Repository navigation
Python: Preserve FIDES AG-UI replay provenance - #9878
Conversation
GitHub Actions
Inactive
GitHub Actions
Inactive
agent-framework-automation
Bot
added
the
python
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (1 commit(s)): c127b36c74d5
Model: gpt-5.6-sol
Overview
The PR establishes a strong object-identity boundary for backend snapshot provenance, preserves it through normalization, and folds uncovered replay before the new snapshot-only save points. The regression coverage exercises restored history, missing labels, confirmation, authenticated rejection, and provider-failure paths. Two residual trust-boundary issues remain: the supported AG-UI dependency range permits a core version without the new security seam, and authenticated rejection provenance is assigned by a reusable call ID and public result string rather than by the exact lifecycle-produced result.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (1 high, 1 medium) across 1 file. Details are attached to the affected lines below.
Affected areas: python/packages/ag-ui/agent_framework_ag_ui/_agent_run.py
Code coverage overviewLanguages: Python Python / code-coverage/python
View coverage of the 3 most impacted files.
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
c127b36 to
74b7133
Compare
GitHub Actions
Inactive
There was a problem hiding this comment.
🟡 Changes recommended
Active security flaws can preserve trusted provenance for client-controlled tool data and reconstruct labels from incomplete history, bypassing conservative labeling and fail-closed protections.
4 open issues
What changed in this PR
This PR adds the AG-UI replay-provenance layer of the FIDES hardening stack, distinguishing backend-restored history from fresh client data when restoring and persisting security state.
Changes:
- Preserve snapshot provenance through message normalization and remove private markers before provider exposure.
- Fold uncovered replay before confirmation and approval snapshot saves, including missing-label reconstruction.
- Add regression coverage for replay provenance, authenticated denials, and provider-failure persistence.
| File | Description |
|---|---|
python/packages/core/tests/test_security.py |
Tests restored-state handling and replay-marker removal. |
python/packages/core/agent_framework/security.py |
Adds transport-aware replay labeling and snapshot-time folding. |
python/packages/ag-ui/tests/ag_ui/test_endpoint.py |
Adds end-to-end provenance and security-state persistence tests. |
python/packages/ag-ui/agent_framework_ag_ui/_message_adapters.py |
Carries snapshot provenance through message conversion and sanitation. |
python/packages/ag-ui/agent_framework_ag_ui/_agent_run.py |
Connects snapshot and approval provenance to FIDES folding before saves. |
Review effort: Balanced
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Active
agent-framework-automation
Bot
added
the
documentation
2b3e086 to
c0cc54d
Compare
GitHub Actions
Active
GitHub Actions
Active
GitHub Actions
Active
GitHub Actions
Active
There was a problem hiding this comment.
MAF Automated Review — Iteration 2
Result: Findings reported
Scope: full PR (4 commit(s)): 26f309133f05, a13c157b2581, c0cc54dd603f, cc166c2eacbb
Model: gpt-5.6-sol
Overview
The PR carefully carries backend-snapshot provenance through AG-UI normalization, binds denial provenance to exact synthesized objects, invalidates provenance after client edits, and fails closed when service-owned history cannot be reconstructed. The added tests cover the principal replay, approval, provider-failure, and snapshot-save paths. Residual risk remains because the new sentinel is not copy-safe at the declared minimum dependency and because its global marker is consumed incorrectly when multiple FIDES context providers are configured.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 medium) across 1 file. Details are attached to the affected lines below.
Affected areas: python/packages/core/agent_framework/security.py
GitHub Actions
Active
GitHub Actions
Active
GitHub Actions
Active
Motivation & Context
FIDES security state can be restored from an AG-UI Thread Snapshot while the current turn adds a fresh client tool result or resolves an approval. Without transport provenance, normalization can either reclassify restored history as fresh external data or let fresh data inherit coverage from the stored snapshot. Confirmation and approval safe-point returns can also persist before FIDES folds new replay data.
This is the fourth layer of the upstream replacement stack for #9652. It builds on #9875, #9876, and #9877 and isolates AG-UI replay provenance, snapshot folding, and authenticated approval-result handling from the later MCP carrier layer.
This layer uses the core replay seams available in
agent-framework-core1.25.0, matching the current AG-UI dependency floor ofagent-framework-core>=1.25.0,<2. Core now requirestyping-extensions>=4.16.0so the private replaySentinelremains identity-stable when messages are copied.Description & Review Guide
SecureAgentConfigconsumes its own entry. A minimal FIDES replay seam treats covered messages as represented by restored state, folds uncovered messages before snapshot-only or approval safe-point saves, reconstructs complete local replay when the stored context label is missing, and rejects reconstruction when service-owned history is unavailable. Lifecycle-authenticated approvals, replacement approvals, and mixed siblings retain backend authority. Denial provenance binds to the exact synthesized result object, edited client calls lose snapshot provenance, and fresh client results remain conservative. Non-FIDES approval paths avoid the extra full transcript conversion.Related Issue
Fixes #9652
#9652 is the original source draft. This PR is its AG-UI replay-provenance replacement layer, stacked as #9875 -> #9876 -> #9877 -> this PR rather than a competing implementation.
AI Assistance
AI assistance details: GitHub Copilot assisted with implementation, regression tests, validation, and this PR description.
Contribution Checklist
breaking changelabel (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.