.Net: Microsoft.SemanticKernel.AgentHooks — host adapter for the AGENT-HOOKS-0.1 control contract - #14244
Draft
MohammadHaroonAbuomar wants to merge 6 commits into
Draft
Conversation
Adapter that makes a Semantic Kernel host emit AGENT-HOOKS-0.1 interception points (https://github.com/responsibleai/agent-hooks) and honour interceptor verdicts. Function invocations are bracketed as pre_tool_call/post_tool_call with transform write-back to kernel arguments and function results; prompt rendering emits pre_model_call with rendered-prompt substitution; auto function invocation emits post_model_call once per model response. Interceptors resolve from the service collection; composition profile, enforcement mode, approval resolver, and record sink are configurable via AddAgentHooks options. Block verdicts surface as AgentHooksInterceptionBlockedException, so enforcement fails closed through the filter pipeline.
Covers deny blocking function invocation, transform rewriting arguments and results, liftable-deny approval flow with and without a resolver, and record emission with the composition profile attached.
…pha.4 The package now bundles its native library per runtime identifier, so the extension's tests run against the package assets with no local native build. Signed-off-by: MohammadHaroonAbuomar <40180927+MohammadHaroonAbuomar@users.noreply.github.com>
…post_tool_call on tool error A denied agent_startup now blocks every subsequent emission for the kernel session, and a tool invocation that throws still emits post_tool_call with is_error before the exception propagates. Both paths covered by new unit tests. Signed-off-by: MohammadHaroonAbuomar <40180927+MohammadHaroonAbuomar@users.noreply.github.com>
MohammadHaroonAbuomar
had a problem deploying
to
integration
July 30, 2026 21:40 — with 
GitHub Actions
Failure
GitHub Actions
Failure
MohammadHaroonAbuomar
had a problem deploying
to
integration
August 1, 2026 00:12 — with
GitHub Actions
Failure
GitHub Actions
Failure
A stable package version cannot carry the prerelease ResponsibleAI.AgentHooks dependency (NU5104); the extension ships with VersionSuffix alpha, matching the other early-stage packages in the repository. Signed-off-by: MohammadHaroonAbuomar <40180927+MohammadHaroonAbuomar@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Controls for agentic workloads (policy engines, approval flows, information-flow checks, audit pipelines) are rebuilt per framework today, and each framework answers differently whether a control can actually stop an action, what happens when a control crashes, and what evidence exists afterwards. AGENT-HOOKS-0.1 (https://github.com/responsibleai/agent-hooks) is a framework-neutral control contract: eight interception points around the agent loop, a three-verdict model (allow / deny with optional human-approval lift / transform), normative fail-closed host obligations, and a conformance test kit that makes "supported" a checkable claim (https://responsibleai.github.io/agent-hooks/).
What this adds
A self-contained extension,
Microsoft.SemanticKernel.AgentHooks, that makes a Semantic Kernel host emit interception points from the existing filter pipeline and honour interceptor verdicts.AddAgentHooks(options)registers one filter implementing all three filter interfaces; interceptors resolve from DI.Filter mapping
IFunctionInvocationFilterpre_tool_call/post_tool_call(transform writes back intoKernelArguments/ substitutesFunctionResult)IPromptRenderFilterpre_model_callover the rendered prompt (transform rewritesRenderedPrompt)IAutoFunctionInvocationFilterpost_model_callonce per model response carrying function callsKernelagent_startup(lazy, with the plugin function catalog)A block verdict throws
AgentHooksInterceptionBlockedException(aKernelException) without callingnext, so enforcement fails closed through normal filter semantics.Limitations (deliberate, documented in the class remarks)
input,output, andagent_shutdownhave no Kernel-level seam; they exist conceptually at the Agents layer and are left to a follow-up.pre_model_callsees the rendered prompt as a single message, not typed chat history.Kernelinstance.Test evidence
SemanticKernel.Extensions.AgentHooks.UnitTests: 5/5 passing — deny blocks invocation; transform rewrites arguments and result; approval-lifted deny proceeds; unresolved escalation blocks; records carry the composition profile. TheResponsibleAI.AgentHooks0.1.0-alpha.4 package bundles its native library per RID, so tests run with no local native build.Conformance
The contract ships a 47-vector conformance kit and a public claims registry; the reference policy runtime (https://github.com/responsibleai/agent-control-spec) passes 46/47 as an interceptor-side consumer. A Semantic Kernel host conformance claim would follow once the remaining seams land.