OnDemandFeatureView (pandas/python mode) UDF receives all response columns, not just declared sources #6158

Expected Behavior

When an OnDemandFeatureView (ODFV) is defined with a specific sources list, the UDF passed to it should only receive columns that belong to the declared sources. Accessing columns outside the declared sources should either raise an error or be impossible.

Current Behavior

In pandas and python transformation modes, the UDF receives all feature columns present in the offline response at call time — including features from feature views that are not declared in sources. This means the UDF can silently depend on undeclared sources without any warning or error.

Steps to reproduce

1. Define two feature views fv1 and fv2.
2. Define an ODFV with sources=[fv1] (mode pandas or python).
3. Write a UDF that reads a column belonging to fv2.
4. Call get_online_features requesting features from both fv1, fv2, and the ODFV simultaneously.
5. Observe that the UDF runs without error and silently uses the undeclared fv2 column.

Specifications

• Version: latest
• Platform: all
• Subsystem: OnDemandFeatureView, PandasTransformation, PythonTransformation

Possible Solution