исправить: закрыть ревью сквозной корреляции

apps/admin-api/src/request_context.rs

@@ -1,6 +1,6 @@
 use axum::{
     extract::Request,
-    http::{HeaderMap, HeaderName, HeaderValue},
+    http::{HeaderName, HeaderValue},
     middleware::Next,
     response::Response,
 };
@@ -16,7 +16,7 @@ pub struct RequestContext {
 
 pub async fn apply_request_context(mut request: Request, next: Next) -> Response {
     let context = RequestContext {
-        request_id: resolve_request_id(request.headers()),
+        request_id: RequestId::resolve_from_headers(request.headers()).into_string(),
     };
     let method = request.method().clone();
     let path = request.uri().path().to_owned();
@@ -46,15 +46,6 @@ pub async fn apply_request_context(mut request: Request, next: Next) -> Response
     .await
 }
 
-fn resolve_request_id(headers: &HeaderMap) -> String {
-    RequestId::resolve(
-        headers
-            .get(&REQUEST_ID_HEADER)
-            .and_then(|value| value.to_str().ok()),
-    )
-    .into_string()
-}
-
 #[cfg(test)]
 mod tests {
     #[test]

apps/admin-api/src/service.rs

@@ -5,10 +5,10 @@ use std::sync::Arc;
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use crank_core::{
     AuditSink, AuthProfile, CapabilityProfile, CommunityCapabilityProfile, EditionCapabilities,
-    ExecutionMode, IdentityError, IdentityProvider, InvocationLog, InvocationLogId, NoopAuditSink,
-    OperationSecurityLevel, OwnerOnlyPolicyEngine, PolicyEngine, ProductEdition, Protocol,
-    ToolQualityMappingRule, ToolQualityMappingSet, ToolQualitySchemaKind, ToolQualitySchemaNode,
-    UsagePeriod, WorkspaceId,
+    ExecutionMode, IdentityError, IdentityProvider, InvocationLog, InvocationLogId,
+    InvocationSource, NoopAuditSink, OperationSecurityLevel, OwnerOnlyPolicyEngine, PolicyEngine,
+    ProductEdition, Protocol, ToolQualityMappingRule, ToolQualityMappingSet, ToolQualitySchemaKind,
+    ToolQualitySchemaNode, UsagePeriod, WorkspaceId,
 };
 use crank_mapping::{MappingRule, MappingSet};
 use crank_registry::{
@@ -479,9 +479,7 @@ impl AdminService {
 
         let history_span = crank_trace::Stage::HistoryWrite.span();
         let (outcome, db_span) = async {
-            let db_span = crank_trace::Stage::DbQuery
-                .db_span(crank_trace::DbOperation::InvocationHistoryWrite)
-                .expect("database stage");
+            let db_span = crank_trace::DbOperation::InvocationHistoryWrite.span();
             let outcome = self
                 .registry
                 .create_invocation_log(CreateInvocationLogRequest { log: &log })
@@ -509,7 +507,7 @@ impl AdminService {
             outcome,
             request.request_id,
             request.status,
-            "admin_test_run",
+            request.source,
         );
         outcome
     }
@@ -519,7 +517,7 @@ fn observe_invocation_history_outcome(
     outcome: InvocationHistoryWriteOutcome,
     request_id: Option<&str>,
     status: crank_core::InvocationStatus,
-    source: &'static str,
+    source: InvocationSource,
 ) {
     let Some(loss) = outcome.loss() else {
         return;
@@ -530,13 +528,20 @@ fn observe_invocation_history_outcome(
     tracing::warn!(
         name: "admin.invocation_history.lost",
         request_id = request_id.unwrap_or_default(),
-        source,
+        source = invocation_source_label(source),
         invocation_status = invocation_status_label(status),
         error_category = loss.category.as_str(),
         "invocation history was not recorded"
     );
 }
 
+fn invocation_source_label(source: InvocationSource) -> &'static str {
+    match source {
+        InvocationSource::AdminTestRun => "admin_test_run",
+        InvocationSource::AgentToolCall => "agent_tool_call",
+    }
+}
+
 fn invocation_status_label(status: crank_core::InvocationStatus) -> &'static str {
     match status {
         crank_core::InvocationStatus::Ok => "ok",
@@ -606,9 +611,9 @@ fn new_prefixed_id(prefix: &str) -> String {
     format!("{prefix}_{}", Uuid::now_v7().simple())
 }
 
-fn generate_access_secret(prefix: &str) -> String {
+fn generate_access_secret(marker: &str) -> String {
     let random = URL_SAFE_NO_PAD.encode(Uuid::now_v7().as_bytes());
-    format!("{prefix}_{random}")
+    format!("{marker}{random}")
 }
 
 fn hash_access_secret(secret: &str) -> String {
@@ -874,7 +879,7 @@ mod tests {
         sync::{Arc, Mutex},
     };
 
-    use crank_core::InvocationStatus;
+    use crank_core::{InvocationSource, InvocationStatus};
     use crank_observability::{
         ObservabilityConfig, OperationalIncident, RedactionLimits, ServiceIdentity,
         operational_incident_total,
@@ -931,7 +936,7 @@ mod tests {
             }),
             Some("req_admin_dc08"),
             InvocationStatus::Error,
-            "admin_test_run",
+            InvocationSource::AgentToolCall,
         );
 
         let output = writer.output();
@@ -942,7 +947,7 @@ mod tests {
             .find(|event: &Value| event["event"] == "admin.invocation_history.lost")
             .unwrap();
         assert_eq!(event["request_id"], "req_admin_dc08");
-        assert_eq!(event["fields"]["source"], "admin_test_run");
+        assert_eq!(event["fields"]["source"], "agent_tool_call");
         assert_eq!(event["fields"]["invocation_status"], "error");
         assert_eq!(event["fields"]["error_category"], "invalid_record");
         assert!(operational_incident_total(OperationalIncident::InvocationHistoryLost) > before);

apps/admin-api/src/service/api_keys.rs

@@ -65,10 +65,7 @@ impl AdminService {
             ),
             None => None,
         };
-        let secret = generate_access_secret(match payload.key_kind {
-            PlatformApiKeyKind::McpClient => "crk",
-            PlatformApiKeyKind::Approval => "crk_appr",
-        });
+        let secret = generate_access_secret(payload.key_kind.secret_marker());
         let api_key = PlatformApiKeyRecord {
             api_key: PlatformApiKey {
                 id: PlatformApiKeyId::new(new_prefixed_id("pk")),