feat: multi-tenant session isolation - per-customer trace tagging, cost rollup, and GDPR export

[Siddhant-K-code]

Problem

Teams building SaaS products on top of AI agents need to isolate traces, costs, and audit logs per customer. Today agent-trace has no concept of tenancy - all sessions land in the same store with no customer-level separation.

This matters for:

• Cost attribution: "how much did running agents for customer X cost this month?"
• Data isolation: customer A's trace data must not be accessible when querying for customer B
• GDPR compliance: "delete all data for customer X" must be possible and auditable

---

Proposed solution

A --tenant-id flag on watch and hooks that tags all events with a customer identifier, plus tenant-scoped query and export commands.

Tagging sessions

# Tag a session with a tenant ID at watch time
agent-strace watch --tenant-id customer-acme

# Or via environment variable (for CI/automated agents)
AGENT_STRACE_TENANT_ID=customer-acme python my_agent.py

All events in the session are tagged with tenant_id: customer-acme in the NDJSON store.

Querying by tenant

# List sessions for a specific customer
agent-strace list --tenant customer-acme

# Cost report for one customer
agent-strace cost --tenant customer-acme --since 30d

# Full session history for a customer (GDPR subject access request)
agent-strace tenant export customer-acme --format json

# Delete all data for a customer (GDPR right to erasure)
agent-strace tenant delete customer-acme --confirm

Tenant cost rollup

agent-strace tenant report --month 2026-06

Tenant cost report - June 2026
──────────────────────────────────────────────────────
Tenant              Sessions   Cost       % of total
──────────────────────────────────────────────────────
customer-acme          142    $38.21        21.2%
customer-beta           89    $24.18        13.4%
customer-gamma         201    $61.44        34.1%
customer-delta          67    $18.92        10.5%
(untagged)             108    $37.74        20.9%
──────────────────────────────────────────────────────
Total                  607   $180.49

Tenant-scoped API keys (hosted collector)

When using the hosted collector, tenant isolation is enforced server-side:

• Each API key is scoped to one org
• tenant_id is a tag within that org's namespace
• Tenant data is stored in isolated partitions
• tenant export and tenant delete operate only within the caller's org

Implementation notes

• tenant_id is stored as a top-level field in session metadata and propagated to all events
• Existing --stream-to and OTLP export include tenant_id as a span attribute
• tenant delete performs a hard delete from the NDJSON store and writes a deletion audit record
• No changes to the capture path - tagging is additive

---

Acceptance criteria

• --tenant-id flag on watch tags all session events with the tenant identifier
• AGENT_STRACE_TENANT_ID env var works as an alternative to the flag
• agent-strace list --tenant ID filters session list to one tenant
• agent-strace cost --tenant ID scopes cost calculation to one tenant
• agent-strace tenant report produces a cost rollup across all tenants
• agent-strace tenant export ID exports all sessions for a tenant as JSON
• agent-strace tenant delete ID --confirm hard-deletes all tenant data and writes an audit record
• tenant_id included in OTLP span attributes on export
• Docs: "Multi-tenant agent deployments" guide with GDPR compliance notes