Shared anonymous user id across telemetry, feedback, and DeepSeek requests
遥测、反馈与 DeepSeek 请求共享匿名用户 id
The OpenTelemetry backend already persisted one anonymous UUID in `$DSH_HOME/.anonymous-user-id`. `/feedback` now needs to report both the receiving session id and a user id so an operator can correlate the acknowledgement with exported records. Duplicating or independently generating that identity would make the reported user meaningless, while importing it from `session-telemetry-otel` would make a direct command d
English
Problem
The OpenTelemetry backend already persisted one anonymous UUID in $DSH_HOME/.anonymous-user-id. /feedback now needs to report both the receiving session id and a user id so an operator can correlate the acknowledgement with exported records. Duplicating or independently generating that identity would make the reported user meaningless, while importing it from session-telemetry-otel would make a direct command depend on an exporter backend and create a dependency cycle when feedback export is mounted by telemetry.
The earlier anonymous-user-id decision deliberately kept the helper inside the OTel backend until a second real consumer existed. Feedback became that second consumer. Direct DeepSeek request identity is the third.
Decision
@deepseek-ai/dsh-anonymous-user-id owns getOrCreateAnonymousUserId() and the $DSH_HOME/.anonymous-user-id storage contract. session-telemetry-otel uses the returned id as OpenTelemetry Resource user.id; the /feedback success acknowledgement reports Feedback recorded for session {sessionId} followed by Anonymous user: {userId} on a second line; and direct DeepSeek requests carry it as x-deepseek-harness-user-id. Invalid feedback is rejected before resolving the id, and the DeepSeek adapter resolves it only after credentials succeed, so neither an empty command nor a credential failure creates .anonymous-user-id.
The extraction preserves the existing random UUID, home resolution, process memo, exclusive-create concurrency, corruption replacement, and best-effort write semantics.
Alternatives considered
| Rejected | Reason |
|---|---|
Import the helper from session-telemetry-otel | Couples feedback to an optional exporter backend and forms a reverse dependency cycle once telemetry exports feedback |
| Duplicate the persistence helper in feedback | Two implementations of one file contract can drift and race with different validation or failure semantics |
| Generate a separate feedback user id | The acknowledgement could not correlate with the OTel Resource and would not satisfy the reporting purpose |
Consequences
- One harness home has one anonymous id shared by feedback acknowledgements, session telemetry exports, and direct DeepSeek requests.
- The feedback package depends only on the identity capability, not the telemetry seam or OTel SDK.
- The package is a justified shared library with three consumers; its empty invariant companion explains why reading the private file is not a useful runtime relationship check.
- The original anonymous-user-id Note remains authoritative for storage and privacy semantics, while this Note supersedes only its OTel-local ownership decision.
中文
问题
OpenTelemetry 后端已在 $DSH_HOME/.anonymous-user-id 中持久化一个匿名 UUID。/feedback 需要同时报告接收反馈的会话 id 与用户 id，以便运维人员将确认文本与导出的记录相关联。复制该身份或单独生成身份会使报告的用户失去意义；从 session-telemetry-otel 导入身份则会让直接命令依赖导出后端，并在遥测侧挂载反馈导出时形成依赖环。
早先的匿名用户 id 决策刻意将辅助函数留在 OTel 后端内，直至出现第二个真实消费方。反馈成为第二个消费方，直连 DeepSeek 请求身份则是第三个。
决策
@deepseek-ai/dsh-anonymous-user-id 负责 getOrCreateAnonymousUserId() 和 $DSH_HOME/.anonymous-user-id 存储约定。session-telemetry-otel 将返回的 id 用作 OpenTelemetry Resource 的 user.id；/feedback 的成功确认先报告 Feedback recorded for session {sessionId}，再在第二行显示 User: {userId}；直连 DeepSeek 请求则通过 x-deepseek-harness-user-id 携带它。系统在获取 id 前拒绝无效反馈，DeepSeek 适配器也仅在凭据解析成功后获取 id，因此空命令和凭据失败都不会创建 .anonymous-user-id。
此次抽取保留既有的随机 UUID、home 解析、进程内缓存、独占创建并发、损坏文件替换与 best-effort 写入语义。
考虑过的替代方案
| 已否决 | 原因 |
|---|---|
从 session-telemetry-otel 导入辅助函数 | 使反馈耦合到可选的导出后端，并在遥测导出反馈后形成反向依赖环 |
| 在反馈中复制持久化辅助函数 | 同一文件约定的两份实现可能发生偏差，并因校验或失败语义不同而产生竞态 |
| 生成独立的反馈用户 id | 确认文本无法与 OTel Resource 相关联，因而不能达到报告目的 |
后果
- 一个 harness home 只有一个匿名 id，由反馈确认、会话遥测导出与直连 DeepSeek 请求共享。
- 反馈包只依赖身份能力，不依赖遥测 seam 或 OTel SDK。
- 该包由三个消费方使用，成为有充分依据的共享库；其空不变式伴生插件解释了为何读取私有文件并非有用的运行时关系检查。
- 原始匿名用户 id Note 仍是存储与隐私语义的权威记录；本 Note 仅取代其中由 OTel 本地拥有身份的决策。