[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

AG-UI request Shared State is client-owned and is merged into AgentSession.state, except for a protected set of server-owned namespaces. Standalone FIDES security middleware (LabelTrackingFunctionMiddleware, PolicyEnforcementFunctionMiddleware) keeps its context label, hidden variables, and pending policy approvals in AgentSession.state under __agent_framework_fides_security__ (or its configured session_state_key), but that key was not in the protected set. This extends the protected-namespace handling used for tool approval state (#8714) to that security state.

Description & Review Guide

• What are the major changes?
  • _request_state_protected_keys now also protects the standalone FIDES session-state key. The default key is always protected; a configured session_state_key is discovered from FIDES function middleware on the agent or its client.
  • The key is protected from request state only. It is deliberately not added to the provider service-session reservations, so it keeps persisting in private Session Continuation State.
  • Tests cover the endpoint (middleware on the agent, in a bundle, behind a forwarding wrapper, and on the client; default and custom keys; request and stored Shared State), continuation across requests, malformed values, and the discovery helper. The AG-UI AGENTS.md and README are updated.
• What is the impact of these changes?
  • Request or stored Shared State under those keys is no longer copied into AgentSession.state. Server-produced FIDES state persists across requests as before, and ordinary Shared State is unchanged. No public API, dependency, or core changes.
  • A non-default session_state_key on middleware that is injected after the run starts, or hidden behind a wrapper that does not expose its key, is not discovered. The default key is always protected, and SecureAgentConfig (provider state under its source_id) is unaffected. This boundary is documented.
• What do you want reviewers to focus on?
  • Discovering configured keys through the middleware's _security_session_state_key attribute (cross-package private usage per CODING_STANDARD.md), and spelling the default key literally because importing agent_framework.security emits its experimental-feature warning for every AG-UI user. A test pins the literal to the core constant.
  • The key is added only to the request-state protected set, not to _RESERVED_SERVICE_SESSION_STATE_KEYS, which would also drop it from private Session Continuation State.

Related Issue

N/A - no existing issue. This extends the protected-namespace handling from #8714 to another server-owned session-state key.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Implementation, tests, documentation, and this PR description were AI-assisted (GitHub Copilot).

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

The narrowly scoped protection is consistent with existing state ownership handling and has comprehensive coverage.

0 open findings

What changed in this PR

Protects standalone FIDES security state from untrusted AG-UI Shared State while preserving private session continuation.

Changes:

• Protects default and discoverable custom FIDES state keys.
• Adds endpoint and helper coverage for middleware configurations and malformed state.
• Documents protection and discovery boundaries.

File	Description
python/​packages/​ag-ui/​agent_framework_ag_ui/​_agent_run.py	Discovers and protects FIDES state keys.
python/​packages/​ag-ui/​tests/​ag_ui/​test_run.py	Tests key discovery and continuation serialization.
python/​packages/​ag-ui/​tests/​ag_ui/​test_endpoint.py	Adds end-to-end security and persistence tests.
python/​packages/​ag-ui/​README.md	Documents user-facing behavior.
python/​packages/​ag-ui/​AGENTS.md	Records implementation invariants.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): 888506743616
Model: gpt-5.6-sol

Overview

The PR filters the default and discoverable custom standalone FIDES namespaces at the AG-UI Shared State merge boundary while preserving those namespaces in private Session Continuation State. The implementation is backed by default-key parity, middleware-location, malformed-state, snapshot-forgery, and cross-request continuation tests. No PR-introduced Critical, High, or Medium defect remained after reconciliation.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.