lightspeed-stack 0.7.0rc3__tar.gz → 0.7.1__tar.gz

{lightspeed_stack-0.7.0rc3 → lightspeed_stack-0.7.1}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.1
 Name: lightspeed-stack
-Version: 0.7.0rc3
+Version: 0.7.1
 Summary: LLM tooling stack
 Keywords: LLM,RAG
-Maintainer-Email: =?utf-8?b?UGF2ZWwgVGnFoW5vdnNrw70=?= <tisnik@centrum.cz>
+Maintainer-Email: Pavel Tišnovský <tisnik@centrum.cz>
 License:                                  Apache License
                                     Version 2.0, January 2004
                                  http://www.apache.org/licenses/
@@ -245,6 +245,8 @@ Requires-Dist: azure-identity>=1.21.0
 Requires-Dist: pyasn1>=0.6.3
 Requires-Dist: jinja2>=3.1.0
 Requires-Dist: requests>=2.33.0
+Requires-Dist: oauthlib>=4.0.0
+Requires-Dist: PyJWT>=2.15.1
 Requires-Dist: datasets>=4.7.0
 Requires-Dist: sentry-sdk[fastapi]>=2.58.0
 Requires-Dist: python-dotenv>=1.2.2
@@ -958,7 +960,7 @@ user_data_collection:
 > [!WARNING]
 > The legacy two-file setup (`library_client_config_path:` pointing at an
 > externally maintained `run.yaml`) is deprecated — it logs a startup
-> warning since 0.6 and is removed in 0.7. See the
+> warning since 0.6 and is removed in 0.8. See the
 > [migration guide](docs/user_doc/deployment_guide.md#migrating-from-the-legacy-two-file-configuration).
 
 ## OGX version check
@@ -1232,7 +1234,6 @@ distribution-archives             Generate distribution archives to be uploaded
 upload-distribution-archives      Upload distribution archives into Python registry
 konflux-requirements              Generate hermetic requirements.*.txt file for Konflux build
 konflux-rpm-lock                  Generate rpm.lock.yaml file for Konflux build
-konflux-artifacts-lock            Regenerate artifacts.lock.yaml file for Konflux build
 help                              Show this help screen
 ```
 
@@ -1318,7 +1319,7 @@ ogx:
   use_as_library_client: true
   # Unified mode: the mounted run.yaml is the synthesis profile. (The
   # legacy library_client_config_path equivalent is deprecated, removed
-  # in 0.7.)
+  # in 0.8.)
   config:
     profile: /app-root/run.yaml
 ```
@@ -1773,7 +1774,7 @@ Update these files when you:
 make konflux-requirements
 ```
 
-This compiles Python dependencies from `pyproject.toml` using `uv`, splits packages by their source index (PyPI vs Red Hat's internal registry), and generates hermetic requirements files with pinned versions and hashes for Konflux builds.
+This compiles Python dependencies from `pyproject.toml` using a fork of `uv` that supports a "prefer-index" package version resolution policy, splits packages by their source index (PyPI vs Red Hat's internal registry), and generates hermetic requirements files with pinned versions and hashes for Konflux builds.
 
 **Files produced:**
 - `.konflux/requirements.hashes.source.txt` – PyPI packages with hashes

{lightspeed_stack-0.7.0rc3 → lightspeed_stack-0.7.1}/README.md

@@ -700,7 +700,7 @@ user_data_collection:
 > [!WARNING]
 > The legacy two-file setup (`library_client_config_path:` pointing at an
 > externally maintained `run.yaml`) is deprecated — it logs a startup
-> warning since 0.6 and is removed in 0.7. See the
+> warning since 0.6 and is removed in 0.8. See the
 > [migration guide](docs/user_doc/deployment_guide.md#migrating-from-the-legacy-two-file-configuration).
 
 ## OGX version check
@@ -974,7 +974,6 @@ distribution-archives             Generate distribution archives to be uploaded
 upload-distribution-archives      Upload distribution archives into Python registry
 konflux-requirements              Generate hermetic requirements.*.txt file for Konflux build
 konflux-rpm-lock                  Generate rpm.lock.yaml file for Konflux build
-konflux-artifacts-lock            Regenerate artifacts.lock.yaml file for Konflux build
 help                              Show this help screen
 ```
 
@@ -1060,7 +1059,7 @@ ogx:
   use_as_library_client: true
   # Unified mode: the mounted run.yaml is the synthesis profile. (The
   # legacy library_client_config_path equivalent is deprecated, removed
-  # in 0.7.)
+  # in 0.8.)
   config:
     profile: /app-root/run.yaml
 ```
@@ -1515,7 +1514,7 @@ Update these files when you:
 make konflux-requirements
 ```
 
-This compiles Python dependencies from `pyproject.toml` using `uv`, splits packages by their source index (PyPI vs Red Hat's internal registry), and generates hermetic requirements files with pinned versions and hashes for Konflux builds.
+This compiles Python dependencies from `pyproject.toml` using a fork of `uv` that supports a "prefer-index" package version resolution policy, splits packages by their source index (PyPI vs Red Hat's internal registry), and generates hermetic requirements files with pinned versions and hashes for Konflux builds.
 
 **Files produced:**
 - `.konflux/requirements.hashes.source.txt` – PyPI packages with hashes

{lightspeed_stack-0.7.0rc3 → lightspeed_stack-0.7.1}/pyproject.toml

@@ -51,6 +51,8 @@ dependencies = [
     "pyasn1>=0.6.3",
     "jinja2>=3.1.0",
     "requests>=2.33.0",
+    "oauthlib>=4.0.0",
+    "PyJWT>=2.15.1",
     "datasets>=4.7.0",
     "sentry-sdk[fastapi]>=2.58.0",
     "python-dotenv>=1.2.2",
@@ -61,7 +63,7 @@ dependencies = [
     "opentelemetry-exporter-otlp>=1.34.1",
     "opentelemetry-instrumentation-fastapi>=0.49b0",
 ]
-version = "0.7.0rc3"
+version = "0.7.1"
 
 [project.license]
 file = "LICENSE"
@@ -133,6 +135,10 @@ extend-exclude = [
 
 [tool.ruff.lint]
 extend-select = [
+    "C",
+    "FA",
+    "FLY",
+    "I",
     "TID251",
     "UP006",
     "UP007",
@@ -148,9 +154,9 @@ extend-select = [
     "B009",
     "B010",
     "B011",
+    "BLE",
     "DTZ005",
     "D202",
-    "I001",
     "PLR1733",
     "RUF022",
     "PLW1510",
@@ -159,13 +165,13 @@ extend-select = [
     "PERF402",
     "FURB129",
     "RET501",
+    "LOG",
 ]
 ignore = [
     "UP047",
     "UP045",
-    "BLE",
     "S",
-    "C",
+    "C901",
     "RUF",
     "SIM",
     "B017",
@@ -177,7 +183,6 @@ ignore = [
     "EXE001",
     "G201",
     "ISC004",
-    "LOG014",
     "PYI034",
     "PYI064",
 ]
@@ -224,6 +229,7 @@ dev = [
     "memray>=1.13.0",
     "pygal>=3.1.3",
     "pygaljs>=1.0.2",
+    "pdm>=2.29.2",
 ]
 ogxlibdev = [
     "tree_sitter>=0.24.0",

{lightspeed_stack-0.7.0rc3 → lightspeed_stack-0.7.1}/src/app/endpoints/a2a.py

@@ -158,11 +158,11 @@ def _record_model_span(span: trace.Span, model_id: str) -> None:
         span: The active OpenTelemetry span.
         model_id: Full model identifier in "provider/model" format.
     """
-    provider_id, _ = extract_provider_and_model_from_model_id(model_id)
+    provider_id, bare_model_id = extract_provider_and_model_from_model_id(model_id)
     set_span_attributes(
         span,
         {
-            SpanAttributes.LLM_MODEL_ID: model_id,
+            SpanAttributes.LLM_MODEL_ID: bare_model_id,
             SpanAttributes.LLM_PROVIDER_ID: provider_id,
         },
     )
@@ -172,6 +172,8 @@ def _record_execution_span(
     span: trace.Span,
     tool_call_names: list[str],
     run_result: Optional[AgentRunResult[str]],
+    compacted: bool,
+    inference_time: float,
 ) -> None:
     """Record tool-call metrics, token usage, and output on an a2a.execute span.
 
@@ -179,6 +181,8 @@ def _record_execution_span(
         span: The active OpenTelemetry span.
         tool_call_names: Tool names collected during streaming.
         run_result: Completed agent run result, or None.
+        compacted: Whether the turn used compacted conversation context.
+        inference_time: Request processing duration in seconds.
     """
     if tool_call_names:
         set_span_attributes(
@@ -203,7 +207,10 @@ def _record_execution_span(
 
         output_text = run_result.response.text
         if output_text:
-            span.set_attribute(SpanAttributes.OUTPUT, anonymize_value(output_text))
+            span.set_attribute(SpanAttributes.OUTPUT, output_text)
+
+    span.set_attribute(SpanAttributes.COMPACTED, compacted)
+    span.set_attribute(SpanAttributes.INFERENCE_TIME, inference_time)
 
 
 async def _persist_compacted_a2a_turn(
@@ -385,7 +392,7 @@ class A2AAgentExecutor(AgentExecutor):
                     "Failed to publish failure event: %s", enqueue_error, exc_info=True
                 )
 
-    async def _process_task_streaming(  # pylint: disable=too-many-locals
+    async def _process_task_streaming(  # pylint: disable=too-many-locals,too-many-statements
         self,
         context: RequestContext,
         task_updater: TaskUpdater,
@@ -405,6 +412,7 @@ class A2AAgentExecutor(AgentExecutor):
 
         with tracer.start_as_current_span("a2a.execute") as span:
             span.set_attribute(SpanAttributes.SESSION_ID, context_id)
+            started_at = datetime.now(UTC)
 
             # Extract user input using SDK utility
             user_input = context.get_user_input()
@@ -420,7 +428,7 @@ class A2AAgentExecutor(AgentExecutor):
                 )
                 return
 
-            span.set_attribute(SpanAttributes.INPUT, anonymize_value(user_input))
+            span.set_attribute(SpanAttributes.INPUT, user_input)
             preview = user_input[:200] + ("..." if len(user_input) > 200 else "")
             logger.info("Processing A2A request: %s", preview)
 
@@ -578,7 +586,13 @@ class A2AAgentExecutor(AgentExecutor):
                 client, responses_params, compaction, agent, task_id
             )
 
-            _record_execution_span(span, self._tool_call_names, self._run_result)
+            _record_execution_span(
+                span,
+                self._tool_call_names,
+                self._run_result,
+                compaction.compacted,
+                (datetime.now(UTC) - started_at).total_seconds(),
+            )
 
             # Publish the final task result event
             if aggregator.task_state == TaskState.working:
@@ -1086,7 +1100,7 @@ async def _handle_a2a_jsonrpc(  # pylint: disable=too-many-locals,too-many-state
                 logger.warning(
                     "Could not parse A2A request body for method detection: %s", str(e)
                 )
-    except Exception as e:  # pylint: disable=broad-except
+    except Exception as e:  # pylint: disable=broad-except  # noqa: BLE001
         logger.error("Error detecting streaming request: %s", str(e))
 
     with tracer.start_as_current_span("a2a.dispatch") as span:
@@ -1094,9 +1108,7 @@ async def _handle_a2a_jsonrpc(  # pylint: disable=too-many-locals,too-many-state
             span,
             {
                 SpanAttributes.A2A_RPC_METHOD: rpc_method,
-                SpanAttributes.A2A_REQUEST_ID: (
-                    anonymize_value(rpc_request_id) if rpc_request_id else ""
-                ),
+                SpanAttributes.A2A_REQUEST_ID: rpc_request_id if rpc_request_id else "",
                 SpanAttributes.USER_ID: anonymize_value(auth[0]) if auth[0] else "",
             },
         )
@@ -1226,7 +1238,7 @@ async def _handle_a2a_jsonrpc(  # pylint: disable=too-many-locals,too-many-state
         return Response(
             content=b"".join(response_body),
             status_code=status_code,
-            headers=dict((k.decode(), v.decode()) for k, v in headers),
+            headers={k.decode(): v.decode() for k, v in headers},
         )
 
 

{lightspeed_stack-0.7.0rc3 → lightspeed_stack-0.7.1}/src/app/endpoints/conversations_v1.py

@@ -1,4 +1,14 @@
-"""Handler for REST API calls to manage conversation history using Conversations API."""
+"""Handler for REST API calls to manage conversation history using Conversations API.
+
+These routes use OGX Conversations persistence. They are deprecated and will be
+removed in a later LCS release when OGX is dropped from the stack. Use
+``/v2/conversations`` instead (LCORE-owned storage).
+"""
+
+CONVERSATIONS_V1_DEPRECATED_REASON: str = (
+    "OGX-backed Conversations API; deprecated and scheduled for removal. "
+    "Use /v2/conversations instead."
+)
 
 from typing import Any
 
@@ -7,6 +17,7 @@ from ogx_api import ConversationNotFoundError, InvalidParameterError
 from ogx_client import ApiException
 from opentelemetry import trace
 from sqlalchemy.exc import SQLAlchemyError
+from typing_extensions import deprecated
 
 from app.database import get_session
 from authentication import get_auth_dependency
@@ -56,7 +67,10 @@ from utils.types import Responses
 
 logger = get_logger(__name__)
 tracer = trace.get_tracer(__name__)
-router = APIRouter(tags=["conversations_v1"])
+router = APIRouter(
+    tags=["conversations_v1"],
+    deprecated=True,
+)
 
 conversation_get_responses: Responses = {
     200: ConversationResponse.openapi_response(),
@@ -120,6 +134,7 @@ conversation_update_responses: Responses = {
     summary="Conversations List Endpoint Handler V1",
 )
 @authorize(Action.LIST_CONVERSATIONS)
+@deprecated(CONVERSATIONS_V1_DEPRECATED_REASON)
 async def get_conversations_list_endpoint_handler(
     request: Request,
     auth: Any = Depends(get_auth_dependency()),
@@ -186,6 +201,7 @@ async def get_conversations_list_endpoint_handler(
     summary="Conversation Get Endpoint Handler V1",
 )
 @authorize(Action.GET_CONVERSATION)
+@deprecated(CONVERSATIONS_V1_DEPRECATED_REASON)
 async def get_conversation_endpoint_handler(  # pylint: disable=too-many-locals,too-many-statements
     request: Request,
     conversation_id: str,
@@ -200,6 +216,15 @@ async def get_conversation_endpoint_handler(  # pylint: disable=too-many-locals,
     if not found, 503 if the backend is unavailable, and 500 for
     unexpected errors.
 
+    Note: ``tool_calls``/``tool_results`` here reflect OGX's raw,
+    unredacted item history. If a Granite Guardian TOOL-point guardrail
+    later blocks a tool result, only the final assistant message in OGX's
+    store is patched (see ``replace_last_assistant_message``) -- the tool
+    item itself still shows the original, unredacted content. The v2/v3
+    conversation reads (backed by LCORE's own conversation cache) are the
+    guardrail-authoritative view; see "Troubleshooting" in
+    ``docs/devel_doc/conversations_api.md`` for details.
+
     Args:
         request: The FastAPI request object
         conversation_id: Unique identifier of the conversation to retrieve
@@ -308,6 +333,7 @@ async def get_conversation_endpoint_handler(  # pylint: disable=too-many-locals,
     summary="Conversation Delete Endpoint Handler V1",
 )
 @authorize(Action.DELETE_CONVERSATION)
+@deprecated(CONVERSATIONS_V1_DEPRECATED_REASON)
 async def delete_conversation_endpoint_handler(
     request: Request,
     conversation_id: str,
@@ -428,6 +454,7 @@ async def delete_conversation_endpoint_handler(
     summary="Conversation Update Endpoint Handler V1",
 )
 @authorize(Action.UPDATE_CONVERSATION)
+@deprecated(CONVERSATIONS_V1_DEPRECATED_REASON)
 async def update_conversation_endpoint_handler(  # pylint: disable=too-many-statements
     request: Request,
     conversation_id: str,

{lightspeed_stack-0.7.0rc3 → lightspeed_stack-0.7.1}/src/app/endpoints/feedback.py

@@ -107,8 +107,9 @@ def _record_feedback_request_attributes(
     """Set high-level feedback attributes on the root span.
 
     User-generated free text (the question, LLM response, and comment) is
-    anonymized before being recorded. Low-cardinality signals (rating and
-    categories) are recorded as-is.
+    recorded as raw content; anonymization is handled downstream at ingestion.
+    Only the user identifier is anonymized at emission. Low-cardinality signals
+    (rating and categories) are recorded as-is.
 
     Parameters:
         span: The root feedback span to annotate.
@@ -121,8 +122,8 @@ def _record_feedback_request_attributes(
             SpanAttributes.FEEDBACK_OPERATION: "submit",
             SpanAttributes.USER_ID: anonymize_value(user_id) if user_id else "",
             SpanAttributes.FEEDBACK_CONVERSATION: feedback_request.conversation_id,
-            SpanAttributes.INPUT: anonymize_value(feedback_request.user_question),
-            SpanAttributes.OUTPUT: anonymize_value(feedback_request.llm_response),
+            SpanAttributes.INPUT: feedback_request.user_question,
+            SpanAttributes.OUTPUT: feedback_request.llm_response,
         },
     )
     if feedback_request.sentiment is not None:
@@ -130,7 +131,7 @@ def _record_feedback_request_attributes(
     if feedback_request.user_feedback:
         span.set_attribute(
             SpanAttributes.FEEDBACK_COMMENT,
-            anonymize_value(feedback_request.user_feedback),
+            feedback_request.user_feedback,
         )
     if feedback_request.categories:
         span.set_attribute(

{lightspeed_stack-0.7.0rc3 → lightspeed_stack-0.7.1}/src/app/endpoints/info.py

@@ -20,7 +20,7 @@ from models.api.responses.error import (
 )
 from models.api.responses.successful import InfoResponse
 from models.config import Action
-from utils.otel_tracing import set_span_attributes
+from utils.otel_tracing import SpanAttributes, set_span_attributes
 from utils.types import Responses
 from version import __version__
 
@@ -85,8 +85,8 @@ async def info_endpoint_handler(
             set_span_attributes(
                 span,
                 {
-                    "service.name": configuration.configuration.name,
-                    "service.version": __version__,
+                    SpanAttributes.SERVICE_NAME: configuration.configuration.name,
+                    SpanAttributes.SERVICE_VERSION: __version__,
                 },
             )
             return InfoResponse(

{lightspeed_stack-0.7.0rc3 → lightspeed_stack-0.7.1}/src/app/endpoints/query.py

@@ -44,11 +44,11 @@ from utils.otel_tracing import (
     SpanEvents,
     add_span_event,
     anonymize_value,
+    root_span_turn_attributes,
     set_span_attributes,
 )
 from utils.query import (
     consume_query_tokens,
-    prepare_input,
     store_query_results,
     validate_attachments_metadata,
     validate_model_provider_override,
@@ -59,7 +59,7 @@ from utils.responses import (
     maybe_get_topic_summary,
     prepare_responses_params,
 )
-from utils.shields import run_shield_moderation, validate_shield_ids_override
+from utils.shields import validate_shield_ids_override
 from utils.suid import normalize_conversation_id
 from utils.types import Responses
 from utils.vector_search import build_rag_context
@@ -161,7 +161,7 @@ async def _handle_query_with_tracing(
         root_span,
         {
             SpanAttributes.USER_ID: anonymize_value(user_id),
-            SpanAttributes.INPUT: anonymize_value(query_request.query),
+            SpanAttributes.INPUT: query_request.query,
             SpanAttributes.REQUEST_ATTACHMENTS_COUNT: (
                 len(query_request.attachments) if query_request.attachments else 0
             ),
@@ -205,18 +205,12 @@ async def _handle_query_with_tracing(
 
     client = AsyncOgxClientHolder().get_client()
 
-    # Moderation input is the raw user content (query + attachments) without injected RAG
-    # context, to avoid false positives from retrieved document content.
+    # Input shields run as pydantic-ai capabilities on the agent.
     endpoint_path = ENDPOINT_PATH_QUERY
-    moderation_input = prepare_input(query_request)
-    moderation_result = await run_shield_moderation(
-        client, moderation_input, endpoint_path, query_request.shield_ids
-    )
 
     # Build RAG context from Inline RAG sources
     inline_rag_context = await build_rag_context(
         client,
-        moderation_result.decision,
         query_request.query,
         query_request.vector_store_ids,
         query_request.solr,
@@ -269,7 +263,6 @@ async def _handle_query_with_tracing(
     turn_summary = await retrieve_agent_response(
         client,
         responses_params,
-        moderation_result,
         endpoint_path,
         compaction.original_input if compaction.compacted else None,
         shield_ids=query_request.shield_ids,
@@ -277,19 +270,18 @@ async def _handle_query_with_tracing(
         image_attachments=image_attachments,
     )
 
-    if moderation_result.decision == "passed":
-        # Combine inline RAG results (BYOK + Solr) with tool-based RAG results for the transcript
-        rag_chunks = inline_rag_context.rag_chunks
-        tool_rag_chunks = turn_summary.rag_chunks
-        logger.info("RAG as a tool retrieved %d chunks", len(tool_rag_chunks))
-        turn_summary.rag_chunks = rag_chunks + tool_rag_chunks
-
-        # Add tool-based RAG documents and chunks
-        rag_documents = inline_rag_context.referenced_documents
-        tool_rag_documents = turn_summary.referenced_documents
-        turn_summary.referenced_documents = deduplicate_referenced_documents(
-            rag_documents + tool_rag_documents
-        )
+    # Combine inline RAG results (BYOK + Solr) with tool-based RAG results for the transcript
+    rag_chunks = inline_rag_context.rag_chunks
+    tool_rag_chunks = turn_summary.rag_chunks
+    logger.info("RAG as a tool retrieved %d chunks", len(tool_rag_chunks))
+    turn_summary.rag_chunks = rag_chunks + tool_rag_chunks
+
+    # Add tool-based RAG documents and chunks
+    rag_documents = inline_rag_context.referenced_documents
+    tool_rag_documents = turn_summary.referenced_documents
+    turn_summary.referenced_documents = deduplicate_referenced_documents(
+        rag_documents + tool_rag_documents
+    )
 
     # Get topic summary for new conversation
     should_generate = not user_conversation and bool(
@@ -335,15 +327,10 @@ async def _handle_query_with_tracing(
 
     logger.info("Building final response")
 
-    # Set final span attributes
+    # Set final root-span attributes (llm.* attrs live on the llm.inference span)
     set_span_attributes(
         root_span,
-        {
-            SpanAttributes.SESSION_ID: conversation_id,
-            SpanAttributes.LLM_USAGE_INPUT_TOKENS: turn_summary.token_usage.input_tokens,
-            SpanAttributes.LLM_USAGE_OUTPUT_TOKENS: turn_summary.token_usage.output_tokens,
-            SpanAttributes.OUTPUT: anonymize_value(turn_summary.llm_response),
-        },
+        root_span_turn_attributes(turn_summary, conversation_id, compaction.compacted),
     )
 
     # Emit LLM response completed event