@spunto/build 0.15.0 → 0.17.0

package/src/sandbox-agent/bootstrap.sh

@@ -0,0 +1,64 @@
+#!/bin/sh
+# Spunto sandbox bootstrap (RFC 0035) — the main process of every sandbox, whatever runs it.
+#
+# Finds (or fetches) a Node >= 22, fetches the agent from the platform, and runs it forever. The
+# provider only has to run `curl -fsSL $SPUNTO_API_URL/api/sandboxes/bootstrap.sh | sh` with
+# SPUNTO_API_URL and SPUNTO_SANDBOX_TOKEN in the environment. Needs curl or wget, and glibc if the
+# image has no suitable node (the official Node binaries are not built for musl).
+#
+# Shipped in @spunto/build (`./sandbox-agent`), so any control plane can serve it (RFC 0047):
+#   SPUNTO_AGENT_URL  where the agent is fetched (default $SPUNTO_API_URL/api/sandboxes/agent.mjs)
+#   SPUNTO_NODE       a Node >= 22 the control plane mounted in the box: nothing is downloaded
+set -eu
+
+API="${SPUNTO_API_URL:?SPUNTO_API_URL is required}"
+: "${SPUNTO_SANDBOX_TOKEN:?SPUNTO_SANDBOX_TOKEN is required}"
+NODE_VERSION="${SPUNTO_NODE_VERSION:-v24.11.1}"
+AGENT_URL="${SPUNTO_AGENT_URL:-$API/api/sandboxes/agent.mjs}"
+
+DIR=/opt/spunto-sandbox
+if ! mkdir -p "$DIR" 2>/dev/null || [ ! -w "$DIR" ]; then
+  DIR="${HOME:-/tmp}/.spunto-sandbox"
+  mkdir -p "$DIR"
+fi
+
+fetch() {
+  if command -v curl >/dev/null 2>&1; then curl -fsSL --retry 5 --retry-delay 2 "$1" -o "$2"
+  elif command -v wget >/dev/null 2>&1; then wget -qO "$2" "$1"
+  else echo "[bootstrap] neither curl nor wget in this image" >&2; exit 1
+  fi
+}
+
+node_ok() {
+  [ -n "$1" ] && "$1" -e 'process.exit(+process.versions.node.split(".")[0] >= 22 ? 0 : 1)' 2>/dev/null
+}
+
+NODE="${SPUNTO_NODE:-}"
+node_ok "$NODE" || NODE="$(command -v node 2>/dev/null || true)"
+if ! node_ok "$NODE"; then
+  NODE="$DIR/node/bin/node"
+  if ! node_ok "$NODE"; then
+    case "$(uname -m)" in
+      x86_64|amd64) ARCH=x64 ;;
+      aarch64|arm64) ARCH=arm64 ;;
+      *) echo "[bootstrap] unsupported arch $(uname -m)" >&2; exit 1 ;;
+    esac
+    echo "[bootstrap] fetching node $NODE_VERSION ($ARCH)"
+    fetch "https://nodejs.org/dist/$NODE_VERSION/node-$NODE_VERSION-linux-$ARCH.tar.gz" "$DIR/node.tgz"
+    rm -rf "$DIR/node" && mkdir -p "$DIR/node"
+    tar -xzf "$DIR/node.tgz" -C "$DIR/node" --strip-components=1
+    rm -f "$DIR/node.tgz"
+  fi
+fi
+
+# Re-fetched on every boot, so a restart picks up a new agent without rebuilding anything.
+while true; do
+  if fetch "$AGENT_URL" "$DIR/agent.mjs.new"; then
+    mv "$DIR/agent.mjs.new" "$DIR/agent.mjs"
+  fi
+  if [ -f "$DIR/agent.mjs" ]; then
+    "$NODE" "$DIR/agent.mjs" || true
+  fi
+  echo "[bootstrap] agent exited, restarting in 3s" >&2
+  sleep 3
+done

package/src/sandbox-agent/index.ts

@@ -0,0 +1,31 @@
+/**
+ * The in-box agent (RFC 0035, RFC 0047): the files a control plane serves to a box so that the box
+ * dials it — never imported, never read by this package.
+ *
+ * - `bootstrap.sh` — the box's main process: finds (or fetches) a Node >= 22, fetches the agent,
+ *   runs it forever. `SPUNTO_AGENT_URL` says where from (default
+ *   `$SPUNTO_API_URL/api/sandboxes/agent.mjs`), `SPUNTO_NODE` hands it a Node so it fetches none.
+ * - `agent.mjs` — one file, no dependency, served as is. It dials `SPUNTO_AGENT_CONNECT_URL`
+ *   (default `$SPUNTO_API_URL/api/sandbox-agent/connect`) and speaks `./agent-protocol`.
+ * - `runner.sh` — the project runner: the recipe once per bake key, the features' environment, then
+ *   the worker script. Handed to the agent in the plan, and run by a build in `bake-only` mode.
+ *
+ * What a consumer gets here is *where* the files are; reading and serving them is its own I/O. The
+ * same files are reachable as subpaths of the package (`@spunto/build/sandbox-agent/agent.mjs`…).
+ */
+
+export const SANDBOX_AGENT_FILES = {
+  agent: new URL("./agent.mjs", import.meta.url),
+  bootstrap: new URL("./bootstrap.sh", import.meta.url),
+  runner: new URL("./runner.sh", import.meta.url),
+} as const
+
+export type SandboxAgentFile = keyof typeof SANDBOX_AGENT_FILES
+
+/** What each file is served as. */
+export const SANDBOX_AGENT_CONTENT_TYPES: Record<SandboxAgentFile, string> = {
+  agent: "text/javascript; charset=utf-8",
+  bootstrap: "text/x-shellscript; charset=utf-8",
+  runner: "text/x-shellscript; charset=utf-8",
+}
+export * from "./recipe"

package/src/sandbox-agent/recipe.ts

@@ -0,0 +1,65 @@
+/**
+ * A project's recipe as a box that carries the agent runs it (RFC 0042, RFC 0047): through the
+ * agent's own runner, in `bake-only` mode, so that what a build freezes into an image is exactly
+ * what a box would have baked in place — the `.baked-<key>` marker and the features' captured
+ * environment included. A box started from the result skips straight to the worker script.
+ *
+ * The runner's text is the caller's to read (`SANDBOX_AGENT_FILES.runner`): this package does no I/O.
+ */
+
+import { IMAGE_RECIPE_VERSION } from "../script/index"
+
+/** Where the agent keeps a project (`<dir of agent.mjs>/project`, the bootstrap putting it in /opt/spunto-sandbox). */
+export const SANDBOX_PROJECT_DIR = "/opt/spunto-sandbox/project"
+
+/**
+ * The key a recipe is baked under: changes whenever the recipe would bake something different
+ * (the generator's version, the base image, the script). **A format**: a builder and the agent of
+ * a box started from its result must compute the same one, or the box bakes again.
+ */
+export async function recipeBakeKey(p: { image: string; script: string; recipeVersion?: number | string }): Promise<string> {
+  const text = `${p.recipeVersion ?? IMAGE_RECIPE_VERSION}\n${p.image}\n${p.script}`
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text))
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 16)
+}
+
+const shq = (v: string) => `'${v.replace(/'/g, `'\\''`)}'`
+
+/** An image's `ENV` as shell: its `PATH` in front of the one there is, the rest only where unset. */
+export function imageEnvExports(env: Record<string, string> | null | undefined): string[] {
+  return Object.entries(env ?? {})
+    .filter(([k]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(k))
+    .map(([k, v]) => (k === "PATH" ? `export PATH=${shq(v)}"\${PATH:+:$PATH}"` : `[ -n "\${${k}+x}" ] || export ${k}=${shq(v)}`))
+}
+
+/** FNV-1a, for heredoc tags: a tag only has to be absent from the body it fences. */
+function tagHash(s: string): string {
+  let h = 0x811c9dc5
+  for (let i = 0; i < s.length; i++) h = Math.imul(h ^ s.charCodeAt(i), 0x01000193) >>> 0
+  return h.toString(16).padStart(8, "0")
+}
+
+/**
+ * What a builder runs, as root, in a container of the project's image: the recipe through the
+ * runner in `bake-only` mode. Self-contained: nothing to fetch, no token, nothing personal.
+ * `imageEnv`: the image's `ENV`, for a builder booted from its files without it (a microVM).
+ */
+export function buildRecipeScript(recipe: { bakeKey: string; bake: string; runner: string }, imageEnv: Record<string, string> | null = null): string {
+  if (!/^[A-Za-z0-9_-]+$/.test(recipe.bakeKey)) throw new Error(`Invalid bake key ${recipe.bakeKey}`)
+  const fence = (name: string, body: string) => {
+    const tag = `__SPUNTO_${name}_${tagHash(body)}__`
+    return `cat > "$DIR/${name.toLowerCase()}.sh" <<'${tag}'\n${body.replace(/\n?$/, "\n")}${tag}\n`
+  }
+  return [
+    "#!/bin/bash",
+    "set -eu",
+    `DIR=${SANDBOX_PROJECT_DIR}`,
+    ...imageEnvExports(imageEnv),
+    'mkdir -p "$DIR" && chmod 700 "$DIR"',
+    fence("BAKE", recipe.bake),
+    fence("RUNNER", recipe.runner),
+    'chmod 700 "$DIR/bake.sh" "$DIR/runner.sh"',
+    `exec bash "$DIR/runner.sh" "$DIR" ${recipe.bakeKey} bake-only`,
+    "",
+  ].join("\n")
+}

package/src/sandbox-agent/runner.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# spunto-project-runner — the recipe once per bake key, then the worker script (setup once, start always)
+#
+# One copy, two users: the in-sandbox agent (handed it in the project plan, `plan.runner`) and a
+# provider's build (`buildRecipeScript` in sandbox-project.ts, mode `bake-only`) — so what a build
+# freezes is exactly what a sandbox would have baked in place, marker and features' env included.
+DIR="$1"; KEY="$2"; MODE="$3"
+if [ ! -f "$DIR/.baked-$KEY" ]; then
+  echo "[spunto] baking the project recipe ($KEY)"
+  bash "$DIR/bake.sh" || { echo "[spunto] recipe failed"; exit 90; }
+  touch "$DIR/.baked-$KEY"
+fi
+# Features declare their environment (containerEnv: nvm's PATH…) for the image; a recipe run in
+# place leaves it only in /etc/bash.bashrc, which non-interactive shells skip. Keep what an
+# interactive shell adds over a login one, for the lifecycle commands below and for the agent.
+_skip='^(USER|HOME|LOGNAME|MAIL|PS1|PS2|PS4|SHLVL|_|PWD|OLDPWD|TERM|COLUMNS|LINES|HOSTNAME|BASH_.*|HIST.*|SHELLOPTS|BASHOPTS|LS_COLORS)$'
+# Our own profile.d file must be out of the way, or from the second boot on the login shell
+# already has what we are measuring and the difference comes out empty (seen for real).
+rm -f /etc/profile.d/spunto-features.sh
+env -i HOME=/root PATH="$PATH" bash -lc 'env -0' > "$DIR/.env.login" 2>/dev/null || true
+env -i HOME=/root PATH="$PATH" PS1='$ ' bash -ic 'env -0' > "$DIR/.env.interactive" 2>/dev/null || true
+: > "$DIR/env.list.new"; : > "$DIR/env.sh.new"
+while IFS= read -r -d '' _kv; do
+  _k="${_kv%%=*}"; [[ "$_k" =~ $_skip ]] && continue
+  grep -qzxF -- "$_kv" "$DIR/.env.login" && continue
+  printf '%s\0' "$_kv" >> "$DIR/env.list.new"
+  printf 'export %s=%q\n' "$_k" "${_kv#*=}" >> "$DIR/env.sh.new"
+done < "$DIR/.env.interactive"
+mv -f "$DIR/env.list.new" "$DIR/env.list"; mv -f "$DIR/env.sh.new" "$DIR/env.sh"
+# World-readable (no secret in it): login shells read it from profile.d, and BASH_ENV — which su
+# keeps, unlike PATH — makes the non-interactive bash of postCreate/postStart read it too.
+install -m 644 "$DIR/env.sh" /etc/profile.d/spunto-features.sh
+export BASH_ENV=/etc/profile.d/spunto-features.sh
+. "$DIR/env.sh"
+# A build stops here: what is on disk now is what the provider freezes.
+if [ "$MODE" = "bake-only" ]; then echo "[spunto] recipe baked"; exit 0; fi
+echo "[spunto] running the worker script"
+exec bash "$DIR/worker.sh"

package/src/script/setup-script.ts

@@ -103,16 +103,6 @@ type CloneRepo = {
   branch?: string
 }
 
-/**
- * How a feature's entrypoint is started: without the OpenTelemetry variables the platform gives the
- * workload. An entrypoint is infrastructure — dockerd, containerd — and Docker instruments itself as
- * soon as `OTEL_EXPORTER_OTLP_ENDPOINT` exists: every internal gRPC call of a docker-in-docker
- * daemon became a span (~60 000 per quarter hour for three sandboxes, 2026-10-18), drowning the
- * project's own services in its organization's telemetry. The project's processes keep them.
- */
-export const ENTRYPOINT_WITHOUT_OTEL =
-  "env -u OTEL_EXPORTER_OTLP_ENDPOINT -u OTEL_EXPORTER_OTLP_TRACES_ENDPOINT -u OTEL_EXPORTER_OTLP_METRICS_ENDPOINT -u OTEL_EXPORTER_OTLP_LOGS_ENDPOINT -u OTEL_EXPORTER_OTLP_PROTOCOL -u OTEL_EXPORTER_OTLP_HEADERS -u OTEL_RESOURCE_ATTRIBUTES -u OTEL_SERVICE_NAME"
-
 /**
  * Branch actually checked out for a repo: the worker-level choice (made at creation, applies to
  * every repo of the project) wins over the project-level default carried by the repository itself.
@@ -1150,7 +1140,7 @@ export function buildSetupScript(params: SetupScriptParams): { script: string }
       "  while IFS= read -r _ep; do",
       '    if [ -f "$_ep" ]; then',
       '      echo "Starting entrypoint: $_ep"',
-      '      ' + ENTRYPOINT_WITHOUT_OTEL + ' "$_ep" &',
+      '      "$_ep" &',
       "    fi",
       "  done < " + FEATURE_ENTRYPOINTS_FILE,
       "fi",
@@ -1316,7 +1306,7 @@ export function buildStartScript(params: StartScriptParams): { script: string; h
     "  while IFS= read -r _ep; do",
     '    if [ -f "$_ep" ]; then',
     '      echo "Starting entrypoint: $_ep"',
-    '      ' + ENTRYPOINT_WITHOUT_OTEL + ' "$_ep" &',
+    '      "$_ep" &',
     "    fi",
     "  done < " + FEATURE_ENTRYPOINTS_FILE,
     "fi",
@@ -1490,12 +1480,12 @@ export function buildStartScript(params: StartScriptParams): { script: string; h
 // The functions below power the *new* model where the agent (not the container) drives setup:
 // `buildContainerScript` is the passive CMD (serve code-server + stay alive, no setup, no status
 // machinery), and `buildSetupPlan` returns the ordered phases the agent execs one by one, each
-// wrapped in a native OTel span. The legacy `buildWorkerScript`/`buildSetupScript`/`buildStartScript`
+// wrapped in its own try/catch. The legacy `buildWorkerScript`/`buildSetupScript`/`buildStartScript`
 // above are left untouched — the runner picks the path by flag, defaulting to legacy. See RFC 0017.
 
-/** One setup phase the agent execs via `docker exec`, wrapped in a native OTel span. */
+/** One setup phase the agent execs via `docker exec`. */
 export type SetupPhase = {
-  /** Timing-key / span-suffix (`setup.<id>`) and the phase's short identity. */
+  /** Timing key and the phase's short identity. */
   id: "credentials" | "shell" | "dotfiles" | "skills" | "clone" | "postCreate" | "postStart"
   /** Human label for logs. */
   label: string
@@ -1510,7 +1500,7 @@ export type SetupPhase = {
 
 // The passive container CMD. Same "serve + stay alive" blocks as buildStartScript (SSH, feature
 // entrypoints, env persistence, extensions, code-server settings + restart loop) — MINUS the setup
-// status machinery, the lifecycle commands and any OTLP/timing emission (the agent owns all of that
+// status machinery, the lifecycle commands and any timing emission (the agent owns all of that
 // now). Ends by signalling readiness (`.mp-container-up`) then `wait`. Blocks are duplicated from
 // buildStartScript on purpose: the legacy path stays byte-identical (prod default) until it's
 // deleted once WORKER_SETUP_ORCHESTRATOR=agent becomes the default. See RFC 0017 §2.1.
@@ -1569,7 +1559,7 @@ export function buildContainerScript(params: StartScriptParams): { script: strin
     "  while IFS= read -r _ep; do",
     '    if [ -f "$_ep" ]; then',
     '      echo "Starting entrypoint: $_ep"',
-    '      ' + ENTRYPOINT_WITHOUT_OTEL + ' "$_ep" &',
+    '      "$_ep" &',
     "    fi",
     "  done < " + FEATURE_ENTRYPOINTS_FILE,
     "fi",
@@ -1724,9 +1714,6 @@ export function buildWorkerScript(params: {
     "  local now; now=\"$(_mp_now)\"",
     "  if [ -s \"$_MP_TFILE\" ]; then printf ',' >> \"$_MP_TFILE\"; fi",
     "  printf '\"%s\":%s' \"$1\" \"$now\" >> \"$_MP_TFILE\" || true",
-    // Native OTel: emit this phase transition as a real OTLP span through the node
-    // collector (|| true + suspends set -e inside the fn — telemetry never breaks setup).
-    "  _mp_span_on_stamp \"$1\" \"$now\" || true",
     "}",
     // mp-status.json lives in the home dir (persistent volume), not /tmp — when a
     // DinD feature starts dockerd in the background, /tmp's mount visibility can
@@ -1743,70 +1730,14 @@ export function buildWorkerScript(params: {
     "  printf '%s' \"$j\" > " + workerStatusPath("/home/vscode") + " || true",
     "}",
     "",
-    // ── Native OTel setup spans (emitted by this script, not backdated in the API) ──
-    // Each phase is emitted as a real OTLP span to the node agent's collector (the
-    // auto-injected OTEL_EXPORTER_OTLP_ENDPOINT); the agent forwards to /otlp where org.id
-    // /node.id are stamped server-side. MP_SETUP_TRACEPARENT (the job.worker.spawn span,
-    // injected by the runner) gives the traceId + parent span, so the whole `worker.setup`
-    // subtree nests under the spawn trace. No trace context (or no curl) → silently skipped.
-    "MP_TRACE_ID=''; MP_JOB_SPAN=''",
-    "if [ -n \"${MP_SETUP_TRACEPARENT:-}\" ]; then",
-    "  MP_TRACE_ID=$(printf '%s' \"$MP_SETUP_TRACEPARENT\" | cut -d- -f2)",
-    "  MP_JOB_SPAN=$(printf '%s' \"$MP_SETUP_TRACEPARENT\" | cut -d- -f3)",
-    "fi",
-    "MP_SETUP_SPAN=''; MP_SETUP_START=''; MP_PREV_PHASE=''; MP_PREV_TS=''",
     // Failure-trap state. _MP_DONE flips to 1 once setup+start reach `ready` (see buildStartScript),
     // disarming _mp_fail so a normal container stop / code-server hiccup after ready never looks like
     // a setup failure. _MP_LAST holds the most recent status JSON (set by _mp) for the error re-emit.
     "_MP_DONE=0; _MP_LAST=''",
-    "_mp_rand_id() { od -An -tx1 -N8 /dev/urandom 2>/dev/null | tr -d ' \\n'; }",
-    "_mp_phase_span_name() {",
-    "  case \"$1\" in",
-    "    initializing) echo 'setup.initialize' ;;",
-    "    credentials) echo 'setup.credentials' ;;",
-    "    shell) echo 'setup.shell' ;;",
-    "    cloning) echo 'setup.clone' ;;",
-    "    postCreate) echo 'setup.postCreate' ;;",
-    "    postStart) echo 'setup.postStart' ;;",
-    "    *) echo \"setup.$1\" ;;",
-    "  esac",
-    "}",
-    // Emit one OTLP/HTTP JSON span, backgrounded + short timeout so it never adds latency
-    // to (or blocks) the setup path. Args: name start_ms end_ms span_id parent_span_id phase.
-    "_mp_span_emit() {",
-    "  if [ -z \"$MP_TRACE_ID\" ] || [ -z \"${OTEL_EXPORTER_OTLP_ENDPOINT:-}\" ]; then return 0; fi",
-    "  if ! command -v curl >/dev/null 2>&1; then return 0; fi",
-    // Optional $7 = error message and $8 = exit code turn this into a native ERROR span
-    // (OTel status code 2 + a setup.exit_code attribute) — that's what makes a failed
-    // clone/postCreate/postStart show up red in the waterfall instead of as a hole.
-    "  local name=\"$1\" s_ns=$(( $2 * 1000000 )) e_ns=$(( $3 * 1000000 )) sid=\"$4\" pid=\"$5\" phase=\"$6\" errmsg=\"${7:-}\" ecode=\"${8:-}\" dur=$(( $3 - $2 )) attrs='' status=''",
-    "  if [ -n \"$phase\" ]; then attrs=\"{\\\"key\\\":\\\"setup.phase\\\",\\\"value\\\":{\\\"stringValue\\\":\\\"$phase\\\"}},{\\\"key\\\":\\\"setup.duration_ms\\\",\\\"value\\\":{\\\"intValue\\\":\\\"$dur\\\"}}\"; fi",
-    "  if [ -n \"$ecode\" ]; then [ -n \"$attrs\" ] && attrs=\"$attrs,\"; attrs=\"${attrs}{\\\"key\\\":\\\"setup.exit_code\\\",\\\"value\\\":{\\\"intValue\\\":\\\"$ecode\\\"}}\"; fi",
-    "  if [ -n \"$errmsg\" ]; then status=\",\\\"status\\\":{\\\"code\\\":2,\\\"message\\\":\\\"$errmsg\\\"}\"; fi",
-    "  local body=\"{\\\"resourceSpans\\\":[{\\\"resource\\\":{\\\"attributes\\\":[{\\\"key\\\":\\\"service.name\\\",\\\"value\\\":{\\\"stringValue\\\":\\\"spunto-worker\\\"}},{\\\"key\\\":\\\"spunto.worker.slug\\\",\\\"value\\\":{\\\"stringValue\\\":\\\"${WORKER_SLUG:-}\\\"}}]},\\\"scopeSpans\\\":[{\\\"scope\\\":{\\\"name\\\":\\\"spunto.setup\\\"},\\\"spans\\\":[{\\\"traceId\\\":\\\"$MP_TRACE_ID\\\",\\\"spanId\\\":\\\"$sid\\\",\\\"parentSpanId\\\":\\\"$pid\\\",\\\"name\\\":\\\"$name\\\",\\\"kind\\\":1,\\\"startTimeUnixNano\\\":\\\"$s_ns\\\",\\\"endTimeUnixNano\\\":\\\"$e_ns\\\",\\\"attributes\\\":[$attrs]$status}]}]}]}\"",
-    "  ( curl -s -m 3 -o /dev/null -X POST \"$OTEL_EXPORTER_OTLP_ENDPOINT/v1/traces\" -H 'Content-Type: application/json' -d \"$body\" || true ) &",
-    "}",
-    // Called on each new phase stamp. The first stamp opens the `worker.setup` window; every
-    // later stamp closes the previous phase as a child span; `ready` also emits the parent.
-    "_mp_span_on_stamp() {",
-    "  if [ -z \"$MP_TRACE_ID\" ]; then return 0; fi",
-    "  local key=\"$1\" now=\"$2\"",
-    "  if [ -z \"$MP_SETUP_SPAN\" ]; then",
-    "    MP_SETUP_SPAN=$(_mp_rand_id); MP_SETUP_START=\"$now\"; MP_PREV_PHASE=\"$key\"; MP_PREV_TS=\"$now\"; return 0",
-    "  fi",
-    "  _mp_span_emit \"$(_mp_phase_span_name \"$MP_PREV_PHASE\")\" \"$MP_PREV_TS\" \"$now\" \"$(_mp_rand_id)\" \"$MP_SETUP_SPAN\" \"$MP_PREV_PHASE\"",
-    "  if [ \"$key\" = ready ]; then",
-    "    _mp_span_emit 'worker.setup' \"$MP_SETUP_START\" \"$now\" \"$MP_SETUP_SPAN\" \"$MP_JOB_SPAN\" ''",
-    "  else",
-    "    MP_PREV_PHASE=\"$key\"; MP_PREV_TS=\"$now\"",
-    "  fi",
-    "}",
-    // ── Native error spans on setup failure (the direct goal of this refactor) ──
+    // ── Setup failure trap ──
     // set -e makes any uncaught failure abort the CMD; before PR #115 that just left the worker
-    // stuck at its last status with a hole in the trace. This EXIT trap turns that same failure
-    // into: (1) a real OTLP span in ERROR (status code 2 + exit code + the in-flight phase), so the
-    // failing clone/postCreate/postStart shows up red under worker.setup, and (2) a phase=error
-    // status write so the API poller flips the worker to `error` with a message. It fires only on a
+    // stuck at its last status. This EXIT trap turns that same failure into a phase=error status
+    // write so the API poller flips the worker to `error` with a message. It fires only on a
     // non-zero exit and only before `ready` (_MP_DONE guards the normal path); the short sleep lets
     // the 1.5s poll read the error status before the container exits.
     "_mp_fail() {",
@@ -1816,26 +1747,13 @@ export function buildWorkerScript(params: {
     "  [ \"$_MP_DONE\" = 1 ] && return 0",
     "  [ \"$code\" = 0 ] && return 0",
     "  _MP_DONE=1",
-    "  local phase now msg j",
-    "  phase=\"$MP_PREV_PHASE\"",
-    "  [ -z \"$phase\" ] && phase=$(printf '%s' \"$_MP_LAST\" | sed -n 's/.*\"phase\":\"\\([^\"]*\\)\".*/\\1/p')",
+    "  local phase msg j",
+    "  phase=$(printf '%s' \"$_MP_LAST\" | sed -n 's/.*\"phase\":\"\\([^\"]*\\)\".*/\\1/p')",
     "  [ -z \"$phase\" ] && phase=initializing",
-    "  now=\"$(_mp_now)\"",
     // A phase that knows *why* it failed (e.g. a clone on a branch that doesn't exist) sets
     // MP_FAIL_MSG before exiting, so the UI shows that instead of the generic phase message.
     "  msg=\"${MP_FAIL_MSG:-setup phase $phase failed (exit $code)}\"",
     "  echo \"[setup] ✗ $msg\" >&2",
-    // Best-effort error spans: close the failing phase (child of worker.setup) then worker.setup
-    // itself in ERROR. On a restart (postStart failure) the setup window was never opened, so emit
-    // a single worker.setup error span under the job span instead.
-    "  if [ -n \"$MP_TRACE_ID\" ]; then",
-    "    if [ -n \"$MP_SETUP_SPAN\" ]; then",
-    "      _mp_span_emit \"$(_mp_phase_span_name \"$phase\")\" \"${MP_PREV_TS:-$now}\" \"$now\" \"$(_mp_rand_id)\" \"$MP_SETUP_SPAN\" \"$phase\" \"$msg\" \"$code\"",
-    "      _mp_span_emit 'worker.setup' \"${MP_SETUP_START:-$now}\" \"$now\" \"$MP_SETUP_SPAN\" \"$MP_JOB_SPAN\" '' \"$msg\" \"$code\"",
-    "    else",
-    "      _mp_span_emit 'worker.setup' \"${MP_PREV_TS:-$now}\" \"$now\" \"$(_mp_rand_id)\" \"$MP_JOB_SPAN\" \"$phase\" \"$msg\" \"$code\"",
-    "    fi",
-    "  fi",
     // Flip .mp-status.json to phase=error (preserving the rest) so monitorSetup surfaces it.
     "  j=\"$_MP_LAST\"",
     "  if [ -n \"$j\" ]; then",
@@ -1865,10 +1783,10 @@ export function buildWorkerScript(params: {
 
 // ─── buildSetupPlan (RFC 0017) ─────────────────────────────────────────────────
 //
-// The ordered phases the agent execs one by one (each in its own `docker exec` + OTel span) when
+// The ordered phases the agent execs one by one (each in its own `docker exec`) when
 // WORKER_SETUP_ORCHESTRATOR=agent. Reuses the exact bash blocks from buildSetupScript/buildStartScript
-// (clone strategies, oh-my-zsh, dotfiles, lifecycle) MINUS the `_mp`/`_mp_stamp`/OTLP machinery — the
-// agent owns status + spans now. Each phase carries the SetupStatus to persist at its start/end
+// (clone strategies, oh-my-zsh, dotfiles, lifecycle) MINUS the `_mp`/`_mp_stamp` machinery — the
+// agent owns status now. Each phase carries the SetupStatus to persist at its start/end
 // (mirrors the legacy `mkStatus(...)` writes) so the DB/UI progression is identical. See RFC 0017 §2.2.
 
 export function buildSetupPlan(params: SetupScriptParams): {