fix(pii): preserve trusted scope metadata

crates/core/src/observability/mod.rs

@@ -299,6 +299,15 @@ pub(crate) fn push_session_identity_attributes(
     {
         attributes.push(KeyValue::new("user.id", user_id.to_string()));
     }
+    if let Some(agent_kind) = metadata
+        .and_then(|value| value.get("agent_kind"))
+        .and_then(crate::json::Json::as_str)
+    {
+        attributes.push(KeyValue::new(
+            "nemo_relay.agent.kind",
+            agent_kind.to_string(),
+        ));
+    }
     if let Ok(stack) = crate::api::runtime::current_scope_stack().read() {
         attributes.push(KeyValue::new(
             "nemo_relay.session.instance_id",

crates/core/tests/unit/observability/openinference_tests.rs

@@ -826,7 +826,11 @@ fn session_identity_is_projected_on_trace_roots_and_marks_only() {
         .unwrap()
         .root_uuid()
         .to_string();
-    let identity = json!({"session_id": "logical-session", "user_id": "alice"});
+    let identity = json!({
+        "session_id": "logical-session",
+        "user_id": "alice",
+        "agent_kind": "claude-code"
+    });
 
     callback(&make_start_event_with_metadata(
         root_uuid,
@@ -895,6 +899,7 @@ fn session_identity_is_projected_on_trace_roots_and_marks_only() {
     let root_attributes = attr_map(&root.attributes);
     assert_eq!(root_attributes["session.id"], "logical-session");
     assert_eq!(root_attributes["user.id"], "alice");
+    assert_eq!(root_attributes["nemo_relay.agent.kind"], "claude-code");
     assert_eq!(
         root_attributes["nemo_relay.session.instance_id"],
         instance_id
@@ -910,6 +915,7 @@ fn session_identity_is_projected_on_trace_roots_and_marks_only() {
     assert!(!child_attributes.contains_key("session.id"));
     assert!(!child_attributes.contains_key("user.id"));
     assert!(!child_attributes.contains_key("nemo_relay.session.instance_id"));
+    assert!(!child_attributes.contains_key("nemo_relay.agent.kind"));
     assert_eq!(child_attributes["openinference.metadata.user_id"], "alice");
     let second_root_attributes = attr_map(&second_root.attributes);
     assert_eq!(second_root_attributes["session.id"], "logical-session");
@@ -930,13 +936,15 @@ fn session_identity_is_projected_on_trace_roots_and_marks_only() {
     let mark_attributes = attr_map(&root.events.events[0].attributes);
     assert_eq!(mark_attributes["session.id"], "logical-session");
     assert_eq!(mark_attributes["user.id"], "alice");
+    assert_eq!(mark_attributes["nemo_relay.agent.kind"], "claude-code");
     assert_eq!(
         mark_attributes["nemo_relay.session.instance_id"],
         root_attributes["nemo_relay.session.instance_id"]
     );
     let orphan_attributes = attr_map(&orphan_mark.attributes);
     assert_eq!(orphan_attributes["session.id"], "logical-session");
     assert_eq!(orphan_attributes["user.id"], "alice");
+    assert_eq!(orphan_attributes["nemo_relay.agent.kind"], "claude-code");
     assert_eq!(
         orphan_attributes["nemo_relay.session.instance_id"],
         root_attributes["nemo_relay.session.instance_id"]

crates/core/tests/unit/observability/otel_tests.rs

@@ -717,7 +717,11 @@ fn session_identity_is_projected_on_trace_roots_and_marks_only() {
         .unwrap()
         .root_uuid()
         .to_string();
-    let identity = json!({"session_id": "logical-session", "user_id": "alice"});
+    let identity = json!({
+        "session_id": "logical-session",
+        "user_id": "alice",
+        "agent_kind": "claude-code"
+    });
 
     callback(&make_start_event_with_metadata(
         root_uuid,
@@ -786,6 +790,7 @@ fn session_identity_is_projected_on_trace_roots_and_marks_only() {
     let root_attributes = attr_map(&root.attributes);
     assert_eq!(root_attributes["session.id"], "logical-session");
     assert_eq!(root_attributes["user.id"], "alice");
+    assert_eq!(root_attributes["nemo_relay.agent.kind"], "claude-code");
     assert_eq!(
         root_attributes["nemo_relay.session.instance_id"],
         instance_id
@@ -801,6 +806,7 @@ fn session_identity_is_projected_on_trace_roots_and_marks_only() {
     assert!(!child_attributes.contains_key("session.id"));
     assert!(!child_attributes.contains_key("user.id"));
     assert!(!child_attributes.contains_key("nemo_relay.session.instance_id"));
+    assert!(!child_attributes.contains_key("nemo_relay.agent.kind"));
     assert_eq!(
         child_attributes["nemo_relay.start.metadata.user_id"],
         "alice"
@@ -824,13 +830,15 @@ fn session_identity_is_projected_on_trace_roots_and_marks_only() {
     let mark_attributes = attr_map(&root.events.events[0].attributes);
     assert_eq!(mark_attributes["session.id"], "logical-session");
     assert_eq!(mark_attributes["user.id"], "alice");
+    assert_eq!(mark_attributes["nemo_relay.agent.kind"], "claude-code");
     assert_eq!(
         mark_attributes["nemo_relay.session.instance_id"],
         root_attributes["nemo_relay.session.instance_id"]
     );
     let orphan_attributes = attr_map(&orphan_mark.attributes);
     assert_eq!(orphan_attributes["session.id"], "logical-session");
     assert_eq!(orphan_attributes["user.id"], "alice");
+    assert_eq!(orphan_attributes["nemo_relay.agent.kind"], "claude-code");
     assert_eq!(
         orphan_attributes["nemo_relay.session.instance_id"],
         root_attributes["nemo_relay.session.instance_id"]

crates/pii-redaction/README.md

@@ -154,6 +154,16 @@ fields remain usable. This choice affects canonical event fields before
 subscriber fan-out; exporter-owned resource attributes are outside this
 boundary.
 
+For Scope events, the preset retains direct string values for the trusted
+low-cardinality classification fields `nemo_relay_scope_role`, `agent_kind`,
+`hook_event_name`, `gateway_config_profile`, `gateway_mode`, `turn_source`,
+`harness`, `source`, `identity_quality`, `gateway_path`,
+`llm_correlation_status`, `llm_correlation_source`, `tool_correlation_status`,
+`tool_correlation_source`, `otel.status_code`, and `fidelity_source`. It also
+retains the direct boolean `provider_payload_exact`. Do not place PII or
+conversational content in these fields. Arbitrary metadata and unexpected value
+types continue through the preset's normal semantic redaction.
+
 The preset defines its own action and therefore cannot be combined with
 `action`, `detector`, `pattern`, `target_paths`, or mask-specific fields. Its
 optional `replacement` defaults to `[REDACTED]`.

crates/pii-redaction/src/trajectory.rs

@@ -11,6 +11,27 @@ use nemo_relay::api::event::{CategoryProfile, Event};
 use nemo_relay::codec::request::AnnotatedLlmRequest;
 use nemo_relay::codec::response::AnnotatedLlmResponse;
 
+const TRUSTED_STRING_SCOPE_METADATA_FIELDS: &[&str] = &[
+    "nemo_relay_scope_role",
+    "agent_kind",
+    "hook_event_name",
+    "gateway_config_profile",
+    "gateway_mode",
+    "turn_source",
+    "harness",
+    "source",
+    "identity_quality",
+    "gateway_path",
+    "llm_correlation_status",
+    "llm_correlation_source",
+    "tool_correlation_status",
+    "tool_correlation_source",
+    "otel.status_code",
+    "fidelity_source",
+];
+
+const TRUSTED_BOOLEAN_SCOPE_METADATA_FIELDS: &[&str] = &["provider_payload_exact"];
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(super) enum CustomMarkPayloadPolicy {
     Preserve,
@@ -134,16 +155,47 @@ impl TrajectorySanitizer {
                 .data
                 .map(|value| redact_semantic_content(value, &self.replacement, None));
         }
-        fields.metadata = fields
-            .metadata
-            .map(|value| redact_semantic_content(value, &self.replacement, None));
+        fields.metadata = fields.metadata.map(|value| {
+            if matches!(event, Event::Scope(_)) {
+                sanitize_scope_metadata(value, &self.replacement)
+            } else {
+                redact_semantic_content(value, &self.replacement, None)
+            }
+        });
         fields.category_profile = fields
             .category_profile
             .and_then(|profile| sanitize_category_profile(profile, &self.replacement));
         fields
     }
 }
 
+fn sanitize_scope_metadata(value: Json, replacement: &str) -> Json {
+    let Json::Object(values) = value else {
+        return redact_semantic_content(value, replacement, None);
+    };
+    Json::Object(
+        values
+            .into_iter()
+            .map(|(key, value)| {
+                let value = if is_trusted_scope_metadata_value(&key, &value) {
+                    value
+                } else {
+                    redact_semantic_content(value, replacement, Some(&key))
+                };
+                (key, value)
+            })
+            .collect(),
+    )
+}
+
+fn is_trusted_scope_metadata_value(key: &str, value: &Json) -> bool {
+    match value {
+        Json::String(_) => TRUSTED_STRING_SCOPE_METADATA_FIELDS.contains(&key),
+        Json::Bool(_) => TRUSTED_BOOLEAN_SCOPE_METADATA_FIELDS.contains(&key),
+        _ => false,
+    }
+}
+
 fn is_known_content_bearing_mark(name: &str) -> bool {
     matches!(
         name,