fix(telemetry): OneCollector iKey wire format and 4xx handling

[timenick]

Summary

Three telemetry fixes that came out of debugging a persistent
InvalidTenantToken 401 from OneCollector, plus a small consent-prompt
rebrand.

1. Wire-format bug (the actual cause of the 401)

The exporter was embedding the full instrumentation key in both the
x-apikey HTTP header AND the envelope's iKey field. OneCollector
expects the envelope iKey in o:<tenant_token> form (just the prefix
before the first -); sending the full ikey there gets the request
rejected with Collector-Error: Invalid Tenant Token. This silently
401-ed every event since telemetry shipped — clients don't notice
because all telemetry errors are swallowed.

serialization._envelope_ikey() now derives o:<tenant_token> from the
full ikey; the exporter calls it once at __init__ and embeds the
result in every envelope. x-apikey still carries the full ikey.

2. kill-tokens directive ignored

When OneCollector decides our tenant is misbehaving (e.g. unknown to
the tenant directory), it returns kill-tokens: o:<token>:all plus
kill-duration: N telling the client to back off for N seconds. We
were ignoring both, retrying every batch and every process startup —
exactly the noisy-client behavior the directive exists to suppress.

The exporter now parses both headers, records the kill window, and
short-circuits exports during it. Envelopes for the kill window are
dropped, not cached — caching them just guarantees forever-failure
on the next startup within the window.

3. DEBUG log on non-2xx was unactionable

Previously logged only the status code. Now also includes the
Collector-Error response header and a 200-byte body excerpt — the
two pieces of info OneCollector uses to communicate the actual
rejection reason. Without these, diagnosing a tenant or wire-format
issue required a live probe round-trip.

4. Consent prompt rebrand

ModelKit → WinML CLI in the user-visible consent text.
_CONSENT_VERSION is unchanged because no scope changed.

Validation

Verified end-to-end against the live OneCollector ingest with a real
ikey: with the wire-format fix, a single Heartbeat envelope returns
status: 200, body: {"acc":1}. New unit tests cover the helper,
kill-tokens parsing, kill-window enforcement, log content, and a
regression guard that the full ikey never appears in the envelope
iKey field.

[DingmaomaoBJTU]

Code review

Found 1 issue:

1. exporter fixture leaks a requests.Session — it uses return instead of yield + shutdown(), so the session's connection pool is never closed. The same pattern was flagged in PR feat(telemetry): Phase 1 — OneCollector library + device ID foundation #367 and fixed for test_factory.py; the new fixture here has the same problem. OneCollectorLogExporter.__init__ creates a requests.Session, and shutdown() exists specifically to close it.

https://github.com/microsoft/WinML-ModelKit/blob/dd1a4f981c143751c10d3808e7b8f515b7fec25f/tests/unit/telemetry/library/test_exporter.py#L40-L53

Fix: change to yield + teardown:

@pytest.fixture
def exporter(tmp_path):
    cache = _PersistentCache(path=tmp_path / "modelkit.cache")
    exp = OneCollectorLogExporter(
        ikey="abc-def",
        endpoint="https://example.invalid/OneCollector/1.0/",
        cache=cache,
    )
    yield exp
    exp.shutdown()

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}