Summary

Add an optional origin_session_id parameter to SessionContext.extend_messages that propagates into the existing _attribution payload on Message.additional_properties. Populate it from the harness memory consolidation pipeline when injecting topics that include contributions from sessions other than the current one. Add a self-contained sample observer demonstrating subscription via the standard ContextProvider pipeline.

Companion to #5914 for design discussion. Submitted as a draft — per CONTRIBUTING.md ("DON'T make new APIs without filing an issue and discussing with us first"), I'd appreciate maintainer signal on the API-shape questions in #5914 before this goes to ready-for-review.

Motivation

Dai et al., Stateful Agent Backdoor (arXiv:2605.06158, preprint May 2026) documents a cross-session attack class that uses persistent memory to chain sub-backdoors across session boundaries under permission isolation. The paper specifically surveys MAF in §6.1 / Table 10 as satisfying both threat-model preconditions.

The paper's primary suggested defense is cross-session behavioral pattern analysis (§6.3). MAF's existing ContextProvider pipeline is the natural enforcement point — but downstream observers can't see the cross-session signal today because the framework doesn't expose which session injected content originated from. This PR closes that gap.

See #5914 for the full motivation, the architecture analysis, and the open API questions.

Changes

• python/packages/core/agent_framework/_sessions.py — SessionContext.extend_messages gains an optional origin_session_id: str | None = None keyword parameter. When non-None, it's added to the existing _attribution dict alongside source_id / source_type. Default behavior is unchanged.
• python/packages/core/agent_framework/_harness/_memory.py — MemoryContextProvider.before_run now computes a cross_session_origin from selected_topics[*].session_ids and passes it through extend_messages when injecting the consolidated memory block. The MemoryTopicRecord.session_ids field already tracked this provenance data; we just route it to the attribution layer.
• python/samples/02-agents/context_providers/cross_session_observer.py — new self-contained sample. A CrossSessionObserver(ContextProvider) walks accumulated context messages in before_run, finds those whose attribution carries an origin_session_id different from the current session, and invokes a user-supplied callback. The sample's main() constructs SessionContext directly (no LLM credentials required) and demonstrates both the same-session silence case and the cross-session detection case.
• python/samples/02-agents/context_providers/README.md — table entry + prerequisites section for the new sample.
• Tests — tests/core/test_sessions.py gains four cases (origin omitted by default; origin recorded on attribution; origin works with string source_id; origin works with provider-object source). tests/core/test_harness_memory.py gains two cases (harness marks cross-session origin; harness omits origin when only the current session contributes).

Backward compatibility

Strictly additive:

• The _attribution dict shape is extended with one optional key (origin_session_id); the existing source_id / source_type fields are unchanged.
• Callers that don't pass origin_session_id see the historical attribution dict exactly (verified by test_extend_messages_origin_session_id_default_omits_field).
• No new public types; no changes to abstract ContextProvider / HistoryProvider interfaces; no behavioral change to any provider that doesn't opt in.
• Observers that don't know about origin_session_id ignore it and see today's behavior.

Test plan

• uv run pytest packages/core/tests/core/test_sessions.py packages/core/tests/core/test_harness_memory.py — all 77 tests pass locally (Python 3.14, Windows). The six new tests cover the parameter, default, harness cross-session, harness same-session, string-source, and provider-object-source cases.
• uv run pytest packages/core/tests/ — full core suite: 2774 passed, 27 skipped, 2 xfailed, 0 newly failing. (One pre-existing unrelated test_telemetry.py::test_detect_hosted_fallback_import_error failure on this Python 3.14 / Windows environment, reproducible against main without my changes.)
• uv run ruff check + ruff format --check clean on all six modified files.
• uv run pyright clean (0 errors, 0 warnings, 0 informations) on core sources, tests, and the sample.
• Sample runs end-to-end and produces the expected detection output:

  --- Same-session case complete (no detections expected above) ---
  [cross-session detected] source='memory_provider' origin_session='session-A' current_session='session-B' preview='Remember: API key for prod is sk-7f3a... (from session-A).'
  --- Cross-session case complete (one detection expected above) ---
  

Open API questions (from #5914 — please weigh in)

1. Attribution key naming. origin_session_id vs source_session_id?
2. Threading mechanism. Keyword parameter on extend_messages (current proposal) vs providers setting the field directly on msg.additional_properties["_attribution"] after call?
3. Built-in session-scoped providers (InMemoryHistoryProvider, FileHistoryProvider) — should they populate the field for consistency, even though it would always equal session_id?
4. Typed shape. In-place dict extension (current) vs introducing a typed MessageAttribution dataclass.

Happy to revise based on any direction.

Related

• Discussion anchor: Python: Expose cross-session memory origin for downstream governance (Dai et al., arXiv:2605.06158) #5914
• Adjacent in-flight session-isolation work: Python: Session isolation does not work as expected for workflow-as-agent deployments in App Service / Container Apps #5472
• Downstream impact in Microsoft's governance toolkit: microsoft/agent-governance-toolkit#2374

Surfaced during independent audit conducted by @finnoybu (Ken Tannenbaum, AEGIS Initiative); [MEDIUM, python/packages/core].