Resolve repository-local imported tools for Google ADK and OpenAI Agents SDK (#864)

[pengfei-threemoonslab]

Summary

Closes #864. Agents often bind tools that are defined in another module. The readers used to stop at the module boundary, so a PR that added such a binding produced no row. The #864 repro is jpka/attest#3, where tools=[..., memory_bank.remember_firm_finding, memory_bank.recall_firm_memory] comes from from . import memory_bank.

• Shared resolver. inputs/python_imports.py follows one tools=[...] reference to one function definition.
  • It follows static import / from … import, package __init__ re-exports, module.function access and plain alias = function.
  • It reads only regular .py files inside the directory the read was given: --scope for diff --application, the manifest directory for scan.
  • Files are read through the snapshot-aware load_text_file / list_input_directory, so every module a resolution depends on is in the run's input identity. They are parsed with ast and never imported or run.
  • Directory entries must match the exact spelling (case-folding filesystems included), and symbolic links are never followed.
  • A name must be bound exactly once, directly in the module body, in every module on the chain.
  • Every other outcome is a named reason: module_not_found, outside_scope, ambiguous_module, rebound_name, conditional_binding, star_import, import_cycle, name_not_defined, not_a_function, linked_module, unreadable_module, resolution_limit.
• Google ADK. Resolves imported names, module.function, aliases, and FunctionTool(...) / LongRunningFunctionTool(...) wrappers, whether the wrapper is inline, assigned locally or built in the imported module.
  • There is one tool per definition. Tools are keyed by the defining module and line, so same-named functions in different modules stay distinct.
  • If one agent binds two different functions under one name, the reader reports it as a duplicate_tool_name gap and does not resolve it.
  • The references unresolved tool warning keeps its decoded wording, since unresolved_adk_tool_symbols and inventory scaffolding parse it. The reason is recorded beside it in GoogleAdkArtifacts.unresolved_references.
  • An imported definition can reach high only on the same terms as a local one. A chain that passes a package's module-level __getattr__ (which is not evaluated) is named but held at medium.
• OpenAI Agents SDK (why it is covered here). The resolver is shared and the binding graph is shared, so the SDK reader uses it too, and no sibling issue is needed.
  • Names and module.function references that reach a definition carrying the SDK's @function_tool (fix(diff --application): key SDK identity on imports; unobserved agents are not removals #873's decorator identity) resolve.
  • Guard evidence is included for imported definitions.
  • A definition that a directory source already read is reused, never observed twice.
  • An undecorated target is named with that reason.
• Binding graph. AgentBindingObservation.tool_locators (internal) lets a name match be narrowed to the definition the reader resolved. It only narrows and never widens.
• diff --application.
  • Rows reached through an import add import_path: each module read, the line of the binding followed and that module's SHA-256. It is evidence, outside the compared meaning.
  • An ADK reference the reader could not follow is scoped to its agent with Not resolved because …. Another agent's change in the same file is therefore still established.
  • Additive on the unreleased 0.1 advisory result. No schema or contract bump.

Rebased onto #873 and #877, which landed first. The overlaps in the SDK reader, application_diff.py and the docs were resolved by keeping both sides. #877's test_adk_package_root_agent_with_sibling_tool_is_partial_not_absent pinned the CubeSandbox shape as "partial until #864". It now asserts the resolved form (…_is_compared). #865 (factories) can build on Resolution.value: the resolver returns the assigned expression where a chain stops at name = <call>.

Acceptance (from #864)

• Pinned attest head identifies all six tools. At cab29500, scope agents/attest_orchestrator, both memory functions, scorer.score_answer and the three local tools are identified, with correct agent edges and source locations. Covered by test_adk_head_identifies_imported_memory_and_scorer_tools; the real repro compares compared with head binding_count: 6.
• Paired base/head shows exactly the two additions. The comparison shows the two memory tools as ADDED and does not relabel the four existing bindings. On the real PR this is diff --application --base 10e1f949 --head cab29500 --scope agents/attest_orchestrator → compared, base 4 / head 6 bindings, exactly two ADDED rows. Also covered by test_application_diff_shows_the_two_memory_tool_additions.
• One identity per definition. Aliases and FunctionTool wrappers keep one tool per definition, and same-named functions in different modules stay distinct: test_adk_function_tool_wrappers_and_aliases_keep_one_identity, test_adk_wrapper_built_in_the_imported_module_is_its_function, test_adk_same_name_functions_in_different_modules_stay_distinct.
• Negative cases. Shadowing, reassignment, cycles, unresolved and out-of-scope imports each have a test in tests/test_python_import_resolution.py. So do conditional imports, wildcard imports, classes, unparseable modules, links, the exact-spelling rule and the module bound. Unresolved edges stay named and partial, never empty or complete: test_adk_unresolved_import_is_named_with_its_reason, test_adk_import_leaving_the_read_scope_is_not_followed, test_imported_tool_gap_is_explicit_and_not_counted_as_complete.
• No execution; reads are in identity.
  • test_resolution_never_executes_the_inspected_code puts raise SystemExit plus a file write in the target module and checks neither happens.
  • test_imported_tool_modules_are_read_not_imported covers both frameworks with a trapped sibling module and the sys.modules check.
  • Reads go through the snapshot-aware readers.

Review rounds

Thirteen adversarial rounds, each paired with a replay of the frozen corpora, were run on this branch. Every finding below has a test in tests/test_imported_tool_review.py that fails on the commit before its fix.

• Round 1 (3f83b941)

  • One agent binding two same-named functions now binds neither.
  • A builder's own import is the binding its agent receives.
  • import a.b reads the submodule.
  • Gaps are scoped per agent.
  • scan counts one definition once across sources.
  • The module-binding walk is linear.

• Round 2 (341d9c50)

  • A reference is read where it is used: nonlocal, inline wrappers, factory-local wrappers and toolsets.
  • A monkeypatched module attribute is a named stop.
  • The flat function map no longer overrides the module-level def.
  • The scan dedupe runs where scan and inspect load sources.

• Round 3 (21ad927e)

  • SDK tool lists are read through the scope that binds them.
  • A module-level reference prefers what the module binds.
  • A patch in an enclosing package __init__ is a named stop.
  • A 3,000-deep attribute chain no longer crashes scan.

• Round 4 (b45d3edc)

  • A binding the ADK reader can only guess (the module rebinds the name) is a tool-scoped plus agent-scoped gap, not_established whether added, removed or changed. scan keeps its per-tool findings.
  • A list aliased or passed to a call that may change it is dynamic.

• Round 5 (60a0a4de)

  • A guess's reason covers every tool the module's bindings of that name could give the agent (or the whole agent).
  • A list passed to a function is followed into it.
  • The package-patch scan counts only attributes rooted at an import, on its own budget.

• Round 6 (8ad8d0c6)

  • A literal list stays readable only while every use is a read.
  • A guess's candidates are followed to their definitions.
  • An unreadable module an __init__ imports is a named stop.

• Round 7 (1790e5e7)

  • Spreads, truth tests and dict-method reads keep a list readable.
  • globals()/vars() make a module's lists dynamic.
  • A package's optional imports no longer stop a resolution.

• Round 8 (db223a50)

  • Code that runs before a name is used is checked for a reassignment: every module on the chain (the agent's own file included), every enclosing package's __init__.py, and every in-scope module those import.
  • An above-scope import there is a caveat: the tool is named, its row is not_established, and the ADK scan stays at medium. Round 7 had made it silent.
  • sys.modules and import_module(__name__) make a list dynamic.

• Round 9 (6282afc5)

  • A caveat survives a FunctionTool wrapper the imported module builds.
  • An absolute import spelled through a directory above the scope is a caveat.
  • The defining module's hand-on exemption no longer covers a patch through its own import.
  • Only typing's TYPE_CHECKING skips a block.
  • Ordinary code no longer stops a resolution: ambiguous imports read every candidate, generated *_pb2 modules are the boundary, and the patch scan reads up to 1024 modules.
  • A package __getattr__ is established only when every return it can reach for the name gives that submodule. Attest's two lazy loaders stay established; a redirecting hook is named.

• Round 10 (a54811b3)

  • Whether an absolute import is the application's own code is read from the repository: the compared commit's tree for diff --application, the checkout for scan. A namespace directory counts only when it holds the named submodule, so SDK apps under agents/ import the SDK (round 9's ancestor-name rule had caveated them all).
  • The scope spelled from the repository root (svc.app.tools) is read inside the scope.
  • The lazy-hook idiom requires an undecorated hook, an unrebound parameter, importlib bound only by importing it, and a local bound exactly once.

• Round 11 (dc217503)

  • Every directory between the repository root and the scope is an import root (backend/common for backend/app).
  • A linked or submodule root entry is unread code; scan outside a checkout reads the three directories above the scope.
  • A store into sys.modules in code that runs first is a named stop, and a package hook is not trusted when the package could subvert it.

• Round 12 (a017a6ee)

  • A directory that is itself a package is not an import root, so SDK apps under a regular app/agents/ package import the SDK (a round-11 regression).
  • A sys.modules store is read by its key: a stop when it names a module on the chain or is built on __name__, a caveat when computed (a plugin loader), nothing otherwise.

• Round 13 (1bc307b7)

  • A package directory can still be an import root (a service run from backend/ with a stray backend/__init__.py); standard-library names and the scope's own package are not the repository's code (a round-12 regression).
  • The __init__.py of every package above the scope, and what each imports, are read for reassignments (present since round 1).
  • sys.modules and globals() are read by allow-list; a module rebinding its own name through them is a reassignment, and a change to __path__ a caveat.

• Round 14 (48e18178, 40e84633)

  • Above the scope, each import is followed the way the in-scope reader does: every package on the way and each submodule named (from .hooks import patches, import svc.lib.util runs svc/lib/__init__.py). A reassignment there counts when it is rooted at the scope.
  • Preloaded stdlib modules are always exempt; any other stdlib name only at a root that is a regular package (backend/calendar.py shadows calendar).
  • Reads: comparisons, spreads, iteration, pkgutil.iter_modules(__path__), get_type_hints(globalns=globals()), patch.dict/setitem by key.
  • The module's own object is read however it is spelled: an alias, sys.modules.get, import_module(__name__), __dict__/vars() stores. A computed setattr, or the object handed to a function, is a caveat.
  • A local named vars/globals is a variable (siada-cli's DebugUtils.dump, found by the corpus replay).

• Round 15 (6533f20c)

  • Above the scope, a patch is exempt only when it sets one attribute of another module file that its package binds nothing else under. A longer path, a name imported from a module, a package attribute over the submodule, or a module alias still counts.
  • Scope modules that an ancestor __init__.py imports are read like the chain's own.
  • A module file wins over a same-named data directory, and a link's blob text is never read as source.
  • The module object used anywhere but an attribute, an alias or a reader is a caveat. So are __dict__.update, f_globals stores and builtins.globals aliases.
  • Above-scope reads are batched: 1100 modules went from 76 s to 3 s.

• Round 16 (148ba622)

  • A logging helper reading its caller's f_globals is a read.
  • A directory holding more than 16 MB of Python is read file by file (peak RSS 305 MB → 87 MB). The final review round found no P0 or P1.

• PR review (8ad2f800)

  • An edge's resolved locator picks its definition even when the edge's own source holds one same-named tool, so scan binds the imported definition, not the local one.
  • A read-only call is proven by its binding. A bare builtin counts only when nothing binds the name; a standard-library reader only when imported from that module; a logging method only on logging or a getLogger(...) result.
  • A lazy __getattr__ hook counts as the submodule idiom only when the returned alias imports the submodule requested.

Residuals, named in the CHANGELOG or docs:

• A from config import * that rebinds a list defined before it (pre-existing on main).
• A rebinding in a module that nothing on the chain imports, or that a module the packages above the scope import reaches only through a second import.
• Code outside the scope that is reached some other way than an import the scope's code spells: a sys.path or sys.meta_path change, a plugin loader, or a literal importlib.import_module("…").
• The ambiguous selector when an inventory completes a source that imports another source's definition.
• An agent object changed after construction, which is Application diff reports 'compared, no changes' when an SDK agent built by 'return Agent(...)' gains a tool #876's.

Corpus measurement

The frozen 134-PR corpus, restricted to the 83 rows with category != not_sdk. Each row is replayed at its pinned merge_base/head/scope with run_app.sh, one frozen engine worktree per column, one engine per clone at a time. The table is the replay of round 15 (6533f20c). Round 16 changed only noise that no corpus case reaches, plus the read batch size. The PR-review head (8ad2f800) was replayed in full and matches round 15 on all 183 case/scope pairs.

• Rounds 7, 8 and 10 gave identical results on all 183 case/scope pairs.
• Round 11 changed one case (Agent critical experience: conversational shopping agent with cart, checkout and TDA driver kunalsentry/empower#1, below).
• Rounds 12, 13 and 15 changed none.
• Round 14 changed only siada-cli#6's root scope (a local named vars), fixed in 40e84633.

	main 6394ffd8	this PR
comparison_status	partial 71 · compared 2 · not_established 10	partial 70 · compared 3 · not_established 10
rows	47	89
added / not_established / removed / changed	39 / 3 / 2 / 3	72 / 15 / 2 / 0
"unresolved tool" names/side	64	27

Nine PRs change.

• Six gain rows: feat(gemini-enterprise): read-only SCA Remediation A2A service (v1) endorlabs/endor-labs-agent-kit#50, 14himaja/smart-hospital#1, Agent critical experience: conversational shopping agent with cart, checkout and TDA driver kunalsentry/empower#1, Migrate Day 4 agent examples to ADK v2 API jayyanar/agentic-ai-training#6 and Feat/mcp sage intacct NoiseDigital/agent-platform#98, plus docs(integrations): add Google ADK integration guide TencentCloud/CubeSandbox#1508, which also goes partial → compared.
  • Agent critical experience: conversational shopping agent with cart, checkout and TDA driver kunalsentry/empower#1's six rows are not_established, not added. The agent file imports config, which is agent/config.py: application code outside the scope agent/app that runs before the tools are used and is not read. The reason names that import. Until round 10 these rows were added; they are correct at runtime, but the unread module could have changed them.
• Three turn a false changed into not_established: Introduce gen_ai.invoke_workflow.{inference,tool}_calls open-telemetry/semantic-conventions-genai#523, bleedinghands/semantic-conventions-genai#1 and Add workflow-grain inference and tool call count metrics knapg/semantic-conventions-genai#1. Main reported a get_weather change in a file with two nested get_weather definitions; the reference is now a named local-binding stop.

Three more change gaps only (asterinas#3834, awslabs#1869, thanabartbb#14): a tool list that is rebound or appended to is now named as dynamic.

The review also found several agents main read silently as an empty, complete tool list, because a same-named tools = [] sat elsewhere in the file. They are now named as dynamic: agr_ai_curation's supervisor and runtime_agent, and hepagent's role.py.

The 27 remaining unresolved-tool names:

• 12 bind a value: an unrecognised toolset constructor or a hand-built FunctionTool object.
• 10 are local bindings: 7 local assignments and the 3 nested get_weather.
• 3 import a module outside the selected scope.
• 2 are ADK built-ins.
• None is a sibling-module function this PR should have followed.

Other sets:

• The 50 real modify-existing PRs at their own scope: statuses are identical to main (partial 18 · compared 3 · not_established 29); rows 1 → 6; names/side 26 → 5.
• The same PRs at .: statuses are identical (partial 35 · compared 1 · not_established 11 · exit 2 ×3); names/side 422 → 103.

compared cases were re-audited every round. The set is unchanged, and none is a new silent answer; kkmiecik-coder/CRM#5 is #876's.

Hand-checks against source (5 newly resolved PRs; no false row, no material omission)

• docs(integrations): add Google ADK integration guide TencentCloud/CubeSandbox#1508 (examples/google-adk-integration). The single row cube_code_agent → run_python_in_cube is ADDED, with import agent.py:9, binding agent.py:14 and definition cube_code_tool.py:102, all matching source. The head has no coverage gaps, and smoke_test.py constructs no agent.
• feat(gemini-enterprise): read-only SCA Remediation A2A service (v1) endorlabs/endor-labs-agent-kit#50 (gemini-enterprise).
  • endor_oss binds vulnerability_details, dependency_vulnerabilities, package_risk and recommend_upgrades, imported at adk/endor_oss/agent.py:31 from service/oss/adk_tools.py, plus the local agent_info.
  • All five rows are ADDED, with the definitions at adk_tools.py:24/37/50/62 and agent.py:109 and the binding at agent.py:129, all matching source.
  • service/oss/agent.py is an A2A service, not an ADK agent.
• 14himaja/smart-hospital#1 (app, absolute from app.agents.tools import … inside the app package).
  • The four sub_agents.py lists (8+3+3+3 tools) and the four tool-bearing workflow agents (2+1+1+1) give 22 rows. Every definition line matches tools.py (105…392).
  • read_document = read_patient_document is reported as read_patient_document, which is the __name__ ADK registers.
  • The remaining gap is the root agent's imported sub-agents, which is named.
• Agent critical experience: conversational shopping agent with cart, checkout and TDA driver kunalsentry/empower#1 (agent/app, SDK).
  • checkout_agent gets add_to_cart, view_cart and start_checkout (tools/shop/cart.py:57/95/109) plus apply_coupon and purchase (checkout.py:38/80), all through the tools/shop/__init__.py re-export.
  • products_agent gets search_products (search_products.py:29). All six are @function_tool and match the literal lists.
  • The remaining gaps are manager_agent / plant_expert_agent, which bind hand-built FunctionTool(name=…, on_invoke_tool=…) objects. These are named identically on both sides, as 'buy_plants_tool' in tools/buy_plants.py:27 is assigned a value, not a function definition.
• Migrate Day 4 agent examples to ADK v2 API jayyanar/agentic-ai-training#6 (day4/google_adkV2). The six relative-import tools (get_cpu_info, get_disk_info, get_memory_info, count_characters, exit_loop, get_current_time) match their tools.py definitions and literal lists.
• Feat/mcp sage intacct NoiseDigital/agent-platform#98 (checked because it is the one with not_established rows).
  • The base binds three functions imported from .tools.intacct_tools. The head replaces them with intacct_toolset = MCPToolset(...), imported as google.adk.tools.mcp_tool.mcp_toolset.MCPToolset, a spelling the ADK toolset table does not list.
  • The three candidate removals are therefore correctly not_established, with the head reason naming intacct_toolset. They are not false REMOVED rows.
  • The toolset-spelling gap is pre-existing and separate from this issue.

Type

• Check or risk-model change
• Input adapter change
• CLI or GitHub Action behavior
• Report, schema, or SARIF output
• Documentation only

Verification

CI is authoritative for python -m ruff check ., python -m compileall -q src tests, and python -m pytest.

Additional local checks run:

• Paired regressions. All 12 of the original tests in tests/test_imported_tool_bindings.py fail when copied into a clean origin/main worktree at a430e81a. They fail on behavior: unresolved warnings, partial instead of compared, and the missing reason. They pass here.
• Full suite at the final head (8ad2f800). pytest -n 5 -m "not perf", ruff check . and scripts/generate_schemas.py --check. The only failures are the two environmental test_check_unmodelled_host_config_keys.py[local_settings_enabled_plugins-*] cases: my ~/.config/git/ignore ignores **/.claude/settings.local.json, and they fail identically on untouched origin/main. The same holds at each earlier round's head.
• Review tests. tests/test_imported_tool_review.py holds a test per review finding; each was run against the commit before its fix and fails there.
• Attest repro. diff --application --base 10e1f949 --head cab29500 --scope agents/attest_orchestrator is compared, base 4 / head 6 bindings, exactly the two memory tools ADDED, at every round's head.
• test_imported_tool_gap_is_explicit_and_not_counted_as_complete encoded the old limitation. It now imports a module the repository does not contain, so it still pins "an unresolvable import is a named gap, never complete". The resolved form of its old fixture is the new test_application_diff_reads_sdk_tools_imported_from_a_sibling_module.

Release-readiness notes

• No user-code import added to default scan paths (ast only; tests/test_adapter_static_only.py and the new no-import cases pass)
• No network access added to default scan paths
• New or changed check IDs are documented in docs/checks.md (none)
• Report/schema changes are additive or documented in STABILITY.md (none to the report. import_path is additive on the unreleased application comparison 0.1, documented in docs/application-comparison.md and the application_diff registry row)

Behavior change for scan. ADK and SDK sources whose tools are imported from in-scope modules now catalogue those tools instead of raising unresolved-tool warnings. An ADK module whose chain is fully proven can reach high, the same bar as a local definition; the determinism-boundary cell says so.

🤖 Generated with Claude Code

[pengfei-threemoonslab]

Reviewed the current head, 8ad8d0c69197c0a0bd854ef45e34eea5d0fd1bcd, against base 6394ffd8f7009ac12339411a549a78942de10743. I found four correctness issues that should be fixed before merge; reproductions and suggested corrections are inline.

The most consequential issues are an imported binding being redirected to a different same-named local definition after source deduplication, and attribute reassignment checks being bypassed by aliases. Two further cases allow package initialization or a mutating helper to change the actual bound tool list while diff --application reports compared, zero rows, and no coverage gaps.

Validation: all 904 targeted tests passed (171 import-resolution/application-diff/no-import tests and 733 ADK/binding/identity/static-only/SDK tests); Ruff passed on the changed Python modules. I also ran isolated reproductions outside the checkout and compared the import-related failures against the base engine: the base reports partial/unresolved coverage where this head incorrectly reports a complete comparison. The three PR workflows currently report success. The repository verifier and a fresh agent control read report complete / passed; that automated result does not cover the reproduced correctness defects above.

[pengfei-threemoonslab]

[P1] Enforce the resolved locator even when one source-local name matches

After _one_observation_per_imported_definition removes an imported copy, this code can silently bind the edge to the wrong function. Reproduction: configure agent.py and tools.py as separate SDK sources; agent.py defines lookup, imports tools.lookup as shared_lookup, and constructs local(..., tools=[lookup]) and remote(..., tools=[shared_lookup]). Before deduplication, remote correctly reaches tools.py:3; afterward, it reaches agent.py:4, despite its observation explicitly retaining tool_locators={'lookup': 'tools.py#lookup'}. There is exactly one source-local name match, so neither the cross-source fallback nor locator narrowing runs. Apply the locator constraint to single matches too, and resolve against the surviving exact definition when that constraint removes the source-local match. Otherwise source deduplication changes the reachable capability and associates the wrong implementation/guard evidence with the agent.

[pengfei-threemoonslab]

[P1] Check attribute reassignments at every alias/import hop

_no_attribute_patch is called only for the original reference in resolve/resolve_local_import. This recursive alias hop bypasses it for the newly followed reference. With import tools; alias = tools.lookup; agent = Agent(name='app', tools=[alias]), insert tools.lookup = tools.execute immediately before the alias assignment. Both SDK and ADK comparisons on this head return comparison_status='compared', rows=[], and no coverage gaps, although the agent now receives execute. The base engine correctly retained unresolved coverage for this alias. The same omission applies to dotted references reached inside a re-exporting module. Check the current module's attribute patches when entering _in_module (including recursive hops), so an alias cannot turn a known reassignment into an established original definition.

[pengfei-threemoonslab]

[P2] Account for absolute imports when checking package initialization

This filter skips every import pkg.patch and from pkg import patch, although Python executes those imports just as it executes relative ones. Reproduction: agent.py binds from pkg.tools import lookup; pkg/tools.py defines decorated lookup and execute; pkg/patch.py contains import pkg.tools; pkg.tools.lookup = pkg.tools.execute. Change an empty pkg/__init__.py to import pkg.patch. The agent now receives execute, but this head reports compared with zero rows and no coverage gaps; the base engine reports partial/unresolved coverage. Follow in-scope absolute package imports under the same bounded scan, or retain an explicit uncertainty when they cannot be checked. Silently skipping them lets a package initialization change invalidate the supposedly resolved definition.

[pengfei-threemoonslab]

[P2] Establish callable identity before treating a call as read-only

The new literal-list proof trusts a spelling alone: any function named print, list, etc., and any object's .info()/.error() method is accepted without examining its binding. For example, import lookup/execute from tools.py, import print from helpers.py, set TOOLS = [lookup], and bind Agent(..., tools=TOOLS). Let the helper's print(items) call items.append(execute). Adding print(TOOLS) before construction currently yields compared, no rows, and no gaps, so the added imported capability disappears from the review; the base engine retains unresolved coverage. Validate that a whitelisted name actually denotes the expected builtin/library callable, and use the existing callee analysis or mark the list dynamic for shadowed names and arbitrary same-named methods.

[pengfei-threemoonslab]

Re-reviewed 148ba622a6845a244beaf1a0d3727f8483004d4c, including the changes since my previous review at 8ad8d0c6. Three correctness issues remain: two previous findings still reproduce, plus one new finding inline. I recommend fixing these before merge.

Still reproducible on this head:

• [P1] Wrong definition after source deduplication (original finding). Re-ran the two-source SDK reproduction. Before deduplication, remote -> tools.py:3; afterward, remote -> agent.py:4, even though its observation still explicitly names tools.py#lookup. The single wrong source-local match still prevents locator matching/fallback.
• [P2] Shadowed reader names hide mutations (original finding). Re-ran the imported helpers.print(items) reproduction where it appends execute to TOOLS. Adding print(TOOLS) before constructing the agent still produces compared, zero rows, and no coverage gaps.

Verified fixed against the original reproductions:

• Alias-hop attribute reassignment (original finding): both SDK and ADK now report partial with a not_established row and a reason naming the reassignment.
• Absolute import in package initialization (original finding): adding import pkg.patch now exposes the reassignment and yields partial / not_established.

The new inline finding concerns a lazy __getattr__ redirect via an aliased relative import: the comparison reads the nominal submodule instead of the module actually returned, and misses changes to the bound implementation.

Validation: 1,022 targeted tests passed, Ruff passed on the changed Python/test modules, and git diff --check passed. All three current PR workflows report success. The repository verifier and refreshed control read report complete / passed; the isolated correctness reproductions above still fail despite that automated result. No repository files were edited.

[pengfei-threemoonslab]

[P2] Validate the imported module name before trusting a lazy-hook alias

The ast.alias branch checks the local return variable (value.id == name), but not which submodule the alias imports. A valid redirecting hook is therefore classified as the safe lazy-submodule idiom:

def __getattr__(name):
    if name == "memory":
        from . import alternate as memory
        return memory
    raise AttributeError(name)

With both pkg/memory.py and pkg/alternate.py defining remember, an ADK agent using from pkg import memory; tools=[memory.remember] actually binds pkg.alternate.remember. Changing only that implementation currently yields comparison_status='compared', rows=[], and no coverage gaps. I confirmed the minimal package really returns pkg.alternate, and the base engine retains partial/unresolved coverage. Require the alias's original imported name (values[0].name) to match the requested submodule before marking it lazy_submodule; otherwise preserve the existing hook caveat and not_established result.