[Manohar Paturi (ManoharPaturi)]

Motivation & Context

When converting a workflow to an agent using workflow.as_agent(), WorkflowAgent wraps workflow execution inside the agent contract. In multi-agent orchestrations such as GroupChat or workflows where executors yield conversation history, the emitted output often contains user questions, system instructions, or tool results alongside assistant responses.

Previously, WorkflowAgent._convert_workflow_events_to_agent_response and _convert_workflow_event_to_agent_response_updates forwarded messages from AgentResponse, list[Message], and Message payloads without inspecting message roles. This caused user prompts to be re-emitted as part of the agent response, compounding across conversation turns in streaming and non-streaming modes.

Filtering to assistant-only messages ensures that callers invoking the workflow as an agent receive solely the generated assistant output.

Description & Review Guide

1. Major changes:
   In python/packages/core/agent_framework/_workflows/_agent.py, updated _convert_workflow_events_to_agent_response so that only assistant-role messages from AgentResponse, list[Message], and Message payloads are added to the returned AgentResponse. Also updated _convert_workflow_event_to_agent_response_updates to drop non-assistant messages and updates during streaming conversion.

2. Impact of changes:
   WorkflowAgent now returns strictly assistant output. If a workflow output event consists only of non-assistant messages, it is cleanly omitted without crashing or appending dangling raw representations. Internal workflow messaging and inter-executor communication remain completely unchanged.

3. Review focus:
   Please verify the role filtering logic across the AgentResponse, list[Message], and Message branches in _convert_workflow_events_to_agent_response and _convert_workflow_event_to_agent_response_updates, as well as the unit tests covering multi-turn conversation non-compounding and streaming behavior.

Related Issue

Fixes #4261

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Manohar Paturi (ManoharPaturi)]

Eduard van Valkenburg (@eavanvalkenburg) fixed. the list[Message] branch now appends each assistant message's own raw_representation when the list is filtered, so user/system/tool content no longer leaks through the non-streaming payload; unfiltered lists keep the original object, matching the streaming path. added an assertion to the mixed-list test pinning that no filtered-out role survives in raw_representation. workflow agent suite 64/64 green.

[Manohar Paturi (ManoharPaturi)]

Eduard van Valkenburg (@eavanvalkenburg) fixed in 4266443 — took the drop direction you offered: an assistant message whose contents are entirely function-call envelopes is now dropped alongside the non-assistant messages, so call → tool(result) → final keeps only the final and never leaves an orphaned call in the persisted response. the alternative (preserving paired call+result history) would reintroduce exactly the tool-role leakage this PR exists to remove, since the results are tool-role by construction — but happy to switch if you'd rather expose the pair.

regression test builds your exact transcript (assistant(get_weather call) → tool(18C result) → assistant(final)) and asserts no function_call content survives while the final text does. workflow agent suite 65/65.

[Manohar Paturi (ManoharPaturi)]

CI note: the failing Pre-commit/Package checks on the previous head were pyupgrade wanting the typing import collapse and a docstring-format fix on the new helper — both applied, plus ruff format. all hooks pass locally now (ruff check clean, format clean, pyupgrade idempotent) and the workflow agent suite is 65/65. fresh matrix running on f320aed.

[Eduard van Valkenburg (eavanvalkenburg)]

/review

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (7 commit(s)): f049cb58c3cd, a6eff9e8e746, bcab43884656, cf2a1c0967ea, f320aed5165f, bd8f1e82df0f, c660761cd7b2
Model: gpt-5.6-sol

Overview

The PR centralizes caller-facing message filtering, applies it consistently across response shapes, and adds targeted coverage for role-less continuations, raw payloads, and orphaned function calls. Request-info handling remains separate, and filtered streaming output is what reaches session persistence. Three residual regressions remain: valid informational calls are removed, role inheritance is shared across concurrent streams, and response-level usage metadata is lost when every message is filtered.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (3 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/core/agent_framework/_workflows/_agent.py

[Manohar Paturi (ManoharPaturi)]

All four findings addressed in 54b276f:

• role gate: declared roles are now remembered per message id. A user declaration only stains that message's own continuations, so an unrelated role-less message (another stream, or a later message of the run) is forwarded instead of dropped, and the concurrent A-user/B-assistant interleaving resolves per stream. Updates without a message id share one conservative fallback slot, since there is no identity to scope by.
• informational_only calls are excluded from the internal-envelope check in both the predicate and the streaming filter, so provider-hosted transcript calls without results survive in both modes.
• usage_details and created_at now merge unconditionally per child AgentResponse, so an all-filtered response still reports its billed tokens and timestamp.

New tests: informational call survives (both modes), per-message gate scoping (user decl on one id, role-less chunk on another forwarded, same-id continuation dropped), and usage retention with zero surviving messages. workflow_agent 71/71; foundry_hosting 879 passed with the 4 conftest state-root failures pre-existing on a clean tree (missing optional deps locally).