PR #3387 openai-agents fix only covers non-streaming path - title implies both paths

[knoal]

Problem

PR #3387 (fix: reject failed and incomplete Responses statuses) only handles the non-streaming path. The streaming path is not covered by this PR despite the title claiming both statuses.

Impact

• A streaming agent that returns a failed/incomplete status would NOT be rejected
• The PR is misleading about what it fixes
• A real bug in the streaming path could ship undetected

What was audited

MCE audit Toaiagents3387 (2026-07-19) caught 3 HIGH attacks:

1. The tests do not actually exercise the new code path in AnyLLMModel - they instantiate a fake provider with a canned response, so the assertion only proves the PR raises on the fake; it does not prove it raises on the real code path
2. The new check is placed AFTER prompt=prompt is set on the request in openai_responses.py, meaning a failed/incomplete response still incurs the full request construction cost and has already mutated state
3. The streaming path is not covered by this PR. Both edited files only add the status check on the non-streaming get_response branch. The PR title says 'fix: reject failed and incomplete Responses statuses' which implies both paths

Recommended fix

1. The author (ioleksiuk) should either:
   a. Extend the fix to cover the streaming path as well
   b. Rename the PR to reflect the actual scope (e.g., 'fix: reject failed and incomplete Responses statuses in non-streaming context')
2. The check should be placed BEFORE the request is constructed (to avoid the wasted work)
3. Add a test that exercises the real code path (not just a fake provider)

Cross-references

• MCE audit: Toaiagents3387 (2026-07-19), 0/4 HIT, Brier 0.55
• F-C analysis: /home/alex/.hermes/mce/fc-critiques/Toaiagents3387-with-diff.json
• PR: fix: reject failed and incomplete Responses statuses in non-streaming path #3387
• Note: this PR is marked stale

[seratch]

We haven't merge the PR yet. If you have comments, please leave comments there instead.