feat: implement Level 3 distributed tracing — content capture

[dhshah13]

What this tracks

Implementation of Level 3 distributed tracing — content capture in spans — per the activation contract in ADR 0084 (PR #5947). Sibling of #2577 (Level 1) and #2862 (Level 2).

Level 1 and Level 2 are live: every run produces run-telemetry.jsonl, and OTLP export ships metadata spans to any configured backend. Level 3 adds prompt/message/tool content to the existing per-iteration agent spans, gated by dual consent (operator env + per-agent harness) plus an allow-listed destination, fail-closed on unsatisfiable capture requests, with secret redaction at assembly and no reasoning capture.

Preconditions (gate real content flowing, not implementation)

• Governance sign-off owner named — who records that a backend's access controls suit captured content, and where the record lives
• Scoped sign-off recorded for the non-production validation backend (first pilot host on the allow-list)
• telemetry: MLflow trace columns (Name/Session/User/Source) blank; token & cost omit cache tokens #5361 data-quality legs resolved (the 2026-07-23 restriction on tracing scope keys on it)
• Retention decision for content-bearing traces (Define trace granularity and retention policy for agent reasoning traces #294)

Phased plan

1. Rendering spike against the non-prod MLflow (post-fix(telemetry)!: respect OTEL variables default behaviour #5562 export environment): verify JSON-string GenAI attributes render as span inputs/outputs, and which span feeds the trace-list preview — no fullsend code
2. Sandbox env denylist (tracked separately — ADR 0085's implementation issue)
3. Gates and export guards: env-mode parsing, harness telemetry.content_capture, endpoint allow-list, metadata allow-list on the file exporter, redaction-marker check on the OTLP path — merges inert
4. Capture pipeline: transcript parsing to GenAI message attributes behind a runtime content adapter, redaction at assembly with findings, caps and truncation
5. Validation-environment e2e + pilot agents, building on the otlpsink wire-test harness

Every implementation PR merges inert: without the allow-list org variable, no capture request can succeed.

Out of scope

Reasoning/thinking capture (excluded by ADR 0084; extending scope requires a new ADR), backend-specific attribute coupling, and the quality-evaluation tier (ADR 0050's scope boundary).

Relates to #2862, #5361, #294.

[fullsend-ai-prioritize]

RICE Priority Score: 0.79

Score breakdown

Dimension	Score	Reasoning
Reach	1.5	Level 3 content capture builds on platform-wide tracing infrastructure (Level 1 and 2 are already live for every run). Content capture is opt-in via dual consent and allow-listed destinations, so not all users will enable it immediately, but observability into prompt/message/tool content is valuable across multiple orgs running agents. Scored as affecting multiple strategic customers who need deeper debugging and monitoring.
Impact	1.5	Adding prompt, message, and tool content to tracing spans is a significant improvement for debugging and monitoring agent behavior. Users currently have metadata-only spans (Level 2); seeing actual content in traces addresses a meaningful pain point in diagnosing agent issues. However, Level 1 and 2 tracing already provide useful observability, so this is an enhancement rather than unblocking a blocked workflow.
Confidence	0.7	The issue is exceptionally well-structured with a clear phased plan, explicit preconditions, references to ADRs (0084, 0085), and well-defined scope boundaries. However, no labels, milestone, or comments provide additional signal, and without customer research data the reach estimate is based on general inference about observability demand.
Effort	2	This is a multi-phase implementation spanning gates/export guards (env-mode parsing, harness config, endpoint allow-list, metadata allow-list, redaction-marker checks on OTLP path) and a capture pipeline (transcript parsing, GenAI message attributes, redaction at assembly, caps/truncation). It also has four governance and data-quality preconditions that must be cleared before content can flow. The security surface (secret redaction, consent gates, fail-closed semantics) adds coordination and review overhead.

Formula: (1.5 x 1.5 x 0.7) / 2 = 0.79

[dhshah13]

Closing — the activation contract this depended on was dropped with #5947. Level 3 stays unimplemented; if it is picked up, activation semantics get decided fresh against the surface as it stands then.