feat: add W3C trace-context header support for Foundry observability - #43
Merged
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
anandpant
added a commit
that referenced
this pull request
Jul 11, 2026
Three follow-ups from the independent review of PR #42: 1. Removed the registry API fallback (`DELETE /-/npm/v1/tokens/token/{token}`) from the npm token revocation step. That endpoint is the classic-token API and likely doesn't manage granular access tokens, so it was decorative resilience rather than a real fallback. `npm token revoke` is now the sole automated revocation mechanism; on failure it hard-fails immediately with a manual-revocation error, backstopped as before by the pre/post retry liveness probes. Updated check-release-policy.mjs assertions to match (assert the hard-fail behavior, assert the classic endpoint string is absent). 2. docs/RELEASING.md: note that the bootstrap granular token must be able to manage/revoke itself, and that npm's stated plan to restrict bypass-2FA/sensitive-action permissions on granular tokens sometime in 2026 may eventually break CLI self-revocation — in which case the workflow step hard-fails by design and the operator must revoke manually on npmjs.com immediately. 3. .github/workflows/ci.yml: dropped the `branches: [main]` filter from the `pull_request` trigger so stacked PRs (base != main, like this one and PR #43) actually get the full CI check suite. push stays main-only; workflow_dispatch unchanged. Confirmed release-policy-check is unaffected since it only parses release.yml. Verification: pnpm run format, the reconciliation test file (6/6), and nx run-many -t identity-check release-policy-check lint test typecheck --projects=foundry-ai all pass.
4 tasks
anandpant
force-pushed
the
feat/foundry-trace-context
branch
from
July 12, 2026 22:14
e49af23 to
0429b4c
Compare
Contributor
Author
This was referenced Jul 12, 2026
Contributor
Author
anandpant
changed the base branch from
chore/harden-bootstrap-release
to
graphite-base/43
July 12, 2026 22:18
anandpant
added a commit
that referenced
this pull request
Jul 12, 2026
Three follow-ups from the independent review of PR #42: 1. Removed the registry API fallback (`DELETE /-/npm/v1/tokens/token/{token}`) from the npm token revocation step. That endpoint is the classic-token API and likely doesn't manage granular access tokens, so it was decorative resilience rather than a real fallback. `npm token revoke` is now the sole automated revocation mechanism; on failure it hard-fails immediately with a manual-revocation error, backstopped as before by the pre/post retry liveness probes. Updated check-release-policy.mjs assertions to match (assert the hard-fail behavior, assert the classic endpoint string is absent). 2. docs/RELEASING.md: note that the bootstrap granular token must be able to manage/revoke itself, and that npm's stated plan to restrict bypass-2FA/sensitive-action permissions on granular tokens sometime in 2026 may eventually break CLI self-revocation — in which case the workflow step hard-fails by design and the operator must revoke manually on npmjs.com immediately. 3. .github/workflows/ci.yml: dropped the `branches: [main]` filter from the `pull_request` trigger so stacked PRs (base != main, like this one and PR #43) actually get the full CI check suite. push stays main-only; workflow_dispatch unchanged. Confirmed release-policy-check is unaffected since it only parses release.yml. Verification: pnpm run format, the reconciliation test file (6/6), and nx run-many -t identity-check release-policy-check lint test typecheck --projects=foundry-ai all pass.
anandpant
force-pushed
the
feat/foundry-trace-context
branch
from
July 12, 2026 22:20
0429b4c to
260151c
Compare
anandpant
added a commit
that referenced
this pull request
Jul 12, 2026
…#44) ## Summary - Adds real `embeddingModel()`/`embedding()` support to the Foundry OpenAI provider, backed by `@ai-sdk/openai`'s embedding surface pointed at Foundry's OpenAI embeddings proxy (`/api/v2/llm/proxy/openai/v1/embeddings`), reusing the existing auth/attribution/trace-context header assembly. - Adds `text-embedding-3-small` and `text-embedding-3-large` as typed convenience aliases. **Unlike the language-model endpoints, the embeddings proxy takes a plain OpenAI model string in the request body, not a Foundry RID.** Known aliases resolve to themselves; any other model string passes through unchanged, mirroring the spirit of raw-RID passthrough on the language-model path. - Anthropic and Google `embeddingModel()` continue to throw `NoSuchModelError` (Foundry only documents the OpenAI embeddings proxy). - Exports `OpenAIEmbeddingModelId` / `KnownOpenAIEmbeddingModelId` / `OPENAI_EMBEDDING_MODEL_IDS` / `OPENAI_EMBEDDING_MODELS` from the root entrypoint, additive only. - Updates docs (`docs/SPEC.md`, `packages/foundry-ai/docs/model-support.md`, `usage.md`, READMEs, skill references) to reflect embeddings support and add an `embed`/`embedMany` usage example. - Promotes the live-harness OpenAI embedding probe into a parametrized first-class row covering both models, routed through the real provider (`openai.embeddingModel(...)`) instead of a standalone direct client. Stacked on #43 (`feat/foundry-trace-context`). Note: the branch initially shipped with alias->RID resolution for embeddings (mirroring the language-model pattern). A live probe against the real Foundry embeddings proxy showed that model routing is plain-string-only for embeddings (RIDs 404, plain strings 200), so a follow-up commit (`c027750`) corrected this before review. ## Test plan - [x] `pnpm run format` - [x] `pnpm exec nx run-many -t identity-check release-policy-check lint test typecheck build skills-validate package-audit --projects=foundry-ai --outputStyle=static --skip-nx-cache` — all 8 targets pass (54/54 unit tests) - [x] Live smoke: `embed()` against the real Foundry proxy for both `text-embedding-3-small` (1536 dims) and `text-embedding-3-large` (3072 dims) — both return HTTP 200 with real vectors after the plain-model-string fix. - [ ] Merge decision left to reviewer (not auto-merged per instructions)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
traceParent/traceStateconfig fields (FOUNDRY_TRACE_PARENT/FOUNDRY_TRACE_STATEenv vars) alongside the existingattributionRid, per Palantir's LLM-provider compatible APIs docs, which state in-platform observability requires these W3C trace-context headers.traceParent/traceStateheaders (exact casing per Palantir docs) from all three provider factories (OpenAI, Anthropic, Google) when configured;headersstaysundefinedwhen nothing is set, so request headers are byte-identical to today when the new vars are unset.traceParentagainst the W3Ctraceparentformat, reusing the config module's existing error style.attributionRidcoverage.FOUNDRY_ATTRIBUTION_RID(root README, package README, usage docs, examples README, skill docs) to also cover the new vars, plus a note that third-party OAuth2 apps need theapi:use-language-models-executescope.Stacked on #42, based on
chore/harden-bootstrap-release.Test plan
pnpm run formatpnpm exec nx run-many -t identity-check release-policy-check lint test typecheck build skills-validate package-audit --projects=foundry-ai --outputStyle=static --skip-nx-cache— all targets pass (48 tests, build/typecheck/lint/identity-check/release-policy-check/skills-validate/package-audit all green)