Python: Fix AG-UI workflow-as-agent approval resumes

[Evan Mattson (moonbox3)]

Motivation & Context

When a workflow was exposed through AgentFrameworkAgent(workflow.as_agent()), AG-UI client tools were passed into WorkflowAgent.run() even though the workflow adapter did not accept or propagate them. Approval resumes could therefore fail before the interrupt was surfaced, or lose the original workflow request correlation.

Description & Review Guide

• What are the major changes? Add request-scoped tool propagation through WorkflowAgent, Workflow, AgentExecutor, and nested WorkflowExecutor paths. Mark wrapped workflows as deferred approval owners and translate the canonical AG-UI tool-call ID back to the workflow request alias on resume.
• What is the impact of these changes? Workflows exposed through AgentFrameworkAgent can now accept AG-UI client tools and complete canonical approval resumes while preserving existing native workflow behavior.
• What do you want reviewers to focus on? Review approval ownership and request-ID correlation across initial runs, continuation runs, and nested workflow executors, along with the public endpoint regression coverage.

Related Issue

Fixes #7707

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/ag-ui/agent_framework_ag_ui
_agent_run.py	1414	137	90%	160, 220, 239, 286, 304, 320–321, 443, 496–497, 504, 613, 617, 619, 636, 663–664, 718, 747, 761, 765, 769, 772, 777, 782, 794, 801–807, 818, 832, 839, 849, 864, 867, 908, 943, 967, 980, 1029, 1044, 1047, 1049, 1075, 1077, 1082–1086, 1110, 1141, 1177, 1232–1233, 1275, 1289, 1334–1340, 1349, 1357, 1385, 1408, 1412, 1415, 1417, 1478–1479, 1485–1491, 1595, 1599–1600, 1603, 1608–1609, 1612, 1618–1619, 1623–1625, 1671–1672, 1695–1696, 1709, 1734, 1751–1753, 1764–1766, 1768, 1782–1784, 1912, 1920, 1950, 1954, 1999, 2196, 2349, 2351, 2358, 2388, 2447, 2464, 2533, 2677, 2715, 2723, 2725, 2728, 2734, 2789, 2792, 2802–2803, 2810, 2857
_approval_lifecycle.py	576	50	91%	39, 51, 70, 250, 252, 254, 256, 287, 323, 325, 330, 338, 343, 354–360, 478, 481, 497, 525, 534, 544, 581, 655, 666, 669, 700, 705, 812, 821, 823, 837, 841, 857, 861, 878, 887, 912, 914, 918, 933, 963, 965, 1036–1038
_approval_state.py	45	0	100%
_workflow_run.py	792	89	88%	98, 112, 114, 116, 185–186, 190, 291–294, 338, 364, 400–403, 431, 436, 452, 454, 459–463, 473, 480, 492, 497, 504, 579, 589, 600, 605, 608, 631, 655, 658, 663, 666, 683–685, 690, 692, 698, 702, 704, 721, 727–728, 738, 744, 748–749, 773–774, 812, 820, 889, 909, 925, 940, 1024, 1046–1048, 1088–1102, 1134–1135, 1169–1170, 1245, 1307
packages/core/agent_framework/_workflows
_agent.py	333	34	89%	81, 85, 129–130, 287, 300, 370, 381, 383, 442, 454, 515, 585, 663, 693, 721, 769, 774, 786, 795, 856, 863, 869–870, 881, 913, 920, 941, 950, 954, 956–958, 965
_agent_executor.py	235	19	91%	37–38, 176, 242, 266, 286–287, 386–388, 390, 400–401, 520, 528, 555–556, 627, 633
_executor.py	200	11	94%	224, 363, 365, 374, 394, 397, 504, 509, 519, 696, 703
_runner_context.py	187	16	91%	67, 81–82, 84–85, 87, 470, 487, 500, 508, 511–513, 570, 583, 587
_workflow.py	393	25	93%	62, 64, 69, 93, 98, 159, 195, 414–416, 418–419, 443, 477, 645, 945, 966, 1014, 1026, 1039, 1065–1067, 1238, 1246
_workflow_context.py	171	18	89%	58–59, 67, 71, 75–78, 80–82, 84–86, 161, 195, 307, 451
_workflow_executor.py	166	28	83%	98, 281, 445, 487–495, 504, 572–578, 582–584, 590, 593, 600, 612, 616
TOTAL	47442	4370	90%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9661	36 💤	0 ❌	0 🔥	2m 32s ⏱️

[Copilot]

Pull request overview

Adds request-scoped tool propagation and approval-resume correlation for workflows exposed as agents through AG-UI.

Changes:

• Propagates runtime tools through workflows, agents, executors, and nested workflows.
• Maps canonical AG-UI approval IDs back to workflow request aliases.
• Adds propagation and endpoint regression tests.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
python/packages/core/tests/workflow/test_workflow_kwargs.py	Tests tool propagation.
python/packages/core/agent_framework/_workflows/_workflow.py	Stores runtime tools in workflow state.
python/packages/core/agent_framework/_workflows/_workflow_executor.py	Forwards tools into nested workflows.
python/packages/core/agent_framework/_workflows/_agent.py	Accepts and forwards tools from WorkflowAgent.
python/packages/core/agent_framework/_workflows/_agent_executor.py	Passes tools to underlying agents.
python/packages/ag-ui/tests/ag_ui/test_endpoint.py	Tests workflow-as-agent approval resume.
python/packages/ag-ui/agent_framework_ag_ui/_agent_run.py	Adds workflow approval ownership and ID translation.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 2f684c4af26f
Model: gpt-5.6-sol

Overview

The review found 3 verified inline finding(s).

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (3 medium) across 3 files. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/_workflows/_agent_executor.py, python/packages/core/agent_framework/_workflows/_workflow.py, python/packages/core/agent_framework/_workflows/_workflow_executor.py

[github-actions]

MAF Automated Review — Iteration 2

Result: Findings reported
Scope: 2 net-new commit(s): 260dc00c40b4, c7c402d3780a
Model: gpt-5.6-sol

Overview

The incremental changes improve workflow-agent approval correlation and add explicit cancellation cleanup, backed by endpoint coverage for direct wrapped workflows. The response-shape guards and request-ID validation preserve existing approval and declaration-only tool behavior. One lifecycle gap remains: cancellation cleanup does not reach the owning executor inside a nested workflow, so mixed approval batches can remain blocked.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/ag-ui/agent_framework_ag_ui/_agent_run.py

[Evan Mattson (moonbox3)]

/review

[github-actions]

MAF Automated Review — Iteration 3

Result: Findings reported
Scope: 2 net-new commit(s): 11ea19d2cafa, 80a4851b2401
Model: gpt-5.6-sol

Overview

The change adds request-scoped tool propagation and recursively clears cancelled workflow requests while preserving runtime tools outside checkpointed state. The new ownership validation, signature guards, and nested cancellation tests cover the primary workflow-as-agent resume path. Two cancellation orderings remain broken: cancellation is ineffective before a cold checkpoint restore, and cancelling the last request after a sibling response has already been accepted does not resume the owning agent.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: python/packages/ag-ui/agent_framework_ag_ui/_workflow_run.py, python/packages/core/agent_framework/_workflows/_agent_executor.py