🟡 Changes recommended

The separator-collision test does not exercise the stated collision, and new guards diverge from the repository’s required validation convention.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Scopes OpenAI response, conversation, and index storage by caller isolation keys while retaining shared behavior when isolation is unconfigured.

Changes:

• Adds isolation-key storage decorators and response-key scoping.
• Covers conversation/response isolation flows.
• Updates hosting security guidance.

Suppressed comments (1)

dotnet/src/Microsoft.Agents.AI.Hosting.OpenAI/Conversations/IsolationKeyScopedConversationStorage.cs:62

• Standalone .NET guards in this repository use _ = Throw.IfNull(...) from Microsoft.Shared.Diagnostics (for example, dotnet/src/Microsoft.Agents.AI.Hosting/AIHostAgent.cs:72-73); please use that pattern here.

        ArgumentNullException.ThrowIfNull(conversation);

• Files reviewed: 11/11 changed files
• Comments generated: 4
• Review effort level: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): c68716c27714
Model: gpt-5.6-sol-fast

Overview

The PR consistently scopes conversation, conversation-index, and response storage keys while preserving bare wire identifiers; strict missing-key behavior and broad cross-caller tests provide strong guardrails. Two residual issues remain: resolver construction assumes a singleton isolation provider despite the public custom-provider contract, and index scoping multiplies a fixed global cache by the number of callers. These can prevent endpoint startup for scoped providers and make conversation listings incomplete beyond 1,000 active caller-agent partitions.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: dotnet/src/Microsoft.Agents.AI.Hosting.OpenAI/Conversations/IsolationKeyScopedAgentConversationIndex.cs, dotnet/src/Microsoft.Agents.AI.Hosting.OpenAI/ServiceCollectionExtensions.cs