Expose trustworthy raw JSONL telemetry from Codex Exec Action

Please provide a reviewed, immutable, pinned action revision that exposes trustworthy raw codex exec --json JSONL from the same child process and invocation.

The output must include exactly one terminal turn.completed usage record containing:

• input tokens
• cached-input tokens
• output tokens
• reasoning-output tokens

Please preserve:

• secret isolation and no credential leakage;
• existing privilege separation and sandbox protections;
• exactly one Codex invocation;
• zero retries;
• separate raw JSONL, stderr, and final-message handling;
• deterministic failure when telemetry is unavailable;
• no second CLI invocation, shell tee workaround, unpinned shim, fabricated telemetry, or weakened security boundary.

The downstream consumer must fail closed on malformed, missing, duplicate, negative, or incomplete usage records. Over-threshold observed API-equivalent cost must be reported as USAGE_ANOMALY, not a billing cap.

Required evidence:

• immutable action commit SHA;
• reviewed source diff;
• proof telemetry comes from the same child process and invocation;
• proof stdout JSONL is isolated from stderr and logs;
• proof secrets cannot enter the telemetry artifact;
• documented output schema and lifecycle;
• fixture tests for valid and invalid usage;
• proof exactly one terminal turn.completed record is enforced;
• proof no retry, second invocation, unpinned dependency, or privilege weakening is required;
• example workflow using the pinned revision without exposing credentials.

Begin by locating the action entry point and its current Codex invocation, then trace how stdout, stderr, logs, secrets, and final messages are handled. Done requires a pinned reviewed revision, documented schema and lifecycle, fixture coverage for valid and invalid usage, and evidence for one invocation, isolated telemetry, secret safety, fail-closed validation, and unchanged security boundaries.