feat(observability): join HTTP receipts with OCSF records

.agents/skills/helm-dev-environment/SKILL.md

@@ -266,8 +266,9 @@ task running while using those endpoints.
 ### Viewing local traces
 
 The gateway exports OTLP/gRPC to
-`http://openshell-collector.observability.svc.cluster.local:4317` through the
-default Skaffold values. Forward OTLP/gRPC and the trace UI to the host:
+`http://openshell-collector.observability.svc.cluster.local:4317` through
+`ci/values-local-tracing.yaml`, which only `skaffold.yaml` layers. The Kubernetes
+E2E wrapper omits it, so E2E clusters export no traces. Forward OTLP/gRPC and the trace UI to the host:
 
 ```bash
 mise run helm:k3s:forward
@@ -278,9 +279,10 @@ Kubernetes compute-driver spans under their distinct service names, along with
 Agent Sandbox controller reconciliation spans linked through the Sandbox
 trace-context annotation. The same command exposes OTLP/gRPC on
 `http://127.0.0.1:4317` and, when deployed, the Kubernetes gateway on
-`http://127.0.0.1:8090`. The local `gateway:docker`, `gateway:podman`, and
-`gateway:vm` tasks detect the collector listener at startup and enable trace
-export, OCSF log export, and the agent trace relay only while it is reachable.
+`http://127.0.0.1:8090`. The local `gateway`, `gateway:docker`,
+`gateway:podman`, and `gateway:vm` tasks enable trace export, OCSF log export,
+and the agent trace relay only when `OPENSHELL_DEV_OTLP_ENDPOINT` is set, for
+example `OPENSHELL_DEV_OTLP_ENDPOINT=http://127.0.0.1:4317`.
 Spans an agent exports from inside a sandbox arrive through the supervisor's
 relay with `openshell.telemetry.source=agent` and share `openshell.sandbox.id`
 with that sandbox's supervisor spans.
@@ -642,6 +644,7 @@ for dependencies still declared in `Chart.yaml`.
 | `deploy/helm/openshell/skaffold.yaml` | Skaffold config — images, Helm releases, values overlays |
 | `deploy/helm/openshell/values.yaml` | Default Helm values |
 | `deploy/helm/openshell/ci/values-skaffold.yaml` | Dev overrides (image pull policy, TLS disabled for local Skaffold) |
+| `deploy/helm/openshell/ci/values-local-tracing.yaml` | OTLP export to the `helm:k3s:create` collector (Skaffold only) |
 | `deploy/helm/openshell/ci/values-cert-manager.yaml` | cert-manager PKI overlay (opt-in; disables pkiInitJob) |
 | `deploy/helm/openshell/ci/values-gateway.yaml` | Envoy Gateway GRPCRoute + Gateway overlay |
 | `deploy/helm/openshell/ci/values-high-availability.yaml` | HA test overlay (`replicaCount: 2` with external PostgreSQL Secret) |

.agents/skills/release-captain/SKILL.md

@@ -169,8 +169,7 @@ git worktree remove --force "$wt"
    ```
 
 4. **Watch and verify.** Check that `Select Qualified Prerelease` names the
-   approved candidate, the GitHub Release has assets, no job failed, and the
-   wheel reached PyPI:
+   approved candidate, the GitHub Release has assets and no job failed:
 
    ```shell
    gh run watch <run-id> --exit-status

.agents/skills/release-openshell/SKILL.md

@@ -33,8 +33,8 @@ Release creates `vX.Y.Z` at that exact commit, then rebuilds and publishes all
 stable artifacts without rerunning qualification. Embedded versions change, so
 stable artifacts are not byte-identical to the qualified prerelease. An existing
 stable tag may be retried only if it already points to the selected commit. A retry
-publishes only missing artifacts; published images, charts, release assets, npm,
-and PyPI versions are kept, while the snap is uploaded again.
+publishes only missing artifacts; published images, charts, release assets, and
+npm versions are kept, while the snap is uploaded again.
 Stable images are saved as OCI archives during the build and pushed under the
 stable version tags during publication. Their SBOMs are verified before updating
 `latest`; the qualified prerelease's commit-SHA image tags remain unchanged.
@@ -84,17 +84,6 @@ immutable version and advance latest only for a newer version.
 
 Watch the stable release run and report its result.
 
-## PyPI publishing
+## Python SDK
 
-Stable releases publish the Python wheel to PyPI from `wheel-publish.yml`, which the `publish-pypi` job in `release-publish.yml` calls after the GitHub Release is created. The workflow downloads the wheel from the stable GitHub Release, not a run's build artifact, and checks the stable tag's source commit and the wheel's release checksum. It uses Trusted Publishing with the `pypi` GitHub environment. PyPI matches the workflow file that contains the publishing job, so configure the `openshell` PyPI project's GitHub publisher with owner `NVIDIA`, repository `OpenShell`, workflow `wheel-publish.yml`, and environment `pypi`. No PyPI API token or GitLab trigger credentials are required.
-
-The environment must allow the branch used to dispatch Release or `wheel-publish.yml`. For a support release, explicitly allow its support branch before dispatching. Required reviewers, if configured, must approve the PyPI job. An existing wheel on PyPI is skipped; PyPI does not allow replacing a published wheel.
-
-If a stable release did not reach PyPI, publish the wheel without rerunning Release:
-
-```shell
-gh workflow run wheel-publish.yml -R NVIDIA/OpenShell --ref main \
-  -f release-tag=vX.Y.Z -f source-sha=<tag commit> -f python-version=X.Y.Z
-```
-
-Development and prerelease wheels remain GitHub Release assets and do not publish to PyPI.
+Core no longer builds or publishes the Python SDK for releases. The stable, prerelease, and rolling `dev` GitHub Releases carry no wheel, and nothing in core publishes to PyPI. `openshell` `0.1.7` is the last core-built wheel. From `0.1.8` on, [ai-openshell/sdk-python](https://github.com/ai-openshell/sdk-python) publishes `openshell` on the same day as each stable core release, once its update PR for the core tag merges.

.github/workflows/branch-checks.yml

@@ -598,6 +598,9 @@ jobs:
       - name: Test
         run: mise run test:python
 
+      - name: Test Python scripts
+        run: mise run test:python-scripts
+
       - name: Test local gateway configuration helpers
         run: |
           bash tasks/scripts/test-gateway-pull-policy.sh
@@ -638,6 +641,41 @@ jobs:
           echo "$changed"
           exit 1
 
+  python-sdk-freeze:
+    # The Python SDK moved to ai-openshell/sdk-python (#5287), which imported it
+    # at v0.1.7. Its files stay only until core removes them, so PRs must not
+    # add or change them. Deleting files is allowed (the removal PR). The paths
+    # are the ones the import moved: all of python/ plus the two SDK build
+    # scripts. The shared root pyproject.toml and uv.lock stay editable.
+    # Merge queue runs skip this job; the PR already passed it on its mirror.
+    name: Python SDK Freeze
+    needs: pr_metadata
+    if: needs.pr_metadata.outputs.should_run == 'true' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Reject changes to the Python SDK
+        env:
+          BASE_SHA: ${{ needs.pr_metadata.outputs.base_sha }}
+        run: |
+          set -euo pipefail
+          changed=$(git diff --name-only --diff-filter=d "${BASE_SHA}...HEAD" -- \
+            python \
+            tasks/scripts/generate_python_proto.py)
+          if [ -z "$changed" ]; then
+            echo "No added or changed Python SDK files."
+            exit 0
+          fi
+          echo "::error title=Python SDK moved::The Python SDK moved to https://github.com/ai-openshell/sdk-python. Drop the Python SDK changes from this PR and open SDK changes there. Regenerated bindings are not needed here; sdk-python regenerates them from core releases."
+          echo "Changed Python SDK files:"
+          echo "$changed"
+          exit 1
+
   markdown:
     name: Markdown
     needs: pr_metadata
@@ -687,3 +725,19 @@ jobs:
         run: |
           OPENSHELL_NPM_VERSION="$(uv run python tasks/scripts/release.py get-version --npm)" \
             mise run sdk:ts:publish
+
+  install-script:
+    name: install.sh
+    needs: pr_metadata
+    if: needs.pr_metadata.outputs.should_run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # The RPM lookup test uses gawk when present; gawk warns on bad escapes.
+      - name: Install gawk
+        run: sudo apt-get install -y --no-install-recommends gawk
+
+      - name: Test install.sh
+        run: tasks/scripts/test-install-sh.sh