Conversation
tt-le
force-pushed
the
tien/codex-otel-tracing
branch
from
September 15, 2026 13:42
387f433 to
78ad7a7
Compare
tt-le
force-pushed
the
tien/managed-otel-traces
branch
from
September 15, 2026 16:32
082dd0e to
e0324d4
Compare
Extend the OTel tracing rail (stacked on the Claude PR) to Codex: add `codex` to `OTEL_TRACING_TOOLS`, so a managed per-agent `tracing_config.enabled` for the codex agent sets `codex_otel_tracing` in state. At launch, `codex.py` mints a fresh Databricks bearer and injects the `[otel.trace_exporter.otlp-http]` block (endpoint + http/protobuf + Authorization) as `-c` config overrides — the endpoint is the AI Gateway ingest path, minted per launch and never persisted. Codex has no OTLP headers-helper (unlike Claude's otelHeadersHelper), so the bearer is pinned statically per launch and goes stale after ~1h; a refreshing local proxy is the intended follow-up. Inference and OTel auth are independent in Codex (model_providers.auth vs otel.headers) and both use the same workspace bearer. Co-authored-by: Isaac <no-reply@databricks.com>
tt-le
force-pushed
the
tien/codex-otel-tracing
branch
from
September 15, 2026 16:35
78ad7a7 to
8f389de
Compare
This was referenced Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #599 (base
tien/managed-otel-traces) — this diff is just the one Codex commit.What
Extend the OTel tracing rail to Codex. When the managed
CodingAgentConfigenables tracing for the codex agent (AgentConfig.tracing_config.enabled),ug codexexports OTLP trace spans to the AI Gateway ingest endpoint.How
OTEL_TRACING_TOOLS = ("claude", "codex")— the per-agent flag now setscodex_otel_tracingin state (same rail as Claude).codex.pymints a fresh Databricks bearer (reusing theOAUTH_TOKENmint) and injects the[otel.trace_exporter.otlp-http]block —endpoint(full/v1/tracespath, used verbatim),protocol = "binary"(http/protobuf), andAuthorization: Bearer— as-c/--configoverrides. Nothing is persisted; the token is minted per launch.Auth model (verified against openai/codex source)
Codex keeps inference and telemetry auth fully separate (
model-provider-info/src/lib.rsvsotel/src/config.rs):[model_providers.<n>.auth]command-backed bearer (refreshing).[otel...headers]map only — no headers-helper, no refresh, no reuse of the inference cred.Both use the same Databricks workspace bearer for our gateway; they're just configured in two places.
Known limitation (stopgap)
Because Codex has no
otelHeadersHelperequivalent, the bearer is pinned statically per launch — it goes stale after ~1h, and (via-c) is visible in the process command line. This is an interim manual-testing path. The durable fix is a local refresh proxy (the OTLP analog ofucode mcp-proxy/gateway_proxy.py): pointtrace_exporterat a loopback URL and refresh the bearer server-side, keeping it fresh and out of argv. Planned as a follow-up.Validate
uv run ruff check .+ format clean;tests/test_agent_codex.py+tests/test_managed_resolve.pypass (199 focused). Added: codex in the opt-in list, and launch injects/omits the[otel]-cargs by thecodex_otel_tracingflag.tracing_config.enabledcodex stub resolves tocodex_otel_tracingand produces the correct--config otel={...}launch arg (endpoint +binary+Bearer).test_user_agent_arrives_at_gatewaye2e probes and one smart-routing pty test.This pull request and its description were written by Isaac.