[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

FIDES security state must remain conservative when callers or history providers replay assistant, tool, function-result,
and approval content. Unstamped replay data, modified hidden placeholders, or caller-forged approval controls must not
inherit trust or execution authority from IDs alone.

This is the second layer of the upstream replacement stack for #9652. It builds on the policy, state, and
materialization foundation in #9875 and isolates replay classification, missing-label reconstruction, and approval
authority from the later service-history, AG-UI, and MCP carrier layers.

Description & Review Guide

• What are the major changes? Replay now classifies unstamped assistant/tool content and data-bearing function
  results conservatively, preserves function-call argument confidentiality only while history is uncovered, and
  authenticates exact session-owned hidden placeholders without integrity taint. FIDES and ordinary approvals bind to
  canonical stored call bodies, exact live controls, and pending session snapshots. Missing labels are reconstructed
  transactionally after local history providers finish loading.
• What is the impact of these changes? Replayed or forged content fails closed, replacement and occurrence-only
  approvals remain usable, and restored public history does not gain unnecessary confidentiality. There are no public
  API or breaking changes. Validation passed with:
  • cd python && uv run pytest -q packages/core/tests/test_security.py
  • cd python && uv run poe syntax -P core -C
  • cd python && uv run poe pyright -P core (0 errors and 0 warnings)
  • cd python && uv run poe test-typing -P core (mypy, pyrefly, pyright, ty, and zuban)
  • cd python && uv run poe test -P core (9,134 passed, 20 skipped, 2 xfailed)
  • cd python && uv run poe markdown-code-lint
• What do you want reviewers to focus on? Please review live-object/token authority, canonical call-body
  comparison, duplicate-key and cyclic/deep failure handling, and the local-history reconstruction boundary. This
  layer intentionally excludes service-history ownership and continuation IDs, AG-UI adapters, and MCP result
  carriers.

Related Issue

Fixes #9652

#9652 is the original source draft. This PR is its replay-and-approval-authority replacement layer and is stacked on
the foundation in #9875 rather than competing with the original implementation.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with implementation, regression tests, documentation, validation, and
this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 40521719e14d
Model: gpt-5.6-sol

Overview

The change adds conservative replay classification, exact session-owned placeholder authentication, and canonical approval bindings with strong mutation, depth, duplicate-key, and lifecycle guards. Exact control tokens and pending-session snapshots substantially reduce approval replay authority. However, local per-service history can bypass classification entirely, restored-history coverage is represented by an unbound session-wide boolean, and pre-upgrade hidden placeholders are rejected by the new canonical encoding.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (2 high, 1 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/_agents.py, python/packages/core/agent_framework/security.py

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

4 open issues

• Hashing content.to_dict() makes approval-control authority extremely sensitive to… · New
• _ApprovalReplayAuthority relies on the module-global name id(...). Because global name… · New
• _is_pending_approval_control linearly scans every scope.pending_approvals item for each… · New
• This post-provider hook is a good place to finalize history-based reconstruction, but in runs where… · New

What changed in this PR

Hardens FIDES handling of replayed/history-provided content and approval controls so that callers cannot regain trust/authority by replaying or forging IDs, and missing label state is reconstructed conservatively.

Changes:

• Add conservative replay label classification (including depth/cycle/duplicate-key defenses) and authenticated hidden-placeholder verification.
• Bind approval authority to canonical stored call bodies + exact live controls, and reconstruct history labels after history providers load.
• Extend agent session preparation to run provider-specific approval-history preparation; expand regression coverage and documentation.

File	Description
python/​packages/​core/​agent_framework/​security.py	Implements replay classification, hidden-placeholder authentication, and approval replay authority binding.
python/​packages/​core/​agent_framework/​_agents.py	Invokes provider _prepare_approval_history hook after providers run to finalize reconstruction/binding.
python/​packages/​core/​tests/​test_security.py	Adds extensive regression tests for replay classification, placeholder integrity, and approval binding.
python/​samples/​02-agents/​security/​FIDES_DEVELOPER_GUIDE.md	Documents conservative replay behavior and approval authority rules.
docs/​features/​FIDES_IMPLEMENTATION_SUMMARY.md	Updates FIDES summary to include replay/history-provider behavior and trust boundary notes.

_{Review effort: Lite}

[github-code-quality]

Code coverage overview

Languages: Python

Python / code-coverage/python

main 07b9b3f	fides-replay-approva... da21167	+/-
92%	92%	0%

View coverage of the 6 most impacted files.

File	main 07b9b3f	fides-replay-approva... da21167	+/-
packages/core/a...ork/security.py	91%	90%	-1%
packages/core/a...work/_agents.py	96%	95%	-1%
packages/core/a.../_compaction.py	94%	94%	0%
packages/core/a.../_middleware.py	96%	96%	0%
packages/core/a...rk/_sessions.py	95%	95%	0%
packages/core/a...ework/_tools.py	95%	96%	+1%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated November 05, 2026 14:45 UTC}

[github-actions]

MAF Automated Review — Iteration 2

Result: Findings reported
Scope: full PR (2 commit(s)): 209c9471f18d, 84ed117e3d81
Model: gpt-5.6-sol

Overview

The PR adds conservative replay classification, canonical approval binding, exact hidden-placeholder checks, and digest-backed history coverage, with strong fail-closed handling for forged controls, duplicate keys, deep content, and malformed labels. Exact live-object binding and the expanded replay tests provide useful guardrails. Two coverage lifecycle gaps still reclassify framework-owned history and break ordinary approval and multi-step per-service tool workflows.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 high) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/security.py