feat(telemetry): require explicit opt-in

packages/bundle/base/cordis.patch.yml

@@ -120,14 +120,12 @@
     - id: session-projection
       name: '@deepseek-ai/dsh-session-projection'
 
-    # Session telemetry, on for every dsh mode: mirrors every session-log
-    # event (assistant/chunk projected to first-of-step) plus ops markers onto
-    # OTLP/HTTP log records, streaming on the batch processor's cadence
-    # (10s/batch here) — not at exit; a crash loses at most the last unexported
-    # interval. No telemetry/record redaction rule is mounted yet, so exports
-    # are the raw captured copy; the deployment stance, env seams, and
-    # follow-ups are pinned in the web-telemetry-default-mount Agent Note.
-    # DSH_TELEMETRY_OTLP_URL overrides the production endpoint, and a non-empty
+    # Session telemetry is mounted but disabled by default. DSH_TELEMETRY_MODE
+    # explicitly opts into FULL or FEEDBACK_ONLY reporting; uploading mirrors
+    # session-log records onto OTLP/HTTP logs with no telemetry/record redaction
+    # rule, so exports are the raw captured copy. The deployment stance, env
+    # seams, and follow-ups are pinned in the default-off Agent Note.
+    # DSH_TELEMETRY_OTLP_URL overrides the production endpoint. A non-empty
     # DSH_TELEMETRY_DISABLED — any value, including '0'/'false' — opts the
     # process out (the launchers patch the row disabled; config cannot disable
     # a row). Exports carry the harness home's anonymous user id ($DSH_HOME/.userid,
@@ -144,6 +142,7 @@
     - id: telemetry-otel
       name: '@deepseek-ai/dsh-session-telemetry-otel'
       config:
+        mode: !!js process.env.DSH_TELEMETRY_MODE || 'DISABLED'
         shutdownTimeoutMillis: 3000
         exporter:
           url: !!js process.env.DSH_TELEMETRY_OTLP_URL ?? 'https://harness-telemetry.deepseeksvc.com/v1/logs'

packages/bundle/base/tests/base.spec.ts

@@ -23,11 +23,14 @@ describe('dsh-base bundle', () => {
     )
     expect(Array.isArray(parsed)).toBe(true)
     // The base layer is one insert list over the empty profile root.
-    const rows = (parsed as { insert?: { id?: string }[] }[]).flatMap(
+    const rows = (parsed as { insert?: { id?: string; config?: Record<string, unknown> }[] }[]).flatMap(
       patch => patch.insert ?? [],
     )
     expect(rows.length).toBeGreaterThan(50)
     expect(rows.some(row => row.id === 'agent-loop')).toBe(true)
+    expect(rows.find(row => row.id === 'telemetry-otel')?.config?.['mode']).toEqual({
+      __jsExpr: "process.env.DSH_TELEMETRY_MODE || 'DISABLED'",
+    })
   })
 
   it('ships the Windows platform layer as the confined pwsh roster over the ACL runner chain', () => {