fix(tracing): keep the commit SHA out of the shared business span

trace.py hands ONE Span instance to every registered processor, and
_add_source_to_span mutates span.data in place. So writing __commit_sha__ there
leaked it: a co-registered Agentex processor serialized it too, and it surfaced
in caller-visible span.data -- contradicting the claim that this field is
SGP-scoped.

Build the SGP write's metadata as a copy instead. Adds a regression test that
asserts the SGP metadata carries the key while the shared span and the Agentex
processor's payload do not, plus one for list-shaped data, which has nowhere to
put a metadata key and is now returned untouched.

The __source__ / __agent_* keys leak the same way today; left alone
deliberately, since changing five long-shipped fields is out of scope here.

Reported in review by Greptile.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: cyntwang99

src/agentex/lib/core/tracing/processors/sgp_tracing_processor.py

@@ -3,7 +3,7 @@
 import os
 import asyncio
 import weakref
-from typing import cast, override
+from typing import Any, cast, override
 
 import scale_gp_beta.lib.tracing as tracing
 from scale_gp_beta import SGPClient, AsyncSGPClient
@@ -68,11 +68,29 @@ def _add_source_to_span(span: Span, env_vars: EnvironmentVariables) -> None:
             span.data["__agent_id__"] = env_vars.AGENT_ID
         if env_vars.AGENT_VERSION is not None:
             span.data["__agent_version__"] = env_vars.AGENT_VERSION
-        # Opt-in only (adk.code_revision.enable()); None unless the agent asked
-        # for it, so no agent inherits this by upgrading the SDK.
-        commit_sha = code_revision.commit_sha()
-        if commit_sha is not None:
-            span.data[code_revision.COMMIT_SHA_KEY] = commit_sha
+
+
+def _sgp_metadata(span: Span) -> Any:
+    """Metadata for the SGP write: ``span.data`` plus the opt-in commit SHA.
+
+    Returns a COPY rather than mutating ``span``. ``trace.py`` hands the same
+    Span instance to every registered processor, so anything written onto
+    ``span.data`` here would also be serialized by the Agentex processor and
+    show up in caller-visible span data. ``__commit_sha__`` is opt-in and
+    SGP-scoped, so it must not leak that way.
+
+    (The ``__source__`` / ``__agent_*`` keys set by ``_add_source_to_span`` do
+    leak like that today. Left as-is: changing five long-shipped fields is not
+    this change's business.)
+    """
+    commit_sha = code_revision.commit_sha()
+    if commit_sha is None:
+        return span.data
+    if isinstance(span.data, dict):
+        return {**span.data, code_revision.COMMIT_SHA_KEY: commit_sha}
+    # List-shaped data is an accepted `data` shape and has nowhere to put a
+    # metadata key; leave it untouched rather than dropping the caller's data.
+    return span.data
 
 
 def _build_sgp_span(span: Span, env_vars: EnvironmentVariables) -> SGPSpan:
@@ -88,7 +106,7 @@ def _build_sgp_span(span: Span, env_vars: EnvironmentVariables) -> SGPSpan:
             trace_id=span.trace_id,
             input=span.input,
             output=span.output,
-            metadata=span.data,
+            metadata=_sgp_metadata(span),
         ),
     )
     sgp_span.start_time = span.start_time.isoformat()  # type: ignore[union-attr]

tests/lib/core/tracing/processors/test_sgp_tracing_processor.py

@@ -54,34 +54,63 @@ def test_agent_identity_and_version_stamped_into_span_data(self):
             "__agent_version__": "sha-abc123",
         }
 
+    SHA = "b362b171a9c4e1f09d8e7a6b5c4d3e2f1a0b9c8d"
+
     def test_commit_sha_is_not_stamped_without_opt_in(self, monkeypatch):
         """Upgrading the SDK must not start emitting __commit_sha__ on its own,
         even when the environment carries a perfectly good SHA."""
         from agentex.lib.core.tracing import code_revision
-        from agentex.lib.core.tracing.processors.sgp_tracing_processor import _add_source_to_span
+        from agentex.lib.core.tracing.processors.sgp_tracing_processor import _sgp_metadata
 
-        monkeypatch.setenv("AGENT_COMMIT_SHA", "b362b171a9c4e1f09d8e7a6b5c4d3e2f1a0b9c8d")
+        monkeypatch.setenv("AGENT_COMMIT_SHA", self.SHA)
         code_revision.disable()
 
-        env = MagicMock(ACP_TYPE=None, AGENT_NAME=None, AGENT_ID=None, AGENT_VERSION=None)
-        span = _make_span()
-        _add_source_to_span(span, env)
-        assert isinstance(span.data, dict)
-        assert "__commit_sha__" not in span.data
+        span = _make_span(); span.data = {}
+        assert "__commit_sha__" not in (_sgp_metadata(span) or {})
 
     def test_commit_sha_is_stamped_after_opt_in(self, monkeypatch):
         from agentex.lib.core.tracing import code_revision
-        from agentex.lib.core.tracing.processors.sgp_tracing_processor import _add_source_to_span
+        from agentex.lib.core.tracing.processors.sgp_tracing_processor import _sgp_metadata
 
-        sha = "b362b171a9c4e1f09d8e7a6b5c4d3e2f1a0b9c8d"
-        monkeypatch.setenv("AGENT_COMMIT_SHA", sha)
+        monkeypatch.setenv("AGENT_COMMIT_SHA", self.SHA)
         code_revision.enable()
         try:
-            env = MagicMock(ACP_TYPE=None, AGENT_NAME=None, AGENT_ID=None, AGENT_VERSION=None)
-            span = _make_span()
-            _add_source_to_span(span, env)
-            assert isinstance(span.data, dict)
-            assert span.data["__commit_sha__"] == sha
+            span = _make_span(); span.data = {"caller": "kept"}
+            metadata = _sgp_metadata(span)
+            assert metadata["__commit_sha__"] == self.SHA
+            assert metadata["caller"] == "kept"
+        finally:
+            code_revision.disable()
+
+    def test_commit_sha_does_not_leak_onto_the_shared_span(self, monkeypatch):
+        """trace.py hands ONE Span to every processor. If the commit SHA were
+        written onto span.data, a co-registered Agentex processor would
+        serialize it too, and it would surface in caller-visible span data."""
+        from agentex.lib.core.tracing import code_revision
+        from agentex.lib.core.tracing.processors.sgp_tracing_processor import _sgp_metadata
+        from agentex.lib.core.tracing.processors.agentex_tracing_processor import _create_kwargs
+
+        monkeypatch.setenv("AGENT_COMMIT_SHA", self.SHA)
+        code_revision.enable()
+        try:
+            span = _make_span(); span.data = {}
+            assert _sgp_metadata(span)["__commit_sha__"] == self.SHA   # SGP sees it
+            assert "__commit_sha__" not in span.data                   # the span does not
+            assert "__commit_sha__" not in (_create_kwargs(span)["data"] or {})
+        finally:
+            code_revision.disable()
+
+    def test_list_shaped_data_is_left_alone(self, monkeypatch):
+        """`data` may be a list of dicts; there is nowhere to put a metadata key,
+        and dropping the caller's data would be worse than omitting the field."""
+        from agentex.lib.core.tracing import code_revision
+        from agentex.lib.core.tracing.processors.sgp_tracing_processor import _sgp_metadata
+
+        monkeypatch.setenv("AGENT_COMMIT_SHA", self.SHA)
+        code_revision.enable()
+        try:
+            span = _make_span(); span.data = [{"a": 1}]
+            assert _sgp_metadata(span) == [{"a": 1}]
         finally:
             code_revision.disable()