[dotnet-port-fixes] Prevent workflow telemetry serialization panics

[Michelle Clayton (michelle-clayton-work)]

Summary

Prevent workflow telemetry serialization from failing execution when sensitive-data attributes hit panic-style JSON serialization failures. The Go port now falls back to the existing [Unserializable: ...] marker for both ordinary marshal errors and panics, and adds regression coverage for direct observability helpers and in-process workflow execution.

Ported .NET PRs

• microsoft/agent-framework#7612 - prevent telemetry serialization failures from failing workflows. Upstream commit: 8a0731ad92560d7eb5c181682d9501a82a6b4a70.

Breaking Changes

No. This keeps the existing public Go API and only hardens internal telemetry serialization so workflow execution continues when telemetry-only serialization panics.

Tests and Examples

• go test ./workflow/internal/observability ./workflow/inproc
• Added panic-path observability regression tests for serialized attributes, executor input/output telemetry, and end-to-end in-process workflow delivery
• No example changes were needed for this internal parity fix

Notes

This is the remaining narrow parity gap after earlier observability fallback coverage: Go already handled json.Marshal error returns, but custom MarshalJSON panics could still escape through telemetry serialization.

Generated by .NET to Go Fixes and Test Porting Agent · gpt54 · 255.6 AIC · ⌖ 14 AIC · ⊞ 24.4K · ◷

Closes #909

[Copilot]

Pull request overview

This PR hardens the workflow observability/telemetry path so that JSON serialization failures (including panic from custom MarshalJSON) do not abort workflow execution. It aligns the Go port with the existing fallback marker behavior ([Unserializable: ...]) and adds regression tests covering both the low-level observability helpers and end-to-end in-process workflow runs.

Changes:

• Added a recover-based fallback in internal telemetry serialization to handle panic during json.Marshal.
• Added unit tests to verify fallback behavior for both marshal errors and marshal panics in observability helpers.
• Added an in-process workflow regression test ensuring panicking sensitive-data serialization does not fail workflow execution and telemetry attributes still emit fallback strings.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
workflow/internal/observability/observability.go	Wraps telemetry serialization with panic recovery and reuses a shared fallback formatter.
workflow/internal/observability/observability_test.go	Adds regression tests for fallback behavior when MarshalJSON panics (and for executor input/output tags).
workflow/inproc/observability_test.go	Adds an end-to-end inproc workflow test ensuring panicking payload serialization does not fail workflow execution.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Parity Review — PR #929

Scope: internal-only (no exported API changes)

Changed Go contract: None. All changes are in workflow/internal/observability/observability.go — the internal serialize() function gains a defer recover() to catch panics from custom MarshalJSON implementations. No exported types, functions, fields, or observable public behavior changed.

Upstream evidence reviewed:

• .NET: dotnet/src/Microsoft.Agents.AI.Workflows/Observability/WorkflowTelemetryContext.cs — commit 8a0731ad changed catch (JsonException) to catch (Exception) so all serialization exceptions fall back to [Unserializable: ...]. This prevents telemetry failures from propagating into workflow execution.
• Python: No equivalent telemetry serialization path found; not applicable.

Result: ✅ Aligned — the Go change faithfully ports the upstream .NET fix. The upstream broadened exception catching to cover non-JsonException failures; the Go port equivalently adds defer recover() to catch panics from custom MarshalJSON implementations, matching the upstream intent. The [Unserializable: ...] fallback marker is preserved in both. No public API surface changed; the public-api-change label is not warranted.

Generated by Go API Consistency Review Agent for #929 · sonnet46 · 26 AIC · ⌖ 5.03 AIC · ⊞ 6.4K · ◷