feat(ocsf): emit AI Operation events from inference proxy (class_uid 7001) - #2664
Open
zanetworker wants to merge 2 commits into
Open
feat(ocsf): emit AI Operation events from inference proxy (class_uid 7001)#2664zanetworker wants to merge 2 commits into
zanetworker wants to merge 2 commits into
Conversation
Add OCSF v1.8.0 ai_operation event support for tracking AI model
inference calls proxied through inference.local. This is the event
struct, builder, serialization, shorthand formatter, and tests only.
Proxy wiring is a follow-up PR.
New files:
events/ai_operation.rs — AIOperationEvent struct
builders/ai_operation.rs — AIOperationBuilder with model/provider/
tokens/latency setters
Fields: model, provider, input_tokens, output_tokens, latency_ms,
operation_type. All optional except class_uid/class_name.
Shorthand format: AI:INFERENCE [INFO] claude-opus-4 via anthropic
(12000 in, 3200 out) 2400ms
Edge cases tested: no model (defaults to "unknown" in shorthand),
zero tokens (serializes as 0, not omitted), input-only tokens,
all-None round-trip, operation_type override.
Closes NVIDIA#2663 (event class portion; proxy wiring is separate)
Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
Wire AIOperationBuilder into the inference proxy's buffered and streaming response paths. When inference.local proxies a model call: - Extract model name from request body (fallback to route config) - For buffered responses: extract token counts from response usage - For streaming responses: emit with model/provider/latency only (token counts not available without accumulating all SSE chunks) - Emit AI:INFERENCE OCSF event through the standard pipeline Helper functions added: extract_model_from_request() — parses request JSON for model field extract_usage_from_response() — parses response JSON for usage emit_ai_operation() — builds and emits the AIOperationBuilder event Edge cases handled: - Missing model in request body (falls back to route.model) - Empty model string (filtered out, treated as None) - Missing or malformed usage in response (emits with None tokens) - Streaming responses (emits without token counts) Closes NVIDIA#2663 Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
zanetworker
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
August 9, 2026 20:13
Collaborator
|
We vendor in the 1.7 schema. If we are going to support 1.8 events we should update the schema too. Also, what is the plan when inference does not go through inference.local? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add OCSF v1.8.0
ai_operationevent support. When the inference proxy routes a model call throughinference.local, emit an AI Operation event (class_uid 7001) capturing model identity, token consumption, and provider routing.No agent sandbox in the market produces AI-specific OCSF events today.
Related Issue
Closes #2663
Changes
Commit 1: Event class (
openshell-ocsfcrate)events/ai_operation.rs—AIOperationEventstruct with model, provider, input_tokens, output_tokens, latency_ms, operation_type fieldsbuilders/ai_operation.rs—AIOperationBuilderwith chainable settersevents/mod.rs—AIOperationvariant inOcsfEventenum with Serialize/Deserialize/class_uid/base dispatchformat/shorthand.rs—AI:INFERENCE [INFO] claude-opus-4 via anthropic (12000 in, 3200 out) 2400mslib.rs— re-exportAIOperationBuilderCommit 2: Proxy wiring (
openshell-supervisor-networkcrate)proxy.rs—extract_model_from_request(),extract_usage_from_response(),emit_ai_operation()helpersformat_http_response()with model + token counts from responseTesting
cargo test -p openshell-ocsf— 138 passed, 0 failed (11 new tests)cargo test -p openshell-supervisor-network— 1061 passed, 0 failedcargo check -p openshell-sandbox -p openshell-server— full chain compilesmise run e2eto verify the emit path.Edge cases tested:
Checklist