Explicit-feedback-only upload through OpenTelemetry
仅在显式反馈后通过 OpenTelemetry 上传
Feedback needs the session context it describes and a delivery path independent of the model provider or a later model request. Ordinary activity must not authorize uploads. Inherited feedback must not count as a child Session's consent.
English
Problem
Feedback needs the session context it describes and a delivery path independent of the model provider or a later model request. Ordinary activity must not authorize uploads. Inherited feedback must not count as a child Session's consent.
Decision
The base mounts OTel in FEEDBACK_ONLY for all users and providers, including deepseek-official and Sessions without a request header. Only new own feedback/record, feedback/message-put, and feedback/message-delete events authorize capture through that exact canonical event. Text feedback, ratings, material note edits, and withdrawals count. Cold feedback/committed notifications supply a committed snapshot without publishing a live Session or Agent.
An authorized prefix includes all unhanded canonical context from seq 0 through the feedback, not just its payload. A child needs its own new feedback; its prefix then includes inherited history. Later records wait for the next explicit feedback. Request activity, request headers, Session creation or adoption, restoration, plugin mount, and HMR never authorize capture; stored feedback alone triggers nothing.
The backend uses on-demand capture with complete history and the existing redaction waterfall. DISABLED constructs no transport. FULL is rejected rather than aliased. Direct ctx.sessionTelemetry.emit() calls are no-ops, so callers cannot bypass feedback authorization. SDK scheduled flush and shutdown may finish previously authorized batches but never capture new records. Sending after submission needs no further user interaction or model call.
The canonical-feedback decision owns storage, versions, deletion, and plain command confirmation. The default-on DeepSeek contribution remains independent, with its existing destination and acceptance behavior.
Alternatives considered
Filter by provider or endpoint hostname. Feedback authorizes the same bounded context for every user; a provider choice, gateway, or missing header does not change that authorization.
Use only later DeepSeek requests. Other providers do not carry dsh_session_log, and final feedback may have no subsequent request. The existing OTel pipeline sends independently without a custom uploader or model call.
Keep continuous capture or replay stored feedback on lifecycle events. Deployment configuration and old feedback do not authorize new capture. Only a new explicit submission does. Parent feedback likewise cannot authorize a child upload.
Consequences
Handoff is best-effort, not collector acceptance. Same-object cursors suppress repeated capture, but fresh cold snapshots and new feedback after restart can repeat prefixes; receivers deduplicate on (session.id, session.format_version, event.seq). There is no durable OTel outbox, delivery watermark, or harness HTTP retry promise. SDK batching and loss behavior apply after enqueue. OTel and the default-on DeepSeek path can overlap. Withdrawal exports a deletion event, not remote erasure.
OTel tests cover explicit-feedback capture, provider-independent behavior, lifecycle silence, fork consent, cold commits, and direct-call denial. Coordinator tests cover history capture; base tests pin the mounted default.
中文
问题
反馈需要它所描述的会话上下文，以及不依赖模型提供方或后续模型请求的投递路径。普通活动不得授权上传。继承的反馈不得视为子 Session 的同意。
决策
基础配置为所有用户和提供方以 FEEDBACK_ONLY 挂载 OTel，包括 deepseek-official 和没有请求头的 Session。只有新的自身 feedback/record、feedback/message-put 和 feedback/message-delete 事件授权捕获，且截止该确切的权威事件。文本反馈、评分、实质备注编辑与撤回均算作反馈。冷会话 feedback/committed 通知提供已提交快照，不发布存活 Session 或 Agent。
授权前缀包含从 seq 0 到该反馈的所有尚未交接的权威上下文，而非只有反馈载荷。子会话需要新的自身反馈；之后其前缀包含继承历史。后续记录等待下一次显式反馈。请求活动、请求头、Session 创建或接纳、恢复、插件挂载和 HMR（热模块替换）绝不授权捕获；仅有存储的反馈不会触发任何上传。
后端使用包含完整历史的按需捕获与现有脱敏 waterfall（瀑布式事件）。DISABLED 不构造传输。FULL 被拒绝，不作为别名。直接调用 ctx.sessionTelemetry.emit() 是空操作，因此调用方不能绕过反馈授权。SDK 定时刷新和关闭可以完成先前已授权的批次，但绝不捕获新记录。提交后的发送无需进一步用户交互或模型调用。
权威反馈决策负责存储、版本、删除与纯命令确认。默认开启的 DeepSeek 贡献保持独立，保留现有目标与接受行为。
考虑过的替代方案
按提供方或端点主机名过滤。 反馈为每位用户授权相同的有界上下文；提供方选择、网关或缺失请求头不改变该授权。
仅使用后续 DeepSeek 请求。 其他提供方不携带 dsh_session_log，而最终反馈之后可能没有请求。现有 OTel 流水线可独立发送，无需自定义上传器或模型调用。
保留持续捕获或在生命周期事件上回放存储的反馈。 部署配置和旧反馈不授权新捕获。只有新的显式提交才授权。父会话反馈同样不能授权子会话上传。
后果
交接尽力而为，不代表采集端接受。同对象游标抑制重复捕获，但新冷快照和重启后的新反馈可能重复前缀；接收方按 (session.id, session.format_version, event.seq) 去重。没有持久化 OTel outbox、投递水位或 harness HTTP 重试承诺。入队后适用 SDK 批处理与丢失行为。OTel 与默认开启的 DeepSeek 路径可能重叠。撤回导出删除事件，不是远端擦除。
OTel 测试覆盖显式反馈捕获、提供方无关行为、生命周期静默、fork 同意、冷会话提交与直接调用拒绝。协调器测试覆盖历史捕获；基础配置测试固定挂载默认值。