Python: Remove tool content returned after invocation limits

[eavanvalkenburg]

Motivation & Context

A provider can ignore tool_choice="none" after an invocation limit and return another local call that the framework
will not execute. Exposing that content leaves callers with an unanswered function call or local approval request.

Description & Review Guide

• What are the major changes?
  • Remove locally actionable function calls and local approval requests returned after max_function_calls or max_iterations.
  • Preserve provider-executed informational call/result pairs and hosted approval requests.
  • Apply the filtering to streaming updates and finalized responses while preserving metadata-only updates.
  • Append the deterministic fallback without replacing retained provider transcript content.
  • Keep this PR's spec change to its unique scenario row; Python: Preserve declaration-only streaming metadata #7409 owns the shared gap and related-issue cleanup.
• What is the impact of these changes?
  • Limit termination cannot expose an orphaned local tool call or approval prompt.
  • Provider-owned transcripts, hosted approvals, metadata, and finish information remain available to callers.
  • Streaming and non-streaming terminal behavior stay aligned.
  • Centralizing shared spec cleanup prevents repeated same-hunk conflicts as the focused PRs merge.
• What do you want reviewers to focus on?
  • Filtering only locally actionable content after local tools are intentionally disabled.
  • Informational call/result atomicity, hosted approvals, metadata preservation, and fallback behavior.

Related Issue

Fixes #7045

Shared spec reconciliation is in #7409, which should merge after #7407 and #7408.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
packages/core/agent_framework
_tools.py	1368	83	93%	230–231, 408, 410, 423, 448–450, 458, 476, 490, 497, 504, 527, 529, 536, 544, 679, 713–715, 718–720, 722, 728, 779–781, 806, 832, 836, 874–876, 880, 1053, 1065, 1072–1075, 1096, 1104, 1118–1120, 1490, 1573, 1601, 1623, 1675–1676, 1733, 1780, 1787–1788, 1878, 1940–1941, 1971, 2067, 2081, 2084, 2097, 2100, 2123, 2130, 2139, 2143, 2168, 2202, 2270, 2299–2300, 2397, 2425, 2465, 2468, 2525, 2678, 2759, 3248
TOTAL	46013	4479	90%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9510	34 💤	0 ❌	0 🔥	1m 40s ⏱️

[Copilot]

Pull request overview

This PR hardens the Python function-calling loop to prevent “orphaned” tool calls or approval requests from being surfaced to callers after the framework has intentionally disabled tool execution due to invocation limits. It aligns streaming and non-streaming behavior by filtering unexecutable tool-related content while preserving provider metadata updates and maintaining deterministic fallback behavior when no visible final content remains.

Changes:

• Drop function_call and function_approval_request content from finalized responses once invocation limits disable tools, before applying the existing fallback logic.
• Drop the same unexecutable tool content from streaming updates (while retaining metadata-only updates when present).
• Add unit tests covering both max_function_calls and max_iterations for streaming and non-streaming paths, plus a metadata-preservation streaming case, and update specs/docs to reflect the new guarantee.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
python/packages/core/agent_framework/_tools.py	Adds filtering helpers to remove unexecutable tool content from streamed updates and final responses after invocation limits disable tools, preserving metadata-only updates and existing fallback behavior.
python/packages/core/tests/core/test_function_invocation_logic.py	Adds regression tests to ensure post-limit tool content is not exposed (streaming + non-streaming) and that metadata-only streaming updates remain visible after filtering.
python/packages/core/AGENTS.md	Documents the new behavior that post-limit provider-emitted calls/approval requests are removed while metadata-only streaming updates remain visible.
docs/specs/004-python-function-calling-loop.md	Updates the spec matrix to mark the #7045 scenario as covered by tests and calls out transcript integrity after limits.