feat: add explicit native trace context - #5508

Reviewed the explicit trace-context API, header validation and native propagation boundaries, queued submission capture, callback span exposure, and fresh-parent manual restore. Carriers are immutable, validated before admission, and excluded from persisted checkpoint carriers; native callback correlation remains optional. No actionable findings.

Static review only; no candidate code or tests run locally. Hosted CI: checks remain pending; no failures observed.

Reviewed the response-observation and cache-write history increment. The observation implementation and main regressions match the independently reviewed response-history change. Received facts remain distinct from aggregate accounting, unknown counters stay optional, and Python repair receipts accept the signed values supported by the history codec. No JS-style nonnegative receipt mismatch exists here.

Coordinator and independent static reviews of actual old/new file contents found no actionable issue. Hosted CI on this new head remains pending; prior-head results do not qualify it. No candidate code or local tests executed.

Approved at a3b51bd. Static re-review of the three feature-specific changed files confirms model compaction now carries the submission/session W3C trace parent through the native bridge and submit_with_trace, rather than inheriting a preceding turn override. The new regression checks overridden first turn, session-parent compaction, and subsequent ordinary turn. Existing ownership and cancellation paths are unchanged; the fourth updated file matches the base. Coordinator and independent review found no actionable issue. Hosted native CI remains pending; no candidate code or local tests ran.

Approved after coordinator and independent static re-review of the updated base integration. The production tracing feature changes remain unchanged relative to the base; instruction-file and parent-trace admission compose correctly, with explicit regression coverage for validation order. No actionable findings or new feedback. Lint and documentation checks passed; current-head Linux/macOS native checks are pending. The prior-head macOS timeout is not evidence of a passing new run; CI follow-up remains open. No candidate code or local tests ran.

Re-reviewed the base integration using exact old/new trees and overlapping source. Trace ownership remains captured through queued submission, continuation, restoration, compaction, and repair; writable-root and recovery integration preserves the existing trace contract. No new findings. Hosted native CI is pending. Coordinator and independent static review; no candidate code or local tests executed.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0730558ab5

Request changes for the existing P2 public-parent policy restoration finding, independently confirmed by static review. No duplicate inline finding added.

A session created with caller-supplied parent_trace and no ambient workflow/options can submit with trace_policy=None. submission_dispatch_span then installs context_from_w3c_trace_context unchanged. That parser invokes restore_policy, which looks up the trace/span IDs in the live local policy registry. A carrier naming a still-live local span therefore inherits its ScopePolicy, including the export-route credential; RoutedSpanProcessor consumes that credential when enqueuing the resulting span. This permits same-process reentry to borrow another workflow’s export policy. Public parent parsing must preserve W3C linkage without recovering local policy by caller-visible IDs; attach only policy owned by the new submission. Ensure downstream policy lookup cannot restore it either, and add a same-live-span/no-captured-policy regression test.

The new test-only distinction between the independent caller span and disabled child export is sound. The earlier explicit-parent overwrite finding remains fixed, but this newly confirmed issue supersedes my prior approval. Hosted CI remains pending. No candidate code or tests ran locally.

Approved at e94d3aa. The public-parent policy restoration finding is addressed: #5508 (comment). Public W3C carriers remain remote ancestry only, parser restoration is removed, and registry lookup rejects remote identities. Private policy/credentials are retained only through captured caller policy or opaque SDK handles. Explicit admission ownership, including no owner, prevents unrelated native spans from supplying policy; child callbacks retain creation/admission ownership.

Coordinator and two independent static reviews found no actionable regression. Reviewed added route-isolation, admission-ownership and waiter-cleanup tests; patch digest matches the series manifest. This approval supersedes my previous request-changes decision for this finding at older commits. It does not clear branches that have not incorporated this fix.

Fresh hosted CI is still running (native producers and Python/Rust CodeQL); follow-up remains open. No candidate code or local tests executed and no CI reruns requested.

Approved at c08a715. Coordinator and independent static re-review found no actionable issue in the policy-isolation test change. Both owners must finish admission and close their caller scopes before callbacks are released, while callbacks may run serially. Both callback-policy and exported-span assertions remain intact. Setup failures are surfaced immediately, and the finally block releases, cancels and joins outstanding tasks. Production code and the previously approved public-parent security fix are unchanged.

Fresh hosted native CI is pending. This scheduling change plausibly addresses the prior macOS timeout, but a passing hosted run is still needed; prior-head failure follow-up remains open. No candidate code or local tests executed and no CI reruns requested.

Approved at 3e98eea. Coordinator and independent static review found no actionable issue. The test initializes sessions sequentially before concurrent submissions, separating resource setup from admission-policy capture. Session.submit captures each caller policy while retaining the shared explicit parent; callback-policy and export assertions remain intact after both caller scopes close. Owner tasks are joined before the shared exit stack closes sessions and their peers. Phase diagnostics improve any subsequent admission timeout. Production tracing/security code is unchanged.

Fresh hosted native CI is pending; the previous macOS timeout is not yet verified resolved. No candidate code or local tests executed and no CI reruns requested.

Approved at 5451026. Static follow-up review with an independent reviewer found no actionable issues in the loop-loss regression change. The processor pump can select start before end is queued: shutdown then accounts for one failed delivery and the queued end can reach the next loop. If both records were selected, both are lost. The revised test checks the exact loss for either schedule, zero drops, cumulative partial status, no replay, and delivery of new events. Production code is unchanged from the previously reviewed commit.

Hosted CI is still running on this commit. The prior Linux 3.11 failure is addressed by this assertion correction, but a successful new run is still needed; the prior macOS timeout also remains unverified. No candidate code or local tests executed; no CI reruns requested.