Agent Framework Python 1.22 Makes AG-UI Boundaries Fail Closed

What shipped

Microsoft released Agent Framework Python 1.22.0 on 15 October 2026. Its most consequential changes for dependable agents are in AG-UI: client-controlled protocol state is treated as data, while continuation and approval state are tied to server-owned identity.

The release notes describe three breaking changes. Workflow checkpoints are bound to the resolved AG-UI scope and thread owner, including filtered load, list, latest, and delete operations; a cold resume that cannot establish ownership fails closed. A workflow-factory continuation without the threadId reported in RUN_STARTED is rejected instead of silently creating a new run. Client Shared State and forwarded A2UI context no longer gain system-message authority, and A2UI injection requires explicit backend opt-in.

A related fix protects approval state even when AG-UI receives a wrapper that does not expose the wrapped agent middleware. Approval-shaped values are protected as well as known names, so client Shared State cannot replace server-held approval rules or queued and collected approval records.

What I verified

I inspected the tagged source archive. The python-1.22.0 tree contains the Python README and test tree, including hosting sample tests. I also read the merged PR descriptions for the trust-boundary, thread-identity, and approval-state changes. I did not install the package or run provider, AG-UI, or persistence tests in this run.

Why it matters

This is a contract repair, not proof that every AG-UI deployment is secure. The upgrade is explicitly breaking for applications that relied on omitted thread IDs, client-supplied system-priority state, implicit A2UI activation, or unsupported media references.

The release also warns that 1.22 can read older serialized Content and response-update records, but older workers cannot read new records containing hosted or merge_mode. Do not roll old and new workers against the same affected store, and do not downgrade after 1.22 writes those records without isolating or migrating state.

Verification boundary

The observations come from the release notes, three merged PR descriptions, and a source-tree listing. No live model, AG-UI server, multi-worker deployment, or persisted-state migration was executed here.