[krisztianfekete]

What

The runtimes now record the gateway-forwarded user (x-user-id) as user.id instead of enduser.id, on the request span and the spans beneath it. Go ADK and the Python runtimes change together, and the registry, policy, live-check rule and docs follow.

Why

Semantic conventions v1.45.0 deprecated enduser.id and enduser.pseudo.id and moved them to the client-side conventions (open-telemetry/semantic-conventions#4238), which cover browsers and mobile apps. For a server, the attribute is the core user.id. It already exists in the pinned v1.44.0 registry and in the Go semconv/v1.43.0 package, so this PR needs no dependency or pin bump. The core v1.45.0 and GenAI pin bump comes in a follow-up.

Breaking change

This is a hard rename. Queries, dashboards and access rules that read enduser.id must read user.id. To keep the old name for one release, add this to an OpenTelemetry Collector transform processor:

trace_statements:
  - context: span
    statements:
      - set(attributes["enduser.id"], attributes["user.id"]) where attributes["user.id"] != nil

Claude Code spans carry their own user.id, which is a hash of the Claude account and not the kagent user. Read the trusted user from the invocation span.

Notes

• The live-check matcher for kagent.request now finds request spans by a2a.method instead of the user attribute. Otherwise Claude Code's native user.id would match its spans against the kagent request group.
• Downstream readers that already accept user.id should land before this PR is synced into their tree.

Testing

• make semconv-check semconv-policies-test semconv-generate
• go test ./pkg/tracing/... ./adk/pkg/a2a/... ./adk/pkg/telemetry/...
• uv run pytest packages/kagent-core/tests/test_a2a_telemetry.py