policyengine-observability 3.0.0__tar.gz → 3.0.2__tar.gz

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [3.0.2] - 2026-09-30
+
+### Fixed
+
+- Add process-scoped service instance identities and preserve dispatch attributes on nested operations.
+
+
+## [3.0.1] - 2026-09-28
+
+### Fixed
+
+- Preserve configured dispatch attributes across asynchronous operations, include them in correlated structured logs and nested spans, accept safe scalar application attributes by default, and remove the attribute-count limit.
+
+
 ## [3.0.0] - 2026-09-23
 
 ### Breaking changes

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: policyengine-observability
-Version: 3.0.0
+Version: 3.0.2
 Summary: Shared PolicyEngine observability runtime for logs, timings, metrics, and OpenTelemetry.
 Author-email: PolicyEngine <hello@policyengine.org>
 License-File: LICENSE
@@ -106,12 +106,17 @@ config = ObservabilityConfig(
         traces=OTLPExporterConfig(endpoint="collector:4317"),
         metrics=OTLPExporterConfig(endpoint="collector:4317"),
     ),
-    application_attribute_keys=frozenset({"country_id", "backend"}),
     dispatch_attribute_keys=frozenset({"job_id", "run_id"}),
 )
 runtime = configure(config)
 ```
 
+Local logs and spans accept explicitly supplied safe scalar attributes by
+default. Set `application_attribute_keys` to a `frozenset` only when a consumer
+needs a strict local attribute allowlist. Asynchronous context still transports
+only `dispatch_attribute_keys`, and metrics still use their separate
+low-cardinality allowlist.
+
 `configure` validates the complete configuration before it creates workers,
 exporters, or logging handlers. Invalid values raise `ConfigurationError` with
 the fields that must be corrected. Unavailable credentials or destinations
@@ -346,19 +351,65 @@ instrument_httpx(client, runtime)
 The request hook injects active W3C context and the PolicyEngine request ID.
 Other clients in the process remain unchanged.
 
-For asynchronous dispatch, serialize the bounded correlation context with the
-job request and restore it around the worker operation:
+For asynchronous dispatch, send the bounded observability context as transport
+metadata beside the application payload and restore it around the worker
+operation:
 
 ```python
-request.observability_context = runtime.capture_context()
+observability_context = runtime.capture_context()
+worker.spawn(
+    payload,
+    observability_context=observability_context,
+)
 
-with runtime.operation(
-    "simulation.run",
-    remote_context=request.observability_context,
-):
-    return run_simulation(request)
+def worker(payload, *, observability_context=None):
+    with runtime.operation(
+        "simulation.run",
+        remote_context=observability_context,
+    ):
+        return run_simulation(payload)
+```
+
+`capture_context()` includes W3C trace context, its capture time, the active
+PolicyEngine request ID, and scalar attributes named by
+`dispatch_attribute_keys`. Starting the remote operation restores only those
+configured dispatch attributes. They remain available to nested
+`capture_context()` calls and are attached to logs, nested operations, and
+nested spans inside the operation. They are never added to metric labels
+unless separately included in `metric_attribute_keys`.
+
+Keep this context separate from the application payload. Invalid or stale
+trace context can reduce correlation, but it does not prevent the observed
+application code from running. A recent direct dispatch continues the trace;
+delayed, retry, and aggregate work starts a trace linked to the dispatch span.
+
+## Process identity
+
+OpenTelemetry resource attributes require `service.instance.id` to identify
+one telemetry-producing process. Deployment revisions identify code shared by
+multiple containers and workers, so they must not be used alone as the process
+identity. Construct the deployment identity after the application process has
+started:
+
+```python
+import os
+
+from policyengine_observability import DeploymentIdentity, process_instance_id
+
+service_name = "example-api"
+deployment = DeploymentIdentity(
+    environment="production",
+    platform="google_cloud_run",
+    region="us-central1",
+    instance_id=process_instance_id(service_name, os.getenv("K_REVISION")),
+)
 ```
 
+The helper returns one stable value for a service within the current process.
+It combines the optional platform identifier with a process ID and random UUID,
+so separate workers and containers cannot publish cumulative metrics under the
+same resource identity. A child process receives a new value on its first call.
+
 ## Process restoration and shutdown
 
 After a process image or memory snapshot is restored, rebuild process-local

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/README.md

@@ -60,12 +60,17 @@ config = ObservabilityConfig(
         traces=OTLPExporterConfig(endpoint="collector:4317"),
         metrics=OTLPExporterConfig(endpoint="collector:4317"),
     ),
-    application_attribute_keys=frozenset({"country_id", "backend"}),
     dispatch_attribute_keys=frozenset({"job_id", "run_id"}),
 )
 runtime = configure(config)
 ```
 
+Local logs and spans accept explicitly supplied safe scalar attributes by
+default. Set `application_attribute_keys` to a `frozenset` only when a consumer
+needs a strict local attribute allowlist. Asynchronous context still transports
+only `dispatch_attribute_keys`, and metrics still use their separate
+low-cardinality allowlist.
+
 `configure` validates the complete configuration before it creates workers,
 exporters, or logging handlers. Invalid values raise `ConfigurationError` with
 the fields that must be corrected. Unavailable credentials or destinations
@@ -300,19 +305,65 @@ instrument_httpx(client, runtime)
 The request hook injects active W3C context and the PolicyEngine request ID.
 Other clients in the process remain unchanged.
 
-For asynchronous dispatch, serialize the bounded correlation context with the
-job request and restore it around the worker operation:
+For asynchronous dispatch, send the bounded observability context as transport
+metadata beside the application payload and restore it around the worker
+operation:
 
 ```python
-request.observability_context = runtime.capture_context()
+observability_context = runtime.capture_context()
+worker.spawn(
+    payload,
+    observability_context=observability_context,
+)
 
-with runtime.operation(
-    "simulation.run",
-    remote_context=request.observability_context,
-):
-    return run_simulation(request)
+def worker(payload, *, observability_context=None):
+    with runtime.operation(
+        "simulation.run",
+        remote_context=observability_context,
+    ):
+        return run_simulation(payload)
+```
+
+`capture_context()` includes W3C trace context, its capture time, the active
+PolicyEngine request ID, and scalar attributes named by
+`dispatch_attribute_keys`. Starting the remote operation restores only those
+configured dispatch attributes. They remain available to nested
+`capture_context()` calls and are attached to logs, nested operations, and
+nested spans inside the operation. They are never added to metric labels
+unless separately included in `metric_attribute_keys`.
+
+Keep this context separate from the application payload. Invalid or stale
+trace context can reduce correlation, but it does not prevent the observed
+application code from running. A recent direct dispatch continues the trace;
+delayed, retry, and aggregate work starts a trace linked to the dispatch span.
+
+## Process identity
+
+OpenTelemetry resource attributes require `service.instance.id` to identify
+one telemetry-producing process. Deployment revisions identify code shared by
+multiple containers and workers, so they must not be used alone as the process
+identity. Construct the deployment identity after the application process has
+started:
+
+```python
+import os
+
+from policyengine_observability import DeploymentIdentity, process_instance_id
+
+service_name = "example-api"
+deployment = DeploymentIdentity(
+    environment="production",
+    platform="google_cloud_run",
+    region="us-central1",
+    instance_id=process_instance_id(service_name, os.getenv("K_REVISION")),
+)
 ```
 
+The helper returns one stable value for a service within the current process.
+It combines the optional platform identifier with a process ID and random UUID,
+so separate workers and containers cannot publish cumulative metrics under the
+same resource identity. A child process receives a new value on its first call.
+
 ## Process restoration and shutdown
 
 After a process image or memory snapshot is restored, rebuild process-local

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/docs/engineering/skills/repository-guidance.md

@@ -62,6 +62,20 @@ uv run --extra dev towncrier check --compare-with origin/main
   without breaking the application operation being observed.
 - Preserve structured log schemas. Make additive changes when possible; bump
   schema versions for breaking payload changes.
+- Treat `capture_context()` output as transport metadata beside an application
+  payload. Pass it to the receiver's outer `operation` through
+  `remote_context`; do not insert it into business request models.
+- Restore only attributes explicitly listed in `dispatch_attribute_keys`.
+  Those attributes must remain available to nested dispatches and structured
+  logs and must be attached to nested operations and spans, but must not become
+  metric labels unless independently allowlisted in `metric_attribute_keys`.
+- Accept explicitly supplied safe scalar attributes in local logs and spans by
+  default. Use `application_attribute_keys` only when a consumer requires a
+  strict local allowlist. Do not use that optional local policy to decide what
+  crosses a process boundary or becomes a metric label.
+- Let explicitly supplied receiver attributes override matching remote
+  attributes. Malformed remote context may reduce telemetry but must not stop
+  the observed operation.
 - Keep metric attributes bounded and low-cardinality. Do not put raw paths,
   full URLs, request bodies, or unbounded user-provided values into metric
   labels.
@@ -73,6 +87,9 @@ uv run --extra dev towncrier check --compare-with origin/main
 Add focused tests for context behavior and failure paths whenever changing
 the runtime or its components. The corresponding `tests/test_runtime_*.py`
 modules cover operations, requests, spans, log emission, and tracing.
+Remote-context tests must exercise two runtime instances and prove that
+configured dispatch attributes survive capture, restoration, logs, spans, and
+a subsequent capture. Include malformed context and local-override cases.
 Adapter changes should include framework-level tests that exercise request
 setup, response headers, error paths, and teardown behavior.
 

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/policyengine_observability/__init__.py

@@ -21,6 +21,7 @@ from .destinations import (
     StdoutLogDestination,
 )
 from .google_auth import GoogleIdTokenAuth
+from .identity import process_instance_id
 from .integrations import instrument_httpx
 from .runtime import (
     REQUEST_ID_HEADER,
@@ -61,4 +62,5 @@ __all__ = [
     "instrument_flask",
     "instrument_httpx",
     "instrument_logging",
+    "process_instance_id",
 ]

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/policyengine_observability/config.py

@@ -22,8 +22,6 @@ class ConfigurationError(ValueError):
         super().__init__(f"Invalid observability configuration:\n{details}")
 
 
-DEFAULT_APPLICATION_ATTRIBUTE_KEYS = frozenset(set())
-
 DEFAULT_DISPATCH_ATTRIBUTE_KEYS = frozenset(set())
 
 DEFAULT_METRIC_ATTRIBUTE_KEYS = frozenset(
@@ -106,7 +104,6 @@ class OTelConfig:
 
 @dataclass(frozen=True, slots=True)
 class TelemetryLimits:
-    max_attributes: int = 32
     max_string_length: int = 1_024
     max_error_message_length: int = 2_048
     max_stack_length: int = 16_384
@@ -120,9 +117,7 @@ class ObservabilityConfig:
     logging: LoggingConfig = field(default_factory=LoggingConfig)
     otel: OTelConfig = field(default_factory=OTelConfig)
     limits: TelemetryLimits = field(default_factory=TelemetryLimits)
-    application_attribute_keys: frozenset[str] = (
-        DEFAULT_APPLICATION_ATTRIBUTE_KEYS
-    )
+    application_attribute_keys: frozenset[str] | None = None
     dispatch_attribute_keys: frozenset[str] = DEFAULT_DISPATCH_ATTRIBUTE_KEYS
     metric_attribute_keys: frozenset[str] = DEFAULT_METRIC_ATTRIBUTE_KEYS
     sensitive_values: tuple[str, ...] = ()
@@ -224,11 +219,7 @@ class ObservabilityConfig:
                 ),
             ),
             limits=limits or TelemetryLimits(),
-            application_attribute_keys=(
-                application_attribute_keys
-                if application_attribute_keys is not None
-                else DEFAULT_APPLICATION_ATTRIBUTE_KEYS
-            ),
+            application_attribute_keys=application_attribute_keys,
             dispatch_attribute_keys=(
                 dispatch_attribute_keys
                 if dispatch_attribute_keys is not None
@@ -278,19 +269,18 @@ class ObservabilityConfig:
                         "string."
                     )
 
+        if self.application_attribute_keys is not None:
+            _attribute_key_errors(
+                errors,
+                "application_attribute_keys",
+                self.application_attribute_keys,
+            )
+
         for name, values in (
-            ("application_attribute_keys", self.application_attribute_keys),
             ("dispatch_attribute_keys", self.dispatch_attribute_keys),
             ("metric_attribute_keys", self.metric_attribute_keys),
         ):
-            if not isinstance(values, frozenset):
-                errors.append(
-                    f"{name} must be a frozenset of non-empty strings."
-                )
-                continue
-            for value in values:
-                if not isinstance(value, str) or not value.strip():
-                    errors.append(f"{name} entries must be non-empty strings.")
+            _attribute_key_errors(errors, name, values)
 
         _choice_error(
             errors,
@@ -421,7 +411,6 @@ class ObservabilityConfig:
             )
 
         for name, value in {
-            "limits.max_attributes": self.limits.max_attributes,
             "limits.max_string_length": self.limits.max_string_length,
             "limits.max_error_message_length": self.limits.max_error_message_length,
             "limits.max_stack_length": self.limits.max_stack_length,
@@ -436,6 +425,14 @@ class ObservabilityConfig:
         )
         return tuple(errors)
 
+    @property
+    def local_attribute_keys(self) -> frozenset[str] | None:
+        """Return the optional strict allowlist for local logs and spans."""
+
+        if self.application_attribute_keys is None:
+            return None
+        return self.application_attribute_keys | self.dispatch_attribute_keys
+
     def diagnostics(self) -> tuple[str, ...]:
         messages: list[str] = []
         if (
@@ -623,6 +620,19 @@ def _env_int(
     return parsed
 
 
+def _attribute_key_errors(
+    errors: list[str],
+    name: str,
+    values: object,
+) -> None:
+    if not isinstance(values, frozenset):
+        errors.append(f"{name} must be a frozenset of non-empty strings.")
+        return
+    for value in values:
+        if not isinstance(value, str) or not value.strip():
+            errors.append(f"{name} entries must be non-empty strings.")
+
+
 def _choice_error(
     errors: list[str], name: str, value: Any, choices: set[str]
 ) -> None:

policyengine_observability-3.0.2/policyengine_observability/identity.py

@@ -0,0 +1,36 @@
+"""Stable identities for individual telemetry-producing processes."""
+
+from __future__ import annotations
+
+import os
+from uuid import uuid4
+
+_PROCESS_IDENTITIES: dict[tuple[int, str, str], str] = {}
+
+
+def process_instance_id(
+    service_name: str,
+    platform_instance_id: str | None = None,
+) -> str:
+    """Return a stable, unique identity for one service process.
+
+    Platform identifiers such as a Cloud Run revision identify deployed code,
+    not an individual process. The process ID distinguishes local workers and
+    the UUID distinguishes processes in separate containers that reuse the
+    same operating-system process ID. Including ``os.getpid()`` in the cache
+    key causes a forked child to receive a new identity on its first call.
+    """
+
+    service = service_name.strip()
+    if not service:
+        raise ValueError("service_name must be non-empty")
+    platform_id = (platform_instance_id or "unassigned").strip()
+    if not platform_id:
+        platform_id = "unassigned"
+    process_id = os.getpid()
+    key = (process_id, service, platform_id)
+    existing = _PROCESS_IDENTITIES.get(key)
+    if existing is not None:
+        return existing
+    generated = f"{platform_id}:{process_id}:{uuid4().hex}"
+    return _PROCESS_IDENTITIES.setdefault(key, generated)

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/policyengine_observability/runtime.py

@@ -317,10 +317,7 @@ class ObservabilityRuntime:
         safe, omitted = normalize_attributes(
             attributes,
             self.config,
-            allowed_keys=(
-                self.config.application_attribute_keys
-                | self.config.dispatch_attribute_keys
-            ),
+            allowed_keys=self.config.local_attribute_keys,
         )
         request = self._request_state.get()
         operation = self._operation_state.get()
@@ -507,10 +504,7 @@ class ObservabilityRuntime:
         safe, omitted = normalize_attributes(
             attributes,
             self.config,
-            allowed_keys=(
-                self.config.application_attribute_keys
-                | self.config.dispatch_attribute_keys
-            ),
+            allowed_keys=self.config.local_attribute_keys,
         )
         if omitted:
             self.diagnostics.increment("attributes.omitted", omitted)
@@ -519,6 +513,20 @@ class ObservabilityRuntime:
         request_id: str | None = None
         if remote_context:
             request_id = _valid_request_id(remote_context.get("request_id"))
+            remote_attributes, remote_omitted = normalize_attributes(
+                {
+                    key: remote_context.get(key)
+                    for key in self.config.dispatch_attribute_keys
+                    if key in remote_context
+                },
+                self.config,
+                allowed_keys=self.config.dispatch_attribute_keys,
+            )
+            if remote_omitted:
+                self.diagnostics.increment(
+                    "attributes.omitted", remote_omitted
+                )
+            safe = {**remote_attributes, **safe}
             carrier = {
                 key: str(value)
                 for key, value in remote_context.items()
@@ -540,6 +548,7 @@ class ObservabilityRuntime:
                 if link is not None:
                     links.append(link)
                 parent = self._otel.empty_context()
+        safe = {**safe, **self._active_dispatch_attributes()}
         active_request = self._request_state.get()
         if request_id is None and active_request is not None:
             request_id = active_request.request_id
@@ -615,13 +624,11 @@ class ObservabilityRuntime:
         safe, omitted = normalize_attributes(
             attributes,
             self.config,
-            allowed_keys=(
-                self.config.application_attribute_keys
-                | self.config.dispatch_attribute_keys
-            ),
+            allowed_keys=self.config.local_attribute_keys,
         )
         if omitted:
             self.diagnostics.increment("attributes.omitted", omitted)
+        safe = {**safe, **self._active_dispatch_attributes()}
         return _ChildSpanState(
             name=name,
             start_time=time.perf_counter(),
@@ -661,6 +668,20 @@ class ObservabilityRuntime:
         fields.update(self._otel.current_correlation())
         return fields
 
+    def _active_dispatch_attributes(self) -> dict[str, Any]:
+        attributes: dict[str, Any] = {}
+        request = self._request_state.get()
+        operation = self._operation_state.get()
+        if request is not None:
+            attributes.update(request.attributes)
+        if operation is not None:
+            attributes.update(operation.attributes)
+        return {
+            key: attributes[key]
+            for key in self.config.dispatch_attribute_keys
+            if key in attributes
+        }
+
     def _metric_base(self) -> dict[str, Any]:
         return {
             "service.name": self.config.service.name,
@@ -673,6 +694,15 @@ class ObservabilityRuntime:
 
     def _emit_record(self, **kwargs: Any) -> None:
         try:
+            supplied_attributes = kwargs.get("attributes")
+            kwargs["attributes"] = {
+                **(
+                    dict(supplied_attributes)
+                    if supplied_attributes is not None
+                    else {}
+                ),
+                **self._active_dispatch_attributes(),
+            }
             self._delivery.emit(build_record(self.config, **kwargs))
         except Exception as exc:
             self.diagnostics.report("record.emit", exc)

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/policyengine_observability/schema.py

@@ -43,7 +43,6 @@ def normalize_attributes(
         key = str(raw_key).strip()
         if (
             not key
-            or len(normalized) >= config.limits.max_attributes
             or _prohibited_key(key)
             or (allowed_keys is not None and key not in allowed_keys)
         ):
@@ -100,8 +99,7 @@ def build_record(
     safe_attributes, omitted = normalize_attributes(
         attributes,
         config,
-        allowed_keys=config.application_attribute_keys
-        | config.dispatch_attribute_keys,
+        allowed_keys=config.local_attribute_keys,
     )
     if safe_attributes:
         record["attributes"] = safe_attributes

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "policyengine-observability"
-version = "3.0.0"
+version = "3.0.2"
 description = "Shared PolicyEngine observability runtime for logs, timings, metrics, and OpenTelemetry."
 readme = "README.md"
 authors = [{ name = "PolicyEngine", email = "hello@policyengine.org" }]

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/tests/test_config_schema.py

@@ -97,7 +97,6 @@ def test_invalid_nested_limits_are_reported_together() -> None:
             shutdown_timeout_seconds=100,
         ),
         limits=TelemetryLimits(
-            max_attributes=0,
             max_string_length=0,
             max_error_message_length=0,
             max_stack_length=0,
@@ -120,7 +119,6 @@ def test_invalid_nested_limits_are_reported_together() -> None:
         "otel.traces.protocol",
         "otel.traces.endpoint_mode",
         "otel.traces.timeout_seconds",
-        "limits.max_attributes",
         "limits.async_parent_max_age_seconds",
     ):
         assert field in message
@@ -257,6 +255,7 @@ def test_from_env_reads_transport_but_not_identity(monkeypatch) -> None:
     assert config.otel.span_batch_size == 99
     assert config.otel.span_schedule_delay_seconds == 2.5
     assert config.otel.metric_export_interval_seconds == 4.0
+    assert config.application_attribute_keys is None
 
 
 def test_from_env_marks_signal_specific_endpoints_as_exact(
@@ -377,6 +376,26 @@ def test_schema_preserves_core_fields_and_namespaces_attributes() -> None:
     json.dumps(record)
 
 
+def test_default_application_policy_accepts_safe_scalar_attributes() -> None:
+    config = make_config(application_attribute_keys=None)
+    record = build_record(
+        config,
+        severity="INFO",
+        attributes={
+            "new_runtime_detail": "available",
+            "attempt": 3,
+            "authorization": "prohibited",
+            "structured": {"not": "scalar"},
+        },
+    )
+
+    assert record["attributes"] == {
+        "new_runtime_detail": "available",
+        "attempt": 3,
+    }
+    assert record["attributes.omitted_count"] == 2
+
+
 def test_schema_redacts_and_truncates_errors() -> None:
     config = make_config(
         application_attribute_keys=frozenset({"backend"}),
@@ -442,16 +461,19 @@ def test_attribute_policy_omits_sensitive_non_scalar_and_nonfinite() -> None:
     assert omitted == 3
 
 
-def test_attribute_count_and_string_length_are_bounded() -> None:
+def test_attribute_count_is_unbounded_and_strings_are_truncated() -> None:
+    keys = frozenset(f"attribute_{index}" for index in range(40))
     config = make_config(
-        application_attribute_keys=frozenset({"one", "two", "three"}),
-        limits=TelemetryLimits(max_attributes=2, max_string_length=3),
+        application_attribute_keys=keys,
+        limits=TelemetryLimits(max_string_length=3),
     )
+    values = {key: "abcdef" for key in keys}
     safe, omitted = normalize_attributes(
-        {"one": "abcdef", "two": 2, "three": 3}, config
+        values,
+        config,
     )
-    assert safe == {"one": "abc", "two": 2}
-    assert omitted == 1
+    assert safe == {key: "abc" for key in keys}
+    assert omitted == 0
 
 
 def test_google_trace_correlation_is_not_in_canonical_record() -> None:

policyengine_observability-3.0.2/tests/test_identity.py

@@ -0,0 +1,38 @@
+from __future__ import annotations
+
+import re
+
+import pytest
+
+from policyengine_observability import identity, process_instance_id
+
+
+def test_process_instance_id_is_stable_within_one_process() -> None:
+    first = process_instance_id("example-api", "revision-1")
+    second = process_instance_id("example-api", "revision-1")
+
+    assert first == second
+    assert re.fullmatch(r"revision-1:\d+:[0-9a-f]{32}", first)
+
+
+def test_process_instance_id_separates_services_and_deployments() -> None:
+    first = process_instance_id("example-api", "revision-1")
+
+    assert process_instance_id("other-api", "revision-1") != first
+    assert process_instance_id("example-api", "revision-2") != first
+
+
+def test_process_instance_id_changes_after_process_duplication(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(identity.os, "getpid", lambda: 10_001)
+    parent = process_instance_id("example-api", "revision-1")
+    monkeypatch.setattr(identity.os, "getpid", lambda: 10_002)
+    child = process_instance_id("example-api", "revision-1")
+
+    assert parent != child
+
+
+def test_process_instance_id_rejects_empty_service_name() -> None:
+    with pytest.raises(ValueError, match="service_name must be non-empty"):
+        process_instance_id("  ")

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/tests/test_otel.py

@@ -72,6 +72,42 @@ def test_owned_provider_creates_local_spans_metrics_and_resources() -> None:
     runtime.shutdown()
 
 
+def test_default_policy_records_safe_application_attributes() -> None:
+    config = make_config(
+        otel=OTelConfig(enabled=True),
+        application_attribute_keys=None,
+    )
+    runtime = configure(config)
+    runtime._delivery._stdout = io.StringIO()
+    exporter = InMemorySpanExporter()
+    runtime._otel._tracer_provider.add_span_processor(
+        SimpleSpanProcessor(exporter)
+    )
+
+    with runtime.operation(
+        "simulation.run",
+        attributes={
+            "new_runtime_detail": "available",
+            "authorization": "prohibited",
+        },
+    ):
+        with runtime.span(
+            "simulation.calculate",
+            attributes={"partition_count": 12},
+        ):
+            pass
+
+    spans = {span.name: span for span in exporter.get_finished_spans()}
+    assert (
+        spans["simulation.run"].attributes["new_runtime_detail"] == "available"
+    )
+    assert "authorization" not in spans["simulation.run"].attributes
+    assert spans["simulation.calculate"].attributes["partition_count"] == 12
+    item = records(runtime._delivery._stdout)[0]
+    assert item["attributes"] == {"new_runtime_detail": "available"}
+    runtime.shutdown()
+
+
 def test_sensitive_values_are_redacted_from_spans_and_logs() -> None:
     config = make_config(
         otel=OTelConfig(enabled=True),

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/tests/test_runtime.py

@@ -196,6 +196,174 @@ def test_set_context_and_capture_context_are_allowlisted(runtime) -> None:
     observed.end_request(status_code=202)
 
 
+def test_remote_operation_restores_dispatch_context() -> None:
+    dispatch_keys = frozenset({"job_id", "observability_id"})
+    upstream, _upstream_output = make_runtime(
+        dispatch_attribute_keys=dispatch_keys
+    )
+    downstream, downstream_output = make_runtime(
+        dispatch_attribute_keys=dispatch_keys
+    )
+    upstream.begin_request(
+        headers={REQUEST_ID_HEADER: "request-1"},
+        method="POST",
+        route="/simulation",
+    )
+    upstream.set_context(
+        job_id="job-1",
+        observability_id="00000000-0000-4000-8000-000000000001",
+    )
+
+    remote_context = upstream.capture_context()
+    with downstream.operation("simulation.run", remote_context=remote_context):
+        assert downstream.capture_context()["job_id"] == "job-1"
+        downstream.log("running")
+
+    emitted = records(downstream_output)
+    assert emitted[0]["attributes"] == {
+        "job_id": "job-1",
+        "observability_id": "00000000-0000-4000-8000-000000000001",
+    }
+    assert emitted[1]["attributes"] == emitted[0]["attributes"]
+    upstream.end_request(status_code=202)
+    upstream.shutdown()
+    downstream.shutdown()
+
+
+def test_nested_span_inherits_active_dispatch_attributes(monkeypatch) -> None:
+    observability_id = "00000000-0000-4000-8000-000000000001"
+    observed, _output = make_runtime(
+        application_attribute_keys=frozenset({"backend"}),
+        dispatch_attribute_keys=frozenset({"observability_id"}),
+    )
+    child_span_attributes = []
+
+    with observed.operation(
+        "simulation.run",
+        remote_context={
+            "captured_at": "not-a-date",
+            "observability_id": observability_id,
+        },
+    ):
+        monkeypatch.setattr(
+            observed._otel,
+            "start_span",
+            lambda _name, **kwargs: child_span_attributes.append(
+                kwargs["attributes"]
+            ),
+        )
+        with observed.span(
+            "simulation.calculate",
+            attributes={
+                "backend": "modal",
+                "observability_id": "00000000-0000-4000-8000-000000000099",
+            },
+        ):
+            pass
+
+    assert child_span_attributes == [
+        {
+            "backend": "modal",
+            "observability_id": observability_id,
+        }
+    ]
+    observed.shutdown()
+
+
+def test_nested_operation_inherits_active_dispatch_attributes(
+    monkeypatch,
+) -> None:
+    observability_id = "00000000-0000-4000-8000-000000000001"
+    observed, output = make_runtime(
+        application_attribute_keys=frozenset({"simulation_role"}),
+        dispatch_attribute_keys=frozenset({"observability_id"}),
+    )
+    operation_span_attributes = []
+
+    with observed.operation(
+        "simulation.run",
+        remote_context={
+            "captured_at": "not-a-date",
+            "observability_id": observability_id,
+        },
+    ):
+        monkeypatch.setattr(
+            observed._otel,
+            "start_span",
+            lambda _name, **kwargs: operation_span_attributes.append(
+                kwargs["attributes"]
+            ),
+        )
+        with observed.operation(
+            "simulation.plan",
+            attributes={
+                "simulation_role": "baseline",
+                "observability_id": "00000000-0000-4000-8000-000000000099",
+            },
+        ):
+            assert observed.capture_context()["observability_id"] == (
+                observability_id
+            )
+
+    emitted = records(output)
+    nested_completion = next(
+        item
+        for item in emitted
+        if item.get("operation.name") == "simulation.plan"
+    )
+    assert nested_completion["attributes"] == {
+        "simulation_role": "baseline",
+        "observability_id": observability_id,
+    }
+    assert operation_span_attributes == [
+        {
+            "operation.name": "simulation.plan",
+            "operation.kind": "operation",
+            "simulation_role": "baseline",
+            "observability_id": observability_id,
+        }
+    ]
+    observed.shutdown()
+
+
+def test_local_operation_attributes_override_remote_dispatch_values() -> None:
+    observed, output = make_runtime(
+        dispatch_attribute_keys=frozenset({"job_id"})
+    )
+
+    with observed.operation(
+        "simulation.run",
+        attributes={"job_id": "local-job"},
+        remote_context={
+            "captured_at": "not-a-date",
+            "job_id": "remote-job",
+            "unapproved": "must-not-appear",
+        },
+    ):
+        observed.event("simulation.started")
+
+    emitted = records(output)
+    assert emitted[0]["attributes"] == {"job_id": "local-job"}
+    assert emitted[1]["attributes"] == {"job_id": "local-job"}
+    assert observed.capture_context().get("unapproved") is None
+    observed.shutdown()
+
+
+def test_malformed_remote_context_does_not_change_application_result() -> None:
+    observed, _output = make_runtime()
+
+    @observed.operation(
+        "simulation.run",
+        remote_context=["not", "a", "mapping"],  # type: ignore[arg-type]
+    )
+    def calculate() -> int:
+        return 42
+
+    assert calculate() == 42
+    assert observed.diagnostics.count("failure.operation.start") == 1
+    observed.shutdown()
+
+
 def test_two_runtimes_keep_identity_and_context_separate() -> None:
     first, first_output = make_runtime()
     second_config = make_config(

{policyengine_observability-3.0.0 → policyengine_observability-3.0.2}/uv.lock

@@ -895,7 +895,7 @@ wheels = [
 
 [[package]]
 name = "policyengine-observability"
-version = "3.0.0"
+version = "3.0.2"
 source = { editable = "." }
 
 [package.optional-dependencies]