[NingLin Liu (ninglinLiu)]

Motivation & Context

TodoProvider kept read-modify-write locks on the provider instance. The store is shareable, so two providers over one store and session each took their own lock, could load the same next_id, and the second save could drop the first provider's items or reuse ids. An asyncio.Lock tied to one event loop also breaks when the same session is reused across asyncio.run boundaries.

Description & Review Guide

• What are the major changes? Move todo mutation locking to a module-level WeakValueDictionary keyed by (id(store), event loop, id(session), source_id), matching the file-access _store_write_lock pattern. TodoProvider._mutation_lock now returns that shared lock.
• What is the impact of these changes? Concurrent todos_add / complete / remove from different providers over the same store and session serialize correctly. Locks remain process-local and are not retained after they go unused (weak values).
• What do you want reviewers to focus on? Lock keying (store + session + source_id + loop) and the new shared-provider file-store concurrency test.

Related Issue

Fixes #9868

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Assisted with implementation and tests; I reviewed the lock design against _store_write_lock, verified lock sharing with a local script, and accept responsibility for the change.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

File-backed mutations use object-specific locks, allowing separate AgentSession objects for the same persisted session to allocate duplicate IDs and overwrite concurrent updates.

1 open issue

• Coordinate file mutations across sessions sharing the same state · New

What changed in this PR

This PR addresses #9868 by moving Python todo mutation locks from individual providers to a shared registry, allowing providers using the same store and session object to coordinate updates.

Changes:

• Share locks by store, event loop, session object, and source ID.
• Use weak references so unused locks are released.
• Add tests for lock sharing and concurrent additions through two providers.

File	Description
python/​packages/​core/​tests/​core/​test_harness_todo.py	Adds shared-lock assertions and a two-provider file-store concurrency test.
python/​packages/​core/​agent_framework/​_harness/​_todo.py	Replaces provider-local locks with a shared, event-loop-aware weak registry.

_{Review effort: Balanced}

[Eduard van Valkenburg (eavanvalkenburg)]

Closing since the issue has not been triaged