Drop the unused OpenTelemetry dependencies

CHANGELOG.md

@@ -41,6 +41,15 @@ All notable changes to this project are documented here. Format follows
 - `SENTINEL_MCP_ALLOWED_HOST` for the demo tool servers, so they keep MCP's
   Host-header check when deployed behind an internal hostname.
 
+### Removed
+- The `azure-monitor-opentelemetry`, `opentelemetry-api` and
+  `opentelemetry-sdk` dependencies. Nothing used them once trace and span ids
+  came from `secrets`, and they pinned 28 packages in `versions.lock` (the
+  Azure Monitor exporter, fifteen OpenTelemetry instrumentation and support
+  packages, `msrest`, `psutil`, `wrapt` and others). A project that imported
+  OpenTelemetry only because SENTINEL installed it must now depend on it
+  directly.
+
 ### Security
 - `mcp` is upgraded to 1.30.0 (floor and lock) for CVE-2026-59951
   (GHSA-84m7-p3x7-pcfv): the SDK's streamable-HTTP transport let sessions

README.md

@@ -411,7 +411,7 @@ competitive/threat-landscape research behind the roadmap.
 MIT — see [LICENSE](./LICENSE).
 
 Built on the [Model Context Protocol](https://modelcontextprotocol.io) Python SDK,
-FastAPI, Starlette, `sse-starlette`, Uvicorn, Pydantic, OpenTelemetry, PyYAML, httpx,
+FastAPI, Starlette, `sse-starlette`, Uvicorn, Pydantic, PyYAML, httpx,
 pytest, ruff, mypy, gitleaks, and the Azure SDKs for Python. Thank you to their
 maintainers.
 

pyproject.toml

@@ -47,7 +47,6 @@ dependencies = [
     "azure-ai-projects==2.0.0",          # Foundry; AIProjectClient is THE entry point
     "azure-identity>=1.17,<2",
     "azure-cosmos>=4.7,<5",
-    "azure-monitor-opentelemetry>=1.6,<2",
 
     # MCP — official Python SDK (server + client)
     # Floor is 1.30.0 for security: earlier releases carry PYSEC-2026-3481,
@@ -62,10 +61,6 @@ dependencies = [
     # OpenAI — exact pin written to versions.lock after resolve
     "openai>=1.50,<3",
 
-    # OpenTelemetry
-    "opentelemetry-api>=1.27,<2",
-    "opentelemetry-sdk>=1.27,<2",
-
     # HTTP / SSE
     "fastapi>=0.115,<1",
     "uvicorn[standard]>=0.32,<1",
@@ -125,15 +120,14 @@ timeout_method = "thread"
 asyncio_mode = "auto"
 filterwarnings = [
     "error",
-    # azure-* and opentelemetry occasionally emit deprecation noise we do not own
+    # azure-* occasionally emits deprecation noise we do not own
     "ignore::DeprecationWarning:azure.*",
-    "ignore::DeprecationWarning:opentelemetry.*",
     "ignore::PendingDeprecationWarning:azure.*",
     # anyio/mcp in-memory streams are closed at GC time, which pytest surfaces as
     # an *unraisable* ResourceWarning. Under "error" this intermittently fails the
     # suite depending on GC timing (benign on Windows, fails on the Linux runner).
     # It is a third-party cleanup artifact, not a defect in our code — ignore it
-    # like the azure/opentelemetry noise above.
+    # like the azure noise above.
     "ignore::ResourceWarning",
     "ignore::pytest.PytestUnraisableExceptionWarning",
 ]

tests/test_phase0_smoke.py

@@ -109,9 +109,6 @@ def test_versions_lock_has_real_pins() -> None:
         "openai",
         "azure-identity",
         "azure-cosmos",
-        "azure-monitor-opentelemetry",
-        "opentelemetry-api",
-        "opentelemetry-sdk",
         "fastapi",
         "uvicorn",
         "sse-starlette",

versions.lock

@@ -1,16 +1,12 @@
 annotated-doc==0.0.4
 annotated-types==0.7.0
 anyio==4.14.2
-asgiref==3.11.1
 ast_serialize==0.5.0
 attrs==26.1.0
 azure-ai-projects==2.0.0
 azure-core==1.41.0
-azure-core-tracing-opentelemetry==1.0.0b13
 azure-cosmos==4.15.0
 azure-identity==1.25.3
-azure-monitor-opentelemetry==1.8.8
-azure-monitor-opentelemetry-exporter==1.0.0b52
 azure-storage-blob==12.29.0
 certifi==2026.5.20
 cffi==2.0.0
@@ -30,7 +26,6 @@ httpx==0.28.1
 httpx-sse==0.4.3
 identify==2.6.19
 idna==3.17
-importlib_metadata==8.7.1
 iniconfig==2.3.0
 isodate==0.7.2
 jiter==0.15.0
@@ -40,35 +35,15 @@ librt==0.11.0
 mcp==1.30.0
 msal==1.39.0
 msal-extensions==1.3.1
-msrest==0.7.1
 mypy==2.1.0
 mypy_extensions==1.1.0
 nodeenv==1.10.0
-oauthlib==4.0.0
 openai==2.38.0
-opentelemetry-api==1.40.0
-opentelemetry-instrumentation==0.61b0
-opentelemetry-instrumentation-asgi==0.61b0
-opentelemetry-instrumentation-dbapi==0.61b0
-opentelemetry-instrumentation-django==0.61b0
-opentelemetry-instrumentation-fastapi==0.61b0
-opentelemetry-instrumentation-flask==0.61b0
-opentelemetry-instrumentation-logging==0.61b0
-opentelemetry-instrumentation-psycopg2==0.61b0
-opentelemetry-instrumentation-requests==0.61b0
-opentelemetry-instrumentation-urllib==0.61b0
-opentelemetry-instrumentation-urllib3==0.61b0
-opentelemetry-instrumentation-wsgi==0.61b0
-opentelemetry-resource-detector-azure==0.1.5
-opentelemetry-sdk==1.40.0
-opentelemetry-semantic-conventions==0.61b0
-opentelemetry-util-http==0.61b0
 packaging==26.2
 pathspec==1.1.1
 platformdirs==4.10.0
 pluggy==1.6.0
 pre_commit==4.6.0
-psutil==7.2.2
 pycparser==3.0
 pydantic==2.13.4
 pydantic-settings==2.14.2
@@ -85,7 +60,6 @@ pywin32==311
 PyYAML==6.0.3
 referencing==0.37.0
 requests==2.34.2
-requests-oauthlib==2.0.0
 rpds-py==2026.5.1
 ruff==0.15.15
 sniffio==1.3.1
@@ -100,5 +74,3 @@ uvicorn==0.48.0
 virtualenv==21.7.13
 watchfiles==1.2.0
 websockets==16.0
-wrapt==1.17.3
-zipp==4.1.0