Wave-36 scope: C05 L43 production OTLP metrics push by KooshaPari · Pull Request #297 · KooshaPari/SessionLedger

KooshaPari · 2026-07-17T08:46:08Z

Summary

Scoped lane only — see \WAVE36_LANE.md. Promotes OTLP metrics off Wave-33 soft stub (#276). Distinct from Wave-35 profile http_soft (#289). No SCORECARD edits.

Test plan

Implement per WAVE36_LANE.md acceptance criteria

coderabbitai · 2026-07-17T08:46:22Z

Warning

Review limit reached

@KooshaPari, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 16 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 840f4b96-33bf-4a78-9623-2ecec8d730f1

📥 Commits

Reviewing files that changed from the base of the PR and between 5a23cee and b8e79fb.

📒 Files selected for processing (10)

.github/workflows/ops-load.yml
CHANGELOG.md
WAVE36_LANE.md
crates/sl-daemon/Cargo.toml
crates/sl-daemon/src/main.rs
crates/sl-daemon/src/otel_metrics.rs
docs/ops/observability.md
docs/ops/otlp-metrics.json
docs/ops/otlp-metrics.md
scripts/otlp-metrics-check.ps1

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/sl-w36-otlp-hard

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch feat/sl-w36-otlp-hard

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist

Code Review

This pull request introduces the WAVE36_LANE.md file, which outlines the planning, acceptance criteria, and verification steps for the Wave-36 lane regarding production OTLP metrics push. The feedback points out that the document contains hardcoded absolute paths specific to a single developer's machine for both the worktree and the Cargo target directory, which should be replaced with relative or generic placeholder paths to ensure portability.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-07-17T08:49:03Z

+# Wave-36 lane: w36-otlp-hard — C05 L43 production OTLP metrics push
+
+**Branch:** `feat/sl-w36-otlp-hard`  
+**Worktree:** `C:\Users\koosh\SessionLedger-wtrees\w36-otlp-hard`  


The Worktree path is hardcoded to an absolute path on a specific user's machine. This is not portable for other developers. Please use a placeholder or a relative path to make it generic.

Suggested change

**Worktree:** `C:\Users\koosh\SessionLedger-wtrees\w36-otlp-hard`

**Worktree:** `path/to/your/w36-otlp-hard/worktree`

gemini-code-assist · 2026-07-17T08:49:03Z

+## Verify
+
+```powershell
+$env:CARGO_TARGET_DIR = "C:\Users\koosh\SessionLedger-wtrees\w36-otlp-hard\target-w36-otlp-hard"


The CARGO_TARGET_DIR is set to a hardcoded absolute path. This makes the verification steps not runnable for other developers. Please use a relative path to make this portable.

Suggested change

$env:CARGO_TARGET_DIR = "C:\Users\koosh\SessionLedger-wtrees\w36-otlp-hard\target-w36-otlp-hard"

$env:CARGO_TARGET_DIR = "target-w36-otlp-hard"

cursor

Stale comment

Risk: medium. Production OTLP metrics changes across sl-daemon, CI, and adapters exceed the low-risk approval threshold; build · test · lint also failed (rustfmt on otel_metrics.rs). Leaving for human review; no reviewers assigned (no eligible assignees besides the author).

_{Sent by Cursor Approval Agent: Pull Request Approver}

cursor

Stale comment

cursor · 2026-07-17T10:04:59Z

+        metrics_export = "otlp-grpc",
+        endpoint = %endpoint,
+        prometheus_http = "/metrics",
+        "OTLP metrics export initialized; Prometheus /metrics unchanged"


🔒 Agentic Security Review
Severity: MEDIUM
The OTLP collector endpoint is logged verbatim (endpoint = %endpoint) on successful initialization, and a similar unredacted endpoint is emitted on init failure. OTLP endpoints are frequently configured with embedded credentials (userinfo/query tokens), so this change can leak secrets into application logs.

Impact: Credential-bearing endpoint data may be exposed to anyone with log access, enabling downstream collector compromise or unauthorized telemetry ingestion.

^{Reviewed by Cursor Security Reviewer for commit 03b3e2e. Configure here.}

Co-authored-by: Cursor <cursoragent@cursor.com>

Wire MetricExporter + SdkMeterProvider when SL_OTLP_METRICS_ENDPOINT or OTEL_EXPORTER_OTLP_ENDPOINT is set. Updates otlp-metrics SSOT, SelfCheck anchors, and blocking ops-load CI job. Prometheus /metrics unchanged. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

cursor

Risk: medium. Production OTLP metrics changes across sl-daemon, CI, and ops scripts exceed the low-risk approval threshold; Cursor Bugbot was not present on this PR. Not approving; no reviewers assigned (no eligible assignees besides the author).

_{Sent by Cursor Approval Agent: Pull Request Approver}

kilo-code-bot · 2026-07-17T10:40:44Z

+            Ok(provider) => return Some(provider),
+            Err(error) => {
+                eprintln!(
+                    "warning: failed to initialize OTLP metrics export for {endpoint:?}: {error}; \


WARNING: Endpoint logged with {:?} in error path

The eprintln! on the init_exporter failure path logs the endpoint via {endpoint:?}, which mirrors the credential-exposure risk already flagged at line 92. If the endpoint contains embedded userinfo or query tokens, they will appear in stderr.

Suggested change

"warning: failed to initialize OTLP metrics export for {endpoint:?}: {error}; \

"warning: failed to initialize OTLP metrics export: {error}; \

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

kilo-code-bot · 2026-07-17T10:40:53Z

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
WARNING	1

Issue Details (click to expand)

WARNING

File	Line	Issue
`crates/sl-daemon/src/otel_metrics.rs`	51	Endpoint logged with `{:?}` in error path — the `eprintln!` on init failure exposes the OTLP endpoint, which may contain embedded credentials

Files Reviewed (3 files)

crates/sl-daemon/src/otel_metrics.rs - 1 issue
crates/sl-daemon/src/main.rs - no issues
crates/sl-daemon/Cargo.toml - no issues

Fix these issues in Kilo Cloud

_{Reviewed by step-3.7-flash · Input: 90.1K · Output: 14.6K · Cached: 348K}

gemini-code-assist Bot reviewed Jul 17, 2026

View reviewed changes

KooshaPari marked this pull request as ready for review July 17, 2026 10:01

cursor Bot reviewed Jul 17, 2026

View reviewed changes

KooshaPari and others added 3 commits July 17, 2026 03:05

docs(wave-36): scope C05 L43 production OTLP metrics lane

bda7614

Co-authored-by: Cursor <cursoragent@cursor.com>

style: rustfmt sl-daemon otel_metrics (CI)

b8e79fb

Co-authored-by: Cursor <cursoragent@cursor.com>

KooshaPari force-pushed the feat/sl-w36-otlp-hard branch from 03b3e2e to b8e79fb Compare July 17, 2026 10:07

cursor Bot reviewed Jul 17, 2026

View reviewed changes

KooshaPari merged commit 05ea304 into main Jul 17, 2026
57 of 58 checks passed

KooshaPari deleted the feat/sl-w36-otlp-hard branch July 17, 2026 10:28

kilo-code-bot Bot reviewed Jul 17, 2026

View reviewed changes

Navigation Menu

Wave-36 scope: C05 L43 production OTLP metrics push - #297

Wave-36 scope: C05 L43 production OTLP metrics push#297
KooshaPari merged 3 commits into
mainfrom
feat/sl-w36-otlp-hard

KooshaPari commented Jul 17, 2026

Uh oh!

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

Review limit reached

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jul 17, 2026

Uh oh!

gemini-code-assist Bot Jul 17, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot Jul 17, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

kilo-code-bot Bot Jul 17, 2026

Uh oh!

kilo-code-bot Bot commented Jul 17, 2026 •

edited

Loading

WARNING

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	Worktree: `C:\Users\koosh\SessionLedger-wtrees\w36-otlp-hard`
	Worktree: `path/to/your/w36-otlp-hard/worktree`

	$env:CARGO_TARGET_DIR = "C:\Users\koosh\SessionLedger-wtrees\w36-otlp-hard\target-w36-otlp-hard"
	$env:CARGO_TARGET_DIR = "target-w36-otlp-hard"

	"warning: failed to initialize OTLP metrics export for {endpoint:?}: {error}; \
	"warning: failed to initialize OTLP metrics export: {error}; \

Conversation

KooshaPari commented Jul 17, 2026

Summary

Test plan

Uh oh!

coderabbitai Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kilo-code-bot Bot Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Overview

WARNING

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jul 17, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

kilo-code-bot Bot commented Jul 17, 2026 •

edited

Loading