[JacobStephens2]

Summary

Send ended Session spans live when the User config sets otlp.endpoint; blank remains the default. Setup and the manual document it.

ended span
  write local Session trace
  owning Command permits export + endpoint set
    bounded queue → OTLP/HTTP JSON
    request timeout: 150 ms; Session shutdown wait: ≤200 ms
  Security run, including nested Runs: keep local

Closes #992

Evidence

• Before: cargo test --test otlp_endpoint ended_spans_arrive_before_the_session_finishes -- --exact failed with unknown section [otlp].
  After: all four cargo test --test otlp_endpoint tests pass: live tool delivery before Session completion, final Session delivery, failed sends, stalled receiver, and Setup defaults/preservation.
• cargo test --test security_run otlp_never_receives_a_security_runs_sessions_or_nested_ticket_runs -- --exact passes for both a Security fix Run and nested Spec/Ticket Runs, with zero exported spans and local traces retained.
• cargo check --all-targets, cargo clippy --all-targets -- -D warnings, config tests (32), and Setup tests (50) pass.
• Both existing Setup section inventories now include [otlp]; cargo test --test setup passes all 30 integration tests.
• Final validation: scripts/affected-tests 7ded7631491eb4400986449c2aadb3416c3ba3a1 passed all 36 site tests locally. The full Rust suite and clippy passed in CI on the exact final head, 29f8af2; the Linux job took 12m 28s including setup, compilation, linting and tests. Per docs/testing.md, that result replaces the duplicate local Rust run, which was stopped after CI passed.
• Console/site browser CI and the Linux/macOS release builds also pass.

Test seams

• The thirdshift binary, exercised through Scenario with User config and a local OTLP/HTTP receiver: live ended spans, failed/slow delivery, and Security run privacy including child Runs.
• thirdshift setup and its written User config: blank endpoint default and preservation of an existing endpoint.

Review coverage

Independent thirdshift-code-review Standards and Spec reviews used issue-700 at 7ded7631491eb4400986449c2aadb3416c3ba3a1 as their fixed point. Both read all 12 changed files, including generated site/docs/index.html and one coverage follow-up on tests/setup.rs at 29f8af2. Standards: 0 findings. Spec: 0 findings.

Unread changed files: none under either axis. Generated-output exclusions: none.

Unaddressed findings

Standards

None.

Spec

None.

Merge Danger

Door: two-way

Blast Radius: Sessions

Opting in sends Session span content to the configured receiver. Failed or saturated delivery can drop live spans; local traces remain available. Security run sessions stay local.

Built with codex · gpt-6.1-sol · xhigh