[ronniegeraghty]

Summary

Reported directly from the original forced opt-out; no tracking issue was supplied.

Remove every Action-imposed telemetry opt-out from production Vally launches, including the separate --version probe. When the caller omits telemetry controls, Vally's normal defaults apply. Preserve caller-provided VALLY_TELEMETRY_OPTOUT, DO_NOT_TRACK, and OTEL_SDK_DISABLED values exactly, including explicit opt-outs and empty strings, through the narrow environment allowlist. Do not force telemetry on, forward arbitrary telemetry endpoints/headers, or change credential and process-injection filtering.

Add regression coverage for run, lint, default-all orchestration, and version checks; document the behavior and regenerate dist/index.cjs. Real Vally acceptance fixtures explicitly opt out of telemetry as test-only caller settings.

Verification

• Model-free checks and source-to-bundle verification pass.
• Native integration evidence is distinguished from synthetic controls.
• Credential, process and artifact boundaries were reviewed.
• Documentation and packaged dist match source.

Validated the committed change locally on Windows using Node 24.22.2 and pinned pnpm 12.8.1. Missing dependencies were restored with pnpm install --frozen-lockfile --ignore-scripts (passed).

Command	Result
pnpm build	Passed; regenerated the committed Action bundle.
pnpm check	Passed: type checking, lint, 174 unit/contract tests with coverage thresholds, source-to-bundle verification, and 6 packaging tests.
pnpm check:dist	Passed again immediately before pushing this commit.

The native contract suite runs the real pinned Vally 0.19.0 CLI with its built-in mock executor and deterministic graders, covering lint, pass/fail, skipped/not-run, and evidence behavior. Telemetry environment transport and credential separation are verified with synthetic child executables; GitHub orchestration uses mocked services. These controls do not claim that live telemetry was emitted or that live model credentials were accepted.

Limitations

Hosted Linux Action integration and artifact-service checks are pending CI; this PR remains draft while that integration is incomplete. No model-backed evaluation, live telemetry egress test, or live credential qualification was run locally.

Existing upstream bundled-dependency license-text gaps are unchanged; passing these checks does not clear release gates. No dependency, permission, artifact-policy, or release changes are included.

[github-actions]

Evals: passed

Suite: copilot-smoke

Lint: validated (no model execution) - Evidence

Run: passed - 1 trial - Evidence

Eval	Trials	Result
copilot-skill-smoke	1	passed

Exact revision | Workflow run

[Copilot]

🟡 Changes recommended

The packaged CI job lacks the promised test-only telemetry opt-out, exposing synthetic acceptance runs to telemetry-on defaults, while the README does not clearly document the default or how to disable it.

2 open issues

• Disable telemetry for packaged acceptance fixtures · New
• Document telemetry-on default and show workflow opt-out · New

What changed in this PR

Updates the Vally CLI adapter to respect caller telemetry settings and native defaults instead of forcing telemetry off.

Changes:

• Preserve the three named telemetry controls unchanged, including empty strings, while retaining environment filtering.
• Remove forced opt-outs from native execution and version checks.
• Add regression coverage, explicitly opt out local real-CLI fixtures, and document caller configuration.

File	Description
tests/​policy.test.ts	Tests telemetry control preservation and environment filtering.
tests/​native.test.ts	Tests run, lint, and version-check transport; adds fixture opt-outs.
tests/​action.test.ts	Tests telemetry preservation across default-all phases.
src/​policy.ts	Adds the three telemetry controls to the environment allowlist.
src/​native.ts	Removes forced telemetry overrides from native launches.
README.md	Documents telemetry behavior and workflow configuration.

_{Review effort: Max (auto)}

[wbreza]

Verdict: APPROVE — head 5785bf2018c9ac95a3b4d81ec5ab74c27c61e71b

Reviewed all 9 files (source, tests, README, workflow, regenerated bundle) against the PR intent. Telemetry controls (VALLY_TELEMETRY_OPTOUT, DO_NOT_TRACK, OTEL_SDK_DISABLED) are now allowlisted pass-through in inertEnvironment, the forced overrides are removed from nativeEnvironment and the --version probe, and other env filtering is unchanged (credentials/endpoints/headers still dropped; tests cover this). dist/index.cjs is consistent (Bundle verification passes).

Existing findings (Copilot reviewer), verified fixed in code at this head:

• Packaged-job telemetry opt-out → .github/workflows/ci.yml job-level env (VALLY_TELEMETRY_OPTOUT/DO_NOT_TRACK) ✅
• README default/opt-out docs → README.md ~352-373 ✅

New findings: none (no BZ-20 findings).

CI at head: Action smoke test, Bundle verification, Lint, Type check, Unit tests, CodeQL, evals all pass. I did not run tests locally (no dependency install per review policy).
Coverage limits: single standard-model review; independent multi-model review not warranted for a small, low-risk change. Discussion evaluated through review 5762298807, inline comment 4462821131, issue comment 6620148653. Eyes reaction ID 623658809 (created by this run; to be removed).

Generated by 🌳Breza Bot