@@ -0,0 +1,156 @@
1+# Docker Prometheus smoke
2+3+```yaml qa-scenario
4+id: docker-prometheus-smoke
5+title: Docker Prometheus smoke
6+surface: telemetry
7+coverage:
8+primary:
9+ - telemetry.prometheus
10+secondary:
11+ - harness.qa-lab
12+ - docker.e2e
13+objective: Verify a QA-lab gateway run emits protected, bounded Prometheus diagnostics metrics through the diagnostics-prometheus plugin.
14+successCriteria:
15+ - The diagnostics-prometheus plugin exposes the protected scrape route.
16+ - An unauthenticated scrape is rejected.
17+ - A minimal QA-channel agent turn completes.
18+ - The authenticated scrape includes release-critical diagnostics metric families.
19+ - Prometheus output omits prompt content, session keys, auth tokens, raw ids, and file paths.
20+plugins:
21+ - diagnostics-prometheus
22+gatewayConfigPatch:
23+diagnostics:
24+enabled: true
25+docsRefs:
26+ - docs/gateway/prometheus.md
27+ - docs/concepts/qa-e2e-automation.md
28+codeRefs:
29+ - extensions/diagnostics-prometheus/src/service.ts
30+ - src/diagnostics/internal-diagnostics.ts
31+ - extensions/qa-lab/src/suite.ts
32+execution:
33+kind: flow
34+summary: Complete a minimal QA-lab turn and scrape the protected Prometheus route.
35+config:
36+prompt: Reply exactly DOCKER-PROMETHEUS-OK. Do not repeat DOCKER-PROMETHEUS-SECRET.
37+secretNeedle: DOCKER-PROMETHEUS-SECRET
38+```
39+40+```yaml qa-flow
41+steps:
42+ - name: emits protected low-cardinality prometheus metrics
43+actions:
44+ - call: waitForGatewayHealthy
45+args:
46+ - ref: env
47+ - 60000
48+ - call: waitForQaChannelReady
49+args:
50+ - ref: env
51+ - 60000
52+ - call: reset
53+ - set: startCursor
54+value:
55+expr: state.getSnapshot().messages.length
56+ - call: runAgentPrompt
57+args:
58+ - ref: env
59+ - sessionKey: agent:qa:docker-prometheus-smoke
60+message:
61+expr: config.prompt
62+timeoutMs:
63+expr: liveTurnTimeoutMs(env, 30000)
64+ - call: waitForCondition
65+saveAs: outbound
66+args:
67+ - lambda:
68+expr: "state.getSnapshot().messages.slice(startCursor).filter((candidate) => candidate.direction === 'outbound' && candidate.conversation.id === 'qa-operator' && String(candidate.text ?? '').trim().length > 0).at(-1)"
69+ - expr: liveTurnTimeoutMs(env, 30000)
70+ - expr: "env.providerMode === 'mock-openai' ? 100 : 250"
71+ - assert:
72+expr: "String(outbound.text ?? '').trim().length > 0"
73+message: "expected non-empty qa output before scraping metrics"
74+ - set: prometheusUrl
75+value:
76+expr: "`${env.gateway.baseUrl}/api/diagnostics/prometheus`"
77+ - set: gatewayToken
78+value:
79+expr: "String(env.gateway.token ?? env.gateway.runtimeEnv.OPENCLAW_GATEWAY_TOKEN ?? '')"
80+ - assert:
81+expr: "gatewayToken.length > 0"
82+message: "expected QA gateway token to be available for protected scrape"
83+ - set: unauthenticatedScrape
84+value:
85+expr: |-
86+ (async () => {
87+ const response = await fetch(prometheusUrl);
88+ await response.text().catch(() => "");
89+ return { status: response.status };
90+ })()
91+ - assert:
92+expr: "unauthenticatedScrape.status === 401 || unauthenticatedScrape.status === 403"
93+message:
94+expr: "`expected unauthenticated prometheus scrape to be rejected, got ${unauthenticatedScrape.status}`"
95+ - set: authenticatedScrape
96+value:
97+expr: |-
98+ (async () => {
99+ const response = await fetch(prometheusUrl, {
100+ headers: { authorization: `Bearer ${gatewayToken}` },
101+ });
102+ const text = await response.text();
103+ return {
104+ status: response.status,
105+ contentType: response.headers.get("content-type") ?? "",
106+ text,
107+ };
108+ })()
109+ - assert:
110+expr: "authenticatedScrape.status === 200"
111+message:
112+expr: "`expected authenticated prometheus scrape to return 200, got ${authenticatedScrape.status}`"
113+ - assert:
114+expr: "authenticatedScrape.contentType.includes('text/plain')"
115+message:
116+expr: "`expected prometheus text content type, got ${authenticatedScrape.contentType}`"
117+ - set: prometheusText
118+value:
119+expr: "String(authenticatedScrape.text ?? '')"
120+ - assert:
121+expr: "prometheusText.includes('# TYPE openclaw_run_completed_total counter')"
122+message: "missing run completion counter"
123+ - assert:
124+expr: "prometheusText.includes('# TYPE openclaw_run_duration_seconds histogram')"
125+message: "missing run duration histogram"
126+ - assert:
127+expr: "prometheusText.includes('# TYPE openclaw_model_call_total counter')"
128+message: "missing model call counter"
129+ - assert:
130+expr: "prometheusText.includes('# TYPE openclaw_harness_run_total counter')"
131+message: "missing harness run counter"
132+ - assert:
133+expr: "!prometheusText.includes(config.secretNeedle)"
134+message: "prometheus output leaked prompt sentinel"
135+ - assert:
136+expr: "!prometheusText.includes('DOCKER-PROMETHEUS-OK')"
137+message: "prometheus output leaked response content"
138+ - assert:
139+expr: "!prometheusText.includes('agent:qa:docker-prometheus-smoke')"
140+message: "prometheus output leaked the session key"
141+ - assert:
142+expr: "!prometheusText.includes(gatewayToken)"
143+message: "prometheus output leaked the gateway token"
144+ - assert:
145+expr: "!/runId|sessionId|sessionKey|callId|toolCallId|messageId|providerRequestId/.test(prometheusText)"
146+message: "prometheus output leaked raw diagnostic identifiers"
147+ - assert:
148+expr: "!/\\/tmp\\/|\\/private\\/tmp\\/|\\/app\\//.test(prometheusText)"
149+message: "prometheus output leaked a local file path"
150+ - assert:
151+expr: "!prometheusText.includes('openclaw.content.')"
152+message: "prometheus output leaked content attributes"
153+ - assert:
154+expr: "!/openclaw_prometheus_series_dropped_total(?:\\{[^}]*\\})?\\s+(?!0(?:\\.0+)?(?:\\s|$))/.test(prometheusText)"
155+message: "prometheus dropped series during the smoke"
156+```
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。