feat(observability): instrument identity, authorization, MCP, ACP/A2A, and provider access

[robinbraemer]

Outcome

Trace workload identity, authorization, Agentgateway enforcement, provider credential delivery, MCP/HTTP operations, ACP harness control, A2A delivery, and upstream outcomes through privacy-safe correlated operations.

Scope

• Propagate W3C trace context through Mate, AgentOS authorizer, TokenReview, OpenFGA, agentgateway, provider adapter, upstream, A2A caller/target adapter, and supported ACP client/adapter boundaries.
• Record bounded allow/deny reason, policy/model version, route class, capability class, protocol operation class, dependency status, and latency.
• Correlate canonical Mate, Assignment, workload-plan, native-session, ACP-session, and A2A-operation IDs only in protected spans/logs, never metric labels.
• Instrument MCP discovery/invocation and A2A discover/invoke/stream/cancel/artifact lifecycle without tool arguments, results, prompts, briefs, Inbox bodies, transcript chunks, or artifact content.
• Instrument ACP session create/load/prompt/update/permission/cancel and adapter failure without plan text, tool payloads, terminal output, file bodies, or reasoning.
• Preserve native gateway/harness spans where safe while removing unsafe/default attributes.
• Keep protocol telemetry diagnostic: it never proves Inbox receipt, Assignment completion, authorization, or native-session state.

Acceptance criteria

• One trace distinguishes identity, TokenReview, policy, credential, gateway, MCP/HTTP, ACP adapter/harness, A2A caller/target, and provider failures.
• Revocation, profile reload, A2A fallback, and ACP adapter-recovery latency can be measured without polling or exporting content.
• Denied requests never touch a credential adapter, A2A target, MCP server, or upstream provider.
• Prompts, briefs, Inbox bodies, transcripts, plans, terminal/file/tool payloads, artifacts, headers, tokens, and provider resource IDs fail the export allowlist.
• Protocol IDs remain protected trace/log attributes and never become metric dimensions.
• Tracing loss cannot change authorization, protocol delivery, harness control, provider calls, or fallback behavior.

Dependencies

Coordinate with #122, especially #126, #128, #125, and #130.

References

• https://agentgateway.dev/docs/standalone/latest/reference/observability/traces/
• https://agentgateway.dev/docs/standalone/latest/reference/observability/metrics/
• https://agentclientprotocol.com/protocol/v1/overview
• https://agentgateway.dev/docs/kubernetes/main/agent/a2a/

Design record

docs/superpowers/specs/2026-07-31-resilient-delegation-access-effect-design.md

[0xbrainkid]

This is a strong observability boundary, especially the part that keeps protocol telemetry diagnostic instead of treating it as proof of completion or authorization.

One split that may help the design stay portable across MCP, ACP, and A2A: keep traces as the correlated operational timeline, then link out to decision receipts only at the points where something authoritative happened.

Useful receipt join points might be:

• workload / agent identity or digest
• delegated principal, if any
• requested capability class
• policy/model version
• allow / deny / approval_required outcome
• issued_at / expires_at
• trace/span join handle, without prompt/tool payload content

That keeps tracing loss non-authoritative, as your acceptance criteria says, while still giving downstream auditors a stable way to answer "what decision allowed this step?" without exporting prompts, tool args, artifacts, or provider IDs as dimensions.

This is also the same line we have been taking with AgentFolio/SATP in public: AgentFolio for agent/profile verification, SATP as a portable receipt layer for cross-runtime trust decisions. Status guardrail: AgentFolio is open beta and SATP is RC-S6/building-in-public, so I would treat this as a compatibility shape rather than a claim that a final standard exists.