Python: Reserve HA session id as reserved for AGUI

[westey (westey-m)]

Motivation & Context

Description & Review Guide

• What are the major changes?
• What is the impact of these changes?
• What do you want reviewers to focus on?

Related Issue

Fixes #

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

The duplicated security-sensitive key needs a cross-package contract test to prevent silent drift.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Protects Foundry hosted-agent sandbox IDs from client-controlled AG-UI state.

Changes:

• Declares Foundry session IDs as server-owned.
• Reserves the key unconditionally in AG-UI.
• Adds security regression tests and guidance.

File summaries

File	Description
python/packages/foundry/tests/foundry/test_foundry_agent.py	Tests Foundry sandbox protections.
python/packages/foundry/agent_framework_foundry/_agent.py	Declares and documents the protected key.
python/packages/ag-ui/tests/ag_ui/test_run.py	Tests reserved-state filtering.
python/packages/ag-ui/AGENTS.md	Documents state-ownership rules.
python/packages/ag-ui/agent_framework_ag_ui/_agent_run.py	Unconditionally reserves the Foundry key.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 7280b0df1be6
Model: gpt-5.6-sol-fast

Overview

This PR adds an unconditional AG-UI reservation for the Foundry hosted-agent session key and documents the corresponding Foundry ownership contract. Request state is filtered before the session merge, while tests cover missing wrapper declarations, overwrite attempts, and separation from service_session_id. No Critical, High, or Medium defect introduced by the reviewed range was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[Evan Mattson (moonbox3)]

westey (@westey-m) there's one file conflict, FYI

[westey (westey-m)]

westey (westey (@westey-m)) there's one file conflict, FYI

Thanks Evan Mattson (@moonbox3), I've merged the conflict

[Eduard van Valkenburg (eavanvalkenburg)]

this is now being defined both here and in FoundryAgent's service_session_state_keys, do we need it in both places?