feat(dcode): add backend-neutral OTLP observability

agents/langchain-deepagents-code/Dockerfile

@@ -24,19 +24,23 @@ COPY agents/langchain-deepagents-code/generate-config.ts /opt/nemoclaw-deepagent
 COPY agents/langchain-deepagents-code/managed-dcode-runtime.py /opt/nemoclaw-deepagents-code/managed-dcode-runtime.py
 COPY agents/langchain-deepagents-code/patch-managed-deepagents-code.py /opt/nemoclaw-deepagents-code/patch-managed-deepagents-code.py
 COPY agents/langchain-deepagents-code/progressive_tool_disclosure.py /opt/nemoclaw-deepagents-code/progressive_tool_disclosure.py
+COPY agents/langchain-deepagents-code/nemoclaw_observability.py /opt/nemoclaw-deepagents-code/nemoclaw_observability.py
 COPY agents/langchain-deepagents-code/validate-progressive-tool-disclosure.py /opt/nemoclaw-deepagents-code/validate-progressive-tool-disclosure.py
+COPY agents/langchain-deepagents-code/validate-observability.py /opt/nemoclaw-deepagents-code/validate-observability.py
 COPY agents/langchain-deepagents-code/dcode-wrapper.sh /usr/local/lib/nemoclaw/dcode-wrapper.sh
 COPY agents/langchain-deepagents-code/dcode-launcher.sh /usr/local/lib/nemoclaw/dcode-launcher.sh
 COPY agents/langchain-deepagents-code/start.sh /usr/local/bin/nemoclaw-start
 COPY nemoclaw-blueprint/ /opt/nemoclaw-blueprint/
-RUN chmod 444 /opt/nemoclaw-deepagents-code/generate-config.ts /opt/nemoclaw-deepagents-code/managed-dcode-runtime.py /opt/nemoclaw-deepagents-code/patch-managed-deepagents-code.py /opt/nemoclaw-deepagents-code/progressive_tool_disclosure.py /opt/nemoclaw-deepagents-code/validate-progressive-tool-disclosure.py \
+RUN chmod 444 /opt/nemoclaw-deepagents-code/generate-config.ts /opt/nemoclaw-deepagents-code/managed-dcode-runtime.py /opt/nemoclaw-deepagents-code/patch-managed-deepagents-code.py /opt/nemoclaw-deepagents-code/progressive_tool_disclosure.py /opt/nemoclaw-deepagents-code/nemoclaw_observability.py /opt/nemoclaw-deepagents-code/validate-progressive-tool-disclosure.py /opt/nemoclaw-deepagents-code/validate-observability.py \
     && chmod 755 /usr/local/bin/nemoclaw-start /usr/local/lib/nemoclaw/dcode-wrapper.sh /usr/local/lib/nemoclaw/dcode-launcher.sh \
     && chmod -R a+rX /opt/nemoclaw-blueprint \
     && python3 /opt/nemoclaw-deepagents-code/patch-managed-deepagents-code.py \
     && install -d -m 0700 /tmp/nemoclaw-progressive-validation \
     && TMPDIR=/tmp/nemoclaw-progressive-validation python3 /opt/nemoclaw-deepagents-code/validate-progressive-tool-disclosure.py \
     && rm -rf /tmp/nemoclaw-progressive-validation \
+    && /opt/venv/bin/python3 -I /opt/nemoclaw-deepagents-code/validate-observability.py \
     && rm -f /opt/nemoclaw-deepagents-code/validate-progressive-tool-disclosure.py \
+    && rm -f /opt/nemoclaw-deepagents-code/validate-observability.py \
     && rm -f /usr/local/bin/dcode /usr/local/bin/deepagents-code /opt/venv/bin/dcode /opt/venv/bin/deepagents-code \
     && install -m 0755 /usr/local/lib/nemoclaw/dcode-launcher.sh /usr/local/bin/dcode \
     && install -m 0755 /usr/local/lib/nemoclaw/dcode-launcher.sh /usr/local/bin/dcode.real \

agents/langchain-deepagents-code/dcode-launcher.sh

@@ -8,9 +8,26 @@ set -euo pipefail
 unset BASH_ENV ENV
 
 readonly MANAGED_DCODE_WRAPPER="/usr/local/lib/nemoclaw/dcode-wrapper.sh"
+readonly MANAGED_OBSERVABILITY_MARKER="/tmp/nemoclaw-observability-enabled"
 export HOME=/sandbox
 export PATH="/usr/local/bin:/opt/venv/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin"
 
+# Invalid state: raw OpenShell exec processes do not inherit the sandbox
+# entrypoint's environment, so an opted-in direct dcode exec can lose tracing.
+# Source boundary: start.sh materializes only the credential-free enable bit;
+# this launcher recovers it only from a regular, non-symlink marker.
+# Source-fix constraint: NemoClaw cannot make OpenShell preserve entrypoint env.
+# Regression: the proxy-launcher tests cover exact values and unsafe file types.
+# Removal condition: OpenShell propagates the bit to every exec/login process.
+# The marker is convenience state, not an authorization boundary; the
+# host-selected network policy controls whether local OTLP egress exists.
+unset NEMOCLAW_OBSERVABILITY
+if [ -f "$MANAGED_OBSERVABILITY_MARKER" ] \
+  && [ ! -L "$MANAGED_OBSERVABILITY_MARKER" ] \
+  && [ "$(<"$MANAGED_OBSERVABILITY_MARKER")" = "1" ]; then
+  export NEMOCLAW_OBSERVABILITY=1
+fi
+
 # Raw OpenShell exec processes do not inherit the entrypoint's environment or
 # source shell startup files. Rebuild the proxy-only dcode contract here so a
 # direct exec cannot retain the host seed and bypass the managed proxy for a

agents/langchain-deepagents-code/dependency-review.md

@@ -7,9 +7,9 @@ This file records the reviewed dependency baseline for the Deep Agents Code sand
 Update it whenever `requirements.lock` changes.
 
 - Lockfile: `agents/langchain-deepagents-code/requirements.lock`
-- Lockfile SHA-256: `229efec862ec10e6b128525e95c8fb8b44cdef8285a6cee78e3a7c73af780a9b`
-- Audit command: `uvx --python 3.13 pip-audit -r agents/langchain-deepagents-code/requirements.lock --progress-spinner off`
-- Audit date: 2026-07-03
+- Lockfile SHA-256: `6fde7b3188137ab5669898a552d5b12c7def2560cb4c861e8ed3563d35a5bcb9`
+- Audit command: `uv tool run --python 3.13 pip-audit -r agents/langchain-deepagents-code/requirements.lock --progress-spinner off`
+- Audit date: 2026-07-06
 - Audit result: `No known vulnerabilities found`
 
 The Dockerfile installs this lockfile with `pip3 install --require-hashes`, so this review covers the exact package versions selected for the managed image install.