[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

FoundryToolbox resolved platform headers from the MCP writer's connection-time task context, so a long-lived Toolbox could forward the first request's x-agent-foundry-call-id for later callers. This change binds Toolbox MCP sessions and skill-resource operations to the current request identity instead.

Description & Review Guide

• What are the major changes? Move platform-header propagation from httpx.Auth to the MCP dynamic-header boundary, reconnect the MCP session when effective request identity changes, scope skill-resource reads through the same operation lock, and isolate cached skill objects to one header identity at a time. Focused loopback regressions cover contextless initialization, concurrent callers, custom header providers, and tool/skill/resource calls.
• What is the impact of these changes? Long-lived Toolbox instances no longer retain stale or absent call IDs across requests. Request-owned factories remain supported for deterministic cleanup, while same-identity operations continue to reuse their session and skill discovery cache.
• What do you want reviewers to focus on? Session identity transitions under concurrency, the bounded single-identity skill cache, and strict-versus-ambient behavior when callers also provide a dynamic header provider.

Related Issue

Fixes #7690

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after a language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Copilot review overview

🟡 Changes recommended

Skill resource reads can silently omit headers required by a caller-provided dynamic header provider.

Review effort: Balanced
Findings: 1

Open (1)

• Resource reads drop required custom headers from header_provider · New

What changed in this PR

Fixes stale Foundry Toolbox call IDs by rebinding MCP sessions and skill resources to the current request identity.

Changes:

• Moves platform-header propagation to MCP operation boundaries.
• Serializes identity transitions and isolates skill caches by identity.
• Adds concurrency regressions and updates sample guidance.

File	Description
python/​packages/​foundry_hosting/​agent_framework_foundry_hosting/​_toolbox.py	Implements identity-aware sessions and resources.
python/​packages/​foundry_hosting/​tests/​test_toolbox.py	Adds header, concurrency, and cache tests.
python/​packages/​foundry_hosting/​README.md	Documents long-lived Toolbox behavior.
python/​samples/​04-hosting/​foundry-hosted-agents/​responses/​foundry_toolbox/​README.md	Updates lifecycle guidance.
python/​samples/​04-hosting/​foundry-hosted-agents/​responses/​foundry_toolbox/​main.py	Revises factory documentation.
python/​samples/​04-hosting/​foundry-hosted-agents/​responses/​foundry_toolbox_mcp_skills/​README.md	Documents identity-scoped skill operations.
python/​samples/​04-hosting/​foundry-hosted-agents/​responses/​foundry_toolbox_mcp_skills/​main.py	Revises lifecycle documentation.
python/​samples/​04-hosting/​foundry-hosted-agents/​responses/​files/​README.md	Updates Toolbox lifecycle explanation.
python/​samples/​04-hosting/​foundry-hosted-agents/​responses/​files/​main.py	Clarifies resource ownership.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Jose Alvarez (jpalvarezl)]

Reviewed the full diff, linked issue, CI, and existing resolved thread. The session rebinding, operation serialization, runtime-only header rejection for skill/resource reads, and identity-scoped skill caching address the stale call-ID scenarios with focused regression coverage.