[christso]

Summary

Implements av-kve.7 read-only Phoenix correlation/read-through for Dashboard run detail pages.

• Persists sanitized, non-secret external_trace metadata in run index entries and trace envelopes.
• Adds a narrow Dashboard BFF Phoenix read-through endpoint that uses fixed GraphQL/API calls for linked sessions, spans, annotations, and trace trees.
• Adds a Dashboard Phoenix Session panel with linked session summary, turns, trace IDs, span tree, selected span details, token/cost/timing fields, annotations, and an Open in Phoenix link.
• Documents the shipped Dashboard workflow and the Phoenix boundary.

Boundary Notes

• AgentV artifacts remain canonical for runs, traces, transcripts, datasets, experiments, and indexes.
• Phoenix reads are optional, server-side, and read-only.
• Dashboard read-through is GraphQL-first and view-specific: the normal linked-session path uses fixed Phoenix web-equivalent ProjectSession, Trace, and Span GraphQL fields for session summary, turns, root span IO, annotations, token/cost/timing fields, and trace tree/span details.
• REST is retained only as a narrow compatibility fallback when GraphQL cannot resolve a necessary session/trace case, such as older Phoenix schema mismatch or configs that provide a project name/session ID rather than a GraphQL project node ID. This avoids adding px or Phoenix client runtime deps while preserving recoverable read-through.
• Phoenix network requests use only server-configured endpoint env (AGENTV_PHOENIX_ENDPOINT, PHOENIX_HOST, and related server env aliases). Artifact external_trace.endpoint is treated as display/correlation metadata only and is never combined with server auth headers.
• Credential-like keys in Phoenix span input/output/attributes and annotation result/metadata payloads are recursively redacted before returning BFF JSON to the browser.
• Artifact tracestate metadata is filtered member-by-member so credential-like vendor keys are dropped before persistence.
• No px runtime dependency, Phoenix client dependency, direct Phoenix database access, generic GraphQL proxy, export/projection/import path, dataset creation, experiment creation, or transcript ingestion was added.
• Phoenix credentials, auth headers, cookies, and API tokens stay server-side and are not persisted into run artifacts or returned to the browser.

Validation

• bunx biome check on the touched TS/TSX files
• git diff --check
• bun --filter @agentv/core test test/evaluation/trace-envelope.test.ts
• bun --filter @agentv/core build
• bun --filter agentv typecheck
• bun --filter agentv test test/commands/eval/artifact-writer.test.ts
• bun --filter agentv test test/commands/results/serve.test.ts
• bun --filter @agentv/dashboard build
• bun --filter @agentv/dashboard test
• bun --filter @agentv/web build
• Guard searches for Phoenix client/px runtime deps, direct DB/table access, GraphQL mutations, Phoenix export/projection/dataset/experiment paths
• Manual browser UAT with a temporary run fixture and mock Phoenix API
• Scope-guard follow-up after coordinator note: bunx biome check apps/cli/src/commands/results/phoenix-readthrough.ts apps/cli/test/commands/results/serve.test.ts, git diff --check, bun --filter agentv typecheck, bun --filter agentv test test/commands/results/serve.test.ts, and repeat guard searches for Phoenix client/px, direct DB/table access, GraphQL mutations/API writes.
• Review-blocker follow-up: bunx biome check apps/cli/src/commands/results/phoenix-readthrough.ts apps/cli/test/commands/results/serve.test.ts, git diff --check, bun --filter agentv typecheck, bun --filter agentv test test/commands/results/serve.test.ts, and repeat guard searches. Added regressions for artifact endpoint non-use and credential-key scrubbing in Phoenix payload fields.
• Tracestate hygiene follow-up: bunx biome check apps/cli/src/commands/results/phoenix-readthrough.ts apps/cli/test/commands/results/serve.test.ts packages/core/src/evaluation/external-trace.ts packages/core/test/evaluation/trace-envelope.test.ts, bun --filter @agentv/core test test/evaluation/trace-envelope.test.ts, plus the focused BFF checks above.

Private browser evidence:

• Branch: EntityProcess/agentv-private:evidence/av-kve-7-phoenix-readthrough
• Commit: b8642d8
• Files: evidence/av-kve-7-phoenix-readthrough/run-detail-phoenix.png, evidence/av-kve-7-phoenix-readthrough/run-detail-phoenix.html

Post-Deploy Monitoring & Validation

• Healthy path: run detail remains readable, /phoenix-session returns ok for linked Phoenix runs or recoverable statuses for missing config/no match/unreachable/schema mismatch.
• Watch server logs for Phoenix request failed, Phoenix returned HTTP, /phoenix-session 5xx responses, and browser fetch errors on run detail pages.
• Verify no credential-like Phoenix auth values appear in run artifacts, Dashboard API responses, or logs.
• Rollback/disable path: unset Dashboard Phoenix endpoint/auth env vars; run detail should degrade to not_configured without affecting AgentV run rendering.

[cloudflare-workers-and-pages]

Deploying agentv with    Cloudflare Pages

Latest commit:	7639ab8
Status:	✅  Deploy successful!
Preview URL:	https://53d85ef3.agentv.pages.dev
Branch Preview URL:	https://feat-av-kve-7-phoenix-readth.agentv.pages.dev

View logs