arifOS-Langfuse — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited arifOS-Langfuse (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Instrument arifOS constitutional AI operations with Langfuse LLM tracing.
arifOS Kernel (Python)
└── arifosmcp/runtime/telemetry.py ← Telemetry wrapper
├── Prometheus metrics (counters, histograms)
└── Langfuse v3 span tracing ← HERE
├── context manager: with lf.start_as_current_observation() as span
├── span.update(input={...}, output={...})
└── lf.flush()arifOS uses Langfuse Python SDK v3 with context manager pattern — spans auto-close on exit.
arifOS → Langfuse (cloud Japan):
export LANGFUSE_PUBLIC_KEY=pk-lf-bbe515cf-c1f7-46f3-badc-14cc172554ef
export LANGFUSE_SECRET_KEY=sk-lf-ed6da0eb-23c7-4ccb-a4f9-6d3bac1179d9
export LANGFUSE_HOST=https://jp.cloud.langfuse.comarifOS → Langfuse (self-hosted on VPS):
export LANGFUSE_HOST=http://langfuse-web:3000
# same keysfrom langfuse import Langfuse
lf = Langfuse(
public_key=os.getenv("LANGFUSE_PUBLIC_KEY"),
secret_key=os.getenv("LANGFUSE_SECRET_KEY"),
host=os.getenv("LANGFUSE_HOST", "https://jp.cloud.langfuse.com")
)
# WRONG — detached span, no active context
lf.start_as_current_observation(as_type="span", name="arifOS::tool-name")
lf.update_current_span(...)
# CORRECT — context manager, span auto-closes
with lf.start_as_current_observation(as_type="span", name="arifOS::tool-name", metadata={...}) as span:
span.update(input={"tool": tool_name, "actor": actor_id}, output={"verdict": verdict, ...})In arifosmcp/runtime/telemetry.py, record_tool_call() method:
with self._lf.start_as_current_observation(
as_type="span",
name=f"arifOS::{tool}",
metadata=_redact(span_meta),
) as span:
span.update(input={"tool": tool, "actor": actor_id}, output={"verdict": verdict, ...})After flush() the span appears in Langfuse dashboard under the project.
# Install SDK
pip install langfuse
# In .env (not hardcoded — use env vars)
LANGFUSE_PUBLIC_KEY=pk-lf-...
LANGFUSE_SECRET_KEY=sk-lf-...
LANGFUSE_HOST=https://jp.cloud.langfuse.com
# or for self-hosted:
# LANGFUSE_HOST=http://langfuse-web:3000| Tool | Traced | Priority |
|---|---|---|
| arif_judge_deliberate | ✅ active | P0 |
| arif_mind_reason | ⚠️ pilot | P1 |
| arif_heart_critique | ⚠️ pilot | P1 |
| arif_session_init | 🔜 next | P2 |
| Others | ❌ not wired | — |
# From inside arifOS container:
docker exec arifosmcp python3 -c "
from arifosmcp.runtime.telemetry import get_telemetry
t = get_telemetry()
print('Langfuse active:', t._lf is not None)
t.record_tool_call(tool='arif_judge_deliberate', verdict='SEAL', latency=0.15,
session_id='test', actor_id='arif', metadata={'test': True})
t.flush()
print('Trace sent — check Langfuse dashboard')
"arifosmcp/runtime/tools.pytrace_tool_call() from telemetry after successful executionexport LANGFUSE_PUBLIC_KEY=pk-lf-bbe515cf-c1f7-46f3-badc-14cc172554ef
export LANGFUSE_SECRET_KEY=sk-lf-ed6da0eb-23c7-4ccb-a4f9-6d3bac1179d9
export LANGFUSE_HOST=https://jp.cloud.langfuse.com
# List recent traces
curl -s "$LANGFUSE_HOST/api/public/traces?limit=10" \
-u "$LANGFUSE_PUBLIC_KEY:$LANGFUSE_SECRET_KEY" | python3 -m json.tool
# Get specific trace
curl -s "$LANGFUSE_HOST/api/public/traces/<trace-id>" \
-u "$LANGFUSE_PUBLIC_KEY:$LANGFUSE_SECRET_KEY"lf.score_current_trace(name="arifOS-verdict", value=1.0 if verdict == "SEAL" else 0.0)| Symptom | Fix |
|---|---|
ModuleNotFoundError: No module named 'langfuse' | pip install langfuse in container |
AttributeError: 'Langfuse' object has no attribute 'trace' | Use v3 context manager pattern, not .trace() |
Context error: No active span | Wrap with with lf.start_as_current_observation() as span: |
401 Unauthorized | Check API keys are correct + LANGFUSE_HOST matches region |
| Traces not appearing after flush | Check LANGFUSE_HOST network access from container |
langfuse-web returns 404 | Self-hosted needs /api/public/ path prefix |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.