prodkit 0.2.0__tar.gz → 0.3.0__tar.gz

{prodkit-0.2.0 → prodkit-0.3.0}/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-08-14
+
+### Added
+- **Prometheus metrics plugin** (`pip install prodkit[metrics]`): request
+  count, latency histogram, in-flight gauge. Exposed at `/metrics` (or a
+  custom path). Metrics use route templates as labels (bounded cardinality).
+  Dedicated `CollectorRegistry` per instance — no global-state collisions.
+- **Cache plugin** (`cache={...}`): a named cache service published in the
+  registry under `"cache"`. Memory (per-process LRU with TTL) and Redis
+  (shared across workers) backends. Values must be JSON-serializable.
+- **OpenTelemetry tracing plugin** (`pip install prodkit[otel]`): automatic
+  request spans with W3C `traceparent` propagation, configurable sampler
+  (`sample_rate`), and OTLP/console/none exporters. The `TracerProvider` is
+  published in the registry as `"tracer"`.
+- **Redis backend for rate limiting** (`rate_limit.backend="redis"`): shared
+  aligned fixed-window counters across all workers and hosts. Fails open on
+  Redis errors (availability > strict limiting). Readiness check via `/ready`.
+
+### Changed
+- CI installs `otel` and `metrics` extras for full test coverage.
+- `TracingMiddleware` now uses `context.attach()`/`detach()` for correct W3C
+  trace context propagation (previously passed unsupported `context` kwarg).
+- Dev dependencies now include `anyio` and `pytest-anyio` for async tests.
+
+
+## [0.2.1] - 2026-07-23
+
+### Changed
+- README polish: PyPI/Python badges, table of contents, `prodkit[cli]` install
+  note, rate-limiting shown in the config examples, and a `doctor()` hook in the
+  plugin-authoring example. Docs-only release (no code changes).
+
 ## [0.2.0] - 2026-07-22
 
 ### Added

prodkit-0.2.0/README.md → prodkit-0.3.0/PKG-INFO

@@ -1,3 +1,73 @@
+Metadata-Version: 2.5
+Name: prodkit
+Version: 0.3.0
+Summary: The production framework for FastAPI. One line. Production ready.
+Project-URL: Homepage, https://github.com/Pushkarpant/PRODKIT
+Project-URL: Documentation, https://github.com/Pushkarpant/PRODKIT#readme
+Project-URL: Repository, https://github.com/Pushkarpant/PRODKIT
+Project-URL: Changelog, https://github.com/Pushkarpant/PRODKIT/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/Pushkarpant/PRODKIT/issues
+Author-email: Pushkar Pant <pantpushkar4@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: fastapi,health-check,logging,metrics,middleware,observability,opentelemetry,production,security,tracing
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: fastapi>=0.110
+Requires-Dist: pydantic-settings>=2.1
+Requires-Dist: pydantic>=2.5
+Requires-Dist: tomli>=2.0; python_version < '3.11'
+Provides-Extra: all
+Requires-Dist: brotli-asgi>=1.4; extra == 'all'
+Requires-Dist: opentelemetry-api>=1.20; extra == 'all'
+Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.20; extra == 'all'
+Requires-Dist: opentelemetry-sdk>=1.20; extra == 'all'
+Requires-Dist: prometheus-client>=0.20; extra == 'all'
+Requires-Dist: redis>=5.0; extra == 'all'
+Requires-Dist: rich>=13; extra == 'all'
+Requires-Dist: typer>=0.12; extra == 'all'
+Provides-Extra: brotli
+Requires-Dist: brotli-asgi>=1.4; extra == 'brotli'
+Provides-Extra: cli
+Requires-Dist: rich>=13; extra == 'cli'
+Requires-Dist: typer>=0.12; extra == 'cli'
+Provides-Extra: dev
+Requires-Dist: anyio[trio]>=4.0; extra == 'dev'
+Requires-Dist: fakeredis[lua]>=2.21; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: import-linter>=2.0; extra == 'dev'
+Requires-Dist: mypy>=1.11; extra == 'dev'
+Requires-Dist: opentelemetry-api>=1.20; extra == 'dev'
+Requires-Dist: opentelemetry-sdk>=1.20; extra == 'dev'
+Requires-Dist: prometheus-client>=0.20; extra == 'dev'
+Requires-Dist: pytest-anyio>=0.0.0; extra == 'dev'
+Requires-Dist: pytest-cov>=5.0; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: rich>=13; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Requires-Dist: tomli>=2.0; extra == 'dev'
+Requires-Dist: typer>=0.12; extra == 'dev'
+Provides-Extra: metrics
+Requires-Dist: prometheus-client>=0.20; extra == 'metrics'
+Provides-Extra: otel
+Requires-Dist: opentelemetry-api>=1.20; extra == 'otel'
+Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.20; extra == 'otel'
+Requires-Dist: opentelemetry-sdk>=1.20; extra == 'otel'
+Provides-Extra: redis
+Requires-Dist: redis>=5.0; extra == 'redis'
+Description-Content-Type: text/markdown
+
 # ProdKit
 
 > **One line. Production ready.**
@@ -14,14 +84,24 @@ Production(app)
 
 That's it. Your app now has security headers, structured JSON logging with
 request-ID correlation, RFC 9457 error responses, Kubernetes-ready health
-endpoints, and gzip compression — configured to current best practice,
-hardened for production, and pleasant in development.
+endpoints, gzip compression, and opt-in rate limiting — configured to current
+best practice, hardened for production, and pleasant in development. Then run
+[`prodkit doctor`](#cli--prodkit-doctor) to score how production-ready it is.
 
+[![PyPI](https://img.shields.io/pypi/v/prodkit.svg)](https://pypi.org/project/prodkit/)
+[![Python](https://img.shields.io/pypi/pyversions/prodkit.svg)](https://pypi.org/project/prodkit/)
 [![CI](https://github.com/Pushkarpant/PRODKIT/actions/workflows/ci.yml/badge.svg)](https://github.com/Pushkarpant/PRODKIT/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/Pushkarpant/PRODKIT/blob/main/LICENSE)
 
 ---
 
+**Contents:** [Why](#why) · [Install](#installation) · [Quick Start](#quick-start) ·
+[What You Get](#what-you-get) · [Configuration](#configuration) ·
+[Plugins](#writing-a-plugin) · [CLI / doctor](#cli--prodkit-doctor) ·
+[Status & Roadmap](#project-status)
+
+---
+
 ## Why
 
 Every production FastAPI service re-implements the same ~500 lines of glue:
@@ -37,11 +117,21 @@ evolve, `pip install -U prodkit` updates every app you own.
 [**`pip install prodkit`**](https://pypi.org/project/prodkit/)
 
 ```bash
-pip install prodkit
+pip install prodkit           # the library
+pip install "prodkit[cli]"    # + the `prodkit doctor` CLI (typer + rich)
 ```
 
 Requires Python 3.10+ and FastAPI 0.110+. The base install depends only on
-FastAPI and Pydantic — nothing else.
+FastAPI and Pydantic — nothing else. Optional extras:
+
+| Extra | Adds |
+|---|---|
+| `cli` | `prodkit doctor` CLI (typer + rich) |
+| `metrics` | Prometheus `/metrics` endpoint |
+| `otel` | OpenTelemetry tracing (OTLP export) |
+| `redis` | Shared Redis backends (rate-limit, cache) |
+| `brotli` | Brotli compression |
+| `all` | Everything above |
 
 ## Quick Start
 
@@ -69,7 +159,9 @@ x-content-type-options: nosniff
 x-frame-options: DENY
 strict-transport-security: max-age=63072000; includeSubDomains
 referrer-policy: strict-origin-when-cross-origin
-...
+permissions-policy: camera=(), microphone=(), geolocation=()
+x-xss-protection: 0
+content-type: application/json
 ```
 
 For local development, flip the profile — pretty console logs, debug error
@@ -90,7 +182,10 @@ Production(app, environment="development")
 | ❤️ **Health endpoints** | `/health`, `/live` (liveness) and `/ready` (readiness — aggregates checks from every plugin, 503 until all pass). Kubernetes-native. |
 | 🌐 **CORS** | Explicit origins only; the wildcard-with-credentials footgun is refused at boot. |
 | 📦 **Compression** | Gzip for responses over 500 bytes. |
-| 🚦 **Rate limiting** | Opt-in per-IP limiting (`100/minute`), `429 problem+json` with `Retry-After`. In-memory backend (Redis in v0.3). |
+| 🚦 **Rate limiting** | Opt-in per-IP limiting (`100/minute`), `429 problem+json` with `Retry-After`. Memory or Redis backend (shared across workers). |
+| 📊 **Prometheus metrics** | Request count, latency histogram, in-flight gauge at `/metrics`. Route-template labels (bounded cardinality). `pip install prodkit[metrics]` |
+| 🗄️ **Cache service** | Memory (LRU + TTL) or Redis backend, published in the registry. `await cache.get(key)` / `.set(key, value, ttl=60)`. |
+| 🔭 **OpenTelemetry tracing** | Automatic request spans with W3C `traceparent` propagation. OTLP, console, or none exporter. `pip install prodkit[otel]` |
 | 🩺 **`prodkit doctor`** | CLI production-readiness audit with a 0–100 score. `--strict` gates CI. |
 | 🔌 **Plugin system** | Every feature above is a plugin. Write your own with optional hooks incl. `doctor()`. |
 
@@ -111,6 +206,7 @@ Production(
     cors={"origins": ["https://app.example.com"]},   # dict = configure & enable
     compression=False,                                # bool = toggle
     security={"trusted_hosts": ["api.example.com"]},
+    rate_limit={"default": "100/minute"},             # opt-in per-IP limiting
 )
 ```
 
@@ -134,6 +230,10 @@ level = "INFO"
 [cors]
 enabled = true
 origins = ["https://app.example.com"]
+
+[rate_limit]
+enabled = true
+default = "100/minute"
 ```
 
 ### Fail-fast, refuse-unsafe
@@ -155,7 +255,7 @@ not warned about:
 ## Writing a Plugin
 
 ```python
-from prodkit import Check, Plugin, Production
+from prodkit import Audit, Check, Plugin, Production
 
 class DatabasePlugin(Plugin):
     name = "database"
@@ -167,13 +267,18 @@ class DatabasePlugin(Plugin):
     async def shutdown(self, ctx):
         await self.pool.close()
 
-    def checks(self, ctx):
+    def checks(self, ctx):                     # runtime readiness → /ready
         return [Check(name="database", passed=self.pool.is_alive())]
 
+    def doctor(self, ctx):                     # static audit → prodkit doctor
+        return [Audit(name="Database pool",
+                      status="ok", detail="connection pool configured")]
+
 Production(app, plugins=[DatabasePlugin()])
 ```
 
-Your check now shows up in `/ready` automatically. Plugins can declare
+Your `checks()` result now shows up in `/ready` automatically, and your
+`doctor()` findings roll into the `prodkit doctor` score. Plugins can declare
 `requires = ("other-plugin",)` and the kernel activates them in dependency
 order — cycles and missing dependencies fail at boot.
 
@@ -230,13 +335,13 @@ plugins score too.
 
 ## Project Status
 
-**v0.2.0 — alpha.** Core kernel, eight built-in plugins (incl. rate-limiting),
-the `prodkit doctor` CLI with a production-readiness score, strict mypy, CI
-across Python 3.10–3.13.
+**v0.3.0 — alpha.** Core kernel, eleven built-in plugins (metrics, cache, tracing,
+rate-limiting with Redis), the `prodkit doctor` CLI, strict mypy, CI across
+Python 3.10–3.13.
 
-Roadmap: ✅ `prodkit doctor` CLI + rate limiting (v0.2), Prometheus metrics +
-Redis backends (v0.3), Dockerfile/nginx/CI generators (v0.4), public plugin SDK
-(v0.5), auth helpers (v0.6), stable API (v1.0).
+Roadmap: ✅ `prodkit doctor` CLI + rate limiting (v0.2), ✅ Prometheus metrics +
+Redis backends + OpenTelemetry tracing (v0.3), Dockerfile/nginx/CI generators
+(v0.4), public plugin SDK (v0.5), auth helpers (v0.6), stable API (v1.0).
 Full details in [docs/ARCHITECTURE.md](https://github.com/Pushkarpant/PRODKIT/blob/main/docs/ARCHITECTURE.md).
 
 ## Contributing

prodkit-0.2.0/PKG-INFO → prodkit-0.3.0/README.md

@@ -1,50 +1,3 @@
-Metadata-Version: 2.4
-Name: prodkit
-Version: 0.2.0
-Summary: The production framework for FastAPI. One line. Production ready.
-Project-URL: Homepage, https://github.com/Pushkarpant/PRODKIT
-Project-URL: Documentation, https://github.com/Pushkarpant/PRODKIT#readme
-Project-URL: Repository, https://github.com/Pushkarpant/PRODKIT
-Project-URL: Changelog, https://github.com/Pushkarpant/PRODKIT/blob/main/CHANGELOG.md
-Project-URL: Issues, https://github.com/Pushkarpant/PRODKIT/issues
-Author-email: Pushkar Pant <pantpushkar4@gmail.com>
-License-Expression: MIT
-License-File: LICENSE
-Keywords: fastapi,health-check,logging,middleware,observability,production,security
-Classifier: Development Status :: 3 - Alpha
-Classifier: Framework :: FastAPI
-Classifier: Intended Audience :: Developers
-Classifier: Operating System :: OS Independent
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Python :: 3.13
-Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
-Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
-Classifier: Typing :: Typed
-Requires-Python: >=3.10
-Requires-Dist: fastapi>=0.110
-Requires-Dist: pydantic-settings>=2.1
-Requires-Dist: pydantic>=2.5
-Requires-Dist: tomli>=2.0; python_version < '3.11'
-Provides-Extra: brotli
-Requires-Dist: brotli-asgi>=1.4; extra == 'brotli'
-Provides-Extra: cli
-Requires-Dist: rich>=13; extra == 'cli'
-Requires-Dist: typer>=0.12; extra == 'cli'
-Provides-Extra: dev
-Requires-Dist: httpx>=0.27; extra == 'dev'
-Requires-Dist: import-linter>=2.0; extra == 'dev'
-Requires-Dist: mypy>=1.11; extra == 'dev'
-Requires-Dist: pytest-cov>=5.0; extra == 'dev'
-Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: rich>=13; extra == 'dev'
-Requires-Dist: ruff>=0.6; extra == 'dev'
-Requires-Dist: tomli>=2.0; extra == 'dev'
-Requires-Dist: typer>=0.12; extra == 'dev'
-Description-Content-Type: text/markdown
-
 # ProdKit
 
 > **One line. Production ready.**
@@ -61,14 +14,24 @@ Production(app)
 
 That's it. Your app now has security headers, structured JSON logging with
 request-ID correlation, RFC 9457 error responses, Kubernetes-ready health
-endpoints, and gzip compression — configured to current best practice,
-hardened for production, and pleasant in development.
+endpoints, gzip compression, and opt-in rate limiting — configured to current
+best practice, hardened for production, and pleasant in development. Then run
+[`prodkit doctor`](#cli--prodkit-doctor) to score how production-ready it is.
 
+[![PyPI](https://img.shields.io/pypi/v/prodkit.svg)](https://pypi.org/project/prodkit/)
+[![Python](https://img.shields.io/pypi/pyversions/prodkit.svg)](https://pypi.org/project/prodkit/)
 [![CI](https://github.com/Pushkarpant/PRODKIT/actions/workflows/ci.yml/badge.svg)](https://github.com/Pushkarpant/PRODKIT/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/Pushkarpant/PRODKIT/blob/main/LICENSE)
 
 ---
 
+**Contents:** [Why](#why) · [Install](#installation) · [Quick Start](#quick-start) ·
+[What You Get](#what-you-get) · [Configuration](#configuration) ·
+[Plugins](#writing-a-plugin) · [CLI / doctor](#cli--prodkit-doctor) ·
+[Status & Roadmap](#project-status)
+
+---
+
 ## Why
 
 Every production FastAPI service re-implements the same ~500 lines of glue:
@@ -84,11 +47,21 @@ evolve, `pip install -U prodkit` updates every app you own.
 [**`pip install prodkit`**](https://pypi.org/project/prodkit/)
 
 ```bash
-pip install prodkit
+pip install prodkit           # the library
+pip install "prodkit[cli]"    # + the `prodkit doctor` CLI (typer + rich)
 ```
 
 Requires Python 3.10+ and FastAPI 0.110+. The base install depends only on
-FastAPI and Pydantic — nothing else.
+FastAPI and Pydantic — nothing else. Optional extras:
+
+| Extra | Adds |
+|---|---|
+| `cli` | `prodkit doctor` CLI (typer + rich) |
+| `metrics` | Prometheus `/metrics` endpoint |
+| `otel` | OpenTelemetry tracing (OTLP export) |
+| `redis` | Shared Redis backends (rate-limit, cache) |
+| `brotli` | Brotli compression |
+| `all` | Everything above |
 
 ## Quick Start
 
@@ -116,7 +89,9 @@ x-content-type-options: nosniff
 x-frame-options: DENY
 strict-transport-security: max-age=63072000; includeSubDomains
 referrer-policy: strict-origin-when-cross-origin
-...
+permissions-policy: camera=(), microphone=(), geolocation=()
+x-xss-protection: 0
+content-type: application/json
 ```
 
 For local development, flip the profile — pretty console logs, debug error
@@ -137,7 +112,10 @@ Production(app, environment="development")
 | ❤️ **Health endpoints** | `/health`, `/live` (liveness) and `/ready` (readiness — aggregates checks from every plugin, 503 until all pass). Kubernetes-native. |
 | 🌐 **CORS** | Explicit origins only; the wildcard-with-credentials footgun is refused at boot. |
 | 📦 **Compression** | Gzip for responses over 500 bytes. |
-| 🚦 **Rate limiting** | Opt-in per-IP limiting (`100/minute`), `429 problem+json` with `Retry-After`. In-memory backend (Redis in v0.3). |
+| 🚦 **Rate limiting** | Opt-in per-IP limiting (`100/minute`), `429 problem+json` with `Retry-After`. Memory or Redis backend (shared across workers). |
+| 📊 **Prometheus metrics** | Request count, latency histogram, in-flight gauge at `/metrics`. Route-template labels (bounded cardinality). `pip install prodkit[metrics]` |
+| 🗄️ **Cache service** | Memory (LRU + TTL) or Redis backend, published in the registry. `await cache.get(key)` / `.set(key, value, ttl=60)`. |
+| 🔭 **OpenTelemetry tracing** | Automatic request spans with W3C `traceparent` propagation. OTLP, console, or none exporter. `pip install prodkit[otel]` |
 | 🩺 **`prodkit doctor`** | CLI production-readiness audit with a 0–100 score. `--strict` gates CI. |
 | 🔌 **Plugin system** | Every feature above is a plugin. Write your own with optional hooks incl. `doctor()`. |
 
@@ -158,6 +136,7 @@ Production(
     cors={"origins": ["https://app.example.com"]},   # dict = configure & enable
     compression=False,                                # bool = toggle
     security={"trusted_hosts": ["api.example.com"]},
+    rate_limit={"default": "100/minute"},             # opt-in per-IP limiting
 )
 ```
 
@@ -181,6 +160,10 @@ level = "INFO"
 [cors]
 enabled = true
 origins = ["https://app.example.com"]
+
+[rate_limit]
+enabled = true
+default = "100/minute"
 ```
 
 ### Fail-fast, refuse-unsafe
@@ -202,7 +185,7 @@ not warned about:
 ## Writing a Plugin
 
 ```python
-from prodkit import Check, Plugin, Production
+from prodkit import Audit, Check, Plugin, Production
 
 class DatabasePlugin(Plugin):
     name = "database"
@@ -214,13 +197,18 @@ class DatabasePlugin(Plugin):
     async def shutdown(self, ctx):
         await self.pool.close()
 
-    def checks(self, ctx):
+    def checks(self, ctx):                     # runtime readiness → /ready
         return [Check(name="database", passed=self.pool.is_alive())]
 
+    def doctor(self, ctx):                     # static audit → prodkit doctor
+        return [Audit(name="Database pool",
+                      status="ok", detail="connection pool configured")]
+
 Production(app, plugins=[DatabasePlugin()])
 ```
 
-Your check now shows up in `/ready` automatically. Plugins can declare
+Your `checks()` result now shows up in `/ready` automatically, and your
+`doctor()` findings roll into the `prodkit doctor` score. Plugins can declare
 `requires = ("other-plugin",)` and the kernel activates them in dependency
 order — cycles and missing dependencies fail at boot.
 
@@ -277,13 +265,13 @@ plugins score too.
 
 ## Project Status
 
-**v0.2.0 — alpha.** Core kernel, eight built-in plugins (incl. rate-limiting),
-the `prodkit doctor` CLI with a production-readiness score, strict mypy, CI
-across Python 3.10–3.13.
+**v0.3.0 — alpha.** Core kernel, eleven built-in plugins (metrics, cache, tracing,
+rate-limiting with Redis), the `prodkit doctor` CLI, strict mypy, CI across
+Python 3.10–3.13.
 
-Roadmap: ✅ `prodkit doctor` CLI + rate limiting (v0.2), Prometheus metrics +
-Redis backends (v0.3), Dockerfile/nginx/CI generators (v0.4), public plugin SDK
-(v0.5), auth helpers (v0.6), stable API (v1.0).
+Roadmap: ✅ `prodkit doctor` CLI + rate limiting (v0.2), ✅ Prometheus metrics +
+Redis backends + OpenTelemetry tracing (v0.3), Dockerfile/nginx/CI generators
+(v0.4), public plugin SDK (v0.5), auth helpers (v0.6), stable API (v1.0).
 Full details in [docs/ARCHITECTURE.md](https://github.com/Pushkarpant/PRODKIT/blob/main/docs/ARCHITECTURE.md).
 
 ## Contributing

{prodkit-0.2.0 → prodkit-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "prodkit"
-version = "0.2.0"
+version = "0.3.0"
 description = "The production framework for FastAPI. One line. Production ready."
 readme = "README.md"
 license = "MIT"
@@ -19,6 +19,9 @@ keywords = [
     "observability",
     "logging",
     "health-check",
+    "metrics",
+    "tracing",
+    "opentelemetry",
 ]
 classifiers = [
     "Development Status :: 3 - Alpha",
@@ -44,9 +47,19 @@ dependencies = [
 [project.optional-dependencies]
 brotli = ["brotli-asgi>=1.4"]
 cli = ["typer>=0.12", "rich>=13"]
+metrics = ["prometheus-client>=0.20"]
+redis = ["redis>=5.0"]
+otel = [
+    "opentelemetry-api>=1.20",
+    "opentelemetry-sdk>=1.20",
+    "opentelemetry-exporter-otlp-proto-grpc>=1.20",
+]
+all = ["prodkit[metrics,redis,otel,brotli,cli]"]
 dev = [
     "pytest>=8.0",
     "pytest-cov>=5.0",
+    "anyio[trio]>=4.0",
+    "pytest-anyio>=0.0.0",
     "httpx>=0.27",
     "ruff>=0.6",
     "mypy>=1.11",
@@ -54,6 +67,10 @@ dev = [
     "tomli>=2.0",  # so mypy (python_version=3.10) can type-check the fallback import
     "typer>=0.12",  # CLI is type-checked and tested in CI
     "rich>=13",
+    "prometheus-client>=0.20",
+    "fakeredis[lua]>=2.21",
+    "opentelemetry-api>=1.20",
+    "opentelemetry-sdk>=1.20",
 ]
 
 [project.scripts]

{prodkit-0.2.0 → prodkit-0.3.0}/src/prodkit/__init__.py

@@ -9,15 +9,18 @@ Production(app)
 
 from prodkit.contracts.plugin import Audit, Check, Plugin
 from prodkit.core.config import (
+    CacheConfig,
     CompressionConfig,
     CORSConfig,
     ErrorsConfig,
     HealthConfig,
     LoggingConfig,
+    MetricsConfig,
     ProdKitConfig,
     RateLimitConfig,
     RequestIDConfig,
     SecurityConfig,
+    TracingConfig,
 )
 from prodkit.core.context import Context
 from prodkit.core.exceptions import (
@@ -34,17 +37,19 @@ from prodkit.plugins import builtin_plugins
 # root — the kernel itself never imports from prodkit.plugins.
 set_builtin_factory(builtin_plugins)
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 
 __all__ = [
     "Audit",
     "CORSConfig",
+    "CacheConfig",
     "Check",
     "CompressionConfig",
     "Context",
     "ErrorsConfig",
     "HealthConfig",
     "LoggingConfig",
+    "MetricsConfig",
     "Plugin",
     "PluginDependencyError",
     "PluginError",
@@ -56,5 +61,6 @@ __all__ = [
     "RequestIDConfig",
     "SecurityConfig",
     "ServiceNotFoundError",
+    "TracingConfig",
     "__version__",
 ]

prodkit-0.3.0/src/prodkit/contracts/__init__.py

@@ -0,0 +1,5 @@
+"""ProdKit plugin contract and supporting types."""
+
+from prodkit.contracts.plugin import Audit, AuditStatus, Check, Plugin
+
+__all__ = ["Audit", "AuditStatus", "Check", "Plugin"]

{prodkit-0.2.0 → prodkit-0.3.0}/src/prodkit/contracts/plugin.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Awaitable
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, ClassVar, Literal
 
@@ -72,8 +73,12 @@ class Plugin:
     async def shutdown(self, ctx: Context) -> None:
         """Release resources gracefully."""
 
-    def checks(self, ctx: Context) -> list[Check]:
-        """Readiness checks, aggregated by the health plugin's /ready."""
+    def checks(self, ctx: Context) -> list[Check] | Awaitable[list[Check]]:
+        """Readiness checks, aggregated by the health plugin's /ready.
+
+        May be overridden as ``async def`` (e.g. to ping a backend); the
+        health plugin awaits awaitable results.
+        """
         return []
 
     def doctor(self, ctx: Context) -> list[Audit]:
@@ -89,6 +94,7 @@ class Plugin:
 PRIORITY_REQUEST_ID = 100
 PRIORITY_LOGGING = 200
 PRIORITY_ERRORS = 250
+PRIORITY_TRACING = 290
 PRIORITY_METRICS = 300
 PRIORITY_SECURITY = 400
 PRIORITY_CORS = 500

{prodkit-0.2.0 → prodkit-0.3.0}/src/prodkit/core/config.py

@@ -93,7 +93,37 @@ class RateLimitConfig(_Section):
     enabled: bool = False  # opt-in: an unexpected 429 is worse than no limit
     # "<count>/<second|minute|hour>", parsed and validated by the plugin.
     default: str = "100/minute"
-    by: Literal["ip"] = "ip"  # v0.2 keys on client IP; per-user/route land later
+    by: Literal["ip"] = "ip"  # keys on client IP; per-user/route land later
+    # "memory" is per-process; "redis" shares the limit across workers/hosts.
+    backend: Literal["memory", "redis"] = "memory"
+    redis_url: str = "redis://localhost:6379/0"
+    key_prefix: str = "prodkit:ratelimit:"
+
+
+class MetricsConfig(_Section):
+    enabled: bool = False  # opt-in: needs prodkit[metrics]
+    path: str = "/metrics"
+    buckets: list[float] | None = None  # None -> prometheus-client defaults
+    # Paths never measured (the metrics path itself is always excluded).
+    exclude_paths: list[str] = Field(default_factory=list)
+
+
+class CacheConfig(_Section):
+    enabled: bool = False  # opt-in: a service other code asks for, not middleware
+    backend: Literal["memory", "redis"] = "memory"
+    redis_url: str = "redis://localhost:6379/0"
+    default_ttl: int = 300  # seconds; 0 = no expiry
+    key_prefix: str = "prodkit:cache:"
+    max_entries: int = 1024  # memory backend LRU bound
+
+
+class TracingConfig(_Section):
+    enabled: bool = False  # opt-in: needs prodkit[otel]
+    service_name: str | None = None  # None -> the FastAPI app's title
+    exporter: Literal["otlp", "console", "none"] = "otlp"
+    # None defers to the standard OTEL_EXPORTER_OTLP_* environment variables.
+    endpoint: str | None = None
+    sample_rate: float = Field(default=1.0, ge=0.0, le=1.0)
 
 
 class ProdKitConfig(_Section):
@@ -109,6 +139,9 @@ class ProdKitConfig(_Section):
     cors: CORSConfig = Field(default_factory=CORSConfig)
     compression: CompressionConfig = Field(default_factory=CompressionConfig)
     rate_limit: RateLimitConfig = Field(default_factory=RateLimitConfig)
+    metrics: MetricsConfig = Field(default_factory=MetricsConfig)
+    cache: CacheConfig = Field(default_factory=CacheConfig)
+    tracing: TracingConfig = Field(default_factory=TracingConfig)
 
 
 # Profile defaults: applied beneath toml/env/args. The one-liner must be

{prodkit-0.2.0 → prodkit-0.3.0}/src/prodkit/core/production.py

@@ -45,6 +45,9 @@ _TOGGLEABLE = (
     "cors",
     "compression",
     "rate_limit",
+    "metrics",
+    "cache",
+    "tracing",
 )