[teddy arida-moody (teddyam)]

Socket Mode currently only supports the classic bot identity. This adds opt-in Agentic User (AU) support, mirroring microsoft/teams.ts#928 and microsoft/teams.py#626 while following C# conventions.

Approach

• Options: SocketModeOptions gains AgenticAppId, AgenticTokenScope (required when agentic, no default audience), and AgenticTenantId. Setting scope or tenant without an app ID is invalid.
• Negotiate token: when agentic, negotiate uses an agent-instance app token via the new BotTokenProvider.GetAgenticAppTokenAsync (Microsoft.Identity.Web WithAgentIdentity). It is acquired on every negotiate, so reconnects and refreshes reuse it.
• Inbound validation: in agentic mode, envelopes are rejected with a 400 before dispatch if a present botKey does not match ClientId, or if the recipient lacks non-empty, unpadded agenticAppBlueprintId, agenticAppId, tenantId (plus agenticUserId for role == "agenticUser" or when present), or if the blueprint does not match ClientId. The recipient identity is never modified, so replies go out as each activity's recipient.
• Classic mode is unchanged.
• README updated with an "Agentic Socket Mode" section.

Decisions worth reviewing

1. New public API in Core: BotTokenProvider.GetAgenticAppTokenAsync. Core has no InternalsVisibleTo for Apps; the alternative is adding one and keeping it internal.
2. Validation timing: invalid agentic settings throw ArgumentException at host start (existing C# pattern), not at construction like TS/PY.
3. Case-insensitive ID checks: botKey and blueprint comparisons use OrdinalIgnoreCase (GUIDs; consistent with fix: validate caller app on Entra inbound Agent ID tokens #695 and issuer checks). TS/PY use strict equality.
4. Rejections are not routed to onError: logged as warnings, matching TS and the existing protocol-version rejection. Python also calls onError.
5. Envelopes with no activity are dropped (matches PY and current C#); TS returns 400.
6. Negotiator token error message made identity-neutral ("connection token").

Testing

• New SocketModeAgenticTests and BotTokenProviderAgenticAppTests; added agentic cases to transport and hosting tests, including an end-to-end reply-as-recipient test.
• Full solution builds with no warnings; Core (233) and Apps (999) unit tests pass on net8.0 and net10.0.
• Not yet validated against the live service.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.