Thinking Path

• Paperclip manages agents and their work.
• Company observability gives managed agents an optional OTLP destination.
• Native Codex saved export authentication headers in its managed configuration.
• A Product E2E persistence scan detected that credential after successful task execution.
• Codex's pinned exporter supports authentication through process environment headers.
• This change keeps the credential out of generated files while preserving authenticated export.

Linked Issues or Issue Description

Refs #16874 and #17048. This follow-up is stacked on #17048.

What Changed

• Send Codex log and trace headers through the standard OTLP environment variables.
• Leave exporter header maps empty in generated native, legacy exec and ACPX configuration.
• Forward the two controlled environment variables through both the native Codex launcher and native ACPX transport.
• Redact both encoded and decoded header values from diagnostics and preserve task-environment exclusions.
• Document credential storage and the existing provider-process access boundary.

Verification

• Eight adapter tests, 27 TypeScript runner tests and seven Rust ACPX tests passed. Adapter typecheck and runner TypeScript build passed. Rust native provider environment regression failed before the launcher fix and passed afterward. Parallel integration-test linking exhausted container memory; bounded one-worker library checks and binary builds passed.
• The actual pinned Codex 0.160.0 binary completed a synthetic Responses stream in an isolated Linux container. A local receiver accepted authenticated logs and traces, including a header with percent sequences, commas and equals signs. No provider API was contacted. Its config contained no credential.
• A control run with a literal synthetic config header exported successfully but persisted that header. The config-file interpolation variant did not authenticate. Both controls remain recorded; the fix uses the verified standard environment headers.
• The previous paid task passed all product assertions but failed the persisted-state credential check. Its failed grade and cost remain retained. A later live gateway attempt passed product behavior and the persisted-state scan, but native exports were missing. A provider subprocess regression reproduced the dropped environment headers and passed after the native launcher fix. The separately planned Codex feedback case then passed once at 1480d8e: both feedback tools completed, cleanup and the persisted-state scan passed, and Braintrust indexed 2,552 native/harness records under root c3414f70092ede9e4eed1e055a15166c. API/tool events include both submit_complaint and submit_suggestion. The run added $0.1967024 in estimated gateway cost. The six-attempt marker cap remains exhausted; no failures were discarded. Full eval support checks passed 3,455 tests with two existing skips. Current-head CI/review is pending.

Risks

• Provider processes and their tools can still read their own environment. This change prevents persistence in generated config; it does not create a new trust boundary.
• Old retained artifacts are not rewritten. Existing process lifecycle and credential revision checks still govern replacement.
• Header behavior is qualified against pinned Codex 0.160.0. Future runtime upgrades must preserve this export contract.

Model Used

OpenAI GPT-6 via Codex, with reasoning, code execution and tool use. The exact runtime model ID and context-window size are not exposed to this session.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template
• I have not referenced internal/instance-local Paperclip issues or links (only public GitHub #NNN / github.com/paperclipai/paperclip URLs)
• My branch name describes the change (e.g. docs/..., fix/...) and contains no internal Paperclip ticket id or instance-derived details
• I have run tests locally and they pass (eval support checks; full-suite limitation disclosed above)
• I have added or updated tests where applicable
• I have updated relevant documentation to reflect my changes
• I have considered and documented any risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

Current head ebcb1d4e79: complete 48-job CI run passed. Greptile reviewed this head at 5/5 with no unresolved threads. Earlier canceled scaffold runs remain in history; a separate successful run on this same head completed the gates. Earlier material test failures and their later verification remain described above. No live acceptance is inferred from CI.