[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Production and regulated hosts commonly disable sensitive-data capture while retaining operational telemetry. Exception messages could still expose tool results, URLs, query strings, and other private values through span status descriptions, exception events, workflow events, MCP spans, and function failure logs even when sensitive-data capture was disabled.

This change makes the sensitive-data setting the consistent boundary for exception text while retaining low-cardinality failure diagnostics.

Description & Review Guide

• What are the major changes? Exception capture now always records error.type and ERROR status, but records exception events and message-bearing status descriptions only when sensitive-data capture is enabled. Explicit tool logs, workflow/build events, and MCP error descriptions follow the same policy. Workflow child spans no longer bypass the policy through OpenTelemetry's automatic exception capture, and MCP spans preserve semantic error types such as tool_error.
• What is the impact of these changes? Sensitive-data-disabled telemetry remains useful for failure counts and classification without exporting exception text. Enabling sensitive-data capture preserves the existing detailed diagnostics. Runtime exception propagation is unchanged.
• What do you want reviewers to focus on? Please review the consistency of the sensitive-data gating across shared observability helpers, workflow spans, and MCP retry/error paths, especially preservation of MCP tool_error semantics.

Related Issue

Fixes #9263

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with the implementation, regression tests, and PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

Workflow failure events still expose exception messages and tracebacks when sensitive-data capture is disabled.

2 open findings

• Redact workflow failure details when sensitive data is disabled · New
• Prevent exception text leakage in streamed failure events · New

What changed in this PR

Redacts exception details from Python telemetry when sensitive-data capture is disabled while retaining error classification.

Changes:

• Gates exception events, status descriptions, workflow events, and logs.
• Preserves MCP error semantics.
• Adds regression coverage across tools, workflows, agents, and MCP.

File	Description
tests/​workflow/​test_workflow_observability.py	Tests workflow error telemetry redaction.
tests/​workflow/​test_edge.py	Tests edge-span redaction.
tests/​core/​test_tools.py	Tests tool-span and log redaction.
tests/​core/​test_observability.py	Tests shared exception policy.
tests/​core/​test_mcp_observability.py	Tests MCP error telemetry.
agent_framework/​observability.py	Centralizes sensitive exception capture.
agent_framework/​_workflows/​_workflow.py	Gates workflow span error messages.
agent_framework/​_workflows/​_workflow_builder.py	Gates build error details.
agent_framework/​_workflows/​_functional.py	Gates functional workflow span events.
agent_framework/​_tools.py	Redacts function failure logs.
agent_framework/​_mcp.py	Applies redaction across MCP operations.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-code-quality]

Code Coverage Overview

Languages: Python

Python / code-coverage/python

The overall line coverage in commit eba7bf6 in the fix-issue-9263 branch remains at 92%, unchanged from commit ec47b90 in the main branch.

Show a line coverage summary of the most impacted files.

File	main ec47b90	fix-issue-9263 eba7bf6	+/-
packages/core/a...amework/_mcp.py	92%	92%	0%
packages/core/a...bservability.py	93%	93%	0%
packages/core/a.../_functional.py	91%	91%	0%
packages/core/a...ws/_workflow.py	94%	94%	0%
packages/core/a...flow_builder.py	94%	94%	0%
packages/core/a...ws/_executor.py	94%	94%	0%
packages/core/a...ework/_tools.py	95%	95%	0%
packages/core/a...lows/_events.py	92%	92%	0%
packages/core/a..._edge_runner.py	91%	92%	+1%

---

_{Updated October 14, 2026 09:00 UTC}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 8db7eb41ee90
Model: gpt-5.6-sol

Overview

The PR consistently routes ordinary tool, workflow, and MCP failures through sensitive-data gates, and its parameterized tests verify both redacted and detailed modes across the principal internal paths. Internal MCP handlers preserve low-cardinality error classification, but the exported MCP span helper drops all failure status for unhandled exceptions when redaction is active. The new workflow wrapper also broadens exception handling beyond OpenTelemetry's prior behavior and reports expected task cancellation as an error.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/observability.py

[Jose Alvarez (jpalvarezl)]

Found one remaining sensitive-data logging path.

[Jose Alvarez (jpalvarezl)]

The prior constructor leak is partially fixed, but remaining MCP failure logs still bypass the gate.

[Jose Alvarez (jpalvarezl)]

The reviewed connect/retry paths are fixed, but other raw MCP exception logs still bypass the new gate.

[Jose Alvarez (jpalvarezl)]

The sensitive-data boundary is now consistently applied across exception spans, workflow events, framework exception construction, and all exception-bearing MCP logs. Sensitive-off retains error type/status and stable operational diagnostics without messages or tracebacks; sensitive-on preserves detailed behavior. The follow-up regression coverage addresses the reviewed paths.

[Jose Alvarez (jpalvarezl)]

Re-reviewed the current head after the main merge and MCP task-abandonment follow-up. _MCPTaskAbandoned now uses the same sensitive-data-gated automatic logging policy, its failure paths retain caller-visible exception details without exporting them when sensitive data is disabled, and opt-in detailed logging remains compatible. The current net diff remains ready.