Bootstrap tracing in code for sanctions, replacing the zero-code wrapper

common/telemetry.py builds the Resource, TracerProvider, BatchSpanProcessor
and OTLP/HTTP exporter by hand; sanctions calls setup_telemetry() at
import instead of running under opentelemetry-instrument. No instrumentor
is enabled yet, so sanctions emits no spans for now.

service.version comes from OTEL_RESOURCE_ATTRIBUTES: deploy.sh exports
DEPLOY_HASH (the server's HEAD after the pull) and compose falls back to
"dev". deployment.environment.name=prod is dropped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

common/telemetry.py

@@ -0,0 +1,13 @@
+from opentelemetry import trace
+from opentelemetry.sdk.resources import SERVICE_NAME, Resource
+from opentelemetry.sdk.trace import TracerProvider
+from opentelemetry.sdk.trace.export import BatchSpanProcessor
+from opentelemetry.exporter.otlp.proto.http.trace_exporter import OTLPSpanExporter
+
+
+def setup_telemetry(service_name: str):
+    resource = Resource.create(attributes={SERVICE_NAME: service_name})
+    processor = BatchSpanProcessor(OTLPSpanExporter())
+    provider = TracerProvider(resource=resource)
+    provider.add_span_processor(processor)
+    trace.set_tracer_provider(provider)

deploy.sh

@@ -18,4 +18,10 @@ if [ -n "$(git log '@{u}..HEAD' --oneline 2>/dev/null)" ]; then
   echo "warning: local commits are not pushed; the server will not see them" >&2
 fi
 
-ssh "$DEPLOY_HOST" "cd '$DEPLOY_DIR' && git pull --ff-only && $COMPOSE up -d --build && $COMPOSE ps"
+# DEPLOY_HASH is the server's HEAD *after* the pull -- the code actually
+# running -- and becomes service.version on every span (docker-compose.yml).
+# Escaped so it is evaluated on the server, not here.
+ssh "$DEPLOY_HOST" "cd '$DEPLOY_DIR' && git pull --ff-only \
+  && export DEPLOY_HASH=\$(git rev-parse --short HEAD) \
+  && echo \"deploying \$DEPLOY_HASH\" \
+  && $COMPOSE up -d --build && $COMPOSE ps"

docker-compose.yml

@@ -7,6 +7,9 @@ x-app-env: &app-env
   SANCTIONS_URL: http://sanctions:8003
   INSIGHTS_URL: http://insights:8004
   NOTIFIER_URL: http://notifier:8005
+  # Merged into the Resource by Resource.create(). deploy.sh sets DEPLOY_HASH
+  # to the deployed git SHA; anything else (local runs) is "dev".
+  OTEL_RESOURCE_ATTRIBUTES: service.version=${DEPLOY_HASH:-dev}
 
 x-app-build: &app-build
   build:
@@ -140,7 +143,6 @@ services:
       <<: *app-env
       SERVICE_NAME: sanctions
       OTEL_SERVICE_NAME: sanctions
-      OTEL_RESOURCE_ATTRIBUTES: deployment.environment.name=prod
       OTEL_EXPORTER_OTLP_ENDPOINT: https://otlp.vione.cloud
       OTEL_EXPORTER_OTLP_PROTOCOL: http/protobuf
       OTEL_TRACES_EXPORTER: otlp
@@ -148,7 +150,7 @@ services:
       OTEL_LOGS_EXPORTER: none
     env_file:
       - .env.observability
-    command: opentelemetry-instrument uvicorn services.sanctions.app:app --host 0.0.0.0 --port 8003 --reload --no-access-log
+    command: uvicorn services.sanctions.app:app --host 0.0.0.0 --port 8003 --reload --no-access-log
     ports:
       - "8003:8003"
     healthcheck:

services/sanctions/app.py

@@ -6,13 +6,14 @@ from pydantic import BaseModel
 
 from common.db import engine
 from common.logging_config import configure_logging
-from common.redis_client import redis_client
+from common.telemetry import setup_telemetry
 
 from . import chaos
 from .repository import is_match
 
 SERVICE_NAME = "sanctions"
 logger = configure_logging(SERVICE_NAME)
+setup_telemetry(service_name=SERVICE_NAME)
 app = FastAPI(title=SERVICE_NAME)