[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

A private security review identified several cases where FIDES could lose or weaken information-flow state across transcript replay, MCP result retention, hidden argument validation, durable serialization, and invalid tool metadata. These gaps could cause policy decisions to use less restrictive integrity or confidentiality information than the data warranted.

This change hardens SecureAgentConfig and the FIDES middleware pipeline while preserving restored session state and approval-resume behavior. Context-provider message labeling remains separate follow-up work because context providers are trusted plugins with an existing documented trust boundary.

Description & Review Guide

• What are the major changes?
  • Reconstruct missing FIDES state from caller-replayed and history-provider messages, using conservative labels for unstamped assistant/tool data while keeping restored state authoritative.
  • Retain MCP _meta.ifc in an independently bounded security carrier so generic Host-payload budget exhaustion cannot discard the label; malformed or unretainable supplied IFC metadata fails closed.
  • Split hidden-argument handling into policy preflight and post-authorization materialization so expanded values do not reach Pydantic validators or tool bodies before policy permits the call.
  • Serialize opaque FIDES state with ASCII escapes so lone Unicode surrogates round-trip through JSON and MessagePack session stores.
  • Parse FIDES tool metadata centrally and block unknown or mistyped values with an auditable invalid_policy violation.
  • Add regression coverage across core and AG-UI approval/replay paths and update the FIDES guidance.
• What is the impact of these changes?
  • Transcript replay without persisted FIDES state now restores a conservative cumulative label instead of starting trusted/public.
  • Invalid security metadata that previously warned and continued now blocks execution.
  • Validators no longer run on expanded hidden values for calls rejected by FIDES.
  • Existing restored sessions and AG-UI approval resumes retain their authoritative state and behavior.
  • Non-history context-provider messages remain under the documented trusted-plugin model pending the follow-up design.
• What do you want reviewers to focus on?
  • The boundary between reconstructing missing replay state and preserving restored session state.
  • Approval binding and argument-materialization ordering, including validator transformations and runtime kwargs.
  • The independent MCP IFC carrier, its size bound, and fail-closed handling.

Related Issue

N/A - security hardening based on a privately reported issue. Per SECURITY.md, vulnerability details are not tracked in a public GitHub issue; maintainer direction was explicitly confirmed before implementation. The context-provider labeling follow-up is tracked separately in #9645 and is intentionally not closed by this PR. No competing open PR was found.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: GitHub Copilot assisted with the security assessment, implementation, regression tests, documentation updates, and PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-code-quality]

Code coverage overview

Languages: Python

Python / code-coverage/python

main edc2427	fix-fides-security-h... 8c315f7	+/-
92%	92%	0%

View coverage of the 5 most impacted files.

File	main edc2427	fix-fides-security-h... 8c315f7	+/-
packages/core/a...amework/_mcp.py	91%	90%	-1%
packages/core/a...ork/security.py	90%	90%	0%
packages/ag-ui/...i/_agent_run.py	90%	90%	0%
packages/core/a...ework/_tools.py	95%	95%	0%
packages/core/a.../_middleware.py	96%	96%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 23, 2026 18:19 UTC}

[Copilot]

🟡 Changes recommended

Replay reconstruction can miss loaded history and lose identity-scoped restrictions, leaving downstream policy checks weaker than required.

3 open issues

• Propagate replay labels from nested function-result content · New
• Preserve replay restrictions when user identity principals are invalid · New
• Run history label reconstruction after persisted history loading · New

What changed in this PR

This PR hardens Python FIDES information-flow enforcement across transcript replay, MCP results, hidden arguments, and persisted session state. Non-history context-provider labeling remains a separate follow-up.

Changes:

• Reconstruct missing replay security state while preserving restored labels.
• Retain MCP security metadata independently and reject invalid tool policies.
• Defer hidden-value validation until authorization, support surrogate-safe serialization, and add regression tests and guidance.

File	Description
python/​samples/​02-agents/​security/​FIDES_DEVELOPER_GUIDE.md	Documents replay handling, metadata validation, and authorization ordering.
python/​packages/​core/​tests/​test_security.py	Adds policy, replay, serialization, and validator regressions.
python/​packages/​core/​tests/​core/​test_mcp.py	Tests security-label retention when payload budgets are exhausted.
python/​packages/​core/​agent_framework/​security.py	Implements replay reconstruction, policy parsing, and deferred argument materialization.
python/​packages/​core/​agent_framework/​_tools.py	Integrates deferred security argument materialization into invocation.
python/​packages/​core/​agent_framework/​_middleware.py	Tracks the active function middleware pipeline.
python/​packages/​core/​agent_framework/​_mcp.py	Adds an independently bounded security-metadata carrier.
docs/​features/​FIDES_IMPLEMENTATION_SUMMARY.md	Clarifies enforced flows and context-provider trust boundaries.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 634139edf460
Model: gpt-5.6-sol

Overview

The PR adds conservative replay reconstruction, independently bounded MCP IFC retention, delayed hidden-argument materialization, ASCII-safe durable state, and centralized tool-policy parsing. Its strongest guardrails are fail-closed MCP labeling, identity-bound argument materialization, unconditional ContextVar cleanup, and targeted regression coverage. Two gaps remain: restored sessions stop conservatively labeling newly supplied assistant/tool input, and explicit null enum policies bypass the new invalid-policy path.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (1 high, 1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/security.py