Skip to content

feat(agents): fan out intent-tier traces to Phoenix via AOS - #21

Merged
mergify[bot] merged 1 commit into
mainfrom
feat/phoenix-traces-agentic-netops
Oct 11, 2026
Merged

mergify[bot] merged 1 commit into
mainfrom
feat/phoenix-traces-agentic-netops

Conversation

@mairp

@mairp mairp commented Oct 11, 2026 •

Copy link
Copy Markdown
Owner

What

The four intent-tier agents (supervisor / mapper / allocator / deployer) emitted OTLP once to the tier-owned collector, which fanned out to ClickHouse (agent_analytics) and feature 001 (metrics only). Traces had no queryable UI — raw ClickHouse. This adds a third trace sink: the host-side agent-observability-stack collector (Arize Phoenix, UI :3006), per research.md Decision 8 (one emission, one fan-out point).

Changes

  • deploy/agents/telemetry.yaml — otlphttp/phoenix exporter (OTLP/HTTP, gzip; the gRPC otlp exporter cannot reach Phoenix) added to the traces pipeline; endpoint from AOS_OTLP_HTTP_ENDPOINT (lab default http://172.17.0.1:4318 — the docker bridge gateway from inside kind; must always resolve or the collector fails to start). Metrics pipelines untouched.
  • deploy/agents/namespace-rbac.yaml — allow-egress-aos-otel (T051): collector pod only, ipBlock 172.17.0.1/32 TCP 4318. Without it the deny-all baseline drops the dial and the sink fails silently (observed: labelled probe pod code=000, unlabelled code=004).
  • agents/common/llm.py — stamps agentic-netops.tokens.{prompt,completion,total} on the active span next to the T333–T335 model id / redacted prompt / response. Known caveat (verified live): the SDK's context scoping currently keeps all agentic-netops.* attributes off exported spans (zero spans carry them; the T333–T335 redaction stamping is inert too), so this is redundant-but-harmless — the OpenInference instrumentation records usage natively as gen_ai.usage.* / llm.usage.total_tokens.
  • deploy/agents/README.md — Telemetry (traces) section: three sinks, T051, rollout-restart caveat (file-mounted collector config), kill switch.
  • telemetry.yaml header — T034 qualified shape marked superseded by the verified live shape (ioa-observe is a rebranded Traceloop/OpenInference SDK: OpenInference-native spans, full prompt/completion content in gen_ai.*, resolved model in ioa_observe.association.properties.ls_model_name, A2A round-trips as single traces filed under the supervisor's Phoenix project).

The grounded prompt driving this work lives at prompts/PHOENIX_TRACES_PROMPT.md — local-only, as /prompts/ is gitignored by repo convention.

Verification (live, this lab)

  • Supervisor LLM spans render as LLM with model openai/gpt-5 (fixed from the literal unknown), token counts, full prompt/completion content.
  • Agent decorator + graph-workflow spans render as AGENT; A2A round-trips (client + remote agent) arrive as single traces.
  • Harmless out-of-catalog intents only (phoenix-proof-1..5); confirmation-gated, no fabric mutation.
  • Unit: 268 passed, 4 skipped; e2e telemetry fan-out: 3 passed.

Pairs with

mairp/agent-observability-stack — PR adding the transform/phoenix_agentic_netops per-producer transform on the AOS side.

Out-of-scope notes (pre-existing, observed)

  • otlp/feature001 gRPC export from the tier collector fails (i/o timeout to 10.101.111.153:4317); zero agentic_netops_* metrics in Prometheus.
  • The AOS otlphttp/phoenix exporter shows intermittent pre-existing EOF / connection-reset errors though most batches succeed.

Traces from the four intent-tier agents were previously raw ClickHouse
only. Add a third trace sink to the tier-owned collector's fan-out
(research.md Decision 8, one emission):

- deploy/agents/telemetry.yaml: otlphttp/phoenix exporter (OTLP/HTTP,
  gzip — the otlp gRPC exporter cannot reach Phoenix) into the traces
  pipeline; endpoint from AOS_OTLP_HTTP_ENDPOINT (lab default
  http://172.17.0.1:4318, docker bridge gateway from inside kind).
  Metrics pipelines unchanged.
- deploy/agents/namespace-rbac.yaml: allow-egress-aos-otel (T051) —
  collector pod only, ipBlock 172.17.0.1/32 TCP 4318; without it the
  deny-all baseline drops the dial and the sink fails silently.
- agents/common/llm.py: stamp agentic-netops.tokens.{prompt,completion,
  total} on the active span next to the T333-T335 model id / redacted
  prompt / response. NOTE: the SDK's context scoping currently keeps
  agentic-netops.* off exported spans (verified live: zero spans carry
  them); the OpenInference instrumentation records usage natively as
  gen_ai.usage.* / llm.usage.total_tokens, so this is
  redundant-but-harmless until the SDK context is fixed.
- deploy/agents/README.md: Telemetry (traces) section — three sinks,
  T051 policy, rollout-restart caveat for the file-mounted collector
  config, kill switch, verified live span shape (OpenInference-native;
  A2A round-trips file under the supervisor's Phoenix project).
- deploy/agents/telemetry.yaml header: note that the T034 qualified
  shape is superseded by the verified live shape (see
  prompts/PHOENIX_TRACES_PROMPT.md, local-only per .gitignore).

Verified live: supervisor LLM spans render as LLM with model
(openai/gpt-5), token counts and full prompt/completion content; agent
decorator + graph-workflow spans render as AGENT; A2A round-trips
arrive as single traces. Unit: 268 passed, 4 skipped.
@mergify

mergify Bot commented Oct 11, 2026 •

Copy link
Copy Markdown
Contributor

Merge Queue Status

  • ✅ Entered queue — 2026-10-11 14:26 UTC · Rule: default · triggered by merge protections
  • ✅ Checks skipped · PR is already up-to-date
  • ✅ Merged — 2026-10-11 14:26 UTC · at a6ee4712a9d73e4d54f1fdcbe0cf7f86aef9fc1f · squash

This pull request spent 9 seconds in the queue, including 1 second running CI.

Required conditions to merge
  • github-review-approved [🛡 GitHub repository ruleset rule pr-only]
  • any of [🛡 GitHub branch protection]:
    • check-success = build-and-test
    • check-neutral = build-and-test
    • check-skipped = build-and-test
  • any of [🛡 GitHub branch protection]:
    • check-success = python-tier (openai/gpt-4o-mini)
    • check-neutral = python-tier (openai/gpt-4o-mini)
    • check-skipped = python-tier (openai/gpt-4o-mini)
  • any of [🛡 GitHub branch protection]:
    • check-success = python-tier (anthropic/claude-3-haiku)
    • check-neutral = python-tier (anthropic/claude-3-haiku)
    • check-skipped = python-tier (anthropic/claude-3-haiku)
  • any of [🛡 GitHub branch protection]:
    • check-success = ui
    • check-neutral = ui
    • check-skipped = ui
  • any of [🛡 GitHub branch protection]:
    • check-success = no-credential-literals
    • check-neutral = no-credential-literals
    • check-skipped = no-credential-literals
  • any of [🛡 GitHub branch protection]:
    • check-success = tier-absent-gates
    • check-neutral = tier-absent-gates
    • check-skipped = tier-absent-gates
  • any of [🛡 GitHub branch protection]:
    • check-success = lifecycle-idempotence
    • check-neutral = lifecycle-idempotence
    • check-skipped = lifecycle-idempotence

@mergify
mergify Bot merged commit a6ee471 into main Oct 11, 2026
11 checks passed
@mergify
mergify Bot deleted the feat/phoenix-traces-agentic-netops branch October 11, 2026 14:26
mairp added a commit that referenced this pull request Oct 19, 2026
Resolve conflicts with #19 (sonic-vm conformance profile) in favour of the
feature branch, whose versions are the measured successors of the same code:
node_sudo privilege prefix, bounded ssh with -n, seg6 probe on Loopback0 with
SKIP 77, spine resolved by name, running-AS peering, one-line image@sha256 pin
(FR-009), sonic-vm default profile (T247/T248), and docs that describe the
delivered SRv6Service. Brings in #21 (Phoenix trace fan-out) unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: mairp <oec.valle.art@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant