feat: add chip-ingress batch config keys and tune defaults

[pkcll]

Summary

Add 7 chip-ingress batch configuration keys to beholder.Config and wire them through the batch emitter and LOOP plugin env config.

This PR also updates the batch emitter defaults based on staging/prod capacity analysis and fixes the histogram bucket schema for chip_ingress.batch.request_size_*.

Default changes

Key	Before	After	Rationale
ChipIngressBufferSize	1000	10000	Buffer headroom for transient send stalls
ChipIngressMaxBatchSize	500	1000	Burst-safety ceiling (batches are interval-bound, not size-bound)
ChipIngressSendInterval	100ms	500ms	Reduce RPC volume on interval-bound batches
ChipIngressSendTimeout	3s	10s	Match observed prod latency tail; preserve flush margin
ChipIngressDrainTimeout	10s	30s	Preserve shutdown-flush margin over the larger SendTimeout
ChipIngressMaxConcurrentSends	10	10	Unchanged
ChipIngressMaxGRPCRequestSize	10 MiB	10 MiB	Unchanged

Batches are interval-bound at steady state (p99 ~10 msgs/batch), so MaxBatchSize is a burst-safety ceiling rather than the active flush lever.

Changes

• pkg/beholder/config.go: added ChipIngressMaxGRPCRequestSize + updated defaults
• pkg/beholder/batch_emitter_service.go: wired WithMaxGRPCRequestSize
• pkg/chipingress/batch/client.go: fixed histogram bucket boundaries for request_size_messages and request_size_bytes
• pkg/loop/config.go: added CL_CHIP_INGRESS_* env vars, EnvConfig fields, serialization/parsing
• pkg/loop/server.go: wired env fields into beholder.Config

Related PRs

• Downstream (chainlink TOML wiring): feat: add chip-ingress batch config keys to TOML and wire through chainlink#22987

Testing

• go test ./pkg/loop/... ./pkg/beholder/... ./pkg/chipingress/...

Notes

• DurableEmitter batch client intentionally unchanged.
• Histogram bucket schema change causes transient mixed-schema skew until the fleet upgrades; this is expected and self-healing.
• The previous Co-authored-by: Cursor attribution has been removed from the commit history.

[github-actions]

✅ API Diff Results - github.com/smartcontractkit/chainlink-common

✅ Compatible Changes (9)

pkg/beholder.Config (1)

• ChipIngressMaxGRPCRequestSize — ➕ Added

pkg/beholder.writerClientConfig (1)

• ChipIngressMaxGRPCRequestSize — ➕ Added

pkg/loop.EnvConfig (7)

• ChipIngressBufferSize — ➕ Added

• ChipIngressDrainTimeout — ➕ Added

• ChipIngressMaxBatchSize — ➕ Added

• ChipIngressMaxConcurrentSends — ➕ Added

• ChipIngressMaxGRPCRequestSize — ➕ Added

• ChipIngressSendInterval — ➕ Added

• ChipIngressSendTimeout — ➕ Added

---

📄 View full apidiff report

[github-actions]

📊 API Diff Results

No changes detected for module github.com/smartcontractkit/chainlink-common/pkg/chipingress

View full report

[Copilot]

Pull request overview

Adds configurable chip-ingress batch emitter knobs end-to-end (beholder config ⇄ LOOP env config ⇄ server wiring), updates batch-emitter defaults based on capacity analysis, and corrects the chip_ingress.batch.request_size_* histogram bucket schemas.

Changes:

• Extend beholder.Config with ChipIngressMaxGRPCRequestSize and update chip-ingress batch default values.
• Add CL_CHIP_INGRESS_* env vars to LOOP EnvConfig, serialize/parse them, and wire them into beholder.Config in the LOOP server.
• Adjust chip-ingress batch client histogram bucket boundaries for request sizes (messages + bytes).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pkg/beholder/config.go	Adds ChipIngressMaxGRPCRequestSize and updates chip-ingress batch emitter defaults.
pkg/beholder/batch_emitter_service.go	Wires max gRPC request size into the batch client configuration.
pkg/beholder/batch_emitter_service_test.go	Extends tests/bench config to include ChipIngressMaxGRPCRequestSize.
pkg/beholder/testdata/config-example.json	Adds the new config key to the example JSON schema.
pkg/chipingress/batch/client.go	Updates OTel histogram bucket boundaries for request size metrics.
pkg/loop/config.go	Adds new CL_CHIP_INGRESS_* env vars, EnvConfig fields, serialization, and parsing helpers.
pkg/loop/config_test.go	Updates env config tests to cover new chip-ingress env vars.
pkg/loop/server.go	Wires new LOOP env config fields into beholder.Config.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

pkg/loop/config.go:744

• getUint parses into a uint64 and then casts to uint without bounds checking. On 32-bit platforms (or if a very large value is provided), this can overflow and wrap silently, leading to incorrect configuration values.

func getUint(envKey string) (uint, error) {
	s := os.Getenv(envKey)
	if s == "" {
		return 0, nil
	}
	u, err := strconv.ParseUint(s, 10, 64)
	if err != nil {
		return 0, err
	}
	return uint(u), nil
}

pkg/beholder/batch_emitter_service.go:70

• ChipIngressMaxGRPCRequestSize is converted from uint to int without range checks. If a user configures a value larger than max int, the cast can overflow and become negative/incorrect, which would be passed into batch.WithMaxGRPCRequestSize.

	maxGRPCRequestSize := int(cfg.ChipIngressMaxGRPCRequestSize)
	if maxGRPCRequestSize == 0 {
		maxGRPCRequestSize = int(defaults.ChipIngressMaxGRPCRequestSize)
	}

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

pkg/loop/config.go:613

• ChipIngressMaxConcurrentSends is parsed as an int but negative values are currently accepted. A negative value will panic at runtime when passed into batch.WithMaxConcurrentSends (it uses make(chan struct{}, maxConcurrentSends)). Please reject negative values during env parsing (consistent with the existing negative checks for other chip-ingress keys).

		e.ChipIngressMaxConcurrentSends, err = getInt(envChipIngressMaxConcurrentSends)
		if err != nil {
			return fmt.Errorf("failed to parse %s: %w", envChipIngressMaxConcurrentSends, err)
		}
		e.ChipIngressSendInterval, err = getDuration(envChipIngressSendInterval)
		if err != nil {
			return fmt.Errorf("failed to parse %s: %w", envChipIngressSendInterval, err)
		}

pkg/loop/config.go:747

• getUint parses into a uint64 and then casts to uint without an overflow check. On 32-bit builds this can silently wrap, and even on 64-bit it can allow values that later overflow when converted to int (e.g., in beholder batch emitter config). Prefer parsing with a bitSize that matches the target word size so overflow becomes a parse error.

func getUint(envKey string) (uint, error) {
	s := os.Getenv(envKey)
	if s == "" {
		return 0, nil
	}
	u, err := strconv.ParseUint(s, 10, 64)
	if err != nil {
		return 0, err
	}
	return uint(u), nil
}

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (1)

pkg/loop/config.go:746

• getUint parses into a uint64 and then casts to uint without overflow checking. On 32-bit builds this can silently wrap, producing a much smaller value than configured. Add an explicit bounds check before casting.

	u, err := strconv.ParseUint(s, 10, 64)
	if err != nil {
		return 0, err
	}
	return uint(u), nil

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

pkg/loop/config.go:609

• CL_CHIP_INGRESS_MAX_CONCURRENT_SENDS is parsed with getInt but isn't validated for negative values. A negative value will panic at runtime when batch.WithMaxConcurrentSends does make(chan struct{}, maxConcurrentSends) with a negative capacity. Add a non-negative validation similar to ChipIngressMaxGRPCRequestSize.

		e.ChipIngressMaxConcurrentSends, err = getInt(envChipIngressMaxConcurrentSends)
		if err != nil {
			return fmt.Errorf("failed to parse %s: %w", envChipIngressMaxConcurrentSends, err)
		}

pkg/loop/config.go:746

• getUint parses into a uint64 then casts to uint without checking for overflow. On 32-bit platforms (or with very large env values), this can wrap/truncate and potentially produce an invalid buffer/batch size downstream. Consider adding a platform-size overflow guard before converting.

	u, err := strconv.ParseUint(s, 10, 64)
	if err != nil {
		return 0, err
	}
	return uint(u), nil

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

pkg/loop/config.go:609

• CL_CHIP_INGRESS_MAX_CONCURRENT_SENDS is parsed via getInt but negative values are currently accepted. A negative value will later panic when used to size the semaphore channel in batch.WithMaxConcurrentSends. Please reject negative values during env parsing (0 can remain the sentinel for "use defaults").

			return fmt.Errorf("failed to parse %s: %w", envChipIngressDurableEmitterEnabled, err)
		}
		e.ChipIngressBufferSize, err = getUint(envChipIngressBufferSize)
		if err != nil {

pkg/loop/config.go:746

• getUint currently allows values up to the full uint range (e.g., 2^64-1 on 64-bit), but downstream these chip-ingress sizes are cast to int when wiring the batch client. Values larger than MaxInt will overflow to negative and can cause panics when used as channel capacities. Consider bounding parsed values to MaxInt and returning an error when exceeded.

	s := os.Getenv(envKey)
	if s == "" {
		return 0, nil
	}
	return time.ParseDuration(s)

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

pkg/loop/config.go:619

• CL_CHIP_INGRESS_MAX_CONCURRENT_SENDS can currently be set to a negative value, which will flow into batch.WithMaxConcurrentSends and panic when it creates a channel with negative capacity. Consider rejecting negative values during env parsing (similar to the existing ChipIngressMaxGRPCRequestSize validation).

		e.ChipIngressMaxConcurrentSends, err = getInt(envChipIngressMaxConcurrentSends)
		if err != nil {
			return fmt.Errorf("failed to parse %s: %w", envChipIngressMaxConcurrentSends, err)
		}