fix(telemetry): preserve controls and share request attribution

[mldangelo-oai]

Summary

Request attribution was duplicated or lost across helper processes, and usage could look complete when worker measurements were missing. Share request context across the existing request paths and preserve accurate usage completeness through retries.

Changes

• Add GitHub Action integration, configured provider, scan mode, and Deep worker role attribution while preserving caller metadata and literal dotted keys.
• Preserve selected-profile analytics settings and OpenTelemetry configuration in scan patches and fresh/resumed Deep workers.
• Keep missing usage distinct from measured zero, retain retry thread associations, preserve unpriced token totals, and enforce budgets against measured subtotals.
• Attribute connected-app publication requests and identify embedding requests with the package User-Agent.

Testing

• Full SDK suites with seeds 12345 and 4027216356: each reported 4,918 passed, 65 skipped, and 11 authentication failures. All 11 reproduce on the base commit and are caused by an existing Git marker around the temporary checkout. The entire 128-test authentication file passes from a clean Git working directory in both orders.
• Focused SDK/CLI, worker launch, publication, embeddings, usage, and migration regression tests passed.
• Python usage tests: 87 passed, 2 platform skips. A native control-session probe and independent persistence QA covered repeated completion, missing worker rollouts, and resumed coordinators.
• GitHub Action: 153 tests, typecheck, metadata/docs checks, build, and generated bundle check passed.
• Eight local-only native wire probes passed with synthetic credentials: custom Responses and Bedrock providers, analytics on/off, explicit OTel exporters on/off, dotted metadata, and ambient metadata preservation.
• Ruff lint/format, SDK build/types/format, and portable plugin source checks passed.
• Three independent native code reviews and separate verification passed with no actionable findings.

Risk and rollout

No new CLI flags, Action inputs, telemetry collectors, or export destinations. The Action retains analytics.enabled=false; request attribution remains separate from native analytics and explicitly configured OTel exporters. Provider tags describe wrapper configuration; native managed-provider overrides can select a different backend. Attribution does not establish OpenAI-side reporting for other providers.

Migration 50 adds a local worker-thread registry, backfills known associations, and retains them until the scan is deleted.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T03:38:13.498669Z	90f2eaf	PR opened
🔒 Security Review	✅ Completed 2026-10-17T03:39:49.014259Z	90f2eaf	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.