# Langfuse agent tracing evidence run — 26 August 2026

## Result

The isolated integration run passed against the configured self-hosted Langfuse
instance.

| Component | Version |
| --- | --- |
| Langfuse Python SDK | `4.14.5` |
| Langfuse server | `3.205.0` |
| Python | `3.13.9` |
| Fixture release | `6401879` |

Three remote scenarios passed: happy path, timeout followed by a successful retry, and
a terminal tool error that required human review. A fourth process used an unreachable
local endpoint and returned the same application result despite the unavailable
exporter.

The minimized evidence is in
[`sanitized-trace-shapes-2026-08-26.json`](./sanitized-trace-shapes-2026-08-26.json).
Raw trace responses remained in memory and were not written to the repository.

## Verified assertions

- each scenario contains exactly one root observation;
- every child points to the root observation returned by the SDK;
- the timeout and successful retry are separate `TOOL` observations;
- the terminal tool error is `ERROR`, the root is `WARNING`, and successful siblings
  remain non-error observations;
- all observations have an end time;
- input and output payloads are absent from the exported observations;
- synthetic email and account values are redacted before export;
- the saved evidence contains neither Langfuse secret nor public keys;
- an unreachable exporter does not change the fixture application result.

## Defects caught by the run

The first adapter contract used `observation_id`, matching the class docstring in the
SDK source. The installed `4.14.5` object exposes the span identifier as `id`. The fake
contract therefore passed while every child start failed inside telemetry isolation.
The remote run exposed the mismatch because only the root reached Langfuse. The adapter
and fake contract now use `id`, and all child observations are present.

The raw API response also includes the Langfuse public key under SDK scope metadata.
The evidence exporter now uses a fixed allowlist instead of copying the full metadata
object. The public key is permitted only in the transient authenticated response and
is rejected in the saved evidence.

## Reproduction

The run used an ephemeral dependency environment and did not change project dependency
files:

```bash
uv run --isolated --with langfuse==4.14.5 python \
  docs/seo/evidence/langfuse-agent-tool-tracing/run_integration.py \
  --output /tmp/futurecraft-langfuse-evidence.json
```

Dedicated Langfuse credentials and either `LANGFUSE_BASE_URL` or the existing
`LANGFUSE_BASEURL` alias are required. Never print these values or commit the raw
response.

## Limits

- The model responses and tools are deterministic fixtures, not live providers.
- Timing values describe one local evidence run and are not performance benchmarks.
- The result covers SDK `4.14.5` with one self-hosted `3.205.0` server.
- The sanitized SVG is a diagram generated from the minimized export, not a Langfuse
  product screenshot. It was visually inspected at 1440×900 before the evidence gate
  was closed.