ms-tau-sdk 2.0.6.dev40__tar.gz → 2.0.7.dev41__tar.gz

{ms_tau_sdk-2.0.6.dev40 → ms_tau_sdk-2.0.7.dev41}/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 ## Unreleased
 
+- **Breaking: one delegation envelope on every call made for the work
+  ([#78](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/78), ADR 0021 amendment).** This
+  release works only with the matching platform change, deployed in the same cutover; there is no
+  deprecation period, and earlier releases, including 2.0.6, stop acting for people once that
+  platform is deployed.
+  - Every hosted Main Sequence MCP call names the turn's session, and carries the person's
+    delegation (`mainsequence.ai/delegation/v1`) while the turn serves a person. The platform's
+    per-tool labels (`mainsequence.ai/requires-requester/v1`,
+    `mainsequence.ai/requires-caller-session-proof/v1`) are no longer read, and a turn that serves
+    nobody keeps its MCP tools: its calls are the Agent's own.
+  - Declared application tools run in every turn, with a token for the person the turn serves or
+    the Agent's own token when it serves nobody. A refused delegated call is reported and never
+    retried as the Agent.
+  - The person a turn serves comes only from the platform's answer to the turn start, whoever
+    called; dispatch, delivery and Task answers are no longer read for it. Delegated work serves
+    the person the platform records for it.
+  - `platform_client()` replaces `requester_client()`, with no alias. By default a call carries the
+    delegation while the turn serves a person; `delegation="none"` never carries it and
+    `delegation="required"` refuses the call before sending when the turn serves nobody. Outside a
+    turn no call carries a delegation, and in local mode calls use the signed-in person's own
+    credential.
+  - Delegated calls use the person's ordinary permissions, including administrative ones; the
+    statement people are shown changes accordingly.
+  - The SDK no longer hides the withdrawn private Secret entry operations, and the local health
+    field `mcp_session_proof_limited_tool_count` is removed.
+
+- Documentation now distinguishes requester-bound reads and supported writes from workload grants,
+  states the write risk and platform rollout requirements, and includes conversation/Task
+  permissions and denial recovery. The Security and access guide keeps its `security-model.md`
+  path. Provider selection settings and troubleshooting, the public readiness-hook reference, and
+  the exported API compatibility list are complete. This changes documentation only.
+
+## 2.0.6 — 2026-10-07
+
 - The documentation no longer describes the platform's internal implementation. It no longer names
   the backend framework, its repositories, ADRs, classes or commits, and calls the backend "the
   platform". The archived Astro documents (`docs/history/astro`) and the ADR 56 migration workspace

{ms_tau_sdk-2.0.6.dev40 → ms_tau_sdk-2.0.7.dev41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.6.dev40
+Version: 2.0.7.dev41
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs
@@ -133,10 +133,11 @@ only an application that declares it, so serve the application `create_app()` re
 hosting, requests are handled as before. See
 [request identity](docs/reference/runtime-contract.md#request-identity).
 
-An Agent that an Organization admin enabled for it can read with the access of the person whose
-request a turn is serving. Project tools read that person with `current_requester()` and call the
-platform or another platform application for them with `requester_client()`; neither exposes a
-proof or a token. See the [public API](docs/reference/public-api.md#current_requester-and-requester_client).
+An Agent that an Organization admin enabled for it can act with the ordinary permissions of the
+person whose request a turn is serving. Project tools read that person with `current_requester()`
+and call the platform or another platform application with `platform_client()`, which carries the
+person's delegation by default while the turn serves one; neither exposes a proof or a token. See
+the [public API](docs/reference/public-api.md#current_requester-and-platform_client).
 
 Job-hosted batch execution is an [accepted design](docs/adrs/0015-job-hosted-batch-execution.md)
 with implementation pending. It will run this SDK's configured Tau composition for one assignment
@@ -287,13 +288,14 @@ are not bundled into the SDK. Main Sequence transport and protocol behavior rema
 - explicit, version-matched development skills for repository integration, local debugging,
   project customization, and TAU's A2A host adapter
 
-## Security model
+## Security and access guide
 
-A hosted Agent runs as its own workload, with no access until it is granted, and never reads or
-writes Secret values. An Organization admin can let it read with the access of the person it is
-serving, read-only and for at most 24 hours. Everything its tools read reaches the model, and its
+A hosted Agent runs as its own workload, with no access until it is granted. An Organization admin
+can let it act with the ordinary permissions of the person it serves, including administrative
+ones, only during that work and for at most 24 hours. Prompt injection can cause unintended actions within those rights;
+completed changes can outlast that access. Everything its tools read reaches the model, and its
 tools and extensions run with its credentials. The
-[agent security model](docs/reference/security-model.md) explains what people who build and use
+[Security and access guide](docs/reference/security-model.md) explains what people who build and use
 Agents need to know.
 
 ## Deployment boundary

{ms_tau_sdk-2.0.6.dev40 → ms_tau_sdk-2.0.7.dev41}/README.md

@@ -100,10 +100,11 @@ only an application that declares it, so serve the application `create_app()` re
 hosting, requests are handled as before. See
 [request identity](docs/reference/runtime-contract.md#request-identity).
 
-An Agent that an Organization admin enabled for it can read with the access of the person whose
-request a turn is serving. Project tools read that person with `current_requester()` and call the
-platform or another platform application for them with `requester_client()`; neither exposes a
-proof or a token. See the [public API](docs/reference/public-api.md#current_requester-and-requester_client).
+An Agent that an Organization admin enabled for it can act with the ordinary permissions of the
+person whose request a turn is serving. Project tools read that person with `current_requester()`
+and call the platform or another platform application with `platform_client()`, which carries the
+person's delegation by default while the turn serves one; neither exposes a proof or a token. See
+the [public API](docs/reference/public-api.md#current_requester-and-platform_client).
 
 Job-hosted batch execution is an [accepted design](docs/adrs/0015-job-hosted-batch-execution.md)
 with implementation pending. It will run this SDK's configured Tau composition for one assignment
@@ -254,13 +255,14 @@ are not bundled into the SDK. Main Sequence transport and protocol behavior rema
 - explicit, version-matched development skills for repository integration, local debugging,
   project customization, and TAU's A2A host adapter
 
-## Security model
+## Security and access guide
 
-A hosted Agent runs as its own workload, with no access until it is granted, and never reads or
-writes Secret values. An Organization admin can let it read with the access of the person it is
-serving, read-only and for at most 24 hours. Everything its tools read reaches the model, and its
+A hosted Agent runs as its own workload, with no access until it is granted. An Organization admin
+can let it act with the ordinary permissions of the person it serves, including administrative
+ones, only during that work and for at most 24 hours. Prompt injection can cause unintended actions within those rights;
+completed changes can outlast that access. Everything its tools read reaches the model, and its
 tools and extensions run with its credentials. The
-[agent security model](docs/reference/security-model.md) explains what people who build and use
+[Security and access guide](docs/reference/security-model.md) explains what people who build and use
 Agents need to know.
 
 ## Deployment boundary

{ms_tau_sdk-2.0.6.dev40 → ms_tau_sdk-2.0.7.dev41}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.6.dev40"
+version = "2.0.7.dev41"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.6.dev40 → ms_tau_sdk-2.0.7.dev41}/src/ms_tau_sdk/__init__.py

@@ -9,7 +9,7 @@ from .runtime.deployment_health import (
     RUNTIME_HEALTH_ABI_VERSION,
     register_deployment_readiness_hook,
 )
-from .runtime.requester import current_requester, requester_client
+from .runtime.requester import current_requester, platform_client
 from .settings import TauSDKSettings
 
 __all__ = [
@@ -18,6 +18,6 @@ __all__ = [
     "__version__",
     "create_app",
     "current_requester",
+    "platform_client",
     "register_deployment_readiness_hook",
-    "requester_client",
 ]

{ms_tau_sdk-2.0.6.dev40 → ms_tau_sdk-2.0.7.dev41}/src/ms_tau_sdk/agent_skills/tau_a2a_runtime_adapter/SKILL.md

@@ -23,19 +23,18 @@ The SDK owns:
 
 - projecting the authenticated Main Sequence MCP catalog into a TAU session;
 - preserving each tool's canonical name and metadata through host normalization;
-- privately attaching active caller-session proof when a tool advertises
-  `mainsequence.ai/requires-caller-session-proof/v1: true`;
-- attaching the same proof when a tool advertises `mainsequence.ai/requires-requester/v1: true`,
-  which the platform runs for the turn's requester, and refusing that tool before sending it in a
-  hosted turn that serves nobody;
+- privately attaching, to every hosted Main Sequence MCP call, the turn's caller-session proof under
+  `mainsequence.ai/caller-session-proof/v1`, and, while the turn serves a person, the same proof as
+  that person's delegation under `mainsequence.ai/delegation/v1`. No tool metadata decides it;
 - verifying the platform's signed caller or platform assertion on every inbound request of a
   hosted runtime, and admitting a request to a session or its Tasks only for the session's owner,
   an Organization admin, or the workload User of the Agent that delegated to that child session,
   which the platform's own records establish, never the `X-Caller-*` headers;
 - presenting the verified caller assertion of the request that starts a chat or A2A Message turn
-  only when it marks that turn active, so that the platform can record the turn's requester, and
-  giving extension tools that requester and requester-bound calls through `current_requester()`
-  and `requester_client()` without exposing the assertion, the lease proof, or any token;
+  only when it marks that turn active, so that the platform can record the turn's requester;
+  taking the person the turn serves only from the platform's answer to the turn start; and giving
+  extension tools that person and calls for the work through `current_requester()` and
+  `platform_client()` without exposing the assertion, the lease proof, or any token;
 - translating inbound A2A requests into the shared TAU runtime; and
 - translating runtime events and results into validated A2A responses.
 

{ms_tau_sdk-2.0.6.dev40 → ms_tau_sdk-2.0.7.dev41}/src/ms_tau_sdk/agent_skills/tau_project_customization/SKILL.md

@@ -97,10 +97,11 @@ tools do not grant new platform permissions merely because they run inside TAU.
 
 ## Acting for the person a turn serves
 
-An Agent that an Organization admin enabled for it can read platform data, and ask other platform
-applications, with the access of the person whose request a turn is serving: the requester. The
-platform keeps that authority and finds the person in its own records; the runtime only proves
-which of its sessions it is working on. Extension tools use two SDK functions and nothing else:
+An Agent that an Organization admin enabled for it can call the platform and other platform
+applications with the ordinary permissions of the person whose request a turn is serving: the
+requester. The platform keeps that authority and finds the person in its own records; the runtime
+only proves which of its sessions it is working on. Extension tools use two SDK functions and
+nothing else:
 
 ```python
 import json
@@ -108,64 +109,71 @@ import json
 from tau_agent.messages import TextContent
 from tau_agent.tools import AgentToolResult
 
-from ms_tau_sdk import current_requester, requester_client
+from ms_tau_sdk import platform_client
 
 ANALYST_DATA_RELEASE_UID = "..."  # the release of the application to ask
 
 
 async def revenue_by_region(tool_call_id, arguments, signal=None, on_update=None):
-    if current_requester() is None:
-        return AgentToolResult(content=[TextContent(text="Ask me from your own conversation.")])
+    # This tool answers each person with their own data, so it needs a person.
     try:
-        answer = await requester_client().call_release(
+        answer = await platform_client(delegation="required").call_release(
             ANALYST_DATA_RELEASE_UID,
             "POST",
             "/query",
             json={"question": "revenue by region"},
         )
     except PermissionError:
-        return AgentToolResult(content=[TextContent(text="Your access for this request ended.")])
+        return AgentToolResult(content=[TextContent(text="Ask me from your own conversation.")])
     return AgentToolResult(content=[TextContent(text=json.dumps(answer.json()["rows"]))])
 ```
 
-- `current_requester()` returns the turn's verified requester, with `uid` and `team_uids`, or
-  `None`. It is `None` for Agent callers, the platform's own calls other than a caller delivery
-  (which resumes delegated work for the person who asked), local mode, and code outside a turn.
-  Only it names the requester:
-  never take a person's UID from tool arguments, the prompt, history, or a header.
-- `requester_client()` returns a client bound to the turn. `await client.request("GET",
-  "/api/v1/...")` reads a platform API path for the requester. `await client.call_release(
-  release_uid, method, path, ...)` asks another platform application, which answers as the
-  requester. Both return an `httpx.Response`.
-- Without a requester, `requester_client()` raises a `PermissionError`. So does a call that the
-  platform refuses because the requester's access ended (`code` `requester_binding_invalid` or
-  `runtime_lease_*`): the turn is over, the access was removed, more than 24 hours passed, or the
-  Agent is not enabled. Catch it, say in plain words that the request cannot be served, and never
-  fall back to the Agent's own access.
+- `current_requester()` returns the person the turn serves, with `uid` and `team_uids`, or
+  `None`. The platform names that person when the turn starts, whoever called; it is `None` when
+  the platform names nobody, in local mode, and in code outside a turn. Only it names the
+  requester: never take a person's UID from tool arguments, the prompt, history, or a header.
+- `platform_client()` returns a client. `await client.request("GET", "/api/v1/...")` calls a
+  platform API path, and `await client.call_release(release_uid, method, path, ...)` calls another
+  platform application. Both return an `httpx.Response`.
+- By default (`delegation="auto"`) a call carries the person's delegation while the turn serves a
+  person, and is the Agent's own otherwise; the operation or application decides what it may do.
+  `delegation="none"` never carries it. `delegation="required"` raises a `PermissionError` before
+  sending when the turn serves nobody; use it in a tool that only makes sense for a person.
+- A call the platform refuses because the person's access ended (`code`
+  `requester_binding_invalid` or `runtime_lease_*`) raises a `PermissionError`: the turn is over,
+  the access was removed, more than 24 hours passed, or the Agent is not enabled. Catch it, say in
+  plain words that the request cannot be served, and never retry it as the Agent.
 
 Rules for tools that act for the requester:
 
 - Never handle proofs or tokens. The SDK attaches the session, the lease proof, and the
   credentials itself. A tool never reads, logs, stores, or forwards them, passes a path rather than
   a URL, and never sets `Authorization` or an `X-MainSequence-*` header.
-- Requester-bound calls are read-only. The platform refuses writes, sharing, and Secret values;
-  do not build tools that try them.
+- A delegated call uses the person's ordinary permissions, including administrative ones; any other
+  call uses the Agent's own. Each operation decides what it needs. Never infer write permission
+  from view access.
+- This needs the platform's matching change, deployed in the same cutover; check the deployed
+  platform and the installed SDK before depending on it.
 - Return to the model only business results, such as rows, numbers, and names. Never return the
   response object, its headers, a token, a proof, or a raw error body.
-- Keep nothing for another turn or another person. The binding ends with the turn, and a task the
-  tool leaves running has no access afterwards.
+- Keep nothing for another turn or another person. The delegation ends with the turn, and a task
+  the tool leaves running acts only as the Agent afterwards.
 - What a tool reads for a person belongs to that person's conversation. Do not write it to shared
   stores, other Agents, or external systems.
 
 People who use such an Agent are told:
 
-> **This Agent works with your identity, securely.** It reads only what you can already read, only
-> to answer your own requests, and for at most 24 hours after you ask. It cannot act as anyone else,
-> cannot change, share or delete anything, never sees your secret values, and stops the moment your
-> access ends. Your Organization's administrator approved it to work this way.
-
-The limit is plain: while it works on your request, the Agent's code can read what you can read,
-which is why only administrators decide which Agents may work this way.
+> **This Agent works with your identity.** It can read, create, change, run,
+> share or delete only what your permissions allow through supported operations,
+> only while serving your request, and for at most 24 hours after you ask. It
+> uses your ordinary permissions, including administrative permissions, and
+> access is checked on every call. Your Organization's administrator approved it
+> to work this way.
+
+The statement describes delegated calls. The Agent's own grants and trusted extension code remain
+separate authority. Prompt injection can cause unintended changes, sharing, or deletion within the
+person's permissions, and completed writes can outlast the delegation. Only Organization admins
+enable this authority.
 
 ## Validation
 

{ms_tau_sdk-2.0.6.dev40 → ms_tau_sdk-2.0.7.dev41}/src/ms_tau_sdk/api/a2a.py

@@ -20,7 +20,7 @@ from fastapi.responses import JSONResponse, StreamingResponse
 from structlog.contextvars import bind_contextvars
 from tau_agent.types import JSONValue
 
-from ms_tau_sdk.backend.assertions import CallerAssertion
+from ms_tau_sdk.backend.assertions import CallerAssertion, VerifiedCaller
 from ms_tau_sdk.backend.client import MainSequenceClient
 from ms_tau_sdk.backend.models import (
     AgentTask,
@@ -63,7 +63,7 @@ from ms_tau_sdk.runtime.provenance import (
     TurnProvenance,
     turn_provenance_from_request,
 )
-from ms_tau_sdk.runtime.requester import CallerDelivery, Requester, canonical_requester_uid
+from ms_tau_sdk.runtime.requester import CallerDelivery
 from ms_tau_sdk.runtime.task_context import (
     TaskExecutionContext,
     active_task_execution,
@@ -920,22 +920,14 @@ def _presented_assertion(caller_assertion: CallerAssertion | None) -> dict[str,
     return {"caller_assertion": token} if token else {}
 
 
-def _requester_named_by_task(
-    task: AgentTask,
-    caller_assertion: CallerAssertion | None,
-) -> Requester | None:
-    """Return the request's verified caller when the platform recorded that person as requester.
+def _request_caller(caller_assertion: CallerAssertion | None) -> VerifiedCaller | None:
+    """Return the verified caller of a request that runs a Task attempt itself.
 
-    This is the requester of a Task attempt that the request itself runs: the platform's Task
-    answer must name the same User, as a person, as ``requester_user_uid``.
+    The platform's answer to the attempt's turn start names the person the attempt serves; this
+    caller only supplies that person's teams, when it is that person.
     """
 
-    if caller_assertion is None or caller_assertion.caller_is_workload:
-        return None
-    caller = caller_assertion.caller
-    if task.requester_identity_type != "human" or task.requester_user_uid != caller.uid:
-        return None
-    return Requester(uid=caller.uid, team_uids=caller.team_uids)
+    return caller_assertion.caller if caller_assertion is not None else None
 
 
 async def _wait_for_task_return_state(
@@ -1289,7 +1281,7 @@ async def _execute_task(
     config: TauSDKSettings | None = None,
     dispatch_uid: str | None = None,
     claim: _ClaimedTask | None = None,
-    requester: Requester | None = None,
+    caller: VerifiedCaller | None = None,
 ) -> dict[str, Any]:
     bind_contextvars(
         a2a_task_id=task.task_id,
@@ -1322,7 +1314,7 @@ async def _execute_task(
         attempt_uid=claim.attempt_uid,
         holder_id=claim.holder_id,
         lease_token=claim.lease_token,
-        requester=requester,
+        caller=caller,
     )
     try:
         await writer.ensure_not_canceled(force=True)
@@ -1408,7 +1400,7 @@ async def _schedule_task_accelerator(
     max_output_bytes: int,
     provenance: TurnProvenance,
     config: TauSDKSettings,
-    requester: Requester | None = None,
+    caller: VerifiedCaller | None = None,
 ) -> bool:
     """Best-effort local start after durable creation; dispatch remains recovery owner."""
 
@@ -1440,7 +1432,7 @@ async def _schedule_task_accelerator(
         provenance=provenance,
         config=config,
         claim=claim,
-        requester=requester,
+        caller=caller,
     )
     try:
         _background, scheduled = manager.create_a2a_task_execution(
@@ -1680,7 +1672,7 @@ async def _stream_task_events(
     provenance: TurnProvenance,
     config: TauSDKSettings | None = None,
     history_length: int = DEFAULT_TASK_HISTORY_LENGTH,
-    requester: Requester | None = None,
+    caller: VerifiedCaller | None = None,
 ) -> AsyncIterator[dict[str, Any]]:
     claim = await _claim_backend_task(client, manager, task)
     resolved = config or manager.settings
@@ -1700,7 +1692,7 @@ async def _stream_task_events(
         attempt_uid=claim.attempt_uid,
         holder_id=claim.holder_id,
         lease_token=claim.lease_token,
-        requester=requester,
+        caller=caller,
     )
     working = await client.get_task(task.uid)
     working = await _task_with_history(client, working, history_length=history_length)
@@ -1878,7 +1870,7 @@ def _message_stream_response(
     history_length: int = DEFAULT_TASK_HISTORY_LENGTH,
     json_rpc: bool = False,
     request_id: object = None,
-    requester: Requester | None = None,
+    caller: VerifiedCaller | None = None,
 ) -> StreamingResponse:
     async def stream() -> AsyncIterator[bytes]:
         try:
@@ -1892,7 +1884,7 @@ def _message_stream_response(
                 provenance=provenance,
                 config=config,
                 history_length=history_length,
-                requester=requester,
+                caller=caller,
             ):
                 yield _sse(
                     _stream_payload(
@@ -2149,21 +2141,6 @@ def _durable_task_execution_input(
     return prompt, contract, provenance
 
 
-def _dispatched_requester(body: dict[str, Any], config: TauSDKSettings) -> Requester | None:
-    """Return the requester that the platform's verified dispatch or caller delivery names.
-
-    Only a person is a requester: an Agent's workload User never is. A runtime that does not
-    verify the platform's assertion on its internal routes takes no requester from them.
-    """
-
-    if config.local_mode or config.request_identity_mode != "assertion":
-        return None
-    if body.get("requester_identity_type") != "human":
-        return None
-    uid = canonical_requester_uid(body.get("requester_user_uid"))
-    return Requester(uid=uid) if uid is not None else None
-
-
 @router.post("/internal/a2a/task-dispatch", status_code=200)
 async def task_dispatch_available(
     body: dict[str, Any],
@@ -2199,7 +2176,6 @@ async def task_dispatch_available(
             provenance=provenance,
             config=config,
             claim=claim,
-            requester=_dispatched_requester(body, config),
         ),
         name=f"a2a-task-{task.task_id}",
     )
@@ -2242,7 +2218,6 @@ async def _resume_caller_delivery(
 async def task_caller_delivery_available(
     body: dict[str, Any],
     manager: RuntimeManagerDep,
-    config: SettingsDep,
 ) -> dict[str, Any]:
     delivery_uid = str(body.get("delivery_uid") or "").strip()
     task_uid = str(body.get("task_uid") or "").strip()
@@ -2289,10 +2264,7 @@ async def task_caller_delivery_available(
             task_id=task_id,
             task_status=task_status,
             caller_agent_session_uid=caller_agent_session_uid,
-            delivery=CallerDelivery(
-                uid=delivery_uid,
-                requester=_dispatched_requester(body, config),
-            ),
+            delivery=CallerDelivery(uid=delivery_uid),
         ),
         name=f"a2a-caller-delivery-{delivery_uid}",
     )
@@ -2381,7 +2353,7 @@ async def message_send(
             max_output_bytes=config.max_turn_output_bytes,
             provenance=provenance,
             config=config,
-            requester=_requester_named_by_task(task, caller_assertion),
+            caller=_request_caller(caller_assertion),
         )
         if return_immediately:
             task = await _task_with_history(client, task, history_length=history_length)
@@ -2416,7 +2388,7 @@ async def message_send(
                 max_output_bytes=config.max_turn_output_bytes,
                 provenance=provenance,
                 config=config,
-                requester=_requester_named_by_task(task, caller_assertion),
+                caller=_request_caller(caller_assertion),
             )
             if return_immediately:
                 task = await _task_with_history(client, task, history_length=history_length)
@@ -2556,7 +2528,7 @@ async def message_stream(
         provenance=provenance,
         config=config,
         history_length=history_length,
-        requester=_requester_named_by_task(task, caller_assertion),
+        caller=_request_caller(caller_assertion),
     )
 
 
@@ -2808,7 +2780,7 @@ async def json_rpc(
                 history_length=history_length,
                 json_rpc=True,
                 request_id=request_id,
-                requester=_requester_named_by_task(task, caller_assertion),
+                caller=_request_caller(caller_assertion),
             )
         elif method in {"GetTask", "tasks/get"}:
             result = await get_task(

{ms_tau_sdk-2.0.6.dev40 → ms_tau_sdk-2.0.7.dev41}/src/ms_tau_sdk/backend/client.py

@@ -88,8 +88,8 @@ PATH_IDENTIFIER_PATTERN = re.compile(
     r"(?<=/)(?:[0-9a-f]{8}-[0-9a-f-]{27,}|[0-9]+)(?=/|$)",
     re.IGNORECASE,
 )
-# A requester-bound call names the session the runtime is serving and proves the runtime's lease on
-# it, beside the runtime's own credential. The platform finds the person in its own record of that
+# A delegated call names the session the runtime is serving and proves the runtime's lease on it,
+# beside the runtime's own credential. The platform finds the person in its own record of that
 # session's active turn or Task attempt: the call never names a person.
 ACTING_FOR_SESSION_HEADER = "X-MainSequence-Acting-For-Session"
 LEASE_HOLDER_HEADER = "X-MainSequence-Lease-Holder"
@@ -119,7 +119,7 @@ def _field_error_paths(value: object, *, prefix: str = "") -> list[str]:
 
 @dataclass(frozen=True, slots=True)
 class LeaseProof:
-    """The session a requester-bound call serves, and the runtime's lease on that session."""
+    """The session a delegated call serves, and the runtime's lease on that session."""
 
     session_uid: str
     holder_id: str
@@ -601,14 +601,18 @@ class MainSequenceClient:
         self,
         release_uid: str,
         *,
-        proof: LeaseProof,
+        proof: LeaseProof | None,
     ) -> ReleaseRuntimeAccess:
-        """Obtain access to an application release as a requester-bound call."""
+        """Obtain access to an application release.
+
+        With ``proof`` the call carries the delegation of the person the turn serves, and the
+        token acts for that person. Without it the token is the runtime's own.
+        """
 
         data = await self._request(
             "POST",
             resource_release_runtime_access(release_uid),
-            headers=proof.headers(),
+            headers=proof.headers() if proof is not None else None,
         )
         try:
             return ReleaseRuntimeAccess.model_validate(data)
@@ -617,12 +621,12 @@ class MainSequenceClient:
         # Raised outside the handler: a validation error repeats its input, which holds the token.
         raise BackendError("Backend release access response is invalid")
 
-    async def requester_bound_request(
+    async def platform_request(
         self,
         method: str,
         path: str,
         *,
-        proof: LeaseProof,
+        proof: LeaseProof | None,
         params: Any = None,
         json: Any = None,
         content: bytes | str | None = None,
@@ -630,11 +634,12 @@ class MainSequenceClient:
         files: Any = None,
         headers: Mapping[str, str] | None = None,
     ) -> httpx.Response:
-        """Send one requester-bound call to a platform path, with the runtime's own credential.
+        """Send one call to a platform path, with the runtime's own credential.
 
-        ``path`` is relative to the configured platform base URL, and the call never leaves that
-        origin or follows a redirect. The answer is returned on a copy of the request that carries
-        no header, so neither the credential nor the lease proof travels with it.
+        With ``proof`` the call also carries the delegation of the person the turn serves. ``path``
+        is relative to the configured platform base URL, and the call never leaves that origin or
+        follows a redirect. The answer is returned on a copy of the request that carries no header,
+        so neither the credential nor the lease proof travels with it.
         """
 
         base = httpx.URL(self.settings.backend_url)
@@ -644,7 +649,8 @@ class MainSequenceClient:
             base.host,
             base.port,
         ):
-            raise ValueError("A requester-bound call takes a path on the platform's base URL")
+            raise ValueError("A platform call takes a path on the platform's base URL")
+        delegation = proof.headers() if proof is not None else {}
         force_auth = False
         operation = _dependency_operation(method, path)
         while True:
@@ -661,7 +667,7 @@ class MainSequenceClient:
                     files=files,
                     headers={
                         **dict(headers or {}),
-                        **proof.headers(),
+                        **delegation,
                         **await self.auth.headers(force=force_auth),
                     },
                     follow_redirects=False,
@@ -671,22 +677,22 @@ class MainSequenceClient:
             if failure:
                 logger.warning(
                     "dependency.call.failed",
-                    message="Requester-bound backend call failed",
+                    message="Platform call failed",
                     dependency_operation=operation,
                     target_system="mainsequence_backend",
-                    requester_bound=True,
+                    requester_bound=proof is not None,
                     duration_ms=round((time.monotonic() - started_at) * 1000, 3),
                     error_type=failure,
                     outcome="failed",
                 )
                 # Raised outside the handler: the error holds the request and its credentials.
-                raise BackendError(f"Requester-bound backend call failed: {failure}")
+                raise BackendError(f"Platform call failed: {failure}")
             logger.info(
                 "dependency.call.completed",
-                message="Requester-bound backend call completed",
+                message="Platform call completed",
                 dependency_operation=operation,
                 target_system="mainsequence_backend",
-                requester_bound=True,
+                requester_bound=proof is not None,
                 status_code=response.status_code,
                 duration_ms=round((time.monotonic() - started_at) * 1000, 3),
                 outcome=(