chore: drop python/, link fork analysis, track otel-upstream

- Remove python/ entirely. Only nodejs layers ship; if Python
  autoinstrumentation is needed later, start from origin/python-instrumentation.
  Drop the commented-out pip block in dependabot.yml and the python/README.md
  link in README.md.
- UPSTREAM.md: replace the scratch-path reference to the fork-research doc
  with the Confluence page link. Add remote-setup block (remotes aren't
  checked in, fresh clones only have origin). Add a third fork-points row
  for open-telemetry/opentelemetry-lambda with the tag (layer-nodejs/0.10.0,
  c9e67c4) coralogix last merged in via 436f3d0. Add sync block + note that
  coralogix absorbs upstream-upstream selectively (tags or cherry-picks) so
  the sync skill should walk by patch-id, not merge-base.
- .gitignore: add .claude/worktrees/ and extend/plan-*.md so transient agent
  scaffolding doesn't leak into commits again.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jmsundar

.github/dependabot.yml

@@ -54,21 +54,6 @@ updates:
         patterns:
           - "*"
 
-  # - package-ecosystem: "pip"
-  #   directories:
-  #     - "/python/src/otel"
-  #     - "/python/src/otel/otel_sdk"
-  #     - "/python/src/otel/tests"
-  #   schedule:
-  #     interval: "weekly"
-  #   groups:
-  #     opentelemetry-deps-python:
-  #       patterns:
-  #         - "opentelemetry-*"
-  #     python-other:
-  #       patterns:
-  #         - "*"
-
 registries:
   codeartifact:
     type: npm-registry

.gitignore

@@ -31,3 +31,6 @@ build-sandbox/
 
 .envrc
 mise.toml
+
+.claude/worktrees/
+extend/plan-*.md

README.md

@@ -8,9 +8,9 @@ Ticket: [DEVOPS-2394](https://helloextend.atlassian.net/browse/DEVOPS-2394).
 
 ## Scope
 
-This fork supports **Node.js** and **Python** runtimes only. Upstream's Java, .NET, Ruby, and Go Lambda layers have been removed — we don't ship them and don't need to track their CI.
+This fork ships **Node.js** Lambda layers only. Upstream's Python, Java, .NET, Ruby, and Go layers have been removed — we don't build them. If we need Python autoinstrumentation later, start from `origin/python-instrumentation` rather than reviving the upstream dir.
 
-The collector extension (in `collector/`) is language-agnostic and powers both Node.js and Python layers.
+The collector extension (in `collector/`) is language-agnostic.
 
 ## Layout
 
@@ -19,7 +19,6 @@ The collector extension (in `collector/`) is language-agnostic and powers both N
 | `collector/` | Go collector extension + Makefile (`package-extend` target) |
 | `extend/` | Extend-specific collector configs + README for consumers |
 | `nodejs/` | Node.js wrapper + cx-wrapper package |
-| `python/` | Python wrapper |
 | `scripts/` | Build & dev scripts (`build_nodejs_layer.sh`, `publish-sandbox.sh`, `check_size.sh`, `build-nodejs.sh`, `deploy-nodejs.sh`) |
 | `.github/workflows/publish-extend-otel-layer.yml` | Extend publish pipeline (Node.js + collector layer) |
 | `UPSTREAM.md` | Fork point + upstream sync status |
@@ -55,4 +54,4 @@ Tracked in [`UPSTREAM.md`](UPSTREAM.md). DEVOPS-2502: automate via a repo-level
 
 ## Contributing
 
-Internal docs: [`extend/README.md`](extend/README.md), [`collector/README.md`](collector/README.md), [`nodejs/README.md`](nodejs/README.md), [`python/README.md`](python/README.md).
+Internal docs: [`extend/README.md`](extend/README.md), [`collector/README.md`](collector/README.md), [`nodejs/README.md`](nodejs/README.md).

UPSTREAM.md

@@ -4,46 +4,66 @@ This repo is a fork of [`coralogix/opentelemetry-lambda`](https://github.com/cor
 
 We also consume [`coralogix/opentelemetry-js-contrib`](https://github.com/coralogix/opentelemetry-js-contrib) (branch `coralogix-autoinstrumentation`) at build time — pinned separately in `scripts/publish-sandbox.sh` and `.github/workflows/publish-extend-otel-layer.yml`.
 
-Why we fork cx-contrib: upstream OpenTelemetry has declined the Lambda-specific PRs (trigger subsystem, early-spans-on-timeout, `cx.internal.*` reconciliation attrs — see contrib#1349, contrib#1295, contrib#1309). See `~/workspace/scratch/otel-fork-research/summary.md` for the full rationale.
+Why we fork cx-contrib: upstream OpenTelemetry has declined the Lambda-specific PRs (trigger subsystem, early-spans-on-timeout, `cx.internal.*` reconciliation attrs — see contrib#1349, contrib#1295, contrib#1309). Full rationale: [DEVOPS-2394: OTel Lambda fork analysis](https://helloextend.atlassian.net/wiki/spaces/ENG/pages/3529080850/DEVOPS-2394+OTel+Lambda+fork+analysis).
 
 ## Fork points
 
 | Upstream | Branch | Fork SHA | Forked on |
 |---|---|---|---|
 | `coralogix/opentelemetry-lambda` | `coralogix-nodejs-autoinstrumentation` | `8838714287b2d8a1d1c037b5f098f9bd96e8fdd3` | 2026-03-12 |
 | `coralogix/opentelemetry-js-contrib` | `coralogix-autoinstrumentation` | `3a9691a699ddd06c3644eec70bf4b50cc4217ba3` | 2026-04-18 |
+| `open-telemetry/opentelemetry-lambda` | `main` @ tag `layer-nodejs/0.10.0` | `c9e67c4d8e208000ddbcbab0b8cfe56fc5cf58b6` | 2024-09-24 |
 
-Upstream remote in this repo is configured as `upstream` → `coralogix/opentelemetry-lambda`:
+The `open-telemetry/...` row is transitive — last time Coralogix pulled from OTel-upstream into `coralogix-nodejs-autoinstrumentation` was merge commit [`436f3d0`](https://github.com/coralogix/opentelemetry-lambda/commit/436f3d0) (`Merge tag 'layer-nodejs/0.10.0' into merge`, 2024-10-28), whose second parent is `c9e67c4`. To catch up, start walking OTel-upstream from that SHA:
+
+```
+https://github.com/open-telemetry/opentelemetry-lambda/compare/c9e67c4...main
+```
+
+~416 OTel-`main` commits have landed since. Coralogix merges selectively — whole tags (`436f3d0`) or cherry-picks that rewrite SHAs — so don't rely on `git merge-base` alone when checking what's already in. The sync skill (DEVOPS-2502) should diff by `git patch-id` across the walk.
+
+## Remote setup (one-time, per clone)
+
+Remotes aren't checked into the repo. After cloning, run:
 
 ```bash
-git remote -v | grep upstream
-# upstream  https://github.com/coralogix/opentelemetry-lambda.git (fetch)
-# upstream  https://github.com/coralogix/opentelemetry-lambda.git (push)
+git remote add upstream       https://github.com/coralogix/opentelemetry-lambda.git
+git remote add otel-upstream  https://github.com/open-telemetry/opentelemetry-lambda.git
+git fetch upstream otel-upstream
 ```
 
 ## Manual sync process
 
-Until the sync skill lands (see DEVOPS-2502), upstream changes are pulled in manually:
+Until the sync skill lands (see DEVOPS-2502), upstream changes are pulled in manually. Walk both upstreams — coralogix adds CX-specific features; open-telemetry adds core fixes/security patches that coralogix hasn't yet absorbed.
+
+**coralogix/opentelemetry-lambda** (direct parent):
 
 ```bash
 git fetch upstream
 git log 8838714287b2d8a1d1c037b5f098f9bd96e8fdd3..upstream/coralogix-nodejs-autoinstrumentation --oneline
-# review each commit for relevance — most upstream churn is CX-internal or
-# language-specific (Java/Ruby/.NET/Go) and doesn't affect our layer
+# most churn here is CX-internal or language-specific (Java/Ruby/.NET/Go) — skip those
 ```
 
-After pulling upstream changes, bump the fork SHA row in this file and note the date.
+**open-telemetry/opentelemetry-lambda** (upstream-upstream):
 
-For `coralogix/opentelemetry-js-contrib`:
+```bash
+git fetch otel-upstream
+git log c9e67c4d8e208000ddbcbab0b8cfe56fc5cf58b6..otel-upstream/main --oneline -- nodejs/ collector/
+# scope the path filter to dirs we ship; Node wrapper + collector only
+```
+
+**coralogix/opentelemetry-js-contrib** (build-time dep):
 
 ```bash
-cd .build-cache/opentelemetry-js-contrib  # or your override path
+cd .build-cache/opentelemetry-js-contrib  # or your OPENTELEMETRY_JS_CONTRIB_PATH override
 git fetch origin
 git log 3a9691a699ddd06c3644eec70bf4b50cc4217ba3..origin/coralogix-autoinstrumentation --oneline
 ```
 
-When bumping, update **both** places in sync:
+After pulling changes, bump the matching row in the fork-points table. When bumping the cx-contrib SHA specifically, update **three** places in sync:
+
 - `scripts/publish-sandbox.sh` → `CX_CONTRIB_SHA`
+- `scripts/build-nodejs.sh` → `CX_CONTRIB_SHA`
 - `.github/workflows/publish-extend-otel-layer.yml` → `ref:` on the cx-contrib checkout step
 - This file's fork-points table
 
@@ -55,5 +75,6 @@ The following language-specific upstream directories were removed in this fork 
 - `java/`
 - `ruby/`
 - `go/` (Go-language Lambda layer; the Go collector build in `collector/` is unrelated)
+- `python/` — if Python autoinstrumentation is needed, start from `origin/python-instrumentation`, not the upstream dir
 
 If upstream eventually adds new languages, decide fork-in vs drop at sync time.