fix(telemetry): five review findings on the merged Go helper (backend#1897)

[LukasWodka]

cli#503 merged before its review was resolved. This addresses all five of @saqlainsyed007's findings.

All five are real. Each was reproduced against the merged code before anything changed:

FINDING 1 REPRODUCES: record carries service.name=backend
FINDING 2 REPRODUCES: attribute "tracebloc.elapsed" has type time.Duration; values must be primitives
FINDING 3 REPRODUCES: service.instance.id stamped as ""
FINDING 4 REPRODUCES: delivered although Exports()=false
FINDING 5 REPRODUCES: retired key with a nil value passed silently

Nothing imports this package yet (#1907 is the consumer), so there is no production impact — but three of these would have shaped the first call sites, which is precisely when they'd have become expensive.

The five

1 · Resource-scope keys accepted as record attributes. One flat allowlist mixed the layers, so a call site could contradict its own process identity — the cloud_RoleName confusion, at the call site of the package meant to close it. TestTheSinkReceivesResourceAndRecordSeparately passed only because the caller happened not to pass one.

Now two sets. tracebloc.component/tracebloc.tenant.id are included even though correctly prefixed — the namespace rule alone waved them past. And event.name is refused: it is Emit's first argument, so accepting it let a caller replace the name after the grammar and failure-set checks had run.

2 · The primitive switch was narrower than Go's scalars. A type switch matches the dynamic type, so case int64 never matched time.Duration. Now switches on reflect.Kind. Added Duration(d) int64 returning milliseconds — because time.Duration is an int64 kind and would otherwise pass as a raw nanosecond count, a number nobody reading a dashboard can interpret.

3 · An empty service.instance.id was stamped. os.Hostname() returns "" on error. Omitted now — the record layer already refused empty values; the resource layer did not.

4 · Delivery ignored Exports(). "Unknown never exports" lived in caller discipline at every #1907 call site. Gated now; validation still always runs, so a bad event fails in CI wherever the binary is built.

5 · A bad key with an empty value passed silently. normalise continued before validating the key. Validated first now — and a good key with an empty value is still dropped rather than rejected.

Note

Finding 1 is the same defect Bugbot found independently in the Python sibling (backend#1996). Both fixed the same way, which is some evidence the layer split is the right shape rather than a local patch.

31 tests, 100% statement coverage, make check green. Six mutations, all caught.

Refs #1897.

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are confined to an unused internal telemetry package with expanded tests; no production callers yet, but the rules will shape future CLI instrumentation.

Overview
Hardens the CLI telemetry emitter before first call sites land (#1907): validation behavior stays strict, but several contract gaps from the merged helper are closed.

Resource vs record attributes — The single OTel allowlist is split into resourceScope (process-only, set in New) and recordScope (call-site OTel keys). Call sites can no longer pass resource keys or event.name as attributes.

Values and omission — Primitive checks use reflect.Kind so named scalars (e.g. time.Duration) are accepted; absentValue uses the same kind-based rule so empty named strings are dropped and cannot satisfy failure error.type. Duration() exposes milliseconds for duration attributes. service.instance.id is omitted when blank/whitespace.

Emit delivery — The sink runs only when Exports() is true; validation always runs. Attribute keys are validated before empty values are dropped, so retired/malformed keys cannot slip through on nil/empty values.

Tests cover all five findings plus the named-string edge cases.

^{Reviewed by Cursor Bugbot for commit c3a9210. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c3a9210. Configure here.}

[shujaatTracebloc]

Approve (backend#1897) — CI green, no open Bugbot. Five review findings on the merged Go telemetry helper (cli#503), each a real hardening: the flat allowlist splits into resourceScope vs recordScope (the cross-layer confusion that made cloud_RoleName report a process name, reintroduced at the call site of the package meant to close it); the attribute key is validated BEFORE the empty-value drop (so a retired/malformed key carrying an empty value no longer passes silently); absentValue tests by KIND not concrete type (a named string type type Reason string could otherwise smuggle an empty error.type past checkFailureSet); validation always runs while delivery is gated on Exports() (the "unknown env never exports" guarantee no longer depends on every call site remembering not to install a sink); and service.instance.id is omitted rather than stamped empty when os.Hostname() fails. A zero/false value is correctly NOT treated as absent. Mirrors the same fixes landing on the Python sibling (backend#1996). Clean.