Collector: keep the Codex launch tag and call_id behind shape guards for the #381 join (U7) - #491

Codex exports the per-launch tag (-c otel.environment=<tag>) as the logs
resource attribute env, and it pairs codex.tool_decision with
codex.tool_result by call_id. transform/privacy dropped both, so Codex
records could be joined only by conversation.id.

- transform/privacy resource context: delete env unless it matches
  ^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$, then keep it.
- transform/tool_names final group: the same shape guard for call_id.
- transform/privacy log allowlist: keep call_id right after
  tool_use_id. This leaves the SDK-receipt deny list and the allowlist
  tail unchanged.
- The metric resource allowlist is unchanged, so env and call_id stay
  off metrics.

Sources: openai/codex rust-v0.157.1 (36650394)
codex-rs/otel/src/provider.rs:53,381, codex-rs/otel/src/tool_result.rs:61,
codex-rs/otel/src/events/session_telemetry.rs:1112,1121; the
opentelemetry-collector-contrib v0.161.0 pkg/ottl/ottlfuncs/README.md
(delete_key, IsMatch, keep_keys).

otelcol-contrib 0.161.0 validate exits 0. A negative control with an
unknown OTTL function exits 1. The five collector-reading test modules
pass: Ran 127 tests, OK, 0 skipped.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

This documents the collector change and corrects the host procedure in
observability/collector/README.md.

- Add a dated section, "Codex launch tag and call id — 2026-09-29". It
  names the native sources, the four touched statements, the guard
  pattern, the LogQL joins and the validation.
- The section's limits cover four points:
  - host application is still pending;
  - no real launch has been observed;
  - a call that is hook-blocked, whose hook-rewritten input fails, that
    has a nested code-mode payload error or that is cancelled before
    dispatch logs neither codex.tool_result nor codex.tool_decision, so
    Loki counts can be lower than rollout function calls;
  - env and call_id appear in the local Grafana log details.
- Replace the host note that installed the repository file verbatim.
  The new procedure diffs the host's statements, patches only the
  touched ones, validates, restarts outside measured windows and reads
  back the order. It no longer implies that the host equals the
  repository.
- Keep the dated 2026-09-27 clarification, and point its outstanding
  Codex item to the new section.

Sources: openai/codex rust-v0.157.1 (36650394)
codex-rs/core/src/tools/registry.rs:598-612,619-634,667-682,
codex-rs/core/src/tools/code_mode/mod.rs:363-379,
codex-rs/core/src/tools/code_mode/delegate.rs:323,335-337,
codex-rs/core/src/tools/orchestrator.rs:196-198,
codex-rs/otel/src/metrics/client.rs:46,345; Loki v3.7.x
send-data/otel (non-index resource attributes are stored on each entry).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The PyYAML-free test_codex_launch_tag_and_call_id_are_kept checked only
the env guard. The call_id guard was covered only by PyYAML-gated tests,
so the collector README's always-on claim overstated coverage (verifier
finding on 76c97846).

The test now requires the exact call_id guard statement in the last
transform/tool_names log group, and requires that group to have no
conditions. Transform processor conditions are ORed where clauses that
gate their whole statement group (opentelemetry-collector-contrib
v0.161.0, processor/transformprocessor/README.md:164), so a guard in a
conditioned group would leave call_id on other events unchecked. Call ids
come from openai/codex rust-v0.157.1 codex-rs/otel/src/tool_result.rs:61
and codex-rs/otel/src/events/session_telemetry.rs:1112,1121.

Scratch mutation controls with system python3 (no PyYAML): removing the
guard, conditioning its group or widening its pattern to {0,255} each
fails the extended test and passes the previous one. The README now names
both guards and where each must sit.

Review findings F1, F3, F6, F7, F9 and F10 concern the token-adoption
E2E amendment, outside this PR's files; the u7 handoff records them as
Amendment 4 inputs.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

The cross-family review of this branch sent an ecosystem.sdk_receipt record that
carries a call_id through the committed pipeline (native file receiver). The shared
privacy allowlist now admits call_id for Codex records, and the SDK-receipt deny
list did not remove it, so the receipt exported it. The native Loki test gains a
third resource shaped like the receipts pipeline (codex-sdk-receipt) with a
call_id; it must reach Loki and the event file without one.

At the base collector it fails for the right reason: "SDK receipts without a call
id" reads 0 where 1 is expected.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

The shared privacy allowlist admits call_id for Codex records. An SDK receipt file
is ingested through the same allowlist, and its deny list (the names a receipt
cannot supply) did not include call_id, so a receipt carrying one exported it.
Found by the cross-family review of this branch by sending a receipt with a
call_id through the native file-receiver pipeline.

The deny regex gains call_id. The structural test now states the relation: the
deny list is the allowlist tail from tool_family plus the Codex call id. The
native test from the previous commit passes: the receipt reaches Loki and the event
file without a call id, the other receipt fields are unchanged, and Codex records
keep theirs. The README sentence about receipts names call_id.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

Re-registers the four collector files this branch changes (collector.yaml, its
README and the two observability test modules) on top of main's manifest, as the
hot-file protocol in docs/lanes.md asks. scripts/validate.py passes.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>