Python: isolate hosted session snapshots

[eavanvalkenburg]

Motivation & Context

Hosted Responses continuations currently retrieve the same mutable AgentSession object from the in-memory store. Concurrent branches from one previous_response_id can therefore mutate each other, and older response IDs do not remain independent continuation points.

Description & Review Guide

• What are the major changes? SessionStore.get() now returns a deep copy, AgentState separates newly created working sessions from stored baselines, and regression coverage exercises independent concurrent branches. Hosting guidance now distinguishes immutable response snapshots from mutable conversation heads and explains fresh workflow targets for concurrent runs.
• What is the impact of these changes? Response-keyed runs can branch safely from the same prior response. Stable conversation_id runs perform one explicit write back to the conversation key and remain subject to app-owned single-writer coordination.
• What do you want reviewers to focus on? Please focus on the snapshot boundary and the distinction between response-keyed branching and stable conversation advancement.

Related Issue

Fixes #7140

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/hosting/agent_framework_hosting
_state.py	122	10	91%	213, 226–228, 246, 308, 338, 351–353
TOTAL	44459	5233	88%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
8985	33 💤	0 ❌	0 🔥	2m 25s ⏱️

[Copilot]

Pull request overview

This PR updates the Python hosting state model so hosted Responses continuations restore isolated session snapshots rather than returning a shared, mutable AgentSession instance, enabling safe branching from the same previous_response_id.

Changes:

• Make SessionStore.get() return a deep-copied AgentSession, and adjust AgentState.get_or_create_session() to return independent working copies.
• Update hosting samples/docs to distinguish immutable previous_response_id snapshots from mutable conversation_id heads (which require app-owned single-writer coordination).
• Add regression tests covering independent concurrent branches and WorkflowState(cache_target=False) returning fresh workflow instances.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
python/samples/04-hosting/af-hosting/local_responses/README.md	Clarifies snapshot vs mutable-head semantics for previous_response_id vs conversation_id.
python/samples/04-hosting/af-hosting/local_responses/app.py	Persists session either under stable conversation_id (mutable head) or under new response_id (snapshot continuation).
python/samples/04-hosting/af-hosting/local_responses_workflow/README.md	Documents using cache_target=False to allow simultaneous workflow runs (fresh instances).
python/packages/hosting/tests/hosting/test_state.py	Updates/extends tests to validate copy-on-read session behavior and fresh targets when cache is disabled.
python/packages/hosting/README.md	Documents snapshot isolation semantics and workflow concurrency guidance.
python/packages/hosting/agent_framework_hosting/_state.py	Implements deep-copy snapshot reads and returns independent working sessions from get_or_create_session().
python/packages/hosting-responses/tests/hosting_responses/test_http_round_trip.py	Adds regression coverage for independent branching from the same previous_response_id.
python/packages/hosting-responses/README.md	Documents snapshot (previous_response_id) vs mutable head (conversation_id) continuation patterns.
docs/specs/002-python-hosting-channels.md	Updates hosting spec to note workflow instance single-active-run constraint and fresh-instance pattern.
docs/decisions/0027-hosting-channels.md	Updates ADR text to reflect snapshot isolation on session reads and branching semantics.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 88% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by eavanvalkenburg's agents