v4.0.2

Changed

• Hosted outer POST /responses now unconditionally forces store: false
  before the SDK storage provider runs, for both streaming and non-streaming
  (sync) requests. The pinned azure-ai-agentserver-responses==2.0.0b1 host
  (ResponsesAgentServerHost.__init__) auto-activates its own network-bound
  FoundryStorageProvider (built from DefaultAzureCredential) whenever no
  explicit store override is supplied and the process detects it is running
  as a hosted agent — true on every real deployment. Its orchestrator only
  invoked that provider when the caller's store was true, and the
  OpenAI/Foundry Responses contract defaults an omitted store to true.
  Live matrix validation confirmed the resulting split: a caller that
  explicitly sent store: false succeeded, while the same request with
  store left unset or true deterministically failed with a platform
  storage_error once NETWORK_ISOLATION=true blocked the provider's path
  to the Foundry storage plane. HostedResponsesAgentServerHost._create_endpoint
  (src/api/hosted_entrypoint.py) now overrides store to False
  unconditionally on every create call — regardless of what a caller sends or
  omits — so the container never depends on Foundry managed persistence and
  never needs Conversations data-plane RBAC to answer a request. A caller
  sending store: true or omitting store can no longer enable implicit
  persistence.
• background: true now returns an explicit HTTP 422. background=true
  requires store=true in the pinned SDK and is therefore no longer a
  reachable combination once store is force-overridden to false. It fails
  fast with a clear GPT-RAG validation error instead of the SDK's generic 400,
  since a queued/polled response that can never be retrieved isn't a
  meaningful capability for a stateless container.
• Explicit BFF Conversations/items continuity is a separate contract and
  remains unchanged. Classic (non-hosted, Cosmos-backed) /responses and
  /invocations behavior are unaffected — this change is scoped to
  api/hosted_entrypoint.py's hosted create_response guard only.

Validation

• pytest -q (full suite): 722 passed.
• ruff check --select F on changed files: no findings.
• python -m compileall src tests: passed.
• pip check: no broken requirements.