ms-tau-sdk 2.0.3.dev37__tar.gz → 2.0.3.dev38__tar.gz

{ms_tau_sdk-2.0.3.dev37 → ms_tau_sdk-2.0.3.dev38}/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+- A turn that a caller delivery resumes serves the person who asked for the delegated work. When
+  `POST /internal/a2a/task-caller-delivery` resumes a hosted session, the turn presents no
+  assertion. It names the delivery in `caller_delivery_uid` on the
+  `PATCH /api/v1/agent-sessions/<uid>/tau-runtime-activity/` transition that marks it active, and
+  the platform answers with the requester it recorded for the turn: the person who asked for the
+  turn that delegated with `resume_caller`. `current_requester()` returns that person, with empty
+  `team_uids`, and `requester_client()` reads for them, only when the delivery signal names the
+  same User with `requester_identity_type` `human`. Local mode and a runtime that is not hosted
+  name no delivery.
 - Main Sequence MCP no longer offers `agent_session.resolve_runtime_access` to the model. Its
   result carries a short-lived runtime token for direct-runtime clients, and Tau's generic MCP
   projection copied that token into model-visible tool content and into tool details, which reach
@@ -24,7 +33,7 @@
   platform's dispatch takes its requester from the dispatch's same two facts. Two new public
   functions:
   - `current_requester()` returns that person inside the turn (`uid`, `team_uids`), or `None` for
-    Agent callers, the platform's own calls, local mode, a runtime that is not hosted, and code
+    Agent callers, the platform's other calls, local mode, a runtime that is not hosted, and code
     outside a turn;
   - `requester_client()` returns a client bound to the turn. `request(method, path, ...)` calls a
     platform API path with the runtime's credential and `X-MainSequence-Acting-For-Session`,

{ms_tau_sdk-2.0.3.dev37 → ms_tau_sdk-2.0.3.dev38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.3.dev37
+Version: 2.0.3.dev38
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs

{ms_tau_sdk-2.0.3.dev37 → ms_tau_sdk-2.0.3.dev38}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.3.dev37"
+version = "2.0.3.dev38"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.3.dev37 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -129,8 +129,9 @@ async def revenue_by_region(tool_call_id, arguments, signal=None, on_update=None
 ```
 
 - `current_requester()` returns the turn's verified requester, with `uid` and `team_uids`, or
-  `None`. It is `None` for Agent callers, the platform's own calls, local mode, and code outside a
-  turn. Only it names the requester:
+  `None`. It is `None` for Agent callers, the platform's own calls other than a caller delivery
+  (which resumes delegated work for the person who asked), local mode, and code outside a turn.
+  Only it names the requester:
   never take a person's UID from tool arguments, the prompt, history, or a header.
 - `requester_client()` returns a client bound to the turn. `await client.request("GET",
   "/api/v1/...")` reads a platform API path for the requester. `await client.call_release(

{ms_tau_sdk-2.0.3.dev37 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/api/a2a.py

@@ -63,7 +63,7 @@ from ms_tau_sdk.runtime.provenance import (
     TurnProvenance,
     turn_provenance_from_request,
 )
-from ms_tau_sdk.runtime.requester import Requester, canonical_requester_uid
+from ms_tau_sdk.runtime.requester import CallerDelivery, Requester, canonical_requester_uid
 from ms_tau_sdk.runtime.task_context import (
     TaskExecutionContext,
     active_task_execution,
@@ -2150,7 +2150,7 @@ def _durable_task_execution_input(
 
 
 def _dispatched_requester(body: dict[str, Any], config: TauSDKSettings) -> Requester | None:
-    """Return the Task's requester as the platform's verified dispatch names it.
+    """Return the requester that the platform's verified dispatch or caller delivery names.
 
     Only a person is a requester: an Agent's workload User never is. A runtime that does not
     verify the platform's assertion on its internal routes takes no requester from them.
@@ -2213,6 +2213,7 @@ async def _resume_caller_delivery(
     task_id: str,
     task_status: str,
     caller_agent_session_uid: str,
+    delivery: CallerDelivery,
 ) -> None:
     prompt = (
         "A delegated asynchronous A2A Task has new actionable state. "
@@ -2229,6 +2230,9 @@ async def _resume_caller_delivery(
             "actorKind": "platform",
             "actorUid": "mainsequence",
         },
+        # The turn names its delivery, so that the platform records the requester of the
+        # delegated work for it.
+        caller_delivery=delivery,
     ):
         pass
     manager.mark_response_delivered(caller_agent_session_uid)
@@ -2238,6 +2242,7 @@ async def _resume_caller_delivery(
 async def task_caller_delivery_available(
     body: dict[str, Any],
     manager: RuntimeManagerDep,
+    config: SettingsDep,
 ) -> dict[str, Any]:
     delivery_uid = str(body.get("delivery_uid") or "").strip()
     task_uid = str(body.get("task_uid") or "").strip()
@@ -2284,6 +2289,10 @@ async def task_caller_delivery_available(
             task_id=task_id,
             task_status=task_status,
             caller_agent_session_uid=caller_agent_session_uid,
+            delivery=CallerDelivery(
+                uid=delivery_uid,
+                requester=_dispatched_requester(body, config),
+            ),
         ),
         name=f"a2a-caller-delivery-{delivery_uid}",
     )

{ms_tau_sdk-2.0.3.dev37 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/backend/models.py

@@ -295,7 +295,8 @@ class RuntimeState(BackendModel):
     cancel_requested: bool = False
     cancellation_id: str | None = None
     # The person the platform recorded as the active turn's requester, from the caller assertion
-    # the runtime presented when it marked the turn active. None when it recorded nobody.
+    # the runtime presented, or the caller delivery it named, when it marked the turn active.
+    # None when it recorded nobody.
     requester_user_uid: str | None = None
 
     @model_validator(mode="after")
@@ -322,6 +323,9 @@ class RuntimeActivityPatch(BackendRequestModel):
     activity_sequence: int | None = Field(default=None, ge=1)
     runtime_activity: AgentRuntimeActivity
     active_turn_uid: str | None = None
+    # The caller delivery a turn the platform starts resumes the session for, sent only with the
+    # transition that marks that turn active, and never together with a caller assertion.
+    caller_delivery_uid: str | None = None
 
     @model_validator(mode="after")
     def validate_concurrency_mode(self) -> RuntimeActivityPatch:

{ms_tau_sdk-2.0.3.dev37 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/runtime/manager.py

@@ -65,6 +65,7 @@ from ms_tau_sdk.runtime.live_turns import LiveTurn, LocalChatTurn
 from ms_tau_sdk.runtime.observability import TauTurnObserver
 from ms_tau_sdk.runtime.provenance import TurnProvenance
 from ms_tau_sdk.runtime.requester import (
+    CallerDelivery,
     Requester,
     TurnRequesterBinding,
     bind_turn_requester,
@@ -1323,11 +1324,14 @@ class SessionRuntimeManager:
         platform_event: PlatformEvent | None = None,
         turn_uid: str | None = None,
         caller_assertion: CallerAssertion | None = None,
+        caller_delivery: CallerDelivery | None = None,
     ) -> AsyncIterator[TauRuntimeEvent]:
         """Run one turn in a session.
 
         ``caller_assertion`` is the verified caller assertion of the hosted chat or A2A Message
         request that starts the turn. It is presented only when the turn is marked active.
+        ``caller_delivery`` is, instead, the caller delivery that a turn the platform starts
+        resumes the session for. It is named only when the turn is marked active.
         """
 
         agent_run_uid = str(uuid.uuid4())
@@ -1345,6 +1349,7 @@ class SessionRuntimeManager:
                 provenance=provenance,
                 platform_event=platform_event,
                 caller_assertion=caller_assertion,
+                caller_delivery=caller_delivery,
             ):
                 yield event
 
@@ -1356,6 +1361,7 @@ class SessionRuntimeManager:
         provenance: TurnProvenance | None = None,
         platform_event: PlatformEvent | None = None,
         caller_assertion: CallerAssertion | None = None,
+        caller_delivery: CallerDelivery | None = None,
     ) -> AsyncIterator[TauRuntimeEvent]:
         live_turn = self._open_live_turn(session_uid, content, provenance)
         try:
@@ -1365,6 +1371,7 @@ class SessionRuntimeManager:
                 provenance=provenance,
                 platform_event=platform_event,
                 caller_assertion=caller_assertion,
+                caller_delivery=caller_delivery,
             ):
                 if live_turn is not None:
                     live_turn.observe(event)
@@ -1497,6 +1504,7 @@ class SessionRuntimeManager:
         provenance: TurnProvenance | None = None,
         platform_event: PlatformEvent | None = None,
         caller_assertion: CallerAssertion | None = None,
+        caller_delivery: CallerDelivery | None = None,
     ) -> AsyncIterator[TauRuntimeEvent]:
         logger.info(
             "agent.run.accepted",
@@ -1522,18 +1530,25 @@ class SessionRuntimeManager:
         context = get_contextvars()
         turn_uid = str(context.get("turn_uid") or uuid.uuid4())
         task_context = active_task_execution()
-        # Only a hosted chat or A2A Message turn presents its request's caller assertion. A Task
+        # Only a hosted chat or A2A Message turn presents its request's caller assertion, and only
+        # a hosted turn the platform starts for a caller delivery names that delivery. A Task
         # attempt takes its requester from the platform's dispatch instead.
         presented = (
             caller_assertion
             if task_context is None and self._requester_identity_verified()
             else None
         )
+        delivery = (
+            caller_delivery
+            if presented is None and task_context is None and self._requester_identity_verified()
+            else None
+        )
         runtime = await self._begin_turn_with_one_reload(
             session_uid=session_uid,
             runtime=runtime,
             turn_uid=turn_uid,
             caller_assertion=presented,
+            caller_delivery_uid=delivery.uid if delivery is not None else None,
         )
         requester_binding = TurnRequesterBinding(
             session_uid=session_uid,
@@ -1541,6 +1556,7 @@ class SessionRuntimeManager:
                 runtime,
                 caller_assertion=presented,
                 task_context=task_context,
+                caller_delivery=delivery,
             ),
             lease_proof=lambda: LeaseProof(
                 session_uid=session_uid,
@@ -1677,16 +1693,24 @@ class SessionRuntimeManager:
         runtime: ActiveSessionRuntime,
         turn_uid: str,
         caller_assertion: CallerAssertion | None = None,
+        caller_delivery_uid: str | None = None,
     ) -> ActiveSessionRuntime:
         for begin_attempt in range(2):
             runtime.activity_sequence += 1
             # An expired assertion is not presented, and the platform then records nobody.
             presented = caller_assertion.unexpired_token() if caller_assertion else None
+            named: dict[str, str] = (
+                {"caller_assertion": presented}
+                if presented
+                else {"caller_delivery_uid": caller_delivery_uid}
+                if caller_delivery_uid
+                else {}
+            )
             try:
                 state = await runtime.storage.begin_turn(
                     turn_uid=turn_uid,
                     activity_sequence=runtime.activity_sequence,
-                    **({"caller_assertion": presented} if presented else {}),
+                    **named,
                 )
             except BackendConflictError:
                 if begin_attempt:
@@ -1700,7 +1724,7 @@ class SessionRuntimeManager:
             runtime.activity_sequence = state.activity_sequence or runtime.activity_sequence
             requester_user_uid = state.requester_user_uid
             runtime.requester_user_uid = (
-                requester_user_uid if presented and isinstance(requester_user_uid, str) else None
+                requester_user_uid if named and isinstance(requester_user_uid, str) else None
             )
             return runtime
         raise AssertionError("Tau turn reload loop did not terminate")
@@ -1716,19 +1740,27 @@ class SessionRuntimeManager:
         *,
         caller_assertion: CallerAssertion | None,
         task_context: TaskExecutionContext | None,
+        caller_delivery: CallerDelivery | None = None,
     ) -> Requester | None:
         """Name the verified person a turn serves, or None.
 
         A Task turn serves the person its execution context names, as the platform recorded the
         Task's requester. A chat or A2A Message turn serves its verified caller only when the
         platform recorded that same person as the turn's requester, which it does for a person who
-        owns the session and never for an Agent caller.
+        owns the session and never for an Agent caller. A turn the platform starts for a caller
+        delivery serves the requester the delivery names, only when the platform recorded that
+        same person for the turn.
         """
 
         if not self._requester_identity_verified():
             return None
         if task_context is not None:
             return task_context.requester
+        if caller_delivery is not None:
+            requester = caller_delivery.requester
+            if requester is None or runtime.requester_user_uid != requester.uid:
+                return None
+            return requester
         if caller_assertion is None or caller_assertion.caller_is_workload:
             return None
         caller = caller_assertion.caller

{ms_tau_sdk-2.0.3.dev37 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/runtime/requester.py

@@ -58,6 +58,19 @@ class Requester:
     team_uids: tuple[str, ...] = ()
 
 
+@dataclass(frozen=True, slots=True)
+class CallerDelivery:
+    """The caller delivery that a turn the platform starts resumes its session for.
+
+    ``requester`` is the person the platform's verified signal names as the requester of the
+    delegated work, or None. The turn serves that person only when the platform records the same
+    person for the turn it starts.
+    """
+
+    uid: str
+    requester: Requester | None = None
+
+
 class RequesterBindingError(TauSDKError, PermissionError):
     """The turn has no verified requester, or the platform ended the requester's binding.
 
@@ -551,6 +564,7 @@ def _token_access(answer: ReleaseRuntimeAccess) -> _ReleaseAccess:
 
 
 __all__ = [
+    "CallerDelivery",
     "Requester",
     "RequesterBindingError",
     "RequesterClient",

{ms_tau_sdk-2.0.3.dev37 → ms_tau_sdk-2.0.3.dev38}/src/ms_tau_sdk/sessions/storage.py

@@ -68,11 +68,15 @@ class BackendSessionStorage(SessionStorage):
         turn_uid: str,
         activity_sequence: int,
         caller_assertion: str | None = None,
+        caller_delivery_uid: str | None = None,
     ) -> RuntimeState:
         """Mark ``turn_uid`` active.
 
         ``caller_assertion`` is the verified caller assertion of the request that started the
         turn. It goes only to this transition, so that the platform can record who asked.
+        ``caller_delivery_uid`` names, instead, the caller delivery that a turn the platform
+        starts resumes the session for; the platform then records the requester of the delegated
+        work.
         """
 
         async with self._state_lock:
@@ -89,6 +93,7 @@ class BackendSessionStorage(SessionStorage):
                     activity_sequence=activity_sequence,
                     runtime_activity="working",
                     active_turn_uid=turn_uid,
+                    caller_delivery_uid=caller_delivery_uid,
                 ),
                 **({"caller_assertion": caller_assertion} if caller_assertion else {}),
             )