исправить: закрыть ревью сквозной корреляции

crates/crank-community-mcp/src/access.rs

@@ -6,7 +6,7 @@ use axum::{
 };
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use crank_core::{OperationSecurityLevel, PlatformApiKeyScope};
-use crank_trace::{DbOperation, ErrorCategory, Stage, StageOutcome, observe_db_query};
+use crank_trace::{DbOperation, ErrorCategory, StageOutcome, observe_db_query};
 use sha2::{Digest, Sha256};
 use time::OffsetDateTime;
 use tracing::Instrument;
@@ -154,9 +154,7 @@ async fn verify_static_agent_key(
     secret: &str,
 ) -> Result<Option<VerifiedMachineCredential>, MachineAccessError> {
     let secret_hash = hash_access_secret(secret);
-    let read_span = Stage::DbQuery
-        .db_span(DbOperation::MachineAccessRead)
-        .expect("database stage");
+    let read_span = DbOperation::MachineAccessRead.span();
     let api_key_result = state
         .registry
         .get_platform_api_key_by_secret_for_agent_slug(
@@ -185,9 +183,7 @@ async fn verify_static_agent_key(
     };
 
     let used_at = OffsetDateTime::now_utc();
-    let touch_span = Stage::DbQuery
-        .db_span(DbOperation::MachineAccessTouch)
-        .expect("database stage");
+    let touch_span = DbOperation::MachineAccessTouch.span();
     let touch_result = state
         .registry
         .touch_platform_api_key(&api_key.api_key.workspace_id, &api_key.api_key.id, &used_at)

crates/crank-community-mcp/src/app/invocation_history.rs

@@ -52,9 +52,7 @@ pub(crate) async fn persist_invocation(
 
     let history_span = Stage::HistoryWrite.span();
     let (outcome, db_span) = async {
-        let db_span = Stage::DbQuery
-            .db_span(DbOperation::InvocationHistoryWrite)
-            .expect("database stage");
+        let db_span = DbOperation::InvocationHistoryWrite.span();
         let outcome = state
             .registry
             .create_invocation_log(CreateInvocationLogRequest { log: &log })
@@ -82,7 +80,7 @@ pub(crate) async fn persist_invocation(
         outcome,
         record.request_id,
         record.status,
-        "agent_tool_call",
+        InvocationSource::AgentToolCall,
     );
     outcome
 }
@@ -91,7 +89,7 @@ pub(super) fn observe_invocation_history_outcome(
     outcome: InvocationHistoryWriteOutcome,
     request_id: Option<&str>,
     status: InvocationStatus,
-    source: &'static str,
+    source: InvocationSource,
 ) {
     let Some(loss) = outcome.loss() else {
         return;
@@ -102,13 +100,20 @@ pub(super) fn observe_invocation_history_outcome(
     warn!(
         name: "mcp.invocation_history.lost",
         request_id = request_id.unwrap_or_default(),
-        source,
+        source = invocation_source_label(source),
         invocation_status = invocation_status_label(status),
         error_category = loss.category.as_str(),
         "invocation history was not recorded"
     );
 }
 
+fn invocation_source_label(source: InvocationSource) -> &'static str {
+    match source {
+        InvocationSource::AdminTestRun => "admin_test_run",
+        InvocationSource::AgentToolCall => "agent_tool_call",
+    }
+}
+
 fn invocation_status_label(status: InvocationStatus) -> &'static str {
     match status {
         InvocationStatus::Ok => "ok",

crates/crank-community-mcp/src/app/tests.rs

@@ -75,7 +75,7 @@ fn emits_bounded_history_loss_incident() {
         }),
         Some("req_mcp_dc08"),
         InvocationStatus::Ok,
-        "agent_tool_call",
+        crank_core::InvocationSource::AgentToolCall,
     );
 
     let output = writer.output();

crates/crank-community-mcp/src/catalog.rs

@@ -159,9 +159,7 @@ impl PublishedToolCatalog {
             return Ok(());
         }
 
-        let db_span = Stage::DbQuery
-            .db_span(DbOperation::CatalogLoad)
-            .expect("database stage");
+        let db_span = DbOperation::CatalogLoad.span();
         let catalog_result = self
             .registry
             .get_published_agent_catalog_by_slug(workspace_slug, agent_slug)

crates/crank-community-mcp/src/rate_limit.rs

@@ -4,6 +4,7 @@ use axum::{
     http::{HeaderMap, HeaderValue, StatusCode, header::RETRY_AFTER},
     response::{IntoResponse, Response},
 };
+use crank_core::PlatformApiKeyKind;
 use crank_runtime::RateLimitCheckError;
 use serde_json::{Value, json};
 
@@ -82,6 +83,13 @@ pub(super) fn rate_limited_status_response(error: RateLimitCheckError) -> Respon
 }
 
 fn rate_limit_key(path: &AgentRoutePath, headers: &HeaderMap) -> String {
+    let access_secret = bearer_token(headers);
+    if let Some(secret) = access_secret
+        && secret.starts_with(PlatformApiKeyKind::Approval.secret_marker())
+    {
+        return format!("api_key:{}", hash_access_secret(secret));
+    }
+
     if let Ok(Some(session_id)) = session_id_from_headers(headers) {
         return format!(
             "session:{}:{}:{}",
@@ -89,7 +97,7 @@ fn rate_limit_key(path: &AgentRoutePath, headers: &HeaderMap) -> String {
         );
     }
 
-    if let Some(secret) = bearer_token(headers) {
+    if let Some(secret) = access_secret {
         return format!("api_key:{}", hash_access_secret(secret));
     }
 

crates/crank-community-mcp/src/request_context.rs

@@ -10,13 +10,7 @@ pub(super) struct RequestContext {
 }
 
 pub(super) async fn apply_request_context(mut request: Request, next: Next) -> Response {
-    let request_id = RequestId::resolve(
-        request
-            .headers()
-            .get(&HEADER_X_REQUEST_ID)
-            .and_then(|value| value.to_str().ok()),
-    )
-    .into_string();
+    let request_id = RequestId::resolve_from_headers(request.headers()).into_string();
     let context = RequestContext {
         request_id: request_id.clone(),
     };