feat(compute-plane): scaffold request-trace-uploader

.github/workflows/bazel.yml

@@ -146,6 +146,7 @@ jobs:
           worker-init|src/compute-plane-services/worker-init|false|go-root|build-container
           worker-llm-credentials|src/compute-plane-services/worker-llm-credentials|false|go-root|build-container
           worker-task|src/compute-plane-services/worker-task|false|go-root|build-container
+          request-trace-uploader|src/compute-plane-services/request-trace-uploader|false|go-root|build-container
           worker-utils|src/compute-plane-services/worker-utils|false|go-root|build-container
           function-autoscaler|src/control-plane-services/function-autoscaler|false|go-root|build-container
           helm-reval|src/control-plane-services/helm-reval|false|go-root|build-container

go.work.bazel

@@ -41,6 +41,7 @@ use (
 	./src/compute-plane-services/worker-init
 	./src/compute-plane-services/worker-llm-credentials
 	./src/compute-plane-services/worker-task
+	./src/compute-plane-services/request-trace-uploader
 	./src/compute-plane-services/worker-utils
 	./src/invocation-plane-services/grpc-proxy
 	./src/invocation-plane-services/llm-api-gateway

src/compute-plane-services/request-trace-uploader/AGENTS.md

@@ -0,0 +1,31 @@
+# AGENTS.md - request-trace-uploader
+
+Native Go sidecar scaffold for closed Dynamo request-trace segments. It does
+not publish or delete source segments until a supported upload adapter lands.
+
+## Layout
+
+- `cmd/`: process entrypoint and OCI image target
+- `internal/config/`: current sidecar contract and bounded policy parsing
+- `internal/segment/`: closed trace/audit segment discovery
+- `internal/health/`: liveness and readiness handlers
+- `internal/upload/`: future upload-client boundary
+- `internal/service/`: startup, recovery scan, and HTTP server
+
+## Build and test
+
+```bash
+bazel test //src/compute-plane-services/request-trace-uploader/...
+bazel build //src/compute-plane-services/request-trace-uploader/cmd:image
+```
+
+Run `bazel run //:gazelle` after changing Go imports or Bazel metadata.
+
+## Rules
+
+- Preserve the existing `trace` and `audit` capture-type names.
+- Treat the highest indexed segment for each prefix as active.
+- Do not add a release entry until an approved upload adapter exists.
+- Do not add a Prometheus scrape endpoint. The later observability increment
+  exports logs, traces, and metrics through BYOO OTLP endpoints.
+- Do not log request payloads, credentials, paths, or remote upload IDs.

src/compute-plane-services/request-trace-uploader/BUILD.bazel

@@ -0,0 +1,5 @@
+load("@gazelle//:def.bzl", "gazelle")
+
+# gazelle:prefix github.com/NVIDIA/nvcf/src/compute-plane-services/request-trace-uploader
+# gazelle:go_naming_convention import_alias
+gazelle(name = "gazelle")

src/compute-plane-services/request-trace-uploader/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

src/compute-plane-services/request-trace-uploader/README.md

@@ -0,0 +1,52 @@
+# request-trace-uploader
+
+`request-trace-uploader` is the NVCF sidecar for Dynamo request tracing.
+Dynamo calls the captured objects `RequestTraceRecord` values. The records that
+contain input and output payloads have event type `request_payload`.
+
+The current deployment writes request-trace segments to rotating `.jsonl.gz`
+files. It uses two capture types, `trace` and `audit`. This service discovers
+only closed segments: the highest indexed segment for each prefix remains owned
+by the Dynamo writer.
+
+## Initial scaffold
+
+This initial implementation validates the sidecar configuration, verifies its
+secret-file mount, creates state and quarantine directories, exposes health,
+and verifies local segment discovery. It intentionally does not export logs,
+traces, or metrics, transform records, submit uploads, poll remote status,
+delete source files, or publish a release image.
+
+The `internal/upload` package defines the future upload-client boundary. The
+real adapter and durable journal are separate follow-up work.
+
+## Configuration
+
+The scaffold retains the current file contract:
+
+- `TRACE_DIR`: absolute directory containing trace and audit segments
+- `TRACE_FILE_PREFIX`: trace segment prefix
+- `AUDIT_FILE_PREFIX`: audit segment prefix
+- `REQUEST_TRACE_UPLOADER_DROP_NCA_IDS`: optional CSV NCA ID drop list for audit
+  payloads. Bare IDs and `nca-<id>-nca` are equivalent. The future
+  transform retains correlation metadata and the normalized NCA ID, but removes
+  request and response payloads plus non-NCA headers before upload.
+- `REQUEST_TRACE_UPLOADER_SECRETS_FILE`: readable mounted secret file; default
+  `/var/secrets/secrets.json`
+
+It also accepts these bounded operational settings:
+
+- `HEALTH_ADDR`: default `:8011`
+- `UPLOAD_INTERVAL_SECONDS`: default `30`
+- `STATUS_INTERVAL_SECONDS`: default `5`
+- `STATUS_TIMEOUT_SECONDS`: default `900`
+- `REQUEST_TRACE_UPLOADER_ATTEMPT_TIMEOUT`: default `30s`
+- `REQUEST_TRACE_UPLOADER_OPERATION_TIMEOUT`: default `90s`
+- `REQUEST_TRACE_UPLOADER_MAX_RETRIES`: default `2`
+- `REQUEST_TRACE_UPLOADER_RETRY_INITIAL_BACKOFF`: default `100ms`
+- `REQUEST_TRACE_UPLOADER_RETRY_MAX_BACKOFF`: default `15s`
+- `REQUEST_TRACE_UPLOADER_RETRY_MULTIPLIER`: default `2.0`
+
+Invalid policy values fall back to defaults and produce a safe startup warning.
+Missing paths, unreadable secret files, and incompatible required values prevent
+readiness.

src/compute-plane-services/request-trace-uploader/cmd/BUILD.bazel

@@ -0,0 +1,27 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("//rules/oci:defs.bzl", "go_oci_image")
+
+go_library(
+    name = "cmd_lib",
+    srcs = ["main.go"],
+    importpath = "github.com/NVIDIA/nvcf/src/compute-plane-services/request-trace-uploader/cmd",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//src/compute-plane-services/request-trace-uploader/internal/config",
+        "//src/compute-plane-services/request-trace-uploader/internal/service",
+    ],
+)
+
+go_binary(
+    name = "request-trace-uploader",
+    embed = [":cmd_lib"],
+    visibility = ["//visibility:public"],
+)
+
+go_oci_image(
+    name = "image",
+    base = "@distroless_go",
+    binary = ":request-trace-uploader",
+    tags = ["nvcf-request-trace-uploader"],
+    visibility = ["//visibility:public"],
+)

src/compute-plane-services/request-trace-uploader/cmd/main.go

@@ -0,0 +1,41 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// request-trace-uploader validates and discovers Dynamo request-trace segments.
+package main
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/NVIDIA/nvcf/src/compute-plane-services/request-trace-uploader/internal/config"
+	"github.com/NVIDIA/nvcf/src/compute-plane-services/request-trace-uploader/internal/service"
+)
+
+func main() {
+	cfg, warnings, err := config.LoadFromEnv()
+	if err != nil {
+		slog.Error("invalid request trace uploader configuration", "error", err)
+		os.Exit(1)
+	}
+	for _, warning := range warnings {
+		slog.Warn("request trace uploader configuration fallback", "setting", warning)
+	}
+
+	svc, err := service.New(cfg)
+	if err != nil {
+		slog.Error("create request trace uploader service", "error", err)
+		os.Exit(1)
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	if err := svc.Run(ctx); err != nil && !errors.Is(err, context.Canceled) {
+		slog.Error("request trace uploader stopped", "error", err)
+		os.Exit(1)
+	}
+}

src/compute-plane-services/request-trace-uploader/go.mod

@@ -0,0 +1,3 @@
+module github.com/NVIDIA/nvcf/src/compute-plane-services/request-trace-uploader
+
+go 1.26.5

src/compute-plane-services/request-trace-uploader/internal/config/BUILD.bazel

@@ -0,0 +1,20 @@
+load("@rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "config",
+    srcs = ["config.go"],
+    importpath = "github.com/NVIDIA/nvcf/src/compute-plane-services/request-trace-uploader/internal/config",
+    visibility = ["//src/compute-plane-services/request-trace-uploader:__subpackages__"],
+)
+
+go_test(
+    name = "config_test",
+    srcs = ["config_test.go"],
+    embed = [":config"],
+)
+
+alias(
+    name = "go_default_library",
+    actual = ":config",
+    visibility = ["//src/compute-plane-services/request-trace-uploader:__subpackages__"],
+)