Repository navigation
Python: Clarify Foundry agent tool ownership - #8852
Conversation
Some provider protocols cannot represent every tool-selection constraint. Revalidate fresh calls at the local dispatch boundary while preserving correlated results, execution budgets, and approval resumes.
GitHub Actions
Inactive
GitHub Actions
Inactive
agent-framework-automation
Bot
added
documentation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Approval-resume tests remain permissive and do not verify separation from fresh-call policy filtering.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Enforces tool_choice restrictions at Python’s local function-dispatch boundary.
Changes:
- Rejects disallowed fresh function calls with correlated errors.
- Excludes rejected calls from execution-budget accounting.
- Adds streaming, non-streaming, approval-resume tests and specification mapping.
| File | Description |
|---|---|
python/packages/core/agent_framework/_tools.py |
Filters fresh calls before dispatch. |
python/packages/core/tests/core/test_function_invocation_logic.py |
Adds policy and budget regressions. |
docs/specs/004-python-function-calling-loop.md |
Documents tool-selection behavior. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Code Coverage OverviewLanguages: Python Python / code-coverage/pythonThe overall line coverage in commit d405fd2 in the Show a line coverage summary of the most covered files.
Updated |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: Findings reported
Scope: full PR (1 commit(s)): c040c47161d6
Model: gpt-5.6-sol-fast
Overview
The PR adds a shared pre-dispatch filter that blocks fresh model calls excluded by tool_choice, preserves call/result ordering, and excludes synthetic rejections from the execution budget. The new streaming and non-streaming tests cover the immediate mixed-call and budget cases, while existing approval binding keeps recorded approval resumes separate. Two required-mode transitions still discard active restrictions and can allow a later model turn to execute a forbidden registered tool.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 high) across 1 file. Details are attached to the affected lines below.
Affected areas: python/packages/core/agent_framework/_tools.py
Preconfigured Foundry agents own tool selection server-side, so per-request tool controls cannot be propagated with an agent reference. Warn when callers provide ignored controls and document the boundary. Remove the generic core dispatch enforcement because it could not govern server-side tools and changed behavior for every provider. Copilot-Session: c2489530-5c17-4230-af9a-3b4448b5da1a
Roger Barreto (rogerbarreto)
changed the title
GitHub Actions
Inactive
GitHub Actions
Inactive
|
/review |
There was a problem hiding this comment.
MAF Automated Review — Iteration 2
Result: Findings reported
Scope: 1 net-new commit(s): b208f7b795ca
Model: gpt-5.6-sol
Overview
The PR clearly documents that preconfigured Foundry agents own remote tool declarations and selection, strips unsupported controls on both stable and preview paths, and preserves local approval and middleware authorization boundaries. The new warning logic is not aligned with the framework's option lifecycle, however: it reports the framework-generated tool_choice default as caller input while missing the public allow_multiple_tool_calls option entirely. Those two defects make the guidance noisy for ordinary runs and absent for one supported caller-facing control.
Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 medium) across 1 file. Details are attached to the affected lines below.
Affected areas: python/packages/foundry/agent_framework_foundry/_agent.py
Ignore the framework-generated unrestricted auto default and detect the public allow_multiple_tool_calls option before Foundry translates it for the provider. Copilot-Session: c2489530-5c17-4230-af9a-3b4448b5da1a
GitHub Actions
Inactive
GitHub Actions
Inactive
Motivation & Context
FoundryAgentconnects to a preconfigured PromptAgent or HostedAgent whose tool declarations and tool-selection behavior are owned by Microsoft Foundry. Per-request tool controls cannot be propagated alongside an agent reference, but this boundary was not explicit when callers supplied local function implementations.Description & Review Guide
FoundryAgent.toolssupplies matching local Python implementations only, warn when caller-suppliedtool_choicerestrictions orallow_multiple_tool_callsvalues are ignored, silently omit the framework's unrestrictedtool_choice="auto"default, and cover stable and preview agent paths with regression tests.FoundryChatClientremains the supported path when tool selection must vary per request.Related Issue
N/A. This maintenance change is not linked to a public issue.
Contribution Checklist
breaking changelabel (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.