Python: Add an AgentFuse function middleware sample

[Mkaliez (MkaliezZ)]

Motivation & Context

Adds an optional PEP 723 sample showing how an external AgentFuse RuntimeGuard can use the existing FunctionMiddleware pre-dispatch boundary. The sample preserves the host call_id, dispatches allowed calls, and returns a terminal non-execution result for policy blocks or guard evaluation failures.

This is a concrete external-policy example of the execution-boundary middleware pattern discussed in #5366. It does not change framework APIs or default behavior.

Description & Review Guide

• What are the major changes? Adds one optional middleware sample, focused contract tests, and one sample-index entry. The sample uses the explicitly validated dhms-agentfuse==3.7.3 version through PEP 723 metadata rather than adding a repository dependency.
• What is the impact of these changes? Sample and test files only; no production package or runtime path changes.
• What do you want reviewers to focus on? The use of the existing host call_id, zero dispatch for block/evaluation failure, propagation of cancellation, and ownership of host-native execution errors after an allow decision.

Related Issue

Fixes #7723

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new Python sample demonstrating how to run AgentFuse policy checks as FunctionMiddleware before tool dispatch, plus documentation and a test that executes the sample’s contract verification.

Changes:

• Added AgentFuseFunctionMiddleware sample that preserves host call_id, fail-closes when guard evaluation fails, and returns a terminal “not executed” result for blocked calls.
• Updated middleware samples README to list and describe the new sample.
• Added a pytest that imports/runs the sample and validates allow/block/fail-closed behavior (skipping when dhms_agentfuse isn’t installed).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
python/samples/02-agents/middleware/agentfuse_function_middleware.py	Introduces AgentFuse-backed FunctionMiddleware sample and a self-verifying contract runner.
python/samples/02-agents/middleware/README.md	Documents the new middleware sample in the folder index.
python/packages/core/tests/core/test_agentfuse_function_middleware_sample.py	Adds coverage that imports and runs the sample’s contract verification + a missing-call_id fail-closed check.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Mkaliez (MkaliezZ)]

@microsoft-github-policy-service agree

[Evan Mattson (moonbox3)]

We're not going to add this to the repo at this time. Please feel free to host from your own repo.