feat(rivetkit-core): trace raw http requests

[eersnington]

• Tracing onRequest handlers with the HTTP method, response status and errors
• Connecting database operations to the request that made them
• Keeping request paths out of spans

[eersnington]

Stack for rivet-dev/actors

• #5734 docs(rivetkit): add actor tracing docs
• #5733 feat(rivetkit): forward otel sdk warnings to the pino logger
• #5732 feat(rivetkit): trace actor to actor calls
• #5730 feat(rivetkit-core): trace queue sends and receives
• #5731 feat(rivetkit-core): trace raw http requests 👈
• #5729 feat(rivetkit-core): trace scheduled invocations
• #5726 feat(rivetkit): send trace context from clients
• #5723 feat(rivetkit): pass trace context to js and logs
• #5727 feat(rivetkit): trace sqlite operations
• #5721 feat(rivetkit): trace actor invocations
• #5728 fix(pegboard-gateway): forward request ray id to actors
• #5724 test(rivetkit): let driver runtimes take extra environment
• #5722 fix(rivetkit): disable services in driver test runtimes
• main

Get stack: forklift get 5731
Push local edits: forklift submit
Merge when ready: forklift merge 5731

_{change mkyuyvto}

[claude]

Review

Reviewed the current diff for PR #5731 (feat(rivetkit-core): trace raw http requests), focused on the Reply::on_reply mechanism, ActorInvocation/ActorInvocationTelemetry lifecycle, NAPI/native.ts wiring, and the streaming-response body-pump path.

Findings

1. Streaming response bodies finish the request span before the body actually drains (rivetkit-rust/packages/rivetkit-core/src/telemetry.rs:330)

finish_request is invoked via on_reply as soon as the initial Response (headers) is produced, not when a streaming body finishes being read. Concretely: task.rs DispatchCommand::Http attaches on_reply so it fires the moment reply.send() runs in native-http.ts::convertNativeHttpResponse. For a responseBodyStream, that function returns immediately and only awaits the body via a detached bodyCompletion promise that pumpResponseBody drains in the background.

If the pull() callback of a handler performs work after headers are sent, e.g. c.db.execute(...) to stream query results chunk by chunk, that work happens after finish_request already ran. Since finish_request sets state.finished = true with pending_work == 0, parent_context() returns None and start_sqlite() returns None for any DB call issued from the pull callback going forward. That directly undercuts the goal stated in the PR of connecting database operations to the request that made them for the streaming case, and the recorded span duration reflects only time-to-headers rather than true end-to-end latency.

Suggest deferring finish_request until the body stream is fully drained (hooking into bodyCompletion/pumpResponseBody completion) rather than at reply.send() time for streamed bodies.

2. Inconsistent error.type format for 5xx onRequest responses (rivetkit-rust/packages/rivetkit-core/src/telemetry.rs:341)

For a 5xx Response returned from an onRequest handler, finish_request records error.type as the raw numeric status code (e.g. "503"). Every other error path in this file (record_outcome, used for actions, scheduled invocations, and onRequest handler exceptions) records error.type in group.code form (e.g. "actor.dropped_reply"). This inconsistency means any downstream dashboard or alert parsing error.type as group.code across invocation types will see request-error spans in a different, non-matching shape from the rest of the trace pipeline.

Suggest normalizing to the same group.code convention, e.g. mapping the status code to an HTTP-specific group/code pair, for consistency with record_outcome.

Other notes

• Test coverage looks reasonable for the non-streaming case (actor-telemetry.test.ts, telemetry.ts fixture), but no test exercises a streamed response body with telemetry attached, worth adding given finding [SVC-2555] Set up issue templates #1.
• No security concerns identified; this is internal telemetry and tracing wiring and does not cross a trust boundary.

🤖 Generated with Claude Code

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit 9222dd9.}

---

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

Original location: "rivetkit-typescript/packages/rivetkit-wasm/src/lib.rs":854 (new side, not submitted inline).

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[eersnington]

error.type has two different shapes depending on invocation kind

intentional

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit ce83ec0.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit 09e5b53.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit 2611ec9.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit 66fb8ec.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit 164632c.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit 0b5ee8f.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit c4bfafb.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit 0bd6bbf.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit bb278a9.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit 8108c11.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit 1870777.}

[the-company-company]

🟠 Medium · Bind raw HTTP telemetry to the Rust handler context

The newly-created telemetry is discarded before on_fetch_response is invoked. A Rust actor's HTTP handler therefore receives the original Ctx with no invocation telemetry, so ctx.invocation_sql() and schedule operations cannot create children of this raw-request span.

Bind invocation_telemetry with ctx.with_invocation_telemetry(...) before invoking the HTTP handler, rather than matching it as _.

[the-company-company]

🟠 Medium · Carry raw HTTP telemetry into the Wasm callback context

The Wasm handler discards the telemetry attached to HttpRequest and passes the unbound ctx to JavaScript. Raw requests on the Wasm runtime therefore emit only the root request span; SQLite and scheduling work initiated through the callback cannot be attributed to it.

Create a context with ctx.with_invocation_telemetry(invocation_telemetry) before constructing the callback payload, as the runtime-specific handlers must bind the event telemetry to the context they expose.