feat(otel): export AOP agent signals with GenAI lifecycle semantics

[M09Ic]

Configuring an OTLP endpoint for a normal Cyber Agent execution exports Agent lifecycle, reported model usage and execution activity as traces, structured logs and metrics. One Collector sends all three signals to SigNoz and the same traces to Phoenix.

The AOP projection previously could mark a completed model response as canceled during tool execution, replace a parent tool's call context with a nested command/process, and leave orphan scopes active until extension shutdown. This change fixes those boundaries and pins a coherent GenAI semantic dialect.

Implementation

• Consume existing AOP facts in exts/otel; Agent/tool producers and AOP protobuf definitions keep their existing contracts. Independent SDKs share Resource attributes, with logs/metrics recorded before trace sampling.
• Align Agent, model and tool spans with GenAI v1.41.0 (invoke_agent, chat, execute_tool) and retain OpenInference compatibility. Record provider dialect, conversation/known Agent identity, finite terminal error.type, instrumentation version and semantic version. Omit response model when only a request alias is known. Keep framework-specific JEV purpose names and custom evaluate operation documented; unknown JEV providers/models are not borrowed from the main Agent.
• Represent automatic retries as one logical model span. Token and duration histograms describe the same operation, use recommended buckets and required labels, preserve partial/missing usage, and exclude compilation summaries from standard token accounting. Remove synthetic retry-accounting spans and name-based scope classification.
• End model spans at observed assistant responses without including delayed tool execution; discarded streamed responses reset completion/output. Tool failures and recovered errors retain their actual ownership. Associate tools with their source model by the exact assistant tool-call ID; nested commands/processes cannot overwrite a delegated Agent's parent tool.
• Close a Session's orphan Turn/scopes immediately at SessionEnded, prevent late-event resurrection, and keep separate background Agent Sessions independent. Own one-shot SDK shutdown so caller timeout can be followed by another Close wait; completed exporter timeouts retain diagnostics without misreporting live resources.
• Respect global/signal-specific OTLP endpoint and protocol precedence, preserve complete signal URL paths and allow any signal independently. Support http/protobuf explicitly; other configured protocols fail validation. Reuse SDK resource/header/TLS/sampling settings.
• Enable existing tools/commands/processes observers when the CLI enables any OTel signal without an explicit observer selection. Preserve tool/process execution failures and process completion ordering.
• Include pinned local SigNoz/Phoenix deployment configuration, reusable normal-CLI instructions and documented lifecycle, accounting, content and coverage boundaries.

Content capture defaults to off. Bounded correlation and subscription queues, asynchronous export errors and observed subscription drops are part of the extension lifecycle; no global provider mutation or OTel-specific AOP hooks are required.

Validation

Validated against this PR's production source:

• go build -mod=readonly ./...; also built with the original committed checksum manifest. Clean-checkout go mod tidy identified deterministic checksum bookkeeping required by CI, which is included without local test files or dependency version changes. The AOP submodule remains tidy.
• Repository architecture, resource/extension lifecycle, registry, extension composition and minimal Agent tests passed in the clean checkout.
• Focused OTel/CLI tests supplied through a local Go overlay; no new test files are committed. Regressions cover exact model/tool causality, nested delegation parents, immediate Session cleanup and late facts, recovered errors/cancellation, logical retries/discarded streams, partial/all-missing usage, OTLP wire kinds/attributes/buckets/error labels, endpoint/protocol precedence, each CLI signal alone, sampling independence and Close ownership.
• Race tests for OTel, observe and terminal; vet for OTel, observe, terminal and CLI.
• OTel/CLI tests with emptytemplates forceposix full netgo noembed osusergo sqlite build tags; whitespace checks.
• Dual-backend AOP/lifecycle replay: 7 traces, 23 spans, 210 tokens; SigNoz 113 logs and 15 metric instruments / 99 series. Mechanism mappings, native SigNoz links/Phoenix source attributes, histogram sums/counts and active counts agree.
• Real StandardLoop/Session/tools/processes with an HTTP/SSE fixture: 7 spans, 2 model calls, 250 tokens, one intentional tool failure; SigNoz 39 logs and 14 instruments / 42 series. Both backends agree.
• Newly built normal cmd/aiscan against a real model gateway (gpt-6-sol), using ordinary OTel environment configuration without a recording exporter: 10 model calls, 10 tools (4 failures), 114,242 tokens, 29 spans in each backend and 158 SigNoz logs. Canonical JSONL, CLI usage, trace/metric tokens, 98 nonstreaming AOP fact logs and execution parents/failures agree; the task succeeds after recovery and all active counts return to zero.
• Independently accepted the Agent-generated Python analyzer/self-tests/report: historical input was correctly counted as 138,297 tokens, 22 requests, 28 calls/results and 2 failed tools. That historical input is separate from this run's model consumption.

Only production implementation, dependency checksums, reusable deployment configuration and documentation are included. New tests, acceptance fixtures/scripts, credentials, binaries, screenshots and temporary artifacts remain local. Checksum updates were reproduced in a clean checkout without local test files.

Boundaries

GenAI v1.41.0 is the selected complete dialect, not a claim of latest/all-field coverage. Provider identity is the configured client dialect and remains static for the extension's lifetime. StandardLoop publishes usage after tool results, and startup/recap auxiliary usage remains incomplete. Exact per-attempt usage, full effective requests, response metadata, first-token timing and cross-process W3C propagation need more source facts. Complex mechanisms are covered by replay; this real-model acceptance covers the ordinary Agent/tool path. Phoenix receives traces; logs and metrics are accepted in SigNoz. Log SDK internal queue drops, production dashboards, billing and alert rules remain documented follow-ups.

Refs #175.