[Jose Alvarez (jpalvarezl)]

Motivation & Context

Redis context retrieval uses application, agent, user, and session identifiers as isolation boundaries. Redis TAG defaults and query formatting do not preserve every opaque identifier exactly, so distinct application identities can be treated as equivalent. This change makes scope matching deterministic and exact while retaining the original identifiers as document metadata.

Description & Review Guide

• What are the major changes? Index deterministic, domain-separated scope tokens in dedicated case-sensitive TAG fields; keep raw scope values unindexed; make provider configuration authoritative over document-supplied scope fields; scope search_all() consistently; and reject indexes created with the legacy raw-scope schema.
• What is the impact of these changes? Scope comparisons preserve case and punctuation across text and hybrid retrieval. This is a breaking beta schema change: applications with an existing incompatible context index must delete the old index and context hashes, allow the provider to create a new index, and re-ingest the context data. overwrite_index=True does not bypass the compatibility check or migrate legacy data.
• What do you want reviewers to focus on? The token-field schema, fail-closed legacy-schema detection, authoritative scope assignment on writes, and live Redis coverage for exact identity, session scoping, hybrid retrieval, and explicit recreation/re-ingestion.

Related Issue

N/A - maintainer-directed correctness change with no competing public issue or pull request.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Implementation, tests, documentation, design, and PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" in the title prefix, before or after any language prefix) — workflows keep the label and title prefix in sync automatically.

[github-code-quality]

Code coverage overview

Languages: Python

Python / code-coverage/python

main 10a94cf	fix-redis-context-sc... 63939ca	+/-
92%	92%	0%

View coverage of the 1 most impacted file.

File	main 10a94cf	fix-redis-context-sc... 63939ca	+/-
packages/redis/...ext_provider.py	96%	99%	+3%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 27, 2026 13:58 UTC}

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): ec2198f0d81f
Model: gpt-5.6-sol

Overview

The PR replaces raw TAG filters with domain-separated scope tokens, makes provider scopes authoritative on writes, and adds strong unit and live Redis coverage for exact identity and migration. Those guards address case, punctuation, and caller-supplied scope spoofing. The rebuild path still has three medium-risk lifecycle defects: incomplete migrations can appear complete, migration work is unbounded, and raw prefix matching can mutate unrelated hashes.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
3 verified findings remained after source verification (3 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/redis/agent_framework_redis/_context_provider.py

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

4 open findings

• _migrate_scope_tokens() currently scans all HASH keys in Redis and then filters in Python. This… · New
• The migration loop performs an HGETALL per key serially, which can be slow for large datasets… · New
• The completion check uses FT.INFO num_docs >= migrated_documents, but num_docs reflects total… · New
• This unconditionally overwrites any caller-supplied scope metadata in data *even when the… · New

What changed in this PR

Introduces deterministic, identity-preserving scoping for RedisContextProvider by indexing versioned scope tokens (instead of raw scope identifiers), including an opt-in migration path for existing indexes and added integration coverage.

Changes:

• Replace indexed scope TAG fields (application_id, agent_id, user_id, thread_id, conversation_id) with versioned token TAG fields derived from those identifiers.
• Add overwrite_index=True coordinated migration flow that rebuilds the index and backfills token fields into preserved hashes.
• Expand test coverage (unit + live Redis integration) and wire integration tests into CI workflows.

File	Description
python/​packages/​redis/​agent_framework_redis/​_context_provider.py	Implements tokenized scope fields, schema changes, migration/backfill logic, and updates filtering/search_all behavior.
python/​packages/​redis/​tests/​test_providers.py	Updates schema expectations to reflect tokenized scope fields.
python/​packages/​redis/​tests/​test_context_provider_sdk.py	Verifies SDK-level records include scope token fields derived from stored scope metadata.
python/​packages/​redis/​tests/​test_context_provider_integration.py	Adds live Redis integration tests for scope isolation and migration behavior.
python/​packages/​redis/​tests/​test_context_provider_edges.py	Adds edge-case coverage for token generation, schema tagging behavior, migration, and query filtering.
python/​packages/​redis/​README.md	Documents new isolation model and the coordinated migration procedure.
python/​packages/​redis/​AGENTS.md	Summarizes tokenized scoping and migration behavior for agents.
.github/​workflows/​python-merge-tests.yml	Runs Redis integration tests including the new context provider integration suite.
.github/​workflows/​python-integration-tests.yml	Runs Redis integration tests including the new context provider integration suite.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Eduard van Valkenburg (eavanvalkenburg)]

The scope-token design and live isolation coverage look strong, but the migration control path still has four correctness and concurrency gaps that can skip or mutate records during a coordinated rebuild.

[Jose Alvarez (jpalvarezl)]

/review

[github-actions]

MAF Automated Review — Iteration 2

Result: Findings reported
Scope: full PR (9 commit(s)): e57af6cc4a02, a6fcf087e214, 010aaa2d49fb, a211770106a9, a1f915166248, 6d6b768af77b, 90907469b108, 30ffc84ca5f8, 7c3de4bb1e92
Model: gpt-5.6-sol

Overview

The PR replaces raw Redis scope tags with versioned, field-specific SHA-256 tokens, preserves raw values as metadata, makes provider scope authoritative on writes, and adds live Redis coverage for exact identity and legacy-schema rejection. The guards are strong for sequential initialization, but concurrent initialization can still accept a legacy schema after the pre-create check and undermine the fail-closed contract.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/redis/agent_framework_redis/_context_provider.py