feat(collector): Phoenix transform for agentic-netops intent tier

[mairp]

What

The agentic-netops intent tier (kind cluster: intent-supervisor / intent-mapper / intent-allocator / intent-deployer) now forwards its traces to this stack via otlphttp (endpoint AOS_OTLP_HTTP_ENDPOINT, default http://172.17.0.1:4318 from inside kind — the docker bridge gateway). Verified live 2026-10-11: ioa-observe-sdk is a rebranded Traceloop/OpenInference SDK, so the spans are OpenInference-NATIVE:

• the supervisor's ChatLiteLLM.chat spans carry gen_ai.prompt.N.content / gen_ai.completion.N.content (full content), gen_ai.usage.{prompt,completion}_tokens, llm.usage.total_tokens, and the resolved model in ioa_observe.association.properties.ls_model_name (llm.model_name is absent or the literal "unknown" under the oauth2/ shim);
• agent decorator spans are named <name>.agent with agent.name native; graph runs are LangGraph.workflow (traceloop.span.kind=workflow) + *.task node spans;
• A2A round-trips propagate W3C context, so a request is one trace (client + remote server + remote agent spans), filed under the project of its first span — in practice the supervisor's project.

Changes

• otel-collector/config.yaml — transform/phoenix_agentic_netops in the traces/phoenix pipeline (before the generic transform/phoenix_kind), conditioned on IsMatch(service.name, "^intent-(supervisor|mapper|allocator|deployer)$"):
  • LLM kind on model spans (any of llm.model_name / gen_ai.request.model / gen_ai.usage.prompt_tokens — real spans have no llm.model_name key, which a naive != nil check misses);
  • the literal "unknown" model fixed from ls_model_name (intentional overwrite — the one allowed exception, like transform/phoenix_litellm's kind rule);
  • AGENT kind on <name>.agent and traceloop.span.kind=workflow spans;
  • agentic-netops.* mapping kept as future-proofing (inert today: the SDK's context scoping keeps those attributes off exported spans — zero spans carry them, verified against the tier's ClickHouse).
  • Copy-never-overwrite (== nil) otherwise. Phoenix pipeline only — Tempo/ClickHouse keep the native attributes.
• README.md — producer-table row (export path, projects, mapping, kill switch) and a corrected known-limits note: the tier's source-side redaction (agent-tier T333–T335 in agents/common/llm.py) is currently inert, so its Phoenix spans carry FULL prompt/completion content — consistent with this stack's content-capture-on policy.

Verification

• make validate passes (incl. otelcol validate, pinned 0.109.0).
• Applied live (docker compose restart otel-collector); verified in Phoenix: LLM kind + openai/gpt-5 + token counts on ChatLiteLLM.chat, AGENT on agent/workflow spans, A2A round-trips as single traces (e.g. trace 3bf34baf… / e0eece38… in the intent-supervisor project).

Pairs with

mairp/agentic-netops PR #21 — the tier side (third trace sink otlphttp/phoenix + egress NetworkPolicy T051 + token span stamping).

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-11 14:41 UTC · Rule: default · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking #20 on main (65b46aa) #21
• ✅ Merged — 2026-10-11 14:42 UTC · at 9db0dce1304360f786d656a8a83b727be1222c4c · merge

This pull request spent 46 seconds in the queue, including 27 seconds running CI.

Required conditions to merge

• check-success = secret-scan
• check-success = validate
• github-review-approved [🛡 GitHub repository ruleset rule pr-only]
  • feat(collector): Phoenix transform for agentic-netops intent tier #20