feat: bootstrap and runtime_context

[LucasAlvesSoares]

Description

Introduces sap_cloud_sdk.core.runtime_context — a provider-agnostic runtime context system that lets SDK modules (auditlog, telemetry, and future modules) read caller-identity information (tenant, user, trigger type) without coupling to a specific auth provider or HTTP framework.

Key design decisions:

• RuntimeContext is an immutable typed bag keyed by ContextKey[T] instances — no fixed fields, fully extensible by any module defining its own keys.
• ContextProvider protocol separates extraction logic (IAS JWT, SAP headers) from framework concerns.
• RequestEnvelope is a framework-agnostic carrier (headers, body, metadata) that providers read from — they never touch Starlette, Flask, or gRPC types directly.
• FrameworkAdapter registry decouples bootstrap() from framework-specific code — new frameworks are added by registering an adapter, never by editing bootstrap.
• bootstrap(app) is the single user-facing entry point, exposed at sap_cloud_sdk.bootstrap.

Built-in providers: IASContextProvider (IAS JWT → tenant/user) and HeaderContextProvider (x-sap-origin → trigger type).
Built-in adapter: Starlette/FastAPI.

Type of Change

• New feature (non-breaking change that adds functionality)

How to Test

uv run pytest tests/core/unit/runtime_context/

1. Bootstrap the SDK in a Starlette/FastAPI app:

   from sap_cloud_sdk import bootstrap
   bootstrap(app)

2. On an authenticated request, read context from any module:

   from sap_cloud_sdk.core.runtime_context import get_context, TENANT_ID, USER_ID
   ctx = get_context()
   assert ctx.get(TENANT_ID) is not None

3. With no Authorization header, get_context() returns an empty RuntimeContext and all keys return None.

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

Additional Notes

• sdk_context, async_sdk_context, and set_context are intentionally not exported from the public API — they are internal utilities used by framework middleware.
• The FrameworkAdapter registry and ContextProvider protocol are both exported for third-party extensibility.
• Future work: bootstrap will absorb auto_instrument() once the app-level-instrumentation branch lands, making it the single SDK setup call.

[NicoleMGomes]

Great work!

[tiagoek]

SDK Module Review

Check	Status	Findings
bdd	✅ PASS	0
binding-shape	✅ PASS	0
commits	✅ PASS	0
concurrency	✅ PASS	0
constants	✅ PASS	0
deletion-hygiene	✅ PASS	0
deps-supply	✅ PASS	0
disclosure	✅ PASS	0
docs	✅ PASS	0
errors-logging	✅ PASS	0
hardcode	✅ PASS	0
http-hygiene	✅ PASS	0
license-spdx	✅ PASS	0
pr-size	✅ PASS	0
quality-gate-parity	✅ PASS	0
secrets	✅ PASS	0
telemetry	✅ PASS	0
testing-depth	✅ PASS	0
versioning	✅ PASS	0

0 finding(s): 0 posted as inline comment(s) on the affected lines, 0 not tied to a code line (listed above).

---

Generated by sdk-review-skill · v1