fix(reliability): harden runtime and build lifecycle

[sozercan]

Summary

• harden cancellation, shutdown, cache ownership, capacity, and retry behavior across Orka, Foundry, Microsoft Agent Framework, LangGraph, and PydanticAI runtimes
• bound hosted and brokered requests, model responses, tool outputs, persisted continuation state, MCP initialization, and Orka event frames
• close authentication, session-identity, environment, label, and external-endpoint trust-boundary gaps
• make ABI/config validation, image platform selection, local/remote build contexts, symlink handling, and runtime target routing deterministic
• add focused regression, lifecycle, protocol, differential, conformance, stress, and live-smoke coverage for the reproduced failures

Why

A structured reliability audit found reproducible races, resource leaks, panic paths, unbounded state, cross-language validation drift, and identity/authentication boundary failures. These issues could split session state, strand runtime capacity, make terminal events unreachable, build the wrong runtime or platform, and make retries nondeterministic.

Each accepted issue was reproduced against the prior state, fixed at the owning seam, and verified with focused regression coverage plus broader suites and live checks.

Impact

• cancellation and shutdown now preserve cleanup ownership and drain runtime resources
• session and continuation retries remain deterministic under failure, saturation, and TTL pressure
• runtime memory and wire output stay within explicit limits
• generated images and Python runtimes agree on accepted ABI/configuration inputs
• invalid requests receive consistent errors instead of panics or framework-default responses
• trusted runtime, session, label, environment, and authentication values cannot be overridden by request-controlled data

Validation

• common runtime: 496 tests passed
• PydanticAI: 24 tests passed
• LangGraph: 40 tests passed
• Microsoft Agent Framework: 63 tests passed
• 623 Python tests passed in total
• go test ./... -race
• go mod tidy -diff
• make lint
• Actionlint, ShellCheck, and Python compileall
• external Orka observed/read/write/coordination conformance
• live adapter, Foundry, and Orka lifecycle/stress smokes
• structured autoreview after each significant implementation wave

Stack

This PR targets foundry-brokered-followup (#20), which is stacked on feat/foundry-brokered-responses (#19).

[Copilot]

Pull request overview

Hardens runtime reliability, protocol boundaries, ABI consistency, and deterministic image builds.

Changes:

• Adds cancellation-safe lifecycle, bounded state/output, cache ownership, and retry behavior.
• Tightens authentication, session, environment, label, endpoint, and cross-language validation.
• Makes build contexts, platform selection, runtime routing, and regression coverage deterministic.

Show a summary per file

File	Description
Makefile	Propagates target platforms through builds.
deploy/foundry/scripts/foundry_brokered_conformance.sh	Hardens continuation conformance flow.
deploy/foundry/scripts/verify_brokered_transcript.py	Validates bounded, sanitized transcripts.
docs/agent-abi.md	Documents stricter ABI constraints.
go.mod	Updates the Go toolchain.
pkg/agentkit/abi/render.go	Canonicalizes ABI rendering.
pkg/agentkit/abi/render_test.go	Tests rendering edge cases.
pkg/agentkit/abi/testdata/agent.yaml	Updates rendered ABI fixture.
pkg/agentkit/abi/testdata/edge-cases.yaml	Adds ABI edge-case fixture.
pkg/agentkit/config/config_test.go	Expands configuration validation coverage.
pkg/agentkit/config/labels.go	Protects generated label namespaces.
pkg/agentkit/config/validate.go	Strengthens deterministic validation.
pkg/agentkit/render/orka.go	Validates external Orka endpoints.
pkg/agentkit/render/orka_test.go	Tests Orka rendering boundaries.
pkg/agentkit2llb/agent/image.go	Sets deterministic image platform metadata.
pkg/agentkit2llb/agent/image_test.go	Tests platform metadata.
pkg/build/build.go	Integrates context-aware build behavior.
pkg/build/build_test.go	Adds build reliability regressions.
pkg/build/commands_test.go	Tests generated build commands.
pkg/build/context.go	Resolves local and remote contexts.
pkg/build/instructions.go	Safely loads instruction files.
pkg/build/route_compat_test.go	Tests route compatibility.
pkg/build/router.go	Enforces runtime-target agreement.
pkg/build/router_test.go	Tests deterministic routing.
runtimes/common/agentkit_serve_common/adapter_support.py	Adds cancellation-safe resource ownership.
runtimes/common/agentkit_serve_common/brokered.py	Bounds brokered tool results.
runtimes/common/agentkit_serve_common/config.py	Mirrors strict ABI validation.
runtimes/common/agentkit_serve_common/conformance.py	Expands shared conformance checks.
runtimes/common/agentkit_serve_common/foundry.py	Hardens Foundry requests and sessions.
runtimes/common/agentkit_serve_common/foundry_model_loop.py	Bounds model-loop responses and errors.
runtimes/common/agentkit_serve_common/orka.py	Hardens Orka lifecycle and frames.
runtimes/common/agentkit_serve_common/runtime.py	Improves runtime cleanup semantics.
runtimes/common/agentkit_serve_common/server.py	Bounds server request handling.
runtimes/common/tests/_brokered_description_cases.py	Shares validation edge cases.
runtimes/common/tests/test_abi_contract.py	Tests Go/Python ABI parity.
runtimes/common/tests/test_adapter_support.py	Tests lifecycle ownership.
runtimes/common/tests/test_config_validation.py	Tests strict configuration rules.
runtimes/common/tests/test_foundry_brokered_conformance_script.py	Tests conformance script behavior.
runtimes/common/tests/test_foundry_brokered_protocol.py	Tests brokered continuation boundaries.
runtimes/common/tests/test_foundry_protocol.py	Tests Foundry request limits.
runtimes/common/tests/test_foundry_transcript_verifier.py	Tests transcript sanitization.
runtimes/common/tests/test_orka_protocol.py	Tests Orka lifecycle and limits.
runtimes/langgraph/agentkit_serve/agent_factory.py	Hardens LangGraph lifecycle management.
runtimes/langgraph/tests/test_lifecycle.py	Tests LangGraph cleanup.
runtimes/microsoft-agent-framework/agentkit_serve/agent_factory.py	Hardens MAF resources and sessions.
runtimes/microsoft-agent-framework/tests/test_guardrails.py	Tests MAF cache and retry behavior.
runtimes/microsoft-agent-framework/tests/test_lifecycle.py	Tests MAF resource cleanup.
runtimes/pydantic-ai/agentkit_serve/agent_factory.py	Bounds PydanticAI MCP reads.
runtimes/pydantic-ai/tests/test_lifecycle.py	Tests MCP timeout cleanup.
runtimes/pydantic-ai/tests/test_orka_lifecycle.py	Tests Orka toolset cleanup.
scripts/live-copilot-agent-e2e.sh	Aligns live-build platforms.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 50/51 changed files
• Comments generated: 1
• Review effort level: Medium