Fixes #7951: Add bounded local and remote MCP resource admission - #8095

Large but well-organized PR. Three coherent areas:

1. Agent resource admission - AgentMcpResourceAdmission / AgentResourceAdmission enforce allow-lists (mirroring the existing tool/path admission model) and integrate into AgentMcpDispatcher and AgentMcpHttpHandler.
2. AI proxy observability - AiRequestObservation, AiUpstreamUsageTap, AiObservationSupport, outbound trace context, and Prometheus collectors (AgentAdmissionMetricsCollector, AgentCatalogMetricsCollector, AgentRuntimeMetricsReporter) extend the metrics story.
3. Audit bridge - AgentInvocationAuditBridge composes an optional audit sink with the existing observers without altering traffic, swallowing sink failures.

The audit safely() wrapping and the decision/reason mapping in emit() are sensible.

Coordination needed:

• This PR and #7669 both modify AgentMcpDispatcher.java (resource path). They should be merged in sequence; #7669 first if it carries the base resource dispatcher, then rebase #8095. Please confirm the merge order and resolve any dispatcher conflicts.
• AiProxyApiKeyServiceImpl.convert now returns id; verify the admin UI/serialization expects the key id field.

Approving the design; please coordinate the #7669/#8095 ordering.

Stream Agent analysis

FINAL synthesis of PR #8095 (apache/shenyu) at head ab421f7. Cross-file review of 37 partitions (complete_diff true, CI passed) shows all_parts_passed=false due to two child NEEDS_CHANGES with HIGH defects: missing AtomicInteger import in AgentToolRegistryTest.java (part-17) and incorrect audit target assertion in AgentInvocationAuditBridgeTest.java (part-7). No other cross-file blockers identified. Verdict NEEDS_CHANGES.

Evidence

• part-17 blocking finding: AtomicInteger used but not imported (line 61, RIGHT, HIGH)
• part-7 blocking finding: assertion expects target 'fallback' but observation context 'one' has no target (line 60, RIGHT, HIGH)
• FINAL synthesis: all_parts_passed=false, complete_diff=true, CI passed=true, head ab421f7

Recommended next steps

• Add missing import java.util.concurrent.atomic.AtomicInteger in shenyu-plugin/shenyu-plugin-agent-gateway/src/test/java/org/apache/shenyu/plugin/agent/gateway/tool/AgentToolRegistryTest.java
• Fix incorrect target assertion at line 60 of shenyu-common/src/test/java/org/apache/shenyu/common/audit/AgentInvocationAuditBridgeTest.java to align with observation context
• Re-run CI and partition reviews after test fixes

Scope: captured diff and GitHub check metadata only; no local tests were executed.

Task: 52bc6ca4-a601-4f4b-9dae-26878243c2ca · Commit: ab421f7f4bb219a495e371ed7e28f956541e453d

Review verdict: NEEDS_CHANGES

SYNTHESIS/FINAL: Assessed all 37 child partition summaries. Global complete_diff=true, CI passed=true, but all_parts_passed=false because part-17 and part-7 returned NEEDS_CHANGES with anchored HIGH defects. Per rules, child NEEDS_CHANGES cannot be overridden to PASS. The defects are concrete: missing import causing compilation failure and incorrect test assertion contradicting sibling tests. No other cross-file blockers evident. Therefore FINAL verdict is NEEDS_CHANGES.

Publication: REQUEST_CHANGES (VERIFIED_BLOCKING_FINDINGS)

• shenyu-plugin/shenyu-plugin-agent-gateway/src/test/java/org/apache/shenyu/plugin/agent/gateway/tool/AgentToolRegistryTest.java:61 [RIGHT] AtomicInteger is used but not imported; missing 'import java.util.concurrent.atomic.AtomicInteger;' will cause compilation failure of the test.
• shenyu-common/src/test/java/org/apache/shenyu/common/audit/AgentInvocationAuditBridgeTest.java:60 [RIGHT] Assertion expects logical audit record (records.get(2)) to have target "fallback", but observation was created with context("one") without a target; attempt targets are set on separate attempt contexts. This contradicts sibling tests where logical target derives from observation context, likely causing test failure or wrong contract enforcement.

Review details

Recommendation: Do not merge until the two test defects are fixed. 1) Add import java.util.concurrent.atomic.AtomicInteger; to AgentToolRegistryTest.java (line 61). 2) Correct the logical audit record target assertion in AgentInvocationAuditBridgeTest.java line 60 to match observation context without target. After fixes, re-run CI and partition reviews.

Stream Agent analysis

FINAL synthesis of PR #8095 (apache/shenyu) at head c3487f5. Across 37 partition reviews, 36 passed and part-17 (AgentToolRegistryTest.java) returned NEEDS_CHANGES due to missing imports for AtomicInteger and Set, causing test compilation failure. CI status is complete but passed=false. Complete diff was reviewed in partitions (global_complete_diff=true). Cross-file interactions among admission controller, config, plugin wiring, and audit appear consistent in passing partitions, but the test compilation blocker and failed CI prevent a PASS. Verdict: NEEDS_CHANGES.

Evidence

• Child review part-17: NEEDS_CHANGES with HIGH findings on AgentToolRegistryTest.java lines 61 and 77 (missing AtomicInteger and Set imports)
• CI summary: complete=true, passed=false, check_count=9
• all_parts_passed=false; global_complete_diff=true; head_sha=c3487f5070d2ba889f206a2fe7b4991195b5b3ab

Recommended next steps

• Add imports for java.util.concurrent.atomic.AtomicInteger and java.util.Set in shenyu-plugin/shenyu-plugin-agent-gateway/src/test/java/org/apache/shenyu/plugin/agent/gateway/tool/AgentToolRegistryTest.java
• Re-run CI to confirm compilation and tests pass after import fix
• Validate cross-module contracts with prerequisite PRs since PR is draft building on unmerged work

Scope: captured diff and GitHub check metadata only; no local tests were executed.

Task: f65486a0-5d0e-4ea6-81c0-5de8ebd6404a · Commit: c3487f5070d2ba889f206a2fe7b4991195b5b3ab

Review verdict: NEEDS_CHANGES

FINAL scope synthesis from 37 partition reviews. Per rules, child NEEDS_CHANGES cannot be overridden. part-17 identified concrete HIGH severity blocking defects: missing imports for AtomicInteger and Set in AgentToolRegistryTest.java (RIGHT side lines 61,77) causing compilation failure. Additionally CI passed=false though complete. complete_diff=true and head_sha set. Cross-file assessment of other partitions shows no contradictory HIGH/CRITICAL defects, but the test compile blocker and CI failure necessitate NEEDS_CHANGES. Limitations: no local test execution; prerequisite PRs (#8002,#7860,#7921) not independently verified; partition reviews relied on supplied diff segments only.

Publication: REQUEST_CHANGES (VERIFIED_BLOCKING_FINDINGS)

• shenyu-plugin/shenyu-plugin-agent-gateway/src/test/java/org/apache/shenyu/plugin/agent/gateway/tool/AgentToolRegistryTest.java:61 [RIGHT] AtomicInteger is used but no import for java.util.concurrent.atomic.AtomicInteger is present in the added imports; compilation will fail.
• shenyu-plugin/shenyu-plugin-agent-gateway/src/test/java/org/apache/shenyu/plugin/agent/gateway/tool/AgentToolRegistryTest.java:77 [RIGHT] Set.of is used but no import for java.util.Set is present in the added imports; compilation will fail.

Review details

PR #8095 introduces bounded MCP resource admission with audit and metrics. Partition review found one blocking issue: AgentToolRegistryTest.java lacks imports for java.util.concurrent.atomic.AtomicInteger (line 61) and java.util.Set (line 77), which will fail test compilation. All other 36 partitions passed without HIGH/CRITICAL defects. CI is currently failing. Recommend adding the missing imports and ensuring CI passes before merge; also confirm integration with prerequisite PRs (#8002, #7860, #7921) as noted in PR description.

Stream Agent analysis

Synthesis of PR #8095 (apache/shenyu) at head c3487f5 implementing bounded local and remote MCP resource admission. All 37 partition reviews returned PASS with no HIGH/CRITICAL findings; complete_diff=true and all_parts_passed=true. However CI status shows passed=false across 38 checks, and the PR is a draft dependent on unmerged prerequisites. Therefore FINAL PASS cannot be granted; verdict INCONCLUSIVE.

Evidence

• Attached review summary: all_parts_passed=true, complete_diff=true, 37/37 partition verdicts PASS with empty blocking_findings
• CI object in attachment: check_count=38, complete=true, passed=false, legacy_state=pending
• Multiple partition notes state PR builds on unmerged prerequisites (#8002, #7860, #7921) and is not independently mergeable

Recommended next steps

• Investigate and resolve CI failures (38 checks reported, passed=false)
• Merge prerequisite PRs #8002, #7860, #7921 before integrating this draft
• Re-run full cross-module test suite with prerequisites to confirm admission contracts

Scope: captured diff and GitHub check metadata only; no local tests were executed.

Task: 372c954e-259e-4e3f-a370-76a0c1bb5556 · Commit: c3487f5070d2ba889f206a2fe7b4991195b5b3ab

Review verdict: INCONCLUSIVE

FINAL synthesis scope: all 37 child partition reviews returned PASS with no HIGH/CRITICAL findings, complete_diff=true and all_parts_passed=true. However the governing rule requires CI passed before a FINAL PASS, and the attached CI data shows passed=false (38 checks complete). Additionally, the PR is a draft that explicitly depends on unmerged prerequisite PRs, so cross-file contract correctness cannot be fully confirmed from static partition reviews alone. With no concrete blocking defect to justify NEEDS_CHANGES but inability to confirm PASS, the only admissible verdict is INCONCLUSIVE.

Publication: COMMENT (INCONCLUSIVE_REVIEW)

Review details

Based on the frozen partition reviews, all supplied code segments are clean, but CI did not pass and the PR relies on unmerged prerequisite work. Recommend not merging until CI is green and prerequisites are integrated. Verdict: INCONCLUSIVE.

Stream Agent analysis

WHOLE_PR review at the pinned head is INCONCLUSIVE: the frozen versioned-diff evidence was fully delivered, but CI is complete and not passing, and the attachment lacks failure logs needed to verify a HIGH/CRITICAL source-level blocker.

Evidence

• Frozen attachment: scope WHOLE_PR, VERSIONED_DIFF, file_count 59, complete_diff true; engine read progress records 283241/283241 diff characters delivered with no unread pages; coverage notes no local tests executed.
• CI evidence: complete=true, check_count=93, passed=false; failed checks at the head SHA include build, e2e, compat_java21 (admin, shenyu-admin), and e2e-storage (shenyu-e2e-case-storage, e2e-mysql-compose). The attachment provides conclusions and run IDs but no failure logs.
• Targeted pinned-head reads verified malformed Javadoc in new AgentResourceAdmission.java RIGHT lines 61 and 73, but no CI log proves these lines caused the failed build; no source-level HIGH/CRITICAL defect is established.

Recommended next steps

• Collect the four failed CI job logs for head 226f40e and fix the verified root cause.
• Rerun CI after the #8002 dependency synchronization described in the PR description.
• Return for re-review with passing CI evidence or a source-level failure cause anchored to changed lines.

Scope: captured diff and GitHub check metadata only; no local tests were executed.

Task: 2243019f-645f-43e1-bbaa-abf851f9f28f · Commit: 226f40eb24a8f154c42f61044c4432225f798dec

Review verdict: INCONCLUSIVE

Scope is the complete #8095 change at head 226f40e. Full diff coverage is recorded, but PASS requires passing CI and CI is explicitly failed with four failed checks, so PASS is not supported. NEEDS_CHANGES is also not supported because the frozen evidence contains no failure logs and no verified HIGH/CRITICAL defect anchored to a changed path, side and line. The missing CI root-cause evidence makes the analysis incomplete; therefore the explicit verdict is INCONCLUSIVE with no blocking findings.

Publication: COMMENT (INCONCLUSIVE_REVIEW)

Stream Agent analysis

WHOLE_PR review of #8095 (bounded local and remote MCP resource admission, audit bridge, metrics, docs, and Spring Boot wiring): the entire 283,244-character pinned diff was read and cross-file contracts were spot-checked on the frozen head, but CI has not completed and the PR still carries an unmerged dependency, so no definitive PASS or NEEDS_CHANGES verdict is supported.

Evidence

• Coverage: frozen VERSIONED_DIFF fully consumed with complete_diff=true; all pages read to has_more=false (next_unread_offset 283244 = total_characters 283244) for the empty path, plus the complete AgentResourceAdmission.java sub-path; targeted resource_read/resource_search on pinned head 5c87f99 located AgentResourceAdmission, AgentMcpResourceAdmission, AgentMcpDispatcher and AgentToolRegistry references.
• CI is unfinished: ci.check_count=11 while every enumerated check has status=queued and conclusion=null; legacy_state=pending, status_count=0, failed_checks=[], passed=false. No passing CI exists to satisfy the PASS requirement.
• PR description states the branch 'still depends on #8002' and will be 'synchronized with master' after that merge so the final patch contains only the resource-admission delta, meaning the reviewed head carries a non-final patch.

Recommended next steps

• Re-evaluate once the 11 reported CI checks leave the queued/pending state and their conclusions are available.
• Re-review after the branch is rebased on master following the #8002 merge, so the patch contains only the resource-admission delta.
• Verify admission wiring across AgentGatewayPluginConfiguration, AiProxyPluginConfiguration, MetricsReporter and the new agent-audit starter once CI is green.

Scope: captured diff and GitHub check metadata only; no local tests were executed.

Task: 505c8798-f3db-48db-9b02-f50f0305be7c · Commit: 5c87f99f2baf7cd485fff193117d6d9fe0bc8dd6

Review verdict: INCONCLUSIVE

Scope was WHOLE_PR with full diff coverage on head 5c87f99 and no tool failures; no concrete HIGH/CRITICAL blocking defect was verified, so NEEDS_CHANGES is unjustified (and no tests were executed by the reviewer). However PASS explicitly requires passing CI, and the frozen CI snapshot shows 11 checks all queued/pending with passed=false and status_count=0; the PR additionally depends on unmerged #8002, so the reviewed patch is not final. Because this evidence is incomplete, the explicit verdict must be INCONCLUSIVE rather than PASS.

Publication: COMMENT (INCONCLUSIVE_REVIEW)