feat(server): forward OTLP export config to the worker subprocess (O1 Lever B)

[thewoolleyman]

Activates the inert worker OTLP exporter for the dark factory (livespec O1 bd-ib-98c.4, Lever B). Companion to the transport PR fabro-sh#576 (already carried in factory-integration).

Problem

The server spawns __run-worker via apply_worker_env, which env_clear()s and copies a narrow allowlist (WORKER_ENV_ALLOWLIST) that omits all OTEL_*. The worker installs otel::otel_layer() (fabro-cli) but, with no OTEL env, never exports — so the agent-side spans are lost.

Change

Re-inject the server's OTLP export config into the worker after apply_worker_env, via a new apply_worker_otel_export_env:

• forwards the 5 non-secret export vars (endpoint / protocol / service-name, base + per-signal);
• explicitly env_removes the credential-bearing OTEL_EXPORTER_OTLP_HEADERS / _TRACES_HEADERS.

Security invariant

The headers vars carry the collector's egress credential (a Honeycomb API key), and the opentelemetry-otlp exporter reads OTEL_EXPORTER_OTLP_HEADERS from the env itself. They must never reach the sandboxed worker — the worker exports to the local collector, which adds egress auth. A unit test proves the five non-secret vars forward and both headers spellings are stripped even when pre-set.

Additive / opt-in

With no OTLP env on the server, nothing is forwarded and there is no behavior change.

Validation (pinned nightly-2026-04-14)

• cargo fmt --check --all — clean
• cargo clippy --locked -p fabro-server --all-targets -- -D warnings — clean
• cargo test -p fabro-server --lib spawn_env — 3 passed

Draft pending Codex + Fable adversarial review and the maintainer's integrate + re-pin decision (Lever B pairs with Lever A, the server-start OTEL env; see the livespec O1 plan). End-to-end proof-dispatch is deferred until the pinned host binary is rebuilt from this + the server restarted with OTEL env.

[thewoolleyman]

Adversarial review complete (Codex + Fable), findings addressed

Reviewed with the transport's two-reviewer pattern. Fable (executing) ran clippy + tests and confirmed the security invariant holds: env_clear + allowlist-only forwarding is fail-closed; no path lets OTEL_EXPORTER_OTLP_HEADERS/_TRACES_HEADERS or any other secret reach the worker; endpoint/protocol precedence matches fabro-cli/src/otel.rs. Codex (static) found no leak path and confirmed correct ordering. All findings were low/minor/nit:

• Forward the timeout knobs (Codex) — OTEL_EXPORTER_OTLP_TIMEOUT/_TRACES_TIMEOUT are read by the exporter too; now forwarded so the worker exporter fully mirrors the server's non-secret export config.
• Harden the strip test (Codex + Fable) — the test now pre-sets both headers vars before apply_otel_export, so both denylist entries are regression-guarded (previously only the base spelling was exercised).
• Correct the comments (Fable) — the fail-closed guarantee is env_clear + allowlist-only forwarding; the headers denylist is belt-and-suspenders. Added the local-no-auth-collector topology assumption.
• Ordering made explicit (Fable) — the re-injection MUST stay after apply_worker_env's env_clear; documented at the call site.

Not added: a process-env integration test over command_for_spec. Fable suggested mirroring the FABRO_WORKER_TOKEN assertion, but that var is spec-field-sourced (deterministic), whereas the OTEL forwarding reads the ambient process env — like apply_worker_env's allowlist, which fabro itself tests via the injected-lookup unit test (mirrored here), not an integration test. A command_for_spec OTEL test would need unsafe global set_var; the ordering it would guard is fail-safe (telemetry loss, never a leak) and is now pinned by the explicit call-site comment.

Validated under the pinned nightly-2026-04-14: fmt clean, clippy -p fabro-server --all-targets -D warnings clean, test spawn_env 3/3.

Ready to integrate into factory-integration when the host binary is rebuilt + re-pinned (pairs with Lever A, the server-start OTEL env). End-to-end proof-dispatch follows that repin + restart.