Mandark-droid/genai_otel_instrument

Review signals: 1 connection review, 1 hardcoded secret, 198 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. <internal-ip>:7318 7 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. examples/demo/ALERTS-QUICKSTART.md

OSV reports a known vulnerability in this dependency version. 15 distinct locations. 132 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Only 200 of 337 findings are stored; the summary counts all of them.

Full safety evidence →

• Automatic instrumentation initializes successfully: Real input produced the expected result: GenAI OpenTelemetry instrumentation setup complete.

  Source: genai_otel.instrument()

  Input: example_usage.py with OTLP endpoint unset

  Expected: GenAI OpenTelemetry instrumentation setup complete.

  Command: /tmp/tv-venv/bin/python example_usage.py

  Observed: GenAI OpenTelemetry instrumentation setup complete. Warning: openai not installed. Skipping OpenAI examples. Warning: anthropic not installed. Skipping Anthropic examples. Warning: google-generativeai not installed. Skipping Google AI examples. Warning: psycopg2 not installed. Skipping database examples. Warning: redis not installed. Skipping Redis examples. Warning: pinecone not installed. Skipping Pinecone examples. Warning: kafka-python not installed. Skipping Kafka examples. --- Testing Infrastructure Instrumentation --- --- Testing Custom Configuration --- Custom configuration example s

Examples

• Run the documented example_usage.py demonstration: command completed successfully

  Source: example_usage.py

  Input: OTEL_EXPORTER_OTLP_ENDPOINT empty; no API credentials

  Expected: Instrumentor initializes and example finishes

  Command: /tmp/tv-venv/bin/python example_usage.py

  Observed: INFO - Global server metrics collector initialized 2026-10-28 16:27:22,516 - genai_otel.auto_instrument - INFO - Server metrics collector initialized (KV cache, request queue) 2026-10-28 16:27:22,517 - genai_otel.auto_instrument - INFO - Auto-instrumentation setup complete 2026-10-28 16:27:22,519 - genai_otel - INFO - GenAI OpenTelemetry instrumentation initialized successfully 2026-10-28 16:27:57,524 - genai_otel.cost_enrichment_processor - INFO - CostEnrichmentSpanProcessor shutdown 2026-10-28 16:27:57,525 - genai_otel.cost_enriching_exporter - INFO - CostEnrichingSpanExporter shutting down

Local or hosted: local

Initialize TraceVerde auto-instrumentation and run example_usage.py

pwd; rg --files -g 'README*' -g 'pyproject.toml' -g 'requirements*.txt' -g 'package.json' -g 'Makefile' -g 'AGENTS.md' -g '.github/**' -g '*.md' | head -80; python3 --version; git status --short --branch; sed -n '1,240p' README.md
sed -n '240,520p' README.md; ls -la; find . -maxdepth 3 -type f | head -100
cat pyproject.toml | head -120; sed -n '1,220p' example_usage.py; find examples -maxdepth 2 -type f | head -50; grep -R "instrument()\|ConsoleSpanExporter\|InMemorySpanExporter" -n examples | head -50
python3 -m venv /tmp/tv-venv && /tmp/tv-venv/bin/pip install -e .
SETUPTOOLS_SCM_PRETEND_VERSION_FOR_GENAI_OTEL_INSTRUMENT=1.20.0 /tmp/tv-venv/bin/pip install -e .
OTEL_EXPORTER_OTLP_ENDPOINT='' /tmp/tv-venv/bin/python example_usage.py
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/tmp/tv-venv/bin/python","example_usage.py"],"cwd":"<guest-path>","env":{"OTEL_EXPORTER_OTLP_ENDPOINT":""},"expected_text":"[OK] Telemetry export complete. Check your collector for traces and metrics."}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Automatic instrumentation initializes successfully","source":"genai_otel.instrument()","input":"example_usage.py with OTLP endpoint unset","expected":"GenAI OpenTelemetry instrumentation setup complete.","probe_kind":"cli","argv":["/tmp/tv-venv/bin/python","example_usage.py"],"env":{"OTEL_EXPORTER_OTLP_ENDPOINT":""},"expected_text":"GenAI OpenTelemetry instrumentation setup complete.","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Run the documented example_usage.py demonstration","source":"example_usage.py","input":"OTEL_EXPORTER_OTLP_ENDPOINT empty; no API credentials","expected":"Instrumentor initializes and example finishes","argv":["/tmp/tv-venv/bin/python","example_usage.py"],"cwd":"<guest-path>","env":{"OTEL_EXPORTER_OTLP_ENDPOINT":""},"expected_text":"[OK] Telemetry export complete. Check your collector for traces and metrics."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README, example_usage.py and examples entrypoints; no product scheduler or recurring cycle is documented. The example's five-second export wait is shutdown flushing, not a product cycle."}
EOF

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Initialize TraceVerde auto-instrumentation and run example_usage.py","operation_scope":"Python 3.12.3 venv with package dependencies installed; README-compatible Python >=3.9","steps":["Read README.md and inspected pyproject.toml and example_usage.py.","Created /tmp/tv-venv with python3 -m venv.","Installed the local package with SETUPTOOLS_SCM_PRETEND_VERSION_FOR_GENAI_OTEL_INSTRUMENT=1.20.0 /tmp/tv-venv/bin/pip install -e .","Ran OTEL_EXPORTER_OTLP_ENDPOINT='' /tmp/tv-venv/bin/python example_usage.py; it printed instrumentation setup complete and export complete.","Validated claims and replay with <env-var>=<guest-path> python3 -I <guest-path> --validate --replay; valid=true, status=PASS."],"deviations":["The provided source snapshot has no Git metadata; editable install initially failed because setuptools-scm could not infer a version. Re-ran with SETUPTOOLS_SCM_PRETEND_VERSION_FOR_GENAI_OTEL_INSTRUMENT=1.20.0.","No provider API calls were made: example_usage.py reported provider SDKs absent and requires API keys and external services for live calls. Auto-instrumentation setup itself succeeded."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF