feat(geneva-exporter): support agent-fed credentials

[manishgoel3]

Change Summary

Adds agent-fed authentication to the Geneva exporter. The exporter resolves bearer tokens and endpoint/moniker routing from the BearerTokenProvider and VendorBundle capabilities, bypassing the Geneva Config Service handshake.

Both capabilities must bind to the same extension. Invalid or unavailable credentials fail closed, while per-upload credential reads support host-side rotation.

What issue does this PR close?

• Closes [otap-dataflow] Support embedder-fed (push) credentials for exporter auth via the extension framework #3275

How are these changes tested?

• Contrib-nodes and engine all-target clippy pass with warnings denied.
• All 34 Geneva exporter unit and regression tests pass.
• Coverage includes existing authentication modes, configuration validation, capability binding, routing precedence, rotation, recovery, and ACK/NACK behavior.
• Runtime tests used the non-assembly zeroize fallback because ms-prod currently reports E9003 for its inline assembly barrier.

Are there any user-facing changes?

Yes. Geneva exporters can now select auth.type: agentfed and bind the following capabilities to the same host extension:

• bearer_token_provider
• vendor_bundle

The endpoint and region configuration fields are optional in agent-fed mode. Existing authentication modes retain their current behavior and requirements.

Changelog

• Added a .chloggen/*.yaml entry
• This PR is a chore (indicated in title)
• This is a documentation-only PR.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Status last refreshed: 2026-07-26 03:48:26 UTC.

• Waiting on: Reviewers
• Next step: Review the latest changes.

This automated status or its linked feedback items may be incorrect. If something looks wrong, please report it with the result you expected.

[Copilot]

✅ Ready to approve

The implementation is cohesive, fail-closed, well-documented, and includes targeted unit/regression coverage for capability binding, routing precedence, rotation, and error handling paths.

Note: this review does not count toward required approvals for merging.

Pull request overview

Adds an agent-fed authentication mode to the Rust OTAP Dataflow Geneva exporter so an embedding host can supply bearer tokens and routing metadata via the extension capability framework, bypassing the Geneva Config Service (GCS) handshake.

Changes:

• Introduces auth.type: agentfed for the Geneva exporter, resolving credentials and routing from bearer_token_provider + vendor_bundle capabilities bound to the same extension.
• Adds an AgentFedGenevaSource adapter that fail-closes on invalid/unavailable credentials, supports host-side rotation via per-upload reads, and rate-limits warning logs.
• Extends documentation and testing utilities to support real capability binding resolution in downstream component tests.

File summaries

File	Description
rust/otap-dataflow/crates/engine/src/testing/capability/mod.rs	Adds a test-only helper to resolve real capability bindings for component tests.
rust/otap-dataflow/crates/engine/src/capability/vendor_bundle.rs	Clarifies non-atomic token/bundle read semantics and extension clone state-sharing requirements.
rust/otap-dataflow/crates/contrib-nodes/src/exporters/geneva_exporter/README.md	Documents agentfed configuration, binding requirements, routing precedence, and rotation behavior.
rust/otap-dataflow/crates/contrib-nodes/src/exporters/geneva_exporter/mod.rs	Implements agentfed config parsing/validation, capability binding checks, and client construction with an agent-fed source.
rust/otap-dataflow/crates/contrib-nodes/src/exporters/geneva_exporter/agent_fed_source.rs	Adds the adapter bridging engine capabilities to geneva-uploader’s agent-fed credential source + extensive unit tests.
rust/otap-dataflow/.chloggen/agent-fed-exporter-sources.yaml	Adds a user-facing changelog entry for agent-fed Geneva exporter credentials.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 0
• Review effort level: Low

Note

Your feedback helps us improve the quality of this feature.
Please use 👍 or 👎 to tell us whether this assessment is correct.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 92.10904% with 55 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.90%. Comparing base (185447e) to head (146efc9).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3579      +/-   ##
==========================================
+ Coverage   86.88%   86.90%   +0.01%     
==========================================
  Files         782      784       +2     
  Lines      319283   319912     +629     
==========================================
+ Hits       277422   278021     +599     
- Misses      41337    41367      +30     
  Partials      524      524              

Components	Coverage Δ
otap-dataflow	87.97% <92.10%> (+0.01%)	⬆️
query_engine	89.57% <ø> (ø)
otel-arrow-go	52.45% <ø> (ø)
quiver	92.20% <ø> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.