feat(runtime): add OpenTelemetry observability

.github/workflows/build-development-artifacts.yml

@@ -0,0 +1,89 @@
+name: Build OpenAPPA Development Artifacts
+
+on:
+  pull_request:
+    types:
+      - labeled
+      - synchronize
+
+permissions: {}
+
+concurrency:
+  group: "openappa-development-${{ github.event.pull_request.number }}"
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: Build Linux development artifacts
+    if: >-
+      ${{ github.event.pull_request.head.repo.full_name == github.repository &&
+          ((github.event.action == 'labeled' && github.event.label.name == 'build-development-artifacts') ||
+           (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'build-development-artifacts'))) }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    permissions:
+      contents: write # Publish the opt-in development prerelease and its immutable assets.
+    steps:
+      - name: Checkout the reviewed PR commit
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Resolve development release
+        id: release
+        env:
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          short_sha=${HEAD_SHA:0:12}
+          release_ref="dev-pr-${PR_NUMBER}-${short_sha}"
+          echo "release_ref=${release_ref}" >> "$GITHUB_OUTPUT"
+          echo "version=${release_ref#dev-}" >> "$GITHUB_OUTPUT"
+
+      - name: Stage plugin and build runtime
+        env:
+          APPA_RELEASE_REF: ${{ steps.release.outputs.release_ref }}
+        run: |
+          mkdir -p dist
+          sh scripts/appa-stage-plugin-bundle.sh staged
+          version=$(cargo metadata --locked --no-deps --format-version 1 \
+            | jq -r '.packages[] | select(.name == "appa") | .version')
+          tar -C staged -czf "dist/appa-plugin-${version}.tar.gz" .
+          cp "dist/appa-plugin-${version}.tar.gz" "dist/appa-plugin-${APPA_RELEASE_REF}.tar.gz"
+          plugin_sha256=$(sha256sum "dist/appa-plugin-${version}.tar.gz" | cut -d' ' -f1)
+          APPA_PLUGIN_SHA256="$plugin_sha256" cargo build --release --locked --package appa
+          mkdir -p package
+          cp target/release/appa package/appa
+          chmod 755 package/appa
+          tar -C package -czf "dist/appa-x86_64-unknown-linux-gnu.tar.gz" appa
+          (cd dist && sha256sum *.tar.gz > SHA256SUMS)
+
+      - name: Publish immutable development prerelease
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RELEASE_REF: ${{ steps.release.outputs.release_ref }}
+        run: |
+          gh release create "$RELEASE_REF" dist/* \
+            --repo "$GITHUB_REPOSITORY" \
+            --target "$HEAD_SHA" \
+            --title "OpenAPPA ${RELEASE_REF}" \
+            --notes "Development artifacts for PR #${PR_NUMBER} at ${HEAD_SHA}. Not a supported release." \
+            --prerelease
+
+      - name: Publish usage summary
+        env:
+          RELEASE_REF: ${{ steps.release.outputs.release_ref }}
+        run: |
+          {
+            echo "### OpenAPPA development build"
+            echo
+            echo "Release: https://github.com/${GITHUB_REPOSITORY}/releases/tag/${RELEASE_REF}"
+            echo
+            echo '```dockerfile'
+            echo "ARG APPA_VERSION=${RELEASE_REF}"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/pr-title-linter.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Lint PR title
         if: ${{ github.event_name == 'pull_request' }}
-        uses: grafana/shared-workflows/actions/lint-pr-title@70c40e5b6522c854a55334124545261cae3d4c73 # v1.2.4
+        uses: grafana/shared-workflows/actions/lint-pr-title@70c40e5b6522c854a55334124545261cae3d4c73 # lint-pr-title/v1.2.4
         with:
           config-path: "${{ github.workspace }}/.github/commitlint.config.js"
         env:

appa-runtime/Cargo.toml

@@ -30,6 +30,10 @@ futures-util = { version = "0.3", default-features = false, features = ["alloc"]
 libloading = "0.9"
 libc = "0.2"
 flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
+opentelemetry = { version = "0.32", features = ["logs", "metrics", "trace"] }
+opentelemetry-appender-tracing = "0.32"
+opentelemetry-otlp = { version = "0.32", default-features = false, features = ["http-proto", "logs", "metrics", "reqwest-blocking-client", "trace"] }
+opentelemetry_sdk = { version = "0.32", features = ["logs", "metrics", "trace"] }
 rand = "0.10"
 reqwest = { workspace = true }
 # `server` carries the tool macros' schema derive; `transport-streamable-http-server`
@@ -43,9 +47,10 @@ sha2 = { workspace = true }
 thiserror = { workspace = true }
 tar = "0.4"
 tempfile = "3"
-tokio = { workspace = true }
+tokio = { workspace = true, features = ["signal"] }
 toml = { workspace = true }
 tracing = { workspace = true }
+tracing-opentelemetry = { version = "0.33", default-features = false }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 url = "2"
 # Not rig-core's `rustls` feature: it pins reqwest to aws-lc-rs, which would put a
@@ -63,6 +68,9 @@ tar = "0.4"
 # The fail points the orchestration tests drive. A dev-dependency, so they are
 # absent from the binary.
 appa-eventlog = { workspace = true, features = ["fault-injection"] }
+# The in-memory span exporter verifies the semantic attributes that leave the
+# tracing bridge, rather than only the runtime's intermediate projection.
+opentelemetry_sdk = { version = "0.32", features = ["testing", "trace"] }
 jsonschema = { version = "0.53.0", default-features = false }
 # The elicitation round trip is only real with a real client on the
 # other end: these features exist for `tests/hitl_elicitation.rs` and