.NET: Preserve hosted session key boundaries

[Ricky-7-Yan]

Motivation & Context Hosted session stores must preserve the boundaries between agent, user, and conversation identifiers. Delimiter-based string keys allow distinct identifier tuples containing : to collapse to the same cache entry, which can mix session state across requests. ### Description & Review Guide - What are the major changes? Python Invocations hosting now serializes hosted session/user identifiers as a compact JSON array, including the standalone break-glass example. The .NET Foundry in-memory store now uses a strongly typed composite key. Focused regression tests cover distinct colliding tuples and repeated-request continuity. - What is the impact of these changes? Distinct hosted identifier combinations remain isolated while existing local-mode keys and same-tuple session reuse stay unchanged. - What do you want reviewers to focus on? Please review the hosted key representation and the compatibility of null/empty agent and user components in the .NET store. ### Related Issue Fixes #8251 ### Contribution Checklist - [x] The code builds clean without any errors or warnings - [x] All unit tests pass, and I have added new tests where possible - [x] The PR follows the Contribution Guidelines - [x] This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above). - [x] This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

The implementations preserve identifier boundaries and existing null, empty, and local-mode behavior with focused regression coverage.

Pull request overview

Preserves hosted session isolation by replacing ambiguous delimiter-based keys with boundary-safe representations.

Changes:

• Serializes Python hosted identifiers as compact JSON arrays.
• Uses a typed composite key for the .NET in-memory store.
• Adds regression tests for collision isolation and session continuity.

File summaries

File	Description
python/samples/04-hosting/foundry-hosted-agents/invocations/break_glass/main.py	Updates the sample’s hosted session key format.
python/packages/foundry_hosting/tests/test_invocations.py	Tests collision isolation and repeated-session reuse.
python/packages/foundry_hosting/agent_framework_foundry_hosting/_invocations.py	Generates unambiguous hosted partition keys.
dotnet/tests/Microsoft.Agents.AI.Foundry.Hosting.UnitTests/InMemoryAgentSessionStoreTests.cs	Verifies composite identifier boundaries.
dotnet/src/Microsoft.Agents.AI.Foundry.Hosting/InMemoryAgentSessionStore.cs	Replaces concatenated keys with a typed record key.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Vincent Biret (baywet)]

Thanks for the contribution!

(to other reviewers, I've only reviewed the dotnet side of things)

[Eduard van Valkenburg (eavanvalkenburg)]

Thanks for the update. Before this is ready, could you please:

• follow up on and resolve the remaining discussion at python/packages/foundry_hosting/agent_framework_foundry_hosting/_invocations.py:66
• get the current Python - Tests, Python - Test Coverage, dotnet-build-and-test, and Merge Gatekeeper failures passing
• complete the build, test, and contribution checklist items, and restore the breaking-change declaration from the current PR template

Once those are addressed, please re-request review. Thanks!