: bool = False
     cancellation_id: str | None = None
     # The person the platform recorded as the active turn's requester, from the caller assertion
-    # the runtime presented when it marked the turn active. None when it recorded nobody.
+    # the runtime presented, or the caller delivery it named, when it marked the turn active.
+    # None when it recorded nobody.
     requester_user_uid: str | None = None
 
     @model_validator(mode="after")
@@ -307,6 +323,9 @@ class RuntimeActivityPatch(BackendRequestModel):
     activity_sequence: int | None = Field(default=None, ge=1)
     runtime_activity: AgentRuntimeActivity
     active_turn_uid: str | None = None
+    # The caller delivery a turn the platform starts resumes the session for, sent only with the
+    # transition that marks that turn active, and never together with a caller assertion.
+    caller_delivery_uid: str | None = None
 
     @model_validator(mode="after")
     def validate_concurrency_mode(self) -> RuntimeActivityPatch:

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/backend/routes.py

@@ -12,6 +12,7 @@ MODEL_PROVIDER_CREDENTIALS = f"{API_V1_PREFIX}/model-provider-credentials/"
 MODEL_PROVIDERS = f"{API_V1_PREFIX}/model-providers/"
 AGENT_TASKS = f"{API_V1_PREFIX}/agent-tasks/"
 RESOURCE_RELEASES = f"{API_V1_PREFIX}/resource-releases/"
+USERS = f"{API_V1_PREFIX}/users/"
 
 type RuntimeLeaseOperation = Literal["acquire", "renew", "release"]
 type ModelProviderCredentialOperation = Literal["hydrate", "status", "flush", "revoke"]
@@ -92,3 +93,7 @@ def agent_task_operation(task_uid: str, operation: AgentTaskOperation) -> str:
 
 def resource_release_runtime_access(release_uid: str) -> str:
     return f"{RESOURCE_RELEASES}{release_uid}/resolve-runtime-access/"
+
+
+def user(user_uid: str) -> str:
+    return f"{USERS}{user_uid}/"

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/runtime/manager.py

@@ -65,6 +65,7 @@ from ms_tau_sdk.runtime.live_turns import LiveTurn, LocalChatTurn
 from ms_tau_sdk.runtime.observability import TauTurnObserver
 from ms_tau_sdk.runtime.provenance import TurnProvenance
 from ms_tau_sdk.runtime.requester import (
+    CallerDelivery,
     Requester,
     TurnRequesterBinding,
     bind_turn_requester,
@@ -1323,11 +1324,14 @@ class SessionRuntimeManager:
         platform_event: PlatformEvent | None = None,
         turn_uid: str | None = None,
         caller_assertion: CallerAssertion | None = None,
+        caller_delivery: CallerDelivery | None = None,
     ) -> AsyncIterator[TauRuntimeEvent]:
         """Run one turn in a session.
 
         ``caller_assertion`` is the verified caller assertion of the hosted chat or A2A Message
         request that starts the turn. It is presented only when the turn is marked active.
+        ``caller_delivery`` is, instead, the caller delivery that a turn the platform starts
+        resumes the session for. It is named only when the turn is marked active.
         """
 
         agent_run_uid = str(uuid.uuid4())
@@ -1345,6 +1349,7 @@ class SessionRuntimeManager:
                 provenance=provenance,
                 platform_event=platform_event,
                 caller_assertion=caller_assertion,
+                caller_delivery=caller_delivery,
             ):
                 yield event
 
@@ -1356,6 +1361,7 @@ class SessionRuntimeManager:
         provenance: TurnProvenance | None = None,
         platform_event: PlatformEvent | None = None,
         caller_assertion: CallerAssertion | None = None,
+        caller_delivery: CallerDelivery | None = None,
     ) -> AsyncIterator[TauRuntimeEvent]:
         live_turn = self._open_live_turn(session_uid, content, provenance)
         try:
@@ -1365,6 +1371,7 @@ class SessionRuntimeManager:
                 provenance=provenance,
                 platform_event=platform_event,
                 caller_assertion=caller_assertion,
+                caller_delivery=caller_delivery,
             ):
                 if live_turn is not None:
                     live_turn.observe(event)
@@ -1497,6 +1504,7 @@ class SessionRuntimeManager:
         provenance: TurnProvenance | None = None,
         platform_event: PlatformEvent | None = None,
         caller_assertion: CallerAssertion | None = None,
+        caller_delivery: CallerDelivery | None = None,
     ) -> AsyncIterator[TauRuntimeEvent]:
         logger.info(
             "agent.run.accepted",
@@ -1522,18 +1530,25 @@ class SessionRuntimeManager:
         context = get_contextvars()
         turn_uid = str(context.get("turn_uid") or uuid.uuid4())
         task_context = active_task_execution()
-        # Only a hosted chat or A2A Message turn presents its request's caller assertion. A Task
+        # Only a hosted chat or A2A Message turn presents its request's caller assertion, and only
+        # a hosted turn the platform starts for a caller delivery names that delivery. A Task
         # attempt takes its requester from the platform's dispatch instead.
         presented = (
             caller_assertion
             if task_context is None and self._requester_identity_verified()
             else None
         )
+        delivery = (
+            caller_delivery
+            if presented is None and task_context is None and self._requester_identity_verified()
+            else None
+        )
         runtime = await self._begin_turn_with_one_reload(
             session_uid=session_uid,
             runtime=runtime,
             turn_uid=turn_uid,
             caller_assertion=presented,
+            caller_delivery_uid=delivery.uid if delivery is not None else None,
         )
         requester_binding = TurnRequesterBinding(
             session_uid=session_uid,
@@ -1541,6 +1556,7 @@ class SessionRuntimeManager:
                 runtime,
                 caller_assertion=presented,
                 task_context=task_context,
+                caller_delivery=delivery,
             ),
             lease_proof=lambda: LeaseProof(
                 session_uid=session_uid,
@@ -1677,16 +1693,24 @@ class SessionRuntimeManager:
         runtime: ActiveSessionRuntime,
         turn_uid: str,
         caller_assertion: CallerAssertion | None = None,
+        caller_delivery_uid: str | None = None,
     ) -> ActiveSessionRuntime:
         for begin_attempt in range(2):
             runtime.activity_sequence += 1
             # An expired assertion is not presented, and the platform then records nobody.
             presented = caller_assertion.unexpired_token() if caller_assertion else None
+            named: dict[str, str] = (
+                {"caller_assertion": presented}
+                if presented
+                else {"caller_delivery_uid": caller_delivery_uid}
+                if caller_delivery_uid
+                else {}
+            )
             try:
                 state = await runtime.storage.begin_turn(
                     turn_uid=turn_uid,
                     activity_sequence=runtime.activity_sequence,
-                    **({"caller_assertion": presented} if presented else {}),
+                    **named,
                 )
             except BackendConflictError:
                 if begin_attempt:
@@ -1700,7 +1724,7 @@ class SessionRuntimeManager:
             runtime.activity_sequence = state.activity_sequence or runtime.activity_sequence
             requester_user_uid = state.requester_user_uid
             runtime.requester_user_uid = (
-                requester_user_uid if presented and isinstance(requester_user_uid, str) else None
+                requester_user_uid if named and isinstance(requester_user_uid, str) else None
             )
             return runtime
         raise AssertionError("Tau turn reload loop did not terminate")
@@ -1716,20 +1740,28 @@ class SessionRuntimeManager:
         *,
         caller_assertion: CallerAssertion | None,
         task_context: TaskExecutionContext | None,
+        caller_delivery: CallerDelivery | None = None,
     ) -> Requester | None:
         """Name the verified person a turn serves, or None.
 
         A Task turn serves the person its execution context names, as the platform recorded the
         Task's requester. A chat or A2A Message turn serves its verified caller only when the
         platform recorded that same person as the turn's requester, which it does for a person who
-        owns the session and never for an Agent caller.
+        owns the session and never for an Agent caller. A turn the platform starts for a caller
+        delivery serves the requester the delivery names, only when the platform recorded that
+        same person for the turn.
         """
 
         if not self._requester_identity_verified():
             return None
         if task_context is not None:
             return task_context.requester
-        if caller_assertion is None:
+        if caller_delivery is not None:
+            requester = caller_delivery.requester
+            if requester is None or runtime.requester_user_uid != requester.uid:
+                return None
+            return requester
+        if caller_assertion is None or caller_assertion.caller_is_workload:
             return None
         caller = caller_assertion.caller
         if runtime.requester_user_uid != caller.uid:

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/runtime/requester.py

@@ -58,6 +58,19 @@ class Requester:
     team_uids: tuple[str, ...] = ()
 
 
+@dataclass(frozen=True, slots=True)
+class CallerDelivery:
+    """The caller delivery that a turn the platform starts resumes its session for.
+
+    ``requester`` is the person the platform's verified signal names as the requester of the
+    delegated work, or None. The turn serves that person only when the platform records the same
+    person for the turn it starts.
+    """
+
+    uid: str
+    requester: Requester | None = None
+
+
 class RequesterBindingError(TauSDKError, PermissionError):
     """The turn has no verified requester, or the platform ended the requester's binding.
 
@@ -551,6 +564,7 @@ def _token_access(answer: ReleaseRuntimeAccess) -> _ReleaseAccess:
 
 
 __all__ = [
+    "CallerDelivery",
     "Requester",
     "RequesterBindingError",
     "RequesterClient",

{ms_tau_sdk-2.0.3.dev36 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/sessions/storage.py

@@ -68,11 +68,15 @@ class BackendSessionStorage(SessionStorage):
         turn_uid: str,
         activity_sequence: int,
         caller_assertion: str | None = None,
+        caller_delivery_uid: str | None = None,
     ) -> RuntimeState:
         """Mark ``turn_uid`` active.
 
         ``caller_assertion`` is the verified caller assertion of the request that started the
         turn. It goes only to this transition, so that the platform can record who asked.
+        ``caller_delivery_uid`` names, instead, the caller delivery that a turn the platform
+        starts resumes the session for; the platform then records the requester of the delegated
+        work.
         """
 
         async with self._state_lock:
@@ -89,6 +93,7 @@ class BackendSessionStorage(SessionStorage):
                     activity_sequence=activity_sequence,
                     runtime_activity="working",
                     active_turn_uid=turn_uid,
+                    caller_delivery_uid=caller_delivery_uid,
                 ),
                 **({"caller_assertion": caller_assertion} if caller_assertion else {}),
             )