Feat: Add the lineage demo on the Weather Agent pair

[JoshSag]

Summary

authbridge/demos/lineage/: the Weather Agent pair from
rossoctl/examples, deployed plain, then given per-request lineage with the
lineage attach kit and nothing else. Six steps. You see the same turn
twice: 19 separate traces when the app forwards no traceparent (the entry, plus 18 small trees the
sidecar roots for each un-propagated call), then one trace of 70 sidecar spans with one root once the
app's own propagation is switched on. Nothing about the app is edited except one environment variable the
app itself defines. Four files, 542 lines, plus the demo row and one README bullet.

Depends on: #852 (the lineage attach kit) and #761. Stacked on #852: until it merges, this PR's
diff also shows #852's ten files; the demo itself is the last commit, everything under
authbridge/demos/lineage/ plus the index row and one README bullet. Draft until #852 lands, then
rebased and marked ready.

What is in the diff

file	lines	what
README.md	195	the walk-through: prerequisites, six steps with the exact output that means each worked, back-out, troubleshooting
k8s/weather.yaml	194	the two stock images as two Deployments, two Services and one ConfigMap for the LLM — no AgentRuntime, no platform sidecar, no auth; mirrors demos/weather-agent/k8s/*-advanced.yaml minus enrollment, and deliberately leaves the LLM port in the redirect
ask.sh	32	one A2A turn from inside the cluster (a port-forward would bypass the sidecar) with a chosen trace id
show-trace.py	121	the shape of one trace from the collector log, with a verdict: it refuses an entry-only trace and counts traces begun by an unparented outbound hop while this one was in flight, so the case that looks fine and is not cannot pass

What it shows

1. Deploy the pair plain; one turn answers through the host LLM and the tool.
2. Attach with the kit (CAPTURE_IO=true, the demo's choice): two commands, both pods 2/2.
3. One turn, read the trace: entry only — 2 spans, 18 stray traces. The sidecar recorded all 35
   exchanges (the A2A entry, 16 MCP exchanges and their inbound sides, 2 LLM calls), but nothing links a
   call to the question that caused it.
4. Flip the agent's own switch (OTEL_EXPORTER_OTLP_ENDPOINT → the collector's OTLP/HTTP port, 8335
   on the stock chart). Why not the kit's shim: the interlock refuses this image, correctly — it already
   instruments httpx. The tool needs nothing: its only call that matters is HTTPS, and its own OTLP export
   is on the plugin's bypass_hosts.
5. The same turn: one trace, 70 sidecar spans, parent.source 1 wire / 34 tracestate / 0 none,
   0 strays, plus 82 of the apps' own spans.
6. Back out via the lines the applier printed (rollout undo --to-revision=1 each), both pods 1/1;
   delete the app; the namespace is as found.

Measured 2026-09-03 on kind with the stock platform, host Ollama qwen2.5:7b, the sidecar built from
#761 @ e45bda99 (contract v1.6). Every number in the README is from that run.

Gates

shellcheck --severity=error: exit 0. ruff at the pre-commit pin and bandit -ll: clean.
yamllint with the CI config and kubectl apply --dry-run=server: clean / accepted for
k8s/weather.yaml. show-trace.py unit-checked on a synthetic log (outbound-none root refused,
payload-quoted id ignored, midnight-safe sort, ) in values).

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}