RSPEED-2326: feat(observability): add inference event builder for rlsapi v1

Implement build_inference_event() matching rlsapi Splunk event format:
- InferenceEventData dataclass for structured input
- Handles auth_disabled case for org_id/system_id
- Maps all fields from request data and configuration
- Empty placeholders for RAG fields (not yet implemented)

Signed-off-by: Major Hayden <major@redhat.com>

Author: major

src/observability/__init__.py

@@ -2,9 +2,13 @@
 
 This module provides functionality for sending telemetry events to external
 systems like Splunk HEC for monitoring and analytics.
+
+The splunk module provides a format-agnostic send_splunk_event() function.
+Event formats are in the formats subpackage - see formats.rlsapi for the
+default implementation, or create your own format module.
 """
 
+from observability.formats import InferenceEventData, build_inference_event
 from observability.splunk import send_splunk_event
-from observability.telemetry import build_inference_event
 
-__all__ = ["send_splunk_event", "build_inference_event"]
+__all__ = ["send_splunk_event", "InferenceEventData", "build_inference_event"]

src/observability/formats/__init__.py

@@ -0,0 +1,9 @@
+"""Event format builders for Splunk telemetry.
+
+Each submodule provides format-specific event builders. The rlsapi module
+provides the default format matching Red Hat's rlsapi v1 specification.
+"""
+
+from observability.formats.rlsapi import InferenceEventData, build_inference_event
+
+__all__ = ["InferenceEventData", "build_inference_event"]

src/observability/formats/rlsapi.py

@@ -0,0 +1,57 @@
+"""Event builders for rlsapi v1 Splunk format.
+
+This module provides event builders specific to the rlsapi v1 telemetry format.
+To implement a custom format, create a new module in this package with your own
+event builder function that returns a dict, then pass the result to send_splunk_event().
+"""
+
+from dataclasses import dataclass
+from typing import Any
+
+from configuration import configuration
+
+
+@dataclass
+class InferenceEventData:  # pylint: disable=too-many-instance-attributes
+    """Data required to build an inference telemetry event."""
+
+    question: str
+    response: str
+    inference_time: float
+    model: str
+    org_id: str
+    system_id: str
+    request_id: str
+    cla_version: str
+    system_os: str
+    system_version: str
+    system_arch: str
+
+
+def build_inference_event(data: InferenceEventData) -> dict[str, Any]:
+    """Build an inference telemetry event payload matching rlsapi format.
+
+    Args:
+        data: The inference event data.
+
+    Returns:
+        A dictionary matching the rlsapi Splunk event format.
+    """
+    return {
+        "question": data.question,
+        "refined_questions": [],
+        "context": "",
+        "response": data.response,
+        "inference_time": data.inference_time,
+        "model": data.model,
+        "deployment": configuration.deployment_environment,
+        "org_id": data.org_id,
+        "system_id": data.system_id,
+        # Token counting not yet implemented in lightspeed-stack; rlsapi uses 0 as default
+        "total_llm_tokens": 0,
+        "request_id": data.request_id,
+        "cla_version": data.cla_version,
+        "system_os": data.system_os,
+        "system_version": data.system_version,
+        "system_arch": data.system_arch,
+    }

tests/unit/observability/formats/__init__.py

@@ -0,0 +1 @@
+"""Unit tests for observability event format builders."""

tests/unit/observability/formats/test_rlsapi.py

@@ -0,0 +1,74 @@
+"""Unit tests for rlsapi v1 event builders."""
+
+from unittest.mock import patch
+
+import pytest
+
+from observability.formats.rlsapi import InferenceEventData, build_inference_event
+
+
+@pytest.fixture(name="sample_event_data")
+def sample_event_data_fixture() -> InferenceEventData:
+    """Create sample inference event data for testing."""
+    return InferenceEventData(
+        question="How do I configure SSH?",
+        response="To configure SSH, edit /etc/ssh/sshd_config...",
+        inference_time=2.34,
+        model="granite-3-8b-instruct",
+        org_id="12345678",
+        system_id="abc-def-123",
+        request_id="req_xyz789",
+        cla_version="CLA/0.4.0",
+        system_os="RHEL",
+        system_version="9.3",
+        system_arch="x86_64",
+    )
+
+
+def test_builds_event_with_all_fields(sample_event_data: InferenceEventData) -> None:
+    """Test event contains all required fields and placeholders."""
+    with patch("observability.formats.rlsapi.configuration") as mock_config:
+        mock_config.deployment_environment = "production"
+
+        event = build_inference_event(sample_event_data)
+
+        assert event["question"] == "How do I configure SSH?"
+        assert event["response"] == "To configure SSH, edit /etc/ssh/sshd_config..."
+        assert event["inference_time"] == 2.34
+        assert event["model"] == "granite-3-8b-instruct"
+        assert event["org_id"] == "12345678"
+        assert event["system_id"] == "abc-def-123"
+        assert event["request_id"] == "req_xyz789"
+        assert event["cla_version"] == "CLA/0.4.0"
+        assert event["system_os"] == "RHEL"
+        assert event["system_version"] == "9.3"
+        assert event["system_arch"] == "x86_64"
+        assert event["deployment"] == "production"
+        assert not event["refined_questions"]
+        assert event["context"] == ""
+        assert event["total_llm_tokens"] == 0
+
+
+def test_handles_auth_disabled_values() -> None:
+    """Test event handles auth_disabled placeholder values."""
+    data = InferenceEventData(
+        question="test",
+        response="test",
+        inference_time=1.0,
+        model="test-model",
+        org_id="auth_disabled",
+        system_id="auth_disabled",
+        request_id="req_123",
+        cla_version="test/1.0",
+        system_os="",
+        system_version="",
+        system_arch="",
+    )
+
+    with patch("observability.formats.rlsapi.configuration") as mock_config:
+        mock_config.deployment_environment = "test"
+
+        event = build_inference_event(data)
+
+        assert event["org_id"] == "auth_disabled"
+        assert event["system_id"] == "auth_disabled"