LoopGrid v0.8.1 — OTLP/HTTP protobuf interoperability

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: npm
+    directory: "/sdk/javascript"
+    schedule:
+      interval: weekly
+    groups:
+      javascript-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly

.github/workflows/codeql.yml

@@ -0,0 +1,24 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '31 4 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Python and JavaScript
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: python,javascript-typescript
+      - uses: github/codeql-action/analyze@v4

.github/workflows/tests.yml

@@ -4,15 +4,41 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   python-tests:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13']
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
-          python-version: '3.12'
+          python-version: ${{ matrix.python-version }}
           cache: 'pip'
       - run: python -m pip install --upgrade pip
       - run: python -m pip install -r requirements.txt
       - run: python -m pytest -q
+      - run: python -m py_compile app/*.py verifier/*.py
+
+  javascript-sdk:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '20'
+      - run: node --check sdk/javascript/index.js
+      - run: npm pack --dry-run
+        working-directory: sdk/javascript
+
+  docker-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Build LoopGrid image
+        run: docker build -t loopgrid-ci .

CHANGELOG.md

@@ -1,3 +1,25 @@
+# LoopGrid v0.8.1 — OTLP Interoperability
+
+## Added / changed
+
+- `/v1/traces` accepts OTLP/HTTP binary protobuf (`application/x-protobuf`) in addition to JSON.
+- OTLP/HTTP gzip request bodies are supported with decoded-size enforcement.
+- JSON and protobuf requests share one normalized trace-to-evidence mapping.
+- OTLP `AnyValue` parsing covers scalar, array, key/value-list and byte values.
+- Successful OTLP responses use the standard `ExportTraceServiceResponse` encoding and mirror the request content type.
+- `X-LoopGrid-Accepted` exposes the accepted-span count without adding non-standard fields to the OTLP response body.
+- Added malformed-body, unsupported-media-type, gzip, parity and protobuf regression tests.
+- CI updated to current GitHub Actions and multiple supported Python versions.
+- Added Dependabot and CodeQL workflow configuration.
+
+## Compatibility
+
+- Evidence Bundle v2, Evidence Profile `3.0-draft`, signing, checkpoints and the standalone verifier are unchanged.
+- GitHub Marketplace verifier `v1.0.0` does not require an update for this server-ingestion change.
+- Python and JavaScript SDK package APIs remain `0.8.0`; they are not republished unless their package code changes.
+
+---
+
 # LoopGrid v0.8.0 — Design Partner Release
 
 ## Focus

README.md

@@ -29,6 +29,14 @@ CAPTURE → SEAL → VERIFY → INVESTIGATE → REVIEW → REPLAY → PROVE
 
 The append-only decision lifecycle includes `decision_created`, `model_completed`, `policy_evaluated`, human review events, tool/action evidence, `outcome_observed` and optional later replay/adjudication events. LoopGrid derives the current state from that history and rejects impossible consequential-event ordering.
 
+## v0.8.1 interoperability update
+
+- `/v1/traces` now accepts standard OTLP/HTTP binary protobuf and JSON trace payloads.
+- `Content-Encoding: gzip` is supported for OTLP/HTTP trace requests.
+- OTLP success responses now use the standard `ExportTraceServiceResponse` encoding and match the request `Content-Type`.
+- Decoded OTLP request bodies are bounded by `LOOPGRID_MAX_REQUEST_BODY_BYTES` to limit decompression expansion.
+- Existing evidence, signing, bundle and verifier formats are unchanged from v0.8.0.
+
 ## v0.8 highlights
 
 - PostgreSQL-backed Docker deployment path.
@@ -41,7 +49,7 @@ The append-only decision lifecycle includes `decision_created`, `model_completed
 - FULL / REDACTED / PROOF-ONLY privacy modes.
 - AES-256-GCM disclosure vault with erasable payloads.
 - Deterministic policy provenance and human-review evidence.
-- REST, Python, TypeScript/JavaScript, OpenTelemetry/OTLP and MCP paths.
+- REST, Python, TypeScript/JavaScript, OpenTelemetry/OTLP (HTTP protobuf + JSON) and MCP paths.
 - Optional live OpenAI/Anthropic replay/provider validation helpers.
 - Optional RFC3161 timestamp and AWS KMS adapter paths.
 
@@ -146,6 +154,27 @@ Portable consistency proof and signer trust are separate concepts. A bundle can
 
 Encrypted disclosures can be erased later without rewriting the signed evidence chain.
 
+
+## OTLP/HTTP trace ingestion
+
+LoopGrid accepts OTLP trace exports on the standard `/v1/traces` path using either:
+
+- `Content-Type: application/x-protobuf` (recommended/default for many OpenTelemetry SDKs)
+- `Content-Type: application/json`
+- optional `Content-Encoding: gzip` for either encoding
+
+Example environment configuration:
+
+```bash
+export OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=http://127.0.0.1:8000/v1/traces
+export OTEL_EXPORTER_OTLP_TRACES_PROTOCOL=http/protobuf
+export OTEL_EXPORTER_OTLP_TRACES_HEADERS="X-LoopGrid-Key=lg_live_...,X-LoopGrid-Workspace=default"
+```
+
+A successful OTLP export returns the standard empty `ExportTraceServiceResponse`. The response header `X-LoopGrid-Accepted` reports how many spans were mapped into LoopGrid decisions. LoopGrid's OTLP adapter preserves both current `gen_ai.provider.name` and the older `gen_ai.system` provider attribute when present.
+
+This ingestion compatibility does not change the LoopGrid evidence bundle, hash-chain, signing or offline-verifier contracts.
+
 ## Auth model
 
 Service API-key scopes:
@@ -166,7 +195,7 @@ In production mode v0.8 refuses startup when auth is disabled or bootstrap/platf
 
 ## Supported integrations
 
-Validated/foundation paths include REST, Python SDK, TypeScript/JavaScript SDK, OpenAI helper, Anthropic helper, LangGraph helper, OpenTelemetry/OTLP and allow-listed MCP proxy/ingestion.
+Validated/foundation paths include REST, Python SDK, TypeScript/JavaScript SDK, OpenAI helper, Anthropic helper, LangGraph helper, OpenTelemetry/OTLP HTTP (protobuf + JSON) and allow-listed MCP proxy/ingestion.
 
 The canonical LoopGrid evidence schema remains provider-neutral. Do not couple your historical evidence model to a single vendor's telemetry schema.
 

RELEASE-CHECKLIST-v0.8.1.md

@@ -0,0 +1,45 @@
+# LoopGrid v0.8.1 — OTLP Interoperability Release Checklist
+
+This is a backward-compatible server-ingestion update from the public v0.8.0 Design Partner Release.
+The evidence bundle, signing format, verifier contract, Python SDK API and JavaScript SDK API are intentionally unchanged.
+
+## Before changing GitHub
+
+- [ ] Keep the current public `main` as the rollback point. Do not delete or overwrite the existing `v0.8.0` tag/release if present.
+- [ ] Upload the v0.8.1 changed/new files with their repository paths preserved.
+- [ ] Confirm `app/version.py` reports `0.8.1-design-partner`.
+- [ ] Confirm `sdk/python/pyproject.toml`, `sdk/python/loopgrid/__init__.py`, and `sdk/javascript/package.json` remain at `0.8.0` because the SDK package code did not change.
+- [ ] Do not modify the separate `loopgridio/loopgrid-evidence-verify` Marketplace repository for this release.
+
+## Required CI checks
+
+- [ ] GitHub `tests` workflow is green for Python 3.10, 3.12 and 3.13.
+- [ ] JavaScript SDK syntax / `npm pack --dry-run` job is green.
+- [ ] Docker image build job is green.
+- [ ] CodeQL workflow is green or has no blocking findings caused by this patch.
+- [ ] Dependabot configuration is accepted by GitHub.
+
+## OTLP acceptance checks
+
+- [ ] OTLP/HTTP JSON request succeeds and returns `{}` with `Content-Type: application/json`.
+- [ ] OTLP/HTTP protobuf request succeeds and returns an empty `ExportTraceServiceResponse` with `Content-Type: application/x-protobuf`.
+- [ ] Gzipped protobuf request succeeds.
+- [ ] Malformed protobuf is rejected cleanly.
+- [ ] Unsupported content type/encoding is rejected cleanly.
+- [ ] Decoded gzip body limit is enforced.
+- [ ] JSON and protobuf inputs map equivalent semantic attributes into LoopGrid evidence.
+- [ ] A standard OpenTelemetry Python OTLP/HTTP protobuf exporter can send a span successfully.
+- [ ] Evidence generated from protobuf ingestion exports successfully and verifies with the existing LoopGrid offline verifier / GitHub Action v1.0.0 contract.
+
+## Release
+
+- [ ] Commit to `main` only after CI is green.
+- [ ] Create a GitHub release/tag `v0.8.1` from the tested commit.
+- [ ] Release note: OTLP/HTTP protobuf + JSON + gzip interoperability; no evidence-format change.
+- [ ] Do **not** republish PyPI `loopgrid` or npm `@cybertechsoft/loopgrid` solely for this backend change.
+- [ ] Rebuild any deployed/self-hosted Docker image from the new GitHub source.
+- [ ] Update loopgrid.io integration/docs copy only after the public GitHub checks are green.
+
+## Rollback
+
+If GitHub CI or a deployment smoke test fails, revert the v0.8.1 commit(s) on `main` or redeploy the previously validated v0.8.0 source. Do not rewrite published tags.

UPGRADE-INSTRUCTIONS-v0.8.1.md

@@ -0,0 +1,59 @@
+# Safe upgrade instructions — public LoopGrid v0.8.0 → v0.8.1
+
+The patch was built from the direct GitHub `loopgrid-main.zip` baseline supplied on 2026-09-18. Do not delete the current repository or overwrite any published tag.
+
+## Files to add
+
+- `.github/dependabot.yml`
+- `.github/workflows/codeql.yml`
+- `app/otlp.py`
+- `tests/test_otlp_http.py`
+- `RELEASE-CHECKLIST-v0.8.1.md`
+- `VALIDATION-RELEASE-RECORD-v0.8.1.md`
+- `UPGRADE-INSTRUCTIONS-v0.8.1.md`
+
+## Existing files to replace
+
+- `.github/workflows/tests.yml`
+- `CHANGELOG.md`
+- `README.md`
+- `app/main.py`
+- `app/schemas.py`
+- `app/static/app.js`
+- `app/static/index.html`
+- `app/version.py`
+- `requirements.txt`
+- `scripts/real_scenario_test.py`
+- `tests/test_flow.py`
+
+## Files that must NOT be changed for this release
+
+- `verifier/loopgrid_verify.py`
+- `sdk/python/pyproject.toml`
+- `sdk/python/loopgrid/__init__.py`
+- `sdk/python/loopgrid/client.py`
+- `sdk/javascript/package.json`
+- `sdk/javascript/index.js`
+- `sdk/javascript/index.d.ts`
+- evidence-profile and bundle-format documents/schemas unless a separate reviewed change is intended
+
+The Python and JavaScript SDK packages therefore stay at `0.8.0`. The server runtime becomes `0.8.1-design-partner`.
+
+## Safest GitHub update sequence
+
+1. Confirm the current public repository is still `cybertechsoft/loopgrid` and keep the downloaded `loopgrid-main.zip` as rollback backup.
+2. Apply only the files listed above, preserving their exact repository paths.
+3. Commit with a message such as `Add OTLP HTTP protobuf interoperability`.
+4. Open **Actions** immediately after the commit. Do not create a release yet.
+5. Wait for the `tests` workflow and `CodeQL` workflow to finish.
+6. Confirm all Python matrix jobs, JavaScript SDK job and Docker build job are green.
+7. If any job is red, stop and fix/revert before tagging. The existing public v0.8.0 release remains the rollback baseline.
+8. When green, test `/health` and confirm the runtime reports `0.8.1-design-partner`.
+9. Run one OTLP JSON request and one standard OTLP/HTTP protobuf exporter request against the deployment being evaluated.
+10. Export evidence from the protobuf-created decision and verify it with the existing `loopgrid-evidence-verify@v1.0.0` Action or the unchanged standalone verifier.
+11. Only then create the GitHub release/tag `v0.8.1`.
+12. Do not publish new PyPI/npm versions unless SDK package code is intentionally changed later.
+
+## Website update timing
+
+Do not update the live website first. After GitHub v0.8.1 is green and validated, update the website integration/docs copy from `OTLP/HTTP JSON` to `OTLP/HTTP protobuf + JSON`, and document gzip support. No website claim should say every OpenTelemetry framework has been validated unless it has actually been tested.

VALIDATION-RELEASE-RECORD-v0.8.1.md

@@ -0,0 +1,47 @@
+# LoopGrid v0.8.1 — OTLP Interoperability Validation Record
+
+**Baseline:** public `cybertechsoft/loopgrid` download supplied on 2026-09-18  
+**Runtime candidate:** `0.8.1-design-partner`  
+**Evidence profile:** `3.0-draft`  
+**Bundle contract:** `loopgrid/evidence-bundle/2` (unchanged)
+
+## Validation completed in the build workspace
+
+| Check | Result | Notes |
+|---|---|---|
+| Python test suite | PASS | 55 tests passed. |
+| Python syntax compile | PASS | `app/*.py` and `verifier/*.py`. |
+| JavaScript SDK syntax | PASS | `node --check sdk/javascript/index.js`. |
+| UI JS syntax | PASS | `node --check app/static/app.js`. |
+| npm dry-run pack | PASS | Existing SDK remains `@cybertechsoft/loopgrid@0.8.0`; 5 expected files only. |
+| OTLP/HTTP JSON | PASS | Standard `{}` `ExportTraceServiceResponse` JSON body; accepted count in response header. |
+| OTLP/HTTP protobuf | PASS | Binary `ExportTraceServiceRequest` accepted; binary `ExportTraceServiceResponse` returned. |
+| OTLP gzip | PASS | Gzipped protobuf accepted. |
+| Malformed protobuf | PASS | Clean 400 with protobuf `google.rpc.Status` body. |
+| Unsupported media/encoding | PASS | Clean 415 responses. |
+| Decompressed body limit | PASS | Oversized decoded gzip body rejected with 413. |
+| JSON/protobuf mapping parity | PASS | Core decision/model/context/action attributes map equivalently. |
+| Standard OpenTelemetry Python HTTP exporter | PASS | `opentelemetry-exporter-otlp-proto-http` successfully exported a real span to `/v1/traces`; LoopGrid recorded the expected provider, model, service and tool attributes. |
+| Evidence after protobuf ingestion | PASS | Exported bundle verifies with the existing standalone verifier contract; Bundle v2 and Ed25519 unchanged. |
+| Full external HTTP real-scenario validation | PASS | Complete decision lifecycle, policy, human review, action/outcome, chain verification, tamper detection, checkpoint, signer-pinned offline verification, withheld export and OTLP JSON ingestion all passed. |
+| YAML parse | PASS | CI, Dependabot and CodeQL YAML parse successfully. |
+| Docker build in this build workspace | NOT RUN | Docker CLI is not available in this environment. A Docker build job is included in GitHub CI and must be green before tagging `v0.8.1`. |
+| CodeQL execution | NOT RUN LOCALLY | CodeQL workflow is included and must be green/triaged on GitHub before tagging. |
+
+## Compatibility boundary
+
+No changes were made to:
+
+- Evidence Bundle v2 structure
+- Evidence Profile `3.0-draft`
+- Ed25519 signing semantics
+- SHA-256 workspace chain semantics
+- checkpoint representation
+- standalone verifier behavior
+- Python SDK package source/API
+- JavaScript SDK package source/API
+- GitHub Marketplace verifier Action `v1.0.0`
+
+## Release gate
+
+Do not tag `v0.8.1` until the pushed GitHub commit has green Python, JavaScript SDK and Docker jobs, and the CodeQL run has no new blocking finding caused by this patch.