[jeremy]

The trace viewer reads a 24-hour signed blob capability from traces/:signed_id. Hosts that use rails_structured_logging need that engine-owned segment declared at the route that defines it so request URLs, referrers, and redirects cannot retain the live capability.

This keeps Upright independent of the optional logger: when the host provides filter_path_parameters, the trace route declares :signed_id; otherwise it draws the same route as before.

Validation:

• bin/rails test test/integration/traces_controller_test.rb — 10 tests, 23 assertions
• bin/rubocop config/routes.rb
• full bin/rails test reached the Playwright probe tests; 3 pre-existing environment failures require the missing local Chromium executable, while the route/controller coverage passed

No deployment is part of this PR.

[jeremy]

@codex review

@codex security review

@copilot review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T23:14:29.503819Z	594bf77	Manual request
🔒 Security Review	✅ Completed 2026-10-24T23:12:58.583655Z	594bf77	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🔵 Needs a closer look

The security-sensitive filtering branch remains unverified against the optional logger’s routing API.

No open issues 🎉

What changed in this PR

This PR declares the trace route’s signed capability parameter for path filtering when the host provides the optional logging integration, without adding a logger dependency to Upright.

Changes:

• Wraps the trace route in filter_path_parameters(:signed_id) when available.
• Preserves the existing route path, name, controller action, and HTTP methods when the integration is absent.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
config/​routes.rb	Adds a guarded filtering declaration for the trace route’s signed ID.

_{Review effort: Balanced}

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 594bf7720b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[Copilot]

@codex review

@codex security review...

Pull request overview

Reviewed commit 594bf77 for correctness, with a separate security review. No actionable bugs or security findings identified; no changes needed.

CI passed: 490 tests, 1,224 assertions, zero failures/errors; lint and Brakeman also passed. Local tests could not start because required gems are missing.

Limitation: the optional rails_structured_logging implementation was unavailable, so its routing API and logger-enabled filtering behavior remain unverified.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 594bf7720b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jeremy]

The optional-logger branch called out in Copilot's review body has coverage on both sides at exact head 594bf7720b189ebbd675448683933fe0f6a2f351:

• Upright's own dependency set does not include rails_structured_logging, so the exact-head GitHub test job exercises the absent-API branch and passed 490 tests / 1,224 assertions. The focused trace-controller run passed 10 / 23, and route RuboCop passed.
• In the dependent 37upright integration checkout, loading this engine head with rails_structured_logging pinned to reviewed merge b8f3ca2985a8be03371a87e16db869c4096d8d2e exercises the present-API branch. The focused query/OIDC/signed-trace-path regression passed 3 tests / 10 assertions; the full Rails suite passed 43 / 106; RuboCop passed 50 files; Brakeman reported 0 warnings.
• All 8 configured engine checks are green, exact-head Codex code/security reviews reported no findings, and there are 0 review threads.

The dependent app changes remain unpushed until this engine commit is immutable after merge. GitHub still requires a human approval here; this comment does not request a bypass, and no merge or deployment has been performed.