fix(demos): harden the OTel benchmark demo after review

Cargo.toml

@@ -6,8 +6,6 @@ members = [
   "crates/praxis-experimental-server",
 ]
 
-# Use praxis main for OTel features not yet in the v0.5.3 crates.io release
-
 [workspace.package]
 version = "0.1.0"
 edition = "2024"

Containerfile

@@ -46,6 +46,7 @@ RUN mkdir -p crates/experimental-probe/src \
     && printf '//! stub\nfn main() {}\n' > crates/praxis-experimental-server/src/main.rs
 
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
     --mount=type=cache,target=/src/target \
     cargo build --release -p praxis-experimental-server ${FEATURES:+--features "$FEATURES"}
 
@@ -69,6 +70,7 @@ RUN find crates -name '*.rs' -exec touch {} +
 # ------------------------------------------------------------------------------
 
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    --mount=type=cache,target=/usr/local/cargo/git \
     --mount=type=cache,target=/src/target \
     cargo build --release -p praxis-experimental-server ${FEATURES:+--features "$FEATURES"} \
     && cp target/release/praxis-experimental-server /usr/local/bin/praxis-experimental-server

Makefile

@@ -13,6 +13,8 @@ PUBLISH_CRATES   := experimental-probe
 # Tools verified by check-prereqs before their consuming targets run.
 LINT_CMDS        := cargo cargo-machete
 LINT_EXTRA_CMDS  := typos taplo shellcheck actionlint
+# Cargo features for the container image, e.g. `make container FEATURES=otel`.
+FEATURES         ?=
 AUDIT_CMDS       := cargo-audit cargo-deny
 KIND_CLUSTER_NAME ?= praxis-dev
 PROJECT_IMAGE    ?= ghcr.io/praxis-proxy/experimental:dev
@@ -110,7 +112,7 @@ lint: check-prereqs check-prereqs-nightly
 lint-extra: check-prereqs-extra
 	typos
 	taplo fmt --check
-	shellcheck hack/*.sh .hooks/pre-commit
+	shellcheck hack/*.sh .hooks/pre-commit demos/*/scripts/*.sh
 	actionlint
 
 fmt: check-prereqs-nightly
@@ -160,10 +162,10 @@ ifndef CONTAINER_ENGINE
 endif
 
 container: | require-container-engine
-	$(CONTAINER_ENGINE) build -t $(PROJECT_IMAGE) -f Containerfile .
+	$(CONTAINER_ENGINE) build $(if $(FEATURES),--build-arg FEATURES=$(FEATURES)) -t $(PROJECT_IMAGE) -f Containerfile .
 
 images: | require-container-engine
-	$(CONTAINER_ENGINE) build -t $(PROJECT_IMAGE) -f Containerfile .
+	$(CONTAINER_ENGINE) build $(if $(FEATURES),--build-arg FEATURES=$(FEATURES)) -t $(PROJECT_IMAGE) -f Containerfile .
 
 # -------------------------------------------------------------------
 # KIND
@@ -186,7 +188,7 @@ dev-env: images
 	bash hack/setup-kind.sh
 
 dev-push: | require-container-engine
-	$(CONTAINER_ENGINE) build -t $(PROJECT_IMAGE) -f Containerfile .
+	$(CONTAINER_ENGINE) build $(if $(FEATURES),--build-arg FEATURES=$(FEATURES)) -t $(PROJECT_IMAGE) -f Containerfile .
 	kind load docker-image $(PROJECT_IMAGE) --name $(KIND_CLUSTER_NAME)
 
 dev-integration:

crates/praxis-experimental-server/Cargo.toml

@@ -54,11 +54,13 @@ praxis-protocol = { version = "0.5.4", package = "praxis-proxy-protocol", featur
 # `http-callout-filter` is off by default upstream because its config surface is
 # still moving. This image exists to expose experimental work, so it is on here
 # — it is what backs the Lakera Guard example config.
-praxis-ai-proxy = { git = "https://github.com/praxis-proxy/ai", tag = "v0.3.0", features = [
+# Pinned to the commit tagged v0.3.0. praxis-ai crates are not on crates.io,
+# and a rev cannot move the way a tag can. Bump deliberately.
+praxis-ai-proxy = { git = "https://github.com/praxis-proxy/ai", rev = "b44360afb4100c5543b1180ac8df16e482978fc8", features = [
   "http-callout-filter",
   "praxis-main",
 ] }
 
 [build-dependencies]
 cargo_metadata = "0.23.1"
-praxis-ai-build-support = { git = "https://github.com/praxis-proxy/ai", tag = "v0.3.0" }
+praxis-ai-build-support = { git = "https://github.com/praxis-proxy/ai", rev = "b44360afb4100c5543b1180ac8df16e482978fc8" }

demos/otel-benchmark/README.md

@@ -25,11 +25,11 @@ For the core (non-AI) proxy benchmark, see [README-core.md](README-core.md).
 3. [Helm](https://helm.sh/) with repos added (step 1 below)
 4. [vegeta](https://github.com/tsenart/vegeta) (for benchmarks)
 5. `python3` (used by `scripts/report.sh`)
-6. [Praxis Forge CLI](https://github.com/praxis-proxy/forge) with
-   `extraPortMappings` support (praxis-proxy/forge#16):
+6. [Praxis Forge CLI](https://github.com/praxis-proxy/forge) — needs
+   `extraPortMappings`, merged in praxis-proxy/forge#16:
 
    ```bash
-   cargo install --locked --git https://github.com/praxis-proxy/forge --branch feat/extra-port-mappings-v2
+   cargo install --locked --git https://github.com/praxis-proxy/forge
    ```
 
    Verify: `praxis-forge doctor`

demos/otel-benchmark/scripts/benchmark.sh

@@ -73,19 +73,8 @@ case "${SCENARIO}" in
     SCENARIO_TITLE="AI "
     REPORT_SCRIPT="report.sh"
     ;;
-  ai-extended)
-    RATE="${RATE:-500}"
-    CONNECTIONS=100
-    WARMUP_RATE=100
-    CONFIGS=(ai-extended-baseline ai-extended-baseline ai-extended-otel-full)
-    LABELS=(ai-ext-baseline ai-ext-otel-noop ai-ext-otel-full)
-    RESULTS_PREFIX="ai-ext-"
-    TARGET_FN=ai_target
-    SCENARIO_TITLE="AI Extended "
-    REPORT_SCRIPT="report.sh"
-    ;;
   *)
-    echo "Usage: $0 [--scenario core|ai|ai-extended]" >&2
+    echo "Usage: $0 [--scenario core|ai]" >&2
     exit 1
     ;;
 esac
@@ -108,9 +97,6 @@ run_vegeta() {
     tee "${RESULTS_DIR}/${label}-run${run}.bin" | \
     vegeta report -type=json > "${RESULTS_DIR}/${label}-run${run}.json"
   vegeta report < "${RESULTS_DIR}/${label}-run${run}.bin"
-  # Capture resource snapshot
-  kubectl --context "${CTX}" top pod -n default --no-headers 2>/dev/null \
-    >> "${RESULTS_DIR}/${label}-resources.txt" || true
   echo ""
 }
 

demos/otel-benchmark/scripts/report.sh

@@ -12,8 +12,9 @@ if [ ! -d "${RESULTS_DIR}" ]; then
 fi
 
 export RESULTS_DIR
-export BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
-export COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
+COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+export BRANCH COMMIT
 
 # Auto-detect scenario from results directory contents
 if [ -f "${RESULTS_DIR}/ai-baseline-run1.json" ]; then

demos/otel-benchmark/stacks/observability/dashboards/praxis-traces.json

@@ -95,9 +95,10 @@
       "gridPos": { "h": 8, "w": 24, "x": 0, "y": 23 },
       "id": 101,
       "targets": [
-        { "expr": "sum(rate(otelcol_exporter_send_failed_spans[5m]))", "legendFormat": "send failed" },
-        { "expr": "sum(rate(otelcol_exporter_enqueue_failed_spans[5m]))", "legendFormat": "enqueue failed" },
-        { "expr": "sum(rate(otelcol_exporter_sent_spans[5m]))", "legendFormat": "sent OK" }
+        { "expr": "sum(rate(otelcol_exporter_send_failed_spans{exporter=\"otlp/tempo\"}[5m]))", "legendFormat": "send failed" },
+        { "expr": "sum(rate(otelcol_exporter_enqueue_failed_spans{exporter=\"otlp/tempo\"}[5m]))", "legendFormat": "enqueue failed" },
+        { "expr": "sum(rate(otelcol_processor_refused_spans[5m]))", "legendFormat": "refused (memory_limiter)" },
+        { "expr": "sum(rate(otelcol_exporter_sent_spans{exporter=\"otlp/tempo\"}[5m]))", "legendFormat": "sent OK" }
       ],
       "title": "Span Export Failures (collector -> Tempo)",
       "type": "timeseries"

demos/otel-benchmark/stacks/observability/manifests/otel-collector.yaml

@@ -14,6 +14,15 @@ data:
             endpoint: 0.0.0.0:4318
 
     processors:
+      # First in the pipeline. The container is limited to 512Mi; without this,
+      # exporter backpressure grows the queue until the kernel kills the collector
+      # and every buffered span is lost. With it, the collector refuses new spans
+      # near the limit and counts them in otelcol_processor_refused_spans, which
+      # the Span Export Failures panel shows.
+      memory_limiter:
+        check_interval: 1s
+        limit_mib: 400
+        spike_limit_mib: 100
       batch:
         timeout: 5s
         # send_batch_size is only a FLUSH TRIGGER, not a cap -- a flush already
@@ -47,7 +56,7 @@ data:
       pipelines:
         traces:
           receivers: [otlp]
-          processors: [batch]
+          processors: [memory_limiter, batch]
           exporters: [debug, otlp/tempo]
 ---
 apiVersion: apps/v1

deny.toml

@@ -44,5 +44,4 @@ allow-registry = ["https://github.com/rust-lang/crates.io-index"]
 # praxis-ai crates are publish = false and only consumable as git dependencies;
 # praxis-experimental-server pins them to an exact rev.
 # praxis-proxy/ai: praxis-ai crates are publish = false (git only).
-# praxis-proxy/praxis: patched to main for otel features not yet in v0.5.3.
 allow-git = ["https://github.com/praxis-proxy/ai"]