[afourniernv]

Summary

Capture configuration identities when a request selects them and retain those identities through its trace and security record. Use schema-safe extension fields where typed fields have different meaning, and preserve full revision precision.

Stacked review 4/6. This draft targets the credential-correlation draft in this fork; its diff contains only this layer, not the whole stack. The HTTP core is reviewed upstream in NVIDIA#5214; this dependent draft is on the author fork because upstream base branches are not available.

Related Issue

Closes NVIDIA#5396.
Tracking: NVIDIA#5210 (remains open).

Changes

• The local layer pins request metadata and stores extension fields under OCSF unmapped rather than repurposing typed firewall-rule versions.
• A request retains the revision identities it actually selected, including across concurrent reloads.
• Provider and policy identities remain distinct and large revision values retain full precision.

Testing

• Exact revision layer: mise run pre-commit passed; 1,655 network and 188 OCSF tests passed.
• Behavior tests added or retained for this layer; DCO-signed commit b5f5756.
• Cumulative native Hermes/Relay live validation on source 0764c1c4c: 13 selected workflows, 1,552 spans and 433 OCSF records; protected synthetic APIs and authenticated GitHub. The agent executed actual tools; no span parents were rewritten. This is cumulative evidence, not isolated-layer E2E qualification.
• Cumulative mise run test rerun passed with four test threads. Initial unchanged VM cleanup and gateway fixture flakes passed isolated reruns and the final full run. Full mise run ci is not claimed.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant crate and observability documentation updated.
• Maintainer acceptance and upstream promotion, after the parent layer lands.

Tested upstream snapshot: 638974575 (merged NVIDIA#4789). Newer main has advanced; this draft does not claim validation against today's main. It is for incremental code review, not merge readiness. No Relay dependency or reverse workload-reporting endpoint is introduced.