[github-actions]

kagent-dev/kagent#3552 — feat(telemetry): record the trusted user as user.id

Docs versions: main

No code-path rule covers 5 touched file(s). The planner could route these only by identifier search, so the candidate pages may miss what they changed, including in the other mode:

• python/packages/kagent-core/src/kagent/core/a2a/_telemetry.py
• telemetry/conformance/live-check.toml
• telemetry/policies/kagent.rego
• telemetry/registry/signals.yaml
• telemetry/resolved.yaml

What changes for users: The runtimes now record the gateway-forwarded x-user-id value as user.id, not enduser.id, on the request span and its descendant spans. Users with dashboards, queries, or access rules that read enduser.id must update them to read user.id.

What the docs now say: The Tracing page's correlation attributes table already used user.id; the row now also tells readers who carried telemetry rules forward from earlier releases to update dashboards, queries, and access rules from enduser.id to user.id.

How kagent-3552 was drafted

Plan, and what changed it

• Planned: Update the Tracing page to document that trusted user identity now uses user.id.
• Learned: docs-site/content/kagent/main/observability/tracing.md already used user.id, but did not state the migration action that the PR body calls breaking; docs-site/content/kagent/main/agents/agent-harness.md had no enduser.id or user.id hits.
• Did: Added the migration action to the user.id row on the Tracing page.

Why a documentation change is necessary

The pull request changes the span attribute for the trusted gateway user from enduser.id to user.id in the Go ADK runtime, the Python runtime, telemetry policy, registry, and live-check rule. The PR body calls the rename a breaking change for queries, dashboards, and access rules. The Tracing page owns the user-facing list of correlation attributes, so the page needs to tell readers what to query now and what to change from earlier releases.

How to verify this change

1. Follow the Tracing guide to enable tracing, create a new Session, and send a request from a caller whose trusted user reaches the runtime as x-user-id.
2. In the tracing backend, inspect the request span and its descendant spans. The trusted caller appears as user.id=<caller>, and enduser.id is absent.
3. For a claude runtime, inspect the kagent invocation span for the trusted caller. Native Claude Code spans can set their own user.id, which is a hash of the Claude account.

Proposed release note

No proposed-release-note.md: markers.notes_placeable is false.

Suggested note: The runtimes now record the gateway-forwarded user from x-user-id as user.id instead of enduser.id on the request span and the spans beneath it. Update dashboards, queries, and access rules that read enduser.id to read user.id.

Files in this pull request

• docs-site/content/kagent/main/observability/tracing.md

How the pages were chosen (triage report)

Draft a documentation change

kagent-dev/kagent#3552 — feat(telemetry): record the trusted user as user.id

• Product: kagent (upstream) → kagent-dev/website
• Docs version: main
• Summary (read from the body): The runtimes now record the gateway-forwarded user (x-user-id) as user.id instead of enduser.id, on the request span and the spans beneath it. Go ADK and the Python runtimes change together, and the registry, policy, live-check rule and docs follow.
• Not tested: no cluster was available, so every command in this diff is unrun
• No rule covers 5 touched file(s). The candidate pages below come from the files that DID match a rule, so they may scope this narrower than the change is. Read these before deciding the change is only about the pages listed:
  • python/packages/kagent-core/src/kagent/core/a2a/_telemetry.py
  • telemetry/conformance/live-check.toml
  • telemetry/policies/kagent.rego
  • telemetry/registry/signals.yaml
  • telemetry/resolved.yaml

Draft branch: pr-tracker-draft-kagent-3552

---

Important

The test suite has not run on this pull request. It was opened by github-actions[bot], and GitHub does not start workflows for pull requests opened with the repository's own token. This repository's checks are held as action_required until somebody presses Approve and run on the Checks tab. Checks that come from GitHub Apps rather than Actions, such as DCO, run on their own.

Please approve the checks before reviewing the content: an absence of failures here means the tests have not run, not that they passed.