v0.4.0

• #63 1c2a577 Thanks @eyelock! - OpenTelemetry. Set OTEL_EXPORTER_OTLP_ENDPOINT and ynm sends a span for each HTTP request, MCP
  tool call, CLI command, store call and dream pass, each announced by a started event and ended
  with its outcome, plus duration metrics and the server's stderr lines as log records. A request's
  traceparent header, a tool call's _meta, or TRACEPARENT in a command's environment joins the
  caller's trace. Nothing is exported that holds memory content: no bodies, summaries, queries, tool
  arguments, subjects or tags, and namespaces only with YNM_TELEMETRY_NAMESPACES=1; every string
  passes through the redaction patterns first. YNM_AUDIT={"sink":"otel"} sends audit events to the
  collector, naming the person by their sign-in id and identity provider host. Without an endpoint
  nothing is loaded and nothing changes. ynm telemetry registry --format json prints every name ynm
  emits.

• #66 e00db04 Thanks @eyelock! - Telemetry passes the trace on and names people by login name. With telemetry on, every process
  ynm starts (git, the Claude CLI, the agent CLIs ynm client install runs) gets TRACEPARENT and
  TRACESTATE for the span it runs in, and every request to a hosted ynm through a remote mount
  carries the W3C traceparent and tracestate headers, so the work ynm calls joins its trace. No
  request to a third party, such as an identity provider or a model API, carries trace context. A
  tool call to a hosted ynm and a call to a model are now client spans of their own
  (tools/call …, model …), with started events and duration metrics. With telemetry off
  nothing changes. The otel audit sink's user.name is now the
  person's login name, the token's preferred_username, falling back to its subject, qualified by
  the identity provider's host; a value with an @ is never used. Who a person is in ynm, and what
  the other audit sinks record, is unchanged.

• #64 9b38d8f Thanks @eyelock! - Telemetry to a ynr spool. With no OTLP endpoint set, ynm writes its spans, events and metrics as
  OTLP JSON lines into the folder YNR_SPOOL names, or into ynr's laptop spool,
  ~/.local/state/ynr/spool/local (under XDG_STATE_HOME when set), when that folder exists. An
  endpoint still wins. Each command, stdio session and function invocation puts its file on disk
  as it ends, within 2 seconds; files are capped, and what is dropped is counted in
  ynm.telemetry.spool.dropped and ynm.telemetry.spool.errors. A server started before the spool
  exists looks for it once a minute. A hosted server writes to the spool's services/ynm folder
  when its deployment sets YNR_SPOOL to it. With neither an endpoint nor a spool, nothing is
  loaded and nothing changes.

• #75 1a3bd91 Thanks @eyelock! - ynm client install ynh now writes ynh's .agents/harness/plugin.json layout, and the ynm harness
  under integrations/ynh uses it too. A harness that still has its manifest in the deprecated
  .ynh-plugin/ directory is recognised by ynm client status and ynm doctor, and
  ynm client install ynh moves it to .agents/harness/ (saying so in its output) before merging
  ynm into it, so a harness never ends up with two manifests.

Patch Changes

• #76 30f1650 Thanks @eyelock! - The Docker image is smaller and contains only the runtime: one bundled ynm.mjs, Node, git and
  tini, with no sources, tests, build cache or dev dependencies (770 MB to about 280 MB). It runs as
  a non-root user, uid 1001, and starts the server with ynm serve --http. A bind-mounted /data
  must be writable by uid 1001 (chown 1001:1001); a named volume needs nothing.

• #69 1cd6046 Thanks @eyelock! - ynm telemetry registry --format json now prints the same shape as the other YN tools: the tool
  and version, the semantic-conventions release, then the attributes, standard attributes, spans,
  events and metrics. The names themselves are unchanged.

Install: see https://eyelock.github.io/ynm/#/how-to/install (Homebrew ynm standalone or ynm-slim, direct download, Docker).

What's Changed

• chore: back-merge release 0.3.0 into develop by @eyelock in #60
• fix: the Claude CLI writer no longer passes ANTHROPIC_API_KEY to the claude CLI by @eyelock in #61
• feat: OpenTelemetry over OTLP, loaded only when an endpoint is set by @eyelock in #63
• feat: write telemetry to a ynr spool when no OTLP endpoint is set by @eyelock in #64
• chore: keep the YNR_READ_PACKAGES secret out of Terraform by @eyelock in #65
• feat: pass trace context on, and name people by login name in telemetry by @eyelock in #66
• fix: trace context goes only to processes ynm starts and to a hosted ynm by @eyelock in #67
• fix: the Pi extension runs ynm from PATH, with no YNM_BIN override by @eyelock in #68
• fix: print the telemetry registry in the shape every YN tool uses by @eyelock in #69
• test: keep the telemetry-off test away from a real ynr laptop spool by @eyelock in #70
• feat: bring the repository to the public-ready standard by @eyelock in #71
• feat: read the public spool exporter with the workflow's own token by @eyelock in #74
• deps: Bump keycloak/keycloak from 26.3 to 26.8 in /infra/keycloak by @dependabot[bot] in #72
• deps: Bump auth0/auth0 from 1.58.0 to 1.58.1 in /infra/auth0 in the terraform group across 1 directory by @dependabot[bot] in #73
• feat: write ynh's .agents/harness layout, moving an old .ynh-plugin by @eyelock in #75
• feat: a slim, non-root container image by @eyelock in #76
• release: 0.4.0 by @eyelock in #78

Full Changelog: v0.3.0...v0.4.0