Fix command admission and native verification

Authorize commands before reading retained private outcomes; validate persisted submission identities and receiving principals; bind query joins to the admitted resource lifetime. Correct current SDK/MCP, restore, connection and canonical receipt assertions using original commands, configuration and pre-operation cuts. Reconcile native inventory source metadata without changing cases or selectors.

Verified: complete Debug solution build with -warnaserror (0 warnings/errors), dotnet format --verify-no-changes, repository governance, and authentic native discovery of all 3,717 cases plus the five unchanged groups. Full runtime and coverage qualification remain open.

Author: KSemenenko

build/KeyLoad.AppHost/ClusterRouting/Resources/ClusterTelemetryResources.cs

@@ -6,10 +6,22 @@ internal static class ClusterTelemetryResources
     private const string Exemplars = "OTEL_METRICS_EXEMPLAR_FILTER";
     private const string DisabledContent = "false";
     private const string DisabledExemplars = "always_off";
+    private const string InvalidExporterRegistration = "The pinned Aspire project exporter registration is invalid.";
+    private const int ExporterEnvironmentOffset = 1;
 
     internal static void Apply(IResourceBuilder<ProjectResource> resource)
     {
         ArgumentNullException.ThrowIfNull(resource);
+        var annotations = resource.Resource.Annotations;
+        var exporter = annotations.OfType<OtlpExporterAnnotation>().Single();
+        var exporterIndex = annotations.IndexOf(exporter);
+        if (exporterIndex + ExporterEnvironmentOffset >= annotations.Count
+            || annotations[exporterIndex + ExporterEnvironmentOffset] is not EnvironmentCallbackAnnotation exporterEnvironment)
+        {
+            throw new InvalidOperationException(InvalidExporterRegistration);
+        }
+        annotations.Remove(exporter);
+        annotations.Remove(exporterEnvironment);
         resource.WithOtlpExporterIfEndpointAvailable(OtlpProtocol.Grpc)
             .WithEnvironment(context =>
             {

docs/Features/Authorization/FoundationOtlp.md

@@ -4,14 +4,14 @@ Native foundation composition contract. Existing Authorization REQ/AC-AUTH-005/0
 
 | Requirement | Acceptance |
 |---|---|
-| REQ-OTLP-FOUNDATION-001 | AC-OTLP-FOUNDATION-001: every actual ClusterResources.AddNode container receives the pinned Aspire13.6.1 native OTLP annotation and environment callback. Native gRPC protocol matches the already selected .NET OTLP exporter. The dashboard's original EndpointReference remains responsible for allocated container-network routing. A dashboard-free model without a configured receiver emits no OTLP endpoint/protocol and does not silently select localhost. |
+| REQ-OTLP-FOUNDATION-001 | AC-OTLP-FOUNDATION-001: every actual ClusterResources.AddNode project receives the pinned Aspire13.6.1 native optional OTLP annotation and environment callback. Native gRPC protocol matches the already selected .NET OTLP exporter. The dashboard's original EndpointReference remains responsible for allocated endpoint routing. A dashboard-free model without a configured receiver emits no OTLP endpoint/protocol and does not silently select localhost. |
 | REQ-OTLP-FOUNDATION-002 | AC-OTLP-FOUNDATION-002: the final feature-owned resource environment callback enforces GenAI content capture=false and exemplars=always_off after the native Development helper. Existing ServiceDefaults processors, views, source/meter selection, native Orleans propagation, provider instances, quotas and health checks stay unchanged. Effective callback results, not annotation presence alone, are asserted in Development and Production with and without configured receiver. |
 | REQ-OTLP-FOUNDATION-003 | AC-OTLP-FOUNDATION-003: actual ServerApplication.RunLifetime resolves the existing public ITelemetryHostInitializer and calls Initialize inside the original observed try before PartitionHost/administration resolution. The existing OTel hosted service later resolves those same DI singleton providers; no second provider/host/export pipeline is created. Failure follows the original failure observer and joined shutdown. |
 | REQ-OTLP-FOUNDATION-004 | AC-OTLP-FOUNDATION-004: retained TelemetryAdmissionWhole r5 actual native SDK/official MCP current-authorization/privacy/replay/two-cold fixture remains an independently reviewed companion, not Docker receiver proof. Full cluster gate requires the test-owned actual AppHost, discovered SDK/official MCP operations, original per-node remote receiver records for traces/metrics/logs, bounded private-state absence, positive expected export records and joined producers/exporters/receiver. Pinned native dashboard authenticated APIs for spans/logs/traces/resources and browser-token exchange are source-confirmed; metrics query is unavailable. Separate cluster trace/log fixture remains conditional/unexecuted, and full three-signal gate stays OPEN. No custom parser/dependency or console-log inference. |
 
 ```mermaid
 flowchart LR
-  Nodes[Actual Aspire cluster container nodes] --> Native[Native optional OTLP callback]
+  Nodes[Actual Aspire native project nodes] --> Native[Native optional OTLP callback]
   Native --> Routing[Original dashboard or configured receiver routing]
   Native --> Privacy[Final content false and exemplars off]
   Build[Existing server DI] --> Init[Native telemetry initializer inside observed lifetime]
@@ -31,6 +31,6 @@ Source/model verification is distinct from runtime acceptance. Native API source
 - AC-OTLP-FOUNDATION-003: source review of exact `ServerApplication.RunLifetimeAsync` call order and pinned `ITelemetryHostInitializer.Initialize` singleton resolution; explicit manual/runtime evidence exception until original native startup, startup failure and shutdown are exercised by Root on exact source. This review is not executed startup proof.
 - AC-OTLP-FOUNDATION-004: retained `TelemetryAdmissionWholeTests.RealServerExportsDuringSdkAndOfficialMcpPolicyRefusalRepairAndTwoOriginalRootColdOpens`, plus separately authored `FoundationOtlpClusterTests.NativeDashboardReceivesActualClusterSdkMcpPolicyRepairTracesAndPrivateFreeRejectionLogs`. Both remain unexecuted source inputs in this delivery; full three-signal cluster, loss/drain and final physical disposal gates remain OPEN.
 
-## Every physical group receives native telemetry composition
+## Every node receives native telemetry composition
 
-REQ-FOUNDATION-OTLP-ALL-NODES-001 / AC-FOUNDATION-OTLP-ALL-NODES-001: common `ClusterResourceSettings.Apply` attaches the same native optional exporter and final privacy callback to every actual KeyLoad node. This includes every node of the Aspire-owned cluster. The former single-group call is removed to prevent duplicate registration. Existing four ordinary model cases are retained unchanged; additional `ClusterTelemetryResourceTests` cases execute every native environment callback for every node resource across Development/Production and receiver present/absent. They independently check exact node identity, data roots, endpoint, one exporter annotation, optional endpoint/protocol/service metadata and privacy values. No fake exporter endpoint or new resource/provider is added.
+REQ-FOUNDATION-OTLP-ALL-NODES-001 / AC-FOUNDATION-OTLP-ALL-NODES-001: common `ClusterResourceSettings.Apply` attaches the same native optional exporter and final privacy callback to every actual KeyLoad node. Aspire13.6.1 `AddProject` registers one exporter annotation immediately followed by its environment callback. Composition validates that pinned pair and replaces only those two annotations with native optional export; all other project callbacks remain. A changed registration structure fails startup. The four existing `ClusterTelemetryResourceTests` arguments execute every native environment callback for every node across Development/Production and receiver present/absent. They independently check exact node identity, data roots, endpoint, one exporter annotation, optional endpoint/protocol/service metadata and privacy values. No collector or additional provider is introduced.

docs/implementation/status.json

@@ -1,13 +1,13 @@
 {
-  "updated": "2026-10-18",
+  "updated": "2026-10-19",
   "product": "KeyLoad development preview. Not production ready.",
   "concept": "Orleans owns all clustering and activation scaling. The API reaches one grain per connected client, logical database/partition grains, storage owners and bounded result aggregation. Shared volumes require one open owner per physical partition without copies; isolated volumes use typed Orleans calls between owners. Shared-volume ownership and distributed partition-query execution are not yet qualified.",
   "qualification": {
     "build": "Not recorded here. Run dotnet build KeyLoad.slnx -warnaserror.",
     "unitTests": "open",
     "processRecoveryTests": "open",
     "aspireClusterSdkMcpTests": "open",
-    "coverage": "unmeasured",
+    "coverage": "open: original Linux analyzer measurements exist; current source mapping and required numeric gates are not qualified. Functional coverage remains open.",
     "performance": "No published claim without authenticated GitHub Benchmarks evidence.",
     "powerLossDurability": "Not proven; process-kill tests do not prove it.",
     "endurance": "open",