Skip to content

Zed gateway capture preparation — 2026-11-01

TL;DR

Prepared an opt-in, key-isolated content callback inside the existing LiteLLM proxy, with no second gateway or version upgrade. Offline tests exercise the installed authentication adapter, SDK and Responses streaming lifecycle; the candidate image builds and its packaged callback loads disabled. No live key, editor setting, capture policy, database or service was changed.

Status

Slice State
Read-only Zed/gateway discovery Zed 1.26.2 and gateway LiteLLM 1.106.4 / SDK 1.45.1 verified; Phoenix API auth verified
Source implementation Prepared on isolated branch/worktree; existing dirty checkout preserved
Image and SDK safety Synthetic candidate build guard and 18 runtime tests pass
Shared capture policy Existing callbacks retained; additional capture defaults off
Live credentials/restart Not approved or performed
OpenAI/Phoenix/native Zed acceptance Not performed; synthetic live testing remains gated

Prepared changes

  • Native aliases for gpt-6.1-sol and default summary/commit model gpt-5.6-luna, with no sampling, reasoning, token-limit, caching or Priority overrides.
  • zed_phoenix.logger: explicit opt-in, pinned authenticated key hash and key-owned metadata marker. Client metadata cannot enable capture. One private, bounded exporter sends only to the fixed existing LAN Phoenix endpoint.
  • Public-field projection retains tool schemas, submitted context, output and exposed usage/summary detail; headers, auth, arbitrary metadata and opaque reasoning are excluded. Oversized fields are explicitly omitted, not silently truncated. This is not a scrubber for secrets in message/tool text.
  • Image/build-context/deployment-fingerprint integration and a 30-second graceful drain window, plus the activation/rollback runbook.
flowchart TD
    A[Approved preparation] --> B[Offline SDK and isolation tests]
    B --> C[Review and merge gate]
    C --> D[Retention, local transport and credential approval]
    D --> E[Approved existing-proxy rollout]
    E --> F[Synthetic OpenAI and Phoenix acceptance]
    F --> G[Synthetic Zed-native conversation]

Validation and corrections

The independent review caught SDK-normalized metadata/no-log defaults rejecting valid requests, retry failures consuming success deduplication, incomplete Responses being labeled completed, and missing exit drain. Those defects were fixed and re-reviewed; an independent automatic-router-retry probe exported both the failed-attempt observation and final successful output.

  • Runtime unit suite: 18 passed, in an existing-image and packaged-candidate environment using read-only mounts, networking disabled and synthetic data.
  • New host integration contracts: 4 passed.
  • Deployment-input regression suite: 43 passed, including mutation of both new image inputs.
  • LiteLLM host regression suite: 145 run, six opt-in runtime tests skipped, otherwise passing after updating the explicit safe build-context allowlist.
  • Dependency-update contracts: 4 passed. New packaging contracts also exercise synthetic version/digest changes and reject missing guards/unsafe image pins.
  • Full candidate image build succeeded; new network-disabled guard emitted 14 synthetic spans with LiteLLM 1.106.4 / SDK 1.45.1. Packaged custom loader check confirmed disabled capture with no exporter initialized.

The first whole-image --network=none attempt stopped at the existing pip/Pillow bootstrap step. The subsequent normal build succeeded; only its test guards are claimed network-isolated. A first read-only packaged import lacked the required writable /tmp; adding the same bounded tmpfs used by the runtime suite passed. The final guard also verifies a native Responses function-call/result round trip, 20 complete tool schemas, 60-turn first/middle/last sentinels, and a single Router call's automatic retry. Documentation source/built-site checks, strict MkDocs, pre-commit and all eleven generator drift checks passed. Gitleaks 8.30.1 scanned the staged patch with redacted output and found no leaks. No safety deadline or test was bypassed. These are not live Phoenix ingestion, DB-backed virtual-key authentication, OpenAI billing or Zed E2E results.

Follow-up: native-host build deadline

Komodo Update 6ae7ed7636b469593dbccb1a completed unsuccessfully at Compose Build: Zed content guard FAILED: deadline. The running proxy retained its prior image and six-day uptime. The failure was not a provider/credential error or a failed isolation assertion.

Disposable native-host diagnostics found FastAPI/Pydantic route registration consuming about 53 seconds, and the first synthetic HTTPX provider call reached around 60 seconds. Local ARM/AMD64 success did not establish an adequate cold- startup budget on infra-services. An initial lightweight-child change alone still failed at native-api; it was not treated as a fix without further evidence.

The reviewed source fix retains every guard check and network restriction, uses finite 120-second main / 60-second exit-child budgets, and emits allowlisted phase/check labels without arbitrary exception text or child output. The exit child avoids the full request-setup fixture while preserving typed-auth gating, real SDK/protobuf export and normal-exit flushing; parent auth adapters remain real. Runtime callback, model routes, version pins and global capture policy are unchanged.

  • Full optimized runtime unit suite: 24 passed on both local ARM and emulated AMD64; independent packaged-image review also passed all 24 tests.
  • Candidate image build: passed, including the network-disabled guard's 14 spans.
  • Exact uninstrumented candidate sources, streamed only into a disposable native- host container's tmpfs: 14 spans, exit 0, 142.63 seconds including Python startup, LiteLLM 1.106.4 / SDK 1.45.1. No production files were edited.

The 120-second watchdog starts after Python startup, so it is not a total wall- clock bound. No deployment was retried and no service restarted. Actual Komodo build/cutover and live acceptance remain pending a merged fix and separately approved scoped retry; the isolated pass is not production acceptance.

Remaining gates

Owner review/merge and separate operational approval are required. Verify actual retention, roles, backup/offsite policy and telemetry before real content; the existing collector hop is unencrypted LAN HTTP. Create/restrict the dedicated key only after spend limits are chosen, pin its hash through private inputs, then approve a scoped proxy rebuild/recreation and synthetic paid-provider tests. The OpenAI URL override is owner-approved but deferred until gateway routes and its keychain credential are ready, to avoid breaking current Zed requests.

The callback is best-effort completed-call capture, not durable audit logging or complete Zed execution tracing. Native Phoenix JSON/message presentation, partial streams, cancellations, compaction, thread relationships and actual backup locality remain unverified; full native tool timing requires Zed-side work.