From c49922d19bd90d68f5d7dcc6e2df49974b8c5578 Mon Sep 17 00:00:00 2001
From: David Haifley <david.haifley@solo.io>
Date: Thu, 17 Sep 2026 14:22:30 -0400
Subject: [PATCH 1/4] feat(tracing): add harness invocation identity,
 lifecycle, and bounded capture

Signed-off-by: David Haifley <david.haifley@solo.io>
---
 docs/architecture/README.md                   |   1 +
 docs/architecture/telemetry.md                | 132 ++++++
 go/adk/pkg/a2a/server/server.go               |  14 +-
 go/adk/pkg/a2a/server/tracing.go              |  76 ++--
 go/adk/pkg/a2a/server/tracing_test.go         | 311 +++++++++++++
 go/adk/pkg/app/app.go                         |  18 +-
 .../internal/translator/claude/compiler.go    |  16 +-
 .../translator/claude/compiler_test.go        |  62 +++
 go/core/internal/translator/codex/compiler.go |   5 +
 .../translator/codex/compiler_test.go         |  54 +++
 go/core/internal/translator/otel.go           |  37 +-
 go/core/test/e2e/tracing_test.go              |  73 ++-
 go/harness/claude/cmd/main.go                 |  14 +-
 go/harness/claude/config/config.go            |  19 +-
 go/harness/claude/config/config_test.go       |  50 ++-
 go/harness/claude/executor/executor.go        |  12 +-
 go/harness/claude/executor/executor_test.go   |   5 +-
 go/harness/claude/internal/adapter/adapter.go |   4 +
 .../claude/internal/adapter/adapter_test.go   |   2 +-
 go/harness/claude/internal/driver/process.go  |   3 +
 go/harness/codex/cmd/main.go                  |  14 +-
 go/harness/codex/config/config.go             |  19 +-
 go/harness/codex/config/config_test.go        |  29 ++
 go/harness/codex/executor/executor.go         |  11 +-
 go/harness/codex/executor/executor_test.go    |   5 +-
 go/harness/codex/internal/adapter/adapter.go  |   4 +
 go/harness/codex/internal/driver/process.go   |   6 +
 go/harness/runtime/a2a/executor.go            | 176 +++++++-
 go/harness/runtime/a2a/executor_test.go       |  21 +-
 go/harness/runtime/a2a/tracing_test.go        | 414 ++++++++++++++++++
 go/pkg/tracing/capture.go                     |  97 ++++
 go/pkg/tracing/capture_test.go                | 111 +++++
 go/pkg/tracing/invocation.go                  | 168 +++++++
 go/pkg/tracing/invocation_test.go             | 176 ++++++++
 go/pkg/tracing/runtime.go                     | 252 +++++++++++
 go/pkg/tracing/runtime_test.go                | 152 +++++++
 go/pkg/tracing/tracing.go                     |  34 +-
 37 files changed, 2490 insertions(+), 107 deletions(-)
 create mode 100644 docs/architecture/telemetry.md
 create mode 100644 go/adk/pkg/a2a/server/tracing_test.go
 create mode 100644 go/harness/runtime/a2a/tracing_test.go
 create mode 100644 go/pkg/tracing/capture.go
 create mode 100644 go/pkg/tracing/capture_test.go
 create mode 100644 go/pkg/tracing/invocation.go
 create mode 100644 go/pkg/tracing/invocation_test.go
 create mode 100644 go/pkg/tracing/runtime.go
 create mode 100644 go/pkg/tracing/runtime_test.go

diff --git a/docs/architecture/README.md b/docs/architecture/README.md
index 39fb422804..f5303ad03b 100644
--- a/docs/architecture/README.md
+++ b/docs/architecture/README.md
@@ -76,6 +76,7 @@ quiescence. It reaches Actors through the private runtime network.
 - [A2A agent tools](a2a-subagents.md)
 - [Human in the loop](human-in-the-loop.md)
 - [Prompt resolution](prompt-templates.md)
+- [Telemetry](telemetry.md)
 
 The documents describe implemented behavior. Deferred work, including full
 cross-AgentInstance delegation and Dedicated agents, belongs in the
diff --git a/docs/architecture/telemetry.md b/docs/architecture/telemetry.md
new file mode 100644
index 0000000000..bdb8502f16
--- /dev/null
+++ b/docs/architecture/telemetry.md
@@ -0,0 +1,132 @@
+# Telemetry
+
+Kagent exports OpenTelemetry traces from agent runtimes when a user enables
+them. This document describes what a runtime produces, so consumers can rely on
+it without reading runtime internals.
+
+## Enabling export
+
+The controller resolves telemetry from its own process environment and compiles
+the result into each runtime revision.
+
+| Variable | Effect |
+| --- | --- |
+| `OTEL_TRACING_ENABLED` | Enables trace export for compiled runtimes |
+| `OTEL_LOGGING_ENABLED` | Enables log export for compiled runtimes |
+| `OTEL_EXPORTER_OTLP_ENDPOINT` | Destination, with the usual signal-specific overrides |
+| `OTEL_EXPORTER_OTLP_PROTOCOL` | `grpc` or `http/protobuf`, with signal-specific overrides |
+| `KAGENT_OTEL_CAPTURE_SENSITIVE_CONTENT` | Enables bounded prompt and response capture. Off by default |
+| `KAGENT_OTEL_CAPTURE_RAW_API_BODIES` | Enables native raw provider body logging. Off by default |
+| `KAGENT_OTEL_MAX_CAPTURE_BYTES` | Bytes retained per captured prompt and per captured response. Defaults to 16 KiB, ceiling 64 KiB |
+
+An unusable capture budget is reported as a compilation warning and replaced by
+the default, so an observability setting cannot invalidate an AgentTemplate.
+
+Other `OTEL_*` variables remain available for per-Harness tuning through
+`Harness.spec.env`, including `OTEL_RESOURCE_ATTRIBUTES`.
+
+## The invocation span
+
+Each A2A `SendMessage` or `SendStreamingMessage` request opens one span named
+`a2a.request` in the instrumentation scope
+`github.com/kagent-dev/kagent/go/adk/pkg/a2a/server`. It represents one
+execution segment and is the anchor consumers should read. Model and tool spans
+come from the runtime itself and are descendants of it.
+
+| Attribute | Meaning |
+| --- | --- |
+| `a2a.method` | `SendMessage` or `SendStreamingMessage` |
+| `kagent.harness.kind` | `claude` or `codex`. Absent for ADK agents, which are not native harnesses |
+| `gen_ai.agent.name` | The compiled agent identity, `<template>-<harness>` |
+| `gen_ai.conversation.id` | The A2A context ID the gateway assigned |
+| `gen_ai.task.id` | The A2A task ID the gateway assigned |
+| `kagent.user_id` | The authenticated user, when the gateway forwarded one |
+| `a2a.task.state` | The state execution actually reported. Its absence does not mean success |
+| `kagent.invocation.segment` | `initial` or `resumed` |
+| `kagent.invocation.disposition` | `canceled`, `abandoned`, or `interrupted`, when the task state does not say it. See below |
+| `error.type` | A safe failure category. Never a provider response, credential, or captured content |
+| `kagent.input`, `kagent.output` | Bounded turn content, present only under the capture opt-in |
+| `kagent.input_truncated`, `kagent.output_truncated` | Whether that content was shortened |
+
+The runtime resource carries `service.name` and `service.namespace` from the
+compiled agent identity, plus `kagent.harness.kind` and `gen_ai.agent.name`. The
+adapter merges those last two into `OTEL_RESOURCE_ATTRIBUTES` for the native
+child process, so its spans report the same agent while keeping its own
+`service.name`. Conversation, task, and user identity never appear on a
+resource, since one runtime process serves many of each.
+
+## Completion and ownership
+
+The transport interceptor opens the span with the identity the runtime knows
+before execution begins, so a request rejected during validation still reports
+which agent rejected it. Execution then takes ownership, because a2a-go runs an
+executor detached from the caller and a unary response can be delivered while
+the turn is still working. Completion runs exactly once.
+
+For runtimes whose Actor may be suspended as soon as a quiescent event leaves
+the process, completion exports before that event is yielded. The export is
+bounded by `KAGENT_TRACE_FLUSH_TIMEOUT_MS`, three seconds by default, so an
+unreachable collector costs at most that budget once per segment.
+
+A segment records `abandoned` when the A2A event consumer stopped accepting
+events before execution finished, and `interrupted` when the execution context
+ended without a cancellation request. Neither is reported as cancellation, which
+is recorded only when a client asked for it. The consumer a runtime can observe
+is the A2A event pipe rather than the network client, so a client that merely
+closes a streaming subscription leaves execution running and is not visible
+here.
+
+Cancellation completes and exports the segment before the canceled event is
+published, since that event is what releases the gateway to suspend the Actor.
+
+## Approvals and resumed turns
+
+A turn that pauses for approval keeps the same native process. The trace context
+the native runtime received belongs to the request that started it, and neither
+native protocol offers a supported way to replace it when the turn resumes. Work
+the native runtime does after an approval therefore stays under the originating
+trace.
+
+Kagent does not paper over this. Each execution segment gets its own
+`a2a.request` span carrying the same conversation and task identity, and a
+resumed segment records an OpenTelemetry link back to the segment that parked
+it, with `kagent.invocation.relationship` set to `resume_origin`. A link states
+a relationship. It does not reparent spans and it does not transfer ownership of
+the token usage recorded under the originating segment. Consumers should expect
+several segments for one task and should not assume the last one owns the work.
+
+## Content capture
+
+Capture is off unless a user turns it on. When it is on, a segment records
+the current turn's prompt and the text that segment produced, each bounded by
+the configured byte budget, preserving UTF-8 and reporting truncation. Tool
+arguments, tool results, approval structures, the rest of the conversation, and
+native stderr are never recorded in these attributes. An approval decision stays
+structured outcome metadata rather than prompt text.
+
+Absent `kagent.input` and `kagent.output` mean capture is disabled. Present but
+empty means the segment produced no text.
+
+These attributes come from the Go wrapper, which is only one of the producers.
+Suppressing them does not establish privacy for native runtime events or log
+bodies, which have their own settings.
+
+## Rollout
+
+The compiled runtime configuration is versioned, and a runtime refuses a version
+it does not understand. Publish the controller and harness images from the same
+revision and move their pins together; a controller that is ahead of its pinned
+harness images compiles configurations those images reject.
+
+## Known limitations
+
+- Native span export completeness at process shutdown is a separate concern from
+  the Go wrapper's export, and is tracked against the native runtimes.
+- Ownership of native work started after an approval is ambiguous by
+  construction and is expressed as a link rather than asserted as a parent.
+- a2a-go dispatches execution before it reads the caller's subscription. A
+  caller that disconnects inside that window completes the invocation from the
+  transport side, so that request's span reports a transport error without
+  conversation or task identity while execution continues untraced.
+- A request rejected by a transport interceptor before execution begins has no
+  invocation span. Such a request never reaches an agent.
diff --git a/go/adk/pkg/a2a/server/server.go b/go/adk/pkg/a2a/server/server.go
index 788f0293d6..973a1aa8f5 100644
--- a/go/adk/pkg/a2a/server/server.go
+++ b/go/adk/pkg/a2a/server/server.go
@@ -20,6 +20,7 @@ import (
 	a2apb "github.com/a2aproject/a2a-go/v2/a2apb/v1"
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+	"go.opentelemetry.io/otel/attribute"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/health"
 	grpc_health_v1 "google.golang.org/grpc/health/grpc_health_v1"
@@ -40,6 +41,11 @@ type ServerConfig struct {
 	// HealthPaths are literal exact paths served by HealthHandler and excluded from tracing.
 	HealthPaths   []string
 	HealthHandler http.Handler
+
+	// InvocationAttributes are the trusted static attributes stamped on every
+	// A2A request span. Request identity is added by whichever component
+	// resolves it, never here.
+	InvocationAttributes []attribute.KeyValue
 }
 
 // A2AServer wraps the A2A server with health endpoints and graceful shutdown.
@@ -56,9 +62,11 @@ type A2AServer struct {
 // NewA2AServer creates a new A2A server using a2asrv.
 func NewA2AServer(agentCard a2atype.AgentCard, executor a2asrv.AgentExecutor, logger *slog.Logger, config ServerConfig, handlerOpts ...a2asrv.RequestHandlerOption) (*A2AServer, error) {
 	flushBeforeResponse := strings.EqualFold(strings.TrimSpace(os.Getenv("KAGENT_PRE_RESPONSE_TRACE_FLUSH")), "true")
-	if flushBeforeResponse {
-		handlerOpts = append(handlerOpts, a2asrv.WithCallInterceptors(&traceFlushInterceptor{logger: logger}))
-	}
+	// The request span anchors invocation identity whether or not the deployment
+	// needs a pre-response flush. It is a no-op span when tracing is disabled.
+	handlerOpts = append(handlerOpts, a2asrv.WithCallInterceptors(&invocationInterceptor{
+		logger: logger, identity: config.InvocationAttributes, flush: flushBeforeResponse,
+	}))
 	requestHandler := a2asrv.NewHandler(executor, handlerOpts...)
 	jsonrpcHandler := a2asrv.NewJSONRPCHandler(requestHandler)
 	if maxContentLength := getMaxContentLength(logger); maxContentLength != nil {
diff --git a/go/adk/pkg/a2a/server/tracing.go b/go/adk/pkg/a2a/server/tracing.go
index 0f722e8df3..dc2e088a69 100644
--- a/go/adk/pkg/a2a/server/tracing.go
+++ b/go/adk/pkg/a2a/server/tracing.go
@@ -6,62 +6,88 @@ import (
 
 	a2atype "github.com/a2aproject/a2a-go/v2/a2a"
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
+	"github.com/kagent-dev/kagent/go/adk/pkg/auth"
 	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
-	"go.opentelemetry.io/otel/trace"
 )
 
-// traceFlushInterceptor runs before a response reaches either A2A transport.
-// The gateway quiesces on the task event, not on HTTP EOF. End the request
-// span owned by this interceptor so the batch flush includes the invocation
-// work before the actor can be stopped. The transport span remains owned by
-// otelhttp, which records its response attributes before ending it.
-type traceFlushInterceptor struct {
+// invocationScope is the instrumentation scope of the request span. Consumers
+// normalize on it, so it and the span name stay stable.
+const invocationScope = "github.com/kagent-dev/kagent/go/adk/pkg/a2a/server"
+
+// invocationInterceptor anchors one A2A execution segment on a request span. It
+// starts the span with the identity the runtime knows before execution begins,
+// so a request rejected during validation still reports which agent rejected
+// it, and it completes the span for failures that never reach an executor.
+//
+// Execution adopts the invocation when it starts. From that point this
+// interceptor stops completing it, because a unary response can return while
+// a2a-go runs the executor detached from the caller and a transport response
+// must not report a finished invocation while execution continues.
+//
+// When flush is set the gateway may suspend the Actor as soon as a quiescent
+// event leaves the process, so completion exports before that event is yielded.
+// The transport span stays owned by otelhttp, which records its response
+// attributes before ending it.
+type invocationInterceptor struct {
 	a2asrv.PassthroughCallInterceptor
-	logger *slog.Logger
+	logger   *slog.Logger
+	identity []attribute.KeyValue
+	flush    bool
 }
 
-func (i *traceFlushInterceptor) Before(ctx context.Context, callCtx *a2asrv.CallContext, _ *a2asrv.Request) (context.Context, any, error) {
+func (i *invocationInterceptor) Before(ctx context.Context, callCtx *a2asrv.CallContext, _ *a2asrv.Request) (context.Context, any, error) {
 	method := callCtx.Method()
 	if method != "SendMessage" && method != "SendStreamingMessage" {
 		return ctx, nil, nil
 	}
-	ctx, _ = otel.Tracer("github.com/kagent-dev/kagent/go/adk/pkg/a2a/server").Start(
-		ctx,
-		"a2a.request",
-		trace.WithAttributes(attribute.String("a2a.method", method)),
-	)
+	attributes := make([]attribute.KeyValue, 0, len(i.identity)+2)
+	attributes = append(attributes, attribute.String("a2a.method", method))
+	attributes = append(attributes, i.identity...)
+	// The gateway authenticates the caller and replaces x-user-id before
+	// forwarding, so this is the only trusted identity on the private path.
+	if userID := auth.UserIDFromContext(ctx); userID != "" {
+		attributes = append(attributes, attribute.String(tracing.AttributeUserID, userID))
+	}
+	ctx, _ = tracing.StartInvocation(ctx, otel.Tracer(invocationScope), "a2a.request", i.flush, attributes...)
 	return ctx, nil, nil
 }
 
-func (i *traceFlushInterceptor) After(ctx context.Context, callCtx *a2asrv.CallContext, response *a2asrv.Response) error {
+func (i *invocationInterceptor) After(ctx context.Context, callCtx *a2asrv.CallContext, response *a2asrv.Response) error {
 	method := callCtx.Method()
 	if method != "SendMessage" && method != "SendStreamingMessage" {
 		return nil
 	}
+	invocation := tracing.InvocationFromContext(ctx)
+	if invocation == nil {
+		return nil
+	}
 
 	var state a2atype.TaskState
+	// A standalone agent message is a final A2A result that carries no task
+	// state. Treating it as non-quiescent would leave the invocation open with
+	// nothing left to complete it.
+	final := false
 	switch payload := response.Payload.(type) {
 	case *a2atype.TaskStatusUpdateEvent:
 		state = payload.Status.State
 	case *a2atype.Task:
 		state = payload.Status.State
+	case *a2atype.Message:
+		final = true
 	}
-	quiescent := state.Terminal() || state == a2atype.TaskStateInputRequired || state == a2atype.TaskStateAuthRequired
+	quiescent := final || state.Terminal() || state == a2atype.TaskStateInputRequired || state == a2atype.TaskStateAuthRequired
 	if method == "SendStreamingMessage" && response.Err == nil && !quiescent {
 		return nil
 	}
-	span := trace.SpanFromContext(ctx)
-	if state != a2atype.TaskStateUnspecified {
-		span.SetAttributes(attribute.String("a2a.task.state", string(state)))
-	}
-	span.End()
-	if !quiescent {
-		return nil
+	result := tracing.Result{TaskState: string(state)}
+	if response.Err != nil {
+		result.Error = "transport_error"
 	}
-	if err := tracing.ForceFlush(ctx); err != nil {
-		i.logger.ErrorContext(ctx, "failed to flush traces before quiescent A2A response", "error", err, "trace_id", span.SpanContext().TraceID().String(), "task_state", state)
+	if _, err := invocation.EndTransport(ctx, result); err != nil {
+		i.logger.ErrorContext(ctx, "failed to flush traces before quiescent A2A response", "error", err,
+			"trace_id", invocation.SpanContext().TraceID().String(), "task_state", state)
 	}
 	return nil
 }
diff --git a/go/adk/pkg/a2a/server/tracing_test.go b/go/adk/pkg/a2a/server/tracing_test.go
new file mode 100644
index 0000000000..d502fd22a1
--- /dev/null
+++ b/go/adk/pkg/a2a/server/tracing_test.go
@@ -0,0 +1,311 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"iter"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"log/slog"
+
+	a2atype "github.com/a2aproject/a2a-go/v2/a2a"
+	a2apb "github.com/a2aproject/a2a-go/v2/a2apb/v1"
+	"github.com/a2aproject/a2a-go/v2/a2apb/v1/pbconv"
+	"github.com/a2aproject/a2a-go/v2/a2asrv"
+	"github.com/kagent-dev/kagent/go/adk/pkg/auth"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/sdk/trace/tracetest"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+// staticUserInterceptor stands in for UserIDCallInterceptor, which the app
+// builder installs ahead of the invocation interceptor.
+type staticUserInterceptor struct {
+	a2asrv.PassthroughCallInterceptor
+	userID string
+}
+
+func (i staticUserInterceptor) Before(ctx context.Context, _ *a2asrv.CallContext, _ *a2asrv.Request) (context.Context, any, error) {
+	return auth.WithUserID(ctx, i.userID), nil, nil
+}
+
+// failingExecutor rejects the request the way validation does, before any
+// executor takes ownership of the invocation.
+type failingExecutor struct{}
+
+func (failingExecutor) Execute(context.Context, *a2asrv.ExecutorContext) iter.Seq2[a2atype.Event, error] {
+	return func(yield func(a2atype.Event, error) bool) {
+		yield(nil, fmt.Errorf("harness runtime accepts exactly one user text part"))
+	}
+}
+
+func (failingExecutor) Cancel(context.Context, *a2asrv.ExecutorContext) iter.Seq2[a2atype.Event, error] {
+	return func(yield func(a2atype.Event, error) bool) {}
+}
+
+// adoptingExecutor mimics a Harness runtime: it takes ownership of the
+// invocation, lets the unary response go out while the task is still working,
+// and completes the invocation itself at the execution boundary.
+type adoptingExecutor struct {
+	release <-chan struct{}
+	done    chan struct{}
+}
+
+func (e adoptingExecutor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext) iter.Seq2[a2atype.Event, error] {
+	return func(yield func(a2atype.Event, error) bool) {
+		invocation := tracing.InvocationFromContext(ctx)
+		invocation.Adopt()
+		defer close(e.done)
+		if !yield(a2atype.NewSubmittedTask(reqCtx, reqCtx.Message), nil) {
+			return
+		}
+		<-e.release
+		invocation.SetAttributes(attribute.String(tracing.AttributeSegment, tracing.SegmentInitial))
+		if _, err := invocation.End(ctx, tracing.Result{TaskState: string(a2atype.TaskStateCompleted)}); err != nil {
+			panic(err)
+		}
+		yield(a2atype.NewStatusUpdateEvent(reqCtx, a2atype.TaskStateCompleted, nil), nil)
+	}
+}
+
+func (adoptingExecutor) Cancel(context.Context, *a2asrv.ExecutorContext) iter.Seq2[a2atype.Event, error] {
+	return func(yield func(a2atype.Event, error) bool) {}
+}
+
+func syncExporter(t *testing.T) *tracetest.InMemoryExporter {
+	t.Helper()
+	exporter := tracetest.NewInMemoryExporter()
+	provider := sdktrace.NewTracerProvider(sdktrace.WithSyncer(exporter))
+	previous := otel.GetTracerProvider()
+	otel.SetTracerProvider(provider)
+	t.Cleanup(func() {
+		otel.SetTracerProvider(previous)
+		_ = provider.Shutdown(context.Background())
+	})
+	return exporter
+}
+
+func sendMessage(t *testing.T, server *A2AServer, request *a2atype.SendMessageRequest) {
+	t.Helper()
+	body, err := json.Marshal(map[string]any{
+		"jsonrpc": "2.0", "id": "1", "method": "SendMessage", "params": request,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpRequest := httptest.NewRequest(http.MethodPost, "/", bytes.NewReader(body))
+	httpRequest.Header.Set("Content-Type", "application/json")
+	httpRequest.Header.Set(a2atype.SvcParamVersion, string(a2atype.Version))
+	recorder := httptest.NewRecorder()
+	server.httpServer.Handler.ServeHTTP(recorder, httpRequest)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("unexpected status %d: %s", recorder.Code, recorder.Body.String())
+	}
+}
+
+func requestSpan(t *testing.T, exporter *tracetest.InMemoryExporter) tracetest.SpanStub {
+	t.Helper()
+	var found []tracetest.SpanStub
+	for _, span := range exporter.GetSpans() {
+		if span.Name == "a2a.request" {
+			found = append(found, span)
+		}
+	}
+	if len(found) != 1 {
+		t.Fatalf("exported %d a2a.request spans, want exactly one", len(found))
+	}
+	return found[0]
+}
+
+func spanAttribute(span tracetest.SpanStub, key string) string {
+	for _, attr := range span.Attributes {
+		if string(attr.Key) == key {
+			return attr.Value.AsString()
+		}
+	}
+	return ""
+}
+
+func TestRequestSpanCarriesStaticIdentityAndTrustedUser(t *testing.T) {
+	exporter := syncExporter(t)
+	server, err := NewA2AServer(a2atype.AgentCard{}, substrateExecutor{}, slog.New(slog.DiscardHandler),
+		ServerConfig{Port: "0", InvocationAttributes: tracing.RuntimeTelemetry{
+			HarnessKind: tracing.HarnessKindCodex, AgentName: "reporter-codex",
+		}.Identity()},
+		a2asrv.WithCallInterceptors(staticUserInterceptor{userID: "person-1"}))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	sendMessage(t, server, &a2atype.SendMessageRequest{
+		Message: a2atype.NewMessage(a2atype.MessageRoleUser, a2atype.NewTextPart("hi")),
+	})
+
+	span := requestSpan(t, exporter)
+	for key, want := range map[string]string{
+		"a2a.method":                 "SendMessage",
+		tracing.AttributeHarnessKind: "codex",
+		tracing.AttributeAgentName:   "reporter-codex",
+		tracing.AttributeUserID:      "person-1",
+		tracing.AttributeTaskState:   string(a2atype.TaskStateCompleted),
+	} {
+		if got := spanAttribute(span, key); got != want {
+			t.Errorf("%s = %q, want %q", key, got, want)
+		}
+	}
+}
+
+// An ADK runtime must not receive a harness marker, and it keeps exactly one
+// counted invocation of its own beneath the request span.
+func TestRequestSpanOmitsHarnessMarkerWithoutTelemetry(t *testing.T) {
+	exporter := syncExporter(t)
+	server, err := NewA2AServer(a2atype.AgentCard{}, substrateExecutor{}, slog.New(slog.DiscardHandler), ServerConfig{Port: "0"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	sendMessage(t, server, &a2atype.SendMessageRequest{
+		Message: a2atype.NewMessage(a2atype.MessageRoleUser, a2atype.NewTextPart("hi")),
+	})
+
+	span := requestSpan(t, exporter)
+	if got := spanAttribute(span, tracing.AttributeHarnessKind); got != "" {
+		t.Errorf("%s = %q, want none", tracing.AttributeHarnessKind, got)
+	}
+	invocations := 0
+	for _, exported := range exporter.GetSpans() {
+		if exported.Name == "invocation" {
+			invocations++
+		}
+	}
+	if invocations != 1 {
+		t.Errorf("exported %d invocation spans, want exactly one", invocations)
+	}
+}
+
+func TestRequestSpanRecordsEarlyFailure(t *testing.T) {
+	exporter := syncExporter(t)
+	server, err := NewA2AServer(a2atype.AgentCard{}, failingExecutor{}, slog.New(slog.DiscardHandler),
+		ServerConfig{Port: "0", InvocationAttributes: tracing.RuntimeTelemetry{
+			HarnessKind: tracing.HarnessKindClaude, AgentName: "reporter-claude",
+		}.Identity()})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// The JSON-RPC error is the response; the request itself is well formed.
+	sendMessage(t, server, &a2atype.SendMessageRequest{
+		Message: a2atype.NewMessage(a2atype.MessageRoleUser, a2atype.NewTextPart("hi")),
+	})
+
+	span := requestSpan(t, exporter)
+	if span.Status.Code != codes.Error {
+		t.Errorf("status = %v, want an error status", span.Status.Code)
+	}
+	if got := spanAttribute(span, tracing.AttributeErrorType); got != "transport_error" {
+		t.Errorf("%s = %q, want %q", tracing.AttributeErrorType, got, "transport_error")
+	}
+	if got := spanAttribute(span, tracing.AttributeHarnessKind); got != "claude" {
+		t.Errorf("a rejected request lost its harness identity: %s = %q", tracing.AttributeHarnessKind, got)
+	}
+}
+
+// A nonblocking unary request returns while a2a-go keeps running the executor
+// detached from the caller. The invocation must stay open until execution
+// reaches its own boundary.
+func TestAdoptedInvocationOutlivesTheUnaryResponse(t *testing.T) {
+	exporter := syncExporter(t)
+	release := make(chan struct{})
+	executor := adoptingExecutor{release: release, done: make(chan struct{})}
+	server, err := NewA2AServer(a2atype.AgentCard{}, executor, slog.New(slog.DiscardHandler), ServerConfig{Port: "0"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	sendMessage(t, server, &a2atype.SendMessageRequest{
+		Message: a2atype.NewMessage(a2atype.MessageRoleUser, a2atype.NewTextPart("hi")),
+		Config:  &a2atype.SendMessageConfig{ReturnImmediately: true},
+	})
+
+	for _, span := range exporter.GetSpans() {
+		if span.Name == "a2a.request" {
+			t.Fatal("the unary response completed an invocation that execution still owned")
+		}
+	}
+	close(release)
+	<-executor.done
+
+	span := requestSpan(t, exporter)
+	if got := spanAttribute(span, tracing.AttributeTaskState); got != string(a2atype.TaskStateCompleted) {
+		t.Errorf("%s = %q, want the state execution reported", tracing.AttributeTaskState, got)
+	}
+	if got := spanAttribute(span, tracing.AttributeSegment); got != tracing.SegmentInitial {
+		t.Errorf("%s = %q, want %q", tracing.AttributeSegment, got, tracing.SegmentInitial)
+	}
+}
+
+// messageExecutor returns a standalone agent message, which A2A treats as a
+// final result. It carries no task state, so the interceptor has to recognize
+// it or nothing else will ever complete the invocation.
+type messageExecutor struct{}
+
+func (messageExecutor) Execute(_ context.Context, reqCtx *a2asrv.ExecutorContext) iter.Seq2[a2atype.Event, error] {
+	return func(yield func(a2atype.Event, error) bool) {
+		message := a2atype.NewMessage(a2atype.MessageRoleAgent, a2atype.NewTextPart("done"))
+		message.TaskID, message.ContextID = reqCtx.TaskID, reqCtx.ContextID
+		yield(message, nil)
+	}
+}
+
+func (messageExecutor) Cancel(context.Context, *a2asrv.ExecutorContext) iter.Seq2[a2atype.Event, error] {
+	return func(yield func(a2atype.Event, error) bool) {}
+}
+
+func TestRequestSpanCompletesOnAStreamingMessageResult(t *testing.T) {
+	exporter := syncExporter(t)
+	server, err := NewA2AServer(a2atype.AgentCard{}, messageExecutor{}, slog.New(slog.DiscardHandler), ServerConfig{Port: "0"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	testServer := httptest.NewUnstartedServer(server.httpServer.Handler)
+	testServer.Config.Protocols = server.httpServer.Protocols
+	testServer.Start()
+	defer testServer.Close()
+	defer server.grpcServer.Stop()
+	conn, err := grpc.NewClient(testServer.Listener.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	request, err := pbconv.ToProtoSendMessageRequest(&a2atype.SendMessageRequest{
+		Message: a2atype.NewMessage(a2atype.MessageRoleUser, a2atype.NewTextPart("hi")),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	stream, err := a2apb.NewA2AServiceClient(conn).SendStreamingMessage(t.Context(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for {
+		if _, err := stream.Recv(); errors.Is(err, io.EOF) {
+			break
+		} else if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	requestSpan(t, exporter)
+}
diff --git a/go/adk/pkg/app/app.go b/go/adk/pkg/app/app.go
index ab9b8bb47b..e58155ad95 100644
--- a/go/adk/pkg/app/app.go
+++ b/go/adk/pkg/app/app.go
@@ -17,6 +17,7 @@ import (
 	"github.com/kagent-dev/kagent/go/adk/pkg/a2a/server"
 	apia2a "github.com/kagent-dev/kagent/go/api/a2a"
 	"github.com/kagent-dev/kagent/go/pkg/logging"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	adkagent "google.golang.org/adk/v2/agent"
 )
 
@@ -59,6 +60,12 @@ type AppConfig struct {
 	// Agent is the ADK agent used to enrich the agent card with skills via
 	// adka2a.BuildAgentSkills. Optional; when nil, the card is used as-is.
 	Agent adkagent.Agent
+
+	// Telemetry is the compiler-owned telemetry contract for this runtime. Its
+	// static identity is stamped on every A2A request span. The zero value
+	// leaves request spans without a harness marker, which is what ADK agents
+	// need.
+	Telemetry tracing.RuntimeTelemetry
 }
 
 // KAgentApp wires an AgentExecutor with kagent's A2A server.
@@ -137,11 +144,12 @@ func New(cfg AppConfig, executor a2asrv.AgentExecutor) (*KAgentApp, error) {
 	}
 
 	serverConfig := server.ServerConfig{
-		Host:            cfg.Host,
-		Port:            cfg.Port,
-		ShutdownTimeout: cfg.ShutdownTimeout,
-		HealthPaths:     cfg.HealthPaths,
-		HealthHandler:   cfg.HealthHandler,
+		Host:                 cfg.Host,
+		Port:                 cfg.Port,
+		ShutdownTimeout:      cfg.ShutdownTimeout,
+		HealthPaths:          cfg.HealthPaths,
+		HealthHandler:        cfg.HealthHandler,
+		InvocationAttributes: cfg.Telemetry.Identity(),
 	}
 
 	a2aServer, err := server.NewA2AServer(cfg.AgentCard, executor, log, serverConfig, handlerOpts...)
diff --git a/go/core/internal/translator/claude/compiler.go b/go/core/internal/translator/claude/compiler.go
index 2c0fcfecf6..fcb34866c3 100644
--- a/go/core/internal/translator/claude/compiler.go
+++ b/go/core/internal/translator/claude/compiler.go
@@ -17,6 +17,7 @@ import (
 	v2translator "github.com/kagent-dev/kagent/go/core/internal/translator"
 	"github.com/kagent-dev/kagent/go/core/pkg/env"
 	claudeconfig "github.com/kagent-dev/kagent/go/harness/claude/config"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"istio.io/istio/pkg/kube/krt"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -121,6 +122,10 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	}
 	config := claudeconfig.Production(model.Spec.Model, input.Root.Instruction)
 	config.Agents = localAgents
+	// The runtime reports this identity on every invocation span and on its
+	// resource, so a user-supplied resource marker is never required.
+	config.RuntimeTelemetry = telemetryConfig.HarnessTelemetry(
+		tracing.HarnessKindClaude, template.Name+"-"+harness.Name, template.Namespace)
 	if len(skillResources.Skills) != 0 || len(skillResources.Plugins) != 0 {
 		config.SkillResources = &skillResources
 	}
@@ -136,7 +141,7 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	if err != nil {
 		return nil, fmt.Errorf("convert Claude agent card: %w", err)
 	}
-	provenance, err := c.buildProvenance(ctx, input, environment)
+	provenance, err := c.buildProvenance(ctx, input, environment, configJSON)
 	if err != nil {
 		return nil, fmt.Errorf("build Claude revision provenance: %w", err)
 	}
@@ -388,9 +393,14 @@ type provenanceEntry struct {
 	Hash       string    `json:"hash"`
 }
 
-func (c *Compiler) buildProvenance(ctx context.Context, input *v2translator.HarnessInput, environment []corev1.EnvVar) ([]byte, error) {
+func (c *Compiler) buildProvenance(ctx context.Context, input *v2translator.HarnessInput, environment []corev1.EnvVar, configJSON []byte) ([]byte, error) {
 	harness := input.Harness
-	entries := []provenanceEntry{objectProvenance(v1alpha3.GroupVersion.String(), "Harness", harness.Name, harness.UID, harness.Generation, harness.Spec)}
+	entries := []provenanceEntry{
+		objectProvenance(v1alpha3.GroupVersion.String(), "Harness", harness.Name, harness.UID, harness.Generation, harness.Spec),
+		// The compiled configuration carries settings that are not in any watched
+		// object, such as telemetry, so a change to one produces a new revision.
+		objectProvenance("kagent.internal/v1", "GeneratedInput", "config.json", "", 0, json.RawMessage(configJSON)),
+	}
 	configMaps := map[string]struct{}{}
 	objects := map[string]struct{}{}
 	addObject := func(kind, name string, uid types.UID, generation int64, content any) {
diff --git a/go/core/internal/translator/claude/compiler_test.go b/go/core/internal/translator/claude/compiler_test.go
index 0376e9133f..9f43ce2d20 100644
--- a/go/core/internal/translator/claude/compiler_test.go
+++ b/go/core/internal/translator/claude/compiler_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/kagent-dev/kagent/go/api/v1alpha3"
 	v2translator "github.com/kagent-dev/kagent/go/core/internal/translator"
 	claudeconfig "github.com/kagent-dev/kagent/go/harness/claude/config"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"istio.io/istio/pkg/kube/krt"
 	"istio.io/istio/pkg/kube/krt/krttest"
 	corev1 "k8s.io/api/core/v1"
@@ -620,3 +621,64 @@ func testInput(t *testing.T, modelSpec v1alpha3.ModelConfigSpec, secretData map[
 	}
 	return &v2translator.HarnessInput{Harness: harness, Root: &v2translator.AgentInput{Template: template, ResolvedModelConfig: &v2translator.ResolvedModelConfig{Config: model}, Instruction: "help carefully"}}, collections
 }
+
+func TestCompileRuntimeTelemetry(t *testing.T) {
+	t.Setenv("OTEL_TRACING_ENABLED", "true")
+	t.Setenv("OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", "http://collector:4317")
+	model := v1alpha3.ModelConfigSpec{
+		Provider: v1alpha3.ModelProviderAnthropic, Model: "claude-sonnet-4-5",
+		APIKeySecret: "model-auth", APIKeySecretKey: "api-key",
+	}
+	input, reader := testInput(t, model, map[string][]byte{"api-key": []byte("secret")})
+	input.Harness.Name = "fast"
+
+	t.Setenv("KAGENT_OTEL_CAPTURE_SENSITIVE_CONTENT", "false")
+	revision, err := NewCompiler(krt.TestingDummyContext{}, reader).Compile(context.Background(), input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config, err := claudeconfig.Parse(revision.ConfigJSON)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The compiled identity follows the Harness name, not the harness kind.
+	want := tracing.RuntimeTelemetry{
+		HarnessKind: tracing.HarnessKindClaude, AgentName: "assistant-fast", AgentNamespace: "test",
+	}
+	if config.RuntimeTelemetry != want {
+		t.Fatalf("runtime telemetry = %#v, want %#v", config.RuntimeTelemetry, want)
+	}
+	if config.RuntimeTelemetry.CaptureLimit() != 0 {
+		t.Fatal("content capture is not disabled by default")
+	}
+
+	t.Setenv("KAGENT_OTEL_CAPTURE_SENSITIVE_CONTENT", "true")
+	t.Setenv("KAGENT_OTEL_MAX_CAPTURE_BYTES", "4096")
+	captured, err := NewCompiler(krt.TestingDummyContext{}, reader).Compile(context.Background(), input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	capturedConfig, err := claudeconfig.Parse(captured.ConfigJSON)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !capturedConfig.RuntimeTelemetry.CaptureContent || capturedConfig.RuntimeTelemetry.CaptureLimit() != 4096 {
+		t.Fatalf("captured runtime telemetry = %#v", capturedConfig.RuntimeTelemetry)
+	}
+	// A telemetry change lives only in the configuration, so provenance must
+	// cover it or the runtime would keep its previous revision.
+	if bytes.Equal(revision.Provenance, captured.Provenance) {
+		t.Fatal("changing the capture policy did not change revision provenance")
+	}
+}
+
+func TestCompileRejectsAnUnusableCaptureBudget(t *testing.T) {
+	t.Setenv("KAGENT_OTEL_MAX_CAPTURE_BYTES", "-1")
+	config, warnings := v2translator.TelemetryConfigFromProcess()
+	if len(warnings) != 1 {
+		t.Fatalf("warnings = %v, want one", warnings)
+	}
+	if config.MaxCaptureBytes != 0 {
+		t.Fatalf("MaxCaptureBytes = %d, want the shared default", config.MaxCaptureBytes)
+	}
+}
diff --git a/go/core/internal/translator/codex/compiler.go b/go/core/internal/translator/codex/compiler.go
index a6966017f9..4ce4edbdb1 100644
--- a/go/core/internal/translator/codex/compiler.go
+++ b/go/core/internal/translator/codex/compiler.go
@@ -16,6 +16,7 @@ import (
 	v2translator "github.com/kagent-dev/kagent/go/core/internal/translator"
 	"github.com/kagent-dev/kagent/go/core/pkg/env"
 	codexconfig "github.com/kagent-dev/kagent/go/harness/codex/config"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"istio.io/istio/pkg/kube/krt"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -103,6 +104,10 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	}
 	cfg := codexconfig.Production(model.Spec.Model, input.Root.Instruction)
 	cfg.Provider, cfg.Agents, cfg.MCPServers = provider, agents, mcp.servers
+	// The runtime reports this identity on every invocation span and on its
+	// resource, so a user-supplied resource marker is never required.
+	cfg.RuntimeTelemetry = telemetryConfig.HarnessTelemetry(
+		tracing.HarnessKindCodex, template.Name+"-"+harness.Name, template.Namespace)
 	if traceConfig.Enabled || logConfig.Enabled {
 		cfg.Telemetry = &codexconfig.Telemetry{CaptureContent: telemetryConfig.CaptureSensitiveContent}
 		if traceConfig.Enabled {
diff --git a/go/core/internal/translator/codex/compiler_test.go b/go/core/internal/translator/codex/compiler_test.go
index 4adaaa745d..299cea7155 100644
--- a/go/core/internal/translator/codex/compiler_test.go
+++ b/go/core/internal/translator/codex/compiler_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/kagent-dev/kagent/go/api/v1alpha3"
 	v2translator "github.com/kagent-dev/kagent/go/core/internal/translator"
 	codexconfig "github.com/kagent-dev/kagent/go/harness/codex/config"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"istio.io/istio/pkg/kube/krt"
 	"istio.io/istio/pkg/kube/krt/krttest"
 	corev1 "k8s.io/api/core/v1"
@@ -316,3 +317,56 @@ func testInput(t *testing.T, modelSpec v1alpha3.ModelConfigSpec, secretData map[
 		Template: template, ResolvedModelConfig: &v2translator.ResolvedModelConfig{Config: model}, Instruction: "help carefully",
 	}}, collections
 }
+
+func TestCompileRuntimeTelemetry(t *testing.T) {
+	t.Setenv("OTEL_TRACING_ENABLED", "true")
+	t.Setenv("OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", "http://collector:4317")
+	responses := v1alpha3.OpenAIAPIFormatResponses
+	model := v1alpha3.ModelConfigSpec{
+		Provider: v1alpha3.ModelProviderOpenAI, Model: "gpt-5.2-codex",
+		APIKeySecret: "model-auth", APIKeySecretKey: "api-key",
+		OpenAI: &v1alpha3.OpenAIConfig{APIFormat: &responses},
+	}
+	input, reader := testInput(t, model, map[string][]byte{"api-key": []byte("secret")})
+	input.Harness.Name = "fast"
+
+	t.Setenv("KAGENT_OTEL_CAPTURE_SENSITIVE_CONTENT", "false")
+	revision, err := NewCompiler(krt.TestingDummyContext{}, reader).Compile(context.Background(), input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config, err := codexconfig.Parse(revision.ConfigJSON)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The compiled identity follows the Harness name, not the harness kind.
+	want := tracing.RuntimeTelemetry{
+		HarnessKind: tracing.HarnessKindCodex, AgentName: "assistant-fast", AgentNamespace: "test",
+	}
+	if config.RuntimeTelemetry != want {
+		t.Fatalf("runtime telemetry = %#v, want %#v", config.RuntimeTelemetry, want)
+	}
+	if config.RuntimeTelemetry.CaptureLimit() != 0 {
+		t.Fatal("content capture is not disabled by default")
+	}
+
+	t.Setenv("KAGENT_OTEL_CAPTURE_SENSITIVE_CONTENT", "true")
+	captured, err := NewCompiler(krt.TestingDummyContext{}, reader).Compile(context.Background(), input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	capturedConfig, err := codexconfig.Parse(captured.ConfigJSON)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !capturedConfig.RuntimeTelemetry.CaptureContent {
+		t.Fatalf("captured runtime telemetry = %#v", capturedConfig.RuntimeTelemetry)
+	}
+	// The native exporter settings stay separate from the Go wrapper contract.
+	if capturedConfig.Telemetry == nil || !capturedConfig.Telemetry.CaptureContent {
+		t.Fatalf("native telemetry = %#v", capturedConfig.Telemetry)
+	}
+	if bytes.Equal(revision.Provenance, captured.Provenance) {
+		t.Fatal("changing the capture policy did not change revision provenance")
+	}
+}
diff --git a/go/core/internal/translator/otel.go b/go/core/internal/translator/otel.go
index d42601beba..95fcaa4ad0 100644
--- a/go/core/internal/translator/otel.go
+++ b/go/core/internal/translator/otel.go
@@ -4,8 +4,10 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"strconv"
 	"strings"
 
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	corev1 "k8s.io/api/core/v1"
 )
 
@@ -20,6 +22,7 @@ const (
 	otelExporterOTLPLogsProtocol   = "OTEL_EXPORTER_OTLP_LOGS_PROTOCOL"
 	otelCaptureSensitiveContent    = "KAGENT_OTEL_CAPTURE_SENSITIVE_CONTENT"
 	otelCaptureRawAPIBodies        = "KAGENT_OTEL_CAPTURE_RAW_API_BODIES"
+	otelMaxCaptureBytes            = "KAGENT_OTEL_MAX_CAPTURE_BYTES"
 	defaultOTLPProtocol            = "grpc"
 )
 
@@ -30,6 +33,9 @@ type TelemetryConfig struct {
 	Logs                    SignalConfig
 	CaptureSensitiveContent bool
 	CaptureRawAPIBodies     bool
+	// MaxCaptureBytes bounds each captured prompt and response on a Harness
+	// invocation span. Zero selects the shared default.
+	MaxCaptureBytes int
 }
 
 // SignalConfig is the resolved export configuration for one telemetry signal.
@@ -50,21 +56,50 @@ func TelemetryConfigFromProcess() (TelemetryConfig, []error) {
 	logs, logWarning := signalConfigFromProcess(
 		"logs", otelLoggingEnabled, otelExporterOTLPLogsEndpoint, otelExporterOTLPLogsProtocol,
 	)
-	warnings := make([]error, 0, 2)
+	warnings := make([]error, 0, 3)
 	if traceWarning != nil {
 		warnings = append(warnings, traceWarning)
 	}
 	if logWarning != nil {
 		warnings = append(warnings, logWarning)
 	}
+	maxCaptureBytes, captureWarning := maxCaptureBytesFromProcess()
+	if captureWarning != nil {
+		warnings = append(warnings, captureWarning)
+	}
 	return TelemetryConfig{
 		Traces:                  traces,
 		Logs:                    logs,
 		CaptureSensitiveContent: environmentEnabled(otelCaptureSensitiveContent),
 		CaptureRawAPIBodies:     environmentEnabled(otelCaptureRawAPIBodies),
+		MaxCaptureBytes:         maxCaptureBytes,
 	}, warnings
 }
 
+// maxCaptureBytesFromProcess resolves the user's capture budget. An unusable
+// value is reported and replaced by the default so an observability setting
+// cannot invalidate AgentTemplates.
+func maxCaptureBytesFromProcess() (int, error) {
+	raw := strings.TrimSpace(os.Getenv(otelMaxCaptureBytes))
+	if raw == "" {
+		return 0, nil
+	}
+	value, err := strconv.Atoi(raw)
+	if err != nil || value <= 0 || value > tracing.MaxCaptureBytes {
+		return 0, fmt.Errorf("%s must be a positive integer of at most %d bytes", otelMaxCaptureBytes, tracing.MaxCaptureBytes)
+	}
+	return value, nil
+}
+
+// HarnessTelemetry is the compiler-owned runtime telemetry contract for one
+// compiled agent. Identity is what the runtime reports on every span it starts.
+func (c TelemetryConfig) HarnessTelemetry(kind tracing.HarnessKind, agentName, namespace string) tracing.RuntimeTelemetry {
+	return tracing.RuntimeTelemetry{
+		HarnessKind: kind, AgentName: agentName, AgentNamespace: namespace,
+		CaptureContent: c.CaptureSensitiveContent, MaxCaptureBytes: c.MaxCaptureBytes,
+	}
+}
+
 func signalConfigFromProcess(signal, enabledVariable, endpointVariable, protocolVariable string) (SignalConfig, error) {
 	if !environmentEnabled(enabledVariable) {
 		return SignalConfig{}, nil
diff --git a/go/core/test/e2e/tracing_test.go b/go/core/test/e2e/tracing_test.go
index 72c1e9b859..ae71a68aa5 100644
--- a/go/core/test/e2e/tracing_test.go
+++ b/go/core/test/e2e/tracing_test.go
@@ -24,6 +24,7 @@ import (
 	"go.opentelemetry.io/otel/sdk/resource"
 	collectortrace "go.opentelemetry.io/proto/otlp/collector/trace/v1"
 	commonpb "go.opentelemetry.io/proto/otlp/common/v1"
+	resourcepb "go.opentelemetry.io/proto/otlp/resource/v1"
 	tracepb "go.opentelemetry.io/proto/otlp/trace/v1"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/metadata"
@@ -43,6 +44,7 @@ const (
 type capturedSpan struct {
 	serviceName string
 	scopeName   string
+	resource    *resourcepb.Resource
 	span        *tracepb.Span
 }
 
@@ -206,7 +208,10 @@ func (r *otlpTraceReceiver) selectSpans(traceID []byte, serviceName, scopeName,
 					}
 				}
 				if matches {
-					selected = append(selected, capturedSpan{serviceName: resourceServiceName, scopeName: currentScopeName, span: span})
+					selected = append(selected, capturedSpan{
+						serviceName: resourceServiceName, scopeName: currentScopeName,
+						resource: resourceSpans.GetResource(), span: span,
+					})
 				}
 			}
 		}
@@ -231,6 +236,7 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 	for _, test := range []struct {
 		name          string
 		harness       string
+		harnessKind   string
 		templateLabel string
 		modelURL      func(*testing.T) string
 		createModel   func(*testing.T, string) string
@@ -239,6 +245,7 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 	}{
 		{
 			name: "claude", harness: claudeTracingE2EHarness, templateLabel: "claude-tracing",
+			harnessKind: string(tracing.HarnessKindClaude),
 			modelURL: func(t *testing.T) string {
 				return reachableServerURL(t, startMockLLMServer(t, claudeInteractionMocks, "mocks/invoke_claude_agent.json"), "")
 			},
@@ -258,6 +265,7 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 		},
 		{
 			name: "codex", harness: codexTracingE2EHarness, templateLabel: "codex-tracing",
+			harnessKind: string(tracing.HarnessKindCodex),
 			modelURL: func(t *testing.T) string {
 				return reachableModelURL(t, startMockLLMServer(t, codexInteractionMocks, "mocks/invoke_codex_agent.json"))
 			},
@@ -288,16 +296,35 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 			fixture.ctx = metadata.AppendToOutgoingContext(fixture.ctx, "traceparent", traceparent)
 
 			streamed := sendTracingMessage(t, fixture, test.prompt)
-			if streamed != a2atype.TaskStateCompleted {
-				t.Fatalf("streamed task state = %s, want COMPLETED", streamed)
+			if streamed.state != a2atype.TaskStateCompleted {
+				t.Fatalf("streamed task state = %s, want COMPLETED", streamed.state)
 			}
 			// Wait for the Actor to suspend then assert that the completed a2a.request span was exported.
 			assertActorSuspended(t, fixture)
-			if spans := receiver.selectSpans(traceID, "", "", "a2a.request", map[string]string{
-				"a2a.method":     "SendStreamingMessage",
-				"a2a.task.state": string(a2atype.TaskStateCompleted),
-			}); len(spans) == 0 {
-				t.Fatalf("completed a2a.request span was not exported before suspension: %s", receiver.diagnostic(traceID))
+			// The compiler owns this identity, so the assertion holds without any
+			// user-supplied resource marker on the Harness.
+			spans := receiver.selectSpans(traceID, "", "", "a2a.request", map[string]string{
+				"a2a.method":                    "SendStreamingMessage",
+				tracing.AttributeTaskState:      string(a2atype.TaskStateCompleted),
+				tracing.AttributeHarnessKind:    test.harnessKind,
+				tracing.AttributeAgentName:      template + "-" + test.harness,
+				tracing.AttributeConversationID: streamed.contextID,
+				tracing.AttributeTaskID:         string(streamed.taskID),
+				tracing.AttributeUserID:         "e2e",
+				tracing.AttributeSegment:        tracing.SegmentInitial,
+			})
+			if len(spans) != 1 {
+				t.Fatalf("identified a2a.request spans = %d, want exactly one before suspension: %s", len(spans), receiver.diagnostic(traceID))
+			}
+			// Capture stays off unless a user enables it, so a turn must not
+			// export its prompt or response.
+			for _, key := range []string{tracing.AttributeInput, tracing.AttributeOutput} {
+				if value := stringAttribute(spans[0].span.GetAttributes(), key); value != "" {
+					t.Errorf("%s = %q with capture disabled", key, value)
+				}
+			}
+			if namespace := stringAttribute(spans[0].resource.GetAttributes(), "service.namespace"); namespace != "kagent" {
+				t.Errorf("service.namespace = %q, want the AgentTemplate namespace", namespace)
 			}
 			test.assertNative(t, receiver, traceID)
 		})
@@ -310,6 +337,11 @@ func requireTracingHarnesses(t *testing.T) {
 	for _, name := range []string{claudeTracingE2EHarness, codexTracingE2EHarness} {
 		var harness v1alpha3.Harness
 		if err := kube.Get(t.Context(), ctrlclient.ObjectKey{Namespace: "kagent", Name: name}, &harness); apierrors.IsNotFound(err) {
+			// A job dedicated to tracing must fail rather than silently skip both
+			// cases when its fixtures are missing.
+			if strings.EqualFold(strings.TrimSpace(os.Getenv("KAGENT_E2E_REQUIRE_TRACING")), "true") {
+				t.Fatalf("tracing Harness %s is not installed", name)
+			}
 			t.Skip("dedicated tracing Harnesses are not installed")
 		} else if err != nil {
 			t.Fatalf("get tracing Harness %s: %v", name, err)
@@ -350,14 +382,22 @@ func sampledTraceparent(t *testing.T) ([]byte, string) {
 	return traceID, fmt.Sprintf("00-%x-%x-01", traceID, spanID)
 }
 
-func sendTracingMessage(t *testing.T, fixture *interactionFixture, text string) a2atype.TaskState {
+// tracedTurn is the identity the gateway assigned to one traced turn. The trace
+// assertions compare it with what the runtime reported.
+type tracedTurn struct {
+	state     a2atype.TaskState
+	taskID    a2atype.TaskID
+	contextID string
+}
+
+func sendTracingMessage(t *testing.T, fixture *interactionFixture, text string) tracedTurn {
 	t.Helper()
 	_, request := newMessageRequest(t, text)
 	stream, err := fixture.client.SendStreamingMessage(fixture.ctx, request)
 	if err != nil {
 		t.Fatalf("start streaming traced A2A message: %v", err)
 	}
-	var terminalState a2atype.TaskState
+	var turn tracedTurn
 	terminalEvents := 0
 	for {
 		response, err := stream.Recv()
@@ -365,13 +405,16 @@ func sendTracingMessage(t *testing.T, fixture *interactionFixture, text string)
 			if terminalEvents != 1 {
 				t.Fatalf("traced stream terminal event count = %d, want 1", terminalEvents)
 			}
-			return terminalState
+			if turn.taskID == "" || turn.contextID == "" {
+				t.Fatal("traced stream did not report a task and context ID")
+			}
+			return turn
 		}
 		if err != nil {
 			t.Fatalf("receive traced A2A stream: %v", err)
 		}
 		if terminalEvents != 0 {
-			t.Fatalf("traced stream emitted an event after terminal state %s", terminalState)
+			t.Fatalf("traced stream emitted an event after terminal state %s", turn.state)
 		}
 		event, err := pbconv.FromProtoStreamResponse(response)
 		if err != nil {
@@ -380,13 +423,13 @@ func sendTracingMessage(t *testing.T, fixture *interactionFixture, text string)
 		var state a2atype.TaskState
 		switch event := event.(type) {
 		case *a2atype.Task:
-			state = event.Status.State
+			state, turn.taskID, turn.contextID = event.Status.State, event.ID, event.ContextID
 		case *a2atype.TaskStatusUpdateEvent:
-			state = event.Status.State
+			state, turn.taskID, turn.contextID = event.Status.State, event.TaskID, event.ContextID
 		}
 		if state.Terminal() {
 			terminalEvents++
-			terminalState = state
+			turn.state = state
 		}
 	}
 }
diff --git a/go/harness/claude/cmd/main.go b/go/harness/claude/cmd/main.go
index 2a68186f4b..e4b76fc630 100644
--- a/go/harness/claude/cmd/main.go
+++ b/go/harness/claude/cmd/main.go
@@ -12,6 +12,7 @@ import (
 
 	a2atype "github.com/a2aproject/a2a-go/v2/a2a"
 	"github.com/kagent-dev/kagent/go/adk/pkg/app"
+	"github.com/kagent-dev/kagent/go/harness/claude/config"
 	"github.com/kagent-dev/kagent/go/harness/claude/executor"
 	"github.com/kagent-dev/kagent/go/pkg/logging"
 	"github.com/kagent-dev/kagent/go/pkg/tracing"
@@ -55,7 +56,13 @@ func run(ctx context.Context, check bool, getenv func(string) string, environmen
 	if strings.TrimSpace(card.Name) == "" {
 		return fmt.Errorf("agent card name is required")
 	}
-	shutdownTelemetry, telemetryEnabled, telemetryErr := tracing.Init(ctx, card.Name)
+	// Telemetry identity and capture policy are compiled into the runtime
+	// configuration, so the configuration is read before tracing starts.
+	cfg, err := config.Parse(configJSON)
+	if err != nil {
+		return err
+	}
+	shutdownTelemetry, telemetryEnabled, telemetryErr := tracing.Init(ctx, card.Name, cfg.RuntimeTelemetry)
 	if telemetryErr != nil {
 		logging.FromContext(ctx).ErrorContext(ctx, "failed to initialize harness telemetry", "error", telemetryErr)
 	} else if telemetryEnabled {
@@ -76,7 +83,10 @@ func run(ctx context.Context, check bool, getenv func(string) string, environmen
 	if check {
 		return nil
 	}
-	application, err := app.New(app.AppConfig{AgentCard: card, Port: privatePort, AppName: card.Name, Logger: logging.FromContext(ctx)}, exec)
+	application, err := app.New(app.AppConfig{
+		AgentCard: card, Port: privatePort, AppName: card.Name,
+		Logger: logging.FromContext(ctx), Telemetry: cfg.RuntimeTelemetry,
+	}, exec)
 	if err != nil {
 		return fmt.Errorf("construct private A2A app: %w", err)
 	}
diff --git a/go/harness/claude/config/config.go b/go/harness/claude/config/config.go
index 0807095fba..ac0b3a5d6e 100644
--- a/go/harness/claude/config/config.go
+++ b/go/harness/claude/config/config.go
@@ -11,12 +11,13 @@ import (
 	"time"
 
 	"github.com/kagent-dev/kagent/go/api/agentplugin"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 )
 
 var agentNamePattern = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
 
 const (
-	Version                             = 4
+	Version                             = 5
 	PinnedClaudeVersion                 = "2.1.260"
 	ClaudeConfigDirEnvName              = "CLAUDE_CONFIG_DIR"
 	DisableUpdatesEnvName               = "DISABLE_UPDATES"
@@ -70,9 +71,13 @@ type Config struct {
 	Agents                map[string]Agent       `json:"agents,omitempty"`
 	SkillResources        *agentplugin.Resources `json:"skill_resources,omitempty"`
 	MCPServers            map[string]MCPServer   `json:"mcp_servers,omitempty"`
-	MaxEventBytes         int                    `json:"max_event_bytes"`
-	MaxStderrBytes        int                    `json:"max_stderr_bytes"`
-	InterruptGraceMillis  int                    `json:"interrupt_grace_millis"`
+	// RuntimeTelemetry carries the compiler-owned span identity and content
+	// capture policy. It is absent for standalone runs, which fall back to the
+	// environment for service identity and leave capture disabled.
+	RuntimeTelemetry     tracing.RuntimeTelemetry `json:"runtime_telemetry,omitzero"`
+	MaxEventBytes        int                      `json:"max_event_bytes"`
+	MaxStderrBytes       int                      `json:"max_stderr_bytes"`
+	InterruptGraceMillis int                      `json:"interrupt_grace_millis"`
 }
 
 // MCPServer is one compiler-owned direct remote server. Claude's strict MCP
@@ -133,6 +138,12 @@ func (c Config) Validate() error {
 	if c.MaxEventBytes <= 0 || c.MaxStderrBytes <= 0 || c.InterruptGraceMillis <= 0 {
 		return fmt.Errorf("event, stderr, and interrupt grace limits must be positive")
 	}
+	if err := c.RuntimeTelemetry.Validate(); err != nil {
+		return err
+	}
+	if kind := c.RuntimeTelemetry.HarnessKind; kind != "" && kind != tracing.HarnessKindClaude {
+		return fmt.Errorf("claude runtime telemetry has harness kind %q", kind)
+	}
 	for name, agent := range c.Agents {
 		if !agentNamePattern.MatchString(name) {
 			return fmt.Errorf("claude agent name %q must contain only letters, numbers, underscores, or hyphens", name)
diff --git a/go/harness/claude/config/config_test.go b/go/harness/claude/config/config_test.go
index b9b07ce8e4..4f4f157cb1 100644
--- a/go/harness/claude/config/config_test.go
+++ b/go/harness/claude/config/config_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/kagent-dev/kagent/go/api/agentplugin"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 )
 
 func TestOwnsEnvironment(t *testing.T) {
@@ -82,7 +83,7 @@ func TestAgentsJSON(t *testing.T) {
 	if raw != want {
 		t.Fatalf("AgentsJSON() = %s, want %s", raw, want)
 	}
-	parsed, err := Parse([]byte(`{"version":4,"claude_executable":"claude","expected_claude_version":"2.1.260","strict_version":true,"agents":` + raw + `,"max_event_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`))
+	parsed, err := Parse([]byte(`{"version":5,"claude_executable":"claude","expected_claude_version":"2.1.260","strict_version":true,"agents":` + raw + `,"max_event_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -107,7 +108,7 @@ func TestConfigRejectsInvalidAgents(t *testing.T) {
 }
 
 func TestParseValidates(t *testing.T) {
-	contents := `{"version":4,"claude_executable":"claude","expected_claude_version":"2.1.260","strict_version":true,"model":"claude-test","append_system_prompt":"help","max_event_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`
+	contents := `{"version":5,"claude_executable":"claude","expected_claude_version":"2.1.260","strict_version":true,"model":"claude-test","append_system_prompt":"help","max_event_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`
 	cfg, err := Parse([]byte(contents))
 	if err != nil {
 		t.Fatal(err)
@@ -118,7 +119,7 @@ func TestParseValidates(t *testing.T) {
 }
 
 func TestConfigRejectsUnknownFields(t *testing.T) {
-	if _, err := Parse([]byte(`{"version":4,"surprise":true}`)); err == nil {
+	if _, err := Parse([]byte(`{"version":5,"surprise":true}`)); err == nil {
 		t.Fatal("Parse() accepted an unknown field")
 	}
 }
@@ -130,8 +131,49 @@ func TestConfigRejectsTrailingValue(t *testing.T) {
 }
 
 func TestConfigRejectsMissingLimits(t *testing.T) {
-	_, err := Parse([]byte(`{"version":4,"claude_executable":"claude"}`))
+	_, err := Parse([]byte(`{"version":5,"claude_executable":"claude"}`))
 	if err == nil || !strings.Contains(err.Error(), "limits must be positive") {
 		t.Fatalf("Parse() error = %v", err)
 	}
 }
+
+func TestConfigValidatesRuntimeTelemetry(t *testing.T) {
+	base := Production("claude-sonnet-4-5", "help")
+	for _, test := range []struct {
+		name      string
+		telemetry tracing.RuntimeTelemetry
+		wantError bool
+	}{
+		{name: "absent"},
+		{name: "claude identity", telemetry: tracing.RuntimeTelemetry{
+			HarnessKind: tracing.HarnessKindClaude, AgentName: "assistant-claude", AgentNamespace: "kagent",
+		}},
+		{name: "another harness kind", telemetry: tracing.RuntimeTelemetry{HarnessKind: tracing.HarnessKindCodex}, wantError: true},
+		{name: "capture above the ceiling", telemetry: tracing.RuntimeTelemetry{
+			HarnessKind: tracing.HarnessKindClaude, CaptureContent: true, MaxCaptureBytes: tracing.MaxCaptureBytes + 1,
+		}, wantError: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			config := base
+			config.RuntimeTelemetry = test.telemetry
+			if err := config.Validate(); (err != nil) != test.wantError {
+				t.Fatalf("Validate() error = %v, wantError = %v", err, test.wantError)
+			}
+		})
+	}
+}
+
+// A configuration without the telemetry section stays readable, which keeps
+// standalone harness validation working.
+func TestParseAcceptsConfigWithoutRuntimeTelemetry(t *testing.T) {
+	config, err := Parse([]byte(`{"version":5,"claude_executable":"claude","expected_claude_version":"2.1.260","strict_version":true,"max_event_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if config.RuntimeTelemetry != (tracing.RuntimeTelemetry{}) {
+		t.Fatalf("runtime telemetry = %#v, want the zero value", config.RuntimeTelemetry)
+	}
+	if config.RuntimeTelemetry.CaptureLimit() != 0 {
+		t.Fatal("capture is enabled without a telemetry section")
+	}
+}
diff --git a/go/harness/claude/executor/executor.go b/go/harness/claude/executor/executor.go
index 1632eee7f6..c93ec2d688 100644
--- a/go/harness/claude/executor/executor.go
+++ b/go/harness/claude/executor/executor.go
@@ -10,6 +10,7 @@ import (
 
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
 	"github.com/google/uuid"
+	"github.com/kagent-dev/kagent/go/harness/claude/config"
 	"github.com/kagent-dev/kagent/go/harness/claude/internal/adapter"
 	runtimea2a "github.com/kagent-dev/kagent/go/harness/runtime/a2a"
 	"github.com/kagent-dev/kagent/go/harness/runtime/continuation"
@@ -48,7 +49,16 @@ func New(ctx context.Context, cfg Config) (a2asrv.AgentExecutor, io.Closer, erro
 		_ = runner.Close()
 		return nil, nil, err
 	}
-	executor, err := runtimea2a.New(runner, store)
+	// Read here rather than taken as a Config field: the identity travels in the
+	// compiled configuration this function already has, and an embedder that
+	// forgot to pass it would emit spans no consumer could attribute to a
+	// harness, which is a silence rather than an error.
+	parsed, err := config.Parse(cfg.ConfigJSON)
+	if err != nil {
+		_ = runner.Close()
+		return nil, nil, err
+	}
+	executor, err := runtimea2a.New(runner, store, parsed.RuntimeTelemetry)
 	if err != nil {
 		_ = runner.Close()
 		return nil, nil, err
diff --git a/go/harness/claude/executor/executor_test.go b/go/harness/claude/executor/executor_test.go
index 13376c4623..1a467ba8af 100644
--- a/go/harness/claude/executor/executor_test.go
+++ b/go/harness/claude/executor/executor_test.go
@@ -2,8 +2,11 @@ package executor
 
 import (
 	"context"
+	"fmt"
 	"strings"
 	"testing"
+
+	"github.com/kagent-dev/kagent/go/harness/claude/config"
 )
 
 func TestValidateSessionID(t *testing.T) {
@@ -21,7 +24,7 @@ func TestNewRejectsBadInput(t *testing.T) {
 		cfg     Config
 		wantErr string
 	}{
-		{name: "relative data dir", cfg: Config{ConfigJSON: []byte(`{"version":4,"claude_executable":"claude","model":"m","max_event_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`), DataDir: "relative/dir"}, wantErr: "absolute path"},
+		{name: "relative data dir", cfg: Config{ConfigJSON: fmt.Appendf(nil, `{"version":%d,"claude_executable":"claude","model":"m","max_event_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`, config.Version), DataDir: "relative/dir"}, wantErr: "absolute path"},
 		{name: "malformed config", cfg: Config{ConfigJSON: []byte(`{"version":`), DataDir: t.TempDir()}, wantErr: "decode config"},
 		{name: "unknown config field", cfg: Config{ConfigJSON: []byte(`{"nope":1}`), DataDir: t.TempDir()}, wantErr: "decode config"},
 	}
diff --git a/go/harness/claude/internal/adapter/adapter.go b/go/harness/claude/internal/adapter/adapter.go
index fd6b0af724..558c2f99da 100644
--- a/go/harness/claude/internal/adapter/adapter.go
+++ b/go/harness/claude/internal/adapter/adapter.go
@@ -14,6 +14,7 @@ import (
 	"github.com/kagent-dev/kagent/go/harness/claude/config"
 	"github.com/kagent-dev/kagent/go/harness/claude/internal/driver"
 	"github.com/kagent-dev/kagent/go/harness/internal/utils"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 )
 
 const approvalMCPServerName = "kagent_hitl"
@@ -67,6 +68,9 @@ func New(ctx context.Context, input Input) (*driver.ProcessDriver, error) {
 		}
 	}
 	environment := setEnvironment(input.Environment, config.ClaudeConfigDirEnvName, claudeDir)
+	// The native runtime inherits the compiled identity through the standard
+	// resource variable, so no user-supplied marker is required.
+	environment = tracing.ResourceEnvironment(environment, cfg.RuntimeTelemetry.Identity())
 	// The image and compiler pin an exact Claude version. Prevent both automatic
 	// and manual update paths from changing that runtime after validation.
 	environment = setEnvironment(environment, config.DisableUpdatesEnvName, "1")
diff --git a/go/harness/claude/internal/adapter/adapter_test.go b/go/harness/claude/internal/adapter/adapter_test.go
index e8d4831937..a545429e49 100644
--- a/go/harness/claude/internal/adapter/adapter_test.go
+++ b/go/harness/claude/internal/adapter/adapter_test.go
@@ -18,7 +18,7 @@ func TestNewMaterializesDurableDirectories(t *testing.T) {
 	ephemeralDir := filepath.Join(t.TempDir(), "credentials")
 	workspace := filepath.Join(durableDir, "workspace")
 	runner, err := New(context.Background(), Input{
-		ConfigJSON: []byte(`{"version":4,"claude_executable":"claude","expected_claude_version":"2.1.260","strict_version":true,"max_event_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`),
+		ConfigJSON: []byte(`{"version":5,"claude_executable":"claude","expected_claude_version":"2.1.260","strict_version":true,"max_event_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`),
 		Workspace:  workspace,
 		DurableDir: durableDir, EphemeralDir: ephemeralDir,
 		Environment: []string{"PATH=/bin", "CLAUDE_CONFIG_DIR=/wrong", "DISABLE_UPDATES=0"},
diff --git a/go/harness/claude/internal/driver/process.go b/go/harness/claude/internal/driver/process.go
index 0c647f3ff0..3a0cd7bab5 100644
--- a/go/harness/claude/internal/driver/process.go
+++ b/go/harness/claude/internal/driver/process.go
@@ -221,6 +221,9 @@ func (d *ProcessDriver) Run(ctx context.Context, turn runtime.Turn, sink runtime
 }
 
 // traceEnvironment injects the trace context into the environment variables.
+// Claude reads it once at startup, so a turn that is resumed after an approval
+// keeps emitting under the trace of the request that started the process. The
+// resumed A2A segment records a link to that origin rather than reparenting it.
 func traceEnvironment(ctx context.Context, environment []string) []string {
 	carrier := propagation.MapCarrier{}
 	propagation.TraceContext{}.Inject(ctx, carrier)
diff --git a/go/harness/codex/cmd/main.go b/go/harness/codex/cmd/main.go
index 376fc57778..96f6cedb2c 100644
--- a/go/harness/codex/cmd/main.go
+++ b/go/harness/codex/cmd/main.go
@@ -12,6 +12,7 @@ import (
 
 	a2atype "github.com/a2aproject/a2a-go/v2/a2a"
 	"github.com/kagent-dev/kagent/go/adk/pkg/app"
+	"github.com/kagent-dev/kagent/go/harness/codex/config"
 	"github.com/kagent-dev/kagent/go/harness/codex/executor"
 	"github.com/kagent-dev/kagent/go/pkg/logging"
 	"github.com/kagent-dev/kagent/go/pkg/tracing"
@@ -55,7 +56,13 @@ func run(ctx context.Context, check bool, getenv func(string) string, environmen
 	if strings.TrimSpace(card.Name) == "" {
 		return fmt.Errorf("agent card name is required")
 	}
-	shutdownTelemetry, telemetryEnabled, telemetryErr := tracing.Init(ctx, card.Name)
+	// Telemetry identity and capture policy are compiled into the runtime
+	// configuration, so the configuration is read before tracing starts.
+	cfg, err := config.Parse(configJSON)
+	if err != nil {
+		return err
+	}
+	shutdownTelemetry, telemetryEnabled, telemetryErr := tracing.Init(ctx, card.Name, cfg.RuntimeTelemetry)
 	if telemetryErr != nil {
 		logging.FromContext(ctx).ErrorContext(ctx, "failed to initialize harness telemetry", "error", telemetryErr)
 	} else if telemetryEnabled {
@@ -74,7 +81,10 @@ func run(ctx context.Context, check bool, getenv func(string) string, environmen
 	if check {
 		return nil
 	}
-	application, err := app.New(app.AppConfig{AgentCard: card, Port: privatePort, AppName: card.Name, Logger: logging.FromContext(ctx)}, exec)
+	application, err := app.New(app.AppConfig{
+		AgentCard: card, Port: privatePort, AppName: card.Name,
+		Logger: logging.FromContext(ctx), Telemetry: cfg.RuntimeTelemetry,
+	}, exec)
 	if err != nil {
 		return fmt.Errorf("construct private A2A app: %w", err)
 	}
diff --git a/go/harness/codex/config/config.go b/go/harness/codex/config/config.go
index f2629f8f77..77cb97f9d8 100644
--- a/go/harness/codex/config/config.go
+++ b/go/harness/codex/config/config.go
@@ -13,10 +13,11 @@ import (
 	"time"
 
 	"github.com/kagent-dev/kagent/go/api/agentplugin"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 )
 
 const (
-	Version            = 2
+	Version            = 3
 	PinnedCodexVersion = "0.148.0"
 )
 
@@ -36,9 +37,13 @@ type Config struct {
 	SkillResources       *agentplugin.Resources `json:"skill_resources,omitempty"`
 	MCPServers           map[string]MCPServer   `json:"mcp_servers,omitempty"`
 	Telemetry            *Telemetry             `json:"telemetry,omitempty"`
-	MaxFrameBytes        int                    `json:"max_frame_bytes"`
-	MaxStderrBytes       int                    `json:"max_stderr_bytes"`
-	InterruptGraceMillis int                    `json:"interrupt_grace_millis"`
+	// RuntimeTelemetry carries the compiler-owned span identity and content
+	// capture policy for the Go wrapper. Telemetry above configures the native
+	// Codex exporters, which are a separate producer.
+	RuntimeTelemetry     tracing.RuntimeTelemetry `json:"runtime_telemetry,omitzero"`
+	MaxFrameBytes        int                      `json:"max_frame_bytes"`
+	MaxStderrBytes       int                      `json:"max_stderr_bytes"`
+	InterruptGraceMillis int                      `json:"interrupt_grace_millis"`
 }
 
 // Telemetry contains the compiler-owned native signal exporter settings.
@@ -112,6 +117,12 @@ func (c Config) Validate() error {
 	if c.Provider.Name != "openai" && c.Provider.Name != "amazon-bedrock" {
 		return fmt.Errorf("unsupported Codex provider %q", c.Provider.Name)
 	}
+	if err := c.RuntimeTelemetry.Validate(); err != nil {
+		return err
+	}
+	if kind := c.RuntimeTelemetry.HarnessKind; kind != "" && kind != tracing.HarnessKindCodex {
+		return fmt.Errorf("codex runtime telemetry has harness kind %q", kind)
+	}
 	if c.Telemetry != nil {
 		if c.Telemetry.Traces == nil && c.Telemetry.Logs == nil {
 			return fmt.Errorf("telemetry requires at least one exporter")
diff --git a/go/harness/codex/config/config_test.go b/go/harness/codex/config/config_test.go
index de03f12b6d..5a624a76db 100644
--- a/go/harness/codex/config/config_test.go
+++ b/go/harness/codex/config/config_test.go
@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"strings"
 	"testing"
+
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 )
 
 func TestProductionRoundTrip(t *testing.T) {
@@ -71,3 +73,30 @@ func TestParseRejectsUnsafeConfiguration(t *testing.T) {
 		t.Fatal("Parse() accepted an unknown field")
 	}
 }
+
+func TestConfigValidatesRuntimeTelemetry(t *testing.T) {
+	base := Production("gpt-5.2-codex", "help")
+	base.Provider = Provider{Name: "openai"}
+	for _, test := range []struct {
+		name      string
+		telemetry tracing.RuntimeTelemetry
+		wantError bool
+	}{
+		{name: "absent"},
+		{name: "codex identity", telemetry: tracing.RuntimeTelemetry{
+			HarnessKind: tracing.HarnessKindCodex, AgentName: "assistant-codex", AgentNamespace: "kagent",
+		}},
+		{name: "another harness kind", telemetry: tracing.RuntimeTelemetry{HarnessKind: tracing.HarnessKindClaude}, wantError: true},
+		{name: "capture above the ceiling", telemetry: tracing.RuntimeTelemetry{
+			HarnessKind: tracing.HarnessKindCodex, CaptureContent: true, MaxCaptureBytes: tracing.MaxCaptureBytes + 1,
+		}, wantError: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			config := base
+			config.RuntimeTelemetry = test.telemetry
+			if err := config.Validate(); (err != nil) != test.wantError {
+				t.Fatalf("Validate() error = %v, wantError = %v", err, test.wantError)
+			}
+		})
+	}
+}
diff --git a/go/harness/codex/executor/executor.go b/go/harness/codex/executor/executor.go
index a577b0d51d..4499a75027 100644
--- a/go/harness/codex/executor/executor.go
+++ b/go/harness/codex/executor/executor.go
@@ -9,6 +9,7 @@ import (
 	"unicode"
 
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
+	"github.com/kagent-dev/kagent/go/harness/codex/config"
 	"github.com/kagent-dev/kagent/go/harness/codex/internal/adapter"
 	runtimea2a "github.com/kagent-dev/kagent/go/harness/runtime/a2a"
 	"github.com/kagent-dev/kagent/go/harness/runtime/continuation"
@@ -41,7 +42,15 @@ func New(ctx context.Context, cfg Config) (a2asrv.AgentExecutor, error) {
 	if err != nil {
 		return nil, err
 	}
-	executor, err := runtimea2a.New(runner, store)
+	// Read here rather than taken as a Config field: the identity travels in the
+	// compiled configuration this function already has, and an embedder that
+	// forgot to pass it would emit spans no consumer could attribute to a
+	// harness, which is a silence rather than an error.
+	parsed, err := config.Parse(cfg.ConfigJSON)
+	if err != nil {
+		return nil, err
+	}
+	executor, err := runtimea2a.New(runner, store, parsed.RuntimeTelemetry)
 	if err != nil {
 		return nil, err
 	}
diff --git a/go/harness/codex/executor/executor_test.go b/go/harness/codex/executor/executor_test.go
index 467b808ee3..94977ec398 100644
--- a/go/harness/codex/executor/executor_test.go
+++ b/go/harness/codex/executor/executor_test.go
@@ -2,8 +2,11 @@ package executor
 
 import (
 	"context"
+	"fmt"
 	"strings"
 	"testing"
+
+	"github.com/kagent-dev/kagent/go/harness/codex/config"
 )
 
 func TestNewRejectsBadInput(t *testing.T) {
@@ -12,7 +15,7 @@ func TestNewRejectsBadInput(t *testing.T) {
 		cfg     Config
 		wantErr string
 	}{
-		{name: "relative data dir", cfg: Config{ConfigJSON: []byte(`{"version":2,"codex_executable":"codex","model":"m","provider":{"name":"openai"},"max_frame_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`), DataDir: "relative/dir"}, wantErr: "absolute path"},
+		{name: "relative data dir", cfg: Config{ConfigJSON: fmt.Appendf(nil, `{"version":%d,"codex_executable":"codex","model":"m","provider":{"name":"openai"},"max_frame_bytes":100,"max_stderr_bytes":100,"interrupt_grace_millis":100}`, config.Version), DataDir: "relative/dir"}, wantErr: "absolute path"},
 		{name: "malformed config", cfg: Config{ConfigJSON: []byte(`{"version":`), DataDir: t.TempDir()}, wantErr: "decode config"},
 		{name: "unknown config field", cfg: Config{ConfigJSON: []byte(`{"nope":1}`), DataDir: t.TempDir()}, wantErr: "decode config"},
 	}
diff --git a/go/harness/codex/internal/adapter/adapter.go b/go/harness/codex/internal/adapter/adapter.go
index bd39821f4e..a6c8a82130 100644
--- a/go/harness/codex/internal/adapter/adapter.go
+++ b/go/harness/codex/internal/adapter/adapter.go
@@ -12,6 +12,7 @@ import (
 	"github.com/kagent-dev/kagent/go/harness/codex/config"
 	"github.com/kagent-dev/kagent/go/harness/codex/internal/driver"
 	"github.com/kagent-dev/kagent/go/harness/internal/utils"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"github.com/pelletier/go-toml/v2"
 )
 
@@ -66,6 +67,9 @@ func New(ctx context.Context, input Input) (*driver.ProcessDriver, error) {
 		return nil, fmt.Errorf("materialize Codex configuration: %w", err)
 	}
 	environment := setEnvironment(input.Environment, codexHomeEnv, codexHome)
+	// The native runtime inherits the compiled identity through the standard
+	// resource variable, so no user-supplied marker is required.
+	environment = tracing.ResourceEnvironment(environment, cfg.RuntimeTelemetry.Identity())
 	approvalServers := make(map[string]struct{})
 	for name, server := range cfg.MCPServers {
 		if server.RequireApproval {
diff --git a/go/harness/codex/internal/driver/process.go b/go/harness/codex/internal/driver/process.go
index 75ffc0beda..3ec7673829 100644
--- a/go/harness/codex/internal/driver/process.go
+++ b/go/harness/codex/internal/driver/process.go
@@ -360,6 +360,12 @@ func (p *pendingTurn) Request() runtime.InputRequest { return p.request }
 
 // Resume answers the correlated App Server request and continues consuming the
 // same process until it completes, fails, or returns another PendingTurn.
+//
+// The JSON-RPC response that releases the turn carries no trace context, and
+// the native turn began under the trace of the request that parked it. Work the
+// native runtime does after this point therefore stays under the originating
+// trace. The resumed A2A segment records a link to that origin rather than
+// claiming ownership of it.
 func (p *pendingTurn) Resume(ctx context.Context, response runtime.InputResponse, sink runtime.EventSink) (runtime.Outcome, error) {
 	sessionOwnedByPendingTurn := false
 	defer func() {
diff --git a/go/harness/runtime/a2a/executor.go b/go/harness/runtime/a2a/executor.go
index 4cbbf3ecf4..ae7e508a99 100644
--- a/go/harness/runtime/a2a/executor.go
+++ b/go/harness/runtime/a2a/executor.go
@@ -15,6 +15,9 @@ import (
 	a2alog "github.com/a2aproject/a2a-go/v2/log"
 	apia2a "github.com/kagent-dev/kagent/go/api/a2a"
 	"github.com/kagent-dev/kagent/go/harness/runtime"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 )
 
 // Runner is the execution capability consumed by the A2A supervisor.
@@ -35,6 +38,7 @@ type ContinuationStore interface {
 type Executor struct {
 	runner       Runner
 	continuation ContinuationStore
+	telemetry    tracing.RuntimeTelemetry
 
 	mu sync.Mutex
 	// state serializes access to the Actor's one native conversation. It also
@@ -60,9 +64,18 @@ type activeTask struct {
 }
 
 // parkedTask owns the PendingTurn while its A2A task is waiting for input.
+// origin is the invocation that parked it, so a later segment can record where
+// the work it continues began.
 type parkedTask struct {
 	taskRef
 	pending runtime.PendingTurn
+	origin  trace.SpanContext
+}
+
+// continuedTurn is the parked turn handed to the request that continues it.
+type continuedTurn struct {
+	pending runtime.PendingTurn
+	origin  trace.SpanContext
 }
 
 // cancelingTask keeps the Actor occupied while PendingTurn.Cancel performs
@@ -81,6 +94,7 @@ type executionSink struct {
 	reqCtx         *a2asrv.ExecutorContext
 	yield          func(a2atype.Event, error) bool
 	continuation   ContinuationStore
+	capture        *tracing.TextCapture
 	textArtifactID a2atype.ArtifactID
 	lastPosition   time.Time
 }
@@ -91,23 +105,74 @@ var (
 )
 
 // New constructs the shared executor used by native Harness implementations.
-func New(runner Runner, continuation ContinuationStore) (*Executor, error) {
+// The telemetry contract supplies the content-capture policy this executor
+// enforces; its zero value leaves capture disabled.
+func New(runner Runner, continuation ContinuationStore, telemetry tracing.RuntimeTelemetry) (*Executor, error) {
 	if runner == nil || continuation == nil {
 		return nil, fmt.Errorf("runner and continuation store are required")
 	}
-	return &Executor{runner: runner, continuation: continuation}, nil
+	if err := telemetry.Validate(); err != nil {
+		return nil, fmt.Errorf("invalid runtime telemetry: %w", err)
+	}
+	return &Executor{runner: runner, continuation: continuation, telemetry: telemetry}, nil
 }
 
 // Execute validates and serializes one A2A request onto the native Runner.
 func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext) iter.Seq2[a2atype.Event, error] {
 	return func(yield func(a2atype.Event, error) bool) {
+		// Execution owns invocation completion from here: a2a-go runs this
+		// detached from the caller, so a unary response can be delivered while
+		// the turn is still working.
+		invocation := tracing.InvocationFromContext(ctx)
+		if !invocation.Adopt() {
+			// Nothing to record against: either tracing is not installed or the
+			// caller disconnected before this execution started and the transport
+			// already completed the invocation.
+			invocation = nil
+		}
+		sink := &executionSink{reqCtx: reqCtx, yield: yield, continuation: e.continuation}
+		result := tracing.Result{}
+		endInvocation := func() {
+			invocation.SetAttributes(sink.captureAttributes()...)
+			if _, err := invocation.End(ctx, result); err != nil {
+				a2alog.Error(ctx, "failed to export A2A invocation traces", err)
+			}
+		}
+		// Quiescent paths complete the invocation before yielding their event, so
+		// the export happens while the Actor still runs. This covers the paths
+		// that yield no quiescent event at all, such as cancellation and an
+		// abandoned stream.
+		defer endInvocation()
+		if reqCtx != nil {
+			invocation.SetAttributes(requestIdentity(reqCtx)...)
+		}
+
 		turn, err := validateRequest(reqCtx)
 		if err != nil {
+			result.Error = "invalid_request"
 			yield(nil, err)
 			return
 		}
+		resuming := reqCtx.StoredTask != nil && requiresInput(reqCtx.StoredTask.Status.State)
+		segment := tracing.SegmentInitial
+		if resuming {
+			segment = tracing.SegmentResumed
+		}
+		invocation.SetAttributes(attribute.String(tracing.AttributeSegment, segment))
+		// Capture the current turn's prompt only. A segment that answers an
+		// approval or question carries a structured decision, not prompt text.
+		if limit := e.captureLimit(invocation); limit > 0 {
+			sink.capture = tracing.NewTextCapture(limit)
+			text, truncated := tracing.BoundedText(turn.Prompt, limit)
+			invocation.SetAttributes(
+				attribute.String(tracing.AttributeInput, text),
+				attribute.Bool(tracing.AttributeInputTruncated, truncated),
+			)
+		}
+
 		continuationID, _, err := e.continuation.Load()
 		if err != nil {
+			result.Error = "continuation_unavailable"
 			yield(nil, err)
 			return
 		}
@@ -117,21 +182,42 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			cancel:  cancel,
 			done:    make(chan struct{}),
 		}
-		resuming := reqCtx.StoredTask != nil && requiresInput(reqCtx.StoredTask.Status.State)
-		pending, err := e.activate(active, resuming)
+		continued, err := e.activate(active, resuming)
 		if err != nil {
 			cancel()
+			result.Error = "actor_unavailable"
 			yield(nil, err)
 			return
 		}
+		if continued != nil {
+			// A link states that this segment continues work another invocation
+			// started. It does not reparent spans or transfer ownership of the
+			// token usage recorded under the originating segment.
+			invocation.AddLink(trace.Link{
+				SpanContext: continued.origin,
+				Attributes:  []attribute.KeyValue{attribute.String(tracing.AttributeLinkRelationship, tracing.RelationshipResumeOrigin)},
+			})
+		}
 		var finishOnce sync.Once
 		finishedCanceled := false
+		// Cancel publishes the canceled event as soon as done closes, so a
+		// segment that cancellation claimed records its outcome and exports
+		// before that wait is released.
+		releaseCanceled := func() {
+			result = tracing.Result{
+				TaskState: string(a2atype.TaskStateCanceled), Disposition: tracing.DispositionCanceled,
+			}
+			endInvocation()
+		}
 		// Exactly one exit path either releases the Actor or parks the native
 		// handle. The deferred finish covers every early return.
 		finish := func() bool {
 			finishOnce.Do(func() {
 				cancel()
 				finishedCanceled = e.deactivate(active)
+				if finishedCanceled {
+					releaseCanceled()
+				}
 				close(active.done)
 			})
 			return finishedCanceled
@@ -140,10 +226,12 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			parked := false
 			finishOnce.Do(func() {
 				cancel()
-				parked = e.park(active, pending)
+				parked = e.park(active, pending, invocation.SpanContext())
 				if !parked {
 					_ = pending.Cancel(context.Background())
-					e.deactivate(active)
+					if e.deactivate(active) {
+						releaseCanceled()
+					}
 				}
 				close(active.done)
 			})
@@ -152,23 +240,34 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 		defer finish()
 
 		if !yield(a2atype.NewStatusUpdateEvent(reqCtx, a2atype.TaskStateWorking, nil), nil) {
+			result.Disposition = tracing.DispositionAbandoned
 			return
 		}
-		sink := &executionSink{reqCtx: reqCtx, yield: yield, continuation: e.continuation}
 		turn.ContinuationID = continuationID
 		var outcome runtime.Outcome
 		var runErr error
 		// activate returns a handle only when this request continues the task
 		// currently waiting for input. New turns enter through Runner.Run.
-		if pending == nil {
+		if continued == nil {
 			outcome, runErr = e.runner.Run(runCtx, turn, sink)
 		} else {
-			outcome, runErr = pending.Resume(runCtx, turn.InputResponse, sink)
+			outcome, runErr = continued.pending.Resume(runCtx, turn.InputResponse, sink)
 		}
 		if errors.Is(runErr, errYieldStopped) {
+			// The A2A event consumer stopped accepting events before execution
+			// finished. That is not a cancellation the client requested, so it is
+			// not reported as one.
+			result.Disposition = tracing.DispositionAbandoned
 			return
 		}
 		if errors.Is(runErr, context.Canceled) || errors.Is(runErr, context.DeadlineExceeded) {
+			// Cancel yields the canceled event from its own request, so complete
+			// the invocation here rather than waiting for an event that this
+			// execution never produces.
+			if !finish() {
+				result.Disposition = tracing.DispositionInterrupted
+			}
+			endInvocation()
 			return
 		}
 		if runErr != nil {
@@ -176,6 +275,8 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			if finish() {
 				return
 			}
+			result = tracing.Result{TaskState: string(a2atype.TaskStateFailed), Error: "runtime_error"}
+			endInvocation()
 			message := taskMessage(reqCtx, "Harness runtime execution failed")
 			message.SetMeta(apia2a.TimelinePositionMetadataKey, sink.nextTimelinePosition())
 			yield(a2atype.NewStatusUpdateEvent(reqCtx, a2atype.TaskStateFailed, message), nil)
@@ -186,6 +287,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			if finish() {
 				return
 			}
+			result.Error = "invalid_runtime_outcome"
 			yield(nil, fmt.Errorf("runtime returned both a failure and a pending turn"))
 			return
 		}
@@ -194,6 +296,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			message, err := inputRequiredMessage(reqCtx, outcome.Pending.Request())
 			if err != nil {
 				_ = outcome.Pending.Cancel(context.Background())
+				result.Error = "invalid_input_request"
 				yield(nil, err)
 				return
 			}
@@ -202,6 +305,8 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			if !park(outcome.Pending) {
 				return
 			}
+			result = tracing.Result{TaskState: string(a2atype.TaskStateInputRequired)}
+			endInvocation()
 			message.SetMeta(apia2a.TimelinePositionMetadataKey, sink.nextTimelinePosition())
 			yield(a2atype.NewStatusUpdateEvent(reqCtx, a2atype.TaskStateInputRequired, message), nil)
 			return
@@ -213,15 +318,55 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 		// publishing a terminal state. A client may submit its next turn as soon
 		// as it observes this event.
 		if outcome.Failure == nil {
+			result = tracing.Result{TaskState: string(a2atype.TaskStateCompleted)}
+			endInvocation()
 			yield(a2atype.NewStatusUpdateEvent(reqCtx, a2atype.TaskStateCompleted, nil), nil)
 			return
 		}
+		result = tracing.Result{TaskState: string(a2atype.TaskStateFailed), Error: "runtime_failure"}
+		endInvocation()
 		message := taskMessage(reqCtx, safeFailure(outcome.Failure.Message))
 		message.SetMeta(apia2a.TimelinePositionMetadataKey, sink.nextTimelinePosition())
 		yield(a2atype.NewStatusUpdateEvent(reqCtx, a2atype.TaskStateFailed, message), nil)
 	}
 }
 
+// requestIdentity is the resolved identity of one A2A request. It belongs on
+// the invocation span, never on the process-wide resource, because one runtime
+// process serves many conversations, tasks, and users.
+func requestIdentity(reqCtx *a2asrv.ExecutorContext) []attribute.KeyValue {
+	attributes := make([]attribute.KeyValue, 0, 2)
+	if reqCtx.ContextID != "" {
+		attributes = append(attributes, attribute.String(tracing.AttributeConversationID, reqCtx.ContextID))
+	}
+	if reqCtx.TaskID != "" {
+		attributes = append(attributes, attribute.String(tracing.AttributeTaskID, string(reqCtx.TaskID)))
+	}
+	return attributes
+}
+
+// captureLimit is the byte budget for this segment's content. It is zero unless
+// the compiler enabled capture and the invocation retains what it is given, so
+// a disabled or unsampled request allocates no collector at all.
+func (e *Executor) captureLimit(invocation *tracing.Invocation) int {
+	if !invocation.IsRecording() {
+		return 0
+	}
+	return e.telemetry.CaptureLimit()
+}
+
+// captureAttributes reports the text this segment produced. Absent attributes
+// mean capture is disabled; an empty value means the segment produced no text.
+func (s *executionSink) captureAttributes() []attribute.KeyValue {
+	if s.capture == nil {
+		return nil
+	}
+	return []attribute.KeyValue{
+		attribute.String(tracing.AttributeOutput, s.capture.Text()),
+		attribute.Bool(tracing.AttributeOutputTruncated, s.capture.Truncated()),
+	}
+}
+
 func (s *executionSink) SessionStarted(event runtime.SessionStarted) error {
 	if event.ContinuationID == "" {
 		return fmt.Errorf("runtime continuation ID is required")
@@ -236,6 +381,9 @@ func (s *executionSink) TextDelta(event runtime.TextDelta) error {
 	if event.Text == "" {
 		return nil
 	}
+	// Capture keeps only the first bounded slice of this segment's text. Every
+	// delta still reaches the caller in full.
+	s.capture.Append(event.Text)
 	var update *a2atype.TaskArtifactUpdateEvent
 	if s.textArtifactID == "" {
 		update = a2atype.NewArtifactEvent(s.reqCtx, a2atype.NewTextPart(event.Text))
@@ -452,7 +600,9 @@ func (r taskRef) matches(other taskRef) bool {
 	return r.taskID == other.taskID && r.contextID == other.contextID
 }
 
-func (e *Executor) activate(task *activeTask, resuming bool) (runtime.PendingTurn, error) {
+// activate claims the Actor for task. It returns a continued turn only when
+// this request continues the task currently waiting for input.
+func (e *Executor) activate(task *activeTask, resuming bool) (*continuedTurn, error) {
 	e.mu.Lock()
 	defer e.mu.Unlock()
 	switch state := e.state.(type) {
@@ -470,13 +620,13 @@ func (e *Executor) activate(task *activeTask, resuming bool) (runtime.PendingTur
 			return nil, fmt.Errorf("continuation does not match the parked task")
 		}
 		e.state = task
-		return state.pending, nil
+		return &continuedTurn{pending: state.pending, origin: state.origin}, nil
 	default:
 		return nil, errBusy
 	}
 }
 
-func (e *Executor) park(task *activeTask, pending runtime.PendingTurn) bool {
+func (e *Executor) park(task *activeTask, pending runtime.PendingTurn, origin trace.SpanContext) bool {
 	e.mu.Lock()
 	defer e.mu.Unlock()
 	if e.state != task {
@@ -487,7 +637,7 @@ func (e *Executor) park(task *activeTask, pending runtime.PendingTurn) bool {
 		// Keep the task active until the caller cancels the newly returned handle.
 		return false
 	}
-	e.state = &parkedTask{taskRef: task.taskRef, pending: pending}
+	e.state = &parkedTask{taskRef: task.taskRef, pending: pending, origin: origin}
 	return true
 }
 
diff --git a/go/harness/runtime/a2a/executor_test.go b/go/harness/runtime/a2a/executor_test.go
index 84dc1e02c3..8c008f3e31 100644
--- a/go/harness/runtime/a2a/executor_test.go
+++ b/go/harness/runtime/a2a/executor_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
 	apia2a "github.com/kagent-dev/kagent/go/api/a2a"
 	"github.com/kagent-dev/kagent/go/harness/runtime"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 )
 
 const (
@@ -94,7 +95,7 @@ func TestExecuteStreamsCompletesAndPersistsSession(t *testing.T) {
 			return runtime.Outcome{}, err
 		}
 		return runtime.Outcome{}, nil
-	}}, continuation)
+	}}, continuation, tracing.RuntimeTelemetry{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -147,7 +148,7 @@ func TestExecutePreservesTextAndToolOrder(t *testing.T) {
 			}
 		}
 		return runtime.Outcome{}, nil
-	}}, &fakeContinuation{})
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -213,7 +214,7 @@ func TestExecuteRejectsMalformedToolActivity(t *testing.T) {
 	for _, emit := range tests {
 		executor, err := New(fakeRunner{run: func(_ context.Context, _ runtime.Turn, sink runtime.EventSink) (runtime.Outcome, error) {
 			return runtime.Outcome{}, emit(sink)
-		}}, &fakeContinuation{})
+		}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -250,7 +251,7 @@ func assertToolActivity(t *testing.T, events []a2atype.Event, partType string, w
 func TestExecuteFailureBoundary(t *testing.T) {
 	executor, err := New(fakeRunner{run: func(context.Context, runtime.Turn, runtime.EventSink) (runtime.Outcome, error) {
 		return runtime.Outcome{Failure: &runtime.Failure{Message: "budget limit reached"}}, nil
-	}}, &fakeContinuation{})
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -269,7 +270,7 @@ func TestExecuteReleasesActiveTaskBeforeTerminalEvent(t *testing.T) {
 	executor, err := New(fakeRunner{run: func(context.Context, runtime.Turn, runtime.EventSink) (runtime.Outcome, error) {
 		close(runnerReturned)
 		return runtime.Outcome{}, nil
-	}}, &fakeContinuation{})
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -302,7 +303,7 @@ func TestBusyAndCancellation(t *testing.T) {
 		close(started)
 		<-ctx.Done()
 		return runtime.Outcome{}, ctx.Err()
-	}}, &fakeContinuation{})
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -338,7 +339,7 @@ func TestCancellationWinsPendingTurnRace(t *testing.T) {
 				return nil
 			},
 		}}, nil
-	}}, &fakeContinuation{})
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -400,7 +401,7 @@ func TestCancelParkedTurn(t *testing.T) {
 				},
 			}}, nil
 		},
-	}, &fakeContinuation{})
+	}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -441,7 +442,7 @@ func TestExecutePublishesAndConsumesStructuredApproval(t *testing.T) {
 				return runtime.Outcome{}, nil
 			},
 		}}, nil
-	}}, &fakeContinuation{})
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -481,7 +482,7 @@ func TestExecutePublishesAndConsumesAskUser(t *testing.T) {
 				return runtime.Outcome{}, nil
 			},
 		}}, nil
-	}}, &fakeContinuation{})
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/go/harness/runtime/a2a/tracing_test.go b/go/harness/runtime/a2a/tracing_test.go
new file mode 100644
index 0000000000..448039ae2c
--- /dev/null
+++ b/go/harness/runtime/a2a/tracing_test.go
@@ -0,0 +1,414 @@
+package a2a
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	a2atype "github.com/a2aproject/a2a-go/v2/a2a"
+	"github.com/a2aproject/a2a-go/v2/a2asrv"
+	apia2a "github.com/kagent-dev/kagent/go/api/a2a"
+	"github.com/kagent-dev/kagent/go/harness/runtime"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/sdk/trace/tracetest"
+	"go.opentelemetry.io/otel/trace"
+)
+
+// traceRecorder starts one invocation per request, the way the A2A transport
+// interceptor does, and collects what each segment exported.
+type traceRecorder struct {
+	exporter *tracetest.InMemoryExporter
+	tracer   trace.Tracer
+}
+
+func newTraceRecorder(t *testing.T) *traceRecorder {
+	t.Helper()
+	exporter := tracetest.NewInMemoryExporter()
+	provider := sdktrace.NewTracerProvider(sdktrace.WithSyncer(exporter))
+	t.Cleanup(func() { _ = provider.Shutdown(context.Background()) })
+	return &traceRecorder{exporter: exporter, tracer: provider.Tracer("test")}
+}
+
+func (r *traceRecorder) segment(ctx context.Context) context.Context {
+	ctx, _ = tracing.StartInvocation(ctx, r.tracer, "a2a.request", false)
+	return ctx
+}
+
+func (r *traceRecorder) spans(t *testing.T, want int) tracetest.SpanStubs {
+	t.Helper()
+	spans := r.exporter.GetSpans()
+	if len(spans) != want {
+		t.Fatalf("exported %d invocation spans, want %d", len(spans), want)
+	}
+	return spans
+}
+
+func attributeOf(span tracetest.SpanStub, key string) (attribute.Value, bool) {
+	for _, attr := range span.Attributes {
+		if string(attr.Key) == key {
+			return attr.Value, true
+		}
+	}
+	return attribute.Value{}, false
+}
+
+func stringAttribute(t *testing.T, span tracetest.SpanStub, key string) string {
+	t.Helper()
+	value, ok := attributeOf(span, key)
+	if !ok {
+		t.Fatalf("span is missing attribute %s", key)
+	}
+	return value.AsString()
+}
+
+func captureTelemetry(limit int) tracing.RuntimeTelemetry {
+	return tracing.RuntimeTelemetry{
+		HarnessKind: tracing.HarnessKindClaude, AgentName: "reporter-claude",
+		AgentNamespace: "kagent", CaptureContent: true, MaxCaptureBytes: limit,
+	}
+}
+
+func TestInvocationRecordsResolvedRequestIdentity(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	executor, err := New(fakeRunner{run: func(context.Context, runtime.Turn, runtime.EventSink) (runtime.Outcome, error) {
+		return runtime.Outcome{}, nil
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, errs := collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-identity", "hello")))
+	if len(errs) != 0 {
+		t.Fatalf("execution errors = %v", errs)
+	}
+
+	span := recorder.spans(t, 1)[0]
+	for key, want := range map[string]string{
+		tracing.AttributeConversationID: testContextID,
+		tracing.AttributeTaskID:         "task-identity",
+		tracing.AttributeSegment:        tracing.SegmentInitial,
+		tracing.AttributeTaskState:      string(a2atype.TaskStateCompleted),
+	} {
+		if got := stringAttribute(t, span, key); got != want {
+			t.Errorf("%s = %q, want %q", key, got, want)
+		}
+	}
+	if _, ok := attributeOf(span, tracing.AttributeInput); ok {
+		t.Error("capture is disabled by default, so no input attribute should be recorded")
+	}
+	if _, ok := attributeOf(span, tracing.AttributeOutput); ok {
+		t.Error("capture is disabled by default, so no output attribute should be recorded")
+	}
+}
+
+func TestInvocationRecordsRuntimeFailure(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	executor, err := New(fakeRunner{run: func(context.Context, runtime.Turn, runtime.EventSink) (runtime.Outcome, error) {
+		return runtime.Outcome{Failure: &runtime.Failure{Message: "provider rejected the api key sk-secret"}}, nil
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-failure", "hello")))
+
+	span := recorder.spans(t, 1)[0]
+	if span.Status.Code != codes.Error {
+		t.Errorf("status = %v, want an error status", span.Status.Code)
+	}
+	if got := stringAttribute(t, span, tracing.AttributeErrorType); got != "runtime_failure" {
+		t.Errorf("%s = %q, want a safe category", tracing.AttributeErrorType, got)
+	}
+	if strings.Contains(span.Status.Description, "sk-secret") {
+		t.Errorf("status description leaked the provider message: %q", span.Status.Description)
+	}
+	if got := stringAttribute(t, span, tracing.AttributeTaskState); got != string(a2atype.TaskStateFailed) {
+		t.Errorf("%s = %q, want %q", tracing.AttributeTaskState, got, a2atype.TaskStateFailed)
+	}
+}
+
+func TestInvocationRecordsCancellation(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	started := make(chan struct{})
+	executor, err := New(fakeRunner{run: func(ctx context.Context, _ runtime.Turn, _ runtime.EventSink) (runtime.Outcome, error) {
+		close(started)
+		<-ctx.Done()
+		return runtime.Outcome{}, ctx.Err()
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		collect(executor.Execute(recorder.segment(context.Background()), requestContext("task-cancel", "hello")))
+	}()
+	<-started
+	collect(executor.Cancel(t.Context(), requestContext("task-cancel", "ignored")))
+	<-done
+
+	span := recorder.spans(t, 1)[0]
+	if got := stringAttribute(t, span, tracing.AttributeDisposition); got != tracing.DispositionCanceled {
+		t.Errorf("%s = %q, want %q", tracing.AttributeDisposition, got, tracing.DispositionCanceled)
+	}
+	if got := stringAttribute(t, span, tracing.AttributeTaskState); got != string(a2atype.TaskStateCanceled) {
+		t.Errorf("%s = %q, want %q", tracing.AttributeTaskState, got, a2atype.TaskStateCanceled)
+	}
+	if span.Status.Code == codes.Error {
+		t.Error("cancellation was reported as an error")
+	}
+}
+
+// A consumer that stops reading is not a cancellation the client requested.
+func TestInvocationRecordsAbandonedStream(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	executor, err := New(fakeRunner{run: func(_ context.Context, _ runtime.Turn, sink runtime.EventSink) (runtime.Outcome, error) {
+		if err := sink.TextDelta(runtime.TextDelta{Text: "partial"}); err != nil {
+			return runtime.Outcome{}, err
+		}
+		return runtime.Outcome{}, nil
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for range executor.Execute(recorder.segment(t.Context()), requestContext("task-abandon", "hello")) {
+		break
+	}
+
+	span := recorder.spans(t, 1)[0]
+	if got := stringAttribute(t, span, tracing.AttributeDisposition); got != tracing.DispositionAbandoned {
+		t.Errorf("%s = %q, want %q", tracing.AttributeDisposition, got, tracing.DispositionAbandoned)
+	}
+	if _, ok := attributeOf(span, tracing.AttributeTaskState); ok {
+		t.Error("an abandoned stream reported a task state it never published")
+	}
+}
+
+func TestCaptureRecordsBoundedTurnContent(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	// Each character is three bytes, so a ten-byte budget cannot hold four of
+	// them and must not split the fourth either.
+	executor, err := New(fakeRunner{run: func(_ context.Context, _ runtime.Turn, sink runtime.EventSink) (runtime.Outcome, error) {
+		for range 4 {
+			if err := sink.TextDelta(runtime.TextDelta{Text: "日"}); err != nil {
+				return runtime.Outcome{}, err
+			}
+		}
+		return runtime.Outcome{}, nil
+	}}, &fakeContinuation{}, captureTelemetry(10))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-capture", strings.Repeat("p", 32))))
+
+	span := recorder.spans(t, 1)[0]
+	if got := stringAttribute(t, span, tracing.AttributeInput); got != strings.Repeat("p", 10) {
+		t.Errorf("%s = %q, want the first ten bytes of the prompt", tracing.AttributeInput, got)
+	}
+	if !boolAttribute(t, span, tracing.AttributeInputTruncated) {
+		t.Error("an oversized prompt did not report truncation")
+	}
+	if got := stringAttribute(t, span, tracing.AttributeOutput); got != "日日日" {
+		t.Errorf("%s = %q, want three whole characters", tracing.AttributeOutput, got)
+	}
+	if !boolAttribute(t, span, tracing.AttributeOutputTruncated) {
+		t.Error("an oversized response did not report truncation")
+	}
+}
+
+// Capture that is enabled but produced nothing is distinguishable from capture
+// that is off, which records no attributes at all.
+func TestCaptureRecordsEmptyOutput(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	executor, err := New(fakeRunner{run: func(context.Context, runtime.Turn, runtime.EventSink) (runtime.Outcome, error) {
+		return runtime.Outcome{}, nil
+	}}, &fakeContinuation{}, captureTelemetry(0))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-empty", "hello")))
+
+	span := recorder.spans(t, 1)[0]
+	if got := stringAttribute(t, span, tracing.AttributeOutput); got != "" {
+		t.Errorf("%s = %q, want an empty capture", tracing.AttributeOutput, got)
+	}
+	if boolAttribute(t, span, tracing.AttributeOutputTruncated) {
+		t.Error("an empty capture reported truncation")
+	}
+	if got := stringAttribute(t, span, tracing.AttributeInput); got != "hello" {
+		t.Errorf("%s = %q, want the prompt", tracing.AttributeInput, got)
+	}
+}
+
+// A failed turn still exports what it produced before the failure, and still
+// keeps the failure category out of the captured content.
+func TestCaptureRecordsOutputOfAFailedTurn(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	executor, err := New(fakeRunner{run: func(_ context.Context, _ runtime.Turn, sink runtime.EventSink) (runtime.Outcome, error) {
+		if err := sink.TextDelta(runtime.TextDelta{Text: "partial answer"}); err != nil {
+			return runtime.Outcome{}, err
+		}
+		return runtime.Outcome{Failure: &runtime.Failure{Message: "provider rejected the request"}}, nil
+	}}, &fakeContinuation{}, captureTelemetry(0))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-capture-failure", "hello")))
+
+	span := recorder.spans(t, 1)[0]
+	if got := stringAttribute(t, span, tracing.AttributeOutput); got != "partial answer" {
+		t.Errorf("%s = %q, want the text produced before the failure", tracing.AttributeOutput, got)
+	}
+	if got := stringAttribute(t, span, tracing.AttributeErrorType); got != "runtime_failure" {
+		t.Errorf("%s = %q, want a safe category", tracing.AttributeErrorType, got)
+	}
+}
+
+// Both segments of an approval belong to the same task. The resumed segment
+// links back to the one that parked it and captures only its own text.
+func TestResumeLinksToTheOriginatingSegment(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	executor, err := New(fakeRunner{run: func(_ context.Context, _ runtime.Turn, sink runtime.EventSink) (runtime.Outcome, error) {
+		if err := sink.TextDelta(runtime.TextDelta{Text: "before"}); err != nil {
+			return runtime.Outcome{}, err
+		}
+		return runtime.Outcome{Pending: &fakePendingTurn{
+			request: &runtime.ApprovalRequest{ID: "7", CallID: "call-1", Name: "tools.write", Hint: "Allow tools.write?"},
+			resume: func(_ context.Context, _ runtime.InputResponse, sink runtime.EventSink) (runtime.Outcome, error) {
+				if err := sink.TextDelta(runtime.TextDelta{Text: "after"}); err != nil {
+					return runtime.Outcome{}, err
+				}
+				return runtime.Outcome{}, nil
+			},
+		}}, nil
+	}}, &fakeContinuation{}, captureTelemetry(0))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	first := requestContext("task-resume", "write")
+	events, errs := collect(executor.Execute(recorder.segment(t.Context()), first))
+	if len(errs) != 0 || len(events) != 3 {
+		t.Fatalf("first segment events/errors = %#v/%v", events, errs)
+	}
+	update, ok := events[2].(*a2atype.TaskStatusUpdateEvent)
+	if !ok || update.Status.State != a2atype.TaskStateInputRequired {
+		t.Fatalf("input-required event = %#v", events[2])
+	}
+	decision := a2atype.NewMessage(a2atype.MessageRoleUser)
+	decision.TaskID, decision.ContextID = first.TaskID, first.ContextID
+	if err := apia2a.AttachHITL(decision, apia2a.ToolApprovalResponse{
+		Type: apia2a.HITLTypeToolApprovalResponse, Approvals: []apia2a.ToolApproval{{ID: "7", Approved: true}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	second := &a2asrv.ExecutorContext{
+		TaskID: first.TaskID, ContextID: first.ContextID, Message: decision,
+		StoredTask: &a2atype.Task{ID: first.TaskID, ContextID: first.ContextID, Status: a2atype.TaskStatus{
+			State: a2atype.TaskStateInputRequired, Message: update.Status.Message,
+		}},
+	}
+	if _, errs := collect(executor.Execute(recorder.segment(t.Context()), second)); len(errs) != 0 {
+		t.Fatalf("second segment errors = %v", errs)
+	}
+
+	spans := recorder.spans(t, 2)
+	origin, resumed := spans[0], spans[1]
+	if got := stringAttribute(t, origin, tracing.AttributeSegment); got != tracing.SegmentInitial {
+		t.Errorf("origin %s = %q, want %q", tracing.AttributeSegment, got, tracing.SegmentInitial)
+	}
+	if got := stringAttribute(t, origin, tracing.AttributeTaskState); got != string(a2atype.TaskStateInputRequired) {
+		t.Errorf("origin %s = %q, want %q", tracing.AttributeTaskState, got, a2atype.TaskStateInputRequired)
+	}
+	if got := stringAttribute(t, resumed, tracing.AttributeSegment); got != tracing.SegmentResumed {
+		t.Errorf("resumed %s = %q, want %q", tracing.AttributeSegment, got, tracing.SegmentResumed)
+	}
+	if len(resumed.Links) != 1 || resumed.Links[0].SpanContext.SpanID() != origin.SpanContext.SpanID() {
+		t.Fatalf("resumed links = %#v, want one link to the originating segment", resumed.Links)
+	}
+	if got := linkAttribute(resumed.Links[0], tracing.AttributeLinkRelationship); got != tracing.RelationshipResumeOrigin {
+		t.Errorf("link %s = %q, want %q", tracing.AttributeLinkRelationship, got, tracing.RelationshipResumeOrigin)
+	}
+	if got := stringAttribute(t, resumed, tracing.AttributeTaskID); got != string(first.TaskID) {
+		t.Errorf("resumed %s = %q, want the same task", tracing.AttributeTaskID, got)
+	}
+	if got := stringAttribute(t, origin, tracing.AttributeOutput); got != "before" {
+		t.Errorf("origin %s = %q, want only the text that segment produced", tracing.AttributeOutput, got)
+	}
+	if got := stringAttribute(t, resumed, tracing.AttributeOutput); got != "after" {
+		t.Errorf("resumed %s = %q, want only the text that segment produced", tracing.AttributeOutput, got)
+	}
+	// An approval decision is structured outcome metadata, not prompt text.
+	if got := stringAttribute(t, resumed, tracing.AttributeInput); got != "" {
+		t.Errorf("resumed %s = %q, want no captured prompt", tracing.AttributeInput, got)
+	}
+}
+
+func boolAttribute(t *testing.T, span tracetest.SpanStub, key string) bool {
+	t.Helper()
+	value, ok := attributeOf(span, key)
+	if !ok {
+		t.Fatalf("span is missing attribute %s", key)
+	}
+	return value.AsBool()
+}
+
+func linkAttribute(link sdktrace.Link, key string) string {
+	for _, attr := range link.Attributes {
+		if string(attr.Key) == key {
+			return attr.Value.AsString()
+		}
+	}
+	return ""
+}
+
+// Cancel publishes its canceled event as soon as the executor releases the
+// Actor, and the gateway may suspend the Actor on that event. The segment has
+// to be exported before the event is yielded, not merely before execution
+// returns.
+func TestCancellationExportsBeforeYieldingItsEvent(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	started := make(chan struct{})
+	executor, err := New(fakeRunner{run: func(ctx context.Context, _ runtime.Turn, _ runtime.EventSink) (runtime.Outcome, error) {
+		close(started)
+		<-ctx.Done()
+		return runtime.Outcome{}, ctx.Err()
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		collect(executor.Execute(recorder.segment(context.Background()), requestContext("task-cancel-order", "hello")))
+	}()
+	<-started
+
+	events := 0
+	for event, err := range executor.Cancel(t.Context(), requestContext("task-cancel-order", "ignored")) {
+		if err != nil {
+			t.Fatalf("cancellation error = %v", err)
+		}
+		events++
+		if _, ok := event.(*a2atype.TaskStatusUpdateEvent); !ok {
+			t.Fatalf("cancellation event = %#v", event)
+		}
+		if exported := len(recorder.exporter.GetSpans()); exported != 1 {
+			t.Fatalf("exported %d spans when the canceled event was published, want the segment already exported", exported)
+		}
+	}
+	<-done
+	if events != 1 {
+		t.Fatalf("cancellation yielded %d events, want one", events)
+	}
+	recorder.spans(t, 1)
+}
diff --git a/go/pkg/tracing/capture.go b/go/pkg/tracing/capture.go
new file mode 100644
index 0000000000..78e30fa3b8
--- /dev/null
+++ b/go/pkg/tracing/capture.go
@@ -0,0 +1,97 @@
+package tracing
+
+import (
+	"strings"
+	"unicode/utf8"
+)
+
+// TextCapture accumulates the beginning of a text stream up to a byte limit.
+// Once the limit is reached it records that fact and discards further input
+// without retaining or copying it, so the memory one capture can hold stays
+// proportional to the limit regardless of response length or delta count.
+// The zero value is unusable; construct it with NewTextCapture.
+type TextCapture struct {
+	limit     int
+	buffer    []byte
+	truncated bool
+}
+
+// NewTextCapture returns a collector bounded to limit bytes, or nil when limit
+// is not positive. A nil collector accepts appends and yields no text, so
+// callers do not branch on whether capture is enabled.
+func NewTextCapture(limit int) *TextCapture {
+	if limit <= 0 {
+		return nil
+	}
+	return &TextCapture{limit: limit}
+}
+
+// Append adds as much of text as the remaining budget holds. Nothing is
+// accepted after the first truncation, because a budget that could still hold
+// a later, shorter fragment would otherwise splice text that was never
+// adjacent in the stream.
+func (c *TextCapture) Append(text string) {
+	if c == nil || text == "" || c.truncated {
+		return
+	}
+	remaining := c.limit - len(c.buffer)
+	if remaining <= 0 {
+		c.truncated = true
+		return
+	}
+	if len(text) <= remaining {
+		if c.buffer == nil {
+			c.buffer = make([]byte, 0, min(c.limit, len(text)*2))
+		}
+		c.buffer = append(c.buffer, text...)
+		return
+	}
+	if c.buffer == nil {
+		c.buffer = make([]byte, 0, c.limit)
+	}
+	c.buffer = append(c.buffer, text[:runeBoundary(text, remaining)]...)
+	c.truncated = true
+}
+
+// Text returns the captured prefix.
+func (c *TextCapture) Text() string {
+	if c == nil {
+		return ""
+	}
+	return string(c.buffer)
+}
+
+// Truncated reports whether any input was dropped.
+func (c *TextCapture) Truncated() bool {
+	return c != nil && c.truncated
+}
+
+// BoundedText returns the longest prefix of text within limit bytes and
+// whether it was shortened. A limit that is not positive yields no text.
+//
+// The prefix is copied. A slice of the original would keep the whole input
+// alive for as long as the span holding it is buffered, which would make the
+// limit bound the exported value rather than the memory capture costs.
+func BoundedText(text string, limit int) (string, bool) {
+	if limit <= 0 {
+		return "", text != ""
+	}
+	if len(text) <= limit {
+		return text, false
+	}
+	return strings.Clone(text[:runeBoundary(text, limit)]), true
+}
+
+// runeBoundary returns the largest cut point at or below limit that does not
+// split a UTF-8 encoded rune.
+func runeBoundary(text string, limit int) int {
+	if limit >= len(text) {
+		return len(text)
+	}
+	for cut := limit; cut > 0; cut-- {
+		if utf8.RuneStart(text[cut]) {
+			return cut
+		}
+	}
+	return 0
+}
diff --git a/go/pkg/tracing/capture_test.go b/go/pkg/tracing/capture_test.go
new file mode 100644
index 0000000000..52edc99d9c
--- /dev/null
+++ b/go/pkg/tracing/capture_test.go
@@ -0,0 +1,111 @@
+package tracing
+
+import (
+	"strings"
+	"testing"
+	"unicode/utf8"
+	"unsafe"
+)
+
+func TestTextCaptureDisabled(t *testing.T) {
+	capture := NewTextCapture(0)
+	if capture != nil {
+		t.Fatalf("NewTextCapture(0) = %v, want nil", capture)
+	}
+	capture.Append("dropped")
+	if capture.Text() != "" || capture.Truncated() {
+		t.Fatalf("disabled capture retained %q (truncated = %v)", capture.Text(), capture.Truncated())
+	}
+}
+
+func TestTextCaptureKeepsThePrefix(t *testing.T) {
+	capture := NewTextCapture(8)
+	capture.Append("abc")
+	capture.Append("de")
+	if capture.Text() != "abcde" || capture.Truncated() {
+		t.Fatalf("capture = %q (truncated = %v), want %q", capture.Text(), capture.Truncated(), "abcde")
+	}
+}
+
+func TestTextCaptureTruncatesOnARuneBoundary(t *testing.T) {
+	// Each character is three bytes, so a nine-byte budget cannot hold the
+	// fourth one and must not keep half of it either.
+	capture := NewTextCapture(9)
+	capture.Append(strings.Repeat("ü", 1))
+	capture.Append(strings.Repeat("日", 4))
+	text := capture.Text()
+	if !capture.Truncated() {
+		t.Fatal("capture did not report truncation")
+	}
+	if !utf8.ValidString(text) {
+		t.Fatalf("capture = %q, want valid UTF-8", text)
+	}
+	if len(text) > 9 {
+		t.Fatalf("capture retained %d bytes, want at most 9", len(text))
+	}
+}
+
+func TestTextCaptureBoundsMemoryAcrossManyDeltas(t *testing.T) {
+	capture := NewTextCapture(64)
+	for range 10_000 {
+		capture.Append("0123456789")
+	}
+	if got := len(capture.Text()); got != 64 {
+		t.Fatalf("capture retained %d bytes, want the 64-byte budget", got)
+	}
+	if !capture.Truncated() {
+		t.Fatal("capture did not report truncation")
+	}
+}
+
+func TestBoundedText(t *testing.T) {
+	for _, test := range []struct {
+		name          string
+		text          string
+		limit         int
+		want          string
+		wantTruncated bool
+	}{
+		{name: "within limit", text: "hello", limit: 16, want: "hello"},
+		{name: "exact limit", text: "hello", limit: 5, want: "hello"},
+		{name: "truncated", text: "hello", limit: 3, want: "hel", wantTruncated: true},
+		{name: "multibyte", text: "日本", limit: 4, want: "日", wantTruncated: true},
+		{name: "disabled with text", text: "hello", limit: 0, wantTruncated: true},
+		{name: "disabled without text", limit: 0},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			text, truncated := BoundedText(test.text, test.limit)
+			if text != test.want || truncated != test.wantTruncated {
+				t.Fatalf("BoundedText() = %q, %v, want %q, %v", text, truncated, test.want, test.wantTruncated)
+			}
+		})
+	}
+}
+
+// A budget with room left after a rune did not fit must not be filled by a
+// later, shorter delta, which would splice text that was never adjacent.
+func TestTextCaptureStopsAtTheFirstTruncation(t *testing.T) {
+	capture := NewTextCapture(4)
+	capture.Append("日")
+	capture.Append("本")
+	capture.Append("x")
+	if got := capture.Text(); got != "日" {
+		t.Fatalf("capture = %q, want the bounded prefix %q", got, "日")
+	}
+	if !capture.Truncated() {
+		t.Fatal("capture did not report truncation")
+	}
+}
+
+// A shortened prefix must not keep the whole input alive, or the budget would
+// bound the exported value rather than the memory capture costs.
+func TestBoundedTextDoesNotRetainTheInput(t *testing.T) {
+	text := strings.Repeat("p", 1<<20)
+	bounded, truncated := BoundedText(text, 16)
+	if !truncated || len(bounded) != 16 {
+		t.Fatalf("BoundedText() = %d bytes, truncated = %v", len(bounded), truncated)
+	}
+	if unsafe.StringData(bounded) == unsafe.StringData(text) {
+		t.Fatal("bounded text shares the input's backing array")
+	}
+}
diff --git a/go/pkg/tracing/invocation.go b/go/pkg/tracing/invocation.go
new file mode 100644
index 0000000000..f03c55d898
--- /dev/null
+++ b/go/pkg/tracing/invocation.go
@@ -0,0 +1,168 @@
+package tracing
+
+import (
+	"context"
+	"sync"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/trace"
+)
+
+type invocationKey struct{}
+
+// Invocation is the request-scoped handle for the span that represents one A2A
+// execution segment. The transport interceptor starts it and completes it while
+// it still owns it. Execution takes ownership when it begins, so a unary
+// response that returns while detached execution continues cannot report a
+// finished invocation early. Completion runs exactly once no matter how many
+// callbacks observe the same outcome.
+//
+// Every method tolerates a nil handle, so callers do not branch on whether
+// tracing is installed.
+type Invocation struct {
+	span  trace.Span
+	flush bool
+
+	mu       sync.Mutex
+	adopted  bool
+	finished bool
+}
+
+// Result is the outcome recorded when an invocation completes. Error is a safe
+// category such as "runtime_failure"; it never carries a provider response, a
+// credential, or captured content.
+type Result struct {
+	TaskState   string
+	Disposition string
+	Error       string
+}
+
+// StartInvocation begins an invocation span and returns a context carrying its
+// handle. Static attributes are applied at start so a request that fails before
+// execution still reports the identity of the runtime that rejected it. Setting
+// context attributes later cannot change a span that has already started.
+//
+// flush requests a bounded export when the invocation completes, for runtimes
+// whose Actor may be suspended as soon as a quiescent event leaves the process.
+func StartInvocation(ctx context.Context, tracer trace.Tracer, name string, flush bool, attributes ...attribute.KeyValue) (context.Context, *Invocation) {
+	ctx, span := tracer.Start(ctx, name, trace.WithAttributes(attributes...))
+	invocation := &Invocation{span: span, flush: flush}
+	return context.WithValue(ctx, invocationKey{}, invocation), invocation
+}
+
+// InvocationFromContext returns the handle started for this request, or nil.
+func InvocationFromContext(ctx context.Context) *Invocation {
+	invocation, _ := ctx.Value(invocationKey{}).(*Invocation)
+	return invocation
+}
+
+// Adopt transfers completion to the component that runs the request. The
+// transport interceptor stops completing the invocation once it is adopted.
+//
+// It reports false when there is nothing to adopt, either because tracing is
+// not installed or because the transport already completed the invocation.
+// a2a-go dispatches execution before the caller's subscription is read, so a
+// caller that disconnects in that window ends the invocation from the
+// transport side and this execution is left untraced.
+func (i *Invocation) Adopt() bool {
+	if i == nil {
+		return false
+	}
+	i.mu.Lock()
+	defer i.mu.Unlock()
+	if i.finished {
+		return false
+	}
+	i.adopted = true
+	return true
+}
+
+// SetAttributes records attributes on an invocation that has not completed.
+func (i *Invocation) SetAttributes(attributes ...attribute.KeyValue) {
+	if i == nil || len(attributes) == 0 {
+		return
+	}
+	i.mu.Lock()
+	defer i.mu.Unlock()
+	if i.finished {
+		return
+	}
+	i.span.SetAttributes(attributes...)
+}
+
+// AddLink relates this invocation to another span without reparenting either.
+func (i *Invocation) AddLink(link trace.Link) {
+	if i == nil || !link.SpanContext.IsValid() {
+		return
+	}
+	i.mu.Lock()
+	defer i.mu.Unlock()
+	if i.finished {
+		return
+	}
+	i.span.AddLink(link)
+}
+
+// SpanContext identifies this invocation for links recorded by later segments.
+func (i *Invocation) SpanContext() trace.SpanContext {
+	if i == nil {
+		return trace.SpanContext{}
+	}
+	return i.span.SpanContext()
+}
+
+// IsRecording reports whether the invocation will retain what it is given.
+// Content capture consults it before allocating any buffer.
+func (i *Invocation) IsRecording() bool {
+	return i != nil && i.span.IsRecording()
+}
+
+// End completes the invocation from the component that owns execution. It
+// reports whether this call ended the span, and any export failure the caller
+// should log.
+func (i *Invocation) End(ctx context.Context, result Result) (bool, error) {
+	return i.end(ctx, result, true)
+}
+
+// EndTransport completes the invocation from the transport interceptor. It does
+// nothing once execution has adopted the invocation, so a response observed
+// ahead of the execution boundary cannot close the segment early.
+func (i *Invocation) EndTransport(ctx context.Context, result Result) (bool, error) {
+	return i.end(ctx, result, false)
+}
+
+func (i *Invocation) end(ctx context.Context, result Result, owner bool) (bool, error) {
+	if i == nil {
+		return false, nil
+	}
+	i.mu.Lock()
+	if i.finished || (!owner && i.adopted) {
+		i.mu.Unlock()
+		return false, nil
+	}
+	i.finished = true
+	attributes := make([]attribute.KeyValue, 0, 3)
+	if result.TaskState != "" {
+		attributes = append(attributes, attribute.String(AttributeTaskState, result.TaskState))
+	}
+	if result.Disposition != "" {
+		attributes = append(attributes, attribute.String(AttributeDisposition, result.Disposition))
+	}
+	if result.Error != "" {
+		attributes = append(attributes, attribute.String(AttributeErrorType, result.Error))
+	}
+	i.span.SetAttributes(attributes...)
+	if result.Error != "" {
+		i.span.SetStatus(codes.Error, result.Error)
+	}
+	i.span.End()
+	flush := i.flush
+	i.mu.Unlock()
+	if !flush {
+		return true, nil
+	}
+	// ForceFlush detaches from caller cancellation and bounds its own wait, so a
+	// collector outage costs at most that budget once per segment.
+	return true, ForceFlush(ctx)
+}
diff --git a/go/pkg/tracing/invocation_test.go b/go/pkg/tracing/invocation_test.go
new file mode 100644
index 0000000000..5106a5c256
--- /dev/null
+++ b/go/pkg/tracing/invocation_test.go
@@ -0,0 +1,176 @@
+package tracing
+
+import (
+	"context"
+	"testing"
+
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/codes"
+	"go.opentelemetry.io/otel/sdk/trace/tracetest"
+	"go.opentelemetry.io/otel/trace"
+
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+)
+
+func recordingTracer(t *testing.T) (trace.Tracer, *tracetest.InMemoryExporter) {
+	t.Helper()
+	exporter := tracetest.NewInMemoryExporter()
+	provider := sdktrace.NewTracerProvider(sdktrace.WithSyncer(exporter))
+	t.Cleanup(func() { _ = provider.Shutdown(context.Background()) })
+	return provider.Tracer("test"), exporter
+}
+
+func TestNilInvocationIsUsable(t *testing.T) {
+	var invocation *Invocation
+	invocation.Adopt()
+	invocation.SetAttributes(attribute.String("k", "v"))
+	invocation.AddLink(trace.Link{})
+	if invocation.IsRecording() || invocation.SpanContext().IsValid() {
+		t.Fatal("nil invocation reported a live span")
+	}
+	if ended, err := invocation.End(t.Context(), Result{}); ended || err != nil {
+		t.Fatalf("End() on a nil invocation = %v, %v", ended, err)
+	}
+}
+
+func TestInvocationEndsExactlyOnce(t *testing.T) {
+	tracer, exporter := recordingTracer(t)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false,
+		attribute.String(AttributeHarnessKind, "codex"))
+
+	ended, err := invocation.End(ctx, Result{TaskState: "TASK_STATE_COMPLETED"})
+	if !ended || err != nil {
+		t.Fatalf("first End() = %v, %v", ended, err)
+	}
+	if ended, _ := invocation.End(ctx, Result{TaskState: "TASK_STATE_FAILED"}); ended {
+		t.Fatal("second End() ended the invocation again")
+	}
+	spans := exporter.GetSpans()
+	if len(spans) != 1 {
+		t.Fatalf("exported %d spans, want exactly one", len(spans))
+	}
+	if got := attributeValue(spans[0].Attributes, AttributeTaskState); got != "TASK_STATE_COMPLETED" {
+		t.Fatalf("task state = %q, want the first outcome", got)
+	}
+}
+
+func TestAdoptedInvocationIgnoresTheTransport(t *testing.T) {
+	tracer, exporter := recordingTracer(t)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	invocation.Adopt()
+
+	if ended, _ := invocation.EndTransport(ctx, Result{TaskState: "TASK_STATE_COMPLETED"}); ended {
+		t.Fatal("transport ended an invocation execution had adopted")
+	}
+	if len(exporter.GetSpans()) != 0 {
+		t.Fatal("adopted invocation was exported before execution finished")
+	}
+	if ended, _ := invocation.End(ctx, Result{TaskState: "TASK_STATE_FAILED", Error: "runtime_error"}); !ended {
+		t.Fatal("execution could not end the invocation it adopted")
+	}
+	spans := exporter.GetSpans()
+	if len(spans) != 1 {
+		t.Fatalf("exported %d spans, want exactly one", len(spans))
+	}
+	if spans[0].Status.Code != codes.Error || spans[0].Status.Description != "runtime_error" {
+		t.Fatalf("status = %v %q, want an error status carrying the safe category", spans[0].Status.Code, spans[0].Status.Description)
+	}
+}
+
+func TestTransportEndsUnadoptedInvocation(t *testing.T) {
+	tracer, exporter := recordingTracer(t)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+
+	if ended, _ := invocation.EndTransport(ctx, Result{Error: "transport_error"}); !ended {
+		t.Fatal("transport could not end an invocation it still owned")
+	}
+	spans := exporter.GetSpans()
+	if len(spans) != 1 || spans[0].Status.Code != codes.Error {
+		t.Fatalf("spans = %#v, want one span with an error status", spans)
+	}
+}
+
+func TestInvocationRecordsDispositionAndLinks(t *testing.T) {
+	tracer, exporter := recordingTracer(t)
+	originCtx, origin := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	originContext := origin.SpanContext()
+	if _, err := origin.End(originCtx, Result{TaskState: "TASK_STATE_INPUT_REQUIRED"}); err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	invocation.AddLink(trace.Link{
+		SpanContext: originContext,
+		Attributes:  []attribute.KeyValue{attribute.String(AttributeLinkRelationship, RelationshipResumeOrigin)},
+	})
+	if _, err := invocation.End(ctx, Result{Disposition: DispositionAbandoned}); err != nil {
+		t.Fatal(err)
+	}
+
+	spans := exporter.GetSpans()
+	if len(spans) != 2 {
+		t.Fatalf("exported %d spans, want two", len(spans))
+	}
+	resumed := spans[1]
+	if got := attributeValue(resumed.Attributes, AttributeDisposition); got != DispositionAbandoned {
+		t.Fatalf("disposition = %q, want %q", got, DispositionAbandoned)
+	}
+	if len(resumed.Links) != 1 || resumed.Links[0].SpanContext.SpanID() != originContext.SpanID() {
+		t.Fatalf("links = %#v, want one link to the origin span", resumed.Links)
+	}
+	if resumed.Parent.IsValid() {
+		t.Fatal("a link must not reparent the resumed segment")
+	}
+}
+
+func TestFinishedInvocationIgnoresLateWrites(t *testing.T) {
+	tracer, exporter := recordingTracer(t)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	if _, err := invocation.End(ctx, Result{}); err != nil {
+		t.Fatal(err)
+	}
+	invocation.SetAttributes(attribute.String(AttributeOutput, "late"))
+
+	spans := exporter.GetSpans()
+	if len(spans) != 1 {
+		t.Fatalf("exported %d spans, want one", len(spans))
+	}
+	if got := attributeValue(spans[0].Attributes, AttributeOutput); got != "" {
+		t.Fatalf("output = %q, want nothing recorded after completion", got)
+	}
+}
+
+func attributeValue(attributes []attribute.KeyValue, key string) string {
+	for _, attr := range attributes {
+		if string(attr.Key) == key {
+			return attr.Value.AsString()
+		}
+	}
+	return ""
+}
+
+// a2a-go dispatches execution before the caller's subscription is read, so a
+// caller that disconnects in that window completes the invocation from the
+// transport side. Execution must be told, rather than writing into a span that
+// can no longer record any of it.
+func TestAdoptRefusesAFinishedInvocation(t *testing.T) {
+	tracer, exporter := recordingTracer(t)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	if !invocation.Adopt() {
+		t.Fatal("Adopt() refused a live invocation")
+	}
+
+	_, transport := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	if _, err := transport.EndTransport(ctx, Result{Error: "transport_error"}); err != nil {
+		t.Fatal(err)
+	}
+	if transport.Adopt() {
+		t.Fatal("Adopt() accepted an invocation the transport already completed")
+	}
+	if ended, _ := transport.End(ctx, Result{TaskState: "TASK_STATE_COMPLETED"}); ended {
+		t.Fatal("End() reopened a completed invocation")
+	}
+	if len(exporter.GetSpans()) != 1 {
+		t.Fatalf("exported %d spans, want only the transport's", len(exporter.GetSpans()))
+	}
+}
diff --git a/go/pkg/tracing/runtime.go b/go/pkg/tracing/runtime.go
new file mode 100644
index 0000000000..38d2f649fd
--- /dev/null
+++ b/go/pkg/tracing/runtime.go
@@ -0,0 +1,252 @@
+package tracing
+
+import (
+	"fmt"
+	"slices"
+	"strings"
+
+	"go.opentelemetry.io/otel/attribute"
+)
+
+// Span and resource attribute keys produced by Harness runtimes. Consumers
+// read these names directly, so treat them as a published contract.
+const (
+	// AttributeHarnessKind names the native runtime behind an invocation. A
+	// Harness object's configurable name is not its kind.
+	AttributeHarnessKind = "kagent.harness.kind"
+	// AttributeAgentName is the compiled agent identity, <template>-<harness>.
+	AttributeAgentName = "gen_ai.agent.name"
+	// AttributeConversationID is the A2A context that groups a conversation.
+	AttributeConversationID = "gen_ai.conversation.id"
+	// AttributeTaskID is the A2A task an invocation executes.
+	AttributeTaskID = "gen_ai.task.id"
+	// AttributeUserID is the gateway-established user, absent when no trusted
+	// identity reached the runtime.
+	AttributeUserID = "kagent.user_id"
+	// AttributeTaskState is the A2A state execution actually reported.
+	AttributeTaskState = "a2a.task.state"
+	// AttributeSegment distinguishes the first execution of a task from the
+	// segments that continue it after an approval or question.
+	AttributeSegment = "kagent.invocation.segment"
+	// AttributeDisposition records how a segment stopped when that is not
+	// visible from the task state, such as an abandoned client stream.
+	AttributeDisposition = "kagent.invocation.disposition"
+	// AttributeInput and AttributeOutput carry bounded turn content, recorded
+	// only under the content-capture opt-in. The truncation flags are siblings
+	// rather than children of them, because a backend that stores attributes as
+	// a nested document cannot hold a string and an object at the same path:
+	// ClickHouse renders both and a reader parsing the result keeps only the
+	// last, dropping the captured text, and Elasticsearch rejects the mapping
+	// outright.
+	AttributeInput           = "kagent.input"
+	AttributeInputTruncated  = "kagent.input_truncated"
+	AttributeOutput          = "kagent.output"
+	AttributeOutputTruncated = "kagent.output_truncated"
+	// AttributeErrorType is a safe failure category. It never carries provider
+	// responses, credentials, or captured content.
+	AttributeErrorType = "error.type"
+	// AttributeLinkRelationship describes why a segment links to another span.
+	AttributeLinkRelationship = "kagent.invocation.relationship"
+)
+
+// Segment values for AttributeSegment.
+const (
+	SegmentInitial = "initial"
+	SegmentResumed = "resumed"
+)
+
+// Disposition values for AttributeDisposition.
+const (
+	// DispositionAbandoned means the A2A event consumer stopped reading. It is
+	// deliberately distinct from cancellation, which the client must request.
+	DispositionAbandoned = "abandoned"
+	// DispositionCanceled means cancellation was requested for this task.
+	DispositionCanceled = "canceled"
+	// DispositionInterrupted means the execution context ended without a
+	// cancellation request, such as a runtime shutting down mid-turn.
+	DispositionInterrupted = "interrupted"
+)
+
+// RelationshipResumeOrigin marks the link from a resumed segment back to the
+// segment that parked the task. A link states a relationship; it does not
+// reparent spans or transfer ownership of token usage.
+const RelationshipResumeOrigin = "resume_origin"
+
+// HarnessKind identifies the native runtime a Harness compiles to.
+type HarnessKind string
+
+const (
+	HarnessKindClaude HarnessKind = "claude"
+	HarnessKindCodex  HarnessKind = "codex"
+)
+
+// DefaultCaptureBytes bounds captured input and output when a configuration
+// enables capture without choosing a limit.
+const DefaultCaptureBytes = 16 << 10
+
+// MaxCaptureBytes is the hard ceiling on captured input and output. It bounds
+// per-request memory and the payload each invocation adds to the exporter
+// queue, independently of response length.
+const MaxCaptureBytes = 64 << 10
+
+// RuntimeTelemetry is the compiler-owned telemetry contract carried in a
+// Harness runtime configuration. It supplies the static identity every span
+// and resource needs and the content-capture policy the runtime enforces.
+// Request identity is never part of it, since one runtime process serves many
+// conversations, tasks, and users.
+//
+// A configuration without this section stays valid: the runtime keeps its
+// environment-derived service identity and capture stays off.
+type RuntimeTelemetry struct {
+	HarnessKind     HarnessKind `json:"harness_kind,omitempty"`
+	AgentName       string      `json:"agent_name,omitempty"`
+	AgentNamespace  string      `json:"agent_namespace,omitempty"`
+	CaptureContent  bool        `json:"capture_content,omitempty"`
+	MaxCaptureBytes int         `json:"max_capture_bytes,omitempty"`
+}
+
+// Validate rejects configurations a compiler could not have produced.
+func (t RuntimeTelemetry) Validate() error {
+	switch t.HarnessKind {
+	case "", HarnessKindClaude, HarnessKindCodex:
+	default:
+		return fmt.Errorf("unsupported harness kind %q", t.HarnessKind)
+	}
+	// Identity is all or nothing. A partial identity would mark a span as a
+	// harness invocation while leaving a user-supplied agent name
+	// authoritative, since Identity omits the keys it does not have.
+	present := 0
+	for _, value := range []string{string(t.HarnessKind), t.AgentName, t.AgentNamespace} {
+		if value != "" {
+			present++
+		}
+	}
+	if present != 0 && present != 3 {
+		return fmt.Errorf("telemetry identity requires a harness kind, agent name, and namespace together")
+	}
+	if strings.TrimSpace(t.AgentName) != t.AgentName || strings.TrimSpace(t.AgentNamespace) != t.AgentNamespace {
+		return fmt.Errorf("telemetry agent identity must not have surrounding whitespace")
+	}
+	if t.MaxCaptureBytes < 0 || t.MaxCaptureBytes > MaxCaptureBytes {
+		return fmt.Errorf("telemetry capture limit must be between 0 and %d bytes", MaxCaptureBytes)
+	}
+	return nil
+}
+
+// Identity returns the trusted static attributes stamped on every invocation
+// span and on the runtime resource.
+func (t RuntimeTelemetry) Identity() []attribute.KeyValue {
+	attributes := make([]attribute.KeyValue, 0, 2)
+	if t.HarnessKind != "" {
+		attributes = append(attributes, attribute.String(AttributeHarnessKind, string(t.HarnessKind)))
+	}
+	if t.AgentName != "" {
+		attributes = append(attributes, attribute.String(AttributeAgentName, t.AgentName))
+	}
+	return attributes
+}
+
+// CaptureLimit is the effective byte budget for one captured input or output.
+// It is zero when capture is disabled.
+func (t RuntimeTelemetry) CaptureLimit() int {
+	if !t.CaptureContent {
+		return 0
+	}
+	if t.MaxCaptureBytes <= 0 {
+		return DefaultCaptureBytes
+	}
+	if t.MaxCaptureBytes > MaxCaptureBytes {
+		return MaxCaptureBytes
+	}
+	return t.MaxCaptureBytes
+}
+
+// MergeResourceAttributes renders an OTEL_RESOURCE_ATTRIBUTES value that keeps
+// user-supplied attributes and makes owned keys authoritative. Native child
+// processes inherit their identity this way, so a user tuning unrelated
+// attributes cannot displace it and a user-supplied marker is never required.
+//
+// Entries without a key are dropped. A repeated key keeps its last value, which
+// is what the OpenTelemetry SDK resolves the same string to, so a runtime and
+// the native process it supervises cannot disagree about a user-supplied attribute.
+func MergeResourceAttributes(existing string, owned []attribute.KeyValue) string {
+	ownedKeys := make(map[string]struct{}, len(owned))
+	for _, attr := range owned {
+		ownedKeys[string(attr.Key)] = struct{}{}
+	}
+	merged := make([]string, 0, len(owned)+4)
+	seen := make(map[string]int, len(owned))
+	for entry := range strings.SplitSeq(existing, ",") {
+		entry = strings.TrimSpace(entry)
+		if entry == "" {
+			continue
+		}
+		key, _, ok := strings.Cut(entry, "=")
+		key = strings.TrimSpace(key)
+		if !ok || key == "" {
+			continue
+		}
+		if _, owned := ownedKeys[key]; owned {
+			continue
+		}
+		if position, duplicate := seen[key]; duplicate {
+			merged[position] = entry
+			continue
+		}
+		seen[key] = len(merged)
+		merged = append(merged, entry)
+	}
+	ownedEntries := make([]string, 0, len(owned))
+	for _, attr := range owned {
+		value := strings.TrimSpace(attr.Value.String())
+		if value == "" {
+			continue
+		}
+		ownedEntries = append(ownedEntries, string(attr.Key)+"="+encodeResourceValue(value))
+	}
+	slices.Sort(ownedEntries)
+	return strings.Join(append(merged, ownedEntries...), ",")
+}
+
+// encodeResourceValue applies the W3C Baggage percent-encoding that the OTEL
+// specification requires of OTEL_RESOURCE_ATTRIBUTES values.
+func encodeResourceValue(value string) string {
+	var builder strings.Builder
+	builder.Grow(len(value))
+	for index := 0; index < len(value); index++ {
+		character := value[index]
+		if character >= 0x21 && character <= 0x7e && character != '"' && character != ',' &&
+			character != ';' && character != '\\' && character != '=' && character != '%' {
+			builder.WriteByte(character)
+			continue
+		}
+		fmt.Fprintf(&builder, "%%%02X", character)
+	}
+	return builder.String()
+}
+
+// ResourceEnvironmentVariable is the standard OTEL resource attribute carrier.
+const ResourceEnvironmentVariable = "OTEL_RESOURCE_ATTRIBUTES"
+
+// ResourceEnvironment merges owned attributes into the OTEL_RESOURCE_ATTRIBUTES
+// entry of a child process environment, so a native runtime reports the same
+// identity as the Go wrapper that supervises it. User-supplied attributes
+// survive; owned keys are replaced. The variable is dropped when the merge
+// leaves nothing to set.
+func ResourceEnvironment(environment []string, owned []attribute.KeyValue) []string {
+	prefix := ResourceEnvironmentVariable + "="
+	existing := ""
+	result := make([]string, 0, len(environment)+1)
+	for _, variable := range environment {
+		if value, found := strings.CutPrefix(variable, prefix); found {
+			existing = value
+			continue
+		}
+		result = append(result, variable)
+	}
+	merged := MergeResourceAttributes(existing, owned)
+	if merged == "" {
+		return result
+	}
+	return append(result, prefix+merged)
+}
diff --git a/go/pkg/tracing/runtime_test.go b/go/pkg/tracing/runtime_test.go
new file mode 100644
index 0000000000..cd1abe7d55
--- /dev/null
+++ b/go/pkg/tracing/runtime_test.go
@@ -0,0 +1,152 @@
+package tracing
+
+import (
+	"slices"
+	"strings"
+	"testing"
+
+	"go.opentelemetry.io/otel/attribute"
+)
+
+func TestRuntimeTelemetryValidate(t *testing.T) {
+	for _, test := range []struct {
+		name      string
+		telemetry RuntimeTelemetry
+		wantError bool
+	}{
+		{name: "empty is valid"},
+		{name: "claude", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindClaude, AgentName: "a-h", AgentNamespace: "kagent"}},
+		{name: "codex", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentName: "a-h", AgentNamespace: "kagent"}},
+		{name: "capture without identity", telemetry: RuntimeTelemetry{CaptureContent: true, MaxCaptureBytes: 1024}},
+		{name: "unknown kind", telemetry: RuntimeTelemetry{HarnessKind: "gemini", AgentName: "a-h", AgentNamespace: "kagent"}, wantError: true},
+		{name: "identity without kind", telemetry: RuntimeTelemetry{AgentName: "a-h", AgentNamespace: "kagent"}, wantError: true},
+		{name: "identity without name", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentNamespace: "kagent"}, wantError: true},
+		{name: "identity without namespace", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentName: "a-h"}, wantError: true},
+		{name: "padded agent name", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentName: " a-h ", AgentNamespace: "kagent"}, wantError: true},
+		{name: "negative limit", telemetry: RuntimeTelemetry{MaxCaptureBytes: -1}, wantError: true},
+		{name: "limit above ceiling", telemetry: RuntimeTelemetry{MaxCaptureBytes: MaxCaptureBytes + 1}, wantError: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			err := test.telemetry.Validate()
+			if (err != nil) != test.wantError {
+				t.Fatalf("Validate() error = %v, wantError = %v", err, test.wantError)
+			}
+		})
+	}
+}
+
+func TestCaptureLimitDefaultsOff(t *testing.T) {
+	for _, test := range []struct {
+		name      string
+		telemetry RuntimeTelemetry
+		want      int
+	}{
+		{name: "disabled by default", telemetry: RuntimeTelemetry{}, want: 0},
+		{name: "disabled ignores limit", telemetry: RuntimeTelemetry{MaxCaptureBytes: 1024}, want: 0},
+		{name: "enabled without limit", telemetry: RuntimeTelemetry{CaptureContent: true}, want: DefaultCaptureBytes},
+		{name: "enabled with limit", telemetry: RuntimeTelemetry{CaptureContent: true, MaxCaptureBytes: 1024}, want: 1024},
+		{name: "clamped to ceiling", telemetry: RuntimeTelemetry{CaptureContent: true, MaxCaptureBytes: MaxCaptureBytes * 4}, want: MaxCaptureBytes},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if got := test.telemetry.CaptureLimit(); got != test.want {
+				t.Fatalf("CaptureLimit() = %d, want %d", got, test.want)
+			}
+		})
+	}
+}
+
+func TestIdentityOmitsUnsetFields(t *testing.T) {
+	if got := (RuntimeTelemetry{}).Identity(); len(got) != 0 {
+		t.Fatalf("Identity() = %v, want none", got)
+	}
+	got := RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentName: "reporter-codex", AgentNamespace: "team"}.Identity()
+	want := []attribute.KeyValue{
+		attribute.String(AttributeHarnessKind, "codex"),
+		attribute.String(AttributeAgentName, "reporter-codex"),
+	}
+	if !slices.Equal(got, want) {
+		t.Fatalf("Identity() = %v, want %v", got, want)
+	}
+}
+
+func TestMergeResourceAttributes(t *testing.T) {
+	owned := RuntimeTelemetry{HarnessKind: HarnessKindClaude, AgentName: "reporter-claude"}.Identity()
+	for _, test := range []struct {
+		name     string
+		existing string
+		owned    []attribute.KeyValue
+		want     string
+	}{
+		{name: "empty existing", owned: owned, want: "gen_ai.agent.name=reporter-claude,kagent.harness.kind=claude"},
+		{
+			name: "user attributes preserved", existing: "deployment.environment=prod,team=sre", owned: owned,
+			want: "deployment.environment=prod,team=sre,gen_ai.agent.name=reporter-claude,kagent.harness.kind=claude",
+		},
+		{
+			name: "owned key replaces user value", existing: "kagent.harness.kind=codex,team=sre", owned: owned,
+			want: "team=sre,gen_ai.agent.name=reporter-claude,kagent.harness.kind=claude",
+		},
+		{
+			// The OpenTelemetry SDK resolves the same string to the last value, so
+			// the wrapper and its native child cannot disagree about this key.
+			name: "duplicate user key keeps the last", existing: "team=sre,team=platform", owned: nil,
+			want: "team=platform",
+		},
+		{
+			name: "duplicate user key keeps its original position", existing: "team=sre,zone=a,team=platform", owned: nil,
+			want: "team=platform,zone=a",
+		},
+		{name: "unparsable entries dropped", existing: "novalue, ,=orphan,team=sre", owned: nil, want: "team=sre"},
+		{name: "empty owned value dropped", owned: []attribute.KeyValue{attribute.String("kagent.harness.kind", "  ")}, want: ""},
+		{
+			name: "value is percent encoded", owned: []attribute.KeyValue{attribute.String("gen_ai.agent.name", "a b,c=d")},
+			want: "gen_ai.agent.name=a%20b%2Cc%3Dd",
+		},
+		{name: "nothing to merge", want: ""},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if got := MergeResourceAttributes(test.existing, test.owned); got != test.want {
+				t.Fatalf("MergeResourceAttributes() = %q, want %q", got, test.want)
+			}
+		})
+	}
+}
+
+func TestResourceEnvironmentReplacesOnlyTheResourceVariable(t *testing.T) {
+	environment := []string{"PATH=/usr/bin", "OTEL_RESOURCE_ATTRIBUTES=team=sre,kagent.harness.kind=stale", "HOME=/data"}
+	got := ResourceEnvironment(environment, RuntimeTelemetry{HarnessKind: HarnessKindCodex}.Identity())
+	want := []string{"PATH=/usr/bin", "HOME=/data", "OTEL_RESOURCE_ATTRIBUTES=team=sre,kagent.harness.kind=codex"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("ResourceEnvironment() = %v, want %v", got, want)
+	}
+}
+
+func TestResourceEnvironmentDropsTheVariableWhenNothingRemains(t *testing.T) {
+	got := ResourceEnvironment([]string{"OTEL_RESOURCE_ATTRIBUTES=", "PATH=/usr/bin"}, nil)
+	if !slices.Equal(got, []string{"PATH=/usr/bin"}) {
+		t.Fatalf("ResourceEnvironment() = %v, want only PATH", got)
+	}
+}
+
+// TestAttributeNamesAreNotNamespaces keeps every published attribute name from
+// being a dotted prefix of another. A backend that stores attributes as a
+// nested document cannot hold a value and an object at the same path, so a name
+// that is also a namespace silently costs a consumer the value: ClickHouse's
+// JSON type renders both and a reader keeps the last, while Elasticsearch
+// rejects the mapping. The wire format is flat, so nothing upstream of storage
+// reports the conflict.
+func TestAttributeNamesAreNotNamespaces(t *testing.T) {
+	names := []string{
+		AttributeHarnessKind, AttributeAgentName, AttributeConversationID, AttributeTaskID,
+		AttributeUserID, AttributeTaskState, AttributeSegment, AttributeDisposition,
+		AttributeInput, AttributeInputTruncated, AttributeOutput, AttributeOutputTruncated,
+		AttributeErrorType, AttributeLinkRelationship,
+	}
+	for _, namespace := range names {
+		for _, name := range names {
+			if name != namespace && strings.HasPrefix(name, namespace+".") {
+				t.Errorf("%q is both an attribute and the namespace of %q", namespace, name)
+			}
+		}
+	}
+}
diff --git a/go/pkg/tracing/tracing.go b/go/pkg/tracing/tracing.go
index 47a2820d4d..71b739054a 100644
--- a/go/pkg/tracing/tracing.go
+++ b/go/pkg/tracing/tracing.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc"
 	"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"
 	"go.opentelemetry.io/otel/propagation"
@@ -21,17 +22,23 @@ import (
 
 // Init configures the global tracer provider and W3C propagator from the
 // standard OTEL environment. It is intended to be called once by a process
-// entrypoint. KAGENT_NAME identifies the service when set; fallbackServiceName
-// supports standalone harness validation where the compiler-owned environment
-// may be absent.
-func Init(ctx context.Context, fallbackServiceName string) (func(context.Context) error, bool, error) {
+// entrypoint. The compiler-owned telemetry contract identifies the service when
+// it is present, then KAGENT_NAME; fallbackServiceName supports standalone
+// harness validation where neither is available.
+func Init(ctx context.Context, fallbackServiceName string, telemetry RuntimeTelemetry) (func(context.Context) error, bool, error) {
 	if !strings.EqualFold(strings.TrimSpace(os.Getenv("OTEL_TRACING_ENABLED")), "true") {
 		return func(context.Context) error { return nil }, false, nil
 	}
-	serviceName := environmentValue("KAGENT_NAME", fallbackServiceName)
-	serviceNamespace := environmentValue("KAGENT_NAMESPACE", "default")
+	serviceName := telemetry.AgentName
+	if serviceName == "" {
+		serviceName = environmentValue("KAGENT_NAME", fallbackServiceName)
+	}
+	serviceNamespace := telemetry.AgentNamespace
+	if serviceNamespace == "" {
+		serviceNamespace = environmentValue("KAGENT_NAMESPACE", "default")
+	}
 
-	res, err := NewResource(ctx, serviceName, serviceNamespace)
+	res, err := NewResource(ctx, serviceName, serviceNamespace, telemetry.Identity()...)
 	if err != nil {
 		return nil, true, err
 	}
@@ -44,10 +51,15 @@ func Init(ctx context.Context, fallbackServiceName string) (func(context.Context
 	return provider.Shutdown, true, nil
 }
 
-// NewResource combines service identity, SDK metadata, and OTEL resource attributes.
-func NewResource(ctx context.Context, serviceName, serviceNamespace string) (*resource.Resource, error) {
-	return resource.New(ctx, resource.WithFromEnv(), resource.WithTelemetrySDK(), resource.WithAttributes(
-		semconv.ServiceNameKey.String(serviceName), semconv.ServiceNamespaceKey.String(serviceNamespace)))
+// NewResource combines service identity, SDK metadata, and OTEL resource
+// attributes. Owned attributes are applied after the environment, so users
+// keep OTEL_RESOURCE_ATTRIBUTES for unrelated tuning while the compiler-supplied
+// identity stays authoritative.
+func NewResource(ctx context.Context, serviceName, serviceNamespace string, owned ...attribute.KeyValue) (*resource.Resource, error) {
+	attributes := append([]attribute.KeyValue{
+		semconv.ServiceNameKey.String(serviceName), semconv.ServiceNamespaceKey.String(serviceNamespace),
+	}, owned...)
+	return resource.New(ctx, resource.WithFromEnv(), resource.WithTelemetrySDK(), resource.WithAttributes(attributes...))
 }
 
 // NewTracerProvider creates a batched OTLP provider without installing it globally.

From 43491941ab090c76824e99368102b42accac4101 Mon Sep 17 00:00:00 2001
From: David Haifley <david.haifley@solo.io>
Date: Mon, 21 Sep 2026 11:53:32 -0400
Subject: [PATCH 2/4] feat(tracing): align the invocation span with the GenAI
 semantic conventions

Signed-off-by: David Haifley <david.haifley@solo.io>
---
 docs/architecture/telemetry.md                | 100 +++++++---
 go/adk/cmd/main.go                            |  10 +-
 go/adk/pkg/a2a/executor.go                    |   7 +
 go/adk/pkg/a2a/server/server.go               |  14 +-
 go/adk/pkg/a2a/server/tracing.go              |  44 +++--
 go/adk/pkg/a2a/server/tracing_test.go         |  77 +++++---
 go/adk/pkg/app/app.go                         |  17 +-
 go/adk/pkg/telemetry/attributes.go            |   8 +-
 go/adk/pkg/telemetry/attributes_test.go       |   5 +-
 go/adk/pkg/telemetry/tracing.go               |  13 +-
 go/adk/pkg/telemetry/tracing_test.go          |   7 +-
 go/core/internal/a2a/trace.go                 |  40 ----
 go/core/internal/a2a/trace_test.go            |  67 -------
 go/core/internal/telemetry/tracing.go         |   2 +-
 .../internal/translator/claude/compiler.go    |   4 +-
 .../translator/claude/compiler_test.go        |   7 +-
 go/core/internal/translator/codex/compiler.go |   4 +-
 .../translator/codex/compiler_test.go         |   3 +-
 go/core/internal/translator/otel.go           |  56 +++++-
 go/core/internal/translator/otel_test.go      |   2 +
 go/core/test/e2e/tracing_test.go              |  61 +++---
 go/harness/claude/config/config.go            |   4 +-
 go/harness/claude/config/config_test.go       |   6 +-
 go/harness/codex/config/config.go             |   4 +-
 go/harness/codex/config/config_test.go        |   6 +-
 go/harness/runtime/a2a/executor.go            |  45 ++---
 go/harness/runtime/a2a/tracing_test.go        |  43 ++--
 go/pkg/tracing/capture.go                     |  28 +++
 go/pkg/tracing/capture_test.go                |  13 ++
 go/pkg/tracing/invocation_test.go             |  22 +--
 go/pkg/tracing/runtime.go                     | 186 +++++++++++++-----
 go/pkg/tracing/runtime_test.go                |  81 +++++---
 go/pkg/tracing/tracing.go                     |  10 +-
 33 files changed, 619 insertions(+), 377 deletions(-)
 delete mode 100644 go/core/internal/a2a/trace.go
 delete mode 100644 go/core/internal/a2a/trace_test.go

diff --git a/docs/architecture/telemetry.md b/docs/architecture/telemetry.md
index bdb8502f16..740b120316 100644
--- a/docs/architecture/telemetry.md
+++ b/docs/architecture/telemetry.md
@@ -22,39 +22,88 @@ the result into each runtime revision.
 An unusable capture budget is reported as a compilation warning and replaced by
 the default, so an observability setting cannot invalidate an AgentTemplate.
 
+The capture decision reaches every runtime as the standard GenAI instrumentation
+variable, `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT`, rendered `true`
+or `false` alongside the trace exporter settings. The ADK runtime reads it
+before recording model request and response payloads on its model spans, and
+the harness runtimes carry the same decision in their compiled configuration.
+It is controller-owned, so a `Harness.spec.env` entry with that name is
+rejected: one setting decides whether prompts enter traces, and no runtime can
+be talked into recording them by a user-supplied variable.
+
 Other `OTEL_*` variables remain available for per-Harness tuning through
 `Harness.spec.env`, including `OTEL_RESOURCE_ATTRIBUTES`.
 
+## Conventions
+
+Attribute names follow the OpenTelemetry GenAI semantic conventions at version
+1.41.0, and every tracer kagent creates declares that schema URL. The pin is
+deliberate: 1.41.0 is the last release of the main conventions to carry the
+GenAI registry, so it is the last one with a Go package of typed keys. The GenAI
+conventions now live in their own repository, and the pin moves when that
+repository publishes a release with a Go package. Names the conventions define
+are taken from that package rather than spelled out, so the constants in
+`go/pkg/tracing` cannot drift from the declared version. Only the `kagent.*` and
+`a2a.*` names are kagent's own, and they are listed below.
+
 ## The invocation span
 
-Each A2A `SendMessage` or `SendStreamingMessage` request opens one span named
-`a2a.request` in the instrumentation scope
-`github.com/kagent-dev/kagent/go/adk/pkg/a2a/server`. It represents one
-execution segment and is the anchor consumers should read. Model and tool spans
-come from the runtime itself and are descendants of it.
+Each A2A `SendMessage` or `SendStreamingMessage` request opens one span in the
+instrumentation scope `github.com/kagent-dev/kagent/go/adk/pkg/a2a/server`. It
+represents one execution segment, and what it is called depends on whether
+anything beneath it describes the agent invocation.
+
+For a native harness, Claude Code or Codex, nothing does: the native runtime
+emits model and tool spans but no agent invocation. The request span is
+therefore the GenAI conventions' `invoke_agent` operation, named
+`invoke_agent <gen_ai.agent.name>`, and it is the anchor consumers should read.
+
+For the ADK runtime the ADK emits exactly one `invoke_agent` of its own per
+turn, carrying `gen_ai.agent.name` and `gen_ai.conversation.id`, and that span
+is the invocation. The request span stays a transport span named `a2a.request`
+with the same identity attributes and no `gen_ai.operation.name`, so a consumer
+counting invocations by operation counts each ADK turn once. The ADK also keeps
+an `invocation` span of its own beneath the request span.
 
 | Attribute | Meaning |
 | --- | --- |
-| `a2a.method` | `SendMessage` or `SendStreamingMessage` |
-| `kagent.harness.kind` | `claude` or `codex`. Absent for ADK agents, which are not native harnesses |
+| `gen_ai.operation.name` | `invoke_agent` on a native harness request span. Absent on an ADK request span |
+| `kagent.runtime` | `adk-go`, `claude`, or `codex`: the runtime that produced the spans beneath this one. The Go ADK also carries it on its resource, so its own `invoke_agent` reports it |
 | `gen_ai.agent.name` | The compiled agent identity, `<template>-<harness>` |
+| `gen_ai.agent.id` | The same identity qualified by namespace, `<namespace>/<template>-<harness>` |
+| `gen_ai.provider.name` | The model provider the agent is compiled against, in the conventions' vocabulary. Harness runtimes only |
+| `gen_ai.request.model` | The model the agent is compiled against. Harness runtimes only; the ADK reports the model on each model span |
 | `gen_ai.conversation.id` | The A2A context ID the gateway assigned |
-| `gen_ai.task.id` | The A2A task ID the gateway assigned |
-| `kagent.user_id` | The authenticated user, when the gateway forwarded one |
+| `a2a.task.id` | The A2A task ID the gateway assigned |
+| `enduser.id` | The authenticated user, when the gateway forwarded one |
+| `a2a.method` | `SendMessage` or `SendStreamingMessage` |
 | `a2a.task.state` | The state execution actually reported. Its absence does not mean success |
 | `kagent.invocation.segment` | `initial` or `resumed` |
 | `kagent.invocation.disposition` | `canceled`, `abandoned`, or `interrupted`, when the task state does not say it. See below |
 | `error.type` | A safe failure category. Never a provider response, credential, or captured content |
-| `kagent.input`, `kagent.output` | Bounded turn content, present only under the capture opt-in |
-| `kagent.input_truncated`, `kagent.output_truncated` | Whether that content was shortened |
+| `gen_ai.input.messages`, `gen_ai.output.messages` | Bounded turn content in the conventions' message shape, present only under the capture opt-in |
+| `kagent.capture.input_truncated`, `kagent.capture.output_truncated` | Whether that content was shortened |
+
+The provider and model on this span stand in for what a native runtime does not
+report. Codex records token usage on a span that names no model, so without the
+compiled model a consumer cannot attribute that usage without walking the trace.
+The conventions allow the model on an agent span when the agent is bound to one
+model, which a compiled kagent agent is.
 
 The runtime resource carries `service.name` and `service.namespace` from the
-compiled agent identity, plus `kagent.harness.kind` and `gen_ai.agent.name`. The
-adapter merges those last two into `OTEL_RESOURCE_ATTRIBUTES` for the native
-child process, so its spans report the same agent while keeping its own
-`service.name`. Conversation, task, and user identity never appear on a
+compiled agent identity, plus the same `kagent.runtime`, `gen_ai.agent.name`,
+`gen_ai.agent.id`, `gen_ai.provider.name` and `gen_ai.request.model`. The
+harness adapters merge those into `OTEL_RESOURCE_ATTRIBUTES` for the native
+child process, so its spans report the same agent and model while keeping its
+own `service.name`. Conversation, task, and user identity never appear on a
 resource, since one runtime process serves many of each.
 
+The ADK runtime additionally stamps `kagent.user_id`, `gen_ai.task.id`,
+`gen_ai.conversation.id` and `kagent.app_name` on the spans beneath the
+invocation, as it always has; the Python runtimes stamp the same keys. Those
+descendant keys move to the names above together with a Python invocation span,
+so the two runtimes change in one step rather than diverging further.
+
 ## Completion and ownership
 
 The transport interceptor opens the span with the identity the runtime knows
@@ -88,7 +137,7 @@ the native runtime does after an approval therefore stays under the originating
 trace.
 
 Kagent does not paper over this. Each execution segment gets its own
-`a2a.request` span carrying the same conversation and task identity, and a
+request span carrying the same conversation and task identity, and a
 resumed segment records an OpenTelemetry link back to the segment that parked
 it, with `kagent.invocation.relationship` set to `resume_origin`. A link states
 a relationship. It does not reparent spans and it does not transfer ownership of
@@ -98,14 +147,17 @@ several segments for one task and should not assume the last one owns the work.
 ## Content capture
 
 Capture is off unless a user turns it on. When it is on, a segment records
-the current turn's prompt and the text that segment produced, each bounded by
-the configured byte budget, preserving UTF-8 and reporting truncation. Tool
-arguments, tool results, approval structures, the rest of the conversation, and
-native stderr are never recorded in these attributes. An approval decision stays
-structured outcome metadata rather than prompt text.
-
-Absent `kagent.input` and `kagent.output` mean capture is disabled. Present but
-empty means the segment produced no text.
+the current turn's prompt as `gen_ai.input.messages` and the text that segment
+produced as `gen_ai.output.messages`, each a JSON array holding one message with
+one text part, in the shape the conventions define for those attributes. The
+text is bounded by the configured byte budget, preserving UTF-8 and reporting
+truncation; the structure around it is not counted. Tool arguments, tool
+results, approval structures, the rest of the conversation, and native stderr
+are never recorded in these attributes.
+
+Absent output messages mean capture is disabled; a message with empty text
+means the segment produced none. A resumed segment records no input messages,
+because its input is a structured approval or answer rather than prompt text.
 
 These attributes come from the Go wrapper, which is only one of the producers.
 Suppressing them does not establish privacy for native runtime events or log
diff --git a/go/adk/cmd/main.go b/go/adk/cmd/main.go
index 84140537bb..530c6a39f9 100644
--- a/go/adk/cmd/main.go
+++ b/go/adk/cmd/main.go
@@ -22,6 +22,7 @@ import (
 	"github.com/kagent-dev/kagent/go/adk/pkg/telemetry"
 	"github.com/kagent-dev/kagent/go/core/pkg/env"
 	"github.com/kagent-dev/kagent/go/pkg/logging"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 )
 
 const (
@@ -104,7 +105,13 @@ func main() {
 	if serviceNamespace == "" {
 		serviceNamespace = "default"
 	}
-	shutdownTelemetry, telemetryEnabled, telErr := telemetry.Init(context.Background(), serviceName, serviceNamespace)
+	// The same identity reaches the resource and every invocation span, so a
+	// consumer reads one contract whichever runtime executed the agent. Model
+	// identity stays on the model spans the ADK emits per call.
+	runtimeTelemetry := tracing.RuntimeTelemetry{
+		Runtime: tracing.RuntimeADKGo, AgentName: serviceName, AgentNamespace: serviceNamespace,
+	}
+	shutdownTelemetry, telemetryEnabled, telErr := telemetry.Init(context.Background(), runtimeTelemetry)
 	if telErr != nil {
 		logger.Error("failed to initialize ADK telemetry providers; continuing without telemetry export", "error", telErr)
 	} else if telemetryEnabled {
@@ -220,6 +227,7 @@ func main() {
 		ShutdownTimeout: 5 * time.Second,
 		Logger:          logger,
 		Agent:           runnerConfig.Agent,
+		Telemetry:       runtimeTelemetry,
 	}, executor)
 	if err != nil {
 		logger.Error("failed to create app", "error", err)
diff --git a/go/adk/pkg/a2a/executor.go b/go/adk/pkg/a2a/executor.go
index 44da5b62d0..7ddcdcad07 100644
--- a/go/adk/pkg/a2a/executor.go
+++ b/go/adk/pkg/a2a/executor.go
@@ -15,6 +15,7 @@ import (
 	"github.com/kagent-dev/kagent/go/adk/pkg/models"
 	"github.com/kagent-dev/kagent/go/adk/pkg/telemetry"
 	apia2a "github.com/kagent-dev/kagent/go/api/a2a"
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/trace"
 	adkagent "google.golang.org/adk/v2/agent"
@@ -134,6 +135,12 @@ func (e *KAgentExecutor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorCon
 
 		ctx = withBearerToken(ctx)
 		ctx = auth.WithUserID(ctx, userID)
+		// The invocation span started before this executor ran, so the request
+		// identity the span processor stamps on descendant spans has to be
+		// recorded on it directly.
+		resumed := reqCtx.StoredTask != nil &&
+			(reqCtx.StoredTask.Status.State == a2atype.TaskStateInputRequired || reqCtx.StoredTask.Status.State == a2atype.TaskStateAuthRequired)
+		tracing.InvocationFromContext(ctx).SetAttributes(tracing.RequestIdentity(sessionID, string(reqCtx.TaskID), resumed)...)
 		spanAttributes := map[string]string{
 			"kagent.user_id":         userID,
 			"gen_ai.task.id":         string(reqCtx.TaskID),
diff --git a/go/adk/pkg/a2a/server/server.go b/go/adk/pkg/a2a/server/server.go
index 973a1aa8f5..752e730e6d 100644
--- a/go/adk/pkg/a2a/server/server.go
+++ b/go/adk/pkg/a2a/server/server.go
@@ -20,7 +20,6 @@ import (
 	a2apb "github.com/a2aproject/a2a-go/v2/a2apb/v1"
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
-	"go.opentelemetry.io/otel/attribute"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/health"
 	grpc_health_v1 "google.golang.org/grpc/health/grpc_health_v1"
@@ -42,10 +41,9 @@ type ServerConfig struct {
 	HealthPaths   []string
 	HealthHandler http.Handler
 
-	// InvocationAttributes are the trusted static attributes stamped on every
-	// A2A request span. Request identity is added by whichever component
-	// resolves it, never here.
-	InvocationAttributes []attribute.KeyValue
+	// Telemetry is the compiler-owned identity every invocation span reports.
+	// Request identity is added by whichever component resolves it, never here.
+	Telemetry tracing.RuntimeTelemetry
 }
 
 // A2AServer wraps the A2A server with health endpoints and graceful shutdown.
@@ -62,10 +60,10 @@ type A2AServer struct {
 // NewA2AServer creates a new A2A server using a2asrv.
 func NewA2AServer(agentCard a2atype.AgentCard, executor a2asrv.AgentExecutor, logger *slog.Logger, config ServerConfig, handlerOpts ...a2asrv.RequestHandlerOption) (*A2AServer, error) {
 	flushBeforeResponse := strings.EqualFold(strings.TrimSpace(os.Getenv("KAGENT_PRE_RESPONSE_TRACE_FLUSH")), "true")
-	// The request span anchors invocation identity whether or not the deployment
-	// needs a pre-response flush. It is a no-op span when tracing is disabled.
+	// The invocation span anchors identity whether or not the deployment needs
+	// a pre-response flush. It is a no-op span when tracing is disabled.
 	handlerOpts = append(handlerOpts, a2asrv.WithCallInterceptors(&invocationInterceptor{
-		logger: logger, identity: config.InvocationAttributes, flush: flushBeforeResponse,
+		logger: logger, telemetry: config.Telemetry, flush: flushBeforeResponse,
 	}))
 	requestHandler := a2asrv.NewHandler(executor, handlerOpts...)
 	jsonrpcHandler := a2asrv.NewJSONRPCHandler(requestHandler)
diff --git a/go/adk/pkg/a2a/server/tracing.go b/go/adk/pkg/a2a/server/tracing.go
index dc2e088a69..7d24c76d85 100644
--- a/go/adk/pkg/a2a/server/tracing.go
+++ b/go/adk/pkg/a2a/server/tracing.go
@@ -8,18 +8,21 @@ import (
 	"github.com/a2aproject/a2a-go/v2/a2asrv"
 	"github.com/kagent-dev/kagent/go/adk/pkg/auth"
 	"github.com/kagent-dev/kagent/go/pkg/tracing"
-	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 )
 
-// invocationScope is the instrumentation scope of the request span. Consumers
-// normalize on it, so it and the span name stay stable.
+// invocationScope is the instrumentation scope of the invocation span.
+// Consumers may key on it, so it stays stable.
 const invocationScope = "github.com/kagent-dev/kagent/go/adk/pkg/a2a/server"
 
-// invocationInterceptor anchors one A2A execution segment on a request span. It
-// starts the span with the identity the runtime knows before execution begins,
-// so a request rejected during validation still reports which agent rejected
-// it, and it completes the span for failures that never reach an executor.
+// invocationInterceptor anchors one A2A execution segment on a request span.
+// For a native harness that span is the GenAI conventions' invoke_agent
+// operation, since nothing beneath it describes the agent invocation; the ADK
+// emits its own invoke_agent, so its request span stays a transport span with
+// the same identity and no operation of its own. The interceptor starts the
+// span with the identity the runtime knows before execution begins, so a
+// request rejected during validation still reports which agent rejected it,
+// and it completes the span for failures that never reach an executor.
 //
 // Execution adopts the invocation when it starts. From that point this
 // interceptor stops completing it, because a unary response can return while
@@ -32,9 +35,18 @@ const invocationScope = "github.com/kagent-dev/kagent/go/adk/pkg/a2a/server"
 // attributes before ending it.
 type invocationInterceptor struct {
 	a2asrv.PassthroughCallInterceptor
-	logger   *slog.Logger
-	identity []attribute.KeyValue
-	flush    bool
+	logger    *slog.Logger
+	telemetry tracing.RuntimeTelemetry
+	flush     bool
+}
+
+// spanName follows the conventions for a native harness: the operation, then
+// the agent name. Any other runtime keeps the transport span name.
+func (i *invocationInterceptor) spanName() string {
+	if !i.telemetry.Runtime.NativeHarness() {
+		return tracing.TransportSpanName
+	}
+	return tracing.OperationInvokeAgent + " " + i.telemetry.AgentName
 }
 
 func (i *invocationInterceptor) Before(ctx context.Context, callCtx *a2asrv.CallContext, _ *a2asrv.Request) (context.Context, any, error) {
@@ -42,15 +54,19 @@ func (i *invocationInterceptor) Before(ctx context.Context, callCtx *a2asrv.Call
 	if method != "SendMessage" && method != "SendStreamingMessage" {
 		return ctx, nil, nil
 	}
-	attributes := make([]attribute.KeyValue, 0, len(i.identity)+2)
-	attributes = append(attributes, attribute.String("a2a.method", method))
-	attributes = append(attributes, i.identity...)
+	identity := i.telemetry.Identity()
+	attributes := make([]attribute.KeyValue, 0, len(identity)+3)
+	if i.telemetry.Runtime.NativeHarness() {
+		attributes = append(attributes, attribute.String(tracing.AttributeOperationName, tracing.OperationInvokeAgent))
+	}
+	attributes = append(attributes, attribute.String(tracing.AttributeMethod, method))
+	attributes = append(attributes, identity...)
 	// The gateway authenticates the caller and replaces x-user-id before
 	// forwarding, so this is the only trusted identity on the private path.
 	if userID := auth.UserIDFromContext(ctx); userID != "" {
 		attributes = append(attributes, attribute.String(tracing.AttributeUserID, userID))
 	}
-	ctx, _ = tracing.StartInvocation(ctx, otel.Tracer(invocationScope), "a2a.request", i.flush, attributes...)
+	ctx, _ = tracing.StartInvocation(ctx, tracing.Tracer(invocationScope), i.spanName(), i.flush, attributes...)
 	return ctx, nil, nil
 }
 
diff --git a/go/adk/pkg/a2a/server/tracing_test.go b/go/adk/pkg/a2a/server/tracing_test.go
index d502fd22a1..d8258861ba 100644
--- a/go/adk/pkg/a2a/server/tracing_test.go
+++ b/go/adk/pkg/a2a/server/tracing_test.go
@@ -114,16 +114,22 @@ func sendMessage(t *testing.T, server *A2AServer, request *a2atype.SendMessageRe
 	}
 }
 
+// isRequestSpan recognizes the span the interceptor opens by the A2A method
+// only it records, whichever name the runtime gives it.
+func isRequestSpan(span tracetest.SpanStub) bool {
+	return spanAttribute(span, tracing.AttributeMethod) != ""
+}
+
 func requestSpan(t *testing.T, exporter *tracetest.InMemoryExporter) tracetest.SpanStub {
 	t.Helper()
 	var found []tracetest.SpanStub
 	for _, span := range exporter.GetSpans() {
-		if span.Name == "a2a.request" {
+		if isRequestSpan(span) {
 			found = append(found, span)
 		}
 	}
 	if len(found) != 1 {
-		t.Fatalf("exported %d a2a.request spans, want exactly one", len(found))
+		t.Fatalf("exported %d request spans, want exactly one", len(found))
 	}
 	return found[0]
 }
@@ -140,9 +146,10 @@ func spanAttribute(span tracetest.SpanStub, key string) string {
 func TestRequestSpanCarriesStaticIdentityAndTrustedUser(t *testing.T) {
 	exporter := syncExporter(t)
 	server, err := NewA2AServer(a2atype.AgentCard{}, substrateExecutor{}, slog.New(slog.DiscardHandler),
-		ServerConfig{Port: "0", InvocationAttributes: tracing.RuntimeTelemetry{
-			HarnessKind: tracing.HarnessKindCodex, AgentName: "reporter-codex",
-		}.Identity()},
+		ServerConfig{Port: "0", Telemetry: tracing.RuntimeTelemetry{
+			Runtime: tracing.RuntimeCodex, AgentName: "reporter-codex", AgentNamespace: "team",
+			Provider: "openai", Model: "gpt-5.2-codex",
+		}},
 		a2asrv.WithCallInterceptors(staticUserInterceptor{userID: "person-1"}))
 	if err != nil {
 		t.Fatal(err)
@@ -153,12 +160,23 @@ func TestRequestSpanCarriesStaticIdentityAndTrustedUser(t *testing.T) {
 	})
 
 	span := requestSpan(t, exporter)
+	// The conventions name an invoke_agent span after the agent it invokes.
+	if span.Name != "invoke_agent reporter-codex" {
+		t.Errorf("span name = %q, want %q", span.Name, "invoke_agent reporter-codex")
+	}
+	if span.InstrumentationScope.SchemaURL != tracing.SchemaURL {
+		t.Errorf("schema URL = %q, want %q", span.InstrumentationScope.SchemaURL, tracing.SchemaURL)
+	}
 	for key, want := range map[string]string{
-		"a2a.method":                 "SendMessage",
-		tracing.AttributeHarnessKind: "codex",
-		tracing.AttributeAgentName:   "reporter-codex",
-		tracing.AttributeUserID:      "person-1",
-		tracing.AttributeTaskState:   string(a2atype.TaskStateCompleted),
+		tracing.AttributeOperationName: tracing.OperationInvokeAgent,
+		tracing.AttributeMethod:        "SendMessage",
+		tracing.AttributeRuntime:       "codex",
+		tracing.AttributeAgentName:     "reporter-codex",
+		tracing.AttributeAgentID:       "team/reporter-codex",
+		tracing.AttributeProviderName:  "openai",
+		tracing.AttributeRequestModel:  "gpt-5.2-codex",
+		tracing.AttributeUserID:        "person-1",
+		tracing.AttributeTaskState:     string(a2atype.TaskStateCompleted),
 	} {
 		if got := spanAttribute(span, key); got != want {
 			t.Errorf("%s = %q, want %q", key, got, want)
@@ -166,11 +184,14 @@ func TestRequestSpanCarriesStaticIdentityAndTrustedUser(t *testing.T) {
 	}
 }
 
-// An ADK runtime must not receive a harness marker, and it keeps exactly one
-// counted invocation of its own beneath the request span.
-func TestRequestSpanOmitsHarnessMarkerWithoutTelemetry(t *testing.T) {
+// An ADK runtime emits exactly one invoke_agent of its own, so its request
+// span stays a transport span that carries the identity but no operation.
+func TestRequestSpanStaysATransportSpanForTheADK(t *testing.T) {
 	exporter := syncExporter(t)
-	server, err := NewA2AServer(a2atype.AgentCard{}, substrateExecutor{}, slog.New(slog.DiscardHandler), ServerConfig{Port: "0"})
+	server, err := NewA2AServer(a2atype.AgentCard{}, substrateExecutor{}, slog.New(slog.DiscardHandler),
+		ServerConfig{Port: "0", Telemetry: tracing.RuntimeTelemetry{
+			Runtime: tracing.RuntimeADKGo, AgentName: "assistant-kagent", AgentNamespace: "team",
+		}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -180,8 +201,20 @@ func TestRequestSpanOmitsHarnessMarkerWithoutTelemetry(t *testing.T) {
 	})
 
 	span := requestSpan(t, exporter)
-	if got := spanAttribute(span, tracing.AttributeHarnessKind); got != "" {
-		t.Errorf("%s = %q, want none", tracing.AttributeHarnessKind, got)
+	if span.Name != tracing.TransportSpanName {
+		t.Errorf("span name = %q, want %q", span.Name, tracing.TransportSpanName)
+	}
+	if got := spanAttribute(span, tracing.AttributeOperationName); got != "" {
+		t.Errorf("%s = %q, want none on an ADK request span", tracing.AttributeOperationName, got)
+	}
+	for key, want := range map[string]string{
+		tracing.AttributeRuntime:   "adk-go",
+		tracing.AttributeAgentName: "assistant-kagent",
+		tracing.AttributeAgentID:   "team/assistant-kagent",
+	} {
+		if got := spanAttribute(span, key); got != want {
+			t.Errorf("%s = %q, want %q", key, got, want)
+		}
 	}
 	invocations := 0
 	for _, exported := range exporter.GetSpans() {
@@ -197,9 +230,9 @@ func TestRequestSpanOmitsHarnessMarkerWithoutTelemetry(t *testing.T) {
 func TestRequestSpanRecordsEarlyFailure(t *testing.T) {
 	exporter := syncExporter(t)
 	server, err := NewA2AServer(a2atype.AgentCard{}, failingExecutor{}, slog.New(slog.DiscardHandler),
-		ServerConfig{Port: "0", InvocationAttributes: tracing.RuntimeTelemetry{
-			HarnessKind: tracing.HarnessKindClaude, AgentName: "reporter-claude",
-		}.Identity()})
+		ServerConfig{Port: "0", Telemetry: tracing.RuntimeTelemetry{
+			Runtime: tracing.RuntimeClaude, AgentName: "reporter-claude", AgentNamespace: "team",
+		}})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -216,8 +249,8 @@ func TestRequestSpanRecordsEarlyFailure(t *testing.T) {
 	if got := spanAttribute(span, tracing.AttributeErrorType); got != "transport_error" {
 		t.Errorf("%s = %q, want %q", tracing.AttributeErrorType, got, "transport_error")
 	}
-	if got := spanAttribute(span, tracing.AttributeHarnessKind); got != "claude" {
-		t.Errorf("a rejected request lost its harness identity: %s = %q", tracing.AttributeHarnessKind, got)
+	if got := spanAttribute(span, tracing.AttributeRuntime); got != "claude" {
+		t.Errorf("a rejected request lost its runtime identity: %s = %q", tracing.AttributeRuntime, got)
 	}
 }
 
@@ -239,7 +272,7 @@ func TestAdoptedInvocationOutlivesTheUnaryResponse(t *testing.T) {
 	})
 
 	for _, span := range exporter.GetSpans() {
-		if span.Name == "a2a.request" {
+		if isRequestSpan(span) {
 			t.Fatal("the unary response completed an invocation that execution still owned")
 		}
 	}
diff --git a/go/adk/pkg/app/app.go b/go/adk/pkg/app/app.go
index e58155ad95..bf1596e426 100644
--- a/go/adk/pkg/app/app.go
+++ b/go/adk/pkg/app/app.go
@@ -62,9 +62,8 @@ type AppConfig struct {
 	Agent adkagent.Agent
 
 	// Telemetry is the compiler-owned telemetry contract for this runtime. Its
-	// static identity is stamped on every A2A request span. The zero value
-	// leaves request spans without a harness marker, which is what ADK agents
-	// need.
+	// static identity is stamped on every invocation span. The zero value
+	// leaves invocation spans without a runtime or agent identity.
 	Telemetry tracing.RuntimeTelemetry
 }
 
@@ -144,12 +143,12 @@ func New(cfg AppConfig, executor a2asrv.AgentExecutor) (*KAgentApp, error) {
 	}
 
 	serverConfig := server.ServerConfig{
-		Host:                 cfg.Host,
-		Port:                 cfg.Port,
-		ShutdownTimeout:      cfg.ShutdownTimeout,
-		HealthPaths:          cfg.HealthPaths,
-		HealthHandler:        cfg.HealthHandler,
-		InvocationAttributes: cfg.Telemetry.Identity(),
+		Host:            cfg.Host,
+		Port:            cfg.Port,
+		ShutdownTimeout: cfg.ShutdownTimeout,
+		HealthPaths:     cfg.HealthPaths,
+		HealthHandler:   cfg.HealthHandler,
+		Telemetry:       cfg.Telemetry,
 	}
 
 	a2aServer, err := server.NewA2AServer(cfg.AgentCard, executor, log, serverConfig, handlerOpts...)
diff --git a/go/adk/pkg/telemetry/attributes.go b/go/adk/pkg/telemetry/attributes.go
index ecfa64de74..9fb55fd03c 100644
--- a/go/adk/pkg/telemetry/attributes.go
+++ b/go/adk/pkg/telemetry/attributes.go
@@ -7,16 +7,14 @@ import (
 	"os"
 	"strings"
 
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"go.opentelemetry.io/otel/attribute"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
 	"go.opentelemetry.io/otel/trace"
 	"google.golang.org/adk/v2/model"
 )
 
-const (
-	captureMessageContentEnvVar = "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT"
-	maxSpanPayloadBytes         = 32 * 1024
-)
+const maxSpanPayloadBytes = 32 * 1024
 
 type kagentSpanAttributesKey struct{}
 
@@ -123,7 +121,7 @@ func setSpanAttributes(ctx context.Context, attrs ...attribute.KeyValue) {
 }
 
 func marshalSpanPayload(value any) string {
-	if strings.EqualFold(strings.TrimSpace(os.Getenv(captureMessageContentEnvVar)), "false") {
+	if strings.EqualFold(strings.TrimSpace(os.Getenv(tracing.CaptureContentEnvironmentVariable)), "false") {
 		return "{}"
 	}
 	if value == nil {
diff --git a/go/adk/pkg/telemetry/attributes_test.go b/go/adk/pkg/telemetry/attributes_test.go
index 4e689d68ec..22b80c6483 100644
--- a/go/adk/pkg/telemetry/attributes_test.go
+++ b/go/adk/pkg/telemetry/attributes_test.go
@@ -5,6 +5,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
@@ -92,7 +93,7 @@ func TestStartInvocationSpan_InheritsContextAttributes(t *testing.T) {
 }
 
 func TestSetLLMAttributes_OnActiveSpan(t *testing.T) {
-	t.Setenv(captureMessageContentEnvVar, "true")
+	t.Setenv(tracing.CaptureContentEnvironmentVariable, "true")
 
 	exporter := tracetest.NewInMemoryExporter()
 	tp := sdktrace.NewTracerProvider(sdktrace.WithSyncer(exporter))
@@ -144,7 +145,7 @@ func TestSetLLMAttributes_OnActiveSpan(t *testing.T) {
 }
 
 func TestSetLLMAttributes_EmitsEmptyPayloadWhenContentCaptureDisabled(t *testing.T) {
-	t.Setenv(captureMessageContentEnvVar, "false")
+	t.Setenv(tracing.CaptureContentEnvironmentVariable, "false")
 
 	exporter := tracetest.NewInMemoryExporter()
 	tp := sdktrace.NewTracerProvider(sdktrace.WithSyncer(exporter))
diff --git a/go/adk/pkg/telemetry/tracing.go b/go/adk/pkg/telemetry/tracing.go
index 8cd79073d3..42c5854a0e 100644
--- a/go/adk/pkg/telemetry/tracing.go
+++ b/go/adk/pkg/telemetry/tracing.go
@@ -28,8 +28,9 @@ func SetKAgentSpanAttributes(ctx context.Context, attributes map[string]string)
 	return context.WithValue(ctx, kagentSpanAttributesKey{}, merged)
 }
 
-// StartInvocationSpan creates a lightweight root span around one executor run.
-// Descendant spans inherit request-scoped attributes via the span processor.
+// StartInvocationSpan creates a lightweight span around one executor run,
+// beneath the invocation span the A2A server opened. Descendant spans inherit
+// request-scoped attributes via the span processor.
 func StartInvocationSpan(ctx context.Context) (context.Context, trace.Span) {
 	return otel.Tracer("gcp.vertex.agent").Start(ctx, "invocation")
 }
@@ -55,13 +56,15 @@ func ForceFlush(ctx context.Context) {
 }
 
 // Init initializes OpenTelemetry providers for Go ADK, sets global providers and
-// propagators, and returns a shutdown function.
-func Init(ctx context.Context, serviceName string, serviceNamespace string) (shutdown func(context.Context) error, enabled bool, err error) {
+// propagators, and returns a shutdown function. The telemetry contract names
+// the service and stamps the runtime identity on the resource, the same way
+// the harness runtimes do.
+func Init(ctx context.Context, telemetry tracing.RuntimeTelemetry) (shutdown func(context.Context) error, enabled bool, err error) {
 	if !isTelemetryEnabled() {
 		return func(context.Context) error { return nil }, false, nil
 	}
 
-	telemetryResource, err := tracing.NewResource(ctx, serviceName, serviceNamespace)
+	telemetryResource, err := tracing.NewResource(ctx, telemetry.AgentName, telemetry.AgentNamespace, telemetry.Identity()...)
 	if err != nil {
 		return nil, true, err
 	}
diff --git a/go/adk/pkg/telemetry/tracing_test.go b/go/adk/pkg/telemetry/tracing_test.go
index 36b25fc83f..241b06a919 100644
--- a/go/adk/pkg/telemetry/tracing_test.go
+++ b/go/adk/pkg/telemetry/tracing_test.go
@@ -9,6 +9,7 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/kagent-dev/kagent/go/pkg/tracing"
 	"go.opentelemetry.io/otel"
 	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/log"
@@ -58,7 +59,9 @@ func TestInitExportsConfiguredSignals(t *testing.T) {
 			})
 			otel.SetTracerProvider(tracenoop.NewTracerProvider())
 			logglobal.SetLoggerProvider(lognoop.NewLoggerProvider())
-			shutdown, enabled, err := Init(t.Context(), "adk-service", "agent-namespace")
+			shutdown, enabled, err := Init(t.Context(), tracing.RuntimeTelemetry{
+				Runtime: tracing.RuntimeADKGo, AgentName: "adk-service", AgentNamespace: "agent-namespace",
+			})
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -120,7 +123,7 @@ func TestInitDisabledPreservesProvider(t *testing.T) {
 	t.Setenv("OTEL_TRACING_ENABLED", "false")
 	t.Setenv("OTEL_LOGGING_ENABLED", "false")
 	previous := otel.GetTracerProvider()
-	shutdown, enabled, err := Init(t.Context(), "unused", "unused")
+	shutdown, enabled, err := Init(t.Context(), tracing.RuntimeTelemetry{Runtime: tracing.RuntimeADKGo, AgentName: "unused", AgentNamespace: "unused"})
 	if err != nil || enabled {
 		t.Fatalf("Init = enabled %v, error %v", enabled, err)
 	}
diff --git a/go/core/internal/a2a/trace.go b/go/core/internal/a2a/trace.go
deleted file mode 100644
index 03df8b1290..0000000000
--- a/go/core/internal/a2a/trace.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package a2a
-
-import (
-	"net/http"
-
-	"go.opentelemetry.io/otel"
-	"go.opentelemetry.io/otel/attribute"
-	semconv "go.opentelemetry.io/otel/semconv/v1.39.0"
-	"go.opentelemetry.io/otel/trace"
-	"k8s.io/apimachinery/pkg/types"
-)
-
-// a2aTracingMiddleware is an A2A server middleware that creates an invoke_agent
-// span for each inbound A2A request, annotated with GenAI semantic convention
-// attributes. Outbound client interceptors inject that span into proxied agent
-// calls, giving a clean agent-invocation span hierarchy in Jaeger.
-type a2aTracingMiddleware struct {
-	agentRef types.NamespacedName
-	provider attribute.KeyValue
-}
-
-func newA2ATracingMiddleware(agentRef types.NamespacedName, provider attribute.KeyValue) *a2aTracingMiddleware {
-	return &a2aTracingMiddleware{agentRef: agentRef, provider: provider}
-}
-
-func (m *a2aTracingMiddleware) Wrap(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		ctx, span := otel.Tracer("kagent").Start(r.Context(), "invoke_agent",
-			trace.WithSpanKind(trace.SpanKindServer),
-			trace.WithAttributes(
-				semconv.GenAIOperationNameInvokeAgent,
-				m.provider,
-				semconv.GenAIAgentName(m.agentRef.Name),
-				semconv.GenAIAgentID(m.agentRef.String()),
-			),
-		)
-		defer span.End()
-		next.ServeHTTP(w, r.WithContext(ctx))
-	})
-}
diff --git a/go/core/internal/a2a/trace_test.go b/go/core/internal/a2a/trace_test.go
deleted file mode 100644
index 3e7c8de698..0000000000
--- a/go/core/internal/a2a/trace_test.go
+++ /dev/null
@@ -1,67 +0,0 @@
-package a2a
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"go.opentelemetry.io/otel"
-	sdktrace "go.opentelemetry.io/otel/sdk/trace"
-	"go.opentelemetry.io/otel/sdk/trace/tracetest"
-	semconv "go.opentelemetry.io/otel/semconv/v1.39.0"
-	"k8s.io/apimachinery/pkg/types"
-)
-
-func TestA2ATracingMiddleware_SetsGenAIAttributes(t *testing.T) {
-	exporter := tracetest.NewInMemoryExporter()
-	tp := sdktrace.NewTracerProvider(sdktrace.WithSyncer(exporter))
-	prev := otel.GetTracerProvider()
-	otel.SetTracerProvider(tp)
-	t.Cleanup(func() {
-		otel.SetTracerProvider(prev)
-		_ = tp.Shutdown(context.Background())
-	})
-
-	agentRef := types.NamespacedName{Namespace: "default", Name: "my-agent"}
-	mw := newA2ATracingMiddleware(agentRef, semconv.GenAIProviderNameOpenAI)
-
-	called := false
-	inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		called = true
-		w.WriteHeader(http.StatusOK)
-	})
-
-	req := httptest.NewRequest(http.MethodPost, "/", nil)
-	rr := httptest.NewRecorder()
-	mw.Wrap(inner).ServeHTTP(rr, req)
-
-	if !called {
-		t.Fatal("inner handler was not called")
-	}
-
-	spans := exporter.GetSpans()
-	if len(spans) != 1 {
-		t.Fatalf("expected 1 span, got %d", len(spans))
-	}
-
-	wantAttrs := map[string]string{
-		"gen_ai.operation.name": "invoke_agent",
-		"gen_ai.provider.name":  "openai",
-		"gen_ai.agent.name":     "my-agent",
-		"gen_ai.agent.id":       "default/my-agent",
-	}
-	gotAttrs := make(map[string]string)
-	for _, a := range spans[0].Attributes {
-		gotAttrs[string(a.Key)] = a.Value.AsString()
-	}
-	for k, want := range wantAttrs {
-		if got := gotAttrs[k]; got != want {
-			t.Errorf("attribute %s: want %q, got %q", k, want, got)
-		}
-	}
-
-	if spans[0].Name != "invoke_agent" {
-		t.Errorf("span name: want %q, got %q", "invoke_agent", spans[0].Name)
-	}
-}
diff --git a/go/core/internal/telemetry/tracing.go b/go/core/internal/telemetry/tracing.go
index 71528adf6e..5ef4b04556 100644
--- a/go/core/internal/telemetry/tracing.go
+++ b/go/core/internal/telemetry/tracing.go
@@ -12,7 +12,7 @@ import (
 	"go.opentelemetry.io/otel/propagation"
 	"go.opentelemetry.io/otel/sdk/resource"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
-	semconv "go.opentelemetry.io/otel/semconv/v1.39.0"
+	semconv "go.opentelemetry.io/otel/semconv/v1.41.0"
 
 	"github.com/kagent-dev/kagent/go/core/pkg/env"
 )
diff --git a/go/core/internal/translator/claude/compiler.go b/go/core/internal/translator/claude/compiler.go
index fcb34866c3..e5397c2bab 100644
--- a/go/core/internal/translator/claude/compiler.go
+++ b/go/core/internal/translator/claude/compiler.go
@@ -124,8 +124,8 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	config.Agents = localAgents
 	// The runtime reports this identity on every invocation span and on its
 	// resource, so a user-supplied resource marker is never required.
-	config.RuntimeTelemetry = telemetryConfig.HarnessTelemetry(
-		tracing.HarnessKindClaude, template.Name+"-"+harness.Name, template.Namespace)
+	config.RuntimeTelemetry = telemetryConfig.RuntimeTelemetry(
+		tracing.RuntimeClaude, template.Name+"-"+harness.Name, template.Namespace, model.Spec)
 	if len(skillResources.Skills) != 0 || len(skillResources.Plugins) != 0 {
 		config.SkillResources = &skillResources
 	}
diff --git a/go/core/internal/translator/claude/compiler_test.go b/go/core/internal/translator/claude/compiler_test.go
index 9f43ce2d20..5ad70120d8 100644
--- a/go/core/internal/translator/claude/compiler_test.go
+++ b/go/core/internal/translator/claude/compiler_test.go
@@ -154,6 +154,7 @@ func TestCompileTracing(t *testing.T) {
 		"OTEL_EXPORTER_OTLP_TRACES_PROTOCOL": "grpc", "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
 		"CLAUDE_CODE_ENHANCED_TELEMETRY_BETA": "1", "OTEL_TRACES_EXPORTER": "otlp",
 		"OTEL_METRICS_EXPORTER": "none", "OTEL_LOGS_EXPORTER": "none",
+		"OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT": "false",
 		"KAGENT_NAME":      "assistant-claude",
 		"KAGENT_NAMESPACE": "test", claudeconfig.PreResponseTraceFlushEnvName: "true",
 	} {
@@ -175,6 +176,9 @@ func TestCompileTracing(t *testing.T) {
 			t.Errorf("sensitive trace environment[%s] = %q, want 1", name, environment[name])
 		}
 	}
+	if got := environment["OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT"]; got != "true" {
+		t.Errorf("capture environment = %q, want true", got)
+	}
 }
 
 func TestCompileLogging(t *testing.T) {
@@ -643,7 +647,8 @@ func TestCompileRuntimeTelemetry(t *testing.T) {
 	}
 	// The compiled identity follows the Harness name, not the harness kind.
 	want := tracing.RuntimeTelemetry{
-		HarnessKind: tracing.HarnessKindClaude, AgentName: "assistant-fast", AgentNamespace: "test",
+		Runtime: tracing.RuntimeClaude, AgentName: "assistant-fast", AgentNamespace: "test",
+		Provider: "anthropic", Model: "claude-sonnet-4-5",
 	}
 	if config.RuntimeTelemetry != want {
 		t.Fatalf("runtime telemetry = %#v, want %#v", config.RuntimeTelemetry, want)
diff --git a/go/core/internal/translator/codex/compiler.go b/go/core/internal/translator/codex/compiler.go
index 4ce4edbdb1..ccd42b06be 100644
--- a/go/core/internal/translator/codex/compiler.go
+++ b/go/core/internal/translator/codex/compiler.go
@@ -106,8 +106,8 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	cfg.Provider, cfg.Agents, cfg.MCPServers = provider, agents, mcp.servers
 	// The runtime reports this identity on every invocation span and on its
 	// resource, so a user-supplied resource marker is never required.
-	cfg.RuntimeTelemetry = telemetryConfig.HarnessTelemetry(
-		tracing.HarnessKindCodex, template.Name+"-"+harness.Name, template.Namespace)
+	cfg.RuntimeTelemetry = telemetryConfig.RuntimeTelemetry(
+		tracing.RuntimeCodex, template.Name+"-"+harness.Name, template.Namespace, model.Spec)
 	if traceConfig.Enabled || logConfig.Enabled {
 		cfg.Telemetry = &codexconfig.Telemetry{CaptureContent: telemetryConfig.CaptureSensitiveContent}
 		if traceConfig.Enabled {
diff --git a/go/core/internal/translator/codex/compiler_test.go b/go/core/internal/translator/codex/compiler_test.go
index 299cea7155..4c4728f293 100644
--- a/go/core/internal/translator/codex/compiler_test.go
+++ b/go/core/internal/translator/codex/compiler_test.go
@@ -341,7 +341,8 @@ func TestCompileRuntimeTelemetry(t *testing.T) {
 	}
 	// The compiled identity follows the Harness name, not the harness kind.
 	want := tracing.RuntimeTelemetry{
-		HarnessKind: tracing.HarnessKindCodex, AgentName: "assistant-fast", AgentNamespace: "test",
+		Runtime: tracing.RuntimeCodex, AgentName: "assistant-fast", AgentNamespace: "test",
+		Provider: "openai", Model: "gpt-5.2-codex",
 	}
 	if config.RuntimeTelemetry != want {
 		t.Fatalf("runtime telemetry = %#v, want %#v", config.RuntimeTelemetry, want)
diff --git a/go/core/internal/translator/otel.go b/go/core/internal/translator/otel.go
index 95fcaa4ad0..4ce8a5154d 100644
--- a/go/core/internal/translator/otel.go
+++ b/go/core/internal/translator/otel.go
@@ -7,7 +7,9 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/kagent-dev/kagent/go/api/v1alpha3"
 	"github.com/kagent-dev/kagent/go/pkg/tracing"
+	semconv "go.opentelemetry.io/otel/semconv/v1.41.0"
 	corev1 "k8s.io/api/core/v1"
 )
 
@@ -91,15 +93,46 @@ func maxCaptureBytesFromProcess() (int, error) {
 	return value, nil
 }
 
-// HarnessTelemetry is the compiler-owned runtime telemetry contract for one
-// compiled agent. Identity is what the runtime reports on every span it starts.
-func (c TelemetryConfig) HarnessTelemetry(kind tracing.HarnessKind, agentName, namespace string) tracing.RuntimeTelemetry {
+// RuntimeTelemetry is the compiler-owned telemetry contract for one compiled
+// agent. Identity is what the runtime reports on every invocation span and on
+// its resource, including the model the agent is bound to, so usage a native
+// runtime reports without naming the model can still be attributed.
+func (c TelemetryConfig) RuntimeTelemetry(runtime tracing.Runtime, agentName, namespace string, model v1alpha3.ModelConfigSpec) tracing.RuntimeTelemetry {
 	return tracing.RuntimeTelemetry{
-		HarnessKind: kind, AgentName: agentName, AgentNamespace: namespace,
+		Runtime: runtime, AgentName: agentName, AgentNamespace: namespace,
+		Provider: ProviderName(model.Provider), Model: strings.TrimSpace(model.Model),
 		CaptureContent: c.CaptureSensitiveContent, MaxCaptureBytes: c.MaxCaptureBytes,
 	}
 }
 
+// ProviderName maps a ModelConfig provider onto the GenAI conventions'
+// provider vocabulary. Providers the conventions do not list get a lowercase
+// identifier of the same shape, which the conventions permit as a custom value.
+func ProviderName(provider v1alpha3.ModelProvider) string {
+	switch provider {
+	case v1alpha3.ModelProviderAnthropic:
+		return semconv.GenAIProviderNameAnthropic.Value.AsString()
+	case v1alpha3.ModelProviderOpenAI:
+		return semconv.GenAIProviderNameOpenAI.Value.AsString()
+	case v1alpha3.ModelProviderAzureOpenAI:
+		return semconv.GenAIProviderNameAzureAIOpenAI.Value.AsString()
+	case v1alpha3.ModelProviderBedrock:
+		return semconv.GenAIProviderNameAWSBedrock.Value.AsString()
+	case v1alpha3.ModelProviderGemini:
+		return semconv.GenAIProviderNameGCPGemini.Value.AsString()
+	case v1alpha3.ModelProviderGeminiVertexAI, v1alpha3.ModelProviderAnthropicVertexAI:
+		return semconv.GenAIProviderNameGCPVertexAI.Value.AsString()
+	case v1alpha3.ModelProviderFoundry:
+		return semconv.GenAIProviderNameAzureAIInference.Value.AsString()
+	case v1alpha3.ModelProviderOllama:
+		return "ollama"
+	case v1alpha3.ModelProviderSAPAICore:
+		return "sap.ai_core"
+	default:
+		return strings.ToLower(string(provider))
+	}
+}
+
 func signalConfigFromProcess(signal, enabledVariable, endpointVariable, protocolVariable string) (SignalConfig, error) {
 	if !environmentEnabled(enabledVariable) {
 		return SignalConfig{}, nil
@@ -148,7 +181,8 @@ func OwnsTelemetryEnvironment(name string) bool {
 	switch name {
 	case otelTracingEnabled, otelLoggingEnabled,
 		otelExporterOTLPEndpoint, otelExporterOTLPTracesEndpoint, otelExporterOTLPLogsEndpoint,
-		otelExporterOTLPProtocol, otelExporterOTLPTracesProtocol, otelExporterOTLPLogsProtocol:
+		otelExporterOTLPProtocol, otelExporterOTLPTracesProtocol, otelExporterOTLPLogsProtocol,
+		tracing.CaptureContentEnvironmentVariable:
 		return true
 	default:
 		return false
@@ -156,8 +190,18 @@ func OwnsTelemetryEnvironment(name string) bool {
 }
 
 // TraceEnvironment renders the resolved trace settings for an agent runtime.
+// The content-capture switch rides with them, because the standard GenAI
+// instrumentation variable is how a runtime that instruments its own model
+// calls learns the decision, and a user-supplied value would let one runtime
+// record prompts that the controller's setting said to keep out of traces.
 func (c TelemetryConfig) TraceEnvironment() []corev1.EnvVar {
-	return signalEnvironment(c.Traces, otelTracingEnabled, otelExporterOTLPTracesEndpoint, otelExporterOTLPTracesProtocol)
+	environment := signalEnvironment(c.Traces, otelTracingEnabled, otelExporterOTLPTracesEndpoint, otelExporterOTLPTracesProtocol)
+	if environment == nil {
+		return nil
+	}
+	return append(environment, corev1.EnvVar{
+		Name: tracing.CaptureContentEnvironmentVariable, Value: strconv.FormatBool(c.CaptureSensitiveContent),
+	})
 }
 
 // LogEnvironment renders the resolved log settings for an agent runtime.
diff --git a/go/core/internal/translator/otel_test.go b/go/core/internal/translator/otel_test.go
index 1b648a3f4d..2d6fe4f8a3 100644
--- a/go/core/internal/translator/otel_test.go
+++ b/go/core/internal/translator/otel_test.go
@@ -37,6 +37,7 @@ func TestTelemetryConfigFromProcess(t *testing.T) {
 		{Name: "OTEL_TRACING_ENABLED", Value: "true"},
 		{Name: "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", Value: "http://traces:4317"},
 		{Name: "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL", Value: "grpc"},
+		{Name: "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT", Value: "true"},
 	}; !reflect.DeepEqual(got.TraceEnvironment(), want) {
 		t.Errorf("trace environment = %#v, want %#v", got.TraceEnvironment(), want)
 	}
@@ -124,6 +125,7 @@ func TestOwnsTelemetryEnvironment(t *testing.T) {
 		"OTEL_EXPORTER_OTLP_PROTOCOL",
 		"OTEL_EXPORTER_OTLP_TRACES_PROTOCOL",
 		"OTEL_EXPORTER_OTLP_LOGS_PROTOCOL",
+		"OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT",
 	} {
 		if !translator.OwnsTelemetryEnvironment(name) {
 			t.Errorf("OwnsTelemetryEnvironment(%q) = false", name)
diff --git a/go/core/test/e2e/tracing_test.go b/go/core/test/e2e/tracing_test.go
index ae71a68aa5..217ac061f9 100644
--- a/go/core/test/e2e/tracing_test.go
+++ b/go/core/test/e2e/tracing_test.go
@@ -148,7 +148,7 @@ func (r *otlpTraceReceiver) clear() {
 }
 
 // diagnostic summarizes only the spans useful for explaining a failed
-// assertion: a2a.request spans and spans correlated by the injected trace ID.
+// assertion: A2A request spans and spans correlated by the injected trace ID.
 // Codex can emit hundreds of native spans, so cap the detail included in logs.
 func (r *otlpTraceReceiver) diagnostic(expectedTraceID []byte) string {
 	r.mu.Lock()
@@ -162,17 +162,18 @@ func (r *otlpTraceReceiver) diagnostic(expectedTraceID []byte) string {
 		for _, scopeSpans := range resourceSpans.GetScopeSpans() {
 			for _, span := range scopeSpans.GetSpans() {
 				totalSpans++
-				if len(details) == detailLimit || !bytes.Equal(span.GetTraceId(), expectedTraceID) && span.GetName() != "a2a.request" {
+				requestSpan := stringAttribute(span.GetAttributes(), tracing.AttributeMethod) != ""
+				if len(details) == detailLimit || !bytes.Equal(span.GetTraceId(), expectedTraceID) && !requestSpan {
 					continue
 				}
 				details = append(details, fmt.Sprintf(
-					"service=%q scope=%q name=%q trace_id=%x a2a.method=%q a2a.task.state=%q",
+					"service=%q scope=%q name=%q trace_id=%x %s=%q %s=%q",
 					serviceName,
 					scopeSpans.GetScope().GetName(),
 					span.GetName(),
 					span.GetTraceId(),
-					stringAttribute(span.GetAttributes(), "a2a.method"),
-					stringAttribute(span.GetAttributes(), "a2a.task.state"),
+					tracing.AttributeMethod, stringAttribute(span.GetAttributes(), tracing.AttributeMethod),
+					tracing.AttributeTaskState, stringAttribute(span.GetAttributes(), tracing.AttributeTaskState),
 				))
 			}
 		}
@@ -236,21 +237,22 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 	for _, test := range []struct {
 		name          string
 		harness       string
-		harnessKind   string
+		runtime       tracing.Runtime
+		provider      string
 		templateLabel string
 		modelURL      func(*testing.T) string
-		createModel   func(*testing.T, string) string
+		createModel   func(*testing.T, string) *v1alpha3.ModelConfig
 		prompt        string
 		assertNative  func(*testing.T, *otlpTraceReceiver, []byte)
 	}{
 		{
 			name: "claude", harness: claudeTracingE2EHarness, templateLabel: "claude-tracing",
-			harnessKind: string(tracing.HarnessKindClaude),
+			runtime: tracing.RuntimeClaude, provider: "anthropic",
 			modelURL: func(t *testing.T) string {
 				return reachableServerURL(t, startMockLLMServer(t, claudeInteractionMocks, "mocks/invoke_claude_agent.json"), "")
 			},
-			createModel: func(t *testing.T, baseURL string) string {
-				return createClaudeMockModel(t, interactionKubeClient(t), baseURL).Name
+			createModel: func(t *testing.T, baseURL string) *v1alpha3.ModelConfig {
+				return createClaudeMockModel(t, interactionKubeClient(t), baseURL)
 			},
 			prompt: "Return exactly CLAUDE_MOCK_FIRST.",
 			assertNative: func(t *testing.T, receiver *otlpTraceReceiver, traceID []byte) {
@@ -265,12 +267,12 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 		},
 		{
 			name: "codex", harness: codexTracingE2EHarness, templateLabel: "codex-tracing",
-			harnessKind: string(tracing.HarnessKindCodex),
+			runtime: tracing.RuntimeCodex, provider: "openai",
 			modelURL: func(t *testing.T) string {
 				return reachableModelURL(t, startMockLLMServer(t, codexInteractionMocks, "mocks/invoke_codex_agent.json"))
 			},
-			createModel: func(t *testing.T, baseURL string) string {
-				return createCodexMockModel(t, interactionKubeClient(t), baseURL).Name
+			createModel: func(t *testing.T, baseURL string) *v1alpha3.ModelConfig {
+				return createCodexMockModel(t, interactionKubeClient(t), baseURL)
 			},
 			prompt: "Return exactly CODEX_MOCK_FIRST.",
 			assertNative: func(t *testing.T, receiver *otlpTraceReceiver, traceID []byte) {
@@ -289,8 +291,8 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 			// the injected trace ID remains the authoritative correlation key because
 			// unrelated controller exports can reach the same listener concurrently.
 			receiver.clear()
-			modelName := test.createModel(t, test.modelURL(t))
-			template := createTracingTemplate(t, test.harness, test.templateLabel, modelName)
+			model := test.createModel(t, test.modelURL(t))
+			template := createTracingTemplate(t, test.harness, test.templateLabel, model.Name)
 			fixture := newInteractionFixtureForHarnessTemplate(t, target, test.harness, template)
 			traceID, traceparent := sampledTraceparent(t)
 			fixture.ctx = metadata.AppendToOutgoingContext(fixture.ctx, "traceparent", traceparent)
@@ -299,32 +301,43 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 			if streamed.state != a2atype.TaskStateCompleted {
 				t.Fatalf("streamed task state = %s, want COMPLETED", streamed.state)
 			}
-			// Wait for the Actor to suspend then assert that the completed a2a.request span was exported.
+			// Wait for the Actor to suspend then assert that the completed invocation span was exported.
 			assertActorSuspended(t, fixture)
 			// The compiler owns this identity, so the assertion holds without any
 			// user-supplied resource marker on the Harness.
-			spans := receiver.selectSpans(traceID, "", "", "a2a.request", map[string]string{
-				"a2a.method":                    "SendStreamingMessage",
+			agentName := template + "-" + test.harness
+			spans := receiver.selectSpans(traceID, "", "", "invoke_agent "+agentName, map[string]string{
+				tracing.AttributeOperationName:  tracing.OperationInvokeAgent,
+				tracing.AttributeMethod:         "SendStreamingMessage",
 				tracing.AttributeTaskState:      string(a2atype.TaskStateCompleted),
-				tracing.AttributeHarnessKind:    test.harnessKind,
-				tracing.AttributeAgentName:      template + "-" + test.harness,
+				tracing.AttributeRuntime:        string(test.runtime),
+				tracing.AttributeAgentName:      agentName,
+				tracing.AttributeAgentID:        "kagent/" + agentName,
+				tracing.AttributeProviderName:   test.provider,
+				tracing.AttributeRequestModel:   model.Spec.Model,
 				tracing.AttributeConversationID: streamed.contextID,
 				tracing.AttributeTaskID:         string(streamed.taskID),
 				tracing.AttributeUserID:         "e2e",
 				tracing.AttributeSegment:        tracing.SegmentInitial,
 			})
 			if len(spans) != 1 {
-				t.Fatalf("identified a2a.request spans = %d, want exactly one before suspension: %s", len(spans), receiver.diagnostic(traceID))
+				t.Fatalf("identified invocation spans = %d, want exactly one before suspension: %s", len(spans), receiver.diagnostic(traceID))
 			}
 			// Capture stays off unless a user enables it, so a turn must not
 			// export its prompt or response.
-			for _, key := range []string{tracing.AttributeInput, tracing.AttributeOutput} {
+			for _, key := range []string{tracing.AttributeInputMessages, tracing.AttributeOutputMessages} {
 				if value := stringAttribute(spans[0].span.GetAttributes(), key); value != "" {
 					t.Errorf("%s = %q with capture disabled", key, value)
 				}
 			}
-			if namespace := stringAttribute(spans[0].resource.GetAttributes(), "service.namespace"); namespace != "kagent" {
-				t.Errorf("service.namespace = %q, want the AgentTemplate namespace", namespace)
+			for key, want := range map[string]string{
+				"service.namespace":        "kagent",
+				tracing.AttributeRuntime:   string(test.runtime),
+				tracing.AttributeAgentName: agentName,
+			} {
+				if got := stringAttribute(spans[0].resource.GetAttributes(), key); got != want {
+					t.Errorf("resource %s = %q, want %q", key, got, want)
+				}
 			}
 			test.assertNative(t, receiver, traceID)
 		})
diff --git a/go/harness/claude/config/config.go b/go/harness/claude/config/config.go
index ac0b3a5d6e..854dd0ab9c 100644
--- a/go/harness/claude/config/config.go
+++ b/go/harness/claude/config/config.go
@@ -141,8 +141,8 @@ func (c Config) Validate() error {
 	if err := c.RuntimeTelemetry.Validate(); err != nil {
 		return err
 	}
-	if kind := c.RuntimeTelemetry.HarnessKind; kind != "" && kind != tracing.HarnessKindClaude {
-		return fmt.Errorf("claude runtime telemetry has harness kind %q", kind)
+	if runtime := c.RuntimeTelemetry.Runtime; runtime != "" && runtime != tracing.RuntimeClaude {
+		return fmt.Errorf("claude runtime telemetry names runtime %q", runtime)
 	}
 	for name, agent := range c.Agents {
 		if !agentNamePattern.MatchString(name) {
diff --git a/go/harness/claude/config/config_test.go b/go/harness/claude/config/config_test.go
index 4f4f157cb1..fc0e8f13e8 100644
--- a/go/harness/claude/config/config_test.go
+++ b/go/harness/claude/config/config_test.go
@@ -146,11 +146,11 @@ func TestConfigValidatesRuntimeTelemetry(t *testing.T) {
 	}{
 		{name: "absent"},
 		{name: "claude identity", telemetry: tracing.RuntimeTelemetry{
-			HarnessKind: tracing.HarnessKindClaude, AgentName: "assistant-claude", AgentNamespace: "kagent",
+			Runtime: tracing.RuntimeClaude, AgentName: "assistant-claude", AgentNamespace: "kagent",
 		}},
-		{name: "another harness kind", telemetry: tracing.RuntimeTelemetry{HarnessKind: tracing.HarnessKindCodex}, wantError: true},
+		{name: "another runtime", telemetry: tracing.RuntimeTelemetry{Runtime: tracing.RuntimeCodex}, wantError: true},
 		{name: "capture above the ceiling", telemetry: tracing.RuntimeTelemetry{
-			HarnessKind: tracing.HarnessKindClaude, CaptureContent: true, MaxCaptureBytes: tracing.MaxCaptureBytes + 1,
+			Runtime: tracing.RuntimeClaude, CaptureContent: true, MaxCaptureBytes: tracing.MaxCaptureBytes + 1,
 		}, wantError: true},
 	} {
 		t.Run(test.name, func(t *testing.T) {
diff --git a/go/harness/codex/config/config.go b/go/harness/codex/config/config.go
index 77cb97f9d8..9da137bb5a 100644
--- a/go/harness/codex/config/config.go
+++ b/go/harness/codex/config/config.go
@@ -120,8 +120,8 @@ func (c Config) Validate() error {
 	if err := c.RuntimeTelemetry.Validate(); err != nil {
 		return err
 	}
-	if kind := c.RuntimeTelemetry.HarnessKind; kind != "" && kind != tracing.HarnessKindCodex {
-		return fmt.Errorf("codex runtime telemetry has harness kind %q", kind)
+	if runtime := c.RuntimeTelemetry.Runtime; runtime != "" && runtime != tracing.RuntimeCodex {
+		return fmt.Errorf("codex runtime telemetry names runtime %q", runtime)
 	}
 	if c.Telemetry != nil {
 		if c.Telemetry.Traces == nil && c.Telemetry.Logs == nil {
diff --git a/go/harness/codex/config/config_test.go b/go/harness/codex/config/config_test.go
index 5a624a76db..9b2ab86d59 100644
--- a/go/harness/codex/config/config_test.go
+++ b/go/harness/codex/config/config_test.go
@@ -84,11 +84,11 @@ func TestConfigValidatesRuntimeTelemetry(t *testing.T) {
 	}{
 		{name: "absent"},
 		{name: "codex identity", telemetry: tracing.RuntimeTelemetry{
-			HarnessKind: tracing.HarnessKindCodex, AgentName: "assistant-codex", AgentNamespace: "kagent",
+			Runtime: tracing.RuntimeCodex, AgentName: "assistant-codex", AgentNamespace: "kagent",
 		}},
-		{name: "another harness kind", telemetry: tracing.RuntimeTelemetry{HarnessKind: tracing.HarnessKindClaude}, wantError: true},
+		{name: "another runtime", telemetry: tracing.RuntimeTelemetry{Runtime: tracing.RuntimeClaude}, wantError: true},
 		{name: "capture above the ceiling", telemetry: tracing.RuntimeTelemetry{
-			HarnessKind: tracing.HarnessKindCodex, CaptureContent: true, MaxCaptureBytes: tracing.MaxCaptureBytes + 1,
+			Runtime: tracing.RuntimeCodex, CaptureContent: true, MaxCaptureBytes: tracing.MaxCaptureBytes + 1,
 		}, wantError: true},
 	} {
 		t.Run(test.name, func(t *testing.T) {
diff --git a/go/harness/runtime/a2a/executor.go b/go/harness/runtime/a2a/executor.go
index ae7e508a99..41f1322a86 100644
--- a/go/harness/runtime/a2a/executor.go
+++ b/go/harness/runtime/a2a/executor.go
@@ -143,8 +143,11 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 		// that yield no quiescent event at all, such as cancellation and an
 		// abandoned stream.
 		defer endInvocation()
+		// Identity is recorded before validation, so a rejected request still
+		// says which conversation and task it belonged to.
+		resuming := reqCtx != nil && reqCtx.StoredTask != nil && requiresInput(reqCtx.StoredTask.Status.State)
 		if reqCtx != nil {
-			invocation.SetAttributes(requestIdentity(reqCtx)...)
+			invocation.SetAttributes(tracing.RequestIdentity(reqCtx.ContextID, string(reqCtx.TaskID), resuming)...)
 		}
 
 		turn, err := validateRequest(reqCtx)
@@ -153,21 +156,18 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			yield(nil, err)
 			return
 		}
-		resuming := reqCtx.StoredTask != nil && requiresInput(reqCtx.StoredTask.Status.State)
-		segment := tracing.SegmentInitial
-		if resuming {
-			segment = tracing.SegmentResumed
-		}
-		invocation.SetAttributes(attribute.String(tracing.AttributeSegment, segment))
 		// Capture the current turn's prompt only. A segment that answers an
-		// approval or question carries a structured decision, not prompt text.
+		// approval or question carries a structured decision, not prompt text,
+		// so it records no input messages at all.
 		if limit := e.captureLimit(invocation); limit > 0 {
 			sink.capture = tracing.NewTextCapture(limit)
-			text, truncated := tracing.BoundedText(turn.Prompt, limit)
-			invocation.SetAttributes(
-				attribute.String(tracing.AttributeInput, text),
-				attribute.Bool(tracing.AttributeInputTruncated, truncated),
-			)
+			if turn.Prompt != "" {
+				text, truncated := tracing.BoundedText(turn.Prompt, limit)
+				invocation.SetAttributes(
+					attribute.String(tracing.AttributeInputMessages, tracing.TextMessages(tracing.RoleUser, text)),
+					attribute.Bool(tracing.AttributeInputTruncated, truncated),
+				)
+			}
 		}
 
 		continuationID, _, err := e.continuation.Load()
@@ -331,20 +331,6 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 	}
 }
 
-// requestIdentity is the resolved identity of one A2A request. It belongs on
-// the invocation span, never on the process-wide resource, because one runtime
-// process serves many conversations, tasks, and users.
-func requestIdentity(reqCtx *a2asrv.ExecutorContext) []attribute.KeyValue {
-	attributes := make([]attribute.KeyValue, 0, 2)
-	if reqCtx.ContextID != "" {
-		attributes = append(attributes, attribute.String(tracing.AttributeConversationID, reqCtx.ContextID))
-	}
-	if reqCtx.TaskID != "" {
-		attributes = append(attributes, attribute.String(tracing.AttributeTaskID, string(reqCtx.TaskID)))
-	}
-	return attributes
-}
-
 // captureLimit is the byte budget for this segment's content. It is zero unless
 // the compiler enabled capture and the invocation retains what it is given, so
 // a disabled or unsampled request allocates no collector at all.
@@ -356,13 +342,14 @@ func (e *Executor) captureLimit(invocation *tracing.Invocation) int {
 }
 
 // captureAttributes reports the text this segment produced. Absent attributes
-// mean capture is disabled; an empty value means the segment produced no text.
+// mean capture is disabled; a message with empty text means the segment
+// produced none.
 func (s *executionSink) captureAttributes() []attribute.KeyValue {
 	if s.capture == nil {
 		return nil
 	}
 	return []attribute.KeyValue{
-		attribute.String(tracing.AttributeOutput, s.capture.Text()),
+		attribute.String(tracing.AttributeOutputMessages, tracing.TextMessages(tracing.RoleAssistant, s.capture.Text())),
 		attribute.Bool(tracing.AttributeOutputTruncated, s.capture.Truncated()),
 	}
 }
diff --git a/go/harness/runtime/a2a/tracing_test.go b/go/harness/runtime/a2a/tracing_test.go
index 448039ae2c..197826b3bd 100644
--- a/go/harness/runtime/a2a/tracing_test.go
+++ b/go/harness/runtime/a2a/tracing_test.go
@@ -33,7 +33,7 @@ func newTraceRecorder(t *testing.T) *traceRecorder {
 }
 
 func (r *traceRecorder) segment(ctx context.Context) context.Context {
-	ctx, _ = tracing.StartInvocation(ctx, r.tracer, "a2a.request", false)
+	ctx, _ = tracing.StartInvocation(ctx, r.tracer, "invoke_agent", false)
 	return ctx
 }
 
@@ -66,7 +66,7 @@ func stringAttribute(t *testing.T, span tracetest.SpanStub, key string) string {
 
 func captureTelemetry(limit int) tracing.RuntimeTelemetry {
 	return tracing.RuntimeTelemetry{
-		HarnessKind: tracing.HarnessKindClaude, AgentName: "reporter-claude",
+		Runtime: tracing.RuntimeClaude, AgentName: "reporter-claude",
 		AgentNamespace: "kagent", CaptureContent: true, MaxCaptureBytes: limit,
 	}
 }
@@ -96,10 +96,10 @@ func TestInvocationRecordsResolvedRequestIdentity(t *testing.T) {
 			t.Errorf("%s = %q, want %q", key, got, want)
 		}
 	}
-	if _, ok := attributeOf(span, tracing.AttributeInput); ok {
+	if _, ok := attributeOf(span, tracing.AttributeInputMessages); ok {
 		t.Error("capture is disabled by default, so no input attribute should be recorded")
 	}
-	if _, ok := attributeOf(span, tracing.AttributeOutput); ok {
+	if _, ok := attributeOf(span, tracing.AttributeOutputMessages); ok {
 		t.Error("capture is disabled by default, so no output attribute should be recorded")
 	}
 }
@@ -208,14 +208,14 @@ func TestCaptureRecordsBoundedTurnContent(t *testing.T) {
 	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-capture", strings.Repeat("p", 32))))
 
 	span := recorder.spans(t, 1)[0]
-	if got := stringAttribute(t, span, tracing.AttributeInput); got != strings.Repeat("p", 10) {
-		t.Errorf("%s = %q, want the first ten bytes of the prompt", tracing.AttributeInput, got)
+	if got, want := stringAttribute(t, span, tracing.AttributeInputMessages), tracing.TextMessages(tracing.RoleUser, strings.Repeat("p", 10)); got != want {
+		t.Errorf("%s = %s, want the first ten bytes of the prompt as %s", tracing.AttributeInputMessages, got, want)
 	}
 	if !boolAttribute(t, span, tracing.AttributeInputTruncated) {
 		t.Error("an oversized prompt did not report truncation")
 	}
-	if got := stringAttribute(t, span, tracing.AttributeOutput); got != "日日日" {
-		t.Errorf("%s = %q, want three whole characters", tracing.AttributeOutput, got)
+	if got, want := stringAttribute(t, span, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, "日日日"); got != want {
+		t.Errorf("%s = %s, want three whole characters as %s", tracing.AttributeOutputMessages, got, want)
 	}
 	if !boolAttribute(t, span, tracing.AttributeOutputTruncated) {
 		t.Error("an oversized response did not report truncation")
@@ -236,14 +236,14 @@ func TestCaptureRecordsEmptyOutput(t *testing.T) {
 	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-empty", "hello")))
 
 	span := recorder.spans(t, 1)[0]
-	if got := stringAttribute(t, span, tracing.AttributeOutput); got != "" {
-		t.Errorf("%s = %q, want an empty capture", tracing.AttributeOutput, got)
+	if got, want := stringAttribute(t, span, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, ""); got != want {
+		t.Errorf("%s = %s, want an empty message %s", tracing.AttributeOutputMessages, got, want)
 	}
 	if boolAttribute(t, span, tracing.AttributeOutputTruncated) {
 		t.Error("an empty capture reported truncation")
 	}
-	if got := stringAttribute(t, span, tracing.AttributeInput); got != "hello" {
-		t.Errorf("%s = %q, want the prompt", tracing.AttributeInput, got)
+	if got, want := stringAttribute(t, span, tracing.AttributeInputMessages), tracing.TextMessages(tracing.RoleUser, "hello"); got != want {
+		t.Errorf("%s = %s, want the prompt as %s", tracing.AttributeInputMessages, got, want)
 	}
 }
 
@@ -264,8 +264,8 @@ func TestCaptureRecordsOutputOfAFailedTurn(t *testing.T) {
 	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-capture-failure", "hello")))
 
 	span := recorder.spans(t, 1)[0]
-	if got := stringAttribute(t, span, tracing.AttributeOutput); got != "partial answer" {
-		t.Errorf("%s = %q, want the text produced before the failure", tracing.AttributeOutput, got)
+	if got, want := stringAttribute(t, span, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, "partial answer"); got != want {
+		t.Errorf("%s = %s, want the text produced before the failure as %s", tracing.AttributeOutputMessages, got, want)
 	}
 	if got := stringAttribute(t, span, tracing.AttributeErrorType); got != "runtime_failure" {
 		t.Errorf("%s = %q, want a safe category", tracing.AttributeErrorType, got)
@@ -340,15 +340,16 @@ func TestResumeLinksToTheOriginatingSegment(t *testing.T) {
 	if got := stringAttribute(t, resumed, tracing.AttributeTaskID); got != string(first.TaskID) {
 		t.Errorf("resumed %s = %q, want the same task", tracing.AttributeTaskID, got)
 	}
-	if got := stringAttribute(t, origin, tracing.AttributeOutput); got != "before" {
-		t.Errorf("origin %s = %q, want only the text that segment produced", tracing.AttributeOutput, got)
+	if got, want := stringAttribute(t, origin, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, "before"); got != want {
+		t.Errorf("origin %s = %s, want only the text that segment produced", tracing.AttributeOutputMessages, got)
 	}
-	if got := stringAttribute(t, resumed, tracing.AttributeOutput); got != "after" {
-		t.Errorf("resumed %s = %q, want only the text that segment produced", tracing.AttributeOutput, got)
+	if got, want := stringAttribute(t, resumed, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, "after"); got != want {
+		t.Errorf("resumed %s = %s, want only the text that segment produced", tracing.AttributeOutputMessages, got)
 	}
-	// An approval decision is structured outcome metadata, not prompt text.
-	if got := stringAttribute(t, resumed, tracing.AttributeInput); got != "" {
-		t.Errorf("resumed %s = %q, want no captured prompt", tracing.AttributeInput, got)
+	// An approval decision is structured outcome metadata, not prompt text, so
+	// the resumed segment records no input messages at all.
+	if got, ok := attributeOf(resumed, tracing.AttributeInputMessages); ok {
+		t.Errorf("resumed %s = %s, want no captured prompt", tracing.AttributeInputMessages, got.AsString())
 	}
 }
 
diff --git a/go/pkg/tracing/capture.go b/go/pkg/tracing/capture.go
index 78e30fa3b8..b8e17b8b7b 100644
--- a/go/pkg/tracing/capture.go
+++ b/go/pkg/tracing/capture.go
@@ -1,10 +1,38 @@
 package tracing
 
 import (
+	"encoding/json"
 	"strings"
 	"unicode/utf8"
 )
 
+// Message roles in the GenAI conventions' message shape.
+const (
+	RoleUser      = "user"
+	RoleAssistant = "assistant"
+)
+
+type messagePart struct {
+	Type    string `json:"type"`
+	Content string `json:"content"`
+}
+
+type message struct {
+	Role  string        `json:"role"`
+	Parts []messagePart `json:"parts"`
+}
+
+// TextMessages renders one text message as the JSON document the GenAI
+// conventions define for gen_ai.input.messages and gen_ai.output.messages: an
+// array of messages, each with a role and text parts. The capture budget
+// bounds the text; the few dozen bytes of structure around it are not
+// counted, so a consumer that parses the document gets the whole bounded text.
+func TextMessages(role, text string) string {
+	// A message with a string role and a text part always marshals.
+	encoded, _ := json.Marshal([]message{{Role: role, Parts: []messagePart{{Type: "text", Content: text}}}})
+	return string(encoded)
+}
+
 // TextCapture accumulates the beginning of a text stream up to a byte limit.
 // Once the limit is reached it records that fact and discards further input
 // without retaining or copying it, so the memory one capture can hold stays
diff --git a/go/pkg/tracing/capture_test.go b/go/pkg/tracing/capture_test.go
index 52edc99d9c..c3727da335 100644
--- a/go/pkg/tracing/capture_test.go
+++ b/go/pkg/tracing/capture_test.go
@@ -109,3 +109,16 @@ func TestBoundedTextDoesNotRetainTheInput(t *testing.T) {
 		t.Fatal("bounded text shares the input's backing array")
 	}
 }
+
+func TestTextMessagesFollowsTheConventionsShape(t *testing.T) {
+	got := TextMessages(RoleUser, `say "hi"`)
+	want := `[{"role":"user","parts":[{"type":"text","content":"say \"hi\""}]}]`
+	if got != want {
+		t.Fatalf("TextMessages() = %s, want %s", got, want)
+	}
+	// Capture that produced no text still yields a message, so a consumer can
+	// tell an empty response from capture that is off.
+	if got := TextMessages(RoleAssistant, ""); got != `[{"role":"assistant","parts":[{"type":"text","content":""}]}]` {
+		t.Fatalf("TextMessages() = %s", got)
+	}
+}
diff --git a/go/pkg/tracing/invocation_test.go b/go/pkg/tracing/invocation_test.go
index 5106a5c256..f1579deb4f 100644
--- a/go/pkg/tracing/invocation_test.go
+++ b/go/pkg/tracing/invocation_test.go
@@ -35,8 +35,8 @@ func TestNilInvocationIsUsable(t *testing.T) {
 
 func TestInvocationEndsExactlyOnce(t *testing.T) {
 	tracer, exporter := recordingTracer(t)
-	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false,
-		attribute.String(AttributeHarnessKind, "codex"))
+	ctx, invocation := StartInvocation(t.Context(), tracer, "invoke_agent", false,
+		attribute.String(AttributeRuntime, "codex"))
 
 	ended, err := invocation.End(ctx, Result{TaskState: "TASK_STATE_COMPLETED"})
 	if !ended || err != nil {
@@ -56,7 +56,7 @@ func TestInvocationEndsExactlyOnce(t *testing.T) {
 
 func TestAdoptedInvocationIgnoresTheTransport(t *testing.T) {
 	tracer, exporter := recordingTracer(t)
-	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "invoke_agent", false)
 	invocation.Adopt()
 
 	if ended, _ := invocation.EndTransport(ctx, Result{TaskState: "TASK_STATE_COMPLETED"}); ended {
@@ -79,7 +79,7 @@ func TestAdoptedInvocationIgnoresTheTransport(t *testing.T) {
 
 func TestTransportEndsUnadoptedInvocation(t *testing.T) {
 	tracer, exporter := recordingTracer(t)
-	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "invoke_agent", false)
 
 	if ended, _ := invocation.EndTransport(ctx, Result{Error: "transport_error"}); !ended {
 		t.Fatal("transport could not end an invocation it still owned")
@@ -92,13 +92,13 @@ func TestTransportEndsUnadoptedInvocation(t *testing.T) {
 
 func TestInvocationRecordsDispositionAndLinks(t *testing.T) {
 	tracer, exporter := recordingTracer(t)
-	originCtx, origin := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	originCtx, origin := StartInvocation(t.Context(), tracer, "invoke_agent", false)
 	originContext := origin.SpanContext()
 	if _, err := origin.End(originCtx, Result{TaskState: "TASK_STATE_INPUT_REQUIRED"}); err != nil {
 		t.Fatal(err)
 	}
 
-	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "invoke_agent", false)
 	invocation.AddLink(trace.Link{
 		SpanContext: originContext,
 		Attributes:  []attribute.KeyValue{attribute.String(AttributeLinkRelationship, RelationshipResumeOrigin)},
@@ -125,17 +125,17 @@ func TestInvocationRecordsDispositionAndLinks(t *testing.T) {
 
 func TestFinishedInvocationIgnoresLateWrites(t *testing.T) {
 	tracer, exporter := recordingTracer(t)
-	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "invoke_agent", false)
 	if _, err := invocation.End(ctx, Result{}); err != nil {
 		t.Fatal(err)
 	}
-	invocation.SetAttributes(attribute.String(AttributeOutput, "late"))
+	invocation.SetAttributes(attribute.String(AttributeOutputMessages, "late"))
 
 	spans := exporter.GetSpans()
 	if len(spans) != 1 {
 		t.Fatalf("exported %d spans, want one", len(spans))
 	}
-	if got := attributeValue(spans[0].Attributes, AttributeOutput); got != "" {
+	if got := attributeValue(spans[0].Attributes, AttributeOutputMessages); got != "" {
 		t.Fatalf("output = %q, want nothing recorded after completion", got)
 	}
 }
@@ -155,12 +155,12 @@ func attributeValue(attributes []attribute.KeyValue, key string) string {
 // can no longer record any of it.
 func TestAdoptRefusesAFinishedInvocation(t *testing.T) {
 	tracer, exporter := recordingTracer(t)
-	ctx, invocation := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	ctx, invocation := StartInvocation(t.Context(), tracer, "invoke_agent", false)
 	if !invocation.Adopt() {
 		t.Fatal("Adopt() refused a live invocation")
 	}
 
-	_, transport := StartInvocation(t.Context(), tracer, "a2a.request", false)
+	_, transport := StartInvocation(t.Context(), tracer, "invoke_agent", false)
 	if _, err := transport.EndTransport(ctx, Result{Error: "transport_error"}); err != nil {
 		t.Fatal(err)
 	}
diff --git a/go/pkg/tracing/runtime.go b/go/pkg/tracing/runtime.go
index 38d2f649fd..9fed254315 100644
--- a/go/pkg/tracing/runtime.go
+++ b/go/pkg/tracing/runtime.go
@@ -6,23 +6,48 @@ import (
 	"strings"
 
 	"go.opentelemetry.io/otel/attribute"
+	semconv "go.opentelemetry.io/otel/semconv/v1.41.0"
 )
 
-// Span and resource attribute keys produced by Harness runtimes. Consumers
-// read these names directly, so treat them as a published contract.
+// SchemaURL is the OpenTelemetry semantic conventions version this contract
+// follows. Every tracer kagent creates declares it, so a consumer can tell
+// which revision of the GenAI conventions a span's attribute names come from.
+const SchemaURL = semconv.SchemaURL
+
+// Span and resource attribute keys kagent runtimes produce. Consumers read
+// these names directly, so treat them as a published contract. Names the GenAI
+// semantic conventions define are taken from the pinned semconv package rather
+// than spelled out, so they cannot drift from the version SchemaURL declares;
+// only the kagent and A2A namespaces are kagent's own.
 const (
-	// AttributeHarnessKind names the native runtime behind an invocation. A
-	// Harness object's configurable name is not its kind.
-	AttributeHarnessKind = "kagent.harness.kind"
+	// AttributeOperationName is the GenAI operation. An invocation span carries
+	// OperationInvokeAgent; model and tool spans come from the runtime itself.
+	AttributeOperationName = string(semconv.GenAIOperationNameKey)
+	// AttributeRuntime names the runtime behind an invocation. A Harness
+	// object's configurable name is not its runtime.
+	AttributeRuntime = "kagent.runtime"
 	// AttributeAgentName is the compiled agent identity, <template>-<harness>.
-	AttributeAgentName = "gen_ai.agent.name"
+	AttributeAgentName = string(semconv.GenAIAgentNameKey)
+	// AttributeAgentID is the agent identity qualified by its namespace, which
+	// is what makes it unique within a cluster.
+	AttributeAgentID = string(semconv.GenAIAgentIDKey)
+	// AttributeProviderName is the model provider the agent is compiled against,
+	// in the GenAI conventions' vocabulary.
+	AttributeProviderName = string(semconv.GenAIProviderNameKey)
+	// AttributeRequestModel is the model the agent is compiled against. The
+	// conventions allow it on an agent span only when the agent is bound to one
+	// model, which a compiled kagent agent is.
+	AttributeRequestModel = string(semconv.GenAIRequestModelKey)
 	// AttributeConversationID is the A2A context that groups a conversation.
-	AttributeConversationID = "gen_ai.conversation.id"
-	// AttributeTaskID is the A2A task an invocation executes.
-	AttributeTaskID = "gen_ai.task.id"
+	AttributeConversationID = string(semconv.GenAIConversationIDKey)
+	// AttributeTaskID is the A2A task an invocation executes. The conventions
+	// have no task identity, so it stays in the A2A namespace.
+	AttributeTaskID = "a2a.task.id"
 	// AttributeUserID is the gateway-established user, absent when no trusted
 	// identity reached the runtime.
-	AttributeUserID = "kagent.user_id"
+	AttributeUserID = string(semconv.EnduserIDKey)
+	// AttributeMethod is the A2A method that started the invocation.
+	AttributeMethod = "a2a.method"
 	// AttributeTaskState is the A2A state execution actually reported.
 	AttributeTaskState = "a2a.task.state"
 	// AttributeSegment distinguishes the first execution of a task from the
@@ -31,24 +56,33 @@ const (
 	// AttributeDisposition records how a segment stopped when that is not
 	// visible from the task state, such as an abandoned client stream.
 	AttributeDisposition = "kagent.invocation.disposition"
-	// AttributeInput and AttributeOutput carry bounded turn content, recorded
-	// only under the content-capture opt-in. The truncation flags are siblings
-	// rather than children of them, because a backend that stores attributes as
+	// AttributeInputMessages and AttributeOutputMessages carry bounded turn
+	// content in the conventions' message shape, recorded only under the
+	// content-capture opt-in. The truncation flags live in kagent's namespace
+	// because the conventions have none, and they are siblings rather than
+	// children of the message keys, because a backend that stores attributes as
 	// a nested document cannot hold a string and an object at the same path:
 	// ClickHouse renders both and a reader parsing the result keeps only the
-	// last, dropping the captured text, and Elasticsearch rejects the mapping
-	// outright.
-	AttributeInput           = "kagent.input"
-	AttributeInputTruncated  = "kagent.input_truncated"
-	AttributeOutput          = "kagent.output"
-	AttributeOutputTruncated = "kagent.output_truncated"
+	// last, dropping the captured text, and Elasticsearch rejects the mapping.
+	AttributeInputMessages   = string(semconv.GenAIInputMessagesKey)
+	AttributeInputTruncated  = "kagent.capture.input_truncated"
+	AttributeOutputMessages  = string(semconv.GenAIOutputMessagesKey)
+	AttributeOutputTruncated = "kagent.capture.output_truncated"
 	// AttributeErrorType is a safe failure category. It never carries provider
 	// responses, credentials, or captured content.
-	AttributeErrorType = "error.type"
+	AttributeErrorType = string(semconv.ErrorTypeKey)
 	// AttributeLinkRelationship describes why a segment links to another span.
 	AttributeLinkRelationship = "kagent.invocation.relationship"
 )
 
+// OperationInvokeAgent is the GenAI operation a native harness invocation
+// span reports.
+const OperationInvokeAgent = "invoke_agent"
+
+// TransportSpanName names the wrapper span of a runtime whose invocation
+// span comes from the runtime itself.
+const TransportSpanName = "a2a.request"
+
 // Segment values for AttributeSegment.
 const (
 	SegmentInitial = "initial"
@@ -72,14 +106,33 @@ const (
 // reparent spans or transfer ownership of token usage.
 const RelationshipResumeOrigin = "resume_origin"
 
-// HarnessKind identifies the native runtime a Harness compiles to.
-type HarnessKind string
+// Runtime identifies the runtime that executes an agent. Its values name what
+// produces the model and tool spans beneath an invocation, since that is what
+// a consumer keyed on runtime needs to know, and the Go and Python ADK
+// runtimes differ in what they emit.
+type Runtime string
 
 const (
-	HarnessKindClaude HarnessKind = "claude"
-	HarnessKindCodex  HarnessKind = "codex"
+	RuntimeADKGo  Runtime = "adk-go"
+	RuntimeClaude Runtime = "claude"
+	RuntimeCodex  Runtime = "codex"
 )
 
+// NativeHarness reports whether the runtime wraps a native coding agent whose
+// model and tool spans carry no agent invocation of their own. The wrapper is
+// the invoke_agent span for such a runtime. The ADK emits exactly one
+// invoke_agent per turn itself, so its wrapper stays a transport span rather
+// than a second invocation a consumer would count twice.
+func (r Runtime) NativeHarness() bool {
+	return r == RuntimeClaude || r == RuntimeCodex
+}
+
+// CaptureContentEnvironmentVariable is the OpenTelemetry GenAI instrumentation
+// switch for recording prompts and responses. The controller renders it into
+// every runtime from one setting, so the runtimes that read it directly and
+// the ones that carry the decision in their compiled configuration agree.
+const CaptureContentEnvironmentVariable = "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT"
+
 // DefaultCaptureBytes bounds captured input and output when a configuration
 // enables capture without choosing a limit.
 const DefaultCaptureBytes = 16 << 10
@@ -90,42 +143,49 @@ const DefaultCaptureBytes = 16 << 10
 const MaxCaptureBytes = 64 << 10
 
 // RuntimeTelemetry is the compiler-owned telemetry contract carried in a
-// Harness runtime configuration. It supplies the static identity every span
-// and resource needs and the content-capture policy the runtime enforces.
+// runtime configuration. It supplies the static identity every invocation
+// span and resource needs and the content-capture policy the runtime enforces.
 // Request identity is never part of it, since one runtime process serves many
 // conversations, tasks, and users.
 //
 // A configuration without this section stays valid: the runtime keeps its
 // environment-derived service identity and capture stays off.
 type RuntimeTelemetry struct {
-	HarnessKind     HarnessKind `json:"harness_kind,omitempty"`
-	AgentName       string      `json:"agent_name,omitempty"`
-	AgentNamespace  string      `json:"agent_namespace,omitempty"`
-	CaptureContent  bool        `json:"capture_content,omitempty"`
-	MaxCaptureBytes int         `json:"max_capture_bytes,omitempty"`
+	Runtime        Runtime `json:"runtime,omitempty"`
+	AgentName      string  `json:"agent_name,omitempty"`
+	AgentNamespace string  `json:"agent_namespace,omitempty"`
+	// Provider and Model describe the model the agent is compiled against, in
+	// the GenAI conventions' vocabulary. They let a consumer attribute usage
+	// that a native runtime reports without naming the model.
+	Provider        string `json:"provider,omitempty"`
+	Model           string `json:"model,omitempty"`
+	CaptureContent  bool   `json:"capture_content,omitempty"`
+	MaxCaptureBytes int    `json:"max_capture_bytes,omitempty"`
 }
 
 // Validate rejects configurations a compiler could not have produced.
 func (t RuntimeTelemetry) Validate() error {
-	switch t.HarnessKind {
-	case "", HarnessKindClaude, HarnessKindCodex:
+	switch t.Runtime {
+	case "", RuntimeADKGo, RuntimeClaude, RuntimeCodex:
 	default:
-		return fmt.Errorf("unsupported harness kind %q", t.HarnessKind)
+		return fmt.Errorf("unsupported runtime %q", t.Runtime)
 	}
-	// Identity is all or nothing. A partial identity would mark a span as a
-	// harness invocation while leaving a user-supplied agent name
-	// authoritative, since Identity omits the keys it does not have.
+	// Identity is all or nothing. A partial identity would mark a span with a
+	// runtime while leaving a user-supplied agent name authoritative, since
+	// Identity omits the keys it does not have.
 	present := 0
-	for _, value := range []string{string(t.HarnessKind), t.AgentName, t.AgentNamespace} {
+	for _, value := range []string{string(t.Runtime), t.AgentName, t.AgentNamespace} {
 		if value != "" {
 			present++
 		}
 	}
 	if present != 0 && present != 3 {
-		return fmt.Errorf("telemetry identity requires a harness kind, agent name, and namespace together")
+		return fmt.Errorf("telemetry identity requires a runtime, agent name, and namespace together")
 	}
-	if strings.TrimSpace(t.AgentName) != t.AgentName || strings.TrimSpace(t.AgentNamespace) != t.AgentNamespace {
-		return fmt.Errorf("telemetry agent identity must not have surrounding whitespace")
+	for _, value := range []string{t.AgentName, t.AgentNamespace, t.Provider, t.Model} {
+		if strings.TrimSpace(value) != value {
+			return fmt.Errorf("telemetry identity must not have surrounding whitespace")
+		}
 	}
 	if t.MaxCaptureBytes < 0 || t.MaxCaptureBytes > MaxCaptureBytes {
 		return fmt.Errorf("telemetry capture limit must be between 0 and %d bytes", MaxCaptureBytes)
@@ -133,15 +193,28 @@ func (t RuntimeTelemetry) Validate() error {
 	return nil
 }
 
+// AgentID is the namespace-qualified agent identity, or empty without one.
+func (t RuntimeTelemetry) AgentID() string {
+	if t.AgentName == "" || t.AgentNamespace == "" {
+		return ""
+	}
+	return t.AgentNamespace + "/" + t.AgentName
+}
+
 // Identity returns the trusted static attributes stamped on every invocation
 // span and on the runtime resource.
 func (t RuntimeTelemetry) Identity() []attribute.KeyValue {
-	attributes := make([]attribute.KeyValue, 0, 2)
-	if t.HarnessKind != "" {
-		attributes = append(attributes, attribute.String(AttributeHarnessKind, string(t.HarnessKind)))
-	}
-	if t.AgentName != "" {
-		attributes = append(attributes, attribute.String(AttributeAgentName, t.AgentName))
+	attributes := make([]attribute.KeyValue, 0, 5)
+	for _, entry := range []struct{ key, value string }{
+		{AttributeRuntime, string(t.Runtime)},
+		{AttributeAgentName, t.AgentName},
+		{AttributeAgentID, t.AgentID()},
+		{AttributeProviderName, t.Provider},
+		{AttributeRequestModel, t.Model},
+	} {
+		if entry.value != "" {
+			attributes = append(attributes, attribute.String(entry.key, entry.value))
+		}
 	}
 	return attributes
 }
@@ -161,6 +234,25 @@ func (t RuntimeTelemetry) CaptureLimit() int {
 	return t.MaxCaptureBytes
 }
 
+// RequestIdentity is the identity of one A2A request. It belongs on the
+// invocation span, never on the process-wide resource, because one runtime
+// process serves many conversations and tasks. The segment says whether the
+// request starts a task or continues one that paused for input.
+func RequestIdentity(conversationID, taskID string, resumed bool) []attribute.KeyValue {
+	attributes := make([]attribute.KeyValue, 0, 3)
+	if conversationID != "" {
+		attributes = append(attributes, attribute.String(AttributeConversationID, conversationID))
+	}
+	if taskID != "" {
+		attributes = append(attributes, attribute.String(AttributeTaskID, taskID))
+	}
+	segment := SegmentInitial
+	if resumed {
+		segment = SegmentResumed
+	}
+	return append(attributes, attribute.String(AttributeSegment, segment))
+}
+
 // MergeResourceAttributes renders an OTEL_RESOURCE_ATTRIBUTES value that keeps
 // user-supplied attributes and makes owned keys authoritative. Native child
 // processes inherit their identity this way, so a user tuning unrelated
diff --git a/go/pkg/tracing/runtime_test.go b/go/pkg/tracing/runtime_test.go
index cd1abe7d55..b4cf155e63 100644
--- a/go/pkg/tracing/runtime_test.go
+++ b/go/pkg/tracing/runtime_test.go
@@ -15,14 +15,17 @@ func TestRuntimeTelemetryValidate(t *testing.T) {
 		wantError bool
 	}{
 		{name: "empty is valid"},
-		{name: "claude", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindClaude, AgentName: "a-h", AgentNamespace: "kagent"}},
-		{name: "codex", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentName: "a-h", AgentNamespace: "kagent"}},
+		{name: "claude", telemetry: RuntimeTelemetry{Runtime: RuntimeClaude, AgentName: "a-h", AgentNamespace: "kagent"}},
+		{name: "codex", telemetry: RuntimeTelemetry{Runtime: RuntimeCodex, AgentName: "a-h", AgentNamespace: "kagent"}},
+		{name: "adk go", telemetry: RuntimeTelemetry{Runtime: RuntimeADKGo, AgentName: "a-h", AgentNamespace: "kagent"}},
+		{name: "model identity", telemetry: RuntimeTelemetry{Runtime: RuntimeCodex, AgentName: "a-h", AgentNamespace: "kagent", Provider: "openai", Model: "gpt-5.2-codex"}},
 		{name: "capture without identity", telemetry: RuntimeTelemetry{CaptureContent: true, MaxCaptureBytes: 1024}},
-		{name: "unknown kind", telemetry: RuntimeTelemetry{HarnessKind: "gemini", AgentName: "a-h", AgentNamespace: "kagent"}, wantError: true},
-		{name: "identity without kind", telemetry: RuntimeTelemetry{AgentName: "a-h", AgentNamespace: "kagent"}, wantError: true},
-		{name: "identity without name", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentNamespace: "kagent"}, wantError: true},
-		{name: "identity without namespace", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentName: "a-h"}, wantError: true},
-		{name: "padded agent name", telemetry: RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentName: " a-h ", AgentNamespace: "kagent"}, wantError: true},
+		{name: "unknown runtime", telemetry: RuntimeTelemetry{Runtime: "gemini", AgentName: "a-h", AgentNamespace: "kagent"}, wantError: true},
+		{name: "identity without runtime", telemetry: RuntimeTelemetry{AgentName: "a-h", AgentNamespace: "kagent"}, wantError: true},
+		{name: "identity without name", telemetry: RuntimeTelemetry{Runtime: RuntimeCodex, AgentNamespace: "kagent"}, wantError: true},
+		{name: "identity without namespace", telemetry: RuntimeTelemetry{Runtime: RuntimeCodex, AgentName: "a-h"}, wantError: true},
+		{name: "padded agent name", telemetry: RuntimeTelemetry{Runtime: RuntimeCodex, AgentName: " a-h ", AgentNamespace: "kagent"}, wantError: true},
+		{name: "padded model", telemetry: RuntimeTelemetry{Runtime: RuntimeCodex, AgentName: "a-h", AgentNamespace: "kagent", Model: "gpt "}, wantError: true},
 		{name: "negative limit", telemetry: RuntimeTelemetry{MaxCaptureBytes: -1}, wantError: true},
 		{name: "limit above ceiling", telemetry: RuntimeTelemetry{MaxCaptureBytes: MaxCaptureBytes + 1}, wantError: true},
 	} {
@@ -59,32 +62,66 @@ func TestIdentityOmitsUnsetFields(t *testing.T) {
 	if got := (RuntimeTelemetry{}).Identity(); len(got) != 0 {
 		t.Fatalf("Identity() = %v, want none", got)
 	}
-	got := RuntimeTelemetry{HarnessKind: HarnessKindCodex, AgentName: "reporter-codex", AgentNamespace: "team"}.Identity()
+	got := RuntimeTelemetry{Runtime: RuntimeCodex, AgentName: "reporter-codex", AgentNamespace: "team"}.Identity()
 	want := []attribute.KeyValue{
-		attribute.String(AttributeHarnessKind, "codex"),
+		attribute.String(AttributeRuntime, "codex"),
 		attribute.String(AttributeAgentName, "reporter-codex"),
+		attribute.String(AttributeAgentID, "team/reporter-codex"),
 	}
 	if !slices.Equal(got, want) {
 		t.Fatalf("Identity() = %v, want %v", got, want)
 	}
+	// A namespace alone cannot qualify an agent, so no agent id is reported.
+	if got := (RuntimeTelemetry{AgentNamespace: "team"}).Identity(); len(got) != 0 {
+		t.Fatalf("Identity() = %v, want none", got)
+	}
+	withModel := RuntimeTelemetry{
+		Runtime: RuntimeClaude, AgentName: "reporter-claude", AgentNamespace: "team", Provider: "anthropic", Model: "claude-sonnet-4-5",
+	}.Identity()
+	wantModel := []attribute.KeyValue{
+		attribute.String(AttributeRuntime, "claude"),
+		attribute.String(AttributeAgentName, "reporter-claude"),
+		attribute.String(AttributeAgentID, "team/reporter-claude"),
+		attribute.String(AttributeProviderName, "anthropic"),
+		attribute.String(AttributeRequestModel, "claude-sonnet-4-5"),
+	}
+	if !slices.Equal(withModel, wantModel) {
+		t.Fatalf("Identity() = %v, want %v", withModel, wantModel)
+	}
+}
+
+func TestRequestIdentity(t *testing.T) {
+	got := RequestIdentity("ctx-1", "task-1", false)
+	want := []attribute.KeyValue{
+		attribute.String(AttributeConversationID, "ctx-1"),
+		attribute.String(AttributeTaskID, "task-1"),
+		attribute.String(AttributeSegment, SegmentInitial),
+	}
+	if !slices.Equal(got, want) {
+		t.Fatalf("RequestIdentity() = %v, want %v", got, want)
+	}
+	// A request without identity still says which segment it is.
+	if got := RequestIdentity("", "", true); !slices.Equal(got, []attribute.KeyValue{attribute.String(AttributeSegment, SegmentResumed)}) {
+		t.Fatalf("RequestIdentity() = %v, want only the segment", got)
+	}
 }
 
 func TestMergeResourceAttributes(t *testing.T) {
-	owned := RuntimeTelemetry{HarnessKind: HarnessKindClaude, AgentName: "reporter-claude"}.Identity()
+	owned := RuntimeTelemetry{Runtime: RuntimeClaude, AgentName: "reporter-claude"}.Identity()
 	for _, test := range []struct {
 		name     string
 		existing string
 		owned    []attribute.KeyValue
 		want     string
 	}{
-		{name: "empty existing", owned: owned, want: "gen_ai.agent.name=reporter-claude,kagent.harness.kind=claude"},
+		{name: "empty existing", owned: owned, want: "gen_ai.agent.name=reporter-claude,kagent.runtime=claude"},
 		{
 			name: "user attributes preserved", existing: "deployment.environment=prod,team=sre", owned: owned,
-			want: "deployment.environment=prod,team=sre,gen_ai.agent.name=reporter-claude,kagent.harness.kind=claude",
+			want: "deployment.environment=prod,team=sre,gen_ai.agent.name=reporter-claude,kagent.runtime=claude",
 		},
 		{
-			name: "owned key replaces user value", existing: "kagent.harness.kind=codex,team=sre", owned: owned,
-			want: "team=sre,gen_ai.agent.name=reporter-claude,kagent.harness.kind=claude",
+			name: "owned key replaces user value", existing: "kagent.runtime=codex,team=sre", owned: owned,
+			want: "team=sre,gen_ai.agent.name=reporter-claude,kagent.runtime=claude",
 		},
 		{
 			// The OpenTelemetry SDK resolves the same string to the last value, so
@@ -97,7 +134,7 @@ func TestMergeResourceAttributes(t *testing.T) {
 			want: "team=platform,zone=a",
 		},
 		{name: "unparsable entries dropped", existing: "novalue, ,=orphan,team=sre", owned: nil, want: "team=sre"},
-		{name: "empty owned value dropped", owned: []attribute.KeyValue{attribute.String("kagent.harness.kind", "  ")}, want: ""},
+		{name: "empty owned value dropped", owned: []attribute.KeyValue{attribute.String("kagent.runtime", "  ")}, want: ""},
 		{
 			name: "value is percent encoded", owned: []attribute.KeyValue{attribute.String("gen_ai.agent.name", "a b,c=d")},
 			want: "gen_ai.agent.name=a%20b%2Cc%3Dd",
@@ -113,9 +150,9 @@ func TestMergeResourceAttributes(t *testing.T) {
 }
 
 func TestResourceEnvironmentReplacesOnlyTheResourceVariable(t *testing.T) {
-	environment := []string{"PATH=/usr/bin", "OTEL_RESOURCE_ATTRIBUTES=team=sre,kagent.harness.kind=stale", "HOME=/data"}
-	got := ResourceEnvironment(environment, RuntimeTelemetry{HarnessKind: HarnessKindCodex}.Identity())
-	want := []string{"PATH=/usr/bin", "HOME=/data", "OTEL_RESOURCE_ATTRIBUTES=team=sre,kagent.harness.kind=codex"}
+	environment := []string{"PATH=/usr/bin", "OTEL_RESOURCE_ATTRIBUTES=team=sre,kagent.runtime=stale", "HOME=/data"}
+	got := ResourceEnvironment(environment, RuntimeTelemetry{Runtime: RuntimeCodex}.Identity())
+	want := []string{"PATH=/usr/bin", "HOME=/data", "OTEL_RESOURCE_ATTRIBUTES=team=sre,kagent.runtime=codex"}
 	if !slices.Equal(got, want) {
 		t.Fatalf("ResourceEnvironment() = %v, want %v", got, want)
 	}
@@ -137,10 +174,10 @@ func TestResourceEnvironmentDropsTheVariableWhenNothingRemains(t *testing.T) {
 // reports the conflict.
 func TestAttributeNamesAreNotNamespaces(t *testing.T) {
 	names := []string{
-		AttributeHarnessKind, AttributeAgentName, AttributeConversationID, AttributeTaskID,
-		AttributeUserID, AttributeTaskState, AttributeSegment, AttributeDisposition,
-		AttributeInput, AttributeInputTruncated, AttributeOutput, AttributeOutputTruncated,
-		AttributeErrorType, AttributeLinkRelationship,
+		AttributeOperationName, AttributeRuntime, AttributeAgentName, AttributeAgentID, AttributeProviderName,
+		AttributeRequestModel, AttributeConversationID, AttributeTaskID, AttributeUserID, AttributeMethod,
+		AttributeTaskState, AttributeSegment, AttributeDisposition, AttributeInputMessages, AttributeInputTruncated,
+		AttributeOutputMessages, AttributeOutputTruncated, AttributeErrorType, AttributeLinkRelationship,
 	}
 	for _, namespace := range names {
 		for _, name := range names {
diff --git a/go/pkg/tracing/tracing.go b/go/pkg/tracing/tracing.go
index 71b739054a..7c1173f268 100644
--- a/go/pkg/tracing/tracing.go
+++ b/go/pkg/tracing/tracing.go
@@ -17,9 +17,17 @@ import (
 	"go.opentelemetry.io/otel/propagation"
 	"go.opentelemetry.io/otel/sdk/resource"
 	sdktrace "go.opentelemetry.io/otel/sdk/trace"
-	semconv "go.opentelemetry.io/otel/semconv/v1.36.0"
+	semconv "go.opentelemetry.io/otel/semconv/v1.41.0"
+	"go.opentelemetry.io/otel/trace"
 )
 
+// Tracer returns the global tracer for an instrumentation scope, declaring the
+// semantic conventions version this contract follows. Every span kagent starts
+// goes through it, so no scope is left without a schema URL.
+func Tracer(scope string) trace.Tracer {
+	return otel.Tracer(scope, trace.WithSchemaURL(SchemaURL))
+}
+
 // Init configures the global tracer provider and W3C propagator from the
 // standard OTEL environment. It is intended to be called once by a process
 // entrypoint. The compiler-owned telemetry contract identifies the service when

From ce73624469ccfd47e17db816ae0e26927f08f60e Mon Sep 17 00:00:00 2001
From: David Haifley <david.haifley@solo.io>
Date: Mon, 21 Sep 2026 13:38:58 -0400
Subject: [PATCH 3/4] feat(tracing): record output finish reasons, span-mode
 capture, and abandoned request completion

Signed-off-by: David Haifley <david.haifley@solo.io>
---
 docs/architecture/telemetry.md                |  85 ++++++---
 go/adk/pkg/a2a/executor.go                    |   6 +-
 go/adk/pkg/a2a/server/server.go               |   5 +-
 go/adk/pkg/a2a/server/tracing.go              |  56 ++++--
 go/adk/pkg/a2a/server/tracing_test.go         | 105 +++++++++-
 go/adk/pkg/telemetry/tracing.go               |   2 +-
 .../internal/translator/claude/compiler.go    |   1 +
 .../translator/claude/compiler_test.go        |   4 +-
 go/core/internal/translator/codex/compiler.go |   1 +
 .../internal/translator/kagent/compiler.go    |   1 +
 go/core/internal/translator/otel.go           |  28 +--
 go/core/internal/translator/otel_test.go      |  11 +-
 go/core/test/e2e/tracing_test.go              |  33 +++-
 go/harness/claude/internal/adapter/adapter.go |   2 +-
 go/harness/codex/internal/adapter/adapter.go  |   2 +-
 go/harness/runtime/a2a/executor.go            |  77 ++++++--
 go/harness/runtime/a2a/tracing_test.go        | 179 +++++++++++++++++-
 go/pkg/tracing/capture.go                     |  47 ++++-
 go/pkg/tracing/capture_test.go                |  23 ++-
 go/pkg/tracing/runtime.go                     |  27 ++-
 go/pkg/tracing/runtime_test.go                |  11 ++
 21 files changed, 577 insertions(+), 129 deletions(-)

diff --git a/docs/architecture/telemetry.md b/docs/architecture/telemetry.md
index 740b120316..b633a9bd58 100644
--- a/docs/architecture/telemetry.md
+++ b/docs/architecture/telemetry.md
@@ -23,13 +23,20 @@ An unusable capture budget is reported as a compilation warning and replaced by
 the default, so an observability setting cannot invalidate an AgentTemplate.
 
 The capture decision reaches every runtime as the standard GenAI instrumentation
-variable, `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT`, rendered `true`
-or `false` alongside the trace exporter settings. The ADK runtime reads it
-before recording model request and response payloads on its model spans, and
-the harness runtimes carry the same decision in their compiled configuration.
-It is controller-owned, so a `Harness.spec.env` entry with that name is
-rejected: one setting decides whether prompts enter traces, and no runtime can
-be talked into recording them by a user-supplied variable.
+variable, `OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT`, rendered
+`SPAN_ONLY` when capture is on and `false` when it is off. It is rendered
+whether or not the controller exports traces, so a runtime that reaches a
+collector through settings the controller did not render still follows it. The
+ADK runtimes read the variable as a mode and treat a plain `true` as log records
+only, so the span form is what puts `gen_ai.input.messages` and
+`gen_ai.output.messages` on their model spans; the ADK Go runtime's older
+`gcp.vertex.agent.llm_request` and `llm_response` payload attributes follow the
+same value. The harness runtimes carry the same decision in their compiled
+configuration. The variable is controller-owned: the Claude and Codex compilers
+reject a `Harness.spec.env` entry with that name, and the kagent compiler
+replaces one with the controller's value. One setting decides whether prompts
+enter traces, and no runtime can be talked into recording them by a
+user-supplied variable.
 
 Other `OTEL_*` variables remain available for per-Harness tuning through
 `Harness.spec.env`, including `OTEL_RESOURCE_ATTRIBUTES`.
@@ -58,12 +65,15 @@ emits model and tool spans but no agent invocation. The request span is
 therefore the GenAI conventions' `invoke_agent` operation, named
 `invoke_agent <gen_ai.agent.name>`, and it is the anchor consumers should read.
 
-For the ADK runtime the ADK emits exactly one `invoke_agent` of its own per
-turn, carrying `gen_ai.agent.name` and `gen_ai.conversation.id`, and that span
-is the invocation. The request span stays a transport span named `a2a.request`
-with the same identity attributes and no `gen_ai.operation.name`, so a consumer
-counting invocations by operation counts each ADK turn once. The ADK also keeps
-an `invocation` span of its own beneath the request span.
+For the ADK runtime the ADK emits `invoke_agent` spans of its own, carrying
+`gen_ai.agent.name` and `gen_ai.conversation.id`: one for the root agent and
+one for each sub-agent it transfers to within the turn. The root one is the
+invocation. The request span stays a transport span named `a2a.request` with
+the same identity attributes and no `gen_ai.operation.name`, so the wrapper
+never adds an invocation of its own to what the ADK reports. A consumer that
+counts turns rather than agent invocations counts `kagent.invocation.segment`,
+which only the request span carries, whichever runtime produced the trace. The
+ADK also keeps an `invocation` span of its own beneath the request span.
 
 | Attribute | Meaning |
 | --- | --- |
@@ -81,7 +91,7 @@ an `invocation` span of its own beneath the request span.
 | `kagent.invocation.segment` | `initial` or `resumed` |
 | `kagent.invocation.disposition` | `canceled`, `abandoned`, or `interrupted`, when the task state does not say it. See below |
 | `error.type` | A safe failure category. Never a provider response, credential, or captured content |
-| `gen_ai.input.messages`, `gen_ai.output.messages` | Bounded turn content in the conventions' message shape, present only under the capture opt-in |
+| `gen_ai.input.messages`, `gen_ai.output.messages` | Bounded turn content in the conventions' message shape, present only under the capture opt-in. Each output message carries the `finish_reason` the conventions require |
 | `kagent.capture.input_truncated`, `kagent.capture.output_truncated` | Whether that content was shortened |
 
 The provider and model on this span stand in for what a native runtime does not
@@ -93,9 +103,9 @@ model, which a compiled kagent agent is.
 The runtime resource carries `service.name` and `service.namespace` from the
 compiled agent identity, plus the same `kagent.runtime`, `gen_ai.agent.name`,
 `gen_ai.agent.id`, `gen_ai.provider.name` and `gen_ai.request.model`. The
-harness adapters merge those into `OTEL_RESOURCE_ATTRIBUTES` for the native
-child process, so its spans report the same agent and model while keeping its
-own `service.name`. Conversation, task, and user identity never appear on a
+harness adapters merge those, with `service.namespace`, into
+`OTEL_RESOURCE_ATTRIBUTES` for the native child process, so its spans report the
+same agent, model and namespace while keeping its own `service.name`. Conversation, task, and user identity never appear on a
 resource, since one runtime process serves many of each.
 
 The ADK runtime additionally stamps `kagent.user_id`, `gen_ai.task.id`,
@@ -108,9 +118,12 @@ so the two runtimes change in one step rather than diverging further.
 
 The transport interceptor opens the span with the identity the runtime knows
 before execution begins, so a request rejected during validation still reports
-which agent rejected it. Execution then takes ownership, because a2a-go runs an
-executor detached from the caller and a unary response can be delivered while
-the turn is still working. Completion runs exactly once.
+which agent rejected it. The harness executor then takes ownership, because
+a2a-go runs an executor detached from the caller and a unary response can be
+delivered while the turn is still working. The ADK executor does not: its
+request span is a transport span, completed when the response it describes is
+delivered, and the ADK's own `invoke_agent` describes the turn. Completion runs
+exactly once.
 
 For runtimes whose Actor may be suspended as soon as a quiescent event leaves
 the process, completion exports before that event is yielded. The export is
@@ -120,10 +133,17 @@ unreachable collector costs at most that budget once per segment.
 A segment records `abandoned` when the A2A event consumer stopped accepting
 events before execution finished, and `interrupted` when the execution context
 ended without a cancellation request. Neither is reported as cancellation, which
-is recorded only when a client asked for it. The consumer a runtime can observe
-is the A2A event pipe rather than the network client, so a client that merely
-closes a streaming subscription leaves execution running and is not visible
-here.
+is recorded only when a client asked for it. A harness segment observes the A2A
+event pipe rather than the network client, so a client that closes a streaming
+subscription leaves that execution running and is not visible to it. A request
+span the transport still owns is completed as `abandoned` when the request
+context ends without a quiescent event, which is how a2a-go surfaces a caller
+that stopped waiting; otherwise the span would never end and never export.
+
+A failure that never publishes a task event, such as a rejected request, is
+recorded with its `error.type` and exported before the error leaves the
+process. A panic in a harness runner is recorded as `error.type=runtime_panic`
+without the panic value and then propagates.
 
 Cancellation completes and exports the segment before the canceled event is
 published, since that event is what releases the gateway to suspend the Actor.
@@ -136,10 +156,11 @@ native protocol offers a supported way to replace it when the turn resumes. Work
 the native runtime does after an approval therefore stays under the originating
 trace.
 
-Kagent does not paper over this. Each execution segment gets its own
-request span carrying the same conversation and task identity, and a
-resumed segment records an OpenTelemetry link back to the segment that parked
-it, with `kagent.invocation.relationship` set to `resume_origin`. A link states
+Kagent does not paper over this. Each execution segment gets its own request
+span carrying the same conversation and task identity, and a resumed segment
+records an OpenTelemetry link back to the segment that started the native turn,
+however many times the turn has paused since, with
+`kagent.invocation.relationship` set to `resume_origin`. A link states
 a relationship. It does not reparent spans and it does not transfer ownership of
 the token usage recorded under the originating segment. Consumers should expect
 several segments for one task and should not assume the last one owns the work.
@@ -149,7 +170,11 @@ several segments for one task and should not assume the last one owns the work.
 Capture is off unless a user turns it on. When it is on, a segment records
 the current turn's prompt as `gen_ai.input.messages` and the text that segment
 produced as `gen_ai.output.messages`, each a JSON array holding one message with
-one text part, in the shape the conventions define for those attributes. The
+one text part, in the shape the conventions define for those attributes. Each
+output message carries the `finish_reason` the conventions require: `stop` for
+a completed segment, `tool_call` for a segment parked for an approval or a
+question, since both harnesses park only at a tool call, `error` for a failure,
+and the disposition name for a canceled, abandoned or interrupted segment. The
 text is bounded by the configured byte budget, preserving UTF-8 and reporting
 truncation; the structure around it is not counted. Tool arguments, tool
 results, approval structures, the rest of the conversation, and native stderr
@@ -178,7 +203,7 @@ harness images compiles configurations those images reject.
   construction and is expressed as a link rather than asserted as a parent.
 - a2a-go dispatches execution before it reads the caller's subscription. A
   caller that disconnects inside that window completes the invocation from the
-  transport side, so that request's span reports a transport error without
+  transport side, so that request's span is recorded as abandoned without
   conversation or task identity while execution continues untraced.
 - A request rejected by a transport interceptor before execution begins has no
   invocation span. Such a request never reaches an agent.
diff --git a/go/adk/pkg/a2a/executor.go b/go/adk/pkg/a2a/executor.go
index 7ddcdcad07..eeee7b00ae 100644
--- a/go/adk/pkg/a2a/executor.go
+++ b/go/adk/pkg/a2a/executor.go
@@ -142,9 +142,9 @@ func (e *KAgentExecutor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorCon
 			(reqCtx.StoredTask.Status.State == a2atype.TaskStateInputRequired || reqCtx.StoredTask.Status.State == a2atype.TaskStateAuthRequired)
 		tracing.InvocationFromContext(ctx).SetAttributes(tracing.RequestIdentity(sessionID, string(reqCtx.TaskID), resumed)...)
 		spanAttributes := map[string]string{
-			"kagent.user_id":         userID,
-			"gen_ai.task.id":         string(reqCtx.TaskID),
-			"gen_ai.conversation.id": sessionID,
+			"kagent.user_id":                userID,
+			"gen_ai.task.id":                string(reqCtx.TaskID),
+			tracing.AttributeConversationID: sessionID,
 		}
 		if e.appName != "" {
 			spanAttributes["kagent.app_name"] = e.appName
diff --git a/go/adk/pkg/a2a/server/server.go b/go/adk/pkg/a2a/server/server.go
index 752e730e6d..d8ff3f5175 100644
--- a/go/adk/pkg/a2a/server/server.go
+++ b/go/adk/pkg/a2a/server/server.go
@@ -62,9 +62,8 @@ func NewA2AServer(agentCard a2atype.AgentCard, executor a2asrv.AgentExecutor, lo
 	flushBeforeResponse := strings.EqualFold(strings.TrimSpace(os.Getenv("KAGENT_PRE_RESPONSE_TRACE_FLUSH")), "true")
 	// The invocation span anchors identity whether or not the deployment needs
 	// a pre-response flush. It is a no-op span when tracing is disabled.
-	handlerOpts = append(handlerOpts, a2asrv.WithCallInterceptors(&invocationInterceptor{
-		logger: logger, telemetry: config.Telemetry, flush: flushBeforeResponse,
-	}))
+	handlerOpts = append(handlerOpts, a2asrv.WithCallInterceptors(
+		newInvocationInterceptor(logger, config.Telemetry, flushBeforeResponse)))
 	requestHandler := a2asrv.NewHandler(executor, handlerOpts...)
 	jsonrpcHandler := a2asrv.NewJSONRPCHandler(requestHandler)
 	if maxContentLength := getMaxContentLength(logger); maxContentLength != nil {
diff --git a/go/adk/pkg/a2a/server/tracing.go b/go/adk/pkg/a2a/server/tracing.go
index 7d24c76d85..b0cb2cc9e9 100644
--- a/go/adk/pkg/a2a/server/tracing.go
+++ b/go/adk/pkg/a2a/server/tracing.go
@@ -2,6 +2,7 @@ package server
 
 import (
 	"context"
+	"errors"
 	"log/slog"
 
 	a2atype "github.com/a2aproject/a2a-go/v2/a2a"
@@ -35,18 +36,25 @@ const invocationScope = "github.com/kagent-dev/kagent/go/adk/pkg/a2a/server"
 // attributes before ending it.
 type invocationInterceptor struct {
 	a2asrv.PassthroughCallInterceptor
-	logger    *slog.Logger
-	telemetry tracing.RuntimeTelemetry
-	flush     bool
+	logger *slog.Logger
+	flush  bool
+	// name and static are fixed for the life of the runtime, so they are built
+	// once rather than on every request.
+	name   string
+	static []attribute.KeyValue
 }
 
-// spanName follows the conventions for a native harness: the operation, then
-// the agent name. Any other runtime keeps the transport span name.
-func (i *invocationInterceptor) spanName() string {
-	if !i.telemetry.Runtime.NativeHarness() {
-		return tracing.TransportSpanName
+// newInvocationInterceptor prepares the span name and static attributes. A
+// native harness gets the conventions' invoke_agent operation and span name;
+// any other runtime keeps the transport span name and no operation.
+func newInvocationInterceptor(logger *slog.Logger, telemetry tracing.RuntimeTelemetry, flush bool) *invocationInterceptor {
+	interceptor := &invocationInterceptor{logger: logger, flush: flush, name: tracing.TransportSpanName}
+	if telemetry.Runtime.NativeHarness() {
+		interceptor.name = tracing.OperationInvokeAgent + " " + telemetry.AgentName
+		interceptor.static = append(interceptor.static, attribute.String(tracing.AttributeOperationName, tracing.OperationInvokeAgent))
 	}
-	return tracing.OperationInvokeAgent + " " + i.telemetry.AgentName
+	interceptor.static = append(interceptor.static, telemetry.Identity()...)
+	return interceptor
 }
 
 func (i *invocationInterceptor) Before(ctx context.Context, callCtx *a2asrv.CallContext, _ *a2asrv.Request) (context.Context, any, error) {
@@ -54,19 +62,27 @@ func (i *invocationInterceptor) Before(ctx context.Context, callCtx *a2asrv.Call
 	if method != "SendMessage" && method != "SendStreamingMessage" {
 		return ctx, nil, nil
 	}
-	identity := i.telemetry.Identity()
-	attributes := make([]attribute.KeyValue, 0, len(identity)+3)
-	if i.telemetry.Runtime.NativeHarness() {
-		attributes = append(attributes, attribute.String(tracing.AttributeOperationName, tracing.OperationInvokeAgent))
-	}
+	attributes := make([]attribute.KeyValue, 0, len(i.static)+2)
 	attributes = append(attributes, attribute.String(tracing.AttributeMethod, method))
-	attributes = append(attributes, identity...)
+	attributes = append(attributes, i.static...)
 	// The gateway authenticates the caller and replaces x-user-id before
 	// forwarding, so this is the only trusted identity on the private path.
 	if userID := auth.UserIDFromContext(ctx); userID != "" {
 		attributes = append(attributes, attribute.String(tracing.AttributeUserID, userID))
 	}
-	ctx, _ = tracing.StartInvocation(ctx, tracing.Tracer(invocationScope), i.spanName(), i.flush, attributes...)
+	ctx, invocation := tracing.StartInvocation(ctx, tracing.Tracer(invocationScope), i.name, i.flush, attributes...)
+	// a2a-go runs no final After callback when a streaming consumer stops
+	// reading, so an invocation the transport still owns would otherwise never
+	// end and never export. The request context ends in that case, and
+	// completing there records the abandonment. An adopted invocation, or one
+	// After already completed, is left as it is.
+	context.AfterFunc(ctx, func() {
+		detached := context.WithoutCancel(ctx)
+		if _, err := invocation.EndTransport(detached, tracing.Result{Disposition: tracing.DispositionAbandoned}); err != nil {
+			i.logger.ErrorContext(detached, "failed to flush traces for an abandoned A2A request", "error", err,
+				"trace_id", invocation.SpanContext().TraceID().String())
+		}
+	})
 	return ctx, nil, nil
 }
 
@@ -98,7 +114,13 @@ func (i *invocationInterceptor) After(ctx context.Context, callCtx *a2asrv.CallC
 		return nil
 	}
 	result := tracing.Result{TaskState: string(state)}
-	if response.Err != nil {
+	switch {
+	case response.Err == nil:
+	case errors.Is(response.Err, context.Canceled), errors.Is(response.Err, context.DeadlineExceeded):
+		// The caller stopped waiting. The turn itself did not fail, and a2a-go
+		// keeps running it detached from the caller.
+		result.Disposition = tracing.DispositionAbandoned
+	default:
 		result.Error = "transport_error"
 	}
 	if _, err := invocation.EndTransport(ctx, result); err != nil {
diff --git a/go/adk/pkg/a2a/server/tracing_test.go b/go/adk/pkg/a2a/server/tracing_test.go
index d8258861ba..2f7c898843 100644
--- a/go/adk/pkg/a2a/server/tracing_test.go
+++ b/go/adk/pkg/a2a/server/tracing_test.go
@@ -11,6 +11,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
 
 	"log/slog"
 
@@ -184,8 +185,8 @@ func TestRequestSpanCarriesStaticIdentityAndTrustedUser(t *testing.T) {
 	}
 }
 
-// An ADK runtime emits exactly one invoke_agent of its own, so its request
-// span stays a transport span that carries the identity but no operation.
+// An ADK runtime emits its own invoke_agent spans, so its request span stays a
+// transport span that carries the identity but no operation.
 func TestRequestSpanStaysATransportSpanForTheADK(t *testing.T) {
 	exporter := syncExporter(t)
 	server, err := NewA2AServer(a2atype.AgentCard{}, substrateExecutor{}, slog.New(slog.DiscardHandler),
@@ -218,8 +219,14 @@ func TestRequestSpanStaysATransportSpanForTheADK(t *testing.T) {
 	}
 	invocations := 0
 	for _, exported := range exporter.GetSpans() {
-		if exported.Name == "invocation" {
-			invocations++
+		if exported.Name != "invocation" {
+			continue
+		}
+		invocations++
+		// The kagent-owned invocation span keeps the ADK scope name but declares
+		// the contract's schema, like every other tracer kagent creates.
+		if exported.InstrumentationScope.SchemaURL != tracing.SchemaURL {
+			t.Errorf("invocation schema URL = %q, want %q", exported.InstrumentationScope.SchemaURL, tracing.SchemaURL)
 		}
 	}
 	if invocations != 1 {
@@ -227,6 +234,96 @@ func TestRequestSpanStaysATransportSpanForTheADK(t *testing.T) {
 	}
 }
 
+// blockingExecutor never adopts the invocation and holds the task in the
+// working state until released, the way an ADK turn does while a model call
+// is in flight.
+type blockingExecutor struct {
+	release <-chan struct{}
+}
+
+func (e blockingExecutor) Execute(_ context.Context, reqCtx *a2asrv.ExecutorContext) iter.Seq2[a2atype.Event, error] {
+	return func(yield func(a2atype.Event, error) bool) {
+		if !yield(a2atype.NewSubmittedTask(reqCtx, reqCtx.Message), nil) {
+			return
+		}
+		if !yield(a2atype.NewStatusUpdateEvent(reqCtx, a2atype.TaskStateWorking, nil), nil) {
+			return
+		}
+		<-e.release
+		yield(a2atype.NewStatusUpdateEvent(reqCtx, a2atype.TaskStateCompleted, nil), nil)
+	}
+}
+
+func (blockingExecutor) Cancel(context.Context, *a2asrv.ExecutorContext) iter.Seq2[a2atype.Event, error] {
+	return func(yield func(a2atype.Event, error) bool) {}
+}
+
+// A streaming client that goes away before the task quiesces gets no final
+// After callback from a2a-go, while execution continues detached. The request
+// span must still complete and export, recording the abandonment, rather than
+// stay open for ever.
+func TestRequestSpanCompletesWhenAStreamingClientDisconnects(t *testing.T) {
+	exporter := syncExporter(t)
+	release := make(chan struct{})
+	defer close(release)
+	server, err := NewA2AServer(a2atype.AgentCard{}, blockingExecutor{release: release}, slog.New(slog.DiscardHandler), ServerConfig{Port: "0"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	testServer := httptest.NewUnstartedServer(server.httpServer.Handler)
+	testServer.Config.Protocols = server.httpServer.Protocols
+	testServer.Start()
+	defer testServer.Close()
+	defer server.grpcServer.Stop()
+	conn, err := grpc.NewClient(testServer.Listener.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	request, err := pbconv.ToProtoSendMessageRequest(&a2atype.SendMessageRequest{
+		Message: a2atype.NewMessage(a2atype.MessageRoleUser, a2atype.NewTextPart("hi")),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ctx, cancel := context.WithCancel(t.Context())
+	stream, err := a2apb.NewA2AServiceClient(conn).SendStreamingMessage(ctx, request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := stream.Recv(); err != nil {
+		t.Fatal(err)
+	}
+	cancel()
+
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		var found []tracetest.SpanStub
+		for _, span := range exporter.GetSpans() {
+			if isRequestSpan(span) {
+				found = append(found, span)
+			}
+		}
+		if len(found) == 1 {
+			if got := spanAttribute(found[0], tracing.AttributeDisposition); got != tracing.DispositionAbandoned {
+				t.Fatalf("%s = %q, want %q", tracing.AttributeDisposition, got, tracing.DispositionAbandoned)
+			}
+			if got := spanAttribute(found[0], tracing.AttributeErrorType); got != "" {
+				t.Fatalf("a disconnected client was reported as %s=%q", tracing.AttributeErrorType, got)
+			}
+			return
+		}
+		if len(found) > 1 {
+			t.Fatalf("exported %d request spans, want exactly one", len(found))
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("request span was not exported after the client disconnected")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
 func TestRequestSpanRecordsEarlyFailure(t *testing.T) {
 	exporter := syncExporter(t)
 	server, err := NewA2AServer(a2atype.AgentCard{}, failingExecutor{}, slog.New(slog.DiscardHandler),
diff --git a/go/adk/pkg/telemetry/tracing.go b/go/adk/pkg/telemetry/tracing.go
index 42c5854a0e..03eca19ecd 100644
--- a/go/adk/pkg/telemetry/tracing.go
+++ b/go/adk/pkg/telemetry/tracing.go
@@ -32,7 +32,7 @@ func SetKAgentSpanAttributes(ctx context.Context, attributes map[string]string)
 // beneath the invocation span the A2A server opened. Descendant spans inherit
 // request-scoped attributes via the span processor.
 func StartInvocationSpan(ctx context.Context) (context.Context, trace.Span) {
-	return otel.Tracer("gcp.vertex.agent").Start(ctx, "invocation")
+	return tracing.Tracer("gcp.vertex.agent").Start(ctx, "invocation")
 }
 
 // PreResponseFlushEnabled reports whether spans must be exported before a turn's
diff --git a/go/core/internal/translator/claude/compiler.go b/go/core/internal/translator/claude/compiler.go
index e5397c2bab..9019d68e62 100644
--- a/go/core/internal/translator/claude/compiler.go
+++ b/go/core/internal/translator/claude/compiler.go
@@ -83,6 +83,7 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	)
 	environment = append(environment, telemetryConfig.TraceEnvironment()...)
 	environment = append(environment, telemetryConfig.LogEnvironment()...)
+	environment = append(environment, telemetryConfig.CaptureEnvironment())
 	if traceConfig.Enabled || logConfig.Enabled {
 		tracesExporter := "none"
 		if traceConfig.Enabled {
diff --git a/go/core/internal/translator/claude/compiler_test.go b/go/core/internal/translator/claude/compiler_test.go
index 5ad70120d8..e08e2296f9 100644
--- a/go/core/internal/translator/claude/compiler_test.go
+++ b/go/core/internal/translator/claude/compiler_test.go
@@ -176,8 +176,8 @@ func TestCompileTracing(t *testing.T) {
 			t.Errorf("sensitive trace environment[%s] = %q, want 1", name, environment[name])
 		}
 	}
-	if got := environment["OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT"]; got != "true" {
-		t.Errorf("capture environment = %q, want true", got)
+	if got := environment["OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT"]; got != tracing.CaptureContentSpanOnly {
+		t.Errorf("capture environment = %q, want %q", got, tracing.CaptureContentSpanOnly)
 	}
 }
 
diff --git a/go/core/internal/translator/codex/compiler.go b/go/core/internal/translator/codex/compiler.go
index ccd42b06be..2069d8e4e2 100644
--- a/go/core/internal/translator/codex/compiler.go
+++ b/go/core/internal/translator/codex/compiler.go
@@ -98,6 +98,7 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	)
 	environment = append(environment, telemetryConfig.TraceEnvironment()...)
 	environment = append(environment, telemetryConfig.LogEnvironment()...)
+	environment = append(environment, telemetryConfig.CaptureEnvironment())
 	agents, err := compileAgents(input.Root)
 	if err != nil {
 		return nil, err
diff --git a/go/core/internal/translator/kagent/compiler.go b/go/core/internal/translator/kagent/compiler.go
index dcd3cb7616..62ba8c102c 100644
--- a/go/core/internal/translator/kagent/compiler.go
+++ b/go/core/internal/translator/kagent/compiler.go
@@ -76,6 +76,7 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	)
 	environment = append(environment, telemetryConfig.TraceEnvironment()...)
 	environment = append(environment, telemetryConfig.LogEnvironment()...)
+	environment = append(environment, telemetryConfig.CaptureEnvironment())
 	environment = adkconfig.DedupeEnv(environment)
 	provenance, err := c.config.BuildProvenance(ctx, harness, compiled.Templates, compiled.Models, environment)
 	if err != nil {
diff --git a/go/core/internal/translator/otel.go b/go/core/internal/translator/otel.go
index 4ce8a5154d..8221568adc 100644
--- a/go/core/internal/translator/otel.go
+++ b/go/core/internal/translator/otel.go
@@ -190,18 +190,24 @@ func OwnsTelemetryEnvironment(name string) bool {
 }
 
 // TraceEnvironment renders the resolved trace settings for an agent runtime.
-// The content-capture switch rides with them, because the standard GenAI
-// instrumentation variable is how a runtime that instruments its own model
-// calls learns the decision, and a user-supplied value would let one runtime
-// record prompts that the controller's setting said to keep out of traces.
 func (c TelemetryConfig) TraceEnvironment() []corev1.EnvVar {
-	environment := signalEnvironment(c.Traces, otelTracingEnabled, otelExporterOTLPTracesEndpoint, otelExporterOTLPTracesProtocol)
-	if environment == nil {
-		return nil
-	}
-	return append(environment, corev1.EnvVar{
-		Name: tracing.CaptureContentEnvironmentVariable, Value: strconv.FormatBool(c.CaptureSensitiveContent),
-	})
+	return signalEnvironment(c.Traces, otelTracingEnabled, otelExporterOTLPTracesEndpoint, otelExporterOTLPTracesProtocol)
+}
+
+// CaptureEnvironment renders the content-capture decision as the standard
+// GenAI instrumentation variable, which is how a runtime that instruments its
+// own model calls learns it. It is rendered whether or not the controller
+// exports traces, so a runtime reaching a collector through settings the
+// controller did not render still follows the controller's decision, and a
+// user-supplied value cannot let one runtime record prompts the setting said
+// to keep out of traces. The ADK runtimes read the variable as a mode and
+// treat a plain true as log records only, so the span form is rendered.
+func (c TelemetryConfig) CaptureEnvironment() corev1.EnvVar {
+	value := tracing.CaptureContentDisabled
+	if c.CaptureSensitiveContent {
+		value = tracing.CaptureContentSpanOnly
+	}
+	return corev1.EnvVar{Name: tracing.CaptureContentEnvironmentVariable, Value: value}
 }
 
 // LogEnvironment renders the resolved log settings for an agent runtime.
diff --git a/go/core/internal/translator/otel_test.go b/go/core/internal/translator/otel_test.go
index 2d6fe4f8a3..2110bf7057 100644
--- a/go/core/internal/translator/otel_test.go
+++ b/go/core/internal/translator/otel_test.go
@@ -37,10 +37,14 @@ func TestTelemetryConfigFromProcess(t *testing.T) {
 		{Name: "OTEL_TRACING_ENABLED", Value: "true"},
 		{Name: "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", Value: "http://traces:4317"},
 		{Name: "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL", Value: "grpc"},
-		{Name: "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT", Value: "true"},
 	}; !reflect.DeepEqual(got.TraceEnvironment(), want) {
 		t.Errorf("trace environment = %#v, want %#v", got.TraceEnvironment(), want)
 	}
+	// The ADK runtimes read a plain true as log records only, so capture on is
+	// rendered in the form that records span attributes.
+	if capture, want := got.CaptureEnvironment(), (corev1.EnvVar{Name: "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT", Value: "SPAN_ONLY"}); capture != want {
+		t.Errorf("capture environment = %#v, want %#v", capture, want)
+	}
 	if want := []corev1.EnvVar{
 		{Name: "OTEL_LOGGING_ENABLED", Value: "true"},
 		{Name: "OTEL_EXPORTER_OTLP_LOGS_ENDPOINT", Value: "http://generic:4318/otel/v1/logs"},
@@ -63,6 +67,11 @@ func TestTelemetryConfigFromProcessKeepsSignalsIndependent(t *testing.T) {
 	if got.Traces.Enabled || got.TraceEnvironment() != nil || got.Traces.Hostname != "" || !got.Logs.Enabled {
 		t.Fatalf("telemetry = %#v", got)
 	}
+	// The capture decision is rendered even when the controller exports no
+	// traces, so a runtime cannot be handed a different one.
+	if capture := got.CaptureEnvironment(); capture.Value != "false" {
+		t.Fatalf("capture environment = %#v, want false", capture)
+	}
 }
 
 func TestTelemetryConfigFromProcessDisablesInvalidSignals(t *testing.T) {
diff --git a/go/core/test/e2e/tracing_test.go b/go/core/test/e2e/tracing_test.go
index 217ac061f9..3c7473bf92 100644
--- a/go/core/test/e2e/tracing_test.go
+++ b/go/core/test/e2e/tracing_test.go
@@ -44,6 +44,7 @@ const (
 type capturedSpan struct {
 	serviceName string
 	scopeName   string
+	schemaURL   string
 	resource    *resourcepb.Resource
 	span        *tracepb.Span
 }
@@ -210,7 +211,7 @@ func (r *otlpTraceReceiver) selectSpans(traceID []byte, serviceName, scopeName,
 				}
 				if matches {
 					selected = append(selected, capturedSpan{
-						serviceName: resourceServiceName, scopeName: currentScopeName,
+						serviceName: resourceServiceName, scopeName: currentScopeName, schemaURL: scopeSpans.GetSchemaUrl(),
 						resource: resourceSpans.GetResource(), span: span,
 					})
 				}
@@ -303,11 +304,24 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 			}
 			// Wait for the Actor to suspend then assert that the completed invocation span was exported.
 			assertActorSuspended(t, fixture)
-			// The compiler owns this identity, so the assertion holds without any
+			// Invocations are selected by operation alone, the way a consumer
+			// counts them, so a second invoke_agent span in the trace or one
+			// missing an attribute fails the test rather than going unseen. The
+			// compiler owns this identity, so the assertion holds without any
 			// user-supplied resource marker on the Harness.
 			agentName := template + "-" + test.harness
-			spans := receiver.selectSpans(traceID, "", "", "invoke_agent "+agentName, map[string]string{
-				tracing.AttributeOperationName:  tracing.OperationInvokeAgent,
+			spans := receiver.selectSpans(traceID, "", "", "", map[string]string{tracing.AttributeOperationName: tracing.OperationInvokeAgent})
+			if len(spans) != 1 {
+				t.Fatalf("invoke_agent spans = %d, want exactly one before suspension: %s", len(spans), receiver.diagnostic(traceID))
+			}
+			invocation := spans[0]
+			if got, want := invocation.span.GetName(), "invoke_agent "+agentName; got != want {
+				t.Errorf("invocation span name = %q, want %q", got, want)
+			}
+			if invocation.schemaURL != tracing.SchemaURL {
+				t.Errorf("invocation schema URL = %q, want %q", invocation.schemaURL, tracing.SchemaURL)
+			}
+			for key, want := range map[string]string{
 				tracing.AttributeMethod:         "SendStreamingMessage",
 				tracing.AttributeTaskState:      string(a2atype.TaskStateCompleted),
 				tracing.AttributeRuntime:        string(test.runtime),
@@ -319,14 +333,15 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 				tracing.AttributeTaskID:         string(streamed.taskID),
 				tracing.AttributeUserID:         "e2e",
 				tracing.AttributeSegment:        tracing.SegmentInitial,
-			})
-			if len(spans) != 1 {
-				t.Fatalf("identified invocation spans = %d, want exactly one before suspension: %s", len(spans), receiver.diagnostic(traceID))
+			} {
+				if got := stringAttribute(invocation.span.GetAttributes(), key); got != want {
+					t.Errorf("invocation %s = %q, want %q", key, got, want)
+				}
 			}
 			// Capture stays off unless a user enables it, so a turn must not
 			// export its prompt or response.
 			for _, key := range []string{tracing.AttributeInputMessages, tracing.AttributeOutputMessages} {
-				if value := stringAttribute(spans[0].span.GetAttributes(), key); value != "" {
+				if value := stringAttribute(invocation.span.GetAttributes(), key); value != "" {
 					t.Errorf("%s = %q with capture disabled", key, value)
 				}
 			}
@@ -335,7 +350,7 @@ func TestE2ECompletedChatFlushesTraces(t *testing.T) {
 				tracing.AttributeRuntime:   string(test.runtime),
 				tracing.AttributeAgentName: agentName,
 			} {
-				if got := stringAttribute(spans[0].resource.GetAttributes(), key); got != want {
+				if got := stringAttribute(invocation.resource.GetAttributes(), key); got != want {
 					t.Errorf("resource %s = %q, want %q", key, got, want)
 				}
 			}
diff --git a/go/harness/claude/internal/adapter/adapter.go b/go/harness/claude/internal/adapter/adapter.go
index 558c2f99da..4358c3cf43 100644
--- a/go/harness/claude/internal/adapter/adapter.go
+++ b/go/harness/claude/internal/adapter/adapter.go
@@ -70,7 +70,7 @@ func New(ctx context.Context, input Input) (*driver.ProcessDriver, error) {
 	environment := setEnvironment(input.Environment, config.ClaudeConfigDirEnvName, claudeDir)
 	// The native runtime inherits the compiled identity through the standard
 	// resource variable, so no user-supplied marker is required.
-	environment = tracing.ResourceEnvironment(environment, cfg.RuntimeTelemetry.Identity())
+	environment = tracing.ResourceEnvironment(environment, cfg.RuntimeTelemetry.ChildResource())
 	// The image and compiler pin an exact Claude version. Prevent both automatic
 	// and manual update paths from changing that runtime after validation.
 	environment = setEnvironment(environment, config.DisableUpdatesEnvName, "1")
diff --git a/go/harness/codex/internal/adapter/adapter.go b/go/harness/codex/internal/adapter/adapter.go
index a6c8a82130..eadbe2e3a6 100644
--- a/go/harness/codex/internal/adapter/adapter.go
+++ b/go/harness/codex/internal/adapter/adapter.go
@@ -69,7 +69,7 @@ func New(ctx context.Context, input Input) (*driver.ProcessDriver, error) {
 	environment := setEnvironment(input.Environment, codexHomeEnv, codexHome)
 	// The native runtime inherits the compiled identity through the standard
 	// resource variable, so no user-supplied marker is required.
-	environment = tracing.ResourceEnvironment(environment, cfg.RuntimeTelemetry.Identity())
+	environment = tracing.ResourceEnvironment(environment, cfg.RuntimeTelemetry.ChildResource())
 	approvalServers := make(map[string]struct{})
 	for name, server := range cfg.MCPServers {
 		if server.RequireApproval {
diff --git a/go/harness/runtime/a2a/executor.go b/go/harness/runtime/a2a/executor.go
index 41f1322a86..e38ec7c0b3 100644
--- a/go/harness/runtime/a2a/executor.go
+++ b/go/harness/runtime/a2a/executor.go
@@ -64,8 +64,8 @@ type activeTask struct {
 }
 
 // parkedTask owns the PendingTurn while its A2A task is waiting for input.
-// origin is the invocation that parked it, so a later segment can record where
-// the work it continues began.
+// origin is the invocation that started the native turn, so every later
+// segment can record where the work it continues began.
 type parkedTask struct {
 	taskRef
 	pending runtime.PendingTurn
@@ -133,7 +133,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 		sink := &executionSink{reqCtx: reqCtx, yield: yield, continuation: e.continuation}
 		result := tracing.Result{}
 		endInvocation := func() {
-			invocation.SetAttributes(sink.captureAttributes()...)
+			invocation.SetAttributes(sink.captureAttributes(result)...)
 			if _, err := invocation.End(ctx, result); err != nil {
 				a2alog.Error(ctx, "failed to export A2A invocation traces", err)
 			}
@@ -143,6 +143,23 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 		// that yield no quiescent event at all, such as cancellation and an
 		// abandoned stream.
 		defer endInvocation()
+		// A panic in the runner is a defect, not an outcome. Record a fixed
+		// category before the span is exported, never the recovered value, which
+		// could carry provider content, then let the panic continue.
+		defer func() {
+			if recovered := recover(); recovered != nil {
+				result = tracing.Result{Error: "runtime_panic"}
+				endInvocation()
+				panic(recovered)
+			}
+		}()
+		// Failures that never publish a task event still export before the error
+		// leaves the process, for the same reason the quiescent paths do.
+		fail := func(category string, err error) {
+			result.Error = category
+			endInvocation()
+			yield(nil, err)
+		}
 		// Identity is recorded before validation, so a rejected request still
 		// says which conversation and task it belonged to.
 		resuming := reqCtx != nil && reqCtx.StoredTask != nil && requiresInput(reqCtx.StoredTask.Status.State)
@@ -152,8 +169,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 
 		turn, err := validateRequest(reqCtx)
 		if err != nil {
-			result.Error = "invalid_request"
-			yield(nil, err)
+			fail("invalid_request", err)
 			return
 		}
 		// Capture the current turn's prompt only. A segment that answers an
@@ -164,7 +180,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			if turn.Prompt != "" {
 				text, truncated := tracing.BoundedText(turn.Prompt, limit)
 				invocation.SetAttributes(
-					attribute.String(tracing.AttributeInputMessages, tracing.TextMessages(tracing.RoleUser, text)),
+					attribute.String(tracing.AttributeInputMessages, tracing.InputMessages(text)),
 					attribute.Bool(tracing.AttributeInputTruncated, truncated),
 				)
 			}
@@ -172,8 +188,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 
 		continuationID, _, err := e.continuation.Load()
 		if err != nil {
-			result.Error = "continuation_unavailable"
-			yield(nil, err)
+			fail("continuation_unavailable", err)
 			return
 		}
 		runCtx, cancel := context.WithCancel(ctx)
@@ -185,8 +200,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 		continued, err := e.activate(active, resuming)
 		if err != nil {
 			cancel()
-			result.Error = "actor_unavailable"
-			yield(nil, err)
+			fail("actor_unavailable", err)
 			return
 		}
 		if continued != nil {
@@ -198,6 +212,13 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 				Attributes:  []attribute.KeyValue{attribute.String(tracing.AttributeLinkRelationship, tracing.RelationshipResumeOrigin)},
 			})
 		}
+		// The native process, and the trace it emits under, belong to the
+		// segment that started the turn. A later pause keeps pointing at that
+		// origin rather than at whichever segment paused most recently.
+		origin := invocation.SpanContext()
+		if continued != nil && continued.origin.IsValid() {
+			origin = continued.origin
+		}
 		var finishOnce sync.Once
 		finishedCanceled := false
 		// Cancel publishes the canceled event as soon as done closes, so a
@@ -226,7 +247,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			parked := false
 			finishOnce.Do(func() {
 				cancel()
-				parked = e.park(active, pending, invocation.SpanContext())
+				parked = e.park(active, pending, origin)
 				if !parked {
 					_ = pending.Cancel(context.Background())
 					if e.deactivate(active) {
@@ -287,8 +308,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			if finish() {
 				return
 			}
-			result.Error = "invalid_runtime_outcome"
-			yield(nil, fmt.Errorf("runtime returned both a failure and a pending turn"))
+			fail("invalid_runtime_outcome", fmt.Errorf("runtime returned both a failure and a pending turn"))
 			return
 		}
 
@@ -296,8 +316,7 @@ func (e *Executor) Execute(ctx context.Context, reqCtx *a2asrv.ExecutorContext)
 			message, err := inputRequiredMessage(reqCtx, outcome.Pending.Request())
 			if err != nil {
 				_ = outcome.Pending.Cancel(context.Background())
-				result.Error = "invalid_input_request"
-				yield(nil, err)
+				fail("invalid_input_request", err)
 				return
 			}
 			// Transfer the live native turn into executor state before telling the
@@ -341,19 +360,37 @@ func (e *Executor) captureLimit(invocation *tracing.Invocation) int {
 	return e.telemetry.CaptureLimit()
 }
 
-// captureAttributes reports the text this segment produced. Absent attributes
-// mean capture is disabled; a message with empty text means the segment
-// produced none.
-func (s *executionSink) captureAttributes() []attribute.KeyValue {
+// captureAttributes reports the text this segment produced, with the finish
+// reason the conventions require on an output message. Absent attributes mean
+// capture is disabled; a message with empty text means the segment produced
+// none.
+func (s *executionSink) captureAttributes(result tracing.Result) []attribute.KeyValue {
 	if s.capture == nil {
 		return nil
 	}
 	return []attribute.KeyValue{
-		attribute.String(tracing.AttributeOutputMessages, tracing.TextMessages(tracing.RoleAssistant, s.capture.Text())),
+		attribute.String(tracing.AttributeOutputMessages, tracing.OutputMessages(s.capture.Text(), finishReason(result))),
 		attribute.Bool(tracing.AttributeOutputTruncated, s.capture.Truncated()),
 	}
 }
 
+// finishReason maps a segment outcome onto the GenAI conventions' finish
+// reason. Both harnesses park only at a tool call that needs a decision or an
+// answer, so a segment waiting for input finished at a tool call. A
+// disposition the conventions do not enumerate is recorded under its own name.
+func finishReason(result tracing.Result) string {
+	switch {
+	case result.Error != "":
+		return tracing.FinishReasonError
+	case result.Disposition != "":
+		return result.Disposition
+	case result.TaskState == string(a2atype.TaskStateInputRequired):
+		return tracing.FinishReasonToolCall
+	default:
+		return tracing.FinishReasonStop
+	}
+}
+
 func (s *executionSink) SessionStarted(event runtime.SessionStarted) error {
 	if event.ContinuationID == "" {
 		return fmt.Errorf("runtime continuation ID is required")
diff --git a/go/harness/runtime/a2a/tracing_test.go b/go/harness/runtime/a2a/tracing_test.go
index 197826b3bd..0caf31b61c 100644
--- a/go/harness/runtime/a2a/tracing_test.go
+++ b/go/harness/runtime/a2a/tracing_test.go
@@ -208,13 +208,13 @@ func TestCaptureRecordsBoundedTurnContent(t *testing.T) {
 	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-capture", strings.Repeat("p", 32))))
 
 	span := recorder.spans(t, 1)[0]
-	if got, want := stringAttribute(t, span, tracing.AttributeInputMessages), tracing.TextMessages(tracing.RoleUser, strings.Repeat("p", 10)); got != want {
+	if got, want := stringAttribute(t, span, tracing.AttributeInputMessages), tracing.InputMessages(strings.Repeat("p", 10)); got != want {
 		t.Errorf("%s = %s, want the first ten bytes of the prompt as %s", tracing.AttributeInputMessages, got, want)
 	}
 	if !boolAttribute(t, span, tracing.AttributeInputTruncated) {
 		t.Error("an oversized prompt did not report truncation")
 	}
-	if got, want := stringAttribute(t, span, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, "日日日"); got != want {
+	if got, want := stringAttribute(t, span, tracing.AttributeOutputMessages), tracing.OutputMessages("日日日", tracing.FinishReasonStop); got != want {
 		t.Errorf("%s = %s, want three whole characters as %s", tracing.AttributeOutputMessages, got, want)
 	}
 	if !boolAttribute(t, span, tracing.AttributeOutputTruncated) {
@@ -236,13 +236,13 @@ func TestCaptureRecordsEmptyOutput(t *testing.T) {
 	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-empty", "hello")))
 
 	span := recorder.spans(t, 1)[0]
-	if got, want := stringAttribute(t, span, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, ""); got != want {
+	if got, want := stringAttribute(t, span, tracing.AttributeOutputMessages), tracing.OutputMessages("", tracing.FinishReasonStop); got != want {
 		t.Errorf("%s = %s, want an empty message %s", tracing.AttributeOutputMessages, got, want)
 	}
 	if boolAttribute(t, span, tracing.AttributeOutputTruncated) {
 		t.Error("an empty capture reported truncation")
 	}
-	if got, want := stringAttribute(t, span, tracing.AttributeInputMessages), tracing.TextMessages(tracing.RoleUser, "hello"); got != want {
+	if got, want := stringAttribute(t, span, tracing.AttributeInputMessages), tracing.InputMessages("hello"); got != want {
 		t.Errorf("%s = %s, want the prompt as %s", tracing.AttributeInputMessages, got, want)
 	}
 }
@@ -264,7 +264,7 @@ func TestCaptureRecordsOutputOfAFailedTurn(t *testing.T) {
 	collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-capture-failure", "hello")))
 
 	span := recorder.spans(t, 1)[0]
-	if got, want := stringAttribute(t, span, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, "partial answer"); got != want {
+	if got, want := stringAttribute(t, span, tracing.AttributeOutputMessages), tracing.OutputMessages("partial answer", tracing.FinishReasonError); got != want {
 		t.Errorf("%s = %s, want the text produced before the failure as %s", tracing.AttributeOutputMessages, got, want)
 	}
 	if got := stringAttribute(t, span, tracing.AttributeErrorType); got != "runtime_failure" {
@@ -340,10 +340,10 @@ func TestResumeLinksToTheOriginatingSegment(t *testing.T) {
 	if got := stringAttribute(t, resumed, tracing.AttributeTaskID); got != string(first.TaskID) {
 		t.Errorf("resumed %s = %q, want the same task", tracing.AttributeTaskID, got)
 	}
-	if got, want := stringAttribute(t, origin, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, "before"); got != want {
+	if got, want := stringAttribute(t, origin, tracing.AttributeOutputMessages), tracing.OutputMessages("before", tracing.FinishReasonToolCall); got != want {
 		t.Errorf("origin %s = %s, want only the text that segment produced", tracing.AttributeOutputMessages, got)
 	}
-	if got, want := stringAttribute(t, resumed, tracing.AttributeOutputMessages), tracing.TextMessages(tracing.RoleAssistant, "after"); got != want {
+	if got, want := stringAttribute(t, resumed, tracing.AttributeOutputMessages), tracing.OutputMessages("after", tracing.FinishReasonStop); got != want {
 		t.Errorf("resumed %s = %s, want only the text that segment produced", tracing.AttributeOutputMessages, got)
 	}
 	// An approval decision is structured outcome metadata, not prompt text, so
@@ -413,3 +413,168 @@ func TestCancellationExportsBeforeYieldingItsEvent(t *testing.T) {
 	}
 	recorder.spans(t, 1)
 }
+
+func TestFinishReason(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		result tracing.Result
+		want   string
+	}{
+		{name: "completed", result: tracing.Result{TaskState: string(a2atype.TaskStateCompleted)}, want: tracing.FinishReasonStop},
+		{name: "parked for input", result: tracing.Result{TaskState: string(a2atype.TaskStateInputRequired)}, want: tracing.FinishReasonToolCall},
+		{name: "failed", result: tracing.Result{TaskState: string(a2atype.TaskStateFailed), Error: "runtime_failure"}, want: tracing.FinishReasonError},
+		{name: "rejected", result: tracing.Result{Error: "invalid_request"}, want: tracing.FinishReasonError},
+		{name: "canceled", result: tracing.Result{TaskState: string(a2atype.TaskStateCanceled), Disposition: tracing.DispositionCanceled}, want: tracing.DispositionCanceled},
+		{name: "abandoned", result: tracing.Result{Disposition: tracing.DispositionAbandoned}, want: tracing.DispositionAbandoned},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if got := finishReason(test.result); got != test.want {
+				t.Fatalf("finishReason() = %q, want %q", got, test.want)
+			}
+		})
+	}
+}
+
+// A request rejected before execution yields a JSON-RPC error rather than a
+// task event. The segment is exported before that error leaves, as it is for
+// the quiescent paths, and still names the task it belonged to.
+func TestValidationFailureExportsBeforeYieldingItsError(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	executor, err := New(fakeRunner{run: func(context.Context, runtime.Turn, runtime.EventSink) (runtime.Outcome, error) {
+		t.Fatal("the runner ran for an invalid request")
+		return runtime.Outcome{}, nil
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	request := requestContext("task-invalid", "hello")
+	request.Message.Role = a2atype.MessageRoleAgent
+	errs := 0
+	for event, err := range executor.Execute(recorder.segment(t.Context()), request) {
+		if err == nil {
+			t.Fatalf("invalid request produced event %#v", event)
+		}
+		errs++
+		if exported := len(recorder.exporter.GetSpans()); exported != 1 {
+			t.Fatalf("exported %d spans when the error was yielded, want the segment already exported", exported)
+		}
+	}
+	if errs != 1 {
+		t.Fatalf("invalid request yielded %d errors, want one", errs)
+	}
+	span := recorder.spans(t, 1)[0]
+	if got := stringAttribute(t, span, tracing.AttributeErrorType); got != "invalid_request" {
+		t.Errorf("%s = %q, want %q", tracing.AttributeErrorType, got, "invalid_request")
+	}
+	if got := stringAttribute(t, span, tracing.AttributeTaskID); got != "task-invalid" {
+		t.Errorf("%s = %q, want the rejected task", tracing.AttributeTaskID, got)
+	}
+}
+
+// A panic in the runner is a defect. The segment still exports with a fixed
+// category, never the panic value, and the panic still propagates.
+func TestInvocationRecordsARunnerPanic(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	executor, err := New(fakeRunner{run: func(context.Context, runtime.Turn, runtime.EventSink) (runtime.Outcome, error) {
+		panic("provider said sk-secret")
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	func() {
+		defer func() {
+			if recover() == nil {
+				t.Fatal("the runner panic did not propagate")
+			}
+		}()
+		collect(executor.Execute(recorder.segment(t.Context()), requestContext("task-panic", "hello")))
+	}()
+
+	span := recorder.spans(t, 1)[0]
+	if got := stringAttribute(t, span, tracing.AttributeErrorType); got != "runtime_panic" {
+		t.Errorf("%s = %q, want %q", tracing.AttributeErrorType, got, "runtime_panic")
+	}
+	if span.Status.Code != codes.Error {
+		t.Errorf("status = %v, want an error status", span.Status.Code)
+	}
+	if strings.Contains(span.Status.Description, "sk-secret") {
+		t.Errorf("status description leaked the panic value: %q", span.Status.Description)
+	}
+}
+
+// approvalDecision builds the request that answers the approval a segment
+// parked on.
+func approvalDecision(t *testing.T, first *a2asrv.ExecutorContext, parked *a2atype.TaskStatusUpdateEvent, id string) *a2asrv.ExecutorContext {
+	t.Helper()
+	decision := a2atype.NewMessage(a2atype.MessageRoleUser)
+	decision.TaskID, decision.ContextID = first.TaskID, first.ContextID
+	if err := apia2a.AttachHITL(decision, apia2a.ToolApprovalResponse{
+		Type: apia2a.HITLTypeToolApprovalResponse, Approvals: []apia2a.ToolApproval{{ID: id, Approved: true}},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	return &a2asrv.ExecutorContext{
+		TaskID: first.TaskID, ContextID: first.ContextID, Message: decision,
+		StoredTask: &a2atype.Task{ID: first.TaskID, ContextID: first.ContextID, Status: a2atype.TaskStatus{
+			State: a2atype.TaskStateInputRequired, Message: parked.Status.Message,
+		}},
+	}
+}
+
+func parkedStatus(t *testing.T, events []a2atype.Event, errs []error) *a2atype.TaskStatusUpdateEvent {
+	t.Helper()
+	if len(errs) != 0 || len(events) == 0 {
+		t.Fatalf("segment events/errors = %#v/%v", events, errs)
+	}
+	update, ok := events[len(events)-1].(*a2atype.TaskStatusUpdateEvent)
+	if !ok || update.Status.State != a2atype.TaskStateInputRequired {
+		t.Fatalf("last event = %#v, want input required", events[len(events)-1])
+	}
+	return update
+}
+
+// A turn that pauses twice keeps one native process, so both resumed segments
+// link to the segment that started it rather than forming a chain.
+func TestResumedSegmentsLinkToTheNativeOriginAcrossPauses(t *testing.T) {
+	recorder := newTraceRecorder(t)
+	second := &fakePendingTurn{
+		request: &runtime.ApprovalRequest{ID: "2", CallID: "call-2", Name: "tools.write", Hint: "Allow tools.write?"},
+		resume: func(context.Context, runtime.InputResponse, runtime.EventSink) (runtime.Outcome, error) {
+			return runtime.Outcome{}, nil
+		},
+	}
+	first := &fakePendingTurn{
+		request: &runtime.ApprovalRequest{ID: "1", CallID: "call-1", Name: "tools.read", Hint: "Allow tools.read?"},
+		resume: func(context.Context, runtime.InputResponse, runtime.EventSink) (runtime.Outcome, error) {
+			return runtime.Outcome{Pending: second}, nil
+		},
+	}
+	executor, err := New(fakeRunner{run: func(context.Context, runtime.Turn, runtime.EventSink) (runtime.Outcome, error) {
+		return runtime.Outcome{Pending: first}, nil
+	}}, &fakeContinuation{}, tracing.RuntimeTelemetry{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	request := requestContext("task-two-pauses", "read then write")
+	events, errs := collect(executor.Execute(recorder.segment(t.Context()), request))
+	parkedOnce := parkedStatus(t, events, errs)
+	events, errs = collect(executor.Execute(recorder.segment(t.Context()), approvalDecision(t, request, parkedOnce, "1")))
+	parkedTwice := parkedStatus(t, events, errs)
+	if _, errs := collect(executor.Execute(recorder.segment(t.Context()), approvalDecision(t, request, parkedTwice, "2"))); len(errs) != 0 {
+		t.Fatalf("final segment errors = %v", errs)
+	}
+
+	spans := recorder.spans(t, 3)
+	origin := spans[0].SpanContext.SpanID()
+	for index, resumed := range spans[1:] {
+		if got := stringAttribute(t, resumed, tracing.AttributeSegment); got != tracing.SegmentResumed {
+			t.Errorf("segment %d %s = %q, want %q", index+2, tracing.AttributeSegment, got, tracing.SegmentResumed)
+		}
+		if len(resumed.Links) != 1 || resumed.Links[0].SpanContext.SpanID() != origin {
+			t.Errorf("segment %d links = %#v, want one link to the originating segment", index+2, resumed.Links)
+		}
+	}
+}
diff --git a/go/pkg/tracing/capture.go b/go/pkg/tracing/capture.go
index b8e17b8b7b..16892adb9c 100644
--- a/go/pkg/tracing/capture.go
+++ b/go/pkg/tracing/capture.go
@@ -12,27 +12,56 @@ const (
 	RoleAssistant = "assistant"
 )
 
+// Finish reasons the GenAI conventions define for an output message. An
+// outcome the enumeration does not describe is recorded under its own name,
+// which the conventions permit.
+const (
+	FinishReasonStop     = "stop"
+	FinishReasonToolCall = "tool_call"
+	FinishReasonError    = "error"
+)
+
 type messagePart struct {
 	Type    string `json:"type"`
 	Content string `json:"content"`
 }
 
-type message struct {
+type inputMessage struct {
 	Role  string        `json:"role"`
 	Parts []messagePart `json:"parts"`
 }
 
-// TextMessages renders one text message as the JSON document the GenAI
-// conventions define for gen_ai.input.messages and gen_ai.output.messages: an
-// array of messages, each with a role and text parts. The capture budget
-// bounds the text; the few dozen bytes of structure around it are not
-// counted, so a consumer that parses the document gets the whole bounded text.
-func TextMessages(role, text string) string {
-	// A message with a string role and a text part always marshals.
-	encoded, _ := json.Marshal([]message{{Role: role, Parts: []messagePart{{Type: "text", Content: text}}}})
+// outputMessage carries the finish reason the conventions require on every
+// output message, so one cannot be rendered without it.
+type outputMessage struct {
+	Role         string        `json:"role"`
+	Parts        []messagePart `json:"parts"`
+	FinishReason string        `json:"finish_reason"`
+}
+
+// InputMessages renders one user text message as the JSON document the GenAI
+// conventions define for gen_ai.input.messages: an array of messages, each
+// with a role and parts. The capture budget bounds the text; the few dozen
+// bytes of structure around it are not counted, so a consumer that parses the
+// document gets the whole bounded text.
+func InputMessages(text string) string {
+	// A message of strings always marshals.
+	encoded, _ := json.Marshal([]inputMessage{{Role: RoleUser, Parts: textParts(text)}})
 	return string(encoded)
 }
 
+// OutputMessages renders one assistant text message as the JSON document the
+// conventions define for gen_ai.output.messages, with the reason the segment
+// finished. The same budget rule as InputMessages applies.
+func OutputMessages(text, finishReason string) string {
+	encoded, _ := json.Marshal([]outputMessage{{Role: RoleAssistant, Parts: textParts(text), FinishReason: finishReason}})
+	return string(encoded)
+}
+
+func textParts(text string) []messagePart {
+	return []messagePart{{Type: "text", Content: text}}
+}
+
 // TextCapture accumulates the beginning of a text stream up to a byte limit.
 // Once the limit is reached it records that fact and discards further input
 // without retaining or copying it, so the memory one capture can hold stays
diff --git a/go/pkg/tracing/capture_test.go b/go/pkg/tracing/capture_test.go
index c3727da335..d960926591 100644
--- a/go/pkg/tracing/capture_test.go
+++ b/go/pkg/tracing/capture_test.go
@@ -110,15 +110,24 @@ func TestBoundedTextDoesNotRetainTheInput(t *testing.T) {
 	}
 }
 
-func TestTextMessagesFollowsTheConventionsShape(t *testing.T) {
-	got := TextMessages(RoleUser, `say "hi"`)
+func TestInputMessagesFollowsTheConventionsShape(t *testing.T) {
+	got := InputMessages(`say "hi"`)
 	want := `[{"role":"user","parts":[{"type":"text","content":"say \"hi\""}]}]`
 	if got != want {
-		t.Fatalf("TextMessages() = %s, want %s", got, want)
+		t.Fatalf("InputMessages() = %s, want %s", got, want)
 	}
-	// Capture that produced no text still yields a message, so a consumer can
-	// tell an empty response from capture that is off.
-	if got := TextMessages(RoleAssistant, ""); got != `[{"role":"assistant","parts":[{"type":"text","content":""}]}]` {
-		t.Fatalf("TextMessages() = %s", got)
+}
+
+// The conventions require a finish reason on every output message. Capture
+// that produced no text still yields a message, so a consumer can tell an
+// empty response from capture that is off.
+func TestOutputMessagesFollowsTheConventionsShape(t *testing.T) {
+	got := OutputMessages("done", FinishReasonStop)
+	want := `[{"role":"assistant","parts":[{"type":"text","content":"done"}],"finish_reason":"stop"}]`
+	if got != want {
+		t.Fatalf("OutputMessages() = %s, want %s", got, want)
+	}
+	if got := OutputMessages("", FinishReasonError); got != `[{"role":"assistant","parts":[{"type":"text","content":""}],"finish_reason":"error"}]` {
+		t.Fatalf("OutputMessages() = %s", got)
 	}
 }
diff --git a/go/pkg/tracing/runtime.go b/go/pkg/tracing/runtime.go
index 9fed254315..dcc45514f9 100644
--- a/go/pkg/tracing/runtime.go
+++ b/go/pkg/tracing/runtime.go
@@ -120,9 +120,9 @@ const (
 
 // NativeHarness reports whether the runtime wraps a native coding agent whose
 // model and tool spans carry no agent invocation of their own. The wrapper is
-// the invoke_agent span for such a runtime. The ADK emits exactly one
-// invoke_agent per turn itself, so its wrapper stays a transport span rather
-// than a second invocation a consumer would count twice.
+// the invoke_agent span for such a runtime. The ADK emits invoke_agent spans
+// itself, for the root agent and any sub-agent it transfers to, so its wrapper
+// stays a transport span rather than adding an invocation of its own.
 func (r Runtime) NativeHarness() bool {
 	return r == RuntimeClaude || r == RuntimeCodex
 }
@@ -133,6 +133,15 @@ func (r Runtime) NativeHarness() bool {
 // the ones that carry the decision in their compiled configuration agree.
 const CaptureContentEnvironmentVariable = "OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT"
 
+// Values the controller renders for CaptureContentEnvironmentVariable. The ADK
+// runtimes read the variable as a mode and treat a plain true as log records
+// only, so the span form is spelled out; false is what every runtime,
+// including kagent's own ADK payload capture, reads as off.
+const (
+	CaptureContentSpanOnly = "SPAN_ONLY"
+	CaptureContentDisabled = "false"
+)
+
 // DefaultCaptureBytes bounds captured input and output when a configuration
 // enables capture without choosing a limit.
 const DefaultCaptureBytes = 16 << 10
@@ -219,6 +228,18 @@ func (t RuntimeTelemetry) Identity() []attribute.KeyValue {
 	return attributes
 }
 
+// ChildResource returns the resource attributes a native child process shares
+// with the wrapper that supervises it: the identity plus the compiled
+// namespace, so both producers group under one service.namespace. The child
+// keeps its own service.name.
+func (t RuntimeTelemetry) ChildResource() []attribute.KeyValue {
+	attributes := t.Identity()
+	if t.AgentNamespace != "" {
+		attributes = append(attributes, semconv.ServiceNamespaceKey.String(t.AgentNamespace))
+	}
+	return attributes
+}
+
 // CaptureLimit is the effective byte budget for one captured input or output.
 // It is zero when capture is disabled.
 func (t RuntimeTelemetry) CaptureLimit() int {
diff --git a/go/pkg/tracing/runtime_test.go b/go/pkg/tracing/runtime_test.go
index b4cf155e63..d603d80691 100644
--- a/go/pkg/tracing/runtime_test.go
+++ b/go/pkg/tracing/runtime_test.go
@@ -90,6 +90,17 @@ func TestIdentityOmitsUnsetFields(t *testing.T) {
 	}
 }
 
+func TestChildResourceAddsTheCompiledNamespace(t *testing.T) {
+	telemetry := RuntimeTelemetry{Runtime: RuntimeCodex, AgentName: "reporter-codex", AgentNamespace: "team"}
+	want := append(telemetry.Identity(), attribute.String("service.namespace", "team"))
+	if got := telemetry.ChildResource(); !slices.Equal(got, want) {
+		t.Fatalf("ChildResource() = %v, want %v", got, want)
+	}
+	if got := (RuntimeTelemetry{}).ChildResource(); len(got) != 0 {
+		t.Fatalf("ChildResource() = %v, want none without an identity", got)
+	}
+}
+
 func TestRequestIdentity(t *testing.T) {
 	got := RequestIdentity("ctx-1", "task-1", false)
 	want := []attribute.KeyValue{

From a98bd121cc490402a72577ac018b190cbcf7a2be Mon Sep 17 00:00:00 2001
From: David Haifley <david.haifley@solo.io>
Date: Tue, 22 Sep 2026 10:33:53 -0400
Subject: [PATCH 4/4] feat(tracing): remove config from claude compiler

Signed-off-by: David Haifley <david.haifley@solo.io>
---
 .../internal/translator/claude/compiler.go    | 11 +++-------
 .../translator/claude/compiler_test.go        | 20 +++++++++++++++----
 go/core/internal/translator/codex/compiler.go |  7 ++-----
 .../translator/codex/compiler_test.go         | 18 +++++++++++++++--
 go/core/internal/translator/revision_test.go  | 16 +++++++++++++++
 5 files changed, 53 insertions(+), 19 deletions(-)

diff --git a/go/core/internal/translator/claude/compiler.go b/go/core/internal/translator/claude/compiler.go
index 9019d68e62..64c13805e6 100644
--- a/go/core/internal/translator/claude/compiler.go
+++ b/go/core/internal/translator/claude/compiler.go
@@ -142,7 +142,7 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	if err != nil {
 		return nil, fmt.Errorf("convert Claude agent card: %w", err)
 	}
-	provenance, err := c.buildProvenance(ctx, input, environment, configJSON)
+	provenance, err := c.buildProvenance(ctx, input, environment)
 	if err != nil {
 		return nil, fmt.Errorf("build Claude revision provenance: %w", err)
 	}
@@ -394,14 +394,9 @@ type provenanceEntry struct {
 	Hash       string    `json:"hash"`
 }
 
-func (c *Compiler) buildProvenance(ctx context.Context, input *v2translator.HarnessInput, environment []corev1.EnvVar, configJSON []byte) ([]byte, error) {
+func (c *Compiler) buildProvenance(ctx context.Context, input *v2translator.HarnessInput, environment []corev1.EnvVar) ([]byte, error) {
 	harness := input.Harness
-	entries := []provenanceEntry{
-		objectProvenance(v1alpha3.GroupVersion.String(), "Harness", harness.Name, harness.UID, harness.Generation, harness.Spec),
-		// The compiled configuration carries settings that are not in any watched
-		// object, such as telemetry, so a change to one produces a new revision.
-		objectProvenance("kagent.internal/v1", "GeneratedInput", "config.json", "", 0, json.RawMessage(configJSON)),
-	}
+	entries := []provenanceEntry{objectProvenance(v1alpha3.GroupVersion.String(), "Harness", harness.Name, harness.UID, harness.Generation, harness.Spec)}
 	configMaps := map[string]struct{}{}
 	objects := map[string]struct{}{}
 	addObject := func(kind, name string, uid types.UID, generation int64, content any) {
diff --git a/go/core/internal/translator/claude/compiler_test.go b/go/core/internal/translator/claude/compiler_test.go
index e08e2296f9..2669c8b17b 100644
--- a/go/core/internal/translator/claude/compiler_test.go
+++ b/go/core/internal/translator/claude/compiler_test.go
@@ -670,10 +670,22 @@ func TestCompileRuntimeTelemetry(t *testing.T) {
 	if !capturedConfig.RuntimeTelemetry.CaptureContent || capturedConfig.RuntimeTelemetry.CaptureLimit() != 4096 {
 		t.Fatalf("captured runtime telemetry = %#v", capturedConfig.RuntimeTelemetry)
 	}
-	// A telemetry change lives only in the configuration, so provenance must
-	// cover it or the runtime would keep its previous revision.
-	if bytes.Equal(revision.Provenance, captured.Provenance) {
-		t.Fatal("changing the capture policy did not change revision provenance")
+	// A telemetry change lives only in the compiled configuration, which the
+	// revision digest covers. Provenance records Kubernetes inputs, none of
+	// which changed.
+	if !bytes.Equal(revision.Provenance, captured.Provenance) {
+		t.Fatal("changing the capture policy changed revision provenance")
+	}
+	before, err := revision.Digest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	after, err := captured.Digest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if before == after {
+		t.Fatal("changing the capture policy did not change the revision digest")
 	}
 }
 
diff --git a/go/core/internal/translator/codex/compiler.go b/go/core/internal/translator/codex/compiler.go
index 2069d8e4e2..21f1c79225 100644
--- a/go/core/internal/translator/codex/compiler.go
+++ b/go/core/internal/translator/codex/compiler.go
@@ -132,7 +132,7 @@ func (c *Compiler) Compile(ctx context.Context, input *v2translator.HarnessInput
 	if err != nil {
 		return nil, fmt.Errorf("convert Codex agent card: %w", err)
 	}
-	provenance, err := c.buildProvenance(ctx, input, environment, configJSON)
+	provenance, err := c.buildProvenance(ctx, input, environment)
 	if err != nil {
 		return nil, fmt.Errorf("build Codex revision provenance: %w", err)
 	}
@@ -304,11 +304,8 @@ type provenanceEntry struct {
 	Hash       string    `json:"hash"`
 }
 
-func (c *Compiler) buildProvenance(ctx context.Context, input *v2translator.HarnessInput, environment []corev1.EnvVar, configJSON []byte) ([]byte, error) {
+func (c *Compiler) buildProvenance(ctx context.Context, input *v2translator.HarnessInput, environment []corev1.EnvVar) ([]byte, error) {
 	entries := []provenanceEntry{objectProvenance(v1alpha3.GroupVersion.String(), "Harness", input.Harness.Name, input.Harness.UID, input.Harness.Generation, input.Harness.Spec)}
-	entries = append(entries,
-		objectProvenance("kagent.internal/v1", "GeneratedInput", "config.json", "", 0, json.RawMessage(configJSON)),
-	)
 	seenObjects := map[string]struct{}{}
 	configMaps := map[string]struct{}{}
 	var addAgent func(*v2translator.AgentInput)
diff --git a/go/core/internal/translator/codex/compiler_test.go b/go/core/internal/translator/codex/compiler_test.go
index 4c4728f293..5cdf5e3a10 100644
--- a/go/core/internal/translator/codex/compiler_test.go
+++ b/go/core/internal/translator/codex/compiler_test.go
@@ -367,7 +367,21 @@ func TestCompileRuntimeTelemetry(t *testing.T) {
 	if capturedConfig.Telemetry == nil || !capturedConfig.Telemetry.CaptureContent {
 		t.Fatalf("native telemetry = %#v", capturedConfig.Telemetry)
 	}
-	if bytes.Equal(revision.Provenance, captured.Provenance) {
-		t.Fatal("changing the capture policy did not change revision provenance")
+	// A telemetry change lives only in the compiled configuration, which the
+	// revision digest covers. Provenance records Kubernetes inputs, none of
+	// which changed.
+	if !bytes.Equal(revision.Provenance, captured.Provenance) {
+		t.Fatal("changing the capture policy changed revision provenance")
+	}
+	before, err := revision.Digest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	after, err := captured.Digest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if before == after {
+		t.Fatal("changing the capture policy did not change the revision digest")
 	}
 }
diff --git a/go/core/internal/translator/revision_test.go b/go/core/internal/translator/revision_test.go
index 76d6b335a2..9865759b44 100644
--- a/go/core/internal/translator/revision_test.go
+++ b/go/core/internal/translator/revision_test.go
@@ -29,6 +29,22 @@ func TestRevisionDigestIncludesProvenance(t *testing.T) {
 	}
 }
 
+func TestRevisionDigestIncludesConfig(t *testing.T) {
+	revision := &Revision{Namespace: "agents", AgentTemplateName: "helper", HarnessName: "claude", ConfigJSON: []byte(`{"version":5,"runtime_telemetry":{"capture_content":false}}`)}
+	first, err := revision.Digest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	revision.ConfigJSON = []byte(`{"version":5,"runtime_telemetry":{"capture_content":true}}`)
+	second, err := revision.Digest()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first == second {
+		t.Fatal("compiled configuration change did not change runtime revision")
+	}
+}
+
 func TestCompilationWarningsDoNotAffectRevisionDigest(t *testing.T) {
 	compilation := &CompileResult{Revision: Revision{Namespace: "agents", AgentTemplateName: "helper", HarnessName: "claude"}}
 	first, err := compilation.Digest()