feat(semconv): add AIPOU work-receipt reference span attributes

[Diyaaa-12]

Follow-up to discussion in #4340.

Adds four opt-in SpanAttributes constants for referencing an external
AIPOU work receipt:

• AIPOU_WORK_RECEIPT_ID
• AIPOU_EVIDENCE_CLASS
• AIPOU_SCHEME
• AIPOU_VALIDATION_STATUS

Scope is intentionally minimal per @0xddneto's proposed boundary:
constants + tests only, no helper function yet — want to confirm the
naming/shape here before adding one.

Tests added in _testing.py (shared compliance suite, reused by both
test_semconv_compliance.py and test_span_attributes.py).

Note: 30 unrelated pre-existing failures in this suite come from a
missing opentelemetry-semantic-conventions dependency in my local
env — confirmed via git stash that they fail identically without
this change.

Ref: #4340

• I have added tests that cover my changes.
• If adding a new instrumentation or changing an existing one, I've added screenshots from some observability platform showing the change.
• PR name follows conventional commits format: feat(instrumentation): ... or fix(instrumentation): ....
• (If applicable) I have updated the documentation accordingly.

Summary by CodeRabbit

• Enhancements

  • Added four new deprecated AI observability span attributes for work receipt ID, evidence class, scheme, and validation status.

• Tests

  • Added coverage to verify these new attributes map to the expected standardized aipou.* values.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a89bad03-49d2-479e-ae8a-e863286c75a2

📥 Commits

Reviewing files that changed from the base of the PR and between 301044a and 708791a.

📒 Files selected for processing (1)

• packages/opentelemetry-semantic-conventions-ai/opentelemetry/semconv_ai/__init__.py

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/opentelemetry-semantic-conventions-ai/opentelemetry/semconv_ai/init.py

---

📝 Walkthrough

Walkthrough

Added four deprecated AIPOU SpanAttributes constants and pytest coverage verifying their corresponding aipou.* keys.

Changes

AIPOU span attributes

Layer / File(s)	Summary
AIPOU constants and validation packages/opentelemetry-semantic-conventions-ai/opentelemetry/semconv_ai/__init__.py, packages/opentelemetry-semantic-conventions-ai/opentelemetry/semconv_ai/_testing.py	Adds four deprecated AIPOU attribute constants and tests their expected string values.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding AIPOU work-receipt reference span attributes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@packages/opentelemetry-semantic-conventions-ai/opentelemetry/semconv_ai/_testing.py`:
- Line 465: Add a trailing newline at the end of _testing.py, immediately after
the final assertion, without changing any other content.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 700081ac-f14f-4095-b3d2-987dcfbdb088

📥 Commits

Reviewing files that changed from the base of the PR and between 93429cf and 9c92e65.

📒 Files selected for processing (2)

• packages/opentelemetry-semantic-conventions-ai/opentelemetry/semconv_ai/__init__.py
• packages/opentelemetry-semantic-conventions-ai/opentelemetry/semconv_ai/_testing.py

[0xddneto]

Thank you, @Diyaaa-12. This is the minimal integration surface we discussed, and keeping it to constants plus conformance tests is a good first step. The four fields are correlation-only; the authoritative receipt and validation lifecycle remain external to OpenLLMetry.

I found one important placement issue before maintainer review: the new constants currently sit immediately below # Deprecated, so CodeRabbit is describing all four AIPOU attributes as deprecated. Could you move them into a dedicated section such as # External work receipt references (opt-in) outside that block? The trailing newline flagged by CodeRabbit should also be added.

With that correction, the scope matches the agreed privacy and trust boundary: meaningful work-unit spans may carry the compact reference, while OpenLLMetry does not collect private receipt payloads, derive validation status, or become claim authority. No helper is needed in this PR.

[0xddneto]

I applied the complementary AIPOU-side reference projection in 0xddneto/AI-Proof-of-Us@90551cf.

buildReceiptSpanAttributes now emits exactly the four strings proposed here:

• aipou.work_receipt_id
• aipou.evidence_class
• aipou.scheme
• aipou.validation_status

The conformance test also asserts that wallet, reward, prompt, output, and claim authority are absent. The MCP suite passes 38/38, the production dependency audit reports zero vulnerabilities, and the package dry-run succeeds. This gives the PR an executable producer-side reference without requiring OpenLLMetry to add a helper or validate AIPOU receipts.

I also saw that the trailing-newline fix landed immediately, thank you. The only review item still visible in the current diff is moving the constants out from under the existing # Deprecated heading so their status is unambiguous.

[Diyaaa-12]

Thank You @0xddneto ! Fixed moved the AIPOU constants out from under the # Deprecated heading into their own # External work receipt references (opt-in) section, right after the Watson block. Pushed in cce0559's follow up commit. Ready for another look whenever convenient.

[0xddneto]

Reviewed commit 301044a. The deprecation concern is resolved, the four names match the AIPOU producer-side projection, and the privacy/trust boundary is correct. Thank you for the quick fix.

One small source-organization cleanup remains: the AIPOU section currently sits between GEN_AI_WATSONX_DECODING_METHOD and the other Watson attributes (RANDOM_SEED, MAX_NEW_TOKENS, and so on), so it splits the Watson block. Could you move the complete AIPOU section after all Watson attributes, or immediately before the # Watson/genai LLM heading? This does not change behavior; it just keeps the semantic-convention groups coherent. From the AIPOU side, the naming and boundary are otherwise ready for maintainer review.

[Diyaaa-12]

Hi @0xddneto ! Fixed moved the complete AIPOU section to right after GEN_AI_WATSONX_REPETITION_PENALTY, so the Watson block is no longer split. Pushed in the latest commit. Thanks for catching that.

[Diyaaa-12]

Hi @0xddneto ! waiting for review

[0xddneto]

Sorry for the slow loop closure here, and thank you for the patience.

The honest update from the AIPOU side is that my preferred direction has shifted since this PR was opened. I still think your draft is coherent on its own terms, but the direction I would recommend upstream today is the newer generic external evidence shape rather than vendor-specific �ipou.* keys.

In other words:

• this PR correctly keeps the boundary correlation-only;
• but the longer-lived semantic-conventions fit looks more like gen_ai.external_evidence.* fields that any receipt or audit artifact can use;
• AIPOU should then be one scheme carried by that generic surface, not four dedicated constants in core semconv.

So from my side I would not ask you to keep pushing this AIPOU-specific PR forward unless the maintainers explicitly want a vendor-specific example. If the project wants the more general path instead, I am happy to help with fixture wording and boundary notes there.

[Diyaaa-12]

Thanks for the context, @0xddneto that makes sense as the more durable design.

Before I put time into reworking this PR: would it be worth confirming with the maintainers first whether they'd want a generic gen_ai.external_evidence.* surface at all, versus keeping this as a vendor-specific example? I don't want to rewrite the constants/tests to that shape and then have it stall for the same reason on the generic side.

Happy to do either just want to make sure there's actual appetite before I put in the rework. Let me know what you (or the maintainers) think is the better next step.