Enable bounded GenAI content capture for Studio chat

.env.example

@@ -116,6 +116,18 @@ SIMPLEAUDIT_STUDIO_URL=http://localhost:8000
 #SIMPLEAUDIT_CHAT_OTLP_ENDPOINT=http://web:8000/otlp/v1/traces
 #OTEL_BASIC_AUTH_USERNAME=
 #OTEL_BASIC_AUTH_PASSWORD=
+# Content capture is enabled for the protected Studio OTLP receiver when chat
+# tracing is enabled. Set any flag to false to exclude that content type.
+OTEL_GENAI_CAPTURE_INPUTS=true
+OTEL_GENAI_CAPTURE_OUTPUTS=true
+OTEL_GENAI_CAPTURE_SYSTEM_INSTRUCTIONS=true
+OTEL_GENAI_CAPTURE_TOOL_ARGUMENTS=true
+OTEL_GENAI_CAPTURE_TOOL_RESULTS=true
+OTEL_GENAI_CAPTURE_RETRIEVAL_QUERY=true
+OTEL_GENAI_CAPTURE_RETRIEVAL_DOCUMENTS=true
+OTEL_GENAI_CAPTURE_EMBEDDING_TEXT=true
+OTEL_GENAI_CAPTURE_EMBEDDING_VECTORS=false
+OTEL_GENAI_CONTENT_MAX_LENGTH=2000
 # Optional: switch Studio's OTLP listener (POST /otlp/v1/traces + credential
 # management) on or off. ON by default (preserves existing behavior). Set to
 # "off" to 404 the /otlp/* and /api/otlp/* routes and hide the OTLP button.

chat/config.py

@@ -57,7 +57,7 @@ def is_disabled(value: str | None) -> bool:
 ENABLED = not is_disabled(MODE)
 
 #: The base path the Open WebUI subpath build serves at. Must match the
-#: WEBUI_SUBPATH baked into the image (0.11.4.1-subpath -> /chat). Defined
+#: WEBUI_SUBPATH baked into the image (0.11.4.3-subpath -> /chat). Defined
 #: first: UPSTREAM below bakes it into the default.
 SUBPATH = os.environ.get("SIMPLEAUDIT_CHAT_SUBPATH", "/chat")
 if not SUBPATH.startswith("/"):

chat/proxy.py

@@ -575,7 +575,7 @@ def start_open_webui(studio_port: int | None = None) -> subprocess.Popen:
 OWUI_WHEEL_URL = os.environ.get(
     "SIMPLEAUDIT_CHAT_WHEEL",
     "https://github.com/SushantGautam/open-webui/releases/download/"
-    "v0.11.4.1-subpath/open_webui-0.11.4.1-py3-none-any.whl",
+    "v0.11.4.3-subpath/open_webui-0.11.4.3-py3-none-any.whl",
 )
 OWUI_PACKAGE = os.environ.get("SIMPLEAUDIT_CHAT_PACKAGE", "open-webui")
 

deploy/openwebui-subpath/Caddyfile.subpath

@@ -3,7 +3,7 @@
 #
 # The routing shape enabled by the subpath fork built via
 # deploy/openwebui-subpath/build.sh (published as
-# ghcr.io/sushantgautam/open-webui:v0.11.4.1-subpath). It replaces the old
+# ghcr.io/sushantgautam/open-webui:v0.11.4.3-subpath). It replaces the old
 # cross-origin iframe model (Caddyfile.chat on :8801) with one origin / one
 # port:
 #

deploy/openwebui-subpath/README.md

@@ -130,7 +130,7 @@ re-passes. Distribution context (fork, ghcr.io, pip caveats): [`DESIGN.md`](./DE
 publishing to ghcr.io (root on push, `-subpath` on `webui_subpath` dispatch).
 
 The cutover is done: `docker-compose.yml` pulls
-`ghcr.io/sushantgautam/open-webui:v0.11.4.1-subpath` (set `WEBUI_SUBPATH=/chat`),
+`ghcr.io/sushantgautam/open-webui:v0.11.4.3-subpath` (set `WEBUI_SUBPATH=/chat`),
 `chat-proxy` (Caddy, no profile) is the **only published port** and runs
 `Caddyfile.subpath`, Studio's wrapper page moved to `/playground/`, and
 `Caddyfile.chat` + the separate cross-origin port are retired. Embedded

docker-compose.yml

@@ -187,7 +187,7 @@ services:
   # forward /chat/* WITHOUT stripping the prefix (see the Caddyfile header).
   open-webui:
     profiles: ["chat"]
-    image: ${OPEN_WEBUI_IMAGE:-ghcr.io/sushantgautam/open-webui:v0.11.4.1-subpath}
+    image: ${OPEN_WEBUI_IMAGE:-ghcr.io/sushantgautam/open-webui:v0.11.4.3-subpath}
     environment:
       WEBUI_SUBPATH: /chat
       WEBUI_AUTH_TRUSTED_EMAIL_HEADER: X-Studio-Email
@@ -213,6 +213,18 @@ services:
       OTEL_OTLP_SPAN_EXPORTER: "http"
       OTEL_EXPORTER_OTLP_ENDPOINT: ${SIMPLEAUDIT_CHAT_OTLP_ENDPOINT:-http://web:8000/otlp/v1/traces}
       OTEL_SERVICE_NAME: ${SIMPLEAUDIT_CHAT_OTLP_SERVICE_NAME:-open-webui}
+      # M13 content capture: opt in only for this protected Studio receiver.
+      # Keep vectors off; captured values are truncated by Open WebUI.
+      OTEL_GENAI_CAPTURE_INPUTS: ${OTEL_GENAI_CAPTURE_INPUTS:-true}
+      OTEL_GENAI_CAPTURE_OUTPUTS: ${OTEL_GENAI_CAPTURE_OUTPUTS:-true}
+      OTEL_GENAI_CAPTURE_SYSTEM_INSTRUCTIONS: ${OTEL_GENAI_CAPTURE_SYSTEM_INSTRUCTIONS:-true}
+      OTEL_GENAI_CAPTURE_TOOL_ARGUMENTS: ${OTEL_GENAI_CAPTURE_TOOL_ARGUMENTS:-true}
+      OTEL_GENAI_CAPTURE_TOOL_RESULTS: ${OTEL_GENAI_CAPTURE_TOOL_RESULTS:-true}
+      OTEL_GENAI_CAPTURE_RETRIEVAL_QUERY: ${OTEL_GENAI_CAPTURE_RETRIEVAL_QUERY:-true}
+      OTEL_GENAI_CAPTURE_RETRIEVAL_DOCUMENTS: ${OTEL_GENAI_CAPTURE_RETRIEVAL_DOCUMENTS:-true}
+      OTEL_GENAI_CAPTURE_EMBEDDING_TEXT: ${OTEL_GENAI_CAPTURE_EMBEDDING_TEXT:-true}
+      OTEL_GENAI_CAPTURE_EMBEDDING_VECTORS: ${OTEL_GENAI_CAPTURE_EMBEDDING_VECTORS:-false}
+      OTEL_GENAI_CONTENT_MAX_LENGTH: ${OTEL_GENAI_CONTENT_MAX_LENGTH:-2000}
     volumes:
       - open_webui_data:/app/backend/data
     restart: unless-stopped

docs/chat.md

@@ -229,6 +229,16 @@ unset: the iframe loads the same-origin `/chat/`.
 | `SIMPLEAUDIT_CHAT_OTLP`         | `false`                  | export Open WebUI's spans to Studio's OTLP listener |
 | `SIMPLEAUDIT_CHAT_OTLP_ENDPOINT`| full OTLP listener URL   | the `/otlp/v1/traces` ingestion URL (embedded: `http://127.0.0.1:<port>/otlp/v1/traces`, docker: `http://web:8000/otlp/v1/traces`) — the exporter uses it as-is |
 | `SIMPLEAUDIT_CHAT_OTLP_SERVICE_NAME` | `open-webui`         | the service name Open WebUI tags its spans with |
+| `OTEL_GENAI_CAPTURE_INPUTS` | `true` in the Compose example | capture model input messages |
+| `OTEL_GENAI_CAPTURE_OUTPUTS` | `true` in the Compose example | capture model output messages |
+| `OTEL_GENAI_CAPTURE_SYSTEM_INSTRUCTIONS` | `true` in the Compose example | capture system instructions |
+| `OTEL_GENAI_CAPTURE_TOOL_ARGUMENTS` | `true` in the Compose example | capture tool arguments |
+| `OTEL_GENAI_CAPTURE_TOOL_RESULTS` | `true` in the Compose example | capture tool results |
+| `OTEL_GENAI_CAPTURE_RETRIEVAL_QUERY` | `true` in the Compose example | capture retrieval queries |
+| `OTEL_GENAI_CAPTURE_RETRIEVAL_DOCUMENTS` | `true` in the Compose example | capture retrieved document content |
+| `OTEL_GENAI_CAPTURE_EMBEDDING_TEXT` | `true` in the Compose example | capture embedding input text |
+| `OTEL_GENAI_CAPTURE_EMBEDDING_VECTORS` | `false` | capture embedding vectors |
+| `OTEL_GENAI_CONTENT_MAX_LENGTH` | `2000` | maximum characters per captured field |
 
 ## Exporting Open WebUI's spans to Studio (OTLP)
 
@@ -263,6 +273,9 @@ So enabling it is one line:
 ```bash
 # .env (docker) — or the equivalent environment in embedded mode
 SIMPLEAUDIT_CHAT_OTLP=true
+# The Compose example enables bounded GenAI content capture for the protected
+# Studio receiver. Keep the receiver access-controlled and turn individual
+# flags off when the corresponding content must not leave Open WebUI.
 ```
 
 For an authenticated target (a `basic` or `bearer` OTLP credential instead of a

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "simpleaudit-studio"
-version = "0.5.7"
+version = "0.5.8"
 description = "Production AI model audit platform — one-liner demo mode via uvx"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -24,8 +24,9 @@ dependencies = [
     # package metadata, so the engine must be a registry dependency. 0.2.0 is
     # the first release containing run_scenario_reps (n_repetitions support);
     # 0.2.1 adds the native on_turn per-phase progress callback; 0.3.1 adds
-    # the traceparent-to-wire forwarding this repo's tracing relies on.
-    "simpleaudit==0.3.1",
+    # the traceparent-to-wire forwarding this repo's tracing relies on;
+    # 0.3.2 also preserves GenAI content attributes through OTLP parsing.
+    "simpleaudit==0.3.2",
     "cronsim==2.7",
     "psutil>=7.2.2",
     "opentelemetry-proto>=1.45.0",