test(observability): prove privacy, cardinality, trace continuity, and pipeline failure behavior

[robinbraemer]

Outcome

Prove the Fleet observability contract preserves privacy, bounded cardinality, trace continuity, and fail-open behavior across restarts and dependency failures.

Scope

• Seed representative prompts, briefs, Inbox bodies, memory, transcript/plan/terminal/file/tool payloads, A2A artifacts, credentials, headers, provider identities, repository names, and arbitrary errors, then assert none reach an OTLP sink or diagnostic archive.
• Exercise direct/Gateway, HTTP/MCP, ACP/A2A, allow/deny, budget, compaction, memory, workload-plan, topology, protocol fallback, and recovery traces.
• Restart the Collector with queued data, exhaust queues/disk bounds, break exporters, corrupt context headers, and drop spans.
• Assert span relationships and bounded metric label sets.

Acceptance criteria

• Forbidden content is rejected at instrumentation and Collector layers.
• High-cardinality workload, native-session, ACP-session, A2A operation, Agent, Assignment, Pod, and provider IDs never appear in metrics.
• Expected trace parents/links survive supported cross-process and protocol paths; malformed context degrades safely.
• ACP/A2A trace gaps cannot be interpreted as session success, delivery receipt, or Assignment completion.
• Queue/export/archive failure cannot block inference, memory, authorization decisions, protocol fallback, harness recovery, or reconciliation.
• Reproducible disposable-Fleet evidence gates release promotion.

Dependencies

Coordinate with #114, #119, #121, #122, and #130.

Design record

docs/superpowers/specs/2026-07-31-resilient-delegation-access-effect-design.md