feat(collector)!: complete the OTel AutoInstrumentation 4.0.0 cutover

[ANcpLua]

Completes the qyl side of the Qyl.OpenTelemetry.AutoInstrumentation 4.0.0 migration
(external PR ANcpLua/Qyl.OpenTelemetry.AutoInstrumentation#20, published + indexed on nuget.org).
4.0.0 removed QylInterceptedAspNetCore.Build and injects the ASP.NET Core server-span
middleware via IStartupFilter instead of a Build() interceptor.

Includes the fleet's generator-half commit (3382f960) + the consumer half:

Generator half (fleet, 3382f960)

• GeneratorPipelineHelpers: drop QylInterceptedAspNetCoreTypeName + IsOtelAutoInstrumentationReferenced
• ServiceDefaultsSourceGenerator: drop the otelAutoInstrumentationAvailable stage + the QYL0138 fail-fast → emit plain builder.Build()
• AnalyzerReleases.Unshipped.md: drop the QYL0138 row (RS2002)

Consumer half (this)

• Directory.Packages.props: pin 3.1.2 → 4.0.0
• qyl.collector.csproj: drop the QylAutoInstrumentationInterceptWebApplicationBuilderBuild opt-out knob (the OTel generator no longer intercepts Build(), so there's nothing to yield)
• Program.cs: builder.Services.AddQylAspNetCoreInstrumentation() — restores the server-request span the removed Build() interceptor used to wire

Verification

dotnet build services/qyl.collector -c Release → 0 warnings / 0 errors against published 4.0.0. ServiceDefaults owns Build() alone now → no CS9153.

⚠️ Orthogonal CI blocker

CI's collector build will red-fail on NU1903 — a live advisory on transitive Microsoft.OpenApi 2.0.0 (via Microsoft.AspNetCore.OpenApi, a framework dep). It's unrelated to this change (4.0.0 has no OpenApi dependency) and fails any collector build repo-wide until deps are refreshed. Verified clean with the audit isolated.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: cdf609c7-3655-4e8e-81a0-207e810d5dc5

📥 Commits

Reviewing files that changed from the base of the PR and between ec44751 and 2f92eb4.

📒 Files selected for processing (1)

• Directory.Packages.props

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: Backend (.NET)
• GitHub Check: Dependency Audit

🧰 Additional context used

📓 Path-based instructions (4)

**/*.{cs,csx,csproj,props}

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

.NET code must have nullable enabled.

Files:

• Directory.Packages.props

**/Directory.Packages.props

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Use central package management via Directory.Packages.props.

Files:

• Directory.Packages.props

**

⚙️ CodeRabbit configuration file

AGENTS.md

**:

10.0.9
10.7.0
10.7.0
1.16.0
1.15.1
1.5.3
3.35.1
2.80.0
2.81.1

2.2.29
1.11.0

<!-- MAF (Microsoft.Agents.AI.*) — mirrors SDK truth; inlined so the repo builds with or without the sibling SDK checkout. -->
<MicrosoftAgentsAIVersion>1.11.0</MicrosoftAgentsAIVersion>
<MicrosoftAgentsAIHostingVersion>1.11.0-preview.260623.1</MicrosoftAgentsAIHostingVersion>

<NukeVersion>10.1.0</NukeVersion>
<SpectreConsoleVersion>0.57.0</SpectreConsoleVersion>
<VersionizeVersion>2.5.0</VersionizeVersion>

**:

<Import Project="$(MSBuildThisFileDirectory)../framework/ANcpLua.NET.Sdk/src/Build/Common/Version.props"
...

Files:

• Directory.Packages.props

**/*.props

⚙️ CodeRabbit configuration file

MSBuild property files (Directory.Build.props, Directory.Packages.props, Version.props). Review for: Central Package Management correctness, version consistency, and that new packages are added with explicit version pins. Flag transitive dependency promotions that aren't justified. Verify TFM targeting is correct (.NET 10).

Files:

• Directory.Packages.props

🔇 Additional comments (2)

Directory.Packages.props (2)

45-48: LGTM! Confirmed 2.7.5 is the first patched 2.x release for GHSA-v5pm-xwqc-g5wc.

---

81-81: LGTM! Explicit version pin, consistent with central package management.

---

Summary by CodeRabbit

• Chores
  • Updated bundled NuGet package versions, including adding a transitive security override for Microsoft.OpenApi and upgrading OpenTelemetry auto-instrumentation to a newer major release.

Walkthrough

Central package management was updated in Directory.Packages.props to add a Microsoft.OpenApi override at 2.7.5 and bump Qyl.OpenTelemetry.AutoInstrumentation from 3.1.2 to 4.0.0.

Changes

Central package updates

Layer / File(s)	Summary
OpenApi override Directory.Packages.props	Adds a centralized Microsoft.OpenApi version override to 2.7.5 with a comment.
AutoInstrumentation bump Directory.Packages.props	Updates Qyl.OpenTelemetry.AutoInstrumentation from 3.1.2 to 4.0.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• ANcpLua/Paperless#2: Also changes Directory.Packages.props for centralized NuGet version management.
• ANcpLua/Qyl.OpenTelemetry.AutoInstrumentation#17: Likely related to the Qyl.OpenTelemetry.AutoInstrumentation version bump in this PR.

Suggested labels: area:infra, breaking

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Title check	❌ Error	The title matches the change, but the scope collector is not one of the allowed scopes.	Use an allowed conventional-commit scope such as infra and keep the title concise.

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly describes the OTel 4.0.0 migration and related collector changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Otel Instrumentation Required	✅ Passed	No new local DI-registered service class was introduced; the only DI hook is external instrumentation, and collector telemetry already uses QylTelemetry ActivitySource/Meter.
No Unbounded Mcp Responses	✅ Passed	No src/qyl.mcp tree exists in this repo, and the diff shows no MCP tool-definition changes.
Duckdb Backpressure On Write Paths	✅ Passed	No new DuckDB write path is added; the diff only touches package versions and instrumentation wiring, not storage code.
Cancellationtoken Threading	✅ Passed	No C# files were changed under src/**, so this PR adds no public async methods in the checked scope.

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Completes the in-repo portion of the migration to Qyl.OpenTelemetry.AutoInstrumentation 4.0.0, removing the previous WebApplicationBuilder.Build() interception composition point and explicitly registering the ASP.NET Core server-span middleware via DI.

Changes:

• Bumps Qyl.OpenTelemetry.AutoInstrumentation from 3.1.2 to 4.0.0 in central package management.
• Removes the collector opt-out property that previously prevented Build() interceptor collisions (CS9153).
• Updates the ServiceDefaults source generator to emit a plain builder.Build() interceptor and drops the QYL0138 fail-fast path that required the OTel package.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
Directory.Packages.props	Pins Qyl.OpenTelemetry.AutoInstrumentation to 4.0.0.
services/qyl.collector/qyl.collector.csproj	Removes the now-obsolete Build() interception opt-out property.
services/qyl.collector/Program.cs	Explicitly registers AddQylAspNetCoreInstrumentation() for server-request spans.
internal/qyl.instrumentation.generators/ServiceDefaultsSourceGenerator.cs	Removes QYL0138 enforcement and emits builder.Build() directly.
internal/qyl.instrumentation.generators/GeneratorPipelineHelpers.cs	Deletes OTel-reference detection helpers no longer used by the generator pipeline.
internal/qyl.instrumentation.generators/AnalyzerReleases/AnalyzerReleases.Unshipped.md	Removes the unshipped QYL0138 entry.