Mark Phase 2 done

First auto-instrumented sanctions trace verified in Tempo. Records what
carries forward: /healthz trace noise, the prod environment label in the
base compose file, and the red G10 guard test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/roadmap/phase-2.md

@@ -2,11 +2,27 @@
 
 *Part of `docs/roadmap/` — see [`intro.md`](intro.md) for platform/background context and [`summary.md`](summary.md) for how every phase fits together. Prev: [`phase-1.md`](phase-1.md) · Next: [`phase-3.md`](phase-3.md)*
 
-**Status:** In progress
+**Status:** Done
 
-**Message:** Started 2026-10-12. Step 1 (deploy the platform) is done and
-verified live, apart from reading the Alloy component graph. Next: step 2,
-zero-code auto-instrumentation of `sanctions`.
+**Message:** Started and finished 2026-10-12. The platform is deployed and the
+Alloy component graph has been read. `sanctions` runs under zero-code
+auto-instrumentation (`opentelemetry-distro==0.66b1` +
+`opentelemetry-exporter-otlp==1.45.1`, instrumentors installed by
+`opentelemetry-bootstrap` at build time). It exports traces only, over
+OTLP/HTTP to `https://otlp.vione.cloud`. First real trace:
+`9bfa05d03eabe3d3338a8672cf127465` (`POST /internal/lookup`), found with
+`{resource.service.name="sanctions" && kind=server && span.http.route!="/healthz"}`.
+
+Found along the way: Alloy returns **404** for OTLP metrics and logs. They are
+not silently accepted, and the docs were corrected to say so.
+
+Carried forward, all undecided:
+- **`/healthz` traces.** The Docker healthcheck produces a trace every 5s and
+  floods Tempo search. `OTEL_PYTHON_FASTAPI_EXCLUDED_URLS` would filter it.
+- **`deployment.environment.name=prod`** is set in the base
+  `docker-compose.yml`, so local runs would also be labelled `prod`.
+- **Guard test G10** (`test_dependency_files_do_not_list_observability_libraries`)
+  is red by choice until the guard suite is retired in Phase 3.
 
 **Time-box:** one evening.
 

docs/roadmap/summary.md

@@ -17,7 +17,7 @@ warnings), **Time-box**, **Concepts**, **Resources**, **Build**, **Done when**.
 | 0a | [`phase-0.md`](phase-0.md) | Done | Integration test suite (agent, tests only) | 1 evening | Red suite + `RED-BASELINE.md` |
 | 0b | [`phase-0.md`](phase-0.md) | Done | Base project implemented to green (second agent) | 1–2 evenings | Ledgerline running, list of frustrations |
 | 1 | [`phase-1.md`](phase-1.md) | Done | Deployment: Compose + Traefik on a server | 1 evening | `https://ledgerline.vione.cloud` |
-| 2 | [`phase-2.md`](phase-2.md) | In progress | Concepts + first trace | 1 evening | One trace in Tempo |
+| 2 | [`phase-2.md`](phase-2.md) | Done | Concepts + first trace | 1 evening | One trace in Tempo |
 | 3 | [`phase-3.md`](phase-3.md) | Not started | Distributed tracing | 2–3 evenings | Connected trace across 7 services incl. the async hop |
 | 4 | [`phase-4.md`](phase-4.md) | Not started | Structured logs | 1–2 evenings | Two-way trace↔log correlation |
 | 5 | [`phase-5.md`](phase-5.md) | Not started | Metrics | 2 evenings | RED per service, service map, exemplars |
@@ -39,7 +39,8 @@ warnings), **Time-box**, **Concepts**, **Resources**, **Build**, **Done when**.
 - **2 — The model, and one signal end to end.** Learn the OTel API/SDK/Collector
   split and the M.E.L.T. vocabulary; deploy the real Grafana-stack platform
   (the mentor's Ansible stack, ported to k3s as `k8s/` — already deployed on
-  `falken`) and get one auto-instrumented trace into Tempo.
+  `falken`) and get one auto-instrumented trace into Tempo. **Done** — see
+  `phase-2.md` for what carries forward.
 - **3 — Distributed tracing.** The heart of the task: auto- and
   manual-instrument all seven services, and hand-propagate trace context
   across the Redis Stream hop, which carries none by default.