fix(agentserver): partition in-memory response state by user

[Shanmukha Pasumarthy (shanmukha1200)]

Summary

• Partition InMemoryResponseProvider response envelopes, items, history, conversation indexes, and legacy execution/replay state by the exact PlatformContext.user_id_key.
• Preserve anonymous local usage in a separate partition when context or the user key is absent. Keep empty and whitespace keys distinct, consistent with PlatformContext.
• Add optional context to legacy helpers and update the API documentation and changelog.

The provider relies on trusted platform context; it does not authenticate callers or interpret call_id. Runtime authorization and the process-wide SSE stream registry are unchanged.

Security impact

Previously, InMemoryResponseProvider accepted platform context but indexed response, item, and conversation state only by resource ID. When a provider instance served multiple users, its storage layer did not enforce per-user isolation: a caller able to reach a provider-backed operation with another user's identifier could read or modify that user's stored state, subject to any upstream authorization checks.

This change keys provider-owned state by both the trusted platform user key and the resource ID, including lookups, mutations, history resolution, and legacy execution/replay helpers. Missing identity selects a separate anonymous partition rather than bypassing isolation.

This is a storage-layer fix, not authentication or a claim of a demonstrated production exploit. Hosts must establish trustworthy platform context. Runtime authorization and the separate process-wide SSE stream registry are not changed by this PR.

Validation

• 87 tests passed in the changed unit and contract suites after rebasing onto the latest main.
• Coverage includes cross-user and anonymous isolation, ID collisions, CRUD, history and item references, paging, expiration, and provider fallbacks before and after runtime eviction.
• Earlier expanded targeted run: 196 tests passed. Targeted Black and mypy checks passed; git diff --check is clean.
• Two dependency deprecation warnings; no live or full-repository tests run.

Authored-by: GitHub Copilot CLI 1.0.81-0
Model: GPT-6 Astra (gpt-6-astra)

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The modified API snapshot’s committed metadata hash is stale and must be regenerated.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Partitions in-memory response state by platform user identity to prevent cross-user access.

Changes:

• Adds user-scoped storage keys across responses, items, history, and legacy state.
• Adds isolation tests for CRUD, eviction, replay, expiration, and anonymous users.
• Updates public API documentation and release notes.

File summaries

File	Description
store/_memory.py	Implements user-partitioned storage.
store/_base.py	Clarifies provider isolation requirements.
test_in_memory_provider_crud.py	Tests partitioned provider behavior.
test_user_isolation_enforcement.py	Tests host isolation around eviction.
README.md	Documents identity partitioning.
CHANGELOG.md	Records the security fix.
api.md	Adds context parameters to the API snapshot.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Balanced (auto)

Note

Copilot is running an experiment and ran this review at Balanced.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.