Skip to content

.NET: [BREAKING] Reduce Foundry Hosting API surface - #10132

Open
Roger Barreto (rogerbarreto) wants to merge 31 commits into
microsoft:mainfrom
rogerbarreto:foundry-public-api-review
Open

.NET: [BREAKING] Reduce Foundry Hosting API surface#10132
Roger Barreto (rogerbarreto) wants to merge 31 commits into
microsoft:mainfrom
rogerbarreto:foundry-public-api-review

Conversation

@rogerbarreto

@rogerbarreto Roger Barreto (rogerbarreto) commented Nov 6, 2026

Copy link
Copy Markdown
Member

Motivation & Context

Microsoft.Agents.AI.Foundry.Hosting is still preview but exposed implementation, storage, diagnostics, and composition types that would create avoidable compatibility obligations after stable release. This change narrows the package to supported customer-facing registration, options, routing, session, and Toolbox configuration surfaces while preserving the behaviors required by Foundry hosted agents.

Live source deployment also exposed that most hosted samples selected the local-only IServiceCollection registration overload. Those containers failed startup because AgentServer could not bind Foundry storage and task configuration from the host builder.

Description & Review Guide

  • What are the major changes?
    • Reduce the exported Hosting API to the supported extension classes, FoundryResponsesOptions, and FoundryToolboxOptions; internalize or remove response-handler, session-store, checkpoint-store, memory-helper, status, and diagnostics implementation types.
    • Remove undocumented request-time Toolbox marker APIs and keep configured/deferred Toolbox discovery as the supported model.
    • Make FoundryResponsesOptions inherit ResponsesServerOptions, type OAuth consent origins as ISet<Uri>, remove Hosting experimental markers, and split extension classes by owning surface.
    • Update source-deployment samples to use the IHostApplicationBuilder registration path, materialize linked source helpers correctly, and use local project references for in-repository builds while preserving package-based ZIP deployment.
  • What is the impact of these changes?
    • This is a breaking cleanup of preview APIs. Consumers using removed implementation types, direct static references to the previous extension class, duplicated option members, or request Toolbox markers must migrate to the supported composition surfaces.
    • Normal extension-method invocation remains unchanged. Hosted registration now binds AgentServer through the host builder; local/non-hosted registration remains available through IServiceCollection.
  • What do you want reviewers to focus on?
    • Whether the remaining public surface covers supported customer composition scenarios without exposing implementation ownership.
    • AgentServer option inheritance and precedence, Toolbox configuration boundaries, and source-deployment sample behavior.

Related Issue

Fixes #10131

AI Assistance

  • No material AI assistance was used.
  • This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Copilot assisted with the API investigation, implementation, tests, sample validation, documentation, and PR description.

Contribution Checklist

  • The code builds clean without any errors or warnings
  • All unit tests pass, and I have added new tests where possible
  • The PR follows the Contribution Guidelines
  • This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
  • This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

@rogerbarreto
refactor(dotnet)!: internalize response handler
ffb9942 
AgentServer resolves the public ResponseHandler contract from DI, so the concrete adapter does not need to be part of the package API.

BREAKING CHANGE: AgentFrameworkResponseHandler is no longer publicly accessible. Register a custom ResponseHandler to replace request handling.
@rogerbarreto
refactor(dotnet)!: remove filesystem session store
db6c86f 
FoundryAgentSessionStore supplies hosted persistence and the AgentServer local file-backed fallback, leaving the old store unused.

BREAKING CHANGE: FileSystemAgentSessionStore has been removed. Pass FoundryAgentSessionStore or another AgentSessionStore to AddFoundryResponses.
@rogerbarreto
refactor(dotnet)!: internalize default session store
9edc577 
Callers configure session persistence through the AgentSessionStore abstraction, so the state-store-backed default does not need to be public.

BREAKING CHANGE: FoundryAgentSessionStore is no longer publicly accessible. Omit the AddFoundryResponses store parameter for the default or pass another AgentSessionStore.
@rogerbarreto
refactor(dotnet)!: internalize toolbox service
a1a82c0 
AddFoundryToolboxes owns service construction and lifetime, so the concrete hosted service and its startup status do not need to be public.

BREAKING CHANGE: FoundryToolboxService and FoundryToolboxStartupStatus are no longer publicly accessible. Configure toolbox behavior through AddFoundryToolboxes and FoundryToolboxOptions.
@rogerbarreto
refactor(dotnet)!: accept direct hosting options
53233c9 
Required dependencies and resource names remain explicit extension parameters. Nullable options objects now carry only optional behavior and replace configuration callbacks.

BREAKING CHANGE: AddFoundryResponses and AddFoundryToolboxes no longer accept options callbacks. Pass FoundryResponsesOptions or FoundryToolboxOptions instances instead. FoundryToolboxOptions.ToolboxNames is no longer public; pass names to AddFoundryToolboxes.
@rogerbarreto
refactor(dotnet): split hosting extensions
41b8021 
Keep each extension receiver in its own file and pass copied toolbox options directly to the internal hosted service instead of routing through IOptions.
@rogerbarreto
refactor(dotnet)!: internalize checkpoint store
7a74634 
Hosted workflow setup owns checkpoint persistence, so the concrete Foundry state-store adapter does not need to be public.

BREAKING CHANGE: FoundryJsonCheckpointStore is no longer publicly accessible. Hosted workflows receive checkpoint storage through AddFoundryResponses.
@rogerbarreto
refactor(dotnet)!: remove hosted memory helpers
fa94d56 
Hosted memory samples now show the trusted hosted user identity to Foundry memory scope mapping directly, avoiding redundant hosting-specific helper APIs.

BREAKING CHANGE: HostedFoundryMemoryProviderScopes and HostedFoundryMemoryProviderServiceCollectionExtensions have been removed. Construct FoundryMemoryProvider directly and read session.GetHostedContext().UserId in the state initializer.
@rogerbarreto
refactor(dotnet)!: simplify hosted user identity
a2ead50 
AgentServer already supplies PlatformContext.UserIdKey. The handler now reads it directly and stores a plain user-id string in AgentSession, removing redundant context and provider abstractions.

BREAKING CHANGE: HostedSessionContext, HostedSessionContextExtensions, and HostedSessionIsolationKeyProvider have been removed. Use AgentSession.GetHostedUserId(); self-hosted identity overrides must set x-agent-user-id through trusted middleware.
@rogerbarreto
refactor(dotnet)!: remove in-memory session store
9318f88 
Foundry Hosting already defaults to durable Foundry storage with an AgentServer file-backed local fallback. The duplicate process-only store existed only as unit-test infrastructure.

BREAKING CHANGE: Microsoft.Agents.AI.Foundry.Hosting.InMemoryAgentSessionStore has been removed. Use the default store, generic Hosting in-memory store, or another AgentSessionStore implementation.
@rogerbarreto
refactor(dotnet)!: remove request toolbox markers
44e4225 
Remove the undocumented foundry-toolbox:// request convention and its
dynamic toolbox resolution path. Hosted agents now use registered
AddFoundryToolboxes integrations; prompt agents and direct Responses
requests use standard MCP endpoints.

BREAKING CHANGE: HostedMcpToolboxAITool, FoundryAITool toolbox factories,
FoundryAIToolExtensions, StrictMode, and public toolbox ApiVersion were
removed.
@rogerbarreto
refactor(dotnet)!: type consent origin allowlist
3e515f3 
Represent configured origins as unique Uri values while retaining raw
string validation for externally supplied consent links.

BREAKING CHANGE: FoundryToolboxOptions.AllowedOAuthConsentOrigins changed
from IList<string> to ISet<Uri>.
@rogerbarreto
refactor(dotnet)!: rename hosting extension types
73d8783 
Match extension class names to their receiver-specific source files.
Extension method call syntax remains unchanged.

BREAKING CHANGE: FoundryHostingExtensions was replaced by
AgentSessionExtensions, EndpointRouteBuilderExtensions,
HostApplicationBuilderExtensions, and ServiceCollectionExtensions.
@rogerbarreto
refactor(dotnet): remove hosting experimental markers
0f3cf28 
Public hosting types do not inherit experimental contracts, and internal
implementation types do not need consumer-facing experimental annotations.
@rogerbarreto
refactor(dotnet)!: inherit AgentServer options
3d76e1c 
Reuse the AgentServer option surface and defaults instead of duplicating
properties and tracking whether each setter was called.

BREAKING CHANGE: FoundryResponsesOptions now inherits ResponsesServerOptions.
Inherited AgentServer values are treated as the complete code override when
an options object is supplied.
@rogerbarreto
test(dotnet): split hosting extension tests
6c280b0
@rogerbarreto
fix(dotnet): use hosted sample builder
78b7cb0 
Source-deployed agents need IHostApplicationBuilder registration so AgentServer binds Foundry storage and task configuration.
@rogerbarreto
fix(dotnet): repair hosted source samples
49680d5 
Materialize linked helpers in deployment ZIPs, use the correct Azure OpenAI token audience, and keep approval replies on explicit conversations.
@rogerbarreto
build(dotnet): use local hosted sample refs
89db3a7 
In-repo builds need unreleased APIs while source-deployment ZIPs continue restoring published packages.
Copilot AI balanced review requested due to automatic review settings November 6, 2026 06:19
@rogerbarreto Roger Barreto (rogerbarreto) added the breaking change Usage: [PRs], Target: all PRs that introduce changes that are not backward compatible label Nov 6, 2026
@agent-framework-automation agent-framework-automation Bot added documentation Usage: [Issues, PRs], Target: documentation in the code base and learn docs .NET Usage: [Issues, PRs], Target: .Net labels Nov 6, 2026
Copilot AI reviewed Nov 6, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The migration note still recommends the removed GetHostedContext().UserId API, which produces code that no longer compiles, instead of session.GetHostedUserId().

1 open issue
What changed in this PR

This breaking preview-API cleanup addresses #10131 by narrowing Foundry Hosting to supported customer-facing APIs and correcting hosted-sample registration and source deployment.

Changes:

  • Internalizes or removes implementation APIs, standalone session stores, memory helpers, and request-time Toolbox markers.
  • Aligns hosting options with AgentServer, adds GetHostedUserId(), and types OAuth consent origins as ISet<Uri>.
  • Migrates hosted samples to host-builder registration and updates deployment preparation, tests, and documentation.

This pull request requires changes.

Two review comments remain unresolved:

  • Moderate — 1 vote: At HostApplicationBuilderExtensions.cs:130, add no-options registration coverage with ResponsesServer:ResilientBackground=true and SteerableConversations=true. Assert matching effective values in IOptions<ResponsesServerOptions> and IOptions<FoundryResponsesOptions>; the existing tests supply explicit options and bypass this configuration path.
  • Nit — 3 votes: At docs/decisions/0030-hosted-platform-context-agentserver-2.0.md:15, replace the removed GetHostedContext().UserId API with session.GetHostedUserId() so the migration example compiles.
File Description
dotnet/​tests/​Microsoft.Agents.AI.Foundry.UnitTests/​HostedMcpToolboxAIToolTests.cs Removes marker API tests.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.UnitTests/​FoundryFeatureUsageActivationTests.cs Removes marker activation coverage.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​TestAgentSessionStore.cs Adds shared test-only session storage.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​SteerableLongRunningIntegrationTests.cs Updates steering options and storage setup.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​ResilientTwoLifetimeIntegrationTests.cs Updates resilient registration options.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​OAuthConsentToolInvocationTests.cs Updates handler composition and test storage.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​OAuthConsentPolicyHandlerTests.cs Uses URI allowlists and configured discovery.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​OAuthConsentLinkPolicyTests.cs Tests URI-based origin configuration.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​OAuthConsentEmissionTests.cs Updates consent policy construction.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​InputConverterTests.cs Removes marker parsing tests.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​InMemoryAgentSessionStoreTests.cs Removes deleted store coverage.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​HostedWorkflowCheckpointingHealthCheckTests.cs Updates extension-class references.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​HostedUserIdTests.cs Tests platform-derived user identity.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​HostedResponsesRegistrationTests.cs Updates steering registration and storage setup.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​HostedOutboundUserAgentTests.cs Updates storage and extension references.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​HostedFoundryMemoryProviderServiceCollectionExtensionsTests.cs Removes memory registration-helper tests.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​HostedFoundryMemoryProviderScopesTests.cs Removes memory scope-helper tests.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​HostedConversationKeyTests.cs Covers distinct conversation and chain histories.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​HostApplicationBuilderExtensionsTests.cs Tests explicit options precedence.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryToolboxResponseScopeTests.cs Retains configured-discovery isolation coverage.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryToolboxMarkerScopingTests.cs Removes marker scoping tests.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryToolboxHealthCheckTests.cs Updates service construction.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryToolboxApprovalTests.cs Updates coverage for supported Toolbox discovery.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryResponsesOptionsTests.cs Checks inherited AgentServer defaults.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryListenPortTests.cs Updates extension-class constants.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryHostingAgentTests.cs Updates telemetry helper references.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FoundryAIToolExtensionsTests.cs Removes marker factory tests.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FileSystemAgentSessionStoreTests.cs Removes deleted filesystem-store coverage.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​FakeHostedSessionIsolationKeyProvider.cs Removes the obsolete identity-provider fake.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​EndpointRouteBuilderExtensionsTests.cs Covers readiness, protocol filtering, and Responses routing.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​ComputerToolHostingLoopTests.cs Updates handler composition and test storage.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​AgentSessionExtensionsTests.cs Tests hosted user-ID accessors and write-once behavior.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​AgentFrameworkResponseHandlerWorkflowTests.cs Updates workflow handler fixtures.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​AgentFrameworkResponseHandlerTelemetryTests.cs Updates telemetry fixtures and references.
dotnet/​tests/​Microsoft.Agents.AI.Foundry.Hosting.UnitTests/​AgentFrameworkResponseHandlerResilienceTests.cs Updates resilience fixtures and options.
dotnet/​tests/​Microsoft.Agents.AI.FeatureRegistry.UnitTests/​FeatureRegistryTests.cs Moves Toolbox feature ownership to Hosting.
dotnet/​tests/​Foundry.Hosting.IntegrationTests/​MemoryHostedAgentTests.cs Updates identity documentation.
dotnet/​tests/​Foundry.Hosting.IntegrationTests.TestContainer/​UserIdentityEchoAgent.cs Uses the hosted user-ID accessor.
dotnet/​tests/​Foundry.Hosting.IntegrationTests.TestContainer/​Program.cs Updates options and explicit memory scoping.
dotnet/​src/​Microsoft.Agents.AI.Foundry/​HostedMcpToolboxAITool.cs Removes the Toolbox marker type.
dotnet/​src/​Microsoft.Agents.AI.Foundry/​FoundryChatClient.cs Removes marker-specific feature tracking.
dotnet/​src/​Microsoft.Agents.AI.Foundry/​FoundryAITool.cs Removes the marker factory.
dotnet/​src/​Microsoft.Agents.AI.Foundry/​FeatureIndex.cs Removes Toolbox feature ownership.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​ToolApprovalIdMap.cs Removes obsolete storage documentation references.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​PlatformHostedSessionIsolationKeyProvider.cs Removes the platform identity-provider implementation.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​OAuthConsentLinkPolicy.cs Validates URI-based consent origins.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​Microsoft.Agents.AI.Foundry.Hosting.csproj Removes the Foundry project dependency and adjusts SDK references.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​InputConverter.cs Removes request-marker extraction.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​InMemoryAgentSessionStore.cs Removes standalone in-memory session storage.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedWorkflowCheckpointingHealthCheck.cs Removes experimental markers and updates references.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedStoredOutputHealthCheck.cs Removes experimental markers and updates references.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedSessionJsonUtilities.cs Removes obsolete identity serialization helpers.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedSessionIsolationKeyProvider.cs Removes the identity-provider abstraction.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedSessionContextExtensions.cs Removes context-based identity accessors.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedSessionContext.cs Removes the public identity wrapper.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedProtocolCompatibilityFilter.cs Updates configuration constant references.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedFoundryMemoryProviderServiceCollectionExtensions.cs Removes memory registration helpers.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedFoundryMemoryProviderScopes.cs Removes memory scope helpers.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostedConversationKey.cs Clarifies conversation and chain history separation.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​HostApplicationBuilderExtensions.cs Adds dedicated host-builder registration extensions.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryToolboxStartupStatus.cs Internalizes startup status.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryToolboxService.cs Internalizes discovery and removes marker resolution.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryToolboxOptions.cs Narrows configuration and types consent origins.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryToolboxHealthCheck.cs Updates extension references and experimental markers.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryResponsesOptions.cs Inherits AgentServer options.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryJsonCheckpointStore.cs Internalizes checkpoint storage.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryAIToolExtensions.cs Removes Toolbox marker factories.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FoundryAgentSessionStore.cs Internalizes session storage.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FileSystemAgentSessionStore.cs Removes standalone filesystem session storage.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​FeatureIndex.cs Adds Toolbox feature ownership.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​EndpointRouteBuilderExtensions.cs Separates endpoint mapping extensions.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​AgentSessionExtensions.cs Adds hosted user-ID accessors.
dotnet/​src/​Microsoft.Agents.AI.Foundry.Hosting/​AgentFrameworkResponseHandler.cs Internalizes handling and simplifies identity and Toolbox paths.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Using-Samples/​Hosted-Toolbox-AuthPaths-Client/​Program.cs Clarifies approval conversation continuity.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Workflow-Simple/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Workflow-Resilient/​README.md Updates options and storage guidance.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Workflow-Resilient/​Program.cs Uses an options object.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Workflow-Resilient-Long-Running/​README.md Documents prepared source deployment.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Workflow-Resilient-Long-Running/​Program.cs Uses an options object.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Workflow-Resilient-Long-Running/​HostedWorkflowResilientLongRunning.csproj Links helper source for deployment preparation.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Workflow-Handoff/​README.md Documents linked-helper materialization.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Workflow-Handoff/​Program.cs Updates registration, endpoint helper, and token scope.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Workflow-Handoff/​HostedWorkflowHandoff.csproj Includes the linked deployment endpoint helper.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-ToolboxMcpSkills/​README.md Clarifies approval conversation routing.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-ToolboxMcpSkills/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-ToolboxMcpSkills/​HostedToolboxMcpSkills.csproj Adds an explicit core framework dependency.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Toolbox/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Toolbox-AuthPaths/​Program.cs Updates registration and removes marker guidance.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-TextRag/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Steering/​README.md Updates options-object registration examples.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Steering/​Program.cs Uses an options object.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Observability/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-MemoryAgent/​Program.cs Uses hosted user IDs for explicit memory scoping.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-MemoryAgent/​HostedMemoryAgent.csproj Supports local framework project references.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-McpTools/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-LocalTools/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-LocalCodeAct/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Harness-Research/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-FoundryAgent/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-Files/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-ChatClientAgent/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-ChatClientAgent-Dockerfile/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-AzureSearchRag/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted-AgentSkills/​Program.cs Uses host-builder registration.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Hosted_Shared_Contributor_Setup/​IdempotentServiceClient.cs Accommodates linked-project using differences.
dotnet/​samples/​04-hosting/​FoundryHostedAgents/​responses/​Directory.Build.targets Substitutes local framework project references.
docs/​specs/​feature-usage-bit-registry.md Updates feature ownership and registration references.
docs/​decisions/​0035-foundry-hosting-resilient-long-running-agents.md Updates internal storage terminology.
docs/​decisions/​0031-hosted-per-user-session-storage-isolation.md Updates platform identity resolution guidance.
docs/​decisions/​0030-hosted-platform-context-agentserver-2.0.md Documents identity and memory API migration.

Review effort: Balanced

Comment thread docs/decisions/0030-hosted-platform-context-agentserver-2.0.md Resolved
github-actions[bot]
github-actions Bot reviewed Nov 6, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (19 commit(s)): ffb9942be4c2, db6c86f5f4fd, 9edc5778daf8, a1a82c0c0b95, 53233c975037, 41b802195fce, 7a746341f686, fa94d56b6293, a2ead508f034, 9318f8893a57, 44e42250e195, 3e515f3eeb9f, 73d8783d6e2e, 0f3cf2894486, 3d76e1cb1336, 6c280b06b31b, 78b7cb04100d, 49680d53d0b1, 89db3a77d1b3
Model: gpt-5.6-sol

Overview

The PR substantially reduces the public Hosting surface while retaining focused registration, routing, session, and options APIs, backed by strong tests around option precedence, request-scoped toolbox cleanup, OAuth links, and route registration. The remaining risk is concentrated in two core paths: non-Foundry hosts can no longer bind persisted identity to a trusted principal, and source-deployed samples compile in-repository against local APIs that their pinned deployment package does not contain. Both can prevent safe or successful use of the affected hosting flows.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 high) across 2 files. Details are attached to the affected lines below.

Affected areas: dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-Workflow-Handoff/Program.cs, dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/AgentFrameworkResponseHandler.cs

Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/AgentFrameworkResponseHandler.cs Resolved
Comment thread dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-Workflow-Handoff/Program.cs Resolved
@rogerbarreto
fix(dotnet): update hosted sample package pins
5df75ca 
Published 1.27 contains host-builder registration. Keep conditional source compatibility for APIs reduced on this branch and validate prepared ZIPs without a local feed.
baywet
Vincent Biret (baywet) reviewed Nov 6, 2026
View reviewed changes
Comment thread dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-Steering/Program.cs Resolved
Comment thread dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-Workflow-Handoff/Program.cs Resolved
Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/FoundryResponsesOptions.cs Resolved
Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/FoundryToolboxOptions.cs Resolved
Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/HostApplicationBuilderExtensions.cs Resolved
@rogerbarreto
build(dotnet): trim hosting dependencies
0ff1ea1 
Rely on existing transitive package and project references to keep the Foundry hosting package and hosting samples aligned with their minimal dependency closure.
@rogerbarreto
test(dotnet): cover middleware user identity
946be9f 
Prove hosts can replace x-agent-user-id in ASP.NET middleware before AgentServer creates its response context, without a custom isolation provider.
@rogerbarreto
fix(samples): use Foundry project for handoff
4f19b5d 
Use the Foundry project model and project-scoped identity instead of a separate Azure OpenAI resource. Temporarily pin MEAI OpenAI 10.11 because 10.10.1 returns 401 for hosted project-model calls.
@rogerbarreto
refactor(dotnet)!: remove response route prefix
baaa6bd 
Foundry fixes the container protocol endpoint at /responses. Keep local AIProjectClient compatibility in the client transport instead of expanding the hosted API.

BREAKING CHANGE: MapFoundryResponses no longer accepts a route prefix.
@rogerbarreto
refactor(dotnet)!: rename toolbox service API
c987dba 
Align toolbox options and registration names with FoundryToolboxService. Keep source samples compatible with the published 1.27 extension name until the next release.

BREAKING CHANGE: FoundryToolboxOptions is now FoundryToolboxServiceOptions, and AddFoundryToolboxes is now AddFoundryToolboxService.
@rogerbarreto
refactor(dotnet)!: clarify response options
f8a365a 
Align Foundry hosting options with ResponsesServerOptions naming, clarify inference-storage and reasoning-content semantics, and inject one concrete options snapshot into stateful services.

BREAKING CHANGE: FoundryResponsesOptions is now FoundryResponsesServerOptions. AllowStoredOutputEnabled is now InferenceStoredOutputAllowed. IncludeReasoningEncryptedContent is now ExcludeReasoningEncryptedContent with inverted semantics.
rogerbarreto
Roger Barreto (rogerbarreto) commented Nov 7, 2026
View reviewed changes

@rogerbarreto Roger Barreto (rogerbarreto) left a comment

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed the review feedback in the referenced commits. Validation covered affected Debug builds, published-package sample builds, Hosting unit tests, CI-container formatting, and live Handoff validation against tao-cace.

Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/EndpointRouteBuilderExtensions.cs Resolved
Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/FoundryResponsesOptions.cs Resolved
Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/FoundryResponsesOptions.cs Resolved
Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/HostApplicationBuilderExtensions.cs Resolved
Comment thread dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-Steering/Program.cs Resolved
Comment thread dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-Workflow-Handoff/Program.cs Resolved
Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/FoundryResponsesOptions.cs Resolved
Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/FoundryToolboxOptions.cs Resolved
Comment thread dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/AgentFrameworkResponseHandler.cs Resolved

This branch was successfully deployed

1 active deployment
github-app-auth — f8a365aa Deployed Nov 7, 2026 by rogerbarreto via add_label #27337
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@baywet Vincent Biret (baywet) baywet left review comments
@github-actions github-actions[bot] github-actions[bot] left review comments
Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@eavanvalkenburg Eduard van Valkenburg (eavanvalkenburg) Awaiting requested review from eavanvalkenburg eavanvalkenburg is a code owner
@SergeyMenshykh SergeyMenshykh Awaiting requested review from SergeyMenshykh SergeyMenshykh is a code owner
@westey-m westey (westey-m) Awaiting requested review from westey-m westey-m is a code owner
@jpalvarezl Jose Alvarez (jpalvarezl) Awaiting requested review from jpalvarezl jpalvarezl is a code owner
@sophia-ramsey sophia-ramsey Awaiting requested review from sophia-ramsey sophia-ramsey is a code owner
@dargilco Darren Cohen (dargilco) Awaiting requested review from dargilco dargilco is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@rogerbarreto Roger Barreto (rogerbarreto)

Labels

breaking change Usage: [PRs], Target: all PRs that introduce changes that are not backward compatible documentation Usage: [Issues, PRs], Target: documentation in the code base and learn docs .NET Usage: [Issues, PRs], Target: .Net

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

.NET: Reduce Foundry Hosting public API before stable release

3 participants

@rogerbarreto @baywet