Addressed additional properties metadata in the conversion fallback.

Delegate MCP ContentBlock to AIContent conversion to the MCP SDK
Merge branch 'main' into peibekwe/declarative-toolbox
2026-06-16 21:04:09 +08:00 · 2026-05-15 12:38:49 -07:00 · 2026-05-15 11:45:12 -07:00 · 2026-05-14 10:19:00 -07:00 · 2026-05-13 15:34:27 -07:00 · 2026-05-13 13:47:37 -07:00
562 changed files with 5500 additions and 51581 deletions
@@ -17,7 +17,7 @@ runs:
    using: "composite"
    steps:
      - name: Set up uv
-        uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
+        uses: astral-sh/setup-uv@v6
        with:
            version-file: "python/pyproject.toml"
            enable-cache: true
@@ -32,13 +32,7 @@ runs:
              if grep -q "name = \"$pkg\"" "$f"; then
                pkg_dir=$(dirname "$f" | sed 's|python/||')
                echo "Excluding workspace package: $pkg ($pkg_dir)"
-                if awk '/^\[tool\.uv\.workspace\]/{f=1;next} /^\[/{f=0} f && /^exclude = \[/{found=1} END{exit !found}' python/pyproject.toml; then
-                  if ! awk '/^\[tool\.uv\.workspace\]/{f=1;next} /^\[/{f=0} f && /^exclude = \[/ && index($0, "\"'"$pkg_dir"'\"")' python/pyproject.toml | grep -q .; then
-                    sed -i.bak '/\[tool\.uv\.workspace\]/,/^\[/ { /^exclude = \[/ s|\]|, "'"$pkg_dir"'"]| }' python/pyproject.toml
-                  fi
-                else
-                  sed -i.bak '/\[tool\.uv\.workspace\]/a\exclude = ["'"$pkg_dir"'"]' python/pyproject.toml
-                fi
+                sed -i.bak '/\[tool\.uv\.workspace\]/a\exclude = ["'"$pkg_dir"'"]' python/pyproject.toml
                sed -i.bak '/'"$pkg"' = { workspace = true }/d' python/pyproject.toml
              fi
            done
@@ -46,4 +40,4 @@ runs:
      - name: Install the project
        shell: bash
        run: |
-          cd python && uv sync --all-packages --all-extras --dev --prerelease=if-necessary-or-explicit
+          cd python && uv sync --all-packages --all-extras --dev -U --prerelease=if-necessary-or-explicit
@@ -24,7 +24,7 @@ runs:
  using: "composite"
  steps:
    - name: Set up Node.js environment
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      uses: actions/setup-node@v6
      with:
        node-version: 22

@@ -37,7 +37,7 @@ runs:
      run: copilot --version && copilot -p "What can you do in one sentence?"

    - name: Azure CLI Login
-      uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+      uses: azure/login@v2
      with:
        client-id: ${{ inputs.azure-client-id }}
        tenant-id: ${{ inputs.azure-tenant-id }}
@@ -44,15 +44,9 @@ updates:

  # Maintain dependencies for github-actions
  - package-ecosystem: "github-actions"
-    # Cover both the standard workflow location and our composite actions.
-    # With `directory: "/"` Dependabot only scans `.github/workflows/*.{yml,yaml}`
-    # plus a root-level `action.yml/action.yaml`. It does NOT recurse into
-    # `.github/actions/*/action.yml`, so the glob below is required to keep the
-    # composite actions in `.github/actions/<name>/` up to date as well.
-    # Ref: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#directories-or-directory--
-    directories:
-      - "/"
-      - "/.github/actions/*"
+    # Workflow files stored in the
+    # default location of `.github/workflows`
+    directory: "/"
    schedule:
      interval: "weekly"
      day: "sunday"
@@ -32,13 +32,13 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
        with:
          persist-credentials: false

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4
+        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -51,7 +51,7 @@ jobs:
      # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
      # If this step fails, then you should remove it and run the build manually (see below)
      - name: Autobuild
-        uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4
+        uses: github/codeql-action/autobuild@v4

      # ℹ️ Command-line programs to run using the OS shell.
      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -64,6 +64,6 @@ jobs:
      #     ./location_of_script_within_repo/buildscript.sh

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4
+        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{matrix.language}}"
@@ -66,7 +66,7 @@ jobs:

      - name: Check PR author team membership
        id: check
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        env:
          TEAM_NAME: ${{ secrets.DEVELOPER_TEAM }}
          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
@@ -116,7 +116,7 @@ jobs:
    steps:
      # Safe checkout: base repo only, not the untrusted PR head.
      - name: Checkout target repo base
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
        with:
          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }}
          fetch-depth: 0
@@ -125,7 +125,7 @@ jobs:

      # Private DevFlow checkout: the PAT/token grants access to this repo's code.
      - name: Checkout DevFlow
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.DEVFLOW_REPOSITORY }}
          ref: ${{ env.DEVFLOW_REF }}
@@ -135,12 +135,12 @@ jobs:
          path: devflow

      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@v7
        with:
          version: "0.11.x"
          enable-cache: true
@@ -41,8 +41,8 @@ jobs:
      functionsChanged: ${{ steps.filter.outputs.functions }}
      coreChanged: ${{ steps.filter.outputs.core }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
@@ -111,7 +111,7 @@ jobs:

    runs-on: ${{ matrix.os }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
            persist-credentials: false
            sparse-checkout: |
@@ -122,7 +122,7 @@ jobs:
              declarative-agents

      - name: Setup dotnet
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        uses: actions/setup-dotnet@v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json
      - name: Build dotnet solutions
@@ -181,7 +181,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    environment: ${{ matrix.environment }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
            persist-credentials: false
            sparse-checkout: |
@@ -202,7 +202,7 @@ jobs:
          echo "COSMOSDB_EMULATOR_AVAILABLE=true" >> $env:GITHUB_ENV

      - name: Setup dotnet
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        uses: actions/setup-dotnet@v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

@@ -271,7 +271,7 @@ jobs:

      - name: Azure CLI Login
        if: github.event_name != 'pull_request' && matrix.integration-tests
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -318,7 +318,7 @@ jobs:
      # Generate test reports and check coverage
      - name: Generate test reports
        if: matrix.targetFramework == env.COVERAGE_FRAMEWORK
-        uses: danielpalme/ReportGenerator-GitHub-Action@2a82782178b2816d9d6960a7345fdd164791b323 # 5.5.3
+        uses: danielpalme/ReportGenerator-GitHub-Action@5.5.3
        with:
          reports: "./TestResults/Coverage/**/*.cobertura.xml"
          targetdir: "./TestResults/Reports"
@@ -326,7 +326,7 @@ jobs:

      - name: Upload coverage report artifact
        if: matrix.targetFramework == env.COVERAGE_FRAMEWORK
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: CoverageReport-${{ matrix.os }}-${{ matrix.targetFramework }}-${{ matrix.configuration }} # Artifact name
          path: ./TestResults/Reports # Directory containing files to upload
@@ -338,7 +338,7 @@ jobs:

      - name: Upload integration test results
        if: always() && github.event_name != 'pull_request' && matrix.integration-tests
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: dotnet-test-results-${{ matrix.targetFramework }}-${{ matrix.os }}
          path: IntegrationTestResults/**/*.junit
@@ -356,7 +356,7 @@ jobs:
    env:
      configuration: Release
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -366,7 +366,7 @@ jobs:
            python

      - name: Setup dotnet
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        uses: actions/setup-dotnet@v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

@@ -381,7 +381,7 @@ jobs:
        run: dotnet build dotnet/tests/Foundry.Hosting.IntegrationTests/Foundry.Hosting.IntegrationTests.csproj -c "$configuration" --warnaserror

      - name: Azure CLI Login
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -442,7 +442,7 @@ jobs:
    runs-on: ubuntu-latest
    environment: integration
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -453,7 +453,7 @@ jobs:
            declarative-agents

      - name: Setup dotnet
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        uses: actions/setup-dotnet@v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

@@ -465,7 +465,7 @@ jobs:
          dotnet build ./tests/Microsoft.Agents.AI.Hosting.AzureFunctions.IntegrationTests -c Release -f net10.0 --warnaserror

      - name: Azure CLI Login
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -522,7 +522,7 @@ jobs:

      - name: Upload functions test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: dotnet-test-results-functions-net10.0-ubuntu-latest
          path: IntegrationTestResults/**/*.junit
@@ -560,14 +560,14 @@ jobs:
      - name: Fail workflow if tests failed
        id: check_tests_failed
        if: contains(join(needs.*.result, ','), 'failure')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        with:
          script: core.setFailed('Integration Tests Failed!')

      - name: Fail workflow if tests cancelled
        id: check_tests_cancelled
        if: contains(join(needs.*.result, ','), 'cancelled')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        with:
          script: core.setFailed('Integration Tests Cancelled!')

@@ -585,7 +585,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -597,12 +597,12 @@ jobs:
          python-version: "3.13"
          os: ${{ runner.os }}
      - name: Download all test results from current run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@v4
        with:
          pattern: dotnet-test-results-*
          path: dotnet-test-results/
      - name: Restore report history cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/restore@v4
        with:
          path: python/dotnet-integration-report-history.json
          key: dotnet-integration-report-history-${{ github.run_id }}
@@ -619,13 +619,13 @@ jobs:
        run: cat dotnet-integration-test-report.md >> $GITHUB_STEP_SUMMARY
      - name: Save report history cache
        if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/save@v4
        with:
          path: python/dotnet-integration-report-history.json
          key: dotnet-integration-report-history-${{ github.run_id }}
      - name: Upload trend report
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: dotnet-integration-test-report
          path: |
@@ -30,7 +30,7 @@ jobs:

    steps:
      - name: Check out code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -42,7 +42,7 @@ jobs:
      - name: Get changed files
        id: changed-files
        if: github.event_name == 'pull_request'
-        uses: jitterbit/get-changed-files@b17fbb00bdc0c0f63fcf166580804b4d2cdc2a42 # v1
+        uses: jitterbit/get-changed-files@v1
        continue-on-error: true

      - name: No C# files changed
@@ -29,7 +29,7 @@ jobs:
    environment: integration
    timeout-minutes: 60
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -50,7 +50,7 @@ jobs:
          echo "COSMOS_EMULATOR_AVAILABLE=true" >> $env:GITHUB_ENV

      - name: Setup dotnet
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        uses: actions/setup-dotnet@v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

@@ -63,7 +63,7 @@ jobs:
          done

      - name: Azure CLI Login
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -41,7 +41,7 @@ jobs:
    environment: 'integration'
    timeout-minutes: 90
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          sparse-checkout: |
@@ -52,13 +52,13 @@ jobs:
            declarative-agents

      - name: Setup dotnet
-        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
+        uses: actions/setup-dotnet@v5.2.0
        with:
          global-json-file: ${{ github.workspace }}/dotnet/global.json

      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -123,7 +123,7 @@ jobs:

      - name: Upload results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: verify-samples-results
          path: |
@@ -53,7 +53,7 @@ jobs:
          echo "repo=${GITHUB_REPOSITORY}" >> "$GITHUB_OUTPUT"

      - name: Checkout scripts
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
        with:
          sparse-checkout: .github/scripts
          fetch-depth: 1
@@ -61,7 +61,7 @@ jobs:

      - name: Check issue author team membership
        id: check
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        env:
          TEAM_NAME: ${{ secrets.DEVELOPER_TEAM }}
          ISSUE_NUMBER: ${{ steps.issue.outputs.issue_number }}
@@ -93,7 +93,7 @@ jobs:
    steps:
      # Safe checkout: base repo only.
      - name: Checkout target repo base
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
          persist-credentials: false
@@ -101,7 +101,7 @@ jobs:

      # Private DevFlow (maf-dashboard) checkout.
      - name: Checkout DevFlow
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@v6
        with:
          repository: ${{ env.DEVFLOW_REPOSITORY }}
          ref: ${{ env.DEVFLOW_REF }}
@@ -111,12 +111,12 @@ jobs:
          path: devflow

      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@v7
        with:
          version: "0.11.x"
          enable-cache: true
@@ -126,7 +126,7 @@ jobs:
        run: uv sync --frozen

      - name: Azure CLI Login
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -137,7 +137,6 @@ jobs:
        working-directory: ${{ env.DEVFLOW_PATH }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          DEVFLOW_TOKEN: ${{ secrets.DEVFLOW_TOKEN }}
          SK_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
          AGENT_REPO_PATH: ${{ env.TARGET_REPO_PATH }}
          ISSUE_REPO: ${{ needs.team_check.outputs.repo }}
@@ -150,14 +149,16 @@ jobs:
            --apply-labels

      - name: Stop after spam gate
-        if: ${{ steps.spam.outputs.allow_triage != 'true' }}
+        if: ${{ steps.spam.outputs.decision != 'allow' }}
        shell: bash
+        env:
+          SPAM_DECISION: ${{ steps.spam.outputs.decision }}
        run: |
-          echo "Stopping: issue triage preflight did not allow automation."
+          echo "Stopping: spam gate decided: ${SPAM_DECISION}"
          exit 1

      - name: Reproduce reported issue
-        if: ${{ steps.spam.outputs.allow_triage == 'true' }}
+        if: ${{ steps.spam.outputs.decision == 'allow' }}
        id: repro
        working-directory: ${{ env.DEVFLOW_PATH }}
        env:
@@ -13,7 +13,7 @@ jobs:
    permissions:
      issues: write
    steps:
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+      - uses: actions/github-script@v8
        with:
          github-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
          script: |
@@ -16,6 +16,6 @@ jobs:
      pull-requests: write

    steps:
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6
+      - uses: actions/labeler@v6
        with:
          repo-token: "${{ secrets.GH_ACTIONS_PR_WRITE }}"
@@ -15,7 +15,7 @@ jobs:
      pull-requests: write

    steps:
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+      - uses: actions/github-script@v8
        name: "Issue/PR: update title"
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -19,13 +19,13 @@ jobs:
    runs-on: ubuntu-22.04
    # check out the latest version of the code
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      # Checks the status of hyperlinks in all files
      - name: Run linkspector
-        uses: umbrelladocs/action-linkspector@963b6264d7de32c904942a70b488d3407453049e # v1
+        uses: umbrelladocs/action-linkspector@v1
        with:
          reporter: local
          filter_mode: nofilter
@@ -19,7 +19,7 @@ jobs:
    steps:
      - name: Wait for required checks
        if: github.event_name == 'pull_request'
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        env:
          TIMEOUT_SECONDS: "3600"
          INTERVAL_SECONDS: "30"
@@ -27,7 +27,7 @@ jobs:
    env:
      UV_PYTHON: ${{ matrix.python-version }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Set up python and install the project
@@ -38,11 +38,11 @@ jobs:
          os: ${{ runner.os }}
        env:
          UV_CACHE_DIR: /tmp/.uv-cache
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      - uses: actions/cache@v5
        with:
          path: ~/.cache/prek
          key: prek|${{ matrix.python-version }}|${{ hashFiles('python/.pre-commit-config.yaml') }}
-      - uses: j178/prek-action@0bb87d7f00b0c99306c8bcb8b8beba1eb581c037 # v1
+      - uses: j178/prek-action@v1
        name: Run Pre-commit Hooks (excluding poe-check)
        env:
          SKIP: poe-check
@@ -64,7 +64,7 @@ jobs:
    env:
      UV_PYTHON: ${{ matrix.python-version }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Set up python and install the project
@@ -93,7 +93,7 @@ jobs:
    env:
      UV_PYTHON: ${{ matrix.python-version }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Set up python and install the project
@@ -124,7 +124,7 @@ jobs:
    env:
      UV_PYTHON: ${{ matrix.python-version }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Set up python and install the project
@@ -22,7 +22,7 @@ jobs:
      UV_PYTHON: "3.13"
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -44,7 +44,7 @@ jobs:
      - name: Upload dependency range report
        # Always publish the report so failures are inspectable even when validation fails.
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: dependency-range-results
          path: python/scripts/dependencies/dependency-range-results.json
@@ -53,7 +53,7 @@ jobs:
      - name: Create issues for failed dependency candidates
        # Always process the report so failed candidates create actionable tracking issues.
        if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        with:
          script: |
            const fs = require("fs")
@@ -18,7 +18,7 @@ jobs:
      UV_PYTHON: "3.13"
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -24,9 +24,9 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up uv
-        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        uses: astral-sh/setup-uv@v7
        with:
          version-file: "python/pyproject.toml"
          enable-cache: true
@@ -36,7 +36,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -69,7 +69,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -90,7 +90,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-openai
          path: ./python/pytest.xml
@@ -112,7 +112,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -123,7 +123,7 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Azure CLI Login
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -141,7 +141,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-azure-openai
          path: ./python/pytest.xml
@@ -163,7 +163,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -177,7 +177,7 @@ jobs:
        run: curl -fsSL https://ollama.com/install.sh | sh
        working-directory: .
      - name: Cache Ollama models
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@v4
        with:
          path: ~/.ollama/models
          key: ollama-models-qwen2.5-1.5b-nomic-embed-text-v1
@@ -231,7 +231,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-misc
          path: ./python/pytest.xml
@@ -283,7 +283,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -294,7 +294,7 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Azure CLI Login
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -315,7 +315,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-functions
          path: ./python/pytest.xml
@@ -341,7 +341,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -352,7 +352,7 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Azure CLI Login
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -369,7 +369,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-foundry
          path: ./python/pytest.xml
@@ -388,7 +388,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -399,7 +399,7 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Azure CLI Login
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -416,7 +416,7 @@ jobs:
          --junitxml=pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-foundry-hosting
          path: ./python/pytest.xml
@@ -443,7 +443,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -468,7 +468,7 @@ jobs:
        run: uv run --directory packages/azure-cosmos poe integration-tests -n logical --dist worksteal --timeout=120 --session-timeout=900 --timeout_method thread --retries 2 --retry-delay 5 --junitxml=${{ github.workspace }}/python/pytest.xml
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-cosmos
          path: ./python/pytest.xml
@@ -496,7 +496,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
        with:
          ref: ${{ inputs.checkout-ref }}
          persist-credentials: false
@@ -506,12 +506,12 @@ jobs:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Download all test results from current run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@v4
        with:
          pattern: test-results-*
          path: test-results/
      - name: Restore report history cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/restore@v4
        with:
          path: python/integration-report-history.json
          key: integration-report-history-integration-${{ github.run_id }}
@@ -528,13 +528,13 @@ jobs:
        run: cat integration-test-report.md >> $GITHUB_STEP_SUMMARY
      - name: Save report history cache
        if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/save@v4
        with:
          path: python/integration-report-history.json
          key: integration-report-history-integration-${{ github.run_id }}
      - name: Upload unified trend report
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: integration-test-report
          path: |
@@ -558,12 +558,12 @@ jobs:
    steps:
      - name: Fail workflow if tests failed
        if: contains(join(needs.*.result, ','), 'failure')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        with:
          script: core.setFailed('Integration Tests Failed!')

      - name: Fail workflow if tests cancelled
        if: contains(join(needs.*.result, ','), 'cancelled')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        with:
          script: core.setFailed('Integration Tests Cancelled!')
@@ -24,8 +24,8 @@ jobs:
    outputs:
      pythonChanges: ${{ steps.filter.outputs.python}}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
@@ -59,7 +59,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Set up python and install the project
        id: python-setup
@@ -94,7 +94,7 @@ jobs:
      # Surface failing tests
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/packages/lab/**.xml
          summary: true
@@ -41,8 +41,8 @@ jobs:
      foundryHostingChanged: ${{ steps.filter.outputs.foundry_hosting }}
      cosmosChanged: ${{ steps.filter.outputs.cosmos }}
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
@@ -106,7 +106,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -123,7 +123,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -153,7 +153,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -177,7 +177,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -186,7 +186,7 @@ jobs:
          title: OpenAI integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-openai
          path: ./python/pytest.xml
@@ -214,7 +214,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -223,7 +223,7 @@ jobs:
          os: ${{ runner.os }}
      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -247,7 +247,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -256,7 +256,7 @@ jobs:
          title: Azure OpenAI integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-azure-openai
          path: ./python/pytest.xml
@@ -284,7 +284,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -295,7 +295,7 @@ jobs:
        run: curl -fsSL https://ollama.com/install.sh | sh
        working-directory: .
      - name: Cache Ollama models
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@v4
        with:
          path: ~/.ollama/models
          key: ollama-models-qwen2.5-1.5b-nomic-embed-text-v1
@@ -370,7 +370,7 @@ jobs:
          kill -KILL -- "-$server_pid" 2>/dev/null || kill -KILL "$server_pid" 2>/dev/null || true
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -379,7 +379,7 @@ jobs:
          title: Misc integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-misc
          path: ./python/pytest.xml
@@ -417,7 +417,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -426,7 +426,7 @@ jobs:
          os: ${{ runner.os }}
      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -448,7 +448,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -457,7 +457,7 @@ jobs:
          title: Functions integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-functions
          path: ./python/pytest.xml
@@ -488,7 +488,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -497,7 +497,7 @@ jobs:
          os: ${{ runner.os }}
      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -515,7 +515,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -524,7 +524,7 @@ jobs:
          title: Test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-foundry
          path: ./python/pytest.xml
@@ -549,7 +549,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -558,7 +558,7 @@ jobs:
          os: ${{ runner.os }}
      - name: Azure CLI Login
        if: github.event_name != 'pull_request'
-        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2
+        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -576,7 +576,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -585,7 +585,7 @@ jobs:
          title: Foundry Hosting integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-foundry-hosting
          path: ./python/pytest.xml
@@ -620,7 +620,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -643,7 +643,7 @@ jobs:
        working-directory: ./python
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -652,7 +652,7 @@ jobs:
          title: Cosmos integration test results
      - name: Upload test results
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: test-results-cosmos
          path: ./python/pytest.xml
@@ -680,19 +680,19 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        uses: ./.github/actions/python-setup
        with:
          python-version: ${{ env.UV_PYTHON }}
          os: ${{ runner.os }}
      - name: Download all test results from current run
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@v4
        with:
          pattern: test-results-*
          path: test-results/
      - name: Restore report history cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/restore@v4
        with:
          path: python/integration-report-history.json
          key: integration-report-history-merge-${{ github.run_id }}
@@ -709,13 +709,13 @@ jobs:
        run: cat integration-test-report.md >> $GITHUB_STEP_SUMMARY
      - name: Save report history cache
        if: always()
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/save@v4
        with:
          path: python/integration-report-history.json
          key: integration-report-history-merge-${{ github.run_id }}
      - name: Upload unified trend report
        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          name: integration-test-report
          path: |
@@ -740,13 +740,13 @@ jobs:
      - name: Fail workflow if tests failed
        id: check_tests_failed
        if: contains(join(needs.*.result, ','), 'failure')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        with:
          script: core.setFailed('Integration Tests Failed!')

      - name: Fail workflow if tests cancelled
        id: check_tests_cancelled
        if: contains(join(needs.*.result, ','), 'cancelled')
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@v8
        with:
          script: core.setFailed('Integration Tests Cancelled!')
@@ -23,7 +23,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -56,7 +56,7 @@ jobs:
      - name: Build the package
        run: uv run poe --directory packages/${{ env.PACKAGE }} build
      - name: Release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@v2
        with:
          files: |
            python/dist/*
@@ -29,7 +29,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -49,7 +49,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 01-get-started --save-report --report-name 01-get-started

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-01-get-started
@@ -82,7 +82,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -111,7 +111,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents --exclude providers --save-report --report-name 02-agents

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents
@@ -130,7 +130,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -152,7 +152,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/openai --save-report --report-name 02-agents-openai

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents-openai
@@ -170,7 +170,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -191,7 +191,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/azure --save-report --report-name 02-agents-azure

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents-azure
@@ -208,7 +208,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -228,7 +228,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/anthropic --save-report --report-name 02-agents-anthropic

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents-anthropic
@@ -242,7 +242,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -257,7 +257,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/github_copilot --save-report --report-name 02-agents-github-copilot

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents-github-copilot
@@ -274,7 +274,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -289,7 +289,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/amazon --save-report --report-name 02-agents-amazon

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents-amazon
@@ -306,7 +306,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -321,7 +321,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/ollama --save-report --report-name 02-agents-ollama

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents-ollama
@@ -341,7 +341,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -363,7 +363,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/foundry --save-report --report-name 02-agents-foundry

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents-foundry
@@ -383,7 +383,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -405,7 +405,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/copilotstudio --save-report --report-name 02-agents-copilotstudio

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents-copilotstudio
@@ -419,7 +419,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -434,7 +434,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 02-agents/providers/custom --save-report --report-name 02-agents-custom

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-02-agents-custom
@@ -451,7 +451,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -471,7 +471,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 03-workflows --save-report --report-name 03-workflows

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-03-workflows
@@ -491,7 +491,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -506,7 +506,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 04-hosting --save-report --report-name 04-hosting

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-04-hosting
@@ -534,7 +534,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -549,7 +549,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir 05-end-to-end --save-report --report-name 05-end-to-end

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-05-end-to-end
@@ -574,7 +574,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -599,7 +599,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir autogen-migration --save-report --report-name autogen-migration

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-autogen-migration
@@ -633,7 +633,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Setup environment
        uses: ./.github/actions/sample-validation-setup
@@ -662,7 +662,7 @@ jobs:
          cd scripts && uv run python -m sample_validation --subdir semantic-kernel-migration --save-report --report-name semantic-kernel-migration

      - name: Upload validation report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-report-semantic-kernel-migration
@@ -690,10 +690,10 @@ jobs:
      - validate-autogen-migration
      - validate-semantic-kernel-migration
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

      - name: Download all validation reports
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        uses: actions/download-artifact@v7
        with:
          pattern: validation-report-*
          path: reports/
@@ -701,7 +701,7 @@ jobs:

      - name: Restore validation history
        id: cache-restore
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/restore@v4
        with:
          path: validation-history/
          key: validation-history-${{ github.run_id }}
@@ -719,13 +719,13 @@ jobs:
        run: cat trend-report.md >> "$GITHUB_STEP_SUMMARY"

      - name: Save validation history
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/save@v4
        with:
          path: validation-history/
          key: validation-history-${{ github.run_id }}

      - name: Upload trend report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: validation-trend-report
@@ -19,9 +19,9 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Download coverage report
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@v8
        with:
          github-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
          run-id: ${{ github.event.workflow_run.id }}
@@ -46,7 +46,7 @@ jobs:
          echo "PR_NUMBER=$PR_NUMBER" >> "$GITHUB_ENV"
      - name: Pytest coverage comment
        id: coverageComment
-        uses: MishaKav/pytest-coverage-comment@26f986d2599c288bb62f623d29c2da98609e9cd4 # v1.6.0
+        uses: MishaKav/pytest-coverage-comment@v1.6.0
        with:
          github-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}
          issue-number: ${{ env.PR_NUMBER }}
@@ -22,7 +22,7 @@ jobs:
    env:
      UV_PYTHON: "3.11"
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      # Save the PR number to a file since the workflow_run event
      # in the coverage report workflow does not have access to it
      - name: Save PR number
@@ -42,7 +42,7 @@ jobs:
      - name: Check coverage threshold
        run: python ${{ github.workspace }}/.github/workflows/python-check-coverage.py python-coverage.xml ${{ env.COVERAGE_THRESHOLD }}
      - name: Upload coverage report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@v7
        with:
          path: |
            python/python-coverage.xml
@@ -27,7 +27,7 @@ jobs:
      run:
        working-directory: python
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6
      - name: Set up python and install the project
        id: python-setup
        uses: ./.github/actions/python-setup
@@ -46,7 +46,7 @@ jobs:
      # Surface failing tests
      - name: Surface failing tests
        if: always()
-        uses: pmeier/pytest-results-action@20b595761ba9bf89e115e875f8bc863f913bc8ad # v0.7.2
+        uses: pmeier/pytest-results-action@v0.7.2
        with:
          path: ./python/pytest.xml
          summary: true
@@ -31,9 +31,9 @@ jobs:
      issues: write
      pull-requests: write
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@v6

-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: actions/setup-python@v5
        with:
          python-version: '3.13'

@@ -1,84 +0,0 @@
---
-status: accepted
-contact: rogerbarreto
-date: 2026-05-07
-deciders: rogerbarreto
-consulted: []
-informed: []
---
-
-# Hosted session identity context for Foundry Hosting
-
-## Context and Problem Statement
-
-Server-hosted Foundry agents need a way to scope per-user state (most notably `FoundryMemoryProvider` memories) by the end user that initiated the request. The Foundry platform already injects `x-agent-user-isolation-key` and `x-agent-chat-isolation-key` headers on every Responses request, but the agent-framework hosting layer did not surface those values to `AIContextProvider` instances. The provider's `stateInitializer` only received an `AgentSession?` with no identity attached, so per-user scoping was impossible without out-of-band plumbing.
-
-## Decision Drivers
-
- Memory and any future user-private context must be partitioned per end user without per-sample boilerplate.
- The identity must be **read-only** from the perspective of `AIContextProvider`s, so a buggy or hostile provider cannot escalate or leak across users.
- The persisted session must validate against the live request on every resume to defend against session-id leak and in-process tampering.
- The change must work for every existing hosted-agent type (`ChatClientAgent`, `FoundryAgent`, future ones) without per-type refactoring of cast-heavy code paths in `Microsoft.Agents.AI`.
- Local Docker debugging must remain possible when the platform headers are absent.
-
-## Considered Options
-
-1. **`HostedSessionContext` stored in `AgentSessionStateBag`, exposed via a public read accessor and an `internal` setter.** Hosting writes once on session creation and validates on every resume.
-2. **Specialised `HostedAgentSession : AgentSession` wrapper** that carries `UserId`/`ChatId` properties, with `GetService<ChatClientAgentSession>()` as the unwrap escape hatch.
-3. **New property on `AgentSession` base class** (`HostedSessionContext? HostedContext { get; internal set; }`).
-4. **AsyncLocal middleware** that reads the headers and stuffs them into a per-request `AsyncLocal<HostedSessionContext>` consumed by the provider.
-
-For the source of identity:
- A. The platform-injected `IsolationContext` exposed by `ResponseContext.Isolation` (typed `UserIsolationKey`/`ChatIsolationKey`).
- B. The OpenAI Responses spec's top-level `request.User` field.
- C. A custom HTTP header `x-client-user`.
-
-## Decision Outcome
-
-**Option 1** was chosen for the storage shape, sourced from **Option A** (`ResponseContext.Isolation`).
-
-Rationale:
-
- **Wrapper rejected (Option 2).** `ChatClientAgentSession` is `sealed` and `ChatClientAgent` rejects any other session type via direct `is not ChatClientAgentSession` checks at multiple call sites. Wrapping would force non-trivial refactors across `Microsoft.Agents.AI` and a corresponding repeat for every other agent type.
- **Base-class property rejected (Option 3).** Leaks "hosted" semantics into the universal `AgentSession` abstraction used by Durable, A2A, and CopilotStudio agents that have no notion of a hosted user.
- **AsyncLocal rejected (Option 4).** Surfaces the concept only locally, requires every consumer to re-implement the bridge, and cannot be enforced as read-only.
- **`request.User` rejected (Option B).** Set by the caller, not the platform. Forging it client-side trivially defeats per-user partitioning.
- **`x-client-user` rejected (Option C).** Non-standard, requires custom HTTP plumbing, and duplicates the platform-provided isolation contract.
-
-Implementation summary in `Microsoft.Agents.AI.Foundry.Hosting`:
-
-| Type | Visibility | Purpose |
-|---|---|---|
-| `HostedSessionContext` | public sealed | Captures `UserId` and `ChatId` (both required, non-whitespace). |
-| `HostedSessionContextExtensions.GetHostedContext` | public | Read accessor for `AIContextProvider`s. |
-| `HostedSessionContextExtensions.SetHostedContext` | internal | Writer reserved for the hosting assembly. Backed by `AgentSessionStateBag` under a well-known key for serialisation. |
-| `HostedSessionIsolationKeyProvider` (abstract) | public | DI-resolvable factory. Async signature: `ValueTask<HostedSessionContext?> GetKeysAsync(ResponseContext, CreateResponse, CancellationToken)`. |
-| `PlatformHostedSessionIsolationKeyProvider` | internal sealed | Default implementation. Maps `context.Isolation.UserIsolationKey` and `context.Isolation.ChatIsolationKey`. Returns `null` when either is absent. |
-
-Behaviour added to `AgentFrameworkResponseHandler.CreateAsync`:
-
-1. Resolve `HostedSessionIsolationKeyProvider` from DI; fall back to `PlatformHostedSessionIsolationKeyProvider`.
-2. Call `GetKeysAsync(context, request, cancellationToken)`. A `null` result throws `InvalidOperationException` (becomes 500). A null/whitespace `UserId` or `ChatId` is rejected by `HostedSessionContext`'s constructor.
-3. Branch on the **session's existing context**, not on whether a `conversation_id` was supplied:
-   - **No session (`session is null`):** nothing to stamp; skip.
-   - **Session present but un-stamped (`GetHostedContext() is null`):** treat as fresh. This covers both newly-created sessions and pre-existing sessions whose `conversation_id` was provisioned externally (e.g. via `conversations.CreateProjectConversationAsync()`) before the first hosted-agent request. Stamp the resolved identity now.
-   - **Session present with stamped context:** strict resume. The persisted `UserId` and `ChatId` must equal the resolved values exactly. Mismatch throws `ResponsesApiException` with status 403 and body `Hosted session identity context mismatch`.
-
-## Consequences
-
-Positive:
-
- Per-user memory partitioning works out of the box for any agent that consumes a `Microsoft.Agents.AI.Foundry.FoundryMemoryProvider` configured to read `session.GetHostedContext().UserId`.
- Cross-user session-id leak and in-process tampering of the persisted identity both surface as a 403 with a deliberately uninformative body.
- The identity is opaque to the framework, matching the platform's semantics. The framework never inspects user identity; the `IsolationContext` keys are pre-partitioned per agent.
-
-Negative:
-
- Every existing hosted sample fails locally without a `HostedSessionIsolationKeyProvider` registered, because the platform headers are absent outside the platform. Mitigated by shipping `Hosted_Shared_Contributor_Setup` with `DevTemporaryLocalSessionIsolationKeyProvider` and `AddDevTemporaryLocalContributorSetup`, and migrating all 9 existing responses samples.
- An attacker who can plant an un-stamped session under a victim's `conversation_id` *before* the victim's first hosted-agent request would be stamped with the attacker's identity on that first request. This is not a regression vs. behaviour without this contract, and is mitigated in practice because the `conversation_id` namespace is allocated by the platform per project. Once a session is stamped, the strict equality check fully defends the resume path.
-
-## Out of scope
-
- Per-request `User` field on `CreateResponse` is intentionally not consumed; only the platform `IsolationContext` headers carry trustworthy identity.
- Generic (non-Foundry) hosting layers can re-define an equivalent type if needed; nothing in this ADR is moved into `Microsoft.Agents.AI.Hosting` because `Microsoft.Agents.AI.Foundry.Hosting` does not depend on it.
- HMAC tamper signatures over the persisted context are not implemented; comparison against `ResponseContext.Isolation` on every request is sufficient because the platform sets those headers at the trust boundary.
@@ -1,145 +0,0 @@
---
-status: proposed
-contact: eavanvalkenburg
-date: 2026-06-11
-deciders: eavanvalkenburg
---
-
-# Python minimal hosting core and pluggable channels
-
-## Context and Problem Statement
-
-Agent Framework has several protocol-specific hosting surfaces. App authors who want one agent or workflow on multiple protocols must compose servers, routes, middleware, session handling, and lifecycle code by hand.
-
-We will introduce a small Python hosting core that owns the common server shape and leaves protocol details inside channel packages. The first public contract must be intentionally narrow so Python can ship a base contract before adding identity linking, proactive delivery, or multicast behavior. Other language implementations may reuse the same conceptual boundary, but this ADR records the Python decision.
-
-## Decision Drivers
-
- Keep the first host easy to explain: one app, one hostable target, one or more channels.
- Reuse Agent Framework's existing agent, workflow, session, history, and checkpoint primitives.
- Let channel packages own protocol parsing, protocol responses, authentication details, and native command surfaces.
- Make session continuity explicit through a channel-supplied `ChannelSession(isolation_key=...)`.
- Avoid approving cross-channel identity and delivery semantics before their safety model is reviewed.
-
-## Considered Options
-
-1. Keep only protocol-specific hosts.
-2. Ship a large hosting core with identity linking, authorization, background delivery, active-channel routing, and multicast in v1.
-3. Ship a minimal host/channel core now and track linking/multicast as follow-up work.
-
-### Keep only protocol-specific hosts
-
- Good: no new abstraction or package surface.
- Neutral: each protocol can continue evolving independently.
- Bad: every multi-channel app still has to compose servers, lifecycle, and session handling by hand.
-
-### Ship the large cross-channel host in v1
-
- Good: the richest cross-channel scenarios are available immediately.
- Neutral: the host becomes the natural place to demonstrate identity and delivery policy.
- Bad: v1 becomes a security-sensitive identity and delivery system before the safety model is reviewed.
-
-### Ship the minimal core now
-
- Good: the host/channel boundary can be implemented, tested, and explained without solving linking and durable delivery at the same time.
- Neutral: apps that need richer behavior must build it locally or wait for ADR-0028 follow-up work.
- Bad: proactive delivery and multicast scenarios are deliberately absent from v1.
-
-## Decision Outcome
-
-Chosen option: **minimal host/channel core now, follow-up enhancements later**.
-
-`AgentFrameworkHost` owns:
-
- one application object,
- one hostable target (`SupportsAgentRun` agent-compatible object or a `Workflow`), and
- one or more channels.
-
-Channels own:
-
- contributed routes, middleware, commands, and lifecycle callbacks,
- protocol-native request parsing into `ChannelRequest`,
- protocol-native rendering of the originating response, and
- any channel-specific authentication or signature validation.
-
-The host owns:
-
- route/lifecycle aggregation,
- invocation of the target,
- `ChannelSession(isolation_key=...)` to `AgentSession` resolution and caching,
- `reset_session(isolation_key=...)`,
- host-level middleware, including Foundry isolation middleware only when the Foundry hosting environment flag is present,
- invocation of per-channel hooks (`ChannelRunHook`, `ChannelResponseHook`, `ChannelStreamUpdateHook`), and
- workflow checkpoint wiring through an explicit `checkpoint_location`.
-
-`ChannelIdentity`, when present, is request metadata only. In v1 it is not a linking, authorization, or delivery key.
-
-### Trust boundary for `isolation_key`
-
-The host treats `ChannelSession.isolation_key` as a session partition key, not as proof of identity. Channels or host middleware must authenticate and authorize any externally supplied value before passing it to the host. For example, a Responses caller must not be allowed to choose an arbitrary `previous_response_id` or header-derived key unless the platform or middleware has already established that the caller owns that conversation. The host deliberately does not infer that trust from the string itself.
-
-### Hook ownership
-
-Channels provide hook configuration and protocol-native context. The host invokes those hooks as part of the common invocation pipeline:
-
- `ChannelRunHook` runs after channel parsing and before target invocation.
- `ChannelResponseHook` runs after target invocation and before the originating channel serializes its response.
- `ChannelStreamUpdateHook` is applied by the host while the channel consumes streamed updates because streaming serialization is protocol-specific.
-
-`ChannelStreamUpdateHook` is an update hook, not a final-response sanitizer. Channels that use it for redaction or filtering must also apply equivalent policy to any final response they render. Channels choose whether the response is streaming before run hooks execute.
-
-This keeps hook call conventions centralized while leaving protocol payload parsing and response formatting in channel packages.
-
-### State owned by v1
-
-`state_dir` is limited to host-owned local files for reset-session aliases and workflow checkpoint path derivation. It does not store linked identities, active-channel state, response-routing state, continuation records, durable runner queues, or delivery attempts. Those storage concerns belong to ADR-0028.
-
-## Non-goals for v1
-
-The following are deliberately **not** part of the v1 contract:
-
- cross-channel identity linking (`IdentityLinker`, `local_identity_link`, or `agent-framework-hosting-entra`),
- identity allowlists or authorization policy (`IdentityAllowlist`, `AuthPolicy`),
- response routing beyond the originating channel (`ResponseTarget`, active channel, specific linked channel, `all_linked`),
- push or payload codecs (`ChannelPush`, `ChannelPushCodec`),
- background/continuation delivery,
- durable task runners (`DurableTaskRunner`, `InProcessTaskRunner`),
- retry/replay policy (`RetryPolicy`),
- fan-out, multicast, or all-linked delivery,
- confidentiality tiers and `LinkPolicy`, and
- a host-level multi-agent router.
-
-These areas are follow-up enhancements covered by [ADR-0028](0028-hosting-linking-multicast-enhancements.md). They are not prerequisites for shipping or using the v1 host.
-
-## Consequences
-
-Positive:
-
- The host/channel model can be implemented and tested without designing a security-sensitive identity graph.
- Existing and new channel packages can share one Starlette app, middleware stack, lifecycle, and target invocation path.
- Session continuity is explicit and debuggable: two channels share history only when they produce the same `isolation_key`.
- Hook invocation is centralized in the host, so channels do not each invent the call convention.
-
-Negative:
-
- Apps that need OAuth linking, allowlists, proactive messages, or multicast must continue to implement those behaviors outside the v1 host.
- Some richer cross-channel scenarios from the original design move to a separate decision and validation cycle.
- The host must document `isolation_key` trust clearly because it now provides the shared session boundary.
-
-## Validation Gates
-
-Before this ADR is accepted:
-
- A sample can expose one target on multiple channels with one `AgentFrameworkHost` and no handwritten Starlette route composition.
- Built-in channel tests prove that routes, commands, startup, and shutdown callbacks are contributed by channels and aggregated by the host.
- Session tests prove that identical `ChannelSession.isolation_key` values resolve to the same cached `AgentSession`, and `reset_session` rotates that mapping.
- Channel tests prove that each channel renders only its own originating response; there is no host-level push, multicast, or active-channel delivery path.
- Workflow tests or samples use an explicit `checkpoint_location`.
- Foundry isolation middleware is documented and covered by integration or contract tests, including the non-Foundry case where raw isolation headers are ignored.
- The v1 API and packages do not expose the removed symbols or packages listed in [Non-goals for v1](#non-goals-for-v1).
- The Python spec is updated to match this simplified contract and uses "public", "stable", or "released" terminology for Agent Framework APIs.
-
-## More Information
-
- Python v1 specification: [SPEC-002](../specs/002-python-hosting-channels.md)
- Follow-up linking and multicast ADR: [ADR-0028](0028-hosting-linking-multicast-enhancements.md)
@@ -1,132 +0,0 @@
---
-status: proposed
-contact: eavanvalkenburg
-date: 2026-06-11
-deciders: eavanvalkenburg
---
-
-# Hosting linking and multicast enhancements
-
-## Context and Problem Statement
-
-[ADR-0027](0027-hosting-channels.md) defines the minimal v1 hosting core: originating-channel responses, explicit `ChannelSession.isolation_key`, and no host-level identity linking, push, multicast, background delivery, or durable runners.
-
-This ADR tracks the richer cross-channel behaviors that were removed from v1. These enhancements are **follow-up work** and are **not prerequisites** for shipping, using, or stabilizing the v1 host/channel core.
-
-## Decision Drivers
-
- Cross-channel continuity must not create accidental cross-user, cross-tenant, or cross-channel data leaks.
- Non-originating delivery must be observable, idempotent, retryable, and supportable.
- Protocol payloads must remain channel-native while still being safe to persist and replay.
- App authors need opt-in policy controls, not hidden defaults.
- The enhancement stack should layer on top of the v1 host without reshaping the minimal channel contract.
-
-## Enhancement Areas
-
-The follow-up design should cover these capabilities together because they share identity, storage, delivery, and replay concerns:
-
- **Cross-channel identity linking** — a user can connect multiple `ChannelIdentity` values to one channel-neutral `isolation_key`.
- **Authorization and allowlist policy** — channels or hosts can require verified identity, allow specific native identities or claims, and deny unknown callers.
- **Non-originating response delivery** — a run can respond somewhere other than the request's originating protocol when explicitly configured.
- **Active-channel routing** — delivery can target the most recently observed linked channel for an `isolation_key`.
- **Multicast / all-linked delivery** — delivery can fan out to every linked channel or a selected set.
- **Background runs and continuation tokens** — long-running requests can return immediately and complete later, with a polling/status fallback.
- **Durable delivery runners** — delivery work can survive process restarts and support dead-letter handling.
- **Retry and replay semantics** — delivery attempts are bounded, deduplicated, and safe to replay.
- **Payload serialization** — channel-specific payloads can be persisted, redacted, versioned, and reconstructed without losing protocol fidelity.
-
-Candidate API names from the broader design (`IdentityLinker`, `IdentityAllowlist`, `AuthPolicy`, `ResponseTarget`, `ChannelPush`, `ChannelPushCodec`, `DurableTaskRunner`, `InProcessTaskRunner`, `RetryPolicy`, `LinkPolicy`) remain design vocabulary for this ADR. They are not approved v1 APIs.
-
-## Considered Options
-
-### Option A — Leave all behavior to applications
-
-Applications implement linking, authorization, push, retry, and serialization independently.
-
- Good: the hosting core stays very small.
- Neutral: advanced apps can still build what they need.
- Bad: every app must solve the same security and delivery problems, likely inconsistently.
-
-### Option B — Add the full enhancement stack to v1
-
-The first host release includes linking, authorization, active channel, multicast, background runs, durable runners, and codecs.
-
- Good: the original cross-channel experience is available immediately.
- Neutral: samples can demonstrate rich end-to-end flows.
- Bad: v1 becomes security-sensitive, storage-heavy, and harder to stabilize.
-
-### Option C — Layer opt-in enhancement packages after v1
-
-Ship the minimal host first, then add linking, authorization, and delivery packages behind explicit configuration.
-
- Good: v1 remains simple while leaving room for a reviewed, supportable enhancement stack.
- Neutral: apps that need advanced delivery wait for follow-up packages.
- Bad: the first release does not satisfy proactive or all-linked scenarios.
-
-### Option D — Build only platform-specific integrations
-
-Implement linking and proactive delivery separately in Telegram, Activity Protocol, Discord, and future channels.
-
- Good: each package can match its protocol exactly.
- Neutral: some shared abstractions may emerge later.
- Bad: cross-channel behavior becomes fragmented and hard to reason about.
-
-## Decision Outcome
-
-Proposed direction: **Option C — layered opt-in enhancement packages after v1**.
-
-The minimal host remains the foundation. Follow-up packages may add linking, authorization, delivery, and durable execution, but must be explicitly enabled and must pass the validation gates below before becoming part of the public contract.
-
-## Safety Requirements
-
-### Threat model
-
-The design must account for:
-
- spoofed channel-native identities,
- stolen or replayed link challenges,
- cross-tenant or cross-confidentiality data leakage,
- unsolicited proactive messages,
- malicious payloads persisted for replay,
- denial-of-service through fan-out or retry storms, and
- privacy leakage through logs, metrics, or support tooling.
-
-Required mitigations include verified identity claims where available, signed and expiring link challenges, explicit user consent, per-channel capability checks, default-deny policy options, tenant partitioning, and uninformative denial messages on shared channels.
-
-### Idempotency and replay
-
-Exactly-once delivery is not a realistic guarantee. The design must provide:
-
- stable run, continuation, and delivery-attempt identifiers,
- channel-level idempotency keys where protocols support them,
- bounded retry with jitter and explicit terminal states,
- replay windows and expiration,
- duplicate suppression for persisted attempts, and
- clear semantics for "delivered", "accepted by platform", and "observed by user".
-
-### Storage
-
-Enhancement storage must stay distinct from v1 `AgentSession` history and workflow checkpoints unless an implementation deliberately backs them with the same physical store.
-
-Stored data should be schema-versioned, minimized, encrypted or otherwise protected as appropriate, and partitioned by tenant/project. Link records, continuation records, active-channel state, delivery attempts, dead letters, and serialized payloads need independent TTL and deletion policies.
-
-### Observability and support
-
-The design must include structured logs, traces, and metrics for link attempts, authorization decisions, delivery scheduling, retries, replay, and dead-letter outcomes. Logs must avoid message content and sensitive identity claims by default. Operators need a way to inspect, revoke, replay, or purge stuck records safely.
-
-## Validation Gates
-
-Before these enhancements are accepted:
-
- A reviewed threat model covers identity linking, authorization, non-originating delivery, multicast, and replay.
- Cross-channel linking tests prove a verified identity can link two channels and that unlink/deny paths do not leak information.
- Authorization tests cover native-id allowlists, verified-claim allowlists, default-deny behavior, and misconfiguration failures.
- Delivery tests cover originating-only, specific-channel, active-channel, selected-channel, and all-linked routing.
- Background/continuation tests cover polling fallback, cancellation or expiration, process restart, retry, and dead-letter behavior.
- Codec tests prove payloads are versioned, redacted where needed, backward compatible, and rejected safely when unknown.
- Multicast tests prove fan-out is bounded, independently retried, and idempotent per destination.
- Observability tests or manual validation prove support operators can correlate a request to delivery attempts without exposing sensitive content.
-
-## Relationship to ADR-0027
-
-ADR-0027 remains valid without any of these enhancements. This ADR extends the hosting model only after the safety, storage, and support requirements above are satisfied.
@@ -1,320 +0,0 @@
---
-status: proposed
-contact: eavanvalkenburg
-date: 2026-06-11
-deciders: eavanvalkenburg
---
-
-# Python hosting core and pluggable channels
-
-## Scope
-
-This specification is the Python implementation plan for [ADR-0027](../decisions/0027-hosting-channels.md). It documents the simplified v1 host/channel contract only.
-
-The v1 contract is:
-
- `AgentFrameworkHost` owns one Starlette app, one hostable target, and one or more channels.
- A hostable target is either a `SupportsAgentRun`-compatible agent or a `Workflow`.
- Channels contribute routes, middleware, commands, and lifecycle callbacks.
- Channels parse protocol-native input into `ChannelRequest`.
- Channels render their own originating response.
- Session continuity is explicit: a channel supplies `ChannelSession(isolation_key=...)`, and the host resolves/caches an `AgentSession` for that key.
- The host invokes `ChannelRunHook` and `ChannelResponseHook`; channels provide hook configuration and protocol context.
-
-The host does not link identities, route responses to other channels, run background continuations, or multicast in v1. Those enhancements are tracked in [ADR-0028](../decisions/0028-hosting-linking-multicast-enhancements.md).
-
-## Goals
-
- Let an app expose one agent or workflow on multiple protocols without handwritten Starlette composition.
- Keep protocol parsing and response formatting inside channel packages.
- Provide one session-resolution path shared by all channels.
- Keep the channel authoring surface small enough for new channels to implement.
- Preserve full-fidelity agent and workflow results until a channel decides how to render them.
-
-## Non-goals for v1
-
-The following are removed from the v1 implementation pass:
-
- `IdentityLinker`, `IdentityAllowlist`, `AuthPolicy`, and `LinkPolicy`
- `ResponseTarget`, active-channel routing, `all_linked`, fan-out, and multicast
- `ChannelPush` and `ChannelPushCodec`
- `DurableTaskRunner`, `InProcessTaskRunner`, and `RetryPolicy`
- continuation tokens and background delivery
- confidentiality tiers
- `agent-framework-hosting-entra`
- `local_identity_link`
-
-These are follow-up design topics, not hidden requirements of the v1 host.
-
-## Packages
-
-| Package | Import surface | Contents |
-|---|---|---|
-| `agent-framework-hosting` | `agent_framework_hosting` | `AgentFrameworkHost`, channel protocols, key request/result types, hooks, `reset_session`, state-path helpers. |
-| `agent-framework-hosting-responses` | `agent_framework_hosting_responses` | `ResponsesChannel`. |
-| `agent-framework-hosting-invocations` | `agent_framework_hosting_invocations` | `InvocationsChannel`. |
-| `agent-framework-hosting-telegram` | `agent_framework_hosting_telegram` | `TelegramChannel` and Telegram command helpers. |
-| `agent-framework-hosting-activity-protocol` | `agent_framework_hosting_activity_protocol` | `ActivityProtocolChannel` for Activity Protocol over Azure Bot Service. |
-| `agent-framework-hosting-discord` | `agent_framework_hosting_discord` | `DiscordChannel` and Discord command/interaction helpers. |
-| `agent-framework-foundry-hosting` | `agent_framework.foundry_hosting` | Foundry isolation middleware and Foundry-backed hosting helpers usable with the v1 host. |
-
-Channel packages may depend on their native SDKs. The core hosting package should not depend on channel SDKs or on top-level legacy protocol hosts.
-
-## Key Types
-
-### `AgentFrameworkHost`
-
-The host constructor accepts:
-
- `target`: one `SupportsAgentRun`-compatible object or one `Workflow`
- `channels`: one or more `Channel` instances
- optional Starlette middleware
- optional `state_dir`
- optional workflow `checkpoint_location`
-
-The host exposes:
-
- `app`: the canonical Starlette ASGI application
- `serve(...)`: a convenience wrapper for local serving
- `reset_session(isolation_key: str)`: rotate the cached `AgentSession` for a host-tracked conversation
-
-`state_dir` is narrowed to v1 host-owned local files only:
-
- session aliases (`isolation_key` to current `AgentSession` id), and
- workflow checkpoint paths when the app chooses the host-provided file layout.
-
-It is not a store for identity links, continuations, active-channel state, delivery attempts, or multicast payloads.
-
-Externally supplied isolation keys are trusted only after the channel or host middleware has authenticated and authorized the caller. The host uses `isolation_key` as a partition key; the string itself is not proof of identity or ownership.
-
-### `Channel`
-
-A channel implements a small protocol:
-
- declare a stable channel id/name,
- contribute routes, middleware, commands, and lifecycle callbacks,
- parse inbound protocol data into `ChannelRequest`,
- call the host through `ChannelContext.run(...)` or `ChannelContext.run_stream(...)`, and
- serialize the returned result to the originating protocol response.
-
-Channels own protocol authentication, signature validation, native command registration, and protocol-specific error bodies.
-
-### `ChannelContribution`
-
-`ChannelContribution` is the channel's host-facing contribution:
-
- Starlette routes and optional middleware,
- native command descriptors,
- startup and shutdown callbacks, and
- any channel-local metadata needed by the package.
-
-The host aggregates contributions but does not interpret protocol payloads.
-
-### `ChannelRequest`
-
-`ChannelRequest` is the host-neutral request envelope produced by a channel. It carries:
-
- target input,
- optional `ChannelSession`,
- optional `ChannelIdentity`,
- options and attributes produced by the channel, and
- request metadata useful to hooks and context providers.
-
-The host may pass attributes through to context providers and middleware. Channels should treat attributes as a documented extension bag, not as a cross-channel delivery contract.
-
-### `ChannelSession`
-
-`ChannelSession(isolation_key=...)` is the only v1 session-continuity mechanism.
-
-When a request contains an isolation key:
-
-1. The host looks up or creates the cached `AgentSession` for that key.
-2. The target runs with that `AgentSession` when the target is an agent.
-3. `reset_session(isolation_key)` rotates the alias so the next request starts a new conversation.
-
-If two channels produce the same isolation key on the same host, they share the same cached session. If they produce different keys, they do not share session state.
-
-### `ChannelIdentity`
-
-`ChannelIdentity` is optional request metadata such as channel id, native user id, tenant id, claims, or display attributes.
-
-In v1, `ChannelIdentity` does not link channels, authorize callers, select delivery destinations, or imply that two identities should share an `AgentSession`. A channel that wants shared history must still produce the same `ChannelSession.isolation_key`.
-
-### Hooks
-
-Hooks are optional and channel-owned:
-
- `ChannelRunHook`: runs after channel parsing and before host invocation; returns the `ChannelRequest` to execute.
- `ChannelResponseHook`: runs after target completion and before the originating channel renders a one-shot response.
- `ChannelStreamUpdateHook`: the host applies it to streamed updates before the originating channel serializes the stream.
-
-Common uses include adapting chat text into workflow inputs, enforcing deployment-specific options, flattening rich output for text-only protocols, or filtering streamed updates for a protocol. Stream update hooks are update-only; they do not automatically sanitize `get_final_response()` output. Channels choose their response transport from the parsed protocol request before invoking run hooks.
-
-### `HostedRunResult`
-
-`HostedRunResult[T]` wraps the target's full-fidelity result plus the resolved `AgentSession | None`.
-
- Agent targets produce `HostedRunResult[AgentResponse]`.
- Workflow targets produce `HostedRunResult[WorkflowRunResult]`.
-
-The host does not flatten, filter, or translate the result. Each channel decides how much of the result its protocol can carry.
-
-## Host Behavior
-
-1. `AgentFrameworkHost` builds one Starlette app and asks each channel for its contribution.
-2. A channel route receives a protocol-native request.
-3. The channel validates/parses the native payload and creates `ChannelRequest`.
-4. The channel passes the request, optional `ChannelRunHook`, and protocol-native context to the host.
-5. The host invokes `ChannelRunHook`, if configured, and receives the prepared request.
-6. The host resolves an `AgentSession` from `ChannelSession.isolation_key` when present.
-7. The host invokes the agent or workflow target.
-8. The host wraps the result in `HostedRunResult` or the streaming equivalent.
-9. The host invokes `ChannelResponseHook`, if configured, for non-streaming/final response shaping.
-10. The host applies stream update hooks while the channel consumes streams; the channel renders the originating protocol response.
-
-There is no host-level route from one channel's request to another channel's response in v1.
-
-## Workflow Checkpoints
-
-Workflow checkpointing is explicit. Apps either configure checkpoint storage on the workflow itself or pass a `checkpoint_location` to the host so the workflow dispatch path can use the intended file location.
-
-`state_dir` may provide a conventional location for workflow checkpoint files, but checkpointing is still opt-in and separate from agent session history. Checkpoints are workflow-runtime state, not channel state and not identity-link state.
-
-## Foundry Isolation Middleware
-
-V1 keeps Foundry isolation as middleware rather than as a channel-linking feature.
-
-The middleware is installed only when the Foundry hosting environment flag is present. In that environment it reads Foundry-provided isolation values at the trusted hosting boundary, exposes them as read-only request context for Foundry-aware history or memory providers, and rejects unsafe session resumes when the live isolation context does not match persisted session context. Outside Foundry, raw isolation headers are ignored unless an app supplies its own trusted middleware.
-
-This middleware does not create cross-channel identity links and does not authorize non-Foundry channels.
-
-## Current Channels
-
-### Responses
-
-`ResponsesChannel` exposes the OpenAI-compatible Responses API shape. It maps request body fields such as input, options, and conversation identifiers into `ChannelRequest`, and it renders Responses-compatible one-shot or streaming responses.
-
-Responses session continuity uses a channel-selected `isolation_key`, commonly derived from a response/conversation id, caller-provided session id, Foundry isolation context, or deployment-specific request metadata.
-
-### Invocations
-
-`InvocationsChannel` exposes an invocation endpoint for server-side callers and tools. It maps the request body into `ChannelRequest` and renders the invocation result on the same HTTP response.
-
-Invocations is useful for typed workflow inputs because a `ChannelRunHook` can translate the request body into the workflow's expected input type.
-
-### Telegram
-
-`TelegramChannel` supports webhook or polling transport, native command registration, and message rendering back to the originating Telegram chat.
-
-The channel chooses a default `isolation_key` from Telegram-native data such as chat id, user id, or a configured user/chat scope. A `/new` or equivalent command may call `reset_session` for that isolation key.
-
-### Activity Protocol
-
-`ActivityChannel` supports Activity Protocol requests, typically through Azure Bot Service for Teams, Web Chat, and other Bot Framework-fronted surfaces.
-
-The channel maps incoming `Activity` objects to `ChannelRequest` and renders a reply activity to the originating conversation. Proactive Activity delivery, active-channel routing, and all-linked fan-out are not v1 host semantics.
-
-### Discord
-
-`DiscordChannel` supports Discord messages, slash commands, and interactions as channel-native input.
-
-The channel maps Discord-native user, guild, channel, thread, and interaction data into `ChannelRequest` metadata and a configured `ChannelSession.isolation_key`. It renders the result to the originating Discord response path.
-
-## High-level Samples
-
-### One agent on Responses
-
-```python
-host = AgentFrameworkHost(
-    target=agent,
-    channels=[ResponsesChannel()],
-)
-
-app = host.app
-```
-
-### One agent on multiple channels
-
-```python
-host = AgentFrameworkHost(
-    target=agent,
-    channels=[
-        ResponsesChannel(),
-        InvocationsChannel(),
-        TelegramChannel(bot_token=os.environ["TELEGRAM_BOT_TOKEN"]),
-    ],
-)
-
-host.serve(host="localhost", port=8000)
-```
-
-The host owns one Starlette app. Each channel contributes its own routes and renders its own response.
-
-### Adapting a request before execution
-
-```python
-from dataclasses import replace
-
-
-def enforce_options(request: ChannelRequest) -> ChannelRequest:
-    options = dict(request.options or {})
-    options["temperature"] = 0
-    return replace(request, options=options)
-
-
-host = AgentFrameworkHost(
-    target=agent,
-    channels=[ResponsesChannel(run_hook=enforce_options)],
-)
-```
-
-### Workflow with explicit checkpoints
-
-```python
-host = AgentFrameworkHost(
-    target=workflow,
-    channels=[InvocationsChannel(run_hook=adapt_to_workflow_input)],
-    checkpoint_location=Path("./.af-hosting/workflow_checkpoints"),
-)
-```
-
-The hook adapts channel-native input to the workflow's typed input. Checkpoints use the explicit workflow checkpoint location, not identity-link or delivery storage.
-
-### Message channel reset command
-
-```python
-async def new_chat(context):
-    if context.request.session is not None:
-        await context.host.reset_session(context.request.session.isolation_key)
-        await context.reply("Started a new conversation.")
-```
-
-Telegram, Activity Protocol, and Discord can expose equivalent native commands when their protocols support them.
-
-## Follow-up Enhancements
-
-See [ADR-0028](../decisions/0028-hosting-linking-multicast-enhancements.md) for the deferred design covering:
-
- cross-channel identity linking,
- authorization and allowlists,
- non-originating response delivery,
- active-channel routing,
- multicast and all-linked delivery,
- background runs and continuation tokens,
- durable delivery runners,
- retry/replay semantics, and
- payload serialization.
-
-Those enhancements must layer on top of this v1 contract without requiring v1 users to adopt them.
-
-## Validation Gates
-
-The Python implementation should be considered complete when:
-
- a sample uses one `AgentFrameworkHost` with multiple channels and no manual Starlette route composition,
- each current channel has contract tests for route contribution, lifecycle, request parsing, hooks, and originating response rendering,
- session tests prove shared `isolation_key` values share an `AgentSession` and `reset_session` rotates it,
- workflow tests or samples use explicit `checkpoint_location`,
- Foundry isolation middleware is covered by integration or contract tests,
- no v1 package exposes the removed linking, multicast, durable-runner, or continuation APIs, and
- this spec and ADR-0027 remain aligned.
@@ -26,10 +26,10 @@
    <PackageVersion Include="Azure.AI.AgentServer.Invocations" Version="1.0.0-beta.3" />
    <PackageVersion Include="Azure.AI.AgentServer.Responses" Version="1.0.0-beta.4" />
    <PackageVersion Include="Azure.Search.Documents" Version="12.0.0" />
-    <PackageVersion Include="Azure.AI.Projects" Version="2.1.0-beta.2" />
+    <PackageVersion Include="Azure.AI.Projects" Version="2.1.0-beta.1" />
    <PackageVersion Include="Azure.AI.Agents.Persistent" Version="1.2.0-beta.10" />
    <PackageVersion Include="Azure.AI.OpenAI" Version="2.9.0-beta.1" />
-    <PackageVersion Include="Azure.Core" Version="1.55.0" />
+    <PackageVersion Include="Azure.Core" Version="1.53.0" />
    <PackageVersion Include="Azure.Identity" Version="1.21.0" />
    <PackageVersion Include="DotNetEnv" Version="3.1.1" />
    <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="1.5.0" />
@@ -44,7 +44,7 @@
    <PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="10.0.6" />
    <PackageVersion Include="Microsoft.Bcl.HashCode" Version="6.0.0" />
    <PackageVersion Include="Microsoft.Bcl.Memory" Version="10.0.5" />
-    <PackageVersion Include="System.ClientModel" Version="1.11.0" />
+    <PackageVersion Include="System.ClientModel" Version="1.10.0" />
    <PackageVersion Include="System.CodeDom" Version="10.0.0" />
    <PackageVersion Include="System.Collections.Immutable" Version="10.0.1" />
    <PackageVersion Include="System.CommandLine" Version="2.0.0-rc.2.25502.107" />
@@ -112,7 +112,6 @@
    <PackageVersion Include="ModelContextProtocol" Version="1.1.0" />
    <!-- Hyperlight -->
    <PackageVersion Include="Hyperlight.HyperlightSandbox.Api" Version="0.4.0" />
-    <PackageVersion Include="Hyperlight.HyperlightSandbox.Guest.Python" Version="0.4.0" />
    <!-- Inference SDKs -->
    <PackageVersion Include="Microsoft.ML.OnnxRuntimeGenAI" Version="0.10.0" />
    <PackageVersion Include="Microsoft.ML.Tokenizers" Version="2.0.0" />
@@ -121,11 +121,9 @@
  <Folder Name="/Samples/02-agents/Harness/">
    <File Path="samples/02-agents/Harness/README.md" />
    <Project Path="samples/02-agents/Harness/Harness_Shared_Console/Harness_Shared_Console.csproj" />
-    <Project Path="samples/02-agents/Harness/Harness_Shared_Console_OpenAI/Harness_Shared_Console_OpenAI.csproj" />
    <Project Path="samples/02-agents/Harness/Harness_Step01_Research/Harness_Step01_Research.csproj" />
-    <Project Path="samples/02-agents/Harness/Harness_Step02_Research_WithBackgroundAgents/Harness_Step02_Research_WithBackgroundAgents.csproj" />
+    <Project Path="samples/02-agents/Harness/Harness_Step02_Research_WithSubAgents/Harness_Step02_Research_WithSubAgents.csproj" />
    <Project Path="samples/02-agents/Harness/Harness_Step03_DataProcessing/Harness_Step03_DataProcessing.csproj" />
-    <Project Path="samples/02-agents/Harness/Harness_Step04_CodeExecution/Harness_Step04_CodeExecution.csproj" />
    <Project Path="samples/02-agents/Harness/ConsoleReactiveFramework/ConsoleReactiveFramework.csproj" />
    <Project Path="samples/02-agents/Harness/ConsoleReactiveComponents/ConsoleReactiveComponents.csproj" />
  </Folder>
@@ -329,15 +327,9 @@
  <Folder Name="/Samples/04-hosting/FoundryHostedAgents/responses/Hosted-McpTools/">
    <Project Path="samples/04-hosting/FoundryHostedAgents/responses/Hosted-McpTools/HostedMcpTools.csproj" />
  </Folder>
-  <Folder Name="/Samples/04-hosting/FoundryHostedAgents/responses/Hosted-MemoryAgent/">
-    <Project Path="samples/04-hosting/FoundryHostedAgents/responses/Hosted-MemoryAgent/HostedMemoryAgent.csproj" />
-  </Folder>
  <Folder Name="/Samples/04-hosting/FoundryHostedAgents/responses/Hosted-Observability/">
    <Project Path="samples/04-hosting/FoundryHostedAgents/responses/Hosted-Observability/HostedObservability.csproj" />
  </Folder>
-  <Folder Name="/Samples/04-hosting/FoundryHostedAgents/responses/Hosted_Shared_Contributor_Setup/">
-    <Project Path="samples/04-hosting/FoundryHostedAgents/responses/Hosted_Shared_Contributor_Setup/Hosted_Shared_Contributor_Setup.csproj" />
-  </Folder>
  <Folder Name="/Samples/04-hosting/FoundryHostedAgents/responses/Hosted-Toolbox/">
    <Project Path="samples/04-hosting/FoundryHostedAgents/responses/Hosted-Toolbox/HostedToolbox.csproj" />
  </Folder>
@@ -1,14 +1,14 @@
 <Project>
  <PropertyGroup>
    <!-- Central version prefix - applies to all nuget packages. -->
-    <VersionPrefix>1.6.2</VersionPrefix>
+    <VersionPrefix>1.6.1</VersionPrefix>
    <RCNumber>1</RCNumber>
-    <DateSuffix>260521</DateSuffix>
+    <DateSuffix>260514</DateSuffix>
    <PackageVersion Condition="'$(IsReleaseCandidate)' == 'true'">$(VersionPrefix)-rc$(RCNumber)</PackageVersion>
    <PackageVersion Condition="'$(IsReleaseCandidate)' != 'true' AND '$(VersionSuffix)' != ''">$(VersionPrefix)-$(VersionSuffix).$(DateSuffix).1</PackageVersion>
    <PackageVersion Condition="'$(IsReleaseCandidate)' != 'true' AND '$(VersionSuffix)' == ''">$(VersionPrefix)-preview.$(DateSuffix).1</PackageVersion>
    <PackageVersion Condition="'$(IsReleased)' == 'true'">$(VersionPrefix)</PackageVersion>
-    <GitTag>1.6.2</GitTag>
+    <GitTag>1.6.1</GitTag>

    <Configurations>Debug;Release;Publish</Configurations>
    <IsPackable>true</IsPackable>
@@ -24,11 +24,6 @@ public static class AnsiEscapes
    /// </summary>
    public static string MoveCursor(int row, int column) => $"\x1b[{row};{column}H";

-    /// <summary>
-    /// Erases the current line from the cursor position to the end of the line (EL 0).
-    /// </summary>
-    public static string EraseToEndOfLine => "\x1b[0K";
-
    /// <summary>
    /// Erases the entire current line (EL 2).
    /// </summary>
@@ -39,7 +39,7 @@ public class ListSelection : ConsoleReactiveComponent<ListSelectionProps, Consol
        {
            foreach (string line in props.Title.Split('\n'))
            {
-                Console.Write(AnsiEscapes.MoveCursor(props.Y + row, props.X));
+                Console.Write(AnsiEscapes.MoveCursor(this.Y + row, this.X));
                Console.Write(AnsiEscapes.EraseEntireLine);
                Console.Write(line);
                row++;
@@ -51,7 +51,7 @@ public class ListSelection : ConsoleReactiveComponent<ListSelectionProps, Consol

        for (int i = 0; i < totalItems; i++)
        {
-            Console.Write(AnsiEscapes.MoveCursor(props.Y + row, props.X));
+            Console.Write(AnsiEscapes.MoveCursor(this.Y + row, this.X));
            Console.Write(AnsiEscapes.EraseEntireLine);

            bool isSelected = i == props.SelectedIndex;
@@ -58,11 +58,11 @@ public class TextInput : ConsoleReactiveComponent<TextInputProps, ConsoleReactiv
    public override void RenderCore(TextInputProps props, ConsoleReactiveState state)
    {
        int promptLength = props.Prompt.Length;
-        int textWidth = props.Width - promptLength;
+        int textWidth = this.Width - promptLength;
        string indent = new(' ', promptLength);

        // First line: prompt + start of text
-        Console.Write(AnsiEscapes.MoveCursor(props.Y, props.X));
+        Console.Write(AnsiEscapes.MoveCursor(this.Y, this.X));
        Console.Write(AnsiEscapes.EraseEntireLine);
        Console.Write(props.Prompt);

@@ -90,7 +90,7 @@ public class TextInput : ConsoleReactiveComponent<TextInputProps, ConsoleReactiv
        while (offset < props.Text.Length)
        {
            int chunk = Math.Min(textWidth, props.Text.Length - offset);
-            Console.Write(AnsiEscapes.MoveCursor(props.Y + row, props.X));
+            Console.Write(AnsiEscapes.MoveCursor(this.Y + row, this.X));
            Console.Write(AnsiEscapes.EraseEntireLine);
            Console.Write(indent);
            Console.Write(props.Text[offset..(offset + chunk)]);
@@ -17,7 +17,7 @@ public record TextPanelProps : ConsoleReactiveProps
 /// <summary>
 /// A component that renders a list of pre-rendered string items vertically.
 /// Designed for rendering dynamic items in a non-scroll region that may be
-/// re-rendered on each update. If the component's <see cref="ConsoleReactiveProps.Height"/>
+/// re-rendered on each update. If the component's <see cref="ConsoleReactiveComponent.Height"/>
 /// exceeds the number of output lines, leftover lines are erased.
 /// </summary>
 public class TextPanel : ConsoleReactiveComponent<TextPanelProps, ConsoleReactiveState>
@@ -51,18 +51,18 @@ public class TextPanel : ConsoleReactiveComponent<TextPanelProps, ConsoleReactiv

            for (int j = 0; j < lineCount; j++)
            {
-                Console.Write(AnsiEscapes.MoveAndEraseLine(props.Y + currentRow));
+                Console.Write(AnsiEscapes.MoveAndEraseLine(this.Y + currentRow));
                Console.Write(lines[j]);
                currentRow++;
            }
        }

        // If the component height exceeds the output, erase leftover lines
-        if (props.Height > currentRow)
+        if (this.Height > currentRow)
        {
-            for (int i = currentRow; i < props.Height; i++)
+            for (int i = currentRow; i < this.Height; i++)
            {
-                Console.Write(AnsiEscapes.MoveAndEraseLine(props.Y + i));
+                Console.Write(AnsiEscapes.MoveAndEraseLine(this.Y + i));
            }
        }
    }
@@ -52,7 +52,7 @@ public class TextScrollPanel : ConsoleReactiveComponent<TextScrollPanelProps, Te
        }

        // Move cursor to the bottom of the scroll area
-        Console.Write(AnsiEscapes.MoveCursor(props.Y + props.Height - 1, props.X));
+        Console.Write(AnsiEscapes.MoveCursor(this.Y + this.Height - 1, this.X));

        // Output only new items since last rendered
        for (int i = state.RenderedCount; i < props.Items.Count; i++)
@@ -9,6 +9,9 @@ namespace Harness.ConsoleReactiveComponents;
 /// </summary>
 public record TopBottomRuleProps : ConsoleReactiveProps
 {
+    /// <summary>Gets the width of the horizontal rules in characters.</summary>
+    public int Width { get; init; }
+
    /// <summary>Gets the foreground color of the horizontal rules. If <c>null</c>, the default terminal color is used.</summary>
    public ConsoleColor? Color { get; init; }
 }
@@ -29,7 +32,7 @@ public class TopBottomRule : ConsoleReactiveComponent<TopBottomRuleProps, Consol
        int childrenHeight = 0;
        foreach (var child in props.Children)
        {
-            childrenHeight += child.BaseProps?.Height ?? 0;
+            childrenHeight += child.Height;
        }

        // Top rule + children + bottom rule
@@ -48,11 +51,11 @@ public class TopBottomRule : ConsoleReactiveComponent<TopBottomRuleProps, Consol
        }

        // Top rule
-        Console.Write(AnsiEscapes.MoveCursor(props.Y, props.X));
+        Console.Write(AnsiEscapes.MoveCursor(this.Y, this.X));
        Console.Write(rule);

        // Render children stacked below the top rule
-        int currentY = props.Y + 1;
+        int currentY = this.Y + 1;

        if (props.Color.HasValue)
        {
@@ -61,9 +64,10 @@ public class TopBottomRule : ConsoleReactiveComponent<TopBottomRuleProps, Consol

        foreach (var child in props.Children)
        {
-            child.BaseProps = child.BaseProps! with { X = props.X, Y = currentY };
+            child.X = this.X;
+            child.Y = currentY;
            child.Render();
-            currentY += child.BaseProps.Height;
+            currentY += child.Height;
        }

        if (props.Color.HasValue)
@@ -72,7 +76,7 @@ public class TopBottomRule : ConsoleReactiveComponent<TopBottomRuleProps, Consol
        }

        // Bottom rule
-        Console.Write(AnsiEscapes.MoveCursor(currentY, props.X));
+        Console.Write(AnsiEscapes.MoveCursor(currentY, this.X));
        Console.Write(rule);

        if (props.Color.HasValue)
@@ -3,8 +3,8 @@
 namespace Harness.ConsoleReactiveFramework;

 /// <summary>
-/// Abstract base class for all console UI components. Provides access to layout
-/// through <see cref="BaseProps"/> and a <see cref="Render"/> method for drawing to the console.
+/// Abstract base class for all console UI components. Provides layout properties
+/// (position and size) and a <see cref="Render"/> method for drawing to the console.
 /// Derive from <see cref="ConsoleReactiveComponent{TProps, TState}"/> instead of this class directly.
 /// </summary>
 public abstract class ConsoleReactiveComponent
@@ -13,21 +13,20 @@ public abstract class ConsoleReactiveComponent
    {
    }

-    /// <summary>
-    /// Gets or sets the component's props as the base <see cref="ConsoleReactiveProps"/> type.
-    /// Used by parent components to set layout (X, Y, Width, Height) on children without
-    /// knowing the concrete props type.
-    /// </summary>
-    public abstract ConsoleReactiveProps? BaseProps { get; set; }
+    /// <summary>Gets or sets the 1-based column position of the component.</summary>
+    public int X { get; set; }
+
+    /// <summary>Gets or sets the 1-based row position of the component.</summary>
+    public int Y { get; set; }
+
+    /// <summary>Gets or sets the width of the component in columns.</summary>
+    public int Width { get; set; }
+
+    /// <summary>Gets or sets the height of the component in rows.</summary>
+    public int Height { get; set; }

    /// <summary>Renders the component to the console at its current position.</summary>
    public abstract void Render();
-
-    /// <summary>
-    /// Invalidates the component's cached render state, causing the next <see cref="Render"/> call
-    /// to proceed even if props and state have not changed. Use after a screen erase to force repaint.
-    /// </summary>
-    public abstract void Invalidate();
 }

 /// <summary>
@@ -47,13 +46,6 @@ public abstract class ConsoleReactiveComponent<TProps, TState> : ConsoleReactive
    /// <summary>Gets or sets the component's props (external configuration).</summary>
    public TProps? Props { get; set; }

-    /// <inheritdoc/>
-    public override ConsoleReactiveProps? BaseProps
-    {
-        get => this.Props;
-        set => this.Props = (TProps?)value;
-    }
-
    /// <summary>Gets or sets the component's internal state.</summary>
    protected TState? State { get; set; }

@@ -81,8 +73,8 @@ public abstract class ConsoleReactiveComponent<TProps, TState> : ConsoleReactive
                return;
            }

-            if (EqualityComparer<TProps>.Default.Equals(this.Props, this._lastRenderedProps)
-                && EqualityComparer<TState>.Default.Equals(this.State, this._lastRenderedState))
+            if (ReferenceEquals(this.Props, this._lastRenderedProps)
+                && ReferenceEquals(this.State, this._lastRenderedState))
            {
                return;
            }
@@ -94,16 +86,6 @@ public abstract class ConsoleReactiveComponent<TProps, TState> : ConsoleReactive
        }
    }

-    /// <inheritdoc/>
-    public override void Invalidate()
-    {
-        lock (this._renderLock)
-        {
-            this._lastRenderedProps = default;
-            this._lastRenderedState = default;
-        }
-    }
-
    /// <summary>
    /// Called by <see cref="Render"/> to perform the actual rendering. Override this in derived classes.
    /// </summary>
@@ -113,23 +95,11 @@ public abstract class ConsoleReactiveComponent<TProps, TState> : ConsoleReactive
 }

 /// <summary>
-/// Base record for component props. Provides layout properties (position and size)
-/// and an optional <see cref="Children"/> collection for composing child components.
+/// Base record for component props. Provides an optional <see cref="Children"/> collection
+/// for composing child components.
 /// </summary>
 public record ConsoleReactiveProps
 {
-    /// <summary>Gets the 1-based column position of the component.</summary>
-    public int X { get; init; }
-
-    /// <summary>Gets the 1-based row position of the component.</summary>
-    public int Y { get; init; }
-
-    /// <summary>Gets the width of the component in columns.</summary>
-    public int Width { get; init; }
-
-    /// <summary>Gets the height of the component in rows.</summary>
-    public int Height { get; init; }
-
    /// <summary>Gets the child components to render within this component.</summary>
    public IReadOnlyList<ConsoleReactiveComponent> Children { get; init; } = [];
 }
@@ -1,98 +0,0 @@
-// Copyright (c) Microsoft. All rights reserved.
-
-using System.Text.Json;
-using Microsoft.Agents.AI;
-
-namespace Harness.Shared.Console.Commands;
-
-/// <summary>
-/// Handles <c>/session-export &lt;filename&gt;</c> and <c>/session-import &lt;filename&gt;</c>
-/// commands for serializing the current session to a file and restoring a session from a file.
-/// </summary>
-public sealed class SessionCommandHandler : CommandHandler
-{
-    private readonly AIAgent _agent;
-
-    /// <summary>
-    /// Initializes a new instance of the <see cref="SessionCommandHandler"/> class.
-    /// </summary>
-    /// <param name="agent">The agent used for session serialization and deserialization.</param>
-    public SessionCommandHandler(AIAgent agent)
-    {
-        this._agent = agent;
-    }
-
-    /// <inheritdoc/>
-    public override string? GetHelpText() => "/session-export <file> | /session-import <file>";
-
-    /// <inheritdoc/>
-    public override async ValueTask<bool> TryHandleAsync(string input, AgentSession session, IUXStateDriver ux)
-    {
-        string command = input.Split(' ', 2)[0];
-
-        if (command.Equals("/session-export", StringComparison.OrdinalIgnoreCase))
-        {
-            await this.HandleExportAsync(input, session, ux).ConfigureAwait(false);
-            return true;
-        }
-
-        if (command.Equals("/session-import", StringComparison.OrdinalIgnoreCase))
-        {
-            await this.HandleImportAsync(input, ux).ConfigureAwait(false);
-            return true;
-        }
-
-        return false;
-    }
-
-    private async Task HandleExportAsync(string input, AgentSession session, IUXStateDriver ux)
-    {
-        string[] parts = input.Split(' ', 2, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
-        if (parts.Length < 2)
-        {
-            await ux.WriteInfoLineAsync("Usage: /session-export <filename>").ConfigureAwait(false);
-            return;
-        }
-
-        string filename = parts[1];
-        try
-        {
-            JsonElement serialized = await this._agent.SerializeSessionAsync(session).ConfigureAwait(false);
-            string json = JsonSerializer.Serialize(serialized);
-            await File.WriteAllTextAsync(filename, json).ConfigureAwait(false);
-            await ux.WriteInfoLineAsync($"Session exported to {filename}").ConfigureAwait(false);
-        }
-        catch (Exception ex)
-        {
-            await ux.WriteInfoLineAsync($"Failed to export session to {filename}: {ex.Message}").ConfigureAwait(false);
-        }
-    }
-
-    private async Task HandleImportAsync(string input, IUXStateDriver ux)
-    {
-        string[] parts = input.Split(' ', 2, StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
-        if (parts.Length < 2)
-        {
-            await ux.WriteInfoLineAsync("Usage: /session-import <filename>").ConfigureAwait(false);
-            return;
-        }
-
-        string filename = parts[1];
-        try
-        {
-            string json = await File.ReadAllTextAsync(filename).ConfigureAwait(false);
-            JsonElement element = JsonSerializer.Deserialize<JsonElement>(json);
-            AgentSession newSession = await this._agent.DeserializeSessionAsync(element).ConfigureAwait(false);
-            await ux.ReplaceSessionAsync(newSession).ConfigureAwait(false);
-            await ux.WriteInfoLineAsync($"Session imported from {filename}").ConfigureAwait(false);
-        }
-        catch (FileNotFoundException)
-        {
-            await ux.WriteInfoLineAsync($"File not found: {filename}").ConfigureAwait(false);
-        }
-        catch (Exception ex)
-        {
-            await ux.WriteInfoLineAsync($"Failed to import session from {filename}: {ex.Message}").ConfigureAwait(false);
-        }
-    }
-}
@@ -43,7 +43,7 @@ public class AgentModeAndHelp : ConsoleReactiveComponent<AgentModeAndHelpProps,
        }

        System.Console.Write(AnsiEscapes.SaveCursor);
-        System.Console.Write(AnsiEscapes.MoveAndEraseLine(props.Y));
+        System.Console.Write(AnsiEscapes.MoveAndEraseLine(this.Y));

        bool hasMode = props.Mode is not null;

@@ -35,7 +35,6 @@ public class AgentStatus : ConsoleReactiveComponent<AgentStatusProps, AgentStatu
    ];

    private readonly Timer _timer;
-    private AgentStatusProps? _previousProps;

    /// <summary>
    /// Initializes a new instance of the <see cref="AgentStatus"/> class.
@@ -86,12 +85,7 @@ public class AgentStatus : ConsoleReactiveComponent<AgentStatusProps, AgentStatu
        }

        System.Console.Write(AnsiEscapes.SaveCursor);
-        System.Console.Write(AnsiEscapes.MoveCursor(props.Y, props.X));
-        if (props != this._previousProps)
-        {
-            System.Console.Write(AnsiEscapes.EraseToEndOfLine);
-            this._previousProps = props;
-        }
+        System.Console.Write(AnsiEscapes.MoveAndEraseLine(this.Y));

        if (props.ShowSpinner)
        {
@@ -1,67 +0,0 @@
-// Copyright (c) Microsoft. All rights reserved.
-
-using System.Diagnostics;
-using System.Globalization;
-using OpenTelemetry;
-
-namespace Harness.Shared.Console;
-
-/// <summary>
-/// A simple OpenTelemetry span exporter that writes completed activities (spans) to a text file.
-/// Each span is formatted as a human-readable block with timestamps, operation name, duration,
-/// status, and any tags/events.
-/// </summary>
-public sealed class FileSpanExporter : BaseExporter<Activity>
-{
-    private readonly string _filePath;
-    private readonly object _lock = new();
-
-    public FileSpanExporter(string filePath)
-    {
-        this._filePath = filePath;
-        Directory.CreateDirectory(Path.GetDirectoryName(filePath)!);
-    }
-
-    public override ExportResult Export(in Batch<Activity> batch)
-    {
-        lock (this._lock)
-        {
-            using var writer = new StreamWriter(this._filePath, append: true);
-            foreach (var activity in batch)
-            {
-                WriteActivity(writer, activity);
-            }
-        }
-
-        return ExportResult.Success;
-    }
-
-    private static void WriteActivity(StreamWriter writer, Activity activity)
-    {
-        var start = activity.StartTimeUtc.ToString("yyyy-MM-dd HH:mm:ss.fff", CultureInfo.InvariantCulture);
-        var duration = activity.Duration.TotalMilliseconds.ToString("F1", CultureInfo.InvariantCulture);
-
-        writer.WriteLine($"[{start}] {activity.OperationName} ({duration}ms) [{activity.Status}]");
-
-        if (!string.IsNullOrEmpty(activity.DisplayName) && activity.DisplayName != activity.OperationName)
-        {
-            writer.WriteLine($"  DisplayName: {activity.DisplayName}");
-        }
-
-        foreach (var tag in activity.Tags)
-        {
-            writer.WriteLine($"  {tag.Key}: {tag.Value}");
-        }
-
-        foreach (var ev in activity.Events)
-        {
-            writer.WriteLine($"  Event: {ev.Name} @ {ev.Timestamp:HH:mm:ss.fff}");
-            foreach (var tag in ev.Tags)
-            {
-                writer.WriteLine($"    {tag.Key}: {tag.Value}");
-            }
-        }
-
-        writer.WriteLine();
-    }
-}
@@ -19,14 +19,14 @@ namespace Harness.Shared.Console;
 public sealed class HarnessAgentRunner : IDisposable
 {
    private readonly AIAgent _agent;
+    private readonly AgentSession _session;
    private readonly AgentModeProvider? _modeProvider;
    private readonly MessageInjectingChatClient? _messageInjector;
    private readonly IReadOnlyList<CommandHandler> _commandHandlers;
    private readonly IReadOnlyList<ConsoleObserver> _observers;
    private readonly IUXStateDriver _ux;
-    private readonly SemaphoreSlim _inputGate = new(1, 1);

-    private AgentSession _session;
+    private readonly SemaphoreSlim _inputGate = new(1, 1);

    /// <summary>
    /// Initializes a new instance of the <see cref="HarnessAgentRunner"/> class.
@@ -62,25 +62,6 @@ public sealed class HarnessAgentRunner : IDisposable
    /// </summary>
    public string HelpText { get; }

-    /// <summary>
-    /// Replaces the current session with the specified session. Used by the UX driver
-    /// when importing a serialized session. Acquires the input gate to ensure no
-    /// concurrent agent turn is reading the session.
-    /// </summary>
-    /// <param name="newSession">The new session to use.</param>
-    internal async Task ReplaceSessionAsync(AgentSession newSession)
-    {
-        await this._inputGate.WaitAsync().ConfigureAwait(false);
-        try
-        {
-            this._session = newSession;
-        }
-        finally
-        {
-            this._inputGate.Release();
-        }
-    }
-
    /// <inheritdoc/>
    public void Dispose() => this._inputGate.Dispose();

@@ -192,11 +173,6 @@ public sealed class HarnessAgentRunner : IDisposable
                        }
                    }

-                    foreach (var observer in this._observers)
-                    {
-                        await observer.OnResponseUpdateAsync(this._ux, update, this._agent, this._session).ConfigureAwait(false);
-                    }
-
                    if (!string.IsNullOrEmpty(update.Text))
                    {
                        foreach (var observer in this._observers)
@@ -63,7 +63,6 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            getState: () => this.State!,
            setState: s => this.SetState(s),
            requestShutdown: () => this._shutdownTcs.TrySetResult(true),
-            replaceSession: s => this.Runner!.ReplaceSessionAsync(s),
            modeColors: modeColors);

        this.Runner = runnerFactory(this._uxDriver);
@@ -371,7 +370,7 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            };

            bottomChildHeight = ListSelection.CalculateHeight(listProps);
-            listProps = listProps with { Height = bottomChildHeight };
+            this._listSelection.Height = bottomChildHeight;
            this._listSelection.Props = listProps;
            bottomChild = this._listSelection;
        }
@@ -398,7 +397,8 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            }

            bottomChildHeight = TextInput.CalculateHeight(textInputProps, state.ConsoleWidth);
-            textInputProps = textInputProps with { Width = state.ConsoleWidth, Height = bottomChildHeight };
+            this._textInput.Width = state.ConsoleWidth;
+            this._textInput.Height = bottomChildHeight;
            this._textInput.Props = textInputProps;
            bottomChild = this._textInput;
        }
@@ -412,7 +412,8 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            };

            bottomChildHeight = TextInput.CalculateHeight(textInputProps, state.ConsoleWidth);
-            textInputProps = textInputProps with { Width = state.ConsoleWidth, Height = bottomChildHeight };
+            this._textInput.Width = state.ConsoleWidth;
+            this._textInput.Height = bottomChildHeight;
            this._textInput.Props = textInputProps;
            bottomChild = this._textInput;
        }
@@ -457,16 +458,6 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            System.Console.Write(AnsiEscapes.EraseScrollbackBuffer);
            this._textScrollPanel.Reset();
            this._resizedSinceLastRender = false;
-
-            // Invalidate all children so they re-render even if props haven't changed
-            this._rule.Invalidate();
-            this._textScrollPanel.Invalidate();
-            this._textPanel.Invalidate();
-            this._queuedPanel.Invalidate();
-            this._agentStatus.Invalidate();
-            this._modeAndHelp.Invalidate();
-            this._textInput.Invalidate();
-            this._listSelection.Invalidate();
        }

        this._scrollRegionBottom = scrollBottom;
@@ -478,35 +469,35 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            ? state.ScrollAreaContentItems.Take(state.ScrollAreaContentItems.Count - 1).ToList()
            : [];

+        this._textScrollPanel.X = 1;
+        this._textScrollPanel.Y = 1;
+        this._textScrollPanel.Width = state.ConsoleWidth;
+        this._textScrollPanel.Height = scrollBottom;
        this._textScrollPanel.Props = new TextScrollPanelProps
        {
-            X = 1,
-            Y = 1,
-            Width = state.ConsoleWidth,
-            Height = scrollBottom,
            Items = scrollItems,
        };
        this._textScrollPanel.Render();

        // Render the text panel for the last (dynamic) item just below the scroll region
+        this._textPanel.X = 1;
+        this._textPanel.Y = scrollBottom + 1;
+        this._textPanel.Width = state.ConsoleWidth;
+        this._textPanel.Height = textPanelHeight;
        this._textPanel.Props = new TextPanelProps
        {
-            X = 1,
-            Y = scrollBottom + 1,
-            Width = state.ConsoleWidth,
-            Height = textPanelHeight,
            Items = lastItems,
        };
        this._textPanel.Render();

        // Render queued input items between text panel and agent status
        int queuedPanelY = scrollBottom + textPanelHeight + 1;
+        this._queuedPanel.X = 1;
+        this._queuedPanel.Y = queuedPanelY;
+        this._queuedPanel.Width = state.ConsoleWidth;
+        this._queuedPanel.Height = queuedPanelHeight;
        this._queuedPanel.Props = new TextPanelProps
        {
-            X = 1,
-            Y = queuedPanelY,
-            Width = state.ConsoleWidth,
-            Height = queuedPanelHeight,
            Items = state.QueuedItems,
        };
        this._queuedPanel.Render();
@@ -515,41 +506,32 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
        int agentStatusY = queuedPanelY + queuedPanelHeight;
        if (showStatusAndHelp)
        {
-            this._agentStatus.Props = agentStatusProps with
-            {
-                X = 1,
-                Y = agentStatusY,
-                Width = state.ConsoleWidth,
-                Height = agentStatusHeight,
-            };
+            this._agentStatus.X = 1;
+            this._agentStatus.Y = agentStatusY;
+            this._agentStatus.Width = state.ConsoleWidth;
+            this._agentStatus.Height = agentStatusHeight;
+            this._agentStatus.Props = agentStatusProps;
            this._agentStatus.Render();
        }

        // Render the bottom rule + child below the agent status
-        this._rule.Props = ruleProps with
-        {
-            X = 1,
-            Y = agentStatusY + agentStatusHeight,
-        };
+        this._rule.X = 1;
+        this._rule.Y = agentStatusY + agentStatusHeight;
+        this._rule.Props = ruleProps;
        this._rule.Render();

        // Render the mode-and-help line below the bottom rule
        if (showStatusAndHelp)
        {
-            int modeAndHelpY = agentStatusY + agentStatusHeight + ruleHeight;
-            this._modeAndHelp.Props = modeAndHelpProps with
-            {
-                X = 1,
-                Y = modeAndHelpY,
-                Width = state.ConsoleWidth,
-                Height = modeAndHelpHeight,
-            };
+            int modeAndHelpY = this._rule.Y + ruleHeight;
+            this._modeAndHelp.X = 1;
+            this._modeAndHelp.Y = modeAndHelpY;
+            this._modeAndHelp.Width = state.ConsoleWidth;
+            this._modeAndHelp.Height = modeAndHelpHeight;
+            this._modeAndHelp.Props = modeAndHelpProps;
            this._modeAndHelp.Render();
        }

-        // Clear the bottom padding line
-        System.Console.Write(AnsiEscapes.MoveAndEraseLine(state.ConsoleHeight));
-
        // Position cursor for natural typing appearance
        this.PositionCursor(state);
    }
@@ -563,7 +545,7 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            int textWidth = state.ConsoleWidth - promptLength;
            int textLength = state.InputText.Length;

-            int textInputY = (this._rule.Props?.Y ?? 0) + 1;
+            int textInputY = this._rule.Y + 1;

            if (textWidth <= 0 || textLength == 0)
            {
@@ -581,7 +563,7 @@ public class HarnessAppComponent : ConsoleReactiveComponent<ConsoleReactiveProps
            && state.ListSelectionIndex == state.ListSelectionOptions.Count)
        {
            int titleLines = state.ListSelectionTitle?.Split('\n').Length ?? 0;
-            int customOptionY = (this._rule.Props?.Y ?? 0) + 1 + titleLines + state.ListSelectionOptions.Count;
+            int customOptionY = this._rule.Y + 1 + titleLines + state.ListSelectionOptions.Count;
            int cursorCol = 2 + state.ListSelectionCustomInputText.Length + 1;
            System.Console.Write(AnsiEscapes.MoveCursor(customOptionY, cursorCol));
        }
@@ -1,6 +1,5 @@
 // Copyright (c) Microsoft. All rights reserved.

-using System.Text;
 using Harness.ConsoleReactiveComponents;
 using Microsoft.Agents.AI;

@@ -25,8 +24,6 @@ public static class HarnessConsole
    {
        options ??= new();

-        System.Console.OutputEncoding = Encoding.UTF8;
-
        // Null means use defaults; an explicit (possibly empty) list means use exactly what was provided.
        var observers = options.Observers
            ?? HarnessConsoleOptions.BuildDefaultObservers();
@@ -36,9 +33,7 @@ public static class HarnessConsole
        var modeProvider = agent.GetService<AgentModeProvider>();
        var messageInjector = agent.GetService<MessageInjectingChatClient>();

-        AgentSession session = options.SessionFactory is not null
-            ? await options.SessionFactory(agent)
-            : await agent.CreateSessionAsync();
+        AgentSession session = await agent.CreateSessionAsync();

        using var component = new HarnessAppComponent(
            placeholder: userPrompt,
@@ -68,7 +63,6 @@ public static class HarnessConsole

        System.Console.ResetColor();
        System.Console.Write(AnsiEscapes.ResetScrollRegion);
-        System.Console.Write(AnsiEscapes.EraseScrollbackBuffer);
        System.Console.Write(AnsiEscapes.EraseEntireScreen);
        System.Console.Write(AnsiEscapes.MoveCursor(1, 1));
        System.Console.WriteLine("Goodbye!");
@@ -45,12 +45,6 @@ public class HarnessConsoleOptions
    /// </summary>
    public Dictionary<string, ConsoleColor> ModeColors { get; set; } = new(DefaultModeColors, StringComparer.OrdinalIgnoreCase);

-    /// <summary>
-    /// Gets or sets an optional factory for creating the <see cref="AgentSession"/>.
-    /// When <see langword="null"/> (the default), <see cref="AIAgent.CreateSessionAsync"/> is used.
-    /// </summary>
-    public Func<AIAgent, Task<AgentSession>>? SessionFactory { get; set; }
-
    /// <summary>
    /// Creates the default set of observers without planning support.
    /// Includes tool call display, tool approval, error display, reasoning display,
@@ -134,7 +128,6 @@ public class HarnessConsoleOptions
            new ExitCommandHandler(),
            new TodoCommandHandler(todoProvider),
            new ModeCommandHandler(modeProvider, modeColors ?? DefaultModeColors),
-            new SessionCommandHandler(agent),
        ];
    }
 }
@@ -1,7 +1,6 @@
 // Copyright (c) Microsoft. All rights reserved.

 using Harness.ConsoleReactiveComponents;
-using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;

 namespace Harness.Shared.Console;
@@ -17,7 +16,6 @@ internal sealed class HarnessConsoleUXStateDriver : IUXStateDriver
    private readonly Func<HarnessAppComponentState> _getState;
    private readonly Action<HarnessAppComponentState> _setState;
    private readonly Action _requestShutdown;
-    private readonly Func<AgentSession, Task> _replaceSession;
    private readonly IReadOnlyDictionary<string, ConsoleColor>? _modeColors;
    private readonly List<string> _outputItems = [];
    private readonly object _stateLock = new();
@@ -34,19 +32,16 @@ internal sealed class HarnessConsoleUXStateDriver : IUXStateDriver
    /// <param name="getState">Returns the component's current state.</param>
    /// <param name="setState">Replaces the component's state and triggers a re-render.</param>
    /// <param name="requestShutdown">Callback invoked when a command handler requests application shutdown.</param>
-    /// <param name="replaceSession">Callback invoked to replace the current agent session (e.g., on import).</param>
    /// <param name="modeColors">Optional mapping of mode names to console colors.</param>
    public HarnessConsoleUXStateDriver(
        Func<HarnessAppComponentState> getState,
        Action<HarnessAppComponentState> setState,
        Action requestShutdown,
-        Func<AgentSession, Task> replaceSession,
        IReadOnlyDictionary<string, ConsoleColor>? modeColors = null)
    {
        this._getState = getState;
        this._setState = setState;
        this._requestShutdown = requestShutdown;
-        this._replaceSession = replaceSession;
        this._modeColors = modeColors;
        this._currentMode = getState().ModeText;
    }
@@ -410,7 +405,4 @@ internal sealed class HarnessConsoleUXStateDriver : IUXStateDriver

    /// <inheritdoc/>
    public void RequestShutdown() => this._requestShutdown();
-
-    /// <inheritdoc/>
-    public Task ReplaceSessionAsync(AgentSession newSession) => this._replaceSession(newSession);
 }
@@ -1,55 +0,0 @@
-// Copyright (c) Microsoft. All rights reserved.
-
-#pragma warning disable VSTHRD002 // Synchronous waits are required by OpenTelemetry enrichment callbacks.
-
-using OpenTelemetry;
-using OpenTelemetry.Trace;
-
-namespace Harness.Shared.Console;
-
-/// <summary>
-/// Provides factory methods for creating pre-configured OpenTelemetry tracing for harness samples.
-/// </summary>
-public static class HarnessTracing
-{
-    /// <summary>
-    /// Creates a <see cref="TracerProvider"/> that captures spans from the specified source and HTTP client activity,
-    /// enriching HTTP spans with full request/response headers and bodies, and exports all spans to a timestamped
-    /// text file in the application base directory.
-    /// </summary>
-    /// <param name="sourceName">The activity source name to subscribe to (e.g., "Harness.Research").</param>
-    /// <returns>A configured <see cref="TracerProvider"/>, or <see langword="null"/> if the builder returns null.</returns>
-    public static TracerProvider? CreateFileTracerProvider(string sourceName)
-    {
-        var traceLogPath = Path.Combine(AppContext.BaseDirectory, $"traces_{DateTime.UtcNow:yyyyMMdd_HHmmss}_{Guid.NewGuid()}.log");
-
-        return Sdk.CreateTracerProviderBuilder()
-            .AddSource(sourceName)
-            .AddHttpClientInstrumentation((options) =>
-            {
-                options.EnrichWithHttpRequestMessage = (activity, request) =>
-                {
-                    activity.SetTag("http.request.headers", request.Headers.ToString());
-                    if (request.Content != null)
-                    {
-                        activity.SetTag("http.request.content.headers", request.Content.Headers.ToString());
-                        var content = request.Content.ReadAsStringAsync().GetAwaiter().GetResult();
-                        activity.SetTag("http.request.content.body", content);
-                    }
-                };
-
-                options.EnrichWithHttpResponseMessage = (activity, response) =>
-                {
-                    activity.SetTag("http.response.headers", response.Headers.ToString());
-                    if (response.Content != null)
-                    {
-                        activity.SetTag("http.response.content.headers", response.Content.Headers.ToString());
-                        var content = response.Content.ReadAsStringAsync().GetAwaiter().GetResult();
-                        activity.SetTag("http.response.content.body", content);
-                    }
-                };
-            })
-            .AddProcessor(new SimpleActivityExportProcessor(new FileSpanExporter(traceLogPath)))
-            .Build();
-    }
-}
@@ -7,11 +7,6 @@
    <ImplicitUsings>enable</ImplicitUsings>
  </PropertyGroup>

-  <ItemGroup>
-    <PackageReference Include="OpenTelemetry" />
-    <PackageReference Include="OpenTelemetry.Instrumentation.Http" />
-  </ItemGroup>
-
  <ItemGroup>
    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI\Microsoft.Agents.AI.csproj" />
    <ProjectReference Include="..\ConsoleReactiveFramework\ConsoleReactiveFramework.csproj" />
@@ -1,6 +1,5 @@
 // Copyright (c) Microsoft. All rights reserved.

-using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;

 namespace Harness.Shared.Console;
@@ -118,11 +117,4 @@ public interface IUXStateDriver
    /// on the owning component.
    /// </summary>
    void RequestShutdown();
-
-    /// <summary>
-    /// Replaces the current agent session with the specified session (e.g., after importing
-    /// a serialized session from a file).
-    /// </summary>
-    /// <param name="newSession">The new session to use.</param>
-    Task ReplaceSessionAsync(AgentSession newSession);
 }
@@ -24,17 +24,6 @@ public abstract class ConsoleObserver
    {
    }

-    /// <summary>
-    /// Called for each <see cref="AgentResponseUpdate"/> in the response stream, regardless of
-    /// whether it contains content. Override to inspect update-level metadata such as
-    /// <see cref="AgentResponseUpdate.RawRepresentation"/> for provider-specific events.
-    /// </summary>
-    /// <param name="ux">The UX state driver, used for rendering output.</param>
-    /// <param name="update">The streaming response update.</param>
-    /// <param name="agent">The agent being interacted with.</param>
-    /// <param name="session">The current agent session.</param>
-    public virtual Task OnResponseUpdateAsync(IUXStateDriver ux, AgentResponseUpdate update, AIAgent agent, AgentSession session) => Task.CompletedTask;
-
    /// <summary>
    /// Called for each <see cref="AIContent"/> item in the response stream.
    /// </summary>
@@ -31,10 +31,6 @@ public sealed class ToolCallDisplayObserver : ConsoleObserver
        {
            await ux.WriteInfoLineAsync($"🔧 Calling tool: {ToolCallFormatter.Format(this._formatters, functionCall)}...", ConsoleColor.DarkYellow);
        }
-        else if (content is WebSearchToolCallContent)
-        {
-            // Handled by OpenAIResponsesWebSearchDisplayObserver when present; skip here to avoid duplication.
-        }
        else if (content is ToolCallContent toolCall)
        {
            await ux.WriteInfoLineAsync($"🔧 Calling tool: {toolCall}...", ConsoleColor.DarkYellow);
@@ -6,26 +6,26 @@ using Microsoft.Extensions.AI;
 namespace Harness.Shared.Console.ToolFormatters;

 /// <summary>
-/// Formats <c>BackgroundAgents_*</c> tool calls with human-readable details
+/// Formats <c>SubAgents_*</c> tool calls with human-readable details
 /// for task start, continue, wait, and result retrieval operations.
 /// </summary>
-public sealed class BackgroundAgentToolFormatter : ToolCallFormatter
+public sealed class SubAgentToolFormatter : ToolCallFormatter
 {
    /// <inheritdoc/>
-    public override bool CanFormat(FunctionCallContent call) => call.Name.StartsWith("BackgroundAgents_", StringComparison.Ordinal);
+    public override bool CanFormat(FunctionCallContent call) => call.Name.StartsWith("SubAgents_", StringComparison.Ordinal);

    /// <inheritdoc/>
    public override string? FormatDetail(FunctionCallContent call) => call.Name switch
    {
-        "BackgroundAgents_StartTask" => FormatStartBackgroundTask(call),
-        "BackgroundAgents_WaitForFirstCompletion" => FormatIdList(call, "taskIds", "Wait for"),
-        "BackgroundAgents_GetTaskResults" => FormatSingleId(call, "taskId"),
-        "BackgroundAgents_ContinueTask" => FormatContinueTask(call),
-        "BackgroundAgents_ClearCompletedTask" => FormatSingleId(call, "taskId"),
+        "SubAgents_StartTask" => FormatStartSubTask(call),
+        "SubAgents_WaitForFirstCompletion" => FormatIdList(call, "taskIds", "Wait for"),
+        "SubAgents_GetTaskResults" => FormatSingleId(call, "taskId"),
+        "SubAgents_ContinueTask" => FormatContinueTask(call),
+        "SubAgents_ClearCompletedTask" => FormatSingleId(call, "taskId"),
        _ => null,
    };

-    private static string? FormatStartBackgroundTask(FunctionCallContent call)
+    private static string? FormatStartSubTask(FunctionCallContent call)
    {
        string? agentName = GetStringArgumentValue(call, "agentName");
        string? description = GetStringArgumentValue(call, "description");
@@ -19,7 +19,7 @@ public sealed class TodoToolFormatter : ToolCallFormatter
    public override string? FormatDetail(FunctionCallContent call) => call.Name switch
    {
        "TodoList_Add" => FormatAddTodos(call),
-        "TodoList_Complete" => FormatCompleteTodos(call),
+        "TodoList_Complete" => FormatIdList(call, "ids", "Complete"),
        "TodoList_Remove" => FormatIdList(call, "ids", "Remove"),
        _ => null,
    };
@@ -64,50 +64,6 @@ public sealed class TodoToolFormatter : ToolCallFormatter
        return sb.ToString();
    }

-    private static string? FormatCompleteTodos(FunctionCallContent call)
-    {
-        if (call.Arguments?.TryGetValue("items", out object? itemsObj) != true || itemsObj is null)
-        {
-            return null;
-        }
-
-        var entries = new List<(int Id, string? Reason)>();
-
-        if (itemsObj is JsonElement jsonArray && jsonArray.ValueKind == JsonValueKind.Array)
-        {
-            foreach (JsonElement item in jsonArray.EnumerateArray())
-            {
-                if (!item.TryGetProperty("id", out JsonElement idElement) || !idElement.TryGetInt32(out int id))
-                {
-                    continue;
-                }
-
-                string? reason = item.TryGetProperty("reason", out JsonElement reasonElement)
-                    ? reasonElement.GetString()
-                    : null;
-                entries.Add((id, reason));
-            }
-        }
-
-        if (entries.Count == 0)
-        {
-            return null;
-        }
-
-        var sb = new StringBuilder();
-        for (int i = 0; i < entries.Count; i++)
-        {
-            string connector = i < entries.Count - 1 ? "├─" : "└─";
-            sb.Append($"\n   {connector} Complete #{entries[i].Id}");
-            if (!string.IsNullOrEmpty(entries[i].Reason))
-            {
-                sb.Append($" — {Truncate(entries[i].Reason!, 80)}");
-            }
-        }
-
-        return sb.ToString();
-    }
-
    private static string? FormatIdList(FunctionCallContent call, string paramName, string verb)
    {
        List<int>? ids = GetIntListArgumentValue(call, paramName);
@@ -56,7 +56,7 @@ public abstract class ToolCallFormatter
        [
            new TodoToolFormatter(),
            new ModeToolFormatter(),
-            new BackgroundAgentToolFormatter(),
+            new SubAgentToolFormatter(),
            new FileMemoryToolFormatter(),
            new WebSearchToolFormatter(),
            new FallbackToolFormatter(),
@@ -1,19 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <TargetFrameworks>net10.0</TargetFrameworks>
-
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="OpenAI" />
-    <PackageReference Include="Microsoft.Extensions.AI" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
-  </ItemGroup>
-
-</Project>
@@ -1,61 +0,0 @@
-// Copyright (c) Microsoft. All rights reserved.
-
-#pragma warning disable OPENAI001 // Suppress experimental API warnings for Responses API usage.
-
-using Harness.Shared.Console.Observers;
-using Microsoft.Agents.AI;
-using Microsoft.Extensions.AI;
-using OpenAI.Responses;
-
-namespace Harness.Shared.Console.OpenAI;
-
-/// <summary>
-/// Detects and displays error/incomplete status from OpenAI Responses API streaming updates.
-/// Handles <see cref="StreamingResponseFailedUpdate"/> and <see cref="StreamingResponseIncompleteUpdate"/>
-/// which are not surfaced as <see cref="ErrorContent"/> by the chat client.
-/// </summary>
-/// <remarks>
-/// Note: <see cref="StreamingResponseErrorUpdate"/> is already handled by the SDK — it produces
-/// an <see cref="ErrorContent"/> which is displayed by <see cref="ErrorDisplayObserver"/>.
-/// This observer covers the cases where the SDK does not produce <see cref="ErrorContent"/>.
-/// </remarks>
-public sealed class OpenAIResponsesErrorObserver : ConsoleObserver
-{
-    /// <inheritdoc/>
-    public override async Task OnResponseUpdateAsync(IUXStateDriver ux, AgentResponseUpdate update, AIAgent agent, AgentSession session)
-    {
-        // AgentResponseUpdate.RawRepresentation is the ChatResponseUpdate,
-        // whose RawRepresentation is the underlying StreamingResponseUpdate.
-        object? rawUpdate = (update.RawRepresentation as ChatResponseUpdate)?.RawRepresentation
-            ?? update.RawRepresentation;
-
-        switch (rawUpdate)
-        {
-            case StreamingResponseFailedUpdate failedUpdate:
-                // Only display if the response has error details populated.
-                // When error is null, a follow-up StreamingResponseErrorUpdate typically
-                // carries the real error — the SDK surfaces that as ErrorContent,
-                // which is displayed by ErrorDisplayObserver.
-                if (failedUpdate.Response?.Error is { } error)
-                {
-                    string errorMessage = error.Message ?? "Unknown error";
-                    string? errorCode = error.Code.ToString();
-                    string errorText = $"❌ Response failed: {errorMessage}";
-                    if (!string.IsNullOrEmpty(errorCode))
-                    {
-                        errorText += $" (code: {errorCode})";
-                    }
-
-                    await ux.WriteInfoLineAsync(errorText, ConsoleColor.Red);
-                }
-
-                break;
-
-            case StreamingResponseIncompleteUpdate incompleteUpdate:
-                string? reason = incompleteUpdate.Response?.IncompleteStatusDetails?.Reason?.ToString();
-                string incompleteText = $"⚠️ Response incomplete: {reason ?? "unknown reason"}";
-                await ux.WriteInfoLineAsync(incompleteText, ConsoleColor.Yellow);
-                break;
-        }
-    }
-}
@@ -1,205 +0,0 @@
-// Copyright (c) Microsoft. All rights reserved.
-
-#pragma warning disable OPENAI001 // Suppress experimental API warnings for Responses API usage.
-
-using System.Text;
-using Harness.Shared.Console.Observers;
-using Microsoft.Agents.AI;
-using Microsoft.Extensions.AI;
-using OpenAI.Responses;
-
-namespace Harness.Shared.Console.OpenAI;
-
-/// <summary>
-/// Displays web search activity in the scroll area. Shows search queries,
-/// page opens, and find-in-page actions as they stream in from the API.
-/// </summary>
-public sealed class OpenAIResponsesWebSearchDisplayObserver : ConsoleObserver
-{
-    private const int MaxQueryDisplayLength = 120;
-
-    /// <inheritdoc/>
-    public override async Task OnContentAsync(IUXStateDriver ux, AIContent content, AIAgent agent, AgentSession session)
-    {
-        if (content is WebSearchToolResultContent resultContent
-            && resultContent.RawRepresentation is WebSearchCallResponseItem wscri)
-        {
-            await WriteActionAsync(ux, wscri, resultContent.Outputs);
-        }
-    }
-
-    private static async Task WriteActionAsync(IUXStateDriver ux, WebSearchCallResponseItem wscri, IList<AIContent>? outputs)
-    {
-        WebSearchAction? action = wscri.Action;
-        if (action is null)
-        {
-            await ux.WriteInfoLineAsync("🌐 Web Search Tool (no action details)", ConsoleColor.DarkCyan);
-            return;
-        }
-
-        switch (action)
-        {
-            case WebSearchFindInPageAction findInPage:
-                await WriteFindInPageAsync(ux, findInPage);
-                break;
-
-            case WebSearchOpenPageAction openPage:
-                await WriteOpenPageAsync(ux, openPage);
-                break;
-
-            case WebSearchSearchAction search:
-                await WriteSearchAsync(ux, search, outputs);
-                break;
-
-            default:
-                await ux.WriteInfoLineAsync("🌐 Web Search Tool (unknown action)", ConsoleColor.DarkCyan);
-                break;
-        }
-    }
-
-    private static async Task WriteSearchAsync(IUXStateDriver ux, WebSearchSearchAction search, IList<AIContent>? outputs)
-    {
-        // Read queries directly from the typed action.
-        IList<string> queries = search.Queries;
-
-        if (queries.Count == 0)
-        {
-            await ux.WriteInfoLineAsync("🌐 Web Search Tool: search", ConsoleColor.DarkCyan);
-            return;
-        }
-
-        var sb = new StringBuilder();
-        sb.Append("🌐 Web Search Tool: search");
-
-        // Show the search queries.
-        bool hasResults = outputs is { Count: > 0 };
-        for (int i = 0; i < queries.Count; i++)
-        {
-            string connector = (i < queries.Count - 1 || hasResults) ? "├─" : "└─";
-            string query = Truncate(queries[i], MaxQueryDisplayLength);
-            sb.Append($"\n   {connector} \"{query}\"");
-        }
-
-        // Show search result sources (URLs + titles) when available.
-        // Sources come from M.E.AI's Outputs when IncludedResponseProperty.WebSearchCallActionSources is set,
-        // or directly from the SDK's WebSearchSearchAction.Sources.
-        if (hasResults)
-        {
-            sb.Append("\n   │");
-            for (int i = 0; i < outputs!.Count; i++)
-            {
-                string connector = i < outputs.Count - 1 ? "├─" : "└─";
-                string line = FormatOutput(outputs[i]);
-                sb.Append($"\n   {connector} {line}");
-            }
-        }
-        else if (search.Sources is { Count: > 0 } sources)
-        {
-            sb.Append("\n   │");
-            for (int i = 0; i < sources.Count; i++)
-            {
-                string connector = i < sources.Count - 1 ? "├─" : "└─";
-                string line = FormatSource(sources[i]);
-                sb.Append($"\n   {connector} {line}");
-            }
-        }
-
-        await ux.WriteInfoLineAsync(sb.ToString(), ConsoleColor.DarkCyan);
-    }
-
-    private static async Task WriteOpenPageAsync(IUXStateDriver ux, WebSearchOpenPageAction openPage)
-    {
-        string url = openPage.Uri?.AbsoluteUri ?? "(unknown)";
-        await ux.WriteInfoLineAsync(
-            $"🌐 Web Search Tool: open page\n   └─ {url}",
-            ConsoleColor.DarkCyan);
-    }
-
-    private static async Task WriteFindInPageAsync(IUXStateDriver ux, WebSearchFindInPageAction findInPage)
-    {
-        string url = findInPage.Uri?.AbsoluteUri ?? "(unknown)";
-        string pattern = findInPage.Pattern ?? "(unknown)";
-
-        await ux.WriteInfoLineAsync(
-            $"🌐 Web Search Tool: find in page\n   ├─ \"{Truncate(pattern, MaxQueryDisplayLength)}\"\n   └─ {url}",
-            ConsoleColor.DarkCyan);
-    }
-
-    /// <summary>
-    /// Formats a single search result source from the SDK's <see cref="WebSearchActionSource"/> for display.
-    /// </summary>
-    private static string FormatSource(WebSearchActionSource source)
-    {
-        if (source is WebSearchActionUriSource uriSource)
-        {
-            string url = uriSource.Uri?.AbsoluteUri ?? "(unknown)";
-
-            // WebSearchActionUriSource doesn't expose a title property,
-            // but the API may include one in the raw response JSON.
-            string? title = GetTitleFromRawRepresentation(uriSource);
-
-            return title is not null
-                ? $"{Truncate(title, MaxQueryDisplayLength)} — {url}"
-                : url;
-        }
-
-        return source.ToString() ?? "(unknown source)";
-    }
-
-    /// <summary>
-    /// Formats a single search result output from M.E.AI's <see cref="AIContent"/> for display.
-    /// </summary>
-    private static string FormatOutput(AIContent output)
-    {
-        if (output is UriContent uriContent)
-        {
-            string url = uriContent.Uri?.AbsoluteUri ?? "(unknown)";
-
-            // Try to extract a title from the raw JSON of the source.
-            // The SDK's WebSearchActionUriSource doesn't expose a title property,
-            // but the API may include one in the raw response.
-            string? title = GetTitleFromRawRepresentation(uriContent.RawRepresentation)
-                ?? (uriContent.AdditionalProperties?.TryGetValue("title", out var t) is true ? t?.ToString() : null);
-
-            return title is not null
-                ? $"{Truncate(title, MaxQueryDisplayLength)} — {url}"
-                : url;
-        }
-
-        return output.ToString() ?? "(unknown output)";
-    }
-
-    /// <summary>
-    /// Attempts to extract a "title" field from a raw representation object by serializing it to JSON.
-    /// The SDK's <see cref="WebSearchActionUriSource"/> doesn't expose a title property,
-    /// but the API may include one in the raw JSON — this is forward-compatible for when
-    /// the SDK adds title support.
-    /// </summary>
-    private static string? GetTitleFromRawRepresentation(object? rawRepresentation)
-    {
-        if (rawRepresentation is null)
-        {
-            return null;
-        }
-
-        try
-        {
-            var data = System.ClientModel.Primitives.ModelReaderWriter.Write(rawRepresentation);
-            using var doc = System.Text.Json.JsonDocument.Parse(data);
-            if (doc.RootElement.TryGetProperty("title", out var titleEl)
-                && titleEl.ValueKind == System.Text.Json.JsonValueKind.String)
-            {
-                return titleEl.GetString();
-            }
-        }
-        catch
-        {
-            // Serialization may not be supported for this object type.
-        }
-
-        return null;
-    }
-
-    private static string Truncate(string text, int maxLength)
-        => text.Length <= maxLength ? text : string.Concat(text.AsSpan(0, maxLength - 1), "…");
-}
@@ -13,10 +13,9 @@
  </ItemGroup>

  <ItemGroup>
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Harness\Microsoft.Agents.AI.Harness.csproj" />
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
-    <ProjectReference Include="..\Harness_Shared_Console_OpenAI\Harness_Shared_Console_OpenAI.csproj" />
  </ItemGroup>

 </Project>
@@ -1,9 +1,8 @@
 // Copyright (c) Microsoft. All rights reserved.

-// This sample demonstrates how to use a HarnessAgent for interactive research tasks.
-// The HarnessAgent comes pre-configured with TodoProvider, AgentModeProvider, FileMemoryProvider,
-// ToolApproval, WebSearch, and OpenTelemetry — so this sample only needs custom instructions
-// and a WebBrowsingTool.
+// This sample demonstrates how to use a HarnessAgent with the Harness AIContextProviders
+// (TodoProvider and AgentModeProvider) for interactive research tasks with web search
+// capabilities powered by Azure AI Foundry.
 // The agent plans research tasks, creates a todo list, gets user approval,
 // and then executes each step — all within an interactive conversation loop.
 //
@@ -16,89 +15,147 @@
 #pragma warning disable MAAI001  // Suppress experimental API warnings for Agents AI experiments.

 using System.ClientModel.Primitives;
-using Azure.AI.Projects;
 using Azure.Identity;
 using Harness.Shared.Console;
-using Harness.Shared.Console.OpenAI;
 using Harness.Shared.Console.ToolFormatters;
 using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;
+using OpenAI;
+using OpenAI.Responses;
 using SampleApp;

-var endpoint = Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT") ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set.");
+var endpoint = Environment.GetEnvironmentVariable("AZURE_FOUNDRY_OPENAI_ENDPOINT") ?? throw new InvalidOperationException("AZURE_FOUNDRY_OPENAI_ENDPOINT is not set.");
 var deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4";

 const int MaxContextWindowTokens = 1_050_000;
 const int MaxOutputTokens = 128_000;
-const string TracingSourceName = "Harness.Research";
-
-// Set up OpenTelemetry tracing that writes spans to a text file.
-// This captures all agent activity (tool calls, model invocations, compaction, etc.)
-// as well as HTTP requests made by the underlying HttpClient transport.
-using var tracerProvider = HarnessTracing.CreateFileTracerProvider(TracingSourceName);

 // Create a HarnessAgent with the Harness providers (TodoProvider and AgentModeProvider)
 // and research-focused instructions including the mandatory planning workflow.
 var instructions =
    """
-    ## Research Assistant Instructions
-
    You are a research assistant. When given a research topic, research it thoroughly using web search and web browsing.
    Use your knowledge to form good search queries and hypotheses, but always verify claims with the tools available to you rather than relying on memory alone.

-    ### Research quality
+    ## Mandatory planning workflow
+
+    For every new substantive user request, including short factual questions, your behavior is determined by the mode you are in.
+    If you are in plan mode, start with the *Plan Mode* steps, and if you are in execute mode, skip directly to the *Execute Mode* steps below.
+
+    *Plan Mode*
+
+    1. Analyze the request with the purpose of building a research plan.
+    2. Create a list of todo items.
+    3. If needed, use the provided tools to do some exploratory checks to help build a plan and determine what clarifying questions you may need from the user.
+    4. Ask for clarifications from the user where needed.
+      1. Ask each clarification one by one.
+      2. When asking for clarification and you have specific options in mind, present them to the user, so they can choose the option instead of having to retype the entire response.
+      3. Do not proceed until you have received all the needed clarifications.
+      4. Do short exploratory research if it helps with being able to ask sensible clarifications from the user.
+    5. Write the plan to a memory file, so that it is retained even if compaction happens. Make sure to update the plan file if the user requests changes.
+    6. Present the plan to the user and ask for approval to switch to execute mode and process the plan.
+    7. When approval is granted, always switch to execute mode (using the `AgentMode_Set` tool), and follow the steps for *Execute mode*.
+
+    *Execute Mode*
+
+    1. If you don't have a plan or tasks yet, analyse the user request and create tasks and a plan. (**Skip this step if you came from plan mode**)
+    2. Work autonomously — use your best judgement to make decisions and keep progressing without asking the user questions. The goal is to have a complete, useful result ready when the user returns.
+    3. If you encounter ambiguity or an unexpected situation during execution, choose the most reasonable option, note your choice, and keep going.
+    4. Mark tasks as completed as you finish them.
+    5. Continue working, thinking and calling tools until you have the research result for the user.
+
+    ## General Instructions
+
+    - You must check the current mode after any user input, since the user may have changed the mode themselves,
+      e.g. the user may have switched to 'plan' mode after a previous research task finished in 'execute' mode, meaning they want to review a plan first before execution.
+    - Explain your reasoning and thought process as you work through tasks.
+    - Explain what you learned and what you are going to do next between tool calls, so the user can follow along with your thought process.
+    - Avoid making more than 4 tool calls in a row without explaining what you are doing.
+    - Do not answer the underlying question before the plan has been presented and approved.
+    - This rule applies even when the answer seems obvious or the task seems small.
+    - For short requests, use a brief micro-plan rather than skipping planning. The only exceptions are:
+      - greetings,
+      - pure acknowledgments,
+      - clarification questions needed to form the plan,
+      - follow-up questions about results you have already presented,
+      - meta-discussion about the workflow itself.
+
+    **Todo management**
+
+    Mark each todo complete as you finish it so the list stays current.
+    If a todo turns out to be unnecessary or is blocked, remove it and briefly explain why.
+    Once the user finishes with a topic and moves onto a new one, clean up old completed todos by deleting them.
+
+    **Research quality**

    Consult multiple sources when possible and cross-reference key claims.
    When sources disagree, note the discrepancy and explain which source you consider more reliable and why.
    If a web page fails to load or a search returns irrelevant results, try alternative search queries or sources before moving on.
    Track your sources — you will need them when presenting results.

-    ### Presenting results
+    **Presenting results**

    When presenting your final findings:
-    - Use Markdown formatting for clarity.
    - Use clear sections with headings for each major topic or sub-question.
    - Cite your sources inline (e.g., "According to [source name](URL), ...").
    - End with a brief summary of key takeaways.
-    - In addition to returning the results to the user, save the final research report to file memory so it survives compaction and can be referenced later.
+    - Save the final research report to file memory so it survives compaction and can be referenced later.
+
+    **File memory**
+
+    Use the FileMemory_* tools to:
+    - Store downloaded search results or web pages.
+    - Store plans.
+    - Read the current plan to make sure tasks were done according to plan.
+    - Store findings.
+    - Check for relevant previously downloaded data / findings before starting new research.
    """;

 // Create the agent using AsHarnessAgent, which pre-configures function invocation,
-// per-service-call chat history persistence, in-loop compaction, TodoProvider, AgentModeProvider,
-// FileMemoryProvider, ToolApproval, WebSearch, AgentSkillsProvider, and OpenTelemetry.
-// Only custom instructions, a WebBrowsingTool, and FileAccess opt-out are needed.
+// per-service-call chat history persistence, and in-loop compaction.
+// Then wrap with UseToolApproval to allow auto-approving tools once confirmed.
 AIAgent agent =
    // Create an OpenAIClient that communicates with the Foundry responses service.
-    new AIProjectClient(
-        new Uri(endpoint),
+    new OpenAIClient(
        // WARNING: DefaultAzureCredential is convenient for development but requires careful consideration in production.
        // In production, consider using a specific credential (e.g., ManagedIdentityCredential) to avoid
        // latency issues, unintended credential probing, and potential security risks from fallback mechanisms.
-        new DefaultAzureCredential(),
-        new AIProjectClientOptions { RetryPolicy = new ClientRetryPolicy(3) })  // Enable retries to improve resiliency.
-    .GetProjectOpenAIClient()
+        new BearerTokenPolicy(new DefaultAzureCredential(), "https://ai.azure.com/.default"),
+        new OpenAIClientOptions()
+        {
+            Endpoint = new Uri(endpoint),
+            RetryPolicy = new ClientRetryPolicy(3)          // Enable retries to improve resiliency.
+        })
    .GetResponsesClient()
-    .AsIChatClient(deploymentName)
+    .AsIChatClientWithStoredOutputDisabled(deploymentName)   // We want to manage chat history locally (not stored in the responses service), so that we can manage compaction ourselves.
    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
    {
        Name = "ResearchAgent",
        Description = "A research assistant that plans and executes research tasks.",
-        DisableFileAccess = true,                           // If enabled, this would allow the agent to read/write files in a working directory
-        OpenTelemetrySourceName = TracingSourceName,        // Use our custom source name so spans are captured by the TracerProvider above.
-        FileMemoryStore = new FileSystemAgentFileStore(     // Configure the file memory provider to store files in a local folder called "agent-files".
-            Path.Combine(AppContext.BaseDirectory, "agent-files")),
+        AIContextProviders =
+        [
+            new TodoProvider(),         // Add an AIContextProvider to allow the agent to create a TODO list, which is stored in the session.
+            new AgentModeProvider(),    // Add an AIContextProvider that tracks the agent mode and allows switching mode. Current mode is stored in the session.
+            new FileMemoryProvider(     // Add an AIContextProvider that can store memories in files under a session specific working folder.
+                new FileSystemAgentFileStore(Path.Combine(AppContext.BaseDirectory, "agent-files")),
+                (_) => new FileMemoryState() { WorkingFolder = DateTime.UtcNow.ToString("yyyyMMdd_HHmmss") + "_" + Guid.NewGuid().ToString() })
+        ],
        ChatOptions = new ChatOptions
        {
            Instructions = instructions,
            Tools =
            [
-                new WebBrowsingTool(                        // Add a local web browsing tool that converts html to markdown.
+                ResponseTool.CreateWebSearchTool().AsAITool(),          // Add the foundry hosted web search tool that runs in the service.
+                new WebBrowsingTool(                                    // Add a local web browsing tool that converts html to markdown.
                    new WebBrowsingToolOptions { AllowPublicNetworks = true }),
            ],
-            MaxOutputTokens = MaxOutputTokens,              // Set a high token limit for long research tasks with many tool calls and long outputs.
+            MaxOutputTokens = MaxOutputTokens,                          // Set a high token limit for long research tasks with many tool calls and long outputs.
            Reasoning = new() { Effort = ReasoningEffort.Medium },
        },
-    });
+    })
+    .AsBuilder()
+    .UseToolApproval()                                                      // Add the ability to auto approve tools once a user has said they don't want to be asked again. Approval rules are tied to the session.
+    .Build();

 // Run the interactive console session using the shared HarnessConsole helper.
 await HarnessConsole.RunAgentAsync(
@@ -106,15 +163,12 @@ await HarnessConsole.RunAgentAsync(
    userPrompt: "Enter a research topic to get started.",
    new HarnessConsoleOptions
    {
-        Observers = [
-            new OpenAIResponsesWebSearchDisplayObserver(),
-            new OpenAIResponsesErrorObserver(),
-            .. HarnessConsoleOptions.BuildObserversWithPlanning(
-                agent,
-                planModeName: "plan",
-                executionModeName: "execute",
-                maxContextWindowTokens: MaxContextWindowTokens,
-                maxOutputTokens: MaxOutputTokens,
-                toolFormatters: [new DownloadUriToolFormatter(), .. ToolCallFormatter.BuildDefaultToolFormatters()])],
+        Observers = HarnessConsoleOptions.BuildObserversWithPlanning(
+            agent,
+            planModeName: "plan",
+            executionModeName: "execute",
+            maxContextWindowTokens: MaxContextWindowTokens,
+            maxOutputTokens: MaxOutputTokens,
+            toolFormatters: [new DownloadUriToolFormatter(), .. ToolCallFormatter.BuildDefaultToolFormatters()]),
        CommandHandlers = HarnessConsoleOptions.BuildDefaultCommandHandlers(agent),
    });
@@ -1,121 +0,0 @@
-// Copyright (c) Microsoft. All rights reserved.
-
-// This sample demonstrates how to use the BackgroundAgentsProvider to delegate work to background agents.
-// A parent agent is given a list of stock tickers and instructed to find the closing price
-// for each ticker on December 31, 2025. It delegates the web searches to a background agent.
-// The HarnessAgent provides built-in WebSearch (HostedWebSearchTool) so no manual web search
-// tool configuration is needed on the background agent.
-//
-// Special commands:
-//   /exit    — End the session.
-
-#pragma warning disable OPENAI001 // Suppress experimental API warnings for Responses API usage.
-#pragma warning disable MAAI001  // Suppress experimental API warnings for Agents AI experiments.
-
-using System.ClientModel.Primitives;
-using Azure.AI.Projects;
-using Azure.Identity;
-using Harness.Shared.Console;
-using Harness.Shared.Console.OpenAI;
-using Microsoft.Agents.AI;
-using Microsoft.Extensions.AI;
-
-var endpoint = Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT") ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set.");
-var deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4";
-
-const int MaxContextWindowTokens = 1_050_000;
-const int MaxOutputTokens = 128_000;
-const string TracingSourceName = "Harness.SubAgents";
-
-// Set up OpenTelemetry tracing that writes spans to a text file.
-using var tracerProvider = HarnessTracing.CreateFileTracerProvider(TracingSourceName);
-
-// Create the AIProjectClient for communicating with the Foundry responses service.
-var projectClient = new AIProjectClient(
-    new Uri(endpoint),
-    new DefaultAzureCredential(),
-    new AIProjectClientOptions { RetryPolicy = new ClientRetryPolicy(3) });
-
-// --- Background agent: Web Search Agent ---
-// This agent uses the HarnessAgent's built-in HostedWebSearchTool to search the web.
-// Features not needed by this sub-agent are disabled.
-AIAgent webSearchAgent =
-    projectClient
-    .GetProjectOpenAIClient()
-    .GetResponsesClient()
-    .AsIChatClient(deploymentName)
-    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
-    {
-        Name = "WebSearchAgent",
-        Description = "An agent that can search the web to find information.",
-        OpenTelemetrySourceName = TracingSourceName,
-        DisableTodoProvider = true,
-        DisableAgentModeProvider = true,
-        DisableFileMemory = true,   // If enabled, this would allow the agent to store memories as files in a directory associated with the current session
-        DisableFileAccess = true,   // If enabled, this would allow the agent to read/write files in a working directory
-        DisableToolApproval = true, // If enabled, this allows don't-ask-again approval functionality.
-        ChatOptions = new ChatOptions
-        {
-            Instructions = "You are a web search assistant. When asked to find information, use the web search tool to look it up and return a concise, factual answer.",
-        },
-    });
-
-// --- Parent agent: Stock Price Researcher ---
-// This agent orchestrates the background agent to look up stock prices in parallel.
-var parentInstructions =
-    """
-    You are a stock price research assistant. You have access to a web search background agent that can look up information on the web.
-
-    When given a list of stock tickers, your job is to find the closing price for each ticker on December 31, 2025.
-
-    ## Workflow
-
-    1. For each ticker, start a background task on the WebSearchAgent asking it to find the closing price on December 31, 2025.
-       - Start all background tasks before waiting for any of them to complete, so they run concurrently.
-    2. Wait for all background tasks to complete.
-    3. Retrieve the results from each background task.
-    4. Present a summary table with the ticker symbol and closing price for each stock.
-    5. Clear all completed tasks to free memory.
-
-    ## Important
-
-    - Always delegate web searches to the WebSearchAgent background agent. Do not try to answer from memory.
-    - If a background task fails or returns unclear results, continue the task with a more specific query.
-    - Present results in a clean markdown table format.
-    """;
-
-// --- Parent agent: Stock Price Researcher ---
-// This agent orchestrates the sub-agent to look up stock prices in parallel.
-// Most features are disabled since the parent only needs SubAgentsProvider.
-AIAgent parentAgent =
-    projectClient
-    .GetProjectOpenAIClient()
-    .GetResponsesClient()
-    .AsIChatClient(deploymentName)
-    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
-    {
-        Name = "StockPriceResearcher",
-        Description = "An agent that researches stock prices using background agents.",
-        OpenTelemetrySourceName = TracingSourceName,
-        DisableTodoProvider = true,
-        DisableAgentModeProvider = true,
-        DisableFileMemory = true,   // If enabled, this would allow the agent to store memories as files in a directory associated with the current session
-        DisableFileAccess = true,   // If enabled, this would allow the agent to read/write files in a working directory
-        DisableToolApproval = true, // If enabled, this allows don't-ask-again approval functionality.
-        DisableWebSearch = true,
-        BackgroundAgents = [webSearchAgent],
-        ChatOptions = new ChatOptions
-        {
-            Instructions = parentInstructions,
-            MaxOutputTokens = 16_000,
-        },
-    });
-
-// Run the interactive console session.
-await HarnessConsole.RunAgentAsync(
-    parentAgent,
-    userPrompt: "Enter a list of stock tickers (e.g., BAC, MSFT, BA):",
-    options: new HarnessConsoleOptions
-    {
-        Observers = [new OpenAIResponsesErrorObserver(), .. HarnessConsoleOptions.BuildDefaultObservers()],
-    });
@@ -13,10 +13,9 @@
  </ItemGroup>

  <ItemGroup>
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Harness\Microsoft.Agents.AI.Harness.csproj" />
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
-    <ProjectReference Include="..\Harness_Shared_Console_OpenAI\Harness_Shared_Console_OpenAI.csproj" />
  </ItemGroup>

 </Project>
@@ -0,0 +1,106 @@
+// Copyright (c) Microsoft. All rights reserved.
+
+// This sample demonstrates how to use the SubAgentsProvider to delegate work to sub-agents.
+// A parent agent is given a list of stock tickers and instructed to find the closing price
+// for each ticker on December 31, 2025. It delegates the web searches to a sub-agent
+// equipped with Foundry's hosted web search tool.
+//
+// Special commands:
+//   /exit    — End the session.
+
+#pragma warning disable OPENAI001 // Suppress experimental API warnings for Responses API usage.
+#pragma warning disable MAAI001  // Suppress experimental API warnings for Agents AI experiments.
+
+using System.ClientModel.Primitives;
+using Azure.Identity;
+using Harness.Shared.Console;
+using Microsoft.Agents.AI;
+using Microsoft.Extensions.AI;
+using OpenAI;
+using OpenAI.Responses;
+
+var endpoint = Environment.GetEnvironmentVariable("AZURE_FOUNDRY_OPENAI_ENDPOINT") ?? throw new InvalidOperationException("AZURE_FOUNDRY_OPENAI_ENDPOINT is not set.");
+var deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4";
+
+const int MaxContextWindowTokens = 1_050_000;
+const int MaxOutputTokens = 128_000;
+
+// --- Sub-agent: Web Search Agent ---
+// This agent can search the web and is used by the parent agent to look up stock prices.
+AIAgent webSearchAgent =
+    new OpenAIClient(
+        new BearerTokenPolicy(new DefaultAzureCredential(), "https://ai.azure.com/.default"),
+        new OpenAIClientOptions()
+        {
+            Endpoint = new Uri(endpoint),
+            RetryPolicy = new ClientRetryPolicy(3)
+        })
+    .GetResponsesClient()
+    .AsIChatClientWithStoredOutputDisabled(deploymentName)
+    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
+    {
+        Name = "WebSearchAgent",
+        Description = "An agent that can search the web to find information.",
+        ChatOptions = new ChatOptions
+        {
+            Instructions = "You are a web search assistant. When asked to find information, use the web search tool to look it up and return a concise, factual answer.",
+            Tools =
+            [
+                ResponseTool.CreateWebSearchTool().AsAITool(),
+            ],
+        },
+    });
+
+// --- Parent agent: Stock Price Researcher ---
+// This agent orchestrates the sub-agent to look up stock prices in parallel.
+var parentInstructions =
+    """
+    You are a stock price research assistant. You have access to a web search sub-agent that can look up information on the web.
+
+    When given a list of stock tickers, your job is to find the closing price for each ticker on December 31, 2025.
+
+    ## Workflow
+
+    1. For each ticker, start a sub-task on the WebSearchAgent asking it to find the closing price on December 31, 2025.
+       - Start all sub-tasks before waiting for any of them to complete, so they run concurrently.
+    2. Wait for all sub-tasks to complete.
+    3. Retrieve the results from each sub-task.
+    4. Present a summary table with the ticker symbol and closing price for each stock.
+    5. Clear all completed tasks to free memory.
+
+    ## Important
+
+    - Always delegate web searches to the WebSearchAgent sub-agent. Do not try to answer from memory.
+    - If a sub-task fails or returns unclear results, continue the task with a more specific query.
+    - Present results in a clean markdown table format.
+    """;
+
+AIAgent parentAgent =
+    new OpenAIClient(
+        new BearerTokenPolicy(new DefaultAzureCredential(), "https://ai.azure.com/.default"),
+        new OpenAIClientOptions()
+        {
+            Endpoint = new Uri(endpoint),
+            RetryPolicy = new ClientRetryPolicy(3)
+        })
+    .GetResponsesClient()
+    .AsIChatClientWithStoredOutputDisabled(deploymentName)
+    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
+    {
+        Name = "StockPriceResearcher",
+        Description = "An agent that researches stock prices using sub-agents.",
+        AIContextProviders =
+        [
+            new SubAgentsProvider([webSearchAgent]),
+        ],
+        ChatOptions = new ChatOptions
+        {
+            Instructions = parentInstructions,
+            MaxOutputTokens = 16_000,
+        },
+    });
+
+// Run the interactive console session.
+await HarnessConsole.RunAgentAsync(
+    parentAgent,
+    userPrompt: "Enter a list of stock tickers (e.g., BAC, MSFT, BA):");
@@ -1,24 +1,24 @@
-# Harness Step 02 — BackgroundAgents (Stock Price Research)
+# Harness Step 02 — SubAgents (Stock Price Research)

-This sample demonstrates how to use the **BackgroundAgentsProvider** to delegate work from a parent agent to background agents. Both agents use `HarnessAgent` for pre-configured function invocation, per-service-call persistence, and context-window compaction.
+This sample demonstrates how to use the **SubAgentsProvider** to delegate work from a parent agent to sub-agents. Both agents use `HarnessAgent` for pre-configured function invocation, per-service-call persistence, and context-window compaction.

 ## What It Does

-A parent agent receives a list of stock tickers and uses a web-search background agent to find the closing price for each ticker on December 31, 2025. The background tasks run concurrently, and results are presented in a summary table.
+A parent agent receives a list of stock tickers and uses a web-search sub-agent to find the closing price for each ticker on December 31, 2025. The sub-tasks run concurrently, and results are presented in a summary table.

 ### Architecture

 ```
-┌────────────────────────────────────────┐
-│     StockPriceResearcher               │
-│         (Parent Agent)                 │
-│                                        │
-│  BackgroundAgentsProvider              │
-│    ├─ BackgroundAgents_StartTask       │
-│    ├─ BackgroundAgents_WaitFor...      │
-│    ├─ BackgroundAgents_GetTaskResults  │
-│    └─ ...                              │
-└────────────┬───────────────────────────┘
+┌─────────────────────────────────┐
+│     StockPriceResearcher        │
+│         (Parent Agent)          │
+│                                 │
+│  SubAgentsProvider              │
+│    ├─ SubAgents_StartTask       │
+│    ├─ SubAgents_WaitFor...      │
+│    ├─ SubAgents_GetTaskResults  │
+│    └─ ...                       │
+└────────────┬────────────────────┘
             │  delegates to
             ▼
 ┌─────────────────────────────────┐
@@ -40,7 +40,7 @@ A parent agent receives a list of stock tickers and uses a web-search background
 ## Running the Sample

 ```bash
-cd dotnet/samples/02-agents/Harness/Harness_Step02_Research_WithBackgroundAgents
+cd dotnet/samples/02-agents/Harness/Harness_Step02_Research_WithSubAgents
 dotnet run
 ```

@@ -50,4 +50,4 @@ When prompted, enter a list of stock tickers such as:
 BAC, MSFT, BA
 ```

-The parent agent will delegate each ticker lookup to the web search background agent concurrently and present the results in a table.
+The parent agent will delegate each ticker lookup to the web search sub-agent concurrently and present the results in a table.
@@ -13,13 +13,13 @@
  </ItemGroup>

  <ItemGroup>
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Harness\Microsoft.Agents.AI.Harness.csproj" />
+    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
  </ItemGroup>

  <ItemGroup>
-    <Content Include="working\**\*" CopyToOutputDirectory="PreserveNewest" />
+    <Content Include="data\**\*" CopyToOutputDirectory="PreserveNewest" />
  </ItemGroup>

 </Project>
@@ -1,12 +1,10 @@
 // Copyright (c) Microsoft. All rights reserved.

-// This sample demonstrates how to use a HarnessAgent with the default FileAccessProvider
+// This sample demonstrates how to use a HarnessAgent with the FileAccessProvider
 // to give an agent access to a folder of CSV data files. The agent can read, analyze,
 // and extract information from the data, then write results back as new files.
 //
-// The sample includes a pre-populated `working/` folder with sales transaction data.
-// The HarnessAgent's default FileAccessProvider uses `{cwd}/working` as its working directory,
-// which matches this sample's folder layout.
+// The sample includes a pre-populated `data/` folder with sales transaction data.
 // Ask the agent to analyze the data, produce summaries, or create new output files.
 //
 // Special commands:
@@ -16,21 +14,22 @@
 #pragma warning disable MAAI001  // Suppress experimental API warnings for Agents AI experiments.

 using System.ClientModel.Primitives;
-using Azure.AI.Projects;
 using Azure.Identity;
 using Harness.Shared.Console;
 using Microsoft.Agents.AI;
 using Microsoft.Extensions.AI;
+using OpenAI;
+using OpenAI.Responses;

-var endpoint = Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT") ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set.");
+var endpoint = Environment.GetEnvironmentVariable("AZURE_FOUNDRY_OPENAI_ENDPOINT") ?? throw new InvalidOperationException("AZURE_FOUNDRY_OPENAI_ENDPOINT is not set.");
 var deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4";

 const int MaxContextWindowTokens = 1_050_000;
 const int MaxOutputTokens = 128_000;
-const string TracingSourceName = "Harness.DataProcessing";

-// Set up OpenTelemetry tracing that writes spans to a text file.
-using var tracerProvider = HarnessTracing.CreateFileTracerProvider(TracingSourceName);
+// Point the file store at the data/ folder that ships with the sample.
+var dataFolder = Path.Combine(AppContext.BaseDirectory, "data");
+var fileStore = new FileSystemAgentFileStore(dataFolder);

 var instructions =
    """
@@ -57,27 +56,25 @@ var instructions =
    - Always explain what you learned and what you are going to do next between tool calls, so the user can follow along with your thought process.
    """;

-// Create the agent using AsHarnessAgent. The FileAccessStore is explicitly set to the
-// sample's working/ folder (copied to the output directory) so it works regardless of cwd.
-// Unused features are disabled.
+// Create the chat client from the OpenAI provider.
 AIAgent agent =
-    new AIProjectClient(
-        new Uri(endpoint),
-        new DefaultAzureCredential(),
-        new AIProjectClientOptions { RetryPolicy = new ClientRetryPolicy(3) })
-    .GetProjectOpenAIClient()
+    new OpenAIClient(
+        new BearerTokenPolicy(new DefaultAzureCredential(), "https://ai.azure.com/.default"),
+        new OpenAIClientOptions()
+        {
+            Endpoint = new Uri(endpoint),
+            RetryPolicy = new ClientRetryPolicy(3)
+        })
    .GetResponsesClient()
-    .AsIChatClient(deploymentName)
+    .AsIChatClientWithStoredOutputDisabled(deploymentName)
    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
    {
        Name = "DataAnalyst",
        Description = "A data analyst assistant that reads, analyzes, and processes data files.",
-        OpenTelemetrySourceName = TracingSourceName,
-        FileAccessStore = new FileSystemAgentFileStore(Path.Combine(AppContext.BaseDirectory, "working")),
-        DisableTodoProvider = true,
-        DisableAgentModeProvider = true,
-        DisableFileMemory = true,   // If enabled, this would allow the agent to store memories as files in a directory associated with the current session
-        DisableWebSearch = true,
+        AIContextProviders =
+        [
+            new FileAccessProvider(fileStore),
+        ],
        ChatOptions = new ChatOptions
        {
            Instructions = instructions,
@@ -1,11 +1,11 @@
 # What this sample demonstrates

-This sample demonstrates how to use a `HarnessAgent` with the default `FileAccessProvider` to give an agent access to a folder of data files for reading, analyzing, and writing results. The `HarnessAgent` pre-configures function invocation, per-service-call chat history persistence, in-loop compaction, tool approval, and OpenTelemetry — so the sample only needs to supply the chat client, token limits, custom instructions, and opt out of unused features.
+This sample demonstrates how to use a `HarnessAgent` with the `FileAccessProvider` to give an agent access to a folder of data files for reading, analyzing, and writing results. The `HarnessAgent` pre-configures function invocation, per-service-call chat history persistence, and in-loop compaction — so the sample only needs to supply the chat client, token limits, and application-specific options.

 Key features showcased:

 - **HarnessAgent** — a pre-configured agent that wraps a `ChatClientAgent` with function invocation, per-service-call persistence, and context-window compaction
- **FileAccessProvider** — the HarnessAgent's default file access provider uses `{cwd}/working` as its working directory, matching this sample's `working/` folder
+- **FileAccessProvider** — gives the agent tools to read, write, list, search, and delete files in a shared data folder
 - **CSV data processing** — the agent reads sales transaction data and performs analysis on demand
 - **Output file creation** — the agent can write summaries, filtered data, or reports back to the data folder
 - **Streaming output** — responses are streamed token-by-token for a natural experience
@@ -39,7 +39,7 @@ dotnet run --project samples/02-agents/Harness/Harness_Step03_DataProcessing

 ## What to Expect

-The sample starts an interactive conversation with a data analyst agent. The `working/` folder contains a `sales.csv` file with ~50 rows of sales transaction data (date, product, category, quantity, unit price, region, salesperson).
+The sample starts an interactive conversation with a data analyst agent. The `data/` folder contains a `sales.csv` file with ~50 rows of sales transaction data (date, product, category, quantity, unit price, region, salesperson).

 You can ask the agent to:

@@ -53,7 +53,7 @@ E.g. try the following prompt `Please process the sales.csv file by first filter

 ## Sample Data

-The included `working/sales.csv` contains sales transactions from January to March 2025 with the following columns:
+The included `data/sales.csv` contains sales transactions from January to March 2025 with the following columns:

 | Column | Description |
 | --- | --- |
@@ -1,29 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-
-  <PropertyGroup>
-    <OutputType>Exe</OutputType>
-    <TargetFrameworks>net10.0</TargetFrameworks>
-
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Azure.AI.Projects" />
-    <PackageReference Include="Azure.Identity" />
-    <PackageReference Include="Hyperlight.HyperlightSandbox.Guest.Python" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Harness\Microsoft.Agents.AI.Harness.csproj" />
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.Hyperlight\Microsoft.Agents.AI.Hyperlight.csproj" />
-    <ProjectReference Include="..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
-    <ProjectReference Include="..\Harness_Shared_Console\Harness_Shared_Console.csproj" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <Content Include="skills\**\*" CopyToOutputDirectory="PreserveNewest" />
-  </ItemGroup>
-
-</Project>
@@ -1,122 +0,0 @@
-// Copyright (c) Microsoft. All rights reserved.
-
-// This sample demonstrates a HarnessAgent with ALL features enabled, plus:
-// - Hyperlight CodeAct (HyperlightCodeActProvider) for sandboxed Python code execution
-// - Skills (AgentSkillsProvider) discovering a local "regex-tester" skill
-//
-// The agent can plan tasks with todos, manage modes, store memories, read/write files,
-// search the web, approve sensitive tools, discover and use skills, and execute arbitrary
-// Python code in a Hyperlight sandbox — all pre-configured by the HarnessAgent.
-//
-// Try asking: "Help me write a regex that matches valid email addresses, then test it."
-//
-// Special commands:
-//   /todos  — Display the current todo list without invoking the agent.
-//   /mode   — Get or set the current agent mode.
-//   /exit   — End the session.
-
-#pragma warning disable OPENAI001 // Suppress experimental API warnings for Responses API usage.
-#pragma warning disable MAAI001  // Suppress experimental API warnings for Agents AI experiments.
-
-using System.ClientModel.Primitives;
-using Azure.AI.Projects;
-using Azure.Identity;
-using Harness.Shared.Console;
-using HyperlightSandbox.Guest.Python;
-using Microsoft.Agents.AI;
-using Microsoft.Agents.AI.Hyperlight;
-using Microsoft.Extensions.AI;
-
-var endpoint = Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT") ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set.");
-var deploymentName = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-5.4";
-
-const int MaxContextWindowTokens = 1_050_000;
-const int MaxOutputTokens = 128_000;
-const string TracingSourceName = "Harness.CodeExecution";
-
-// Set up OpenTelemetry tracing that writes spans to a text file.
-using var tracerProvider = HarnessTracing.CreateFileTracerProvider(TracingSourceName);
-
-// Create the HyperlightCodeActProvider with the Python/Wasm backend.
-// The guest module path is resolved automatically from the Hyperlight.HyperlightSandbox.Guest.Python NuGet package.
-using var codeAct = new HyperlightCodeActProvider(
-    HyperlightCodeActProviderOptions.CreateForWasm(PythonGuestModule.GetModulePath()));
-
-var instructions =
-    """
-    ## Technical Assistant Instructions
-
-    You are a code-powered technical assistant. You can execute Python code in a sandboxed environment
-    to solve problems precisely rather than guessing. You also have access to skills that provide
-    structured workflows for specific technical tasks.
-
-    ### Code Execution
-
-    When a problem requires computation, validation, or testing:
-    - Write Python code and use `execute_code` to run it in the sandbox.
-    - Always verify results by running the code rather than reasoning about what would happen.
-    - If code fails, read the error message carefully, fix the issue, and retry.
-
-    ### Skills
-
-    You have access to discoverable skills. When a task matches a skill's description:
-    - Follow the skill's instructions carefully.
-    - Use the skill's reference materials for context.
-    - Combine the skill's workflow with code execution when appropriate.
-
-    ### Planning and Research
-
-    For complex tasks:
-    - Break the problem into steps using your todo list.
-    - Research background information using web search when needed.
-    - Save important findings to file memory for later reference.
-
-    ### Presenting Results
-
-    - Show your work: include the code you ran and its output.
-    - Explain what each part of your solution does.
-    - If applicable, save final results to file memory.
-    """;
-
-// Create the agent with ALL HarnessAgent features enabled plus Hyperlight CodeAct.
-// No Disable* flags are set — TodoProvider, AgentModeProvider, FileMemory, FileAccess,
-// ToolApproval, WebSearch, and AgentSkillsProvider are all active.
-AIAgent agent =
-    new AIProjectClient(
-        new Uri(endpoint),
-        new DefaultAzureCredential(),
-        new AIProjectClientOptions { RetryPolicy = new ClientRetryPolicy(3) })
-    .GetProjectOpenAIClient()
-    .GetResponsesClient()
-    .AsIChatClient(deploymentName)
-    .AsHarnessAgent(MaxContextWindowTokens, MaxOutputTokens, new HarnessAgentOptions
-    {
-        Name = "CodeExecutionAgent",
-        Description = "A technical assistant with sandboxed code execution and skill-based workflows.",
-        OpenTelemetrySourceName = TracingSourceName,
-        // Point the file memory at a local folder for persistent memory across sessions.
-        FileMemoryStore = new FileSystemAgentFileStore(Path.Combine(AppContext.BaseDirectory, "agent-files")),
-        // Add the HyperlightCodeActProvider so the agent can execute Python code in a sandbox.
-        AIContextProviders = [codeAct],
-        ChatOptions = new ChatOptions
-        {
-            Instructions = instructions,
-            MaxOutputTokens = MaxOutputTokens,
-            Reasoning = new() { Effort = ReasoningEffort.Medium },
-        },
-    });
-
-// Run the interactive console session using the shared HarnessConsole helper.
-await HarnessConsole.RunAgentAsync(
-    agent,
-    userPrompt: "Ask me a technical question, or try: \"Help me write a regex that matches valid email addresses.\"",
-    new HarnessConsoleOptions
-    {
-        Observers = HarnessConsoleOptions.BuildObserversWithPlanning(
-            agent,
-            planModeName: "plan",
-            executionModeName: "execute",
-            maxContextWindowTokens: MaxContextWindowTokens,
-            maxOutputTokens: MaxOutputTokens),
-        CommandHandlers = HarnessConsoleOptions.BuildDefaultCommandHandlers(agent),
-    });
@@ -1,51 +0,0 @@
-# Harness Step 04 — Code Execution (Hyperlight + Skills)
-
-This sample demonstrates a HarnessAgent with **all features enabled**, plus:
-
- **Hyperlight CodeAct** — sandboxed Python code execution via `execute_code` (requires KVM)
- **Skills** — file-based skill discovery (a `regex-tester` skill is included)
-
-The agent can plan tasks, manage modes, store memories, read/write files, search the web, approve sensitive operations, discover and use skills, and execute arbitrary Python code — all pre-configured by the HarnessAgent.
-
-## Prerequisites
-
- .NET 10 SDK
- An Azure AI Foundry project endpoint
- KVM-capable host (the Hyperlight sandbox runs code in micro-VMs)
-
-## Environment Variables
-
-| Variable | Description |
-|----------|-------------|
-| `AZURE_AI_PROJECT_ENDPOINT` | Your Azure AI Foundry project endpoint |
-| `AZURE_AI_MODEL_DEPLOYMENT_NAME` | Model deployment name (default: `gpt-5.4`) |
-
-## Running
-
-```bash
-dotnet run
-```
-
-## What to Try
-
- **Regex testing**: "Help me write a regex that matches valid email addresses, then test it against some examples."
- **Code execution**: "Calculate the first 20 prime numbers using the Sieve of Eratosthenes."
- **Skill + code combo**: "I need a regex for ISO 8601 dates — test it thoroughly with edge cases."
-
-## Included Skill
-
-The `skills/regex-tester/` skill instructs the agent to validate regex patterns by executing Python test code in the Hyperlight sandbox. It includes a regex cheatsheet as reference material.
-
-## Features Enabled
-
-| Feature | Description |
-|---------|-------------|
-| TodoProvider | Task planning and tracking (`/todos` command) |
-| AgentModeProvider | Mode switching (`/mode` command) |
-| FileMemoryProvider | Persistent memory stored as files |
-| FileAccessProvider | Read/write files in a working directory |
-| ToolApproval | Don't-ask-again approval for sensitive tools |
-| WebSearch | Built-in hosted web search |
-| AgentSkillsProvider | Discovers and uses skills from the `skills/` folder |
-| HyperlightCodeActProvider | Sandboxed Python execution via `execute_code` |
-| OpenTelemetry | Trace logging to a text file |
@@ -1,36 +0,0 @@
---
-name: regex-tester
-description: Validate, test, and debug regular expressions by executing them against sample inputs. Use when asked to build, verify, or explain a regex pattern.
---
-
-## Usage
-
-When the user asks you to create, validate, or debug a regular expression:
-
-1. **Understand the requirement** — clarify what the pattern should match and what it should reject.
-2. **Consult the cheatsheet** — review `references/regex-cheatsheet.md` for syntax reminders if needed.
-3. **Write and execute test code** — use the `execute_code` tool to run Python code that:
-   - Compiles the regex with `re.compile()`
-   - Tests it against a set of positive examples (should match) and negative examples (should not match)
-   - Extracts and displays any capturing groups
-   - Reports pass/fail for each test case
-4. **Iterate** — if any test fails, refine the pattern and re-run until all cases pass.
-5. **Present the result** — give the user the final pattern, explain what each part does, and show the test results.
-
-## Example Test Script
-
-```python
-import re
-
-pattern = re.compile(r'^[\w.+-]+@[\w-]+\.[\w.-]+$')
-
-positives = ["user@example.com", "first.last+tag@sub.domain.org"]
-negatives = ["@missing.com", "no-at-sign", "spaces in@address.com"]
-
-for s in positives:
-    assert pattern.match(s), f"FAIL: expected match for '{s}'"
-for s in negatives:
-    assert not pattern.match(s), f"FAIL: expected no match for '{s}'"
-
-print("All tests passed!")
-```
@@ -1,97 +0,0 @@
-# Regex Quick Reference (Python `re` module)
-
-## Character Classes
-
-| Pattern | Matches |
-|---------|---------|
-| `.`     | Any character except newline |
-| `\d`    | Digit `[0-9]` |
-| `\D`    | Non-digit |
-| `\w`    | Word character `[a-zA-Z0-9_]` |
-| `\W`    | Non-word character |
-| `\s`    | Whitespace `[ \t\n\r\f\v]` |
-| `\S`    | Non-whitespace |
-| `[abc]` | Any of a, b, or c |
-| `[^abc]`| Any character except a, b, c |
-| `[a-z]` | Range: a through z |
-
-## Quantifiers
-
-| Pattern | Meaning |
-|---------|---------|
-| `*`     | 0 or more (greedy) |
-| `+`     | 1 or more (greedy) |
-| `?`     | 0 or 1 (greedy) |
-| `{n}`   | Exactly n |
-| `{n,}`  | n or more |
-| `{n,m}` | Between n and m |
-| `*?`, `+?`, `??` | Non-greedy versions |
-
-## Anchors
-
-| Pattern | Meaning |
-|---------|---------|
-| `^`     | Start of string (or line with `re.MULTILINE`) |
-| `$`     | End of string (or line with `re.MULTILINE`) |
-| `\b`    | Word boundary |
-| `\B`    | Non-word boundary |
-
-## Groups and Backreferences
-
-| Pattern | Meaning |
-|---------|---------|
-| `(...)` | Capturing group |
-| `(?:...)`| Non-capturing group |
-| `(?P<name>...)` | Named group |
-| `\1`    | Backreference to group 1 |
-| `(?=...)` | Positive lookahead |
-| `(?!...)` | Negative lookahead |
-| `(?<=...)` | Positive lookbehind |
-| `(?<!...)` | Negative lookbehind |
-
-## Flags
-
-| Flag | Effect |
-|------|--------|
-| `re.IGNORECASE` / `re.I` | Case-insensitive matching |
-| `re.MULTILINE` / `re.M`  | `^`/`$` match line boundaries |
-| `re.DOTALL` / `re.S`     | `.` matches newline |
-| `re.VERBOSE` / `re.X`    | Allow comments and whitespace |
-
-## Common Patterns
-
-| Use Case | Pattern |
-|----------|---------|
-| Email (simple) | `^[\w.+-]+@[\w-]+\.[\w.-]+$` |
-| IPv4 address | `^\d{1,3}(\.\d{1,3}){3}$` |
-| ISO date | `^\d{4}-\d{2}-\d{2}$` |
-| URL (http/https) | `^https?://[^\s/$.?#].[^\s]*$` |
-| Phone (US) | `^(\+1)?[-.\s]?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}$` |
-
-## Python API
-
-```python
-import re
-
-# Test if a string matches
-re.match(r'pattern', "string")       # match at start
-re.search(r'pattern', "string")      # match anywhere
-re.fullmatch(r'pattern', "string")   # match entire string
-
-# Find all matches
-re.findall(r'\d+', "abc 123 def 456")  # ['123', '456']
-
-# Named groups
-m = re.match(r'(?P<year>\d{4})-(?P<month>\d{2})-(?P<day>\d{2})', "2025-01-15")
-m.group('year')   # '2025'
-
-# Replace
-re.sub(r'\d+', 'X', "abc 123 def")   # 'abc X def'
-
-# Split
-re.split(r',+', "a,b,,c")            # ['a', 'b', 'c']
-
-# Compile for reuse
-pattern = re.compile(r'^\d{4}-\d{2}-\d{2}$')
-pattern.match("2025-01-15")           # Match object
-```
@@ -7,5 +7,5 @@ Samples demonstrating the [Harness AIContextProviders](../../../src/Microsoft.Ag
 | Sample | Description |
 | --- | --- |
 | [Harness_Step01_Research](./Harness_Step01_Research/README.md) | Using a ChatClientAgent with TodoProvider and AgentModeProvider for research, showcasing planning mode and todo management |
-| [Harness_Step02_Research_WithBackgroundAgents](./Harness_Step02_Research_WithBackgroundAgents/README.md) | Using BackgroundAgentsProvider to delegate stock price lookups to a web-search background agent concurrently |
+| [Harness_Step02_Research_WithSubAgents](./Harness_Step02_Research_WithSubAgents/README.md) | Using SubAgentsProvider to delegate stock price lookups to a web-search sub-agent concurrently |
 | [Harness_Step03_DataProcessing](./Harness_Step03_DataProcessing/README.md) | Using FileAccessProvider to give an agent access to CSV data files for reading, analysis, and output generation |
@@ -11,7 +11,7 @@
  </PropertyGroup>

  <ItemGroup>
-    <PackageReference Include="Azure.AI.Projects" />
+    <PackageReference Include="Azure.AI.Projects" VersionOverride="2.1.0-beta.1" />
    <PackageReference Include="Azure.Identity" />
    <PackageReference Include="Azure.Search.Documents" />
    <PackageReference Include="DotNetEnv" />
@@ -22,7 +22,6 @@
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry.Hosting\Microsoft.Agents.AI.Foundry.Hosting.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.OpenAI\Microsoft.Agents.AI.OpenAI.csproj" />
-    <ProjectReference Include="..\Hosted_Shared_Contributor_Setup\Hosted_Shared_Contributor_Setup.csproj" />
  </ItemGroup>

  <!-- For end-users: uncomment the PackageReference below and remove the ProjectReferences above
@@ -14,7 +14,6 @@ using Azure.Identity;
 using Azure.Search.Documents;
 using Azure.Search.Documents.Models;
 using DotNetEnv;
-using Hosted_Shared_Contributor_Setup;
 using Microsoft.Agents.AI;
 using Microsoft.Agents.AI.Foundry.Hosting;
 using Microsoft.Extensions.AI;
@@ -67,15 +66,14 @@ AIAgent agent = new AIProjectClient(new Uri(projectEndpoint), credential)
 // Host the agent as a Foundry Hosted Agent using the Responses API.
 var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddFoundryResponses(agent);
-builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debugging only - must not be used in production.

 var app = builder.Build();
 app.MapFoundryResponses();

-// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
-// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
-// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
-app.MapDevTemporaryLocalAgentEndpoint();
+if (app.Environment.IsDevelopment())
+{
+    app.MapFoundryResponses("openai/v1");
+}

 app.Run();

@@ -18,7 +18,6 @@
  <ItemGroup>
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry.Hosting\Microsoft.Agents.AI.Foundry.Hosting.csproj" />
-    <ProjectReference Include="..\Hosted_Shared_Contributor_Setup\Hosted_Shared_Contributor_Setup.csproj" />
  </ItemGroup>

  <!-- For end-users: uncomment the PackageReference below and remove the ProjectReference above
@@ -4,7 +4,6 @@ using Azure.AI.Projects;
 using Azure.Core;
 using Azure.Identity;
 using DotNetEnv;
-using Hosted_Shared_Contributor_Setup;
 using Microsoft.Agents.AI;
 using Microsoft.Agents.AI.Foundry.Hosting;

@@ -41,14 +40,59 @@ AIAgent agent = new AIProjectClient(projectEndpoint, credential)
 // Host the agent as a Foundry Hosted Agent using the Responses API.
 var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddFoundryResponses(agent);
-builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debugging only - must not be used in production.

 var app = builder.Build();
 app.MapFoundryResponses();

-// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
-// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
-// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
-app.MapDevTemporaryLocalAgentEndpoint();
+// In Development, also map the OpenAI-compatible route that AIProjectClient uses.
+if (app.Environment.IsDevelopment())
+{
+    app.MapFoundryResponses("openai/v1");
+}

 app.Run();
+
+/// <summary>
+/// A <see cref="TokenCredential"/> for local Docker debugging only.
+///
+/// When debugging and testing a hosted agent in a local Docker container, Azure CLI
+/// and other interactive credentials are not available. This credential reads a
+/// pre-fetched bearer token from the <c>AZURE_BEARER_TOKEN</c> environment variable.
+///
+/// This should NOT be used in production — tokens expire (~1 hour) and cannot be refreshed.
+/// In production, the Foundry platform injects a managed identity automatically.
+///
+/// Generate a token on your host and pass it to the container:
+///   export AZURE_BEARER_TOKEN=$(az account get-access-token --resource https://ai.azure.com --query accessToken -o tsv)
+///   docker run -e AZURE_BEARER_TOKEN=$AZURE_BEARER_TOKEN ...
+/// </summary>
+internal sealed class DevTemporaryTokenCredential : TokenCredential
+{
+    private const string EnvironmentVariable = "AZURE_BEARER_TOKEN";
+    private readonly string? _token;
+
+    public DevTemporaryTokenCredential()
+    {
+        this._token = Environment.GetEnvironmentVariable(EnvironmentVariable);
+    }
+
+    public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
+    {
+        return this.GetAccessToken();
+    }
+
+    public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
+    {
+        return new ValueTask<AccessToken>(this.GetAccessToken());
+    }
+
+    private AccessToken GetAccessToken()
+    {
+        if (string.IsNullOrEmpty(this._token) || this._token == "DefaultAzureCredential")
+        {
+            throw new CredentialUnavailableException($"{EnvironmentVariable} environment variable is not set.");
+        }
+
+        return new AccessToken(this._token, DateTimeOffset.UtcNow.AddHours(1));
+    }
+}
@@ -1,4 +1,4 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
+<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFrameworks>net10.0</TargetFrameworks>
@@ -11,7 +11,7 @@
  </PropertyGroup>

  <ItemGroup>
-    <PackageReference Include="Azure.AI.Projects" />
+    <PackageReference Include="Azure.AI.Projects" VersionOverride="2.1.0-beta.1" />
    <PackageReference Include="Azure.Identity" />
    <PackageReference Include="DotNetEnv" />
  </ItemGroup>
@@ -28,7 +28,6 @@
  <ItemGroup>
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry.Hosting\Microsoft.Agents.AI.Foundry.Hosting.csproj" />
-    <ProjectReference Include="..\Hosted_Shared_Contributor_Setup\Hosted_Shared_Contributor_Setup.csproj" />
  </ItemGroup>

  <!-- For end-users: uncomment the PackageReference below and remove the ProjectReference above
@@ -35,7 +35,6 @@ using Azure.AI.Projects;
 using Azure.Core;
 using Azure.Identity;
 using DotNetEnv;
-using Hosted_Shared_Contributor_Setup;
 using Microsoft.Agents.AI;
 using Microsoft.Agents.AI.Foundry.Hosting;
 using Microsoft.Extensions.AI;
@@ -176,15 +175,14 @@ AIAgent agent = new AIProjectClient(new Uri(endpoint), credential)

 var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddFoundryResponses(agent);
-builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debugging only - must not be used in production.

 var app = builder.Build();
 app.MapFoundryResponses();

-// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
-// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
-// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
-app.MapDevTemporaryLocalAgentEndpoint();
+if (app.Environment.IsDevelopment())
+{
+    app.MapFoundryResponses("openai/v1");
+}

 app.Run();

@@ -18,7 +18,6 @@
  <ItemGroup>
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry.Hosting\Microsoft.Agents.AI.Foundry.Hosting.csproj" />
-    <ProjectReference Include="..\Hosted_Shared_Contributor_Setup\Hosted_Shared_Contributor_Setup.csproj" />
  </ItemGroup>

  <!-- For end-users: uncomment the PackageReference below and remove the ProjectReference above
@@ -5,7 +5,6 @@ using Azure.AI.Projects.Agents;
 using Azure.Core;
 using Azure.Identity;
 using DotNetEnv;
-using Hosted_Shared_Contributor_Setup;
 using Microsoft.Agents.AI.Foundry;
 using Microsoft.Agents.AI.Foundry.Hosting;

@@ -34,14 +33,59 @@ FoundryAgent agent = aiProjectClient.AsAIAgent(agentRecord);
 // Host the agent as a Foundry Hosted Agent using the Responses API.
 var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddFoundryResponses(agent);
-builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debugging only - must not be used in production.

 var app = builder.Build();
 app.MapFoundryResponses();

-// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
-// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
-// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
-app.MapDevTemporaryLocalAgentEndpoint();
+// In Development, also map the OpenAI-compatible route that AIProjectClient uses.
+if (app.Environment.IsDevelopment())
+{
+    app.MapFoundryResponses("openai/v1");
+}

 app.Run();
+
+/// <summary>
+/// A <see cref="TokenCredential"/> for local Docker debugging only.
+///
+/// When debugging and testing a hosted agent in a local Docker container, Azure CLI
+/// and other interactive credentials are not available. This credential reads a
+/// pre-fetched bearer token from the <c>AZURE_BEARER_TOKEN</c> environment variable.
+///
+/// This should NOT be used in production — tokens expire (~1 hour) and cannot be refreshed.
+/// In production, the Foundry platform injects a managed identity automatically.
+///
+/// Generate a token on your host and pass it to the container:
+///   export AZURE_BEARER_TOKEN=$(az account get-access-token --resource https://ai.azure.com --query accessToken -o tsv)
+///   docker run -e AZURE_BEARER_TOKEN=$AZURE_BEARER_TOKEN ...
+/// </summary>
+internal sealed class DevTemporaryTokenCredential : TokenCredential
+{
+    private const string EnvironmentVariable = "AZURE_BEARER_TOKEN";
+    private readonly string? _token;
+
+    public DevTemporaryTokenCredential()
+    {
+        this._token = Environment.GetEnvironmentVariable(EnvironmentVariable);
+    }
+
+    public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
+    {
+        return this.GetAccessToken();
+    }
+
+    public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
+    {
+        return new ValueTask<AccessToken>(this.GetAccessToken());
+    }
+
+    private AccessToken GetAccessToken()
+    {
+        if (string.IsNullOrEmpty(this._token) || this._token == "DefaultAzureCredential")
+        {
+            throw new CredentialUnavailableException($"{EnvironmentVariable} environment variable is not set.");
+        }
+
+        return new AccessToken(this._token, DateTimeOffset.UtcNow.AddHours(1));
+    }
+}
@@ -20,7 +20,6 @@
  <ItemGroup>
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry.Hosting\Microsoft.Agents.AI.Foundry.Hosting.csproj" />
-    <ProjectReference Include="..\Hosted_Shared_Contributor_Setup\Hosted_Shared_Contributor_Setup.csproj" />
  </ItemGroup>

  <!-- For end-users: uncomment the PackageReference below and remove the ProjectReference above
@@ -11,7 +11,6 @@ using Azure.AI.Projects;
 using Azure.Core;
 using Azure.Identity;
 using DotNetEnv;
-using Hosted_Shared_Contributor_Setup;
 using Microsoft.Agents.AI;
 using Microsoft.Agents.AI.Foundry.Hosting;
 using Microsoft.Extensions.AI;
@@ -113,18 +112,53 @@ AIAgent agent = new AIProjectClient(new Uri(endpoint), credential)

 var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddFoundryResponses(agent);
-builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debugging only - must not be used in production.

 var app = builder.Build();
 app.MapFoundryResponses();

-// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
-// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
-// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
-app.MapDevTemporaryLocalAgentEndpoint();
+if (app.Environment.IsDevelopment())
+{
+    app.MapFoundryResponses("openai/v1");
+}

 app.Run();

 // ── Types ────────────────────────────────────────────────────────────────────

 internal sealed record Hotel(string Name, int PricePerNight, double Rating, string Location);
+
+/// <summary>
+/// A <see cref="TokenCredential"/> for local Docker debugging only.
+/// Reads a pre-fetched bearer token from the <c>AZURE_BEARER_TOKEN</c> environment variable
+/// once at startup. This should NOT be used in production.
+///
+/// Generate a token on your host and pass it to the container:
+///   export AZURE_BEARER_TOKEN=$(az account get-access-token --resource https://ai.azure.com --query accessToken -o tsv)
+///   docker run -e AZURE_BEARER_TOKEN=$AZURE_BEARER_TOKEN ...
+/// </summary>
+internal sealed class DevTemporaryTokenCredential : TokenCredential
+{
+    private const string EnvironmentVariable = "AZURE_BEARER_TOKEN";
+    private readonly string? _token;
+
+    public DevTemporaryTokenCredential()
+    {
+        this._token = Environment.GetEnvironmentVariable(EnvironmentVariable);
+    }
+
+    public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
+        => this.GetAccessToken();
+
+    public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
+        => new(this.GetAccessToken());
+
+    private AccessToken GetAccessToken()
+    {
+        if (string.IsNullOrEmpty(this._token) || this._token == "DefaultAzureCredential")
+        {
+            throw new CredentialUnavailableException($"{EnvironmentVariable} environment variable is not set.");
+        }
+
+        return new AccessToken(this._token, DateTimeOffset.UtcNow.AddHours(1));
+    }
+}
@@ -21,7 +21,6 @@
  <ItemGroup>
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry.Hosting\Microsoft.Agents.AI.Foundry.Hosting.csproj" />
-    <ProjectReference Include="..\Hosted_Shared_Contributor_Setup\Hosted_Shared_Contributor_Setup.csproj" />
  </ItemGroup>

  <!-- For end-users: uncomment the PackageReference below and remove the ProjectReference above
@@ -19,7 +19,6 @@ using Azure.AI.Projects;
 using Azure.Core;
 using Azure.Identity;
 using DotNetEnv;
-using Hosted_Shared_Contributor_Setup;
 using Microsoft.Agents.AI;
 using Microsoft.Agents.AI.Foundry.Hosting;
 using Microsoft.Extensions.AI;
@@ -82,14 +81,50 @@ AIAgent agent = new AIProjectClient(projectEndpoint, credential)
 // Host the agent as a Foundry Hosted Agent using the Responses API.
 var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddFoundryResponses(agent);
-builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debugging only - must not be used in production.

 var app = builder.Build();
 app.MapFoundryResponses();

-// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
-// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
-// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
-app.MapDevTemporaryLocalAgentEndpoint();
+// In Development, also map the OpenAI-compatible route that AIProjectClient uses.
+if (app.Environment.IsDevelopment())
+{
+    app.MapFoundryResponses("openai/v1");
+}

 app.Run();
+
+/// <summary>
+/// A <see cref="TokenCredential"/> for local Docker debugging only.
+/// Reads a pre-fetched bearer token from the <c>AZURE_BEARER_TOKEN</c> environment variable
+/// once at startup. This should NOT be used in production.
+///
+/// Generate a token on your host and pass it to the container:
+///   export AZURE_BEARER_TOKEN=$(az account get-access-token --resource https://ai.azure.com --query accessToken -o tsv)
+///   docker run -e AZURE_BEARER_TOKEN=$AZURE_BEARER_TOKEN ...
+/// </summary>
+internal sealed class DevTemporaryTokenCredential : TokenCredential
+{
+    private const string EnvironmentVariable = "AZURE_BEARER_TOKEN";
+    private readonly string? _token;
+
+    public DevTemporaryTokenCredential()
+    {
+        this._token = Environment.GetEnvironmentVariable(EnvironmentVariable);
+    }
+
+    public override AccessToken GetToken(TokenRequestContext requestContext, CancellationToken cancellationToken)
+        => this.GetAccessToken();
+
+    public override ValueTask<AccessToken> GetTokenAsync(TokenRequestContext requestContext, CancellationToken cancellationToken)
+        => new(this.GetAccessToken());
+
+    private AccessToken GetAccessToken()
+    {
+        if (string.IsNullOrEmpty(this._token) || this._token == "DefaultAzureCredential")
+        {
+            throw new CredentialUnavailableException($"{EnvironmentVariable} environment variable is not set.");
+        }
+
+        return new AccessToken(this._token, DateTimeOffset.UtcNow.AddHours(1));
+    }
+}
@@ -1,12 +0,0 @@
-AZURE_AI_PROJECT_ENDPOINT=<your-azure-ai-project-endpoint>
-ASPNETCORE_URLS=http://+:8088
-ASPNETCORE_ENVIRONMENT=Development
-AZURE_AI_MODEL_DEPLOYMENT_NAME=gpt-4o
-AZURE_AI_EMBEDDING_DEPLOYMENT_NAME=text-embedding-ada-002
-AZURE_AI_MEMORY_STORE_ID=hosted-memory-sample
-AGENT_NAME=hosted-memory-agent
-AZURE_BEARER_TOKEN=DefaultAzureCredential
-# When running outside the Foundry platform the platform-injected isolation keys are absent.
-# These two variables provide fallback values for local Docker debugging only.
-HOSTED_USER_ISOLATION_KEY=local-dev-user
-HOSTED_CHAT_ISOLATION_KEY=local-dev-chat
@@ -1,26 +0,0 @@
-# Dockerfile for end-users consuming the Agent Framework via NuGet packages.
-#
-# This Dockerfile performs a full `dotnet restore` and `dotnet publish` inside the container,
-# which only succeeds when the project references its dependencies via PackageReference (see the
-# commented-out section in HostedMemoryAgent.csproj). Contributors building from the
-# agent-framework repository source must use Dockerfile.contributor instead because
-# ProjectReference dependencies live outside this folder and cannot be restored from inside
-# this build context.
-#
-# Use the official .NET 10.0 ASP.NET runtime as a parent image
-FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS base
-WORKDIR /app
-
-FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
-WORKDIR /src
-COPY . .
-RUN dotnet restore
-RUN dotnet publish -c Release -o /app/publish
-
-# Final stage
-FROM base AS final
-WORKDIR /app
-COPY --from=build /app/publish .
-EXPOSE 8088
-ENV ASPNETCORE_URLS=http://+:8088
-ENTRYPOINT ["dotnet", "HostedMemoryAgent.dll"]
@@ -1,23 +0,0 @@
-# Dockerfile for contributors building from the agent-framework repository source.
-#
-# This project uses ProjectReference to the local Microsoft.Agents.AI.Foundry source,
-# which means a standard multi-stage Docker build cannot resolve dependencies outside
-# this folder. Instead, pre-publish the app targeting the container runtime and copy
-# the output into the container:
-#
-#   dotnet publish -c Debug -f net10.0 -r linux-musl-x64 --self-contained false -o out
-#   docker build -f Dockerfile.contributor -t hosted-memory-agent .
-#   docker run --rm -p 8088:8088 \
-#     -e AGENT_NAME=hosted-memory-agent \
-#     -e HOSTED_USER_ISOLATION_KEY=alice \
-#     -e HOSTED_CHAT_ISOLATION_KEY=alice-chat-1 \
-#     --env-file .env hosted-memory-agent
-#
-# For end-users consuming the NuGet package (not ProjectReference), use the standard
-# Dockerfile which performs a full dotnet restore + publish inside the container.
-FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine AS final
-WORKDIR /app
-COPY out/ .
-EXPOSE 8088
-ENV ASPNETCORE_URLS=http://+:8088
-ENTRYPOINT ["dotnet", "HostedMemoryAgent.dll"]
@@ -1,33 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk.Web">
-
-  <PropertyGroup>
-    <TargetFrameworks>net10.0</TargetFrameworks>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
-    <RootNamespace>HostedMemoryAgent</RootNamespace>
-    <AssemblyName>HostedMemoryAgent</AssemblyName>
-    <NoWarn>$(NoWarn);MEAI001;OPENAI001</NoWarn>
-  </PropertyGroup>
-
-  <ItemGroup>
-    <PackageReference Include="Azure.AI.Projects" />
-    <PackageReference Include="Azure.Identity" />
-    <PackageReference Include="DotNetEnv" />
-  </ItemGroup>
-
-  <!-- For contributors: uses ProjectReference to build against local source -->
-  <ItemGroup>
-    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry\Microsoft.Agents.AI.Foundry.csproj" />
-    <ProjectReference Include="..\..\..\..\..\src\Microsoft.Agents.AI.Foundry.Hosting\Microsoft.Agents.AI.Foundry.Hosting.csproj" />
-    <ProjectReference Include="..\Hosted_Shared_Contributor_Setup\Hosted_Shared_Contributor_Setup.csproj" />
-  </ItemGroup>
-
-  <!-- For end-users: uncomment the PackageReference below and remove the ProjectReferences above
-  <ItemGroup>
-    <PackageReference Include="Microsoft.Agents.AI.Foundry" Version="1.0.0" />
-    <PackageReference Include="Microsoft.Agents.AI.Foundry.Hosting" Version="1.0.0" />
-  </ItemGroup>
-  -->
-
-</Project>
@@ -1,87 +0,0 @@
-// Copyright (c) Microsoft. All rights reserved.
-
-// Hosted-MemoryAgent
-//
-// Demonstrates how to host an agent that uses FoundryMemoryProvider so that user-private memories
-// persist across requests and across sessions, scoped per user via the Foundry platform's
-// isolation key headers.
-//
-// Memory scope flows from request -> hosting layer -> session -> provider:
-//   1. Foundry sets x-agent-user-isolation-key on every inbound request.
-//   2. AgentFrameworkResponseHandler reads context.Isolation.UserIsolationKey via the registered
-//      HostedSessionIsolationKeyProvider and stores it on the session as a HostedSessionContext.
-//   3. FoundryMemoryProvider's stateInitializer reads HostedSessionContext.UserId and uses it as
-//      the FoundryMemoryProviderScope, partitioning memories per user.
-
-using Azure.AI.Projects;
-using Azure.Core;
-using Azure.Identity;
-using DotNetEnv;
-using Hosted_Shared_Contributor_Setup;
-using Microsoft.Agents.AI;
-using Microsoft.Agents.AI.Foundry;
-using Microsoft.Agents.AI.Foundry.Hosting;
-using Microsoft.Extensions.AI;
-
-// Load .env file if present (for local development).
-Env.TraversePath().Load();
-
-var projectEndpoint = new Uri(Environment.GetEnvironmentVariable("AZURE_AI_PROJECT_ENDPOINT")
-    ?? throw new InvalidOperationException("AZURE_AI_PROJECT_ENDPOINT is not set."));
-var agentName = Environment.GetEnvironmentVariable("AGENT_NAME")
-    ?? throw new InvalidOperationException("AGENT_NAME is not set.");
-var deployment = Environment.GetEnvironmentVariable("AZURE_AI_MODEL_DEPLOYMENT_NAME") ?? "gpt-4o";
-var embeddingDeployment = Environment.GetEnvironmentVariable("AZURE_AI_EMBEDDING_DEPLOYMENT_NAME") ?? "text-embedding-ada-002";
-var memoryStoreName = Environment.GetEnvironmentVariable("AZURE_AI_MEMORY_STORE_ID") ?? "hosted-memory-sample";
-
-// Use a chained credential: try a temporary dev token first (for local Docker debugging),
-// then fall back to DefaultAzureCredential (for local dev via dotnet run / managed identity in foundry).
-TokenCredential credential = new ChainedTokenCredential(
-    new DevTemporaryTokenCredential(),
-    new DefaultAzureCredential());
-
-AIProjectClient projectClient = new(projectEndpoint, credential);
-
-// FoundryMemoryProvider partitions memories per end user via a built-in HostedFoundryMemoryProviderScopes
-// helper that reads the platform-injected user isolation key from the HostedSessionContext that the
-// hosting layer placed on the session.
-FoundryMemoryProvider memoryProvider = new(
-    projectClient,
-    memoryStoreName,
-    stateInitializer: HostedFoundryMemoryProviderScopes.PerUser());
-
-// Provision the memory store on startup if it does not already exist. EnsureMemoryStoreCreatedAsync
-// is idempotent. Doing this once at start avoids per-request latency.
-await memoryProvider.EnsureMemoryStoreCreatedAsync(deployment, embeddingDeployment, "Memory store for the hosted travel-assistant sample.");
-
-const string AgentInstructions = """
-    You are a friendly travel assistant. When the user shares trip preferences, destinations,
-    travel companions, or constraints, remember them and use them in later turns. Use known
-    memories about the user when responding, and do not invent details.
-    """;
-
-ChatClientAgent agent = projectClient.AsAIAgent(new ChatClientAgentOptions()
-{
-    Name = agentName,
-    ChatOptions = new ChatOptions
-    {
-        ModelId = deployment,
-        Instructions = AgentInstructions
-    },
-    AIContextProviders = [memoryProvider]
-});
-
-// Host the agent as a Foundry Hosted Agent using the Responses API.
-var builder = WebApplication.CreateBuilder(args);
-builder.Services.AddFoundryResponses(agent);
-builder.Services.AddDevTemporaryLocalContributorSetup(); // Local Docker debugging only - must not be used in production.
-
-var app = builder.Build();
-app.MapFoundryResponses();
-
-// Contributor-only: in Development, also map the per-agent OpenAI route shape that live Foundry uses
-// so a local REPL client can target this server via AIProjectClient.AsAIAgent(Uri agentEndpoint).
-// Do not use this in production. Hosted Foundry agents only support the agent-endpoint path.
-app.MapDevTemporaryLocalAgentEndpoint();
-
-app.Run();
@@ -1,155 +0,0 @@
-# Hosted-MemoryAgent
-
-A hosted Foundry agent that uses **FoundryMemoryProvider** to remember user-private details across
-requests and across sessions, scoped per end user via the Foundry platform's isolation keys. The
-agent plays a friendly travel assistant: tell it about your trip, ask follow-up questions in a new
-session, and it recalls what it learned about you.
-
-This sample exists to demonstrate two things together:
-
-1. How to host an agent that consumes a `Microsoft.Extensions.AI.AIContextProvider` (specifically
-   `FoundryMemoryProvider`) under the Foundry Responses hosting layer.
-2. How the new `HostedSessionContext` flows from the `Foundry` platform isolation headers
-   (`x-agent-user-isolation-key`, `x-agent-chat-isolation-key`) through the
-   `HostedSessionIsolationKeyProvider` into the provider's `stateInitializer`, so memories are
-   partitioned per user automatically.
-
-## Prerequisites
-
- [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet/10.0)
- An Azure AI Foundry project with at least one chat model deployment and one embedding model deployment
- Azure CLI logged in (`az login`)
-
-## Configuration
-
-Copy the template and fill in your values:
-
-```bash
-cp .env.example .env
-```
-
-Required:
-
-```env
-AZURE_AI_PROJECT_ENDPOINT=https://<account>.services.ai.azure.com/api/projects/<project>
-AZURE_AI_MODEL_DEPLOYMENT_NAME=gpt-4o
-AZURE_AI_EMBEDDING_DEPLOYMENT_NAME=text-embedding-ada-002
-AZURE_AI_MEMORY_STORE_ID=hosted-memory-sample
-AGENT_NAME=hosted-memory-agent
-ASPNETCORE_URLS=http://+:8088
-ASPNETCORE_ENVIRONMENT=Development
-```
-
-For local container runs only (the platform supplies these in production):
-
-```env
-HOSTED_USER_ISOLATION_KEY=alice
-HOSTED_CHAT_ISOLATION_KEY=alice-chat-1
-```
-
-> `.env` is gitignored. The `.env.example` template is checked in as a reference.
-
-## How memory scoping works
-
-| Layer | Source of the user identity |
-|---|---|
-| Inbound request | The Foundry platform sets `x-agent-user-isolation-key` and `x-agent-chat-isolation-key` headers on every request. |
-| Hosting layer | `AgentFrameworkResponseHandler` resolves a `HostedSessionIsolationKeyProvider` from DI and calls `GetKeysAsync(context, request, ct)`. The default implementation reads `context.Isolation.UserIsolationKey` and `context.Isolation.ChatIsolationKey`. |
-| Session | The handler stores the resolved values on the session as a `HostedSessionContext` on the first request, and validates the values on every subsequent request that resumes the same conversation (mismatch returns 403). |
-| Memory provider | The sample's `stateInitializer` reads `session.GetHostedContext().UserId` and uses it as the `FoundryMemoryProviderScope`. Memories are partitioned per user. |
-
-When running outside the Foundry platform the headers are absent. The sample registers
-`DevTemporaryLocalSessionIsolationKeyProvider` (via `AddDevTemporaryLocalContributorSetup`) which
-falls back to the `HOSTED_USER_ISOLATION_KEY` and `HOSTED_CHAT_ISOLATION_KEY` environment variables,
-defaulting to a single `local-dev-*` bucket when neither is set.
-
-> **Production warning.** Never register `DevTemporaryLocalSessionIsolationKeyProvider` in
-> production. The Foundry platform sets the isolation keys for every inbound request, and
-> client-supplied environment variables can be forged.
-
-## Running directly (contributors)
-
-This project uses `ProjectReference` to build against the local Agent Framework source.
-
-```bash
-cd dotnet/samples/04-hosting/FoundryHostedAgents/responses/Hosted-MemoryAgent
-dotnet run
-```
-
-The agent starts on `http://localhost:8088`.
-
-### Test it
-
-```bash
-curl -X POST http://localhost:8088/responses \
-  -H "Content-Type: application/json" \
-  -d '{"input": "Hi! My name is Taylor and I am planning a hiking trip to Patagonia in November.", "model": "hosted-memory-agent"}'
-```
-
-Wait a few seconds for memory extraction, then ask a follow-up using the response id from the
-previous call as `previous_response_id`:
-
-```bash
-curl -X POST http://localhost:8088/responses \
-  -H "Content-Type: application/json" \
-  -d '{"input": "What do you already know about my upcoming trip?", "previous_response_id": "<id>", "model": "hosted-memory-agent"}'
-```
-
-## Running with Docker
-
-Since this project uses `ProjectReference`, the standard `Dockerfile` cannot resolve dependencies
-outside this folder. Use `Dockerfile.contributor` which takes a pre-published output.
-
-### 1. Publish for the container runtime (Linux Alpine)
-
-```bash
-dotnet publish -c Debug -f net10.0 -r linux-musl-x64 --self-contained false -o out
-```
-
-### 2. Build the Docker image
-
-```bash
-docker build -f Dockerfile.contributor -t hosted-memory-agent .
-```
-
-### 3. Run the container
-
-```bash
-export AZURE_BEARER_TOKEN=$(az account get-access-token --resource https://ai.azure.com --query accessToken -o tsv)
-
-docker run --rm -p 8088:8088 \
-  -e AGENT_NAME=hosted-memory-agent \
-  -e AZURE_BEARER_TOKEN=$AZURE_BEARER_TOKEN \
-  -e HOSTED_USER_ISOLATION_KEY=alice \
-  -e HOSTED_CHAT_ISOLATION_KEY=alice-chat-1 \
-  --env-file .env \
-  hosted-memory-agent
-```
-
-### 4. Smoke test the running container
-
-A scripted smoke test that exercises memory recall and per-user isolation across two simulated
-users is provided at `scripts/smoke.ps1`. From the sample folder:
-
-```powershell
-pwsh ./scripts/smoke.ps1
-```
-
-The script publishes the project, builds the image, runs the container with two distinct
-`HOSTED_USER_ISOLATION_KEY` values, drives a multi-turn conversation per user, asserts that each
-user only sees their own memories, and exits non-zero on failure.
-
-## NuGet package users
-
-If you are consuming the Agent Framework as a NuGet package (not building from source), use the
-standard `Dockerfile` instead of `Dockerfile.contributor`. See the commented section in
-`HostedMemoryAgent.csproj` for the `PackageReference` alternative.
-
-## How it differs from sibling samples
-
-| | Hosted-ChatClientAgent | Hosted-MemoryAgent |
-|---|---|---|
-| **Agent definition** | Inline (`AsAIAgent(model, instructions)`) | Inline, plus `AIContextProviders = [memoryProvider]` |
-| **State** | None beyond the conversation history | Per-user memories persisted in Foundry Memory |
-| **Identity** | Not used | Required: `HostedSessionContext.UserId` flows into the memory scope |
-| **Local dev** | `AddDevTemporaryLocalContributorSetup()` keeps requests succeeding when isolation headers are absent | Same; additionally honours `HOSTED_USER_ISOLATION_KEY` to simulate distinct users |
@@ -1,31 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/microsoft/AgentSchema/refs/heads/main/schemas/v1.0/AgentManifest.yaml
-name: hosted-memory-agent
-displayName: "Hosted Memory Agent"
-
-description: >
-  A travel-assistant hosted agent that uses FoundryMemoryProvider to remember user-private
-  preferences and details across sessions. Memory is scoped per end user via the Foundry
-  platform's isolation key headers.
-
-metadata:
-  tags:
-    - AI Agent Hosting
-    - Azure AI AgentServer
-    - Responses Protocol
-    - Streaming
-    - Agent Framework
-    - Memory
-    - Foundry Memory
-
-template:
-  name: hosted-memory-agent
-  kind: hosted
-  protocols:
-    - protocol: responses
-      version: 1.0.0
-  resources:
-    cpu: "0.25"
-    memory: 0.5Gi
-parameters:
-  properties: []
-resources: []
@@ -1,9 +0,0 @@
-# yaml-language-server: $schema=https://raw.githubusercontent.com/microsoft/AgentSchema/refs/heads/main/schemas/v1.0/ContainerAgent.yaml
-kind: hosted
-name: hosted-memory-agent
-protocols:
-  - protocol: responses
-    version: 1.0.0
-resources:
-  cpu: "0.25"
-  memory: 0.5Gi
@@ -1,110 +0,0 @@
-#requires -Version 7
-<#
-.SYNOPSIS
-  Local smoke test for the Hosted-MemoryAgent sample.
-.DESCRIPTION
-  Publishes the sample, builds the contributor Docker image, runs the container twice with two
-  distinct HOSTED_USER_ISOLATION_KEY values, drives a multi-turn conversation per user via curl
-  invocations, and asserts that each user only sees their own remembered details.
-  Exits non-zero on failure.
-
-  Prerequisites:
-    - Docker
-    - az login (token is fetched from the host)
-    - .env populated with AZURE_AI_PROJECT_ENDPOINT and model deployments
-.NOTES
-  This script is for local Docker debugging only. The Foundry platform supplies the isolation
-  keys for every inbound request in production and the dev fallback used here must not be
-  enabled in production deployments.
-#>
-
-[CmdletBinding()]
-param(
-    [int]$Port = 8088,
-    [string]$ImageName = 'hosted-memory-agent-smoke',
-    [int]$RecallDelaySeconds = 25
-)
-
-$ErrorActionPreference = 'Stop'
-Set-Location -Path $PSScriptRoot/..
-
-if (-not (Test-Path .env)) {
-    throw '.env not found. Copy .env.example to .env and fill in AZURE_AI_PROJECT_ENDPOINT.'
-}
-
-Write-Host '==> Publishing sample for linux-musl-x64 ...'
-dotnet publish -c Debug -f net10.0 -r linux-musl-x64 --self-contained false -o out --tl:off | Out-Host
-if ($LASTEXITCODE -ne 0) { throw 'dotnet publish failed.' }
-
-Write-Host '==> Building docker image ...'
-docker build -f Dockerfile.contributor -t $ImageName . | Out-Host
-if ($LASTEXITCODE -ne 0) { throw 'docker build failed.' }
-
-Write-Host '==> Fetching bearer token ...'
-$bearer = az account get-access-token --resource https://ai.azure.com --query accessToken -o tsv
-if (-not $bearer) { throw 'Failed to obtain bearer token. Run az login.' }
-
-function Start-Container([string]$UserKey, [string]$ChatKey, [string]$ContainerName) {
-    docker rm -f $ContainerName 2>$null | Out-Null
-    docker run -d --name $ContainerName -p ${Port}:8088 `
-        -e AGENT_NAME=hosted-memory-agent `
-        -e AZURE_BEARER_TOKEN=$bearer `
-        -e HOSTED_USER_ISOLATION_KEY=$UserKey `
-        -e HOSTED_CHAT_ISOLATION_KEY=$ChatKey `
-        --env-file .env `
-        $ImageName | Out-Host
-    if ($LASTEXITCODE -ne 0) { throw "docker run failed for $ContainerName." }
-    # Wait briefly for the listener to come up.
-    Start-Sleep -Seconds 6
-}
-
-function Invoke-Agent([string]$Prompt, [string]$PreviousResponseId = $null) {
-    $body = @{ input = $Prompt; model = 'hosted-memory-agent' }
-    if ($PreviousResponseId) { $body['previous_response_id'] = $PreviousResponseId }
-    $json = $body | ConvertTo-Json -Compress
-    $resp = Invoke-RestMethod -Method Post -Uri "http://localhost:$Port/responses" -ContentType 'application/json' -Body $json
-    return $resp
-}
-
-function Assert-Contains([string]$Haystack, [string]$Needle, [string]$Label) {
-    if ($Haystack -notmatch [regex]::Escape($Needle)) {
-        throw "FAILED [$Label]: expected response to contain '$Needle' but got: $Haystack"
-    }
-    Write-Host "PASS  [$Label]: response contains '$Needle'."
-}
-
-function Assert-NotContains([string]$Haystack, [string]$Needle, [string]$Label) {
-    if ($Haystack -match [regex]::Escape($Needle)) {
-        throw "FAILED [$Label]: response unexpectedly contains '$Needle': $Haystack"
-    }
-    Write-Host "PASS  [$Label]: response does not contain '$Needle'."
-}
-
-try {
-    Write-Host '==> Phase 1: alice teaches the agent her trip details ...'
-    Start-Container -UserKey 'alice' -ChatKey 'alice-chat-1' -ContainerName 'hosted-memory-smoke-alice'
-    $r1 = Invoke-Agent -Prompt 'Hi! My name is Taylor and I am planning a hiking trip to Patagonia in November.'
-    $r2 = Invoke-Agent -Prompt 'I am travelling with my sister and we love finding scenic viewpoints.' -PreviousResponseId $r1.id
-
-    Write-Host "==> Waiting $RecallDelaySeconds s for memory extraction ..."
-    Start-Sleep -Seconds $RecallDelaySeconds
-
-    $r3 = Invoke-Agent -Prompt 'What do you already know about my upcoming trip?' -PreviousResponseId $r2.id
-    $aliceText = ($r3.output | ForEach-Object { $_.content | ForEach-Object { $_.text } }) -join ' '
-    Assert-Contains $aliceText 'Patagonia' 'alice recall: Patagonia'
-
-    docker rm -f hosted-memory-smoke-alice | Out-Null
-
-    Write-Host '==> Phase 2: bob starts a fresh container with a different user isolation key ...'
-    Start-Container -UserKey 'bob' -ChatKey 'bob-chat-1' -ContainerName 'hosted-memory-smoke-bob'
-    $b1 = Invoke-Agent -Prompt 'Hello, what trip am I planning?'
-    $bobText = ($b1.output | ForEach-Object { $_.content | ForEach-Object { $_.text } }) -join ' '
-    Assert-NotContains $bobText 'Patagonia' 'bob isolation: no leak of alice memories'
-
-    Write-Host ''
-    Write-Host '==> All smoke assertions passed.'
-}
-finally {
-    docker rm -f hosted-memory-smoke-alice 2>$null | Out-Null
-    docker rm -f hosted-memory-smoke-bob 2>$null | Out-Null
-}
@@ -1,6 +1,7 @@
 .env
 bin/
 obj/
+out/
 .vs/
 .vscode/
 *.user
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Peter Ibekwe	3f51100b2f	Addressed additional properties metadata in the conversion fallback.	2026-05-15 12:38:49 -07:00
Peter Ibekwe	8b1028e5d8	Delegate MCP ContentBlock to AIContent conversion to the MCP SDK	2026-05-15 11:45:12 -07:00
Peter Ibekwe	ce53cd53b8	Merge branch 'main' into peibekwe/declarative-toolbox	2026-05-14 10:19:00 -07:00
Peter Ibekwe	3f971550bd	Addressed initial PR comments.	2026-05-13 15:34:27 -07:00
Peter Ibekwe	d1d95d0d75	Add sample for invoking Foundry Toolbox tools from declarative workflows	2026-05-13 13:47:37 -07:00