You are adding the Babco Control Plane automatic connector to this application's backend.

Read every file in this ZIP before modifying code. The source under `connector/` is the approved connection capability. Do not redesign its cryptographic handshake and do not ask me for any Control Plane credential.

OBJECTIVE

Install the connector so this deployed application automatically:

1. creates a signed Control Plane connection request;
2. waits non-blockingly for administrator approval;
3. retrieves the approved scoped credential only as an encrypted envelope;
4. reports every server-side OpenAI response to the Control Plane;
5. retrieves its own official OpenAI usage and cost reconciliation.

IMPLEMENTATION

1. Vendor `connector/` into an internal backend package or library location.
2. Integrate `BabcoControlPlaneConnector` into the backend composition root.
3. Supply:
   - displayName
   - slug
   - environment
   - requestedBy/team
   - providerProjectId from the deployed app's existing OPENAI_PROJECT_ID
   - providerProjectName when known
   - non-sensitive hosting metadata
4. Choose a protected persistent backend directory for connector state.
   - It must survive restarts and deployments.
   - It must not be committed to Git.
   - It must not be exposed through HTTP or static files.
   - Reuse the application's existing persistent secret/evidence storage pattern where appropriate.
5. Start `checkConnection()` in a background startup task. Never block application startup or health checks.
6. While pending, log only request ID, verification code, and status.
7. Poll the same request periodically. Do not generate repeated application identities.
8. After approval, let the connector retrieve and decrypt the envelope automatically.
9. Route all existing server-side OpenAI usage through `reportUsage()`.
10. Preserve the application's existing durable outbox and request-ID deduplication behavior.
11. Add a backend service or protected endpoint using `getReconciliation()`.
12. Use `official.costUsd` as the authoritative final OpenAI cost.
13. Handle reconciliation statuses: not-synced, official-only, matched, and review.
14. Add tests for:
    - first request creation;
    - idempotent polling;
    - pending state;
    - encrypted approval activation;
    - restart with persisted connector state;
    - usage reporting;
    - reconciliation retrieval;
    - no secret in logs, source, browser bundles, or API responses.

DO NOT

- ask me to paste a Control Plane key;
- manually configure BABCO_CONTROL_APPLICATION_ID or BABCO_CONTROL_APPLICATION_KEY;
- call OpenAI organization Usage, Costs, or Projects APIs;
- log the private key, poll token, credential envelope, or decrypted credential;
- weaken existing tests;
- allow telemetry failure to break a successful user operation.

DEPLOYMENT HANDOFF

Deploy the tested backend version, then report:

1. branch, PR, merge commit, and deployment artifact;
2. deployed backend resource;
3. protected persistent connector-state location;
4. OpenAI project ID/name used;
5. verification code shown by the deployed app;
6. tests passed;
7. whether the request is visible in the live Control Plane;
8. the exact remaining owner action.

The expected remaining owner action is:

Open https://babco-labs-control-9cb297fb.azurewebsites.net/connections, find the matching verification code, select the exact application/environment, and tap **Approve connection**.
