[BREAKING] Python: restrict checkpoint deserialization in FoundryCheckpointStore - #8045
Merged
Evan Mattson (moonbox3) merged 2 commits intoSep 8, 2026
Conversation
`FileCheckpointStorage` and the Cosmos checkpoint storage both take an `allowed_checkpoint_types` argument, hold it as `self._allowed_types`, and pass it to `decode_checkpoint_value`. `FoundryCheckpointStore` had neither, and called the decoder with the argument omitted in `load` and again in `list_checkpoints`. An omitted `allowed_types` means no restriction and falls through to plain `pickle.loads`, while the empty frozenset the other two stores pass by default selects the restricted unpickler. So the Foundry store was the only one of the three not following the module's own guidance that the argument be specified whenever possible. Give it the same argument and pass it on, so a workflow that restores on one store restores on the others. This is a behaviour change for applications on this store whose checkpoints hold their own types and which never registered them, since those are relying on the store being more permissive than the other two. They register the types with `register_checkpoint_type` or pass `allowed_checkpoint_types`, which an application on the file or Cosmos store already has to do.
Sriraj (sricursion)
requested review from
Tao Chen (TaoChenOSU),
Eduard van Valkenburg (eavanvalkenburg) and
Evan Mattson (moonbox3)
as code owners
September 3, 2026 18:35
Sriraj (sricursion)
deployed
to
github-app-auth
September 3, 2026 18:35 — with 
GitHub Actions
Active
GitHub Actions
Active
Sriraj (sricursion)
deployed
to
github-app-auth
September 3, 2026 18:35 — with
GitHub Actions
Active
GitHub Actions
Active
Sriraj (sricursion)
deployed
to
github-app-auth
September 3, 2026 18:35 — with
GitHub Actions
Active
GitHub Actions
Active
agent-framework-automation
Bot
added
python
Sriraj (sricursion)
deployed
to
github-app-auth
September 3, 2026 18:35 — with
GitHub Actions
Active
GitHub Actions
Active
`ResponsesHostServer` builds a `CheckpointStoreProvider` itself on the default path, so an option settable only on `FoundryCheckpointStore` was out of reach for a hosted app: it would have had to register types process-wide or replace the whole provider. Take the list on the provider and pass it to each store it creates. The default is unchanged, so a provider built with no arguments still restricts exactly as before.
Sriraj (sricursion)
requested a review
from Jose Alvarez (jpalvarezl)
as a code owner
September 4, 2026 13:38
Sriraj (sricursion)
deployed
to
github-app-auth
September 4, 2026 13:38 — with
GitHub Actions
Active
GitHub Actions
Active
Evan Mattson (moonbox3)
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation & Context
FileCheckpointStorageand the Cosmos checkpoint storage both take anallowed_checkpoint_typesargument, hold it asself._allowed_types, and pass it todecode_checkpoint_value.FoundryCheckpointStorehad neither, and called the decoder with the argument omitted inloadand again inlist_checkpoints.An omitted
allowed_typesmeans no restriction and falls through to plainpickle.loads, while the empty frozenset the other two stores pass by default selects the restricted unpickler. The Foundry store was therefore the only one of the three not following the guidance in_checkpoint_encoding's own security notes, which asks that the argument be specified whenever possible.Description & Review Guide
What are the major changes?
FoundryCheckpointStore.__init__takesallowed_checkpoint_types, keeps it asself._allowed_types, and both decode sites pass it. The argument, its docstring and the frozenset conversion mirrorFileCheckpointStorageso the three stores read the same way.What is the impact of these changes? A workflow that restores on one checkpoint store restores on the others. It is a behaviour change for applications on this store whose checkpoints hold their own types and which never registered them, since those are relying on this store being more permissive than the other two. They register the types with
register_checkpoint_type, or passallowed_checkpoint_types, which an application on the file or Cosmos store already has to do. I have marked this as a breaking change on that basis; say the word if you would rather it were staged behind an argument that defaults to the old behaviour.What do you want reviewers to focus on? Whether aligning with the other two stores is the outcome you want here, or whether the Foundry store is permissive on purpose.
Testing
Three tests added to
packages/foundry_hosting/tests/test_state_store.py: a checkpoint carrying a type outside the allow set is refused onload, the same throughlist_checkpoints, and a caller naming that type throughallowed_checkpoint_typesgets it back. All three fail without the change.The file's 29 tests pass.
ruff check,ruff format --checkandmypyare clean on the touched files.Related Issue
Fixes #8044
Contribution Checklist
breaking changelabel (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.