feat: support invocation-scoped GenAI identity

[fangxiu-wf]

Summary

• accept the exact gen_ai.session.id and gen_ai.user.id keys from LOONGSUITE_PILOT_SPAN_ATTRIBUTES for OpenCode, Claude Code, Qoder/Qoder-CN, and OpenClaw
• transport the values through adapter records and apply them centrally before JSONL, SLS, and trace output
• use the precedence invocation env > configured user id > agent-native identity > fallback user id, without changing native turn or step ids
• keep every other reserved gen_ai.* and user.* key blocked; Codex and Qwen Code CLI remain excluded from phase one
• document the behavior in English and Chinese

Validation

• targeted identity and adapter suites: 130 tests passed
• Qoder/Qoder-CN turn and all-span conversion suite: 3 tests passed
• npm run typecheck
• npm run build
• full npm test: 3202 passed, 50 skipped; one machine-local QwenWorkCN real-transcript test failed because the latest local transcript produced no llm.request. This test exercises local ~/.qwenworkcn data and no QwenWorkCN path is changed by this PR.

Closes #287

[linrunqi08]

[Medium] INVOCATION_IDENTITY_FIELD_MAP is duplicated in 4 files with no sync test to guard against drift.

影响: A future edit (e.g. adding a third identity key) could update one copy but miss the others, silently breaking identity passthrough for that agent with no CI signal. The existing RESERVED_PREFIXES sync test in this same file (which this PR correctly extended for openclaw) demonstrates the project expects drift guards for duplicated constants.

建议: Add a sibling test describe('invocation identity field map stays in sync across copies') that extracts the map from all 4 locations and asserts equality:

• assets/hooks/shared/resource-context.mjs (lines 23-26)
• assets/plugins/openclaw/plugin.mjs (lines 60-63)
• assets/plugins/opencode/plugin.mjs (lines 63-66)
• src/normalization/invocation-identity.ts (lines 13-14, constants)

Generated by LoongSuite-Pilot Code Review Agent

[linrunqi08]

🔍 Code Review Summary

Severity	Count
Critical	0
High	0
Medium	1
Low	3

Lifecycle Verdict

Check	Result
资源释放	PASS
死锁/卡死风险	PASS
状态恢复正确性	PASS
PowerShell CLM 合规	N/A

Merge Gate（合入门禁）

APPROVE-READY ✅

No Critical, High, or blocking Medium issues. The one Medium finding (F1: missing sync test for INVOCATION_IDENTITY_FIELD_MAP) is a test coverage gap for future drift prevention, not a current defect — all 4 copies are currently in sync. All Lifecycle Verdict items PASS.

Findings Summary

#	Severity	File	Issue
F1	Medium	resource-context.test.mjs	INVOCATION_IDENTITY_FIELD_MAP duplicated in 4 files with no sync test (unlike RESERVED_PREFIXES which has one)
F2	Low	openclaw/plugin.mjs, opencode/plugin.mjs	Over-long identity values silently dropped (no warning), unlike shared hook which logs warnSkip()
F3	Low	input-manager.ts:237	batchBytes computed before transport field stripping — minor metric inflation (no consumer today)
F4	Low	docs/trace-output.md	Cursor not mentioned in either phase-one supported or excluded agent lists

总体结论

Well-designed feature with clean transport-field separation, defense-in-depth reserved-key blocking, and comprehensive test coverage (130+ targeted tests). The applyInvocationIdentity() refactoring correctly preserves the existing user.id precedence chain. Pipeline ordering is correct (identity applied before trace linking). No new resources or lifecycle changes.

Recommendation: Merge as-is, address F1 (sync test) as a fast-follow.

Highlights（正向实践）

• Clean agent.pilot.invocation.* namespace avoids collisions with canonical fields
• Consume-and-delete pattern ensures transport fields never leak to output sinks
• Explicit allowInvocationIdentity opt-in flag for shared hook (non-opted-in agents still reject)
• RESERVED_PREFIXES sync test extended to include openclaw
• 130+ targeted test cases covering precedence chain, invalid values, reserved key blocking, and E2E

---

评审报告详见: code-review/pr-288/final-report.md
Generated by LoongSuite-Pilot Code Review Agent

[linrunqi08]

✅ Medium/High 及以上问题已全部确认为非阻断项（F1 是测试覆盖建议，当前 4 份副本一致），本轮评审通过（approved）。

建议合入后补充 INVOCATION_IDENTITY_FIELD_MAP 的同步测试作为 fast-follow。