Python: Harden FIDES replay and approval authority

docs/features/FIDES_IMPLEMENTATION_SUMMARY.md

@@ -4,6 +4,10 @@
 
 **FIDES**  is a comprehensive deterministic prompt injection defense system for the agent framework. The implementation provides label-based security mechanisms to defend against prompt injection attacks by tracking integrity and confidentiality of content throughout agent execution.
 
+FIDES enforces tool-result, hidden-variable, caller-replayed, and history-provider flows. Other `ContextProvider`
+implementations remain trusted plugins; provider-injected messages require an explicit provider/application trust
+boundary until a first-class provider-message labeling contract is defined.
+
 **🚀 Key Features:**
 - **Context Provider Pattern** - `SecureAgentConfig` extends `ContextProvider`, injecting tools, instructions, and middleware automatically
 - **Automatic Variable Hiding** - UNTRUSTED content is automatically hidden without requiring manual intervention
@@ -363,4 +367,8 @@ cd python/packages/core && ../../.venv/bin/pytest tests/test_security.py -v
 - **Full traceability**: Message-level label tracking
 - **Complete auditability**: All security events logged
 
-The system ensures that untrusted content never directly reaches the LLM context and that all tool calls are policy-checked based on the cumulative security state before execution.
+The system hides FIDES-labeled untrusted tool output from the LLM context and policy-checks tool calls against the
+cumulative security state before execution. Newly supplied assistant/tool messages are conservatively labeled even
+when state was restored. History-provider messages reconstruct missing state, while restored state remains
+authoritative for unstamped stored history; trusted non-history context providers remain responsible for the data they
+inject.

python/packages/core/agent_framework/_agents.py

@@ -1841,6 +1841,24 @@ async def _prepare_session_and_messages(
                 state=provider_session.state.setdefault(provider.source_id, {}),
             )
 
+        approval_history_consumers = [
+            (provider, prepare)
+            for provider in self.context_providers
+            if callable(prepare := getattr(provider, "_prepare_approval_history", None))
+        ]
+        if approval_history_consumers and not per_service_call_history_required:
+            if provider_session is None:
+                raise RuntimeError("Provider session must be available when approval history is prepared.")
+            for provider, prepare in approval_history_consumers:
+                prepared = prepare(
+                    agent=self,
+                    session=provider_session,
+                    context=session_context,
+                    state=provider_session.state.setdefault(provider.source_id, {}),
+                )
+                if isawaitable(prepared):
+                    _ = await prepared
+
         # Merge provider-contributed tools into chat_options
         if session_context.tools:
             if chat_options.get("tools") is not None: