Skip to content

feat: attribute AI Gateway usage to workspaces - #29235

Merged
johnstcn merged 15 commits into
mainfrom
cian/aigov-637-include-workspace-level-attribution-to-ai-gateway-usage
Sep 18, 2026
Merged

johnstcn merged 15 commits into
mainfrom
cian/aigov-637-include-workspace-level-attribution-to-ai-gateway-usage

Conversation

@johnstcn

@johnstcn johnstcn commented Sep 11, 2026

Copy link
Copy Markdown
Member

Persist lookup-free workspace attribution on AI Gateway interceptions for direct Codex and Claude Code traffic and delegated Coder Agents traffic.

Workspace IDs are derived from trusted workspace session-token names or persisted chat bindings, then stored per interception. Session details expose interception_attributions as a map keyed by interception ID; unknown attribution is represented by a null value. This avoids adding workspace database lookups to the request path.

Closes AIGOV-637

Implementation plan
  • Add nullable workspace_id to AI Gateway interceptions without a foreign key or index.
  • Derive direct attribution from strictly parsed server-minted workspace session-token names, excluding user-created tokens and validating the embedded owner.
  • Derive delegated Coder Agents attribution from the persisted chat workspace ID.
  • Carry attribution in request context rather than cached bridge state, actor metadata, or HTTP headers.
  • Record workspace_id through the additive v1.3 gateway protocol and structured interception logs.
  • Expose every interception in session details through interception_attributions, including tool-less interceptions and null values for unknown attribution.
  • Cover token spoofing, request-scoped cache safety, direct and delegated traffic, persistence, structured logs, and session API conversion.

Generated by Coder Agents.

@linear-code

linear-code Bot commented Sep 11, 2026

Copy link
Copy Markdown

AIGOV-637

@github-actions

github-actions Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Docs preview

Check off each page once it's been reviewed. If a page changes in a later push, its checkbox clears automatically so it gets a fresh look. Pages not yet wired into the docs navigation aren't listed here.

@johnstcn johnstcn changed the title cian/aigov 637 include workspace level attribution to ai gateway usage feat: attribute AI Gateway usage to workspaces Sep 11, 2026
@johnstcn
johnstcn marked this pull request as ready for review September 15, 2026 14:55

@SasSwart SasSwart left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Cian et bots!

I've reviewed as much as I can in my timebox for today. I've focussed on the parts that I am familiar with. Perhaps another reviewer can focus on the agents side. Otherwise, I'll dig into that tomorrow.

Comment thread coderd/aibridge/factory.go Outdated
Comment thread coderd/aibridge/factory.go
Comment thread coderd/aibridge/factory.go Outdated
Comment thread coderd/aibridge/factory.go
slog.F("agent_firewall_session_id", in.GetAgentFirewallSessionId()), slog.Error(err))
}

workspaceID, err := interceptionAttribution(in)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should probably also log the workspace id as a field for calls on the other side of this DRPC connection as well. I don't think this PR has the LogRecorder yet, but we should remember to log it there as well.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good shout

Comment thread coderd/aibridgedserver/aibridgedserver.go Outdated
Comment thread coderd/aibridged/proto/version.go Outdated
Comment thread coderd/aibridgedserver/aibridgedserver.go Outdated
Comment thread coderd/aibridgedserver/aibridgedserver.go Outdated
Comment thread coderd/aibridge/factory.go Outdated

@ssncferreira ssncferreira left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

Comment thread coderd/database/migrations/000596_aibridge_workspace_context.up.sql Outdated
Comment thread coderd/aibridge/factory_test.go
Comment thread coderd/aibridgedserver/aibridgedserver.go Outdated
Comment thread coderd/x/chatd/model_routing_internal_test.go Outdated
@johnstcn
johnstcn force-pushed the cian/aigov-637-include-workspace-level-attribution-to-ai-gateway-usage branch from 84167c8 to 6748664 Compare September 17, 2026 11:48
@johnstcn
johnstcn requested a review from pawbana September 17, 2026 14:05
…-level-attribution-to-ai-gateway-usage' into cian/aigov-637-include-workspace-level-attribution-to-ai-gateway-usage
@johnstcn
johnstcn merged commit 19076be into main Sep 18, 2026
30 of 31 checks passed
@johnstcn
johnstcn deleted the cian/aigov-637-include-workspace-level-attribution-to-ai-gateway-usage branch September 18, 2026 14:22
@github-actions github-actions Bot locked and limited conversation to collaborators Sep 18, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants