Repository navigation
Python: Harden FIDES service history continuation - #9877
Eduard van Valkenburg (eavanvalkenburg) merged 9 commits into
Conversation
GitHub Actions
Inactive
GitHub Actions
Inactive
agent-framework-automation
Bot
added
the
python
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (1 commit(s)): 25f03b1d9354
Model: gpt-5.6-sol
Overview
The PR resolves effective history ownership and moves local history loading ahead of FIDES approval preparation, with strong streaming/non-streaming coverage and explicit rejection of several opaque continuation cases. However, the new fail-closed gate does not recognize every client-declared continuation carrier, treats any local message as a complete reconstruction, and does not bind restored FIDES state to the resumed conversation. The middleware reorder also changes which request is persisted, while the approval preload invokes custom history providers twice before the first service call.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
5 verified findings remained after source verification (3 high, 2 medium) across 2 files. Details are attached to the affected lines below.
Affected areas: python/packages/core/agent_framework/_agents.py, python/packages/core/agent_framework/security.py
25f03b1 to
4d7c69c
Compare
GitHub Actions
Inactive
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved critical flaws allow service continuations to bypass authoritative FIDES history reconstruction and cause provider preparation and model dispatch to use different conversation IDs.
4 open issues
What changed in this PR
This PR adds the service-history continuation layer to the FIDES hardening stack, building on #9875 and #9876. It aims to prepare security state before approval execution and reject service continuations whose history cannot be safely reconstructed.
Changes:
- Resolve effective history ownership and propagate conversation identity into provider preparation.
- Load local history before approval checks and order per-service-call history middleware before provider middleware.
- Add streaming and non-streaming regressions for history ordering, write-only archives, and missing continuation security state.
| File | Description |
|---|---|
python/packages/core/tests/core/test_agents.py |
Adds history-ordering, ownership, and continuation regression tests. |
python/packages/core/agent_framework/security.py |
Adds a guard against service continuation without reconstructable history or authoritative FIDES state. |
python/packages/core/agent_framework/_agents.py |
Propagates conversation identity and history ownership; adjusts history preparation and middleware ordering. |
Review effort: Balanced
GitHub Actions
Inactive
agent-framework-automation
Bot
added
the
documentation
GitHub Actions
Inactive
GitHub Actions
Active
141bcbb to
8ca5475
Compare
GitHub Actions
Active
GitHub Actions
Active
Code coverage overviewLanguages: Python Python / code-coverage/python
View coverage of the 4 most impacted files.
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
GitHub Actions
Active
GitHub Actions
Active
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
GitHub Actions
Active
There was a problem hiding this comment.
MAF Automated Review — Iteration 2
Result: Findings reported
Scope: full PR (6 commit(s)): 931e8c784a9f, 264bd72ceaf5, c77aaa3a06ec, 8ca5475d520a, ad1351e7a51f, 0291bfa75902
Model: gpt-5.6-sol
Overview
The PR consistently resolves declared continuation identities, fingerprints complete local history, reuses the first prepared snapshot, and captures provider-finalized requests for persistence. The new tests cover the previously reported identity, completeness, retry, ordering, and duplicate-load failures. Residual risk remains because the current continuation is mutated during a tool loop, the stricter message-labeler ordering conflicts with automatic history injection, and OpenAI background-response resumption is absent from the declared carrier set.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (1 high, 2 medium) across 3 files. Details are attached to the affected lines below.
Affected areas: python/packages/core/agent_framework/_agents.py, python/packages/core/agent_framework/_sessions.py, python/packages/core/agent_framework/security.py
Jose Alvarez (jpalvarezl)
left a comment
Jose Alvarez (jpalvarezl)
left a comment
There was a problem hiding this comment.
One behavior issue remains in the per-service-call persistence path.
GitHub Actions
Active
GitHub Actions
Active
76f0d25 to
bc62f32
Compare
GitHub Actions
Active
Motivation & Context
FIDES must evaluate the same history and continuation identity that the model uses. Otherwise, resumed service history
can bypass reconstructed labels, partial local archives can understate confidentiality, and approvals can execute
before loaded history is classified.
This is the service-history and continuation layer of the replacement stack for #9652. It builds on #9875 and #9876.
Later layers own AG-UI provenance and MCP/IFC enforcement.
Description & Review Guide
model dispatch, normalizes all client-declared continuation carriers, and binds FIDES state to that identity. Local
reconstruction requires exact history-snapshot coverage. The first prepared snapshot is reused, and persistence
captures the request after middleware finalizes it.
before approval execution or model dispatch. Local history is not loaded or compacted twice on the first call, and
persisted history matches the request sent to the model. Streaming and non-streaming behavior remain aligned. There
are no public API or breaking changes.
prepared-history middleware boundary. AG-UI changes and MCP/IFC work are intentionally excluded.
Related Issue
Fixes #9652
#9652 is the original source draft. This PR replaces only its service-history and continuation slice. #9875 and #9876
provide the preceding foundation layers.
AI Assistance
AI assistance details: GitHub Copilot assisted with implementation, regression tests, and this PR description.
Contribution Checklist
breaking changelabel (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.