nominal 1.166.0__tar.gz → 1.167.0__tar.gz

{nominal-1.166.0 → nominal-1.167.0}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [1.167.0](https://github.com/nominal-io/nominal-client/compare/v1.166.0...v1.167.0) (2026-09-10)
+
+
+### Features
+
+* add markings support for datasets, connections, and videos ([#930](https://github.com/nominal-io/nominal-client/issues/930)) ([9e8503f](https://github.com/nominal-io/nominal-client/commit/9e8503f259a91141d54c8ff87067c0076bd78464))
+
+
+### Bug Fixes
+
+* restrict plaintext grpc to literal loopback addresses ([#956](https://github.com/nominal-io/nominal-client/issues/956)) ([445f53e](https://github.com/nominal-io/nominal-client/commit/445f53ef66b75be053bbc9c3bde297262d46a88d))
+* use LEGACY backing for read-only dataset fixture ([#965](https://github.com/nominal-io/nominal-client/issues/965)) ([ebf4376](https://github.com/nominal-io/nominal-client/commit/ebf43762935ce870eb0efe6ee77be171e99a29c8))
+
 ## [1.166.0](https://github.com/nominal-io/nominal-client/compare/v1.165.0...v1.166.0) (2026-09-08)
 
 

{nominal-1.166.0 → nominal-1.167.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: nominal
-Version: 1.166.0
+Version: 1.167.0
 Summary: Automate Nominal workflows in Python
 Project-URL: Homepage, https://nominal.io
 Project-URL: Documentation, https://docs.nominal.io
@@ -21,8 +21,8 @@ Requires-Dist: click<9,>=8
 Requires-Dist: conjure-python-client<4,>=3.1.0
 Requires-Dist: exceptiongroup>=1.3.0
 Requires-Dist: ffmpeg-python>=0.2.0
-Requires-Dist: nominal-api-protos==0.1379.0
-Requires-Dist: nominal-api==0.1379.0
+Requires-Dist: nominal-api-protos==0.1437.0
+Requires-Dist: nominal-api==0.1437.0
 Requires-Dist: nominal-streaming==0.9.6; platform_python_implementation == 'CPython' and ((sys_platform == 'win32' and platform_machine == 'AMD64') or (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'linux' and (platform_machine == 'x86_64' or platform_machine == 'armv7l' or platform_machine == 'aarch64' or platform_machine == 'arm64')))
 Requires-Dist: pandas>=2.0.0
 Requires-Dist: polars>=1.0.0

{nominal-1.166.0 → nominal-1.167.0}/nominal/cli/container.py

@@ -209,6 +209,10 @@ def register_image(
         nom container extractor set-active-image -r "$EXTRACTOR_RID" -i "$IMAGE_RID"
 
     The registered image starts PENDING and must be activated with `set-active-image` once READY.
+
+    Build the image for amd64 (`docker build --platform linux/amd64`). Nominal runs extractor
+    images on amd64 and registration does not check the tarball's architecture, so an arm64 image
+    registers and activates, then fails at ingest with an exec format error.
     """
     parsed = _parse_config(_load_config(config_file))
     tag = tag if tag is not None else parsed.tag

{nominal-1.166.0 → nominal-1.167.0}/nominal/cli/util/verify_connection.py

@@ -12,7 +12,10 @@ def validate_token_url(token: str, base_url: str, workspace_rid: str | None) ->
     docs_link = "https://docs.nominal.io/core/sdk/python-client/authentication"
     status_code = 200
     err_msg = ""
-    client = NominalClient.create(base_url, token)
+    try:
+        client = NominalClient.create(base_url, token)
+    except NominalConfigError as err:
+        raise click.ClickException(f"Invalid client configuration: {err}") from err
 
     # first, validate that the api key is correct for the tenant / org by fetching the
     # current user using the api key

{nominal-1.166.0 → nominal-1.167.0}/nominal/core/__init__.py

@@ -24,10 +24,12 @@ from nominal.core.data_review import CheckViolation, DataReview, DataReviewBuild
 from nominal.core.dataset import Dataset
 from nominal.core.dataset_file import DatasetFile, IngestWaitType, as_files_ingested, wait_for_files_to_ingest
 from nominal.core.datasource import DataSource
+from nominal.core.elements import Symbol, SymbolKind
 from nominal.core.event import Event
 from nominal.core.filetype import FileType, FileTypes
 from nominal.core.ingestion_job import IngestionJob, IngestionJobStatus, IngestType
 from nominal.core.log import LogPoint
+from nominal.core.marking import Marking
 from nominal.core.run import Run
 from nominal.core.secret import Secret
 from nominal.core.unit import Unit, UnitLike
@@ -75,11 +77,14 @@ __all__ = [
     "LinkDict",
     "LogPoint",
     "LogStream",
+    "Marking",
     "Comment",
     "NominalClient",
     "Run",
     "SearchEventOriginType",
     "Secret",
+    "Symbol",
+    "SymbolKind",
     "TimestampMetadata",
     "Unit",
     "UnitLike",

{nominal-1.166.0 → nominal-1.167.0}/nominal/core/_clientsbunch.py

@@ -34,8 +34,10 @@ from nominal.core._utils.grpc_tools import GRPCStub, create_grpc_channel, transl
 from nominal.core._utils.networking import (
     HeaderProvider,
     create_conjure_client_factory,
+    validate_api_base_url,
 )
 from nominal.core.exceptions import NominalConfigError
+from nominal.protos.authorization.markings.v1 import markings_pb2_grpc
 from nominal.protos.authorization.roles.v1 import roles_pb2_grpc
 from nominal.protos.comments.v1 import comments_pb2_grpc
 from nominal.protos.event.v2 import event_pb2_grpc
@@ -173,6 +175,7 @@ class ClientsBunch:
     containerized_extractor: containerized_extractor_pb2_grpc.ContainerizedExtractorServiceStub
     event: event_pb2_grpc.EventServiceStub
     ingest_v2: ingest_service_pb2_grpc.IngestServiceStub
+    markings: markings_pb2_grpc.MarkingServiceStub
     registry: registry_pb2_grpc.RegistryServiceStub
     roles: roles_pb2_grpc.RoleServiceStub
     sandbox_workspace: sandbox_workspace_pb2_grpc.SandboxWorkspaceServiceStub
@@ -277,6 +280,7 @@ class ClientsBunch:
         *,
         header_provider: HeaderProvider | None = None,
     ) -> Self:
+        validate_api_base_url(base_url)
         app_base_url = api_base_url_to_app_base_url(base_url)
 
         def client_factory(service_class: type[TService]) -> TService:
@@ -336,6 +340,7 @@ class ClientsBunch:
             containerized_extractor=grpc_factory(containerized_extractor_pb2_grpc.ContainerizedExtractorServiceStub),
             event=grpc_factory(event_pb2_grpc.EventServiceStub),
             ingest_v2=grpc_factory(ingest_service_pb2_grpc.IngestServiceStub),
+            markings=grpc_factory(markings_pb2_grpc.MarkingServiceStub),
             registry=grpc_factory(registry_pb2_grpc.RegistryServiceStub),
             roles=grpc_factory(roles_pb2_grpc.RoleServiceStub),
             sandbox_workspace=grpc_factory(sandbox_workspace_pb2_grpc.SandboxWorkspaceServiceStub),

{nominal-1.166.0 → nominal-1.167.0}/nominal/core/_utils/grpc_tools.py

@@ -6,7 +6,7 @@ generated stub to, so every stub shares that one channel.
 
 The channel is configured to track the conjure HTTP transport as closely as gRPC allows:
 
-- HTTP URLs select plaintext gRPC on any host; HTTPS URLs select TLS.
+- HTTP URLs allow plaintext gRPC only for literal loopback IP addresses; HTTPS URLs select TLS.
 - For TLS, roots combine the configured trust store and the OS trust store (`_grpc_root_certificates`).
 - Retry mirrors conjure's `RetryWithJitter` (`_service_config_json`).
 - Per-call auth metadata and a default deadline are injected by client interceptors, so call sites never
@@ -29,7 +29,7 @@ from urllib.parse import urlparse
 import grpc
 from conjure_python_client import ServiceConfiguration
 
-from nominal.core._utils.networking import HeaderProvider, raise_header_conflict
+from nominal.core._utils.networking import HeaderProvider, raise_header_conflict, validate_api_base_url
 from nominal.core.exceptions import (
     NominalAlreadyExistsError,
     NominalAuthenticationError,
@@ -254,12 +254,27 @@ def create_grpc_channel(
     auth_header: str,
     header_provider: HeaderProvider | None,
 ) -> grpc.Channel:
-    """Build the shared gRPC channel, using plaintext for HTTP URLs and TLS otherwise.
+    """Build the shared gRPC channel, allowing plaintext only for loopback HTTP URLs.
 
     Configures gzip compression, native retry, lifted message-size limits, the SDK user-agent, and the
     auth-metadata + default-deadline interceptors. TLS channels use the union trust bundle; plaintext
     channels do not load TLS credentials. All of a client's gRPC stubs share this one channel.
+
+    Raises:
+        NominalConfigError: If the API URL is malformed, contains user information, or uses HTTP
+            without a literal loopback address.
     """
+    channel = _build_grpc_channel(api_base_url, service_config, user_agent)
+    # The two interceptors are order-independent: one rewrites metadata, the other the deadline.
+    return grpc.intercept_channel(
+        channel,
+        _AuthMetadataInterceptor(auth_header, header_provider),
+        _DefaultDeadlineInterceptor(service_config.read_timeout),
+    )
+
+
+def _build_grpc_channel(api_base_url: str, service_config: ServiceConfiguration, user_agent: str) -> grpc.Channel:
+    parsed = validate_api_base_url(api_base_url)
     options = [
         ("grpc.primary_user_agent", user_agent),
         ("grpc.enable_retries", 1),
@@ -267,22 +282,15 @@ def create_grpc_channel(
         ("grpc.max_send_message_length", _MAX_MESSAGE_LENGTH),
         ("grpc.max_receive_message_length", _MAX_MESSAGE_LENGTH),
     ]
-    target = api_base_url_to_grpc_target(api_base_url)
-    if urlparse(api_base_url).scheme == "http":
-        channel = grpc.insecure_channel(target, options=options, compression=grpc.Compression.Gzip)
-    else:
-        credentials = grpc.ssl_channel_credentials(
-            root_certificates=_grpc_root_certificates(
-                None if service_config.security is None else service_config.security.trust_store_path
-            )
+    target = parsed.netloc
+    if parsed.scheme == "http":
+        return grpc.insecure_channel(target, options=options, compression=grpc.Compression.Gzip)
+    credentials = grpc.ssl_channel_credentials(
+        root_certificates=_grpc_root_certificates(
+            None if service_config.security is None else service_config.security.trust_store_path
         )
-        channel = grpc.secure_channel(target, credentials, options=options, compression=grpc.Compression.Gzip)
-    # The two interceptors are order-independent: one rewrites metadata, the other the deadline.
-    return grpc.intercept_channel(
-        channel,
-        _AuthMetadataInterceptor(auth_header, header_provider),
-        _DefaultDeadlineInterceptor(service_config.read_timeout),
     )
+    return grpc.secure_channel(target, credentials, options=options, compression=grpc.Compression.Gzip)
 
 
 _GRPC_STATUS_TO_EXCEPTION: dict[grpc.StatusCode, type[NominalError]] = {

{nominal-1.166.0 → nominal-1.167.0}/nominal/core/_utils/networking.py

@@ -1,12 +1,14 @@
 from __future__ import annotations
 
 import gzip
+import ipaddress
 import logging
 import ssl
 import threading
 from abc import ABC, abstractmethod
 from dataclasses import dataclass
 from typing import Any, Callable, Mapping, Type, TypeVar
+from urllib.parse import ParseResult, urlparse
 
 import requests
 import truststore
@@ -17,7 +19,7 @@ from requests.adapters import DEFAULT_POOLSIZE, CaseInsensitiveDict, HTTPAdapter
 from urllib3.connection import HTTPConnection
 from urllib3.util.retry import Retry
 
-from nominal.core.exceptions import HeaderConflictError
+from nominal.core.exceptions import HeaderConflictError, NominalConfigError
 
 logger = logging.getLogger(__name__)
 
@@ -25,6 +27,48 @@ T = TypeVar("T")
 
 GZIP_COMPRESSION_LEVEL = 1
 
+_LOOPBACK_NETWORKS = (ipaddress.ip_network("127.0.0.0/8"), ipaddress.ip_network("::1/128"))
+
+
+def _is_loopback_address(host: str | None) -> bool:
+    if host is None or "%" in host:
+        # Network membership alone does not exclude IPv6 scope identifiers.
+        return False
+    try:
+        address = ipaddress.ip_address(host)
+    except ValueError:
+        return False
+    # Explicit networks keep IPv4-mapped IPv6 excluded regardless of Python's is_loopback semantics.
+    return any(address in network for network in _LOOPBACK_NETWORKS)
+
+
+def validate_api_base_url(api_base_url: str) -> ParseResult:
+    """Validate the client-wide URL policy without resolving hostnames.
+
+    Raises:
+        NominalConfigError: If the URL is malformed, contains user information, or uses HTTP
+            without a literal loopback address.
+    """
+    try:
+        parsed = urlparse(api_base_url)
+        host = parsed.hostname
+        parsed.port  # Validate the port without including untrusted URL contents in errors.
+    except ValueError:
+        raise NominalConfigError("Invalid API base URL: check its hostname and port.") from None
+    if not parsed.netloc or host is None:
+        raise NominalConfigError("Invalid API base URL: a hostname is required.")
+    if parsed.username is not None or parsed.password is not None:
+        raise NominalConfigError(
+            f"API base URL for host {host!r} must not contain user information; pass the token separately."
+        )
+    if parsed.scheme == "http" and not _is_loopback_address(host):
+        raise NominalConfigError(
+            f"HTTP API base URL for host {host!r} requires a literal loopback IP address "
+            "(127.0.0.0/8 or [::1]). Hostnames are not resolved; use 127.0.0.1 instead of localhost. "
+            "Use an https:// API URL for remote deployments."
+        )
+    return parsed
+
 
 class HeaderProvider(ABC):
     @abstractmethod

{nominal-1.166.0 → nominal-1.167.0}/nominal/core/_utils/pagination_tools.py

@@ -21,6 +21,7 @@ from nominal_api import (
 
 from nominal.core._utils.grpc_tools import translate_grpc_errors
 from nominal.core._utils.query_tools import ArchiveStatusFilter
+from nominal.protos.authorization.markings.v1 import markings_pb2, markings_pb2_grpc
 from nominal.protos.event.v2 import event_pb2, event_pb2_grpc
 from nominal.protos.ingest.v2 import containerized_extractor_pb2, containerized_extractor_pb2_grpc
 from nominal.protos.registry.v2 import registry_pb2, registry_pb2_grpc
@@ -243,6 +244,27 @@ def search_runs_by_asset_paginated(
         yield from response.results
 
 
+def search_markings_paginated(
+    markings: markings_pb2_grpc.MarkingServiceStub,
+    query: markings_pb2.SearchMarkingsQuery,
+) -> Iterable[markings_pb2.MarkingMetadata]:
+    """Yield markings matching a query, oldest first.
+
+    Unlike its neighbours, the request type carries no sort options: the service always orders by
+    creation time ascending. Archived markings are excluded by the service and never appear here.
+    """
+
+    def factory(page_token: str | None) -> markings_pb2.SearchMarkingsRequest:
+        return markings_pb2.SearchMarkingsRequest(
+            page_size=DEFAULT_PAGE_SIZE,
+            query=query,
+            next_page_token=page_token,
+        )
+
+    for response in paginate_grpc(markings.SearchMarkings, request_factory=factory):
+        yield from response.marking_metadatas
+
+
 def search_secrets_paginated(
     secrets: secrets_pb2_grpc.SecretServiceStub,
     query: secrets_pb2.SearchSecretsQuery,

{nominal-1.166.0 → nominal-1.167.0}/nominal/core/_utils/query_tools.py

@@ -20,6 +20,7 @@ from nominal_api import (
 
 from nominal.core._event_types import EventType, SearchEventOriginType
 from nominal.core._utils.api_tools import rid_from_instance_or_string
+from nominal.protos.authorization.markings.v1 import markings_pb2
 from nominal.protos.event.v2 import event_pb2
 from nominal.protos.registry.v2 import registry_pb2
 from nominal.protos.secrets.v1 import secrets_pb2
@@ -152,6 +153,18 @@ def _backfill_workbook_template_archive_query_clause(
     raise ValueError(f"Unexpected archive_status for workbook template search: {archive_status}")
 
 
+def create_search_markings_query(id_substring: str | None = None) -> markings_pb2.SearchMarkingsQuery:
+    """Build a marking search query. With no arguments, matches every marking in the organization."""
+    queries = []
+    if id_substring is not None:
+        queries.append(markings_pb2.SearchMarkingsQuery(id_exact_substring_search=id_substring))
+    # `and` is a Python keyword, and generated typing stubs cannot expose it as a named argument.
+    # Unlike most search queries in this API, `and` holds a message wrapping the list, not a repeated field.
+    return markings_pb2.SearchMarkingsQuery(
+        **{"and": markings_pb2.SearchMarkingsQueryList(queries=queries)}  # type: ignore[arg-type]
+    )
+
+
 def create_search_secrets_query(
     search_text: str | None = None,
     labels: Sequence[str] | None = None,

{nominal-1.166.0 → nominal-1.167.0}/nominal/core/client.py

@@ -93,6 +93,7 @@ from nominal.core.dataset import (
 )
 from nominal.core.dataset_file import DatasetFile
 from nominal.core.datasource import DataSource
+from nominal.core.elements import Symbol
 from nominal.core.event import Event, _create_event, _get_event, _get_events, _search_events
 from nominal.core.exceptions import (
     LegacyVideoDeprecationWarning,
@@ -103,6 +104,14 @@ from nominal.core.exceptions import (
 )
 from nominal.core.filetype import FileType, FileTypes
 from nominal.core.ingestion_job import IngestionJob, IngestionJobStatus
+from nominal.core.marking import (
+    Marking,
+    _create_marking,
+    _get_marking,
+    _get_marking_by_id,
+    _marking_rids,
+    _search_markings,
+)
 from nominal.core.run import Run, _create_run
 from nominal.core.secret import Secret
 from nominal.core.streaming_checklist import _iter_list_streaming_checklists
@@ -159,6 +168,10 @@ class NominalClient:
                 your corporate CA PEM if you are behind a TLS-inspecting proxy.
             connect_timeout: Request connection timeout.
             extra_headers: Extra request headers, either as a mapping or HeaderProvider.
+
+        Raises:
+            NominalConfigError: If the base URL is malformed, contains user information, or uses HTTP
+                without a literal loopback IP. This prevents client construction even for HTTP-only usage.
         """
         config = NominalConfig.from_yaml()
         prof = config.get_profile(profile)
@@ -199,6 +212,10 @@ class NominalClient:
                 your corporate CA PEM if you are behind a TLS-inspecting proxy.
             connect_timeout: Request connection timeout.
             extra_headers: Extra request headers, either as a mapping or HeaderProvider.
+
+        Raises:
+            NominalConfigError: If the base URL is malformed, contains user information, or uses HTTP
+                without a literal loopback IP. This prevents client construction even for HTTP-only usage.
         """
         trust_store_path = certifi.where() if trust_store_path is None else trust_store_path
         timeout_seconds = connect_timeout.total_seconds() if isinstance(connect_timeout, timedelta) else connect_timeout
@@ -244,6 +261,10 @@ class NominalClient:
         workspace_rid: Optional workspace RID to pin the client to for operations that require a single
             workspace. If not provided, those operations resolve a default workspace client-side when needed.
         extra_headers: Extra request headers, either as a mapping or HeaderProvider.
+
+        Raises:
+            NominalConfigError: If the base URL is malformed, contains user information, or uses HTTP
+                without a literal loopback IP. This prevents client construction even for HTTP-only usage.
         """
         if token is None:
             token = _config.get_token(base_url)
@@ -537,6 +558,80 @@ class NominalClient:
         )
         return list(self._iter_search_secrets(query, archive_status))
 
+    def create_marking(
+        self,
+        id: str,
+        *,
+        description: str | None = None,
+        authorized_groups: Sequence[str] = (),
+        symbol: Symbol | None = None,
+        color: str | None = None,
+    ) -> Marking:
+        """Create a marking in the current organization.
+
+        Args:
+            id: Human-readable identifier for the marking, unique within the organization. Must be
+                lowercase alphanumeric characters optionally separated by hyphens, starting with a
+                letter, e.g. `export-controlled`.
+            description: Human readable description of the marking.
+            authorized_groups: RIDs of the groups authorized to access data sources carrying
+                this marking.
+            symbol: Symbol identifying the marking in the Nominal app.
+            color: Six-digit hex color identifying the marking in the Nominal app, e.g. `#cc0000`.
+                Either case is accepted; the value is lowercased before being sent.
+
+        Returns:
+            Reference to the created marking.
+
+        Raises:
+            ValueError: If `id` is not a valid marking id, or `color` is not a valid hex color.
+            NominalError: If creation fails, including when the caller is not an organization admin
+                or a marking with this id already exists.
+        """
+        return _create_marking(
+            self._clients,
+            id=id,
+            description=description,
+            authorized_groups=authorized_groups,
+            symbol=symbol,
+            color=color,
+        )
+
+    def get_marking(self, rid: str) -> Marking:
+        """Retrieve a marking by RID.
+
+        Raises:
+            NominalNotFoundError: If no marking with the given RID exists.
+            NominalPermissionDeniedError: If the caller cannot read it.
+        """
+        return _get_marking(self._clients, rid)
+
+    def get_marking_by_id(self, id: str) -> Marking:
+        """Retrieve a marking by its human-readable id, unique within the organization.
+
+        Raises:
+            ValueError: If `id` is not a valid marking id.
+            NominalNotFoundError: If no marking with the given id exists.
+            NominalPermissionDeniedError: If the caller cannot read it.
+        """
+        return _get_marking_by_id(self._clients, id)
+
+    def search_markings(self, id_substring: str | None = None) -> Sequence[Marking]:
+        """Search markings in the current organization, oldest first.
+
+        Args:
+            id_substring: Substring that a marking's id must contain to be included.
+
+        Returns:
+            All markings matching the given conditions.
+
+        Note:
+            Markings are scoped to an organization rather than a workspace, so this search takes no
+            workspace filter. Archived markings are never returned; fetch them by RID with
+            `get_marking` instead.
+        """
+        return _search_markings(self._clients, id_substring=id_substring)
+
     def _iter_search_videos(
         self,
         query: scout_video_api.SearchVideosQuery,
@@ -768,7 +863,7 @@ class NominalClient:
         labels: Sequence[str] = (),
         properties: Mapping[str, str] | None = None,
         prefix_tree_delimiter: str | None = None,
-        markings: Sequence[str] | None = None,
+        markings: Sequence[Marking | str] | None = None,
     ) -> Dataset:
         """Create an empty dataset.
 
@@ -778,7 +873,8 @@ class NominalClient:
             labels: Text labels to apply to the created dataset
             properties: Key-value properties to apply to the cleated dataset
             prefix_tree_delimiter: If present, the delimiter to represent tiers when viewing channels hierarchically.
-            markings: If present, RIDs of markings to apply to the created dataset
+            markings: If present, markings (or marking RIDs) applied to the dataset. Sent as part of
+                the creation request rather than applied in a follow-up call.
 
         Returns:
             Reference to the created dataset in Nominal.
@@ -791,7 +887,7 @@ class NominalClient:
             labels=labels,
             properties=properties,
             workspace_rid=self._clients.resolve_default_workspace_rid(),
-            marking_rids=markings,
+            marking_rids=_marking_rids(markings),
         )
         dataset = Dataset._from_conjure(self._clients, response)
 
@@ -812,6 +908,7 @@ class NominalClient:
         description: str | None = None,
         labels: Sequence[str] = (),
         properties: Mapping[str, str] | None = None,
+        markings: Sequence[Marking | str] | None = None,
     ) -> Video:
         """Create an empty video to append video files to.
 
@@ -820,6 +917,8 @@ class NominalClient:
             description: Description of the video to create in nominal
             labels: Labels to apply to the video in nominal
             properties: Properties to apply to the video in nominal
+            markings: If present, markings (or marking RIDs) applied to the video. Sent as part of
+                the creation request rather than applied in a follow-up call.
 
         Returns:
             Handle to the created video
@@ -832,6 +931,7 @@ class NominalClient:
             labels=labels,
             properties=properties,
             workspace_rid=self._clients.resolve_default_workspace_rid(),
+            marking_rids=_marking_rids(markings),
         )
         return Video._from_conjure(self._clients, response)
 
@@ -1077,6 +1177,7 @@ class NominalClient:
         datasource_description: str | None = None,
         *,
         required_tag_names: list[str] | None = None,
+        markings: Sequence[Marking | str] | None = None,
     ) -> StreamingConnection:
         workspace_rid = self._clients.resolve_default_workspace_rid()
         datasource_response = self._clients.storage.create(
@@ -1109,7 +1210,7 @@ class NominalClient:
                 available_tag_values={},
                 should_scrape=True,
                 workspace=workspace_rid,
-                marking_rids=[],
+                marking_rids=_marking_rids(markings),
             ),
         )
         conn = Connection._from_conjure(self._clients, connection_response)

{nominal-1.166.0 → nominal-1.167.0}/nominal/core/containerized_extractor.py

@@ -161,8 +161,12 @@ class ContainerizedExtractor(HasRid, RefreshableGrpcMixin[containerized_extracto
         This extractor instance is unmodified. Tags are immutable — registering an already-registered
         tag raises `NominalAlreadyExistsError`.
 
+        Nominal runs extractor images on amd64, so build with `--platform linux/amd64`. Registration
+        does not check the tarball's architecture: an arm64 image (the default on Apple Silicon)
+        registers and activates, then fails at ingest with an exec format error.
+
         Args:
-            tarball: Path to a `docker save` tarball of the extractor image.
+            tarball: Path to a `docker save` tarball of the extractor image, built for linux/amd64.
             tag: Tag to register the image under.
             inputs: Input files the extractor consumes.
             default_timestamp_column: Name of the column containing timestamp data in the extractor's

{nominal-1.166.0 → nominal-1.167.0}/nominal/core/dataset.py

@@ -947,8 +947,14 @@ class Dataset(DataSource, RefreshableConjureMixin[scout_catalog.EnrichedDataset]
         """Add data from proprietary data formats using a pre-registered custom extractor.
 
         A containerized extraction runs asynchronously and may emit multiple output files, so this returns
-        the tracking `IngestionJob` immediately rather than a single file. Use `job.as_files_ingested()` or
-        `job.dataset_files()` to pull the produced files, `job.status` to poll, and `job.cancel()` to cancel.
+        the tracking `IngestionJob` immediately rather than a single file, and `job.cancel()` cancels it.
+
+        Waiting takes two stages: the container finishes producing files, then those files finish
+        ingesting. `job.as_files_ingested()` covers both — it re-reads the file list while the job runs,
+        so it picks up outputs that do not exist yet at the time of the call. `job.dataset_files()`, by
+        contrast, returns only the files that exist when it is called, which is empty until a manifest
+        extractor's container has exited; and `job.status` is a snapshot, so polling it requires
+        `job.refresh()` to advance it.
 
         Args:
             extractor: ContainerizedExtractor instance (or rid of one) to use for extracting and ingesting data.
@@ -1565,6 +1571,7 @@ def _create_dataset(
     marking_rids: Sequence[str] | None = None,
 ) -> scout_catalog.EnrichedDataset:
     request = scout_catalog.CreateDataset(
+        channel_search_split_tag_keys=[],
         name=name,
         description=description,
         labels=list(labels),