[AdamDiStefanoAI]

Scope

Harden the Python SDK's response-consumption boundary and repair the required dependency audit with the matching patched OpenTelemetry family. No policy, permission, workflow, or normative-standard changes; optional framework migration remains separate.

• Reject ALLOW/MODIFY on non-200 evaluation responses while retaining structured DENY/ESCALATE behavior.
• Require explicit replacement actions/parameters and bind replacement tool names to the requested tool in raw clients and local guards.
• Preserve legitimate unchanged/empty replacement parameters, tool aliases, and gateway-managed results.
• Add 64 regression cases, including real router/SDK compatibility with isolated fixtures; document limits.

Evidence before publication

• Pinned base: ff2bd3e2fe447a00baf639d8b298219807c9d9f4.
• Independently reviewed patch SHA-256: bbee1db9ef729c059d5a14d4fbe4dd023e9b794f8c8147bea3480d372da7abbd.
• Local full suite with optional LangGraph: 422 passed, 81.92% coverage; lint, format and package build passed.
• Independent review: 92 separately authored probes plus a separate execution of all 64 new regressions passed.
• Fresh installed-wheel smoke outside the repository: one allowed local tool call, zero denied calls; pip check passed.

Boundaries

These defects concern malformed responses from the configured gateway/intermediary/custom transport. Tests do not establish external injection into authenticated HTTPS, nor that the normal gateway emits these malformed responses. The patch does not protect against a fully compromised trusted gateway, undo server-side effects already performed, or provide approval replay/concurrency safety or complete standard conformance.

Release gate

This PR is separate from contributor integration work. Keep it draft until final exact-head independent review and all required CI checks pass. An authorized v1.1.6 release remains conditional on normal review/merge gates and explicit verification of the merged commit before tagging; no release occurs merely by opening this PR.

Required-gate dependency repair

The first public SDK head passed the non-audit checks, but strict pip-audit found CVE-2026-114603 in opentelemetry-api 1.38.0. This follow-up raises the API/SDK/OTLP HTTP exporter floor to 1.45.1 and selects the matching instrumentation 0.66b1 family; no audit waiver or workflow changes. Two bounded trace-context tests preserve legitimate propagation and check oversized-state rejection. Independent offline smoke verifies ACR startup, HTTPX/FastAPI spans, and both OTLP exporter APIs.

Fresh exact base/dev installation: 420 tests passed, 2 skipped; pip check passed; strict frozen-environment pip-audit reports no known vulnerabilities. Separate optional legacy framework testing: 424 passed, 1 skipped, but that optional dependency family is not audit-clean. Warnings now precede the legacy integration installation guidance; no optional major-version migration is included here. Base installation does not install LangChain/LangGraph. Pre-existing SQLAlchemy 2.1 instrumentation compatibility is tracked separately and must not be represented as validated complete tracing.

Final candidate requires a new independent exact-head review and all hosted checks before merge or v1.1.6 tagging. No production-readiness or complete-conformance claim.