Python: Add approval storage and improve truth checks

[westey (westey-m)]

Motivation & Context

Description & Review Guide

• What are the major changes?
• What is the impact of these changes?
• What do you want reviewers to focus on?

Related Issue

Fixes #

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/ag-ui/agent_framework_ag_ui
_agent_run.py	1402	140	90%	158, 218, 237, 284, 302, 318–319, 441, 494–495, 502, 611, 615, 617, 634, 661–662, 716, 745, 759, 763, 767, 770, 775, 780, 792, 799–805, 816, 830, 837, 847, 862, 865, 897, 932, 956, 969, 1018, 1033, 1036, 1038, 1064, 1066, 1068, 1071–1075, 1099, 1130, 1166, 1221–1222, 1264, 1278, 1323–1329, 1338, 1346, 1374, 1396, 1400, 1403, 1405, 1465–1466, 1472–1478, 1581, 1585–1586, 1589, 1594–1595, 1598, 1604–1605, 1609–1611, 1629–1631, 1656–1657, 1680–1681, 1694, 1736–1738, 1749–1751, 1753, 1767–1769, 1897, 1905, 1935, 1939, 1984, 2186, 2338, 2340, 2347, 2363, 2422, 2439, 2508, 2651, 2689, 2697, 2699, 2702, 2708, 2763, 2766, 2776–2777, 2784, 2831
_approval_lifecycle.py	558	50	91%	39, 51, 70, 249, 251, 253, 255, 285, 319, 321, 326, 334, 339, 349–355, 472, 475, 491, 519, 528, 538, 562, 636, 647, 650, 681, 686, 793, 802, 804, 818, 822, 838, 842, 854, 863, 888, 890, 894, 909, 928, 930, 1001–1003
_message_adapters.py	620	48	92%	169–170, 179–181, 184, 187–191, 193–198, 201, 210–212, 215–218, 254, 421, 542–544, 601, 604, 606, 609, 612, 628, 645, 667, 767, 783–784, 855, 877, 947, 982–983, 1051, 1094
packages/core/agent_framework
_tools.py	1481	96	93%	232–233, 410, 412, 425, 450–452, 460, 478, 492, 499, 506, 529, 531, 538, 546, 681, 715–717, 720–722, 724, 730, 781–783, 808, 834, 838, 876–878, 882, 1055, 1067, 1074–1077, 1098, 1106, 1120–1122, 1492, 1575, 1625, 1685–1686, 1743, 1790, 1797–1798, 1889, 1930–1931, 1966, 2062, 2076, 2079, 2086, 2089, 2095, 2107, 2124, 2133, 2141, 2145, 2165, 2167, 2174, 2232, 2235, 2258, 2265, 2270–2271, 2274, 2278, 2281, 2303, 2337, 2405, 2434–2435, 2532, 2560, 2600, 2603, 2660, 2813, 2906, 3441
_types.py	1293	98	92%	63, 73, 127, 136, 155, 157, 161, 165, 167, 169, 171, 189, 193, 219, 241, 246, 251, 255, 285, 711–712, 893–894, 1352, 1427, 1465, 1485, 1495, 1689–1691, 1976–1981, 2006, 2061, 2066, 2076, 2084, 2091–2095, 2113, 2186, 2199, 2204, 2317, 2601, 2625, 2724, 2905–2906, 3008, 3291, 3344, 3363, 3402, 3413, 3415–3419, 3421, 3424–3432, 3442, 3607, 3614, 3618–3620, 3765, 3770, 3775, 3780, 3784, 3870–3872, 3901, 3989–3993
packages/core/agent_framework/_harness
_tool_approval.py	364	40	89%	69, 72, 77, 114, 131, 134, 137, 194–195, 214, 243, 251, 262, 280–285, 297, 311, 334, 385, 408, 410–411, 443, 453, 468, 470–471, 473–474, 529–531, 583–584, 634, 643
packages/declarative/agent_framework_declarative/_workflows
_executors_mcp.py	245	22	91%	100, 323, 326, 332, 335, 344, 354, 358, 373, 376, 389, 392, 403–405, 417–419, 456–457, 515, 543
_executors_tools.py	172	1	99%	208
TOTAL	46770	4358	90%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9447	36 💤	0 ❌	0 🔥	2m 41s ⏱️

[Copilot]

Pull request overview

Adds session-bound approval storage and strict boolean authorization to prevent forged, replayed, or malformed approvals.

Changes:

• Rebinds approval responses to stored request snapshots.
• Requires literal True across core, declarative, and AG-UI paths.
• Adds regression tests and updates type-checker dependencies.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/uv.lock	Updates Pyrefly and Zuban.
python/packages/declarative/tests/test_function_tool_executor.py	Tests approval validation.
python/packages/declarative/tests/test_declarative_approval_binding.py	Tests malformed decisions.
python/packages/declarative/agent_framework_declarative/_workflows/_executors_tools.py	Enforces strict approvals.
python/packages/declarative/agent_framework_declarative/_workflows/_executors_mcp.py	Hardens MCP approvals.
python/packages/core/tests/core/test_types.py	Tests safe deserialization.
python/packages/core/tests/core/test_harness_tool_approval.py	Tests forged standing approvals.
python/packages/core/tests/core/test_function_invocation_logic.py	Tests binding and replay protection.
python/packages/core/agent_framework/_types.py	Normalizes malformed decisions.
python/packages/core/agent_framework/_tools.py	Stores and binds pending approvals.
python/packages/core/agent_framework/_harness/_tool_approval.py	Integrates binding with middleware.
python/packages/ag-ui/tests/ag_ui/test_run.py	Tests canonical decisions.
python/packages/ag-ui/tests/ag_ui/test_message_adapters.py	Tests adapter validation.
python/packages/ag-ui/tests/ag_ui/test_approval_result_event.py	Tests malformed rejection handling.
python/packages/ag-ui/agent_framework_ag_ui/_message_adapters.py	Applies strict truth checks.
python/packages/ag-ui/agent_framework_ag_ui/_agent_run.py	Makes pending entries immutable and validated.
docs/specs/004-python-function-calling-loop.md	Documents approval guarantees.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 0ae9dea73012
Model: gpt-5.6-sol

Overview

The PR strengthens local approval handling by snapshotting pending requests, rebinding responses to server-held call data, consuming approvals once, and requiring strict boolean decisions across core, AG-UI, and declarative paths. The new tests cover substitution, replay, malformed decisions, and forged history well. Residual risk remains because snapshot identity is based only on provider request IDs, is not tied to the tool registry that originated it, and grows for abandoned session approvals without a lifecycle bound.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (2 high, 1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/_tools.py

[Evan Mattson (moonbox3)]

westey (@westey-m) there are a couple of merge conflicts.

[westey (westey-m)]

westey (westey (@westey-m)) there are a couple of merge conflicts.

Thanks Evan Mattson (@moonbox3), I've resolved the conflicts