feat(orchestration,loop,flow): 接线子代理编排 — 派发入口 + 分支归父会话 + 节点日志（含脱敏）

修的是「文档说 ✅、生产不可达」：此前 Scheduler.Spawn 只有测试调用方、无 bus 入口、无派发工具；Span.Record 无生产调用方 → 泳道画不出、节点日志恒空。
- 入口：subagent_spawn 工具（internal/runtime/orchestration/spawntool.go，同包便于用真 Scheduler/loop/Tracer/Flow 做集成测试；注册在 cmd/cyrene/subagent_tool.go 照 terminal_tool 范式）。默认 owner-only，不设 AllowInGroup/AllowInStranger；安全仍由 restrictSchemas + applyToolSecurityGate 双层保证，未绕代审
- 父会话归属：AgentSpec.ParentSession（请求语义）→ Scheduler 转运行期 ctx 标记 loop.WithFlowBranch → 分支 span 以父 session 发布；**allow 谓词一行未改**；单图语义靠「分支 Run 不调 StartRound/EndRound」+ FlowPublisher 不新建图；未归属 spawn 一张图都不发（有测试锁）
- 前台最多等 2s（对齐 task.autoBackgroundThreshold）→ 合并结果作工具结果；转后台则广播 bus subagent.result（design/05 §9 回填 hook）；新增 Scheduler.Wait(ids) 按批等待（Join 会串并发批次，故不重用）
- 子代理跑在 WithoutCancel(ctx)：保留 span 归属、不被工具超时/回合结束顺手杀掉；生命周期由 PerAgentTimeout + CancelAll 约束；内部 WithMutedBroadcast 静音（不进前台 stream）
- 节点日志：loop/spanlog.go 新增 llm.done / tool.done / subagent.done；工具参数**只记键名不记值**；仅步骤真正结束才追加（跳过/被拒路径不发，不伪造）
- 脱敏（红线）：新增 trace/redact.go（形状规则 sk-/Bearer/JWT/key:value + 键名规则 api_key/token/authorization/password…，递归嵌套、不改调用方事件），graph.go 发布前必经；**顺带修掉一个既有泄漏**：result_summary prop 原先未脱敏（工具结果里的密钥会进图），由图级变异测试抓出
- 测试：新增 22 个（工具级 / 图级 / 日志级），含 4 次变异验证（去掉 WithFlowBranch、去掉 record*、还原未脱敏、去掉静音 各自 FAIL）；-race 过 orchestration+trace+loop
- 已知限制：真实模型端到端未验（无凭据/不起服务）；工具白名单是 design gap 未做；subagent.result 暂无消费者（design/15 未实现）；后台子代理跨轮次边界迟到 span 会丢泳道根；PerAgentTimeout=10min 待确认

internal/runtime/loop/flow.go

@@ -23,6 +23,11 @@ type allowedSessions func(sessionID string) bool
 // a realtime input→think→tool→output graph (design/19 §1). It is nil-tolerant
 // (a nil publisher is a no-op) and safe for concurrent use; session graphs are
 // serialized under one mutex because parallel tool spans finish concurrently.
+//
+// Ownership: one session owns one live round. A Run that declares itself a branch
+// of another session (loop.WithFlowBranch) never calls StartRound/EndRound and
+// publishes its spans under the owning session instead, so a sub-agent renders as
+// a swimlane of the parent's graph rather than as a second graph (design/19 §2).
 type FlowPublisher struct {
 	mu     sync.Mutex
 	publish func(subject string, payload any)

internal/runtime/loop/flow_branch.go

@@ -0,0 +1,66 @@
+package loop
+
+import "context"
+
+// flowBranchKey is the context key marking a Run as a branch of another
+// session's flow graph. It is set by the orchestration layer (through
+// WithFlowBranch) before it drives a sub-agent's Run.
+type flowBranchKey struct{}
+
+// WithFlowBranch returns ctx marking the current Run as a branch: its spans fold
+// into parentSession's live flow graph and the Run neither starts nor ends a
+// round of its own — the owning session's round does. It is how the orchestration
+// layer attributes a sub-agent's work to the session that spawned it, so parallel
+// sub-agents render as swimlanes of one graph instead of replacing the frontend's
+// single flowGraph with a graph of their own (design/19 §2).
+//
+// An empty parentSession still marks the Run as a branch: it owns no round and
+// publishes nothing. That is the state of a background sub-agent nobody attributed
+// to a session, and it must not silently become a graph of its own. A nil ctx is
+// returned unchanged.
+func WithFlowBranch(ctx context.Context, parentSession string) context.Context {
+	if ctx == nil {
+		return ctx
+	}
+	return context.WithValue(ctx, flowBranchKey{}, parentSession)
+}
+
+// flowBranch reports the parent session recorded by WithFlowBranch and whether the
+// Run is a branch at all. A non-branch Run owns its own round and publishes under
+// its own session id.
+func flowBranch(ctx context.Context) (string, bool) {
+	if ctx == nil {
+		return "", false
+	}
+	v := ctx.Value(flowBranchKey{})
+	if v == nil {
+		return "", false
+	}
+	s, _ := v.(string)
+	return s, true
+}
+
+// flowOwner returns the session whose flow graph should receive this Run's spans:
+// the branch parent when the Run is a sub-agent branch (empty when the branch is
+// unattributed, which suppresses publication), otherwise the Run's own sessionID.
+func flowOwner(ctx context.Context, sessionID string) string {
+	if parent, isBranch := flowBranch(ctx); isBranch {
+		return parent
+	}
+	return sessionID
+}
+
+// FlowOwnerFromContext returns the session whose flow graph owns work started
+// from ctx: the branch parent when ctx runs inside a sub-agent branch, otherwise
+// the session id the enclosing Run was driven with (empty when neither is set).
+//
+// A tool that dispatches background work — the sub-agent spawn tool — passes this
+// as the parent session, so a sub-agent spawned from inside another sub-agent
+// stays attributed to the same top-level graph instead of to an id that owns no
+// graph.
+func FlowOwnerFromContext(ctx context.Context) string {
+	if parent, isBranch := flowBranch(ctx); isBranch {
+		return parent
+	}
+	return SessionFromContext(ctx)
+}

internal/runtime/loop/run.go

@@ -55,7 +55,10 @@ func (l *Loop) Run(ctx context.Context, sessionID string, messages []model.Messa
 	msgs = l.resolveImages(ctx, msgs)
 	toolState := &toolLoopState{prevFP: make(map[string]bool)}
 	res := &Result{}
-	if l.flow != nil {
+	// A branch Run (a sub-agent) folds its spans into the parent session's live
+	// graph; only the owning Run starts and ends a round. Without this a sub-agent
+	// would reset the frontend's single flowGraph and gap the parent's own nodes.
+	if _, isBranch := flowBranch(ctx); l.flow != nil && !isBranch {
 		l.flow.StartRound(sessionID, lastUserText(msgs))
 		defer func() { l.flow.EndRound(sessionID, res.Text) }()
 	}

internal/runtime/loop/session_ctx.go

@@ -20,6 +20,12 @@ func loopSession(ctx context.Context) string {
 	return s
 }
 
+// SessionFromContext returns the session id the enclosing Run is driving, or ""
+// when none was attached. It is exported so a tool executing inside the loop can
+// attribute the work it starts (a spawned sub-agent, a background task) to the
+// conversation that launched it — never inferred from model output.
+func SessionFromContext(ctx context.Context) string { return loopSession(ctx) }
+
 // loopTurnIDKey is the context key for the assistant turn the current Run is
 // producing. The gateway attaches it (WithTurnID) before starting a turn so the
 // streaming events the loop emits can be correlated to that turn by the client.

internal/runtime/loop/spanlog.go

@@ -0,0 +1,118 @@
+package loop
+
+import (
+	"sort"
+	"time"
+
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/agent"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/trace"
+)
+
+// Log event types recorded on a span so the flow graph's node log[] shows what
+// happened at each step (design/19 §1 节点实时日志). An event is appended only when
+// the step really finished, so the log never announces work that did not run.
+const (
+	// EventLLMDone is recorded on an llm_call span once the model call returned.
+	EventLLMDone = "llm.done"
+	// EventToolDone is recorded on a tool_call span once the tool call settled.
+	EventToolDone = "tool.done"
+)
+
+// maxLogSummaryRunes bounds a log value before publication. The graph redacts and
+// truncates again on the way out; this only keeps an individual span small.
+const maxLogSummaryRunes = 240
+
+// recordLLMDone appends a desensitized summary of a finished model call to its
+// span: the configured model, both stop reasons, how many tool calls were
+// requested and how long the call took. No prompt or completion text is recorded,
+// so an llm node's log can never carry conversation content.
+func (l *Loop) recordLLMDone(span *trace.Span, out *stepOutcome) {
+	if span == nil || out == nil {
+		return
+	}
+	props := map[string]any{
+		"stop_reason": out.stopReason,
+		"tool_calls":  len(out.toolCalls),
+		"elapsed_ms":  elapsedMS(span),
+	}
+	if m := l.modelName(out); m != "" {
+		props["model"] = m
+	}
+	if out.modelStopReason != "" {
+		props["model_stop_reason"] = out.modelStopReason
+	}
+	_ = span.Record(trace.Event{Type: EventLLMDone, Props: props})
+}
+
+// recordToolDone appends a desensitized summary of one tool call to its span: the
+// tool name, whether it succeeded, the argument NAMES (never their values), the
+// error kind on failure, and a truncated result summary. Argument values are
+// deliberately omitted — a tool argument is exactly where a credential, a message
+// body or a file path with a secret would appear — and everything recorded here is
+// scrubbed again by the graph before publication.
+func (l *Loop) recordToolDone(span *trace.Span, tc agent.ToolCall, out ToolOutcome) {
+	if span == nil {
+		return
+	}
+	props := map[string]any{
+		"tool":       tc.Name,
+		"ok":         out.Err == nil,
+		"args_keys":  argKeys(tc.Args),
+		"elapsed_ms": elapsedMS(span),
+	}
+	if out.Err != nil {
+		if out.ErrKind != "" {
+			props["error_kind"] = out.ErrKind
+		}
+		props["error"] = trimSummary(out.Err.Error())
+	} else {
+		props["result_summary"] = trimSummary(formatToolResult(out.Result))
+	}
+	_ = span.Record(trace.Event{Type: EventToolDone, Props: props})
+}
+
+// modelName reports the model that served a step: the routed request model when
+// the streaming path knows it, else the loop's configured model. It is empty when
+// neither is available.
+func (l *Loop) modelName(out *stepOutcome) string {
+	if out.model != "" {
+		return out.model
+	}
+	if l.agent == nil {
+		return ""
+	}
+	return l.agent.Model()
+}
+
+// elapsedMS reports how long a span has been open so far. A span's Duration is
+// only stamped by Finish, so a log event recorded before Finish measures it here.
+func elapsedMS(span *trace.Span) int64 {
+	if span == nil || span.StartedAt.IsZero() {
+		return 0
+	}
+	return time.Since(span.StartedAt).Milliseconds()
+}
+
+// argKeys returns a tool call's argument names in sorted order. Only the names are
+// logged; the values stay out of the trace (see recordToolDone).
+func argKeys(args map[string]any) []string {
+	if len(args) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(args))
+	for k := range args {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+// trimSummary shortens a log value to maxLogSummaryRunes runes without splitting a
+// multi-byte rune.
+func trimSummary(s string) string {
+	r := []rune(s)
+	if len(r) <= maxLogSummaryRunes {
+		return s
+	}
+	return string(r[:maxLogSummaryRunes]) + "…"
+}

internal/runtime/loop/step.go

@@ -21,6 +21,10 @@ type stepOutcome struct {
 	// call (Anthropic max_tokens / end_turn / tool_use), recorded on the llm_call
 	// span so a truncation is visible even when the step itself ended normally.
 	modelStopReason string
+	// model is the routed model that served the call, known on the streaming path
+	// (which builds the request itself) and empty on the agent path. It is
+	// recorded on the llm_call span's log event.
+	model string
 }
 
 // step runs a single model call. When an OnStream callback is configured it
@@ -53,6 +57,7 @@ func (l *Loop) step(ctx context.Context, sessionID string, messages []model.Mess
 		l.spanProp(llmSpan, "model_stop_reason", out.modelStopReason)
 	}
 	l.spanProp(llmSpan, "tool_calls", len(out.toolCalls))
+	l.recordLLMDone(llmSpan, out)
 	l.finishSpan(llmSpan, trace.SpanStatusOK)
 	return out, nil
 }

internal/runtime/loop/stream.go

@@ -59,7 +59,9 @@ func (l *Loop) streamStep(ctx context.Context, messages []model.Message) (*stepO
 	}
 
 	if calls, ok := decodeToolCalls(resp); ok {
-		return &stepOutcome{final: false, toolCalls: calls, stopReason: agent.StopReasonToolCalls, modelStopReason: resp.StopReason}, nil
+		return &stepOutcome{final: false, toolCalls: calls, stopReason: agent.StopReasonToolCalls,
+			modelStopReason: resp.StopReason, model: resp.Model}, nil
 	}
-	return &stepOutcome{final: true, text: resp.Content, stopReason: agent.StopReasonStop, modelStopReason: resp.StopReason}, nil
+	return &stepOutcome{final: true, text: resp.Content, stopReason: agent.StopReasonStop,
+		modelStopReason: resp.StopReason, model: resp.Model}, nil
 }

internal/runtime/loop/tools.go

@@ -293,6 +293,7 @@ func (l *Loop) invokeOne(ctx context.Context, d *tool.Dispatcher, tc agent.ToolC
 	}
 	l.emitToolExecution(ctx, tc.Name, phase)
 	out := ToolOutcome{Result: result, Err: err, ErrKind: errorKind(err)}
+	l.recordToolDone(toolSpan, tc, out)
 	if err != nil {
 		l.spanProp(toolSpan, "error", err.Error())
 		l.spanProp(toolSpan, "error_kind", out.ErrKind)

internal/runtime/loop/trace.go

@@ -9,14 +9,15 @@ import (
 // span starts a named span of the given kind when a Tracer is configured, else
 // returns a nil no-op span. The returned context carries the span as the current
 // one so nested spans chain as children. When a FlowPublisher is configured the
-// span's session (threaded via ctx) is stamped as a prop and a running placeholder
+// span's flow owner (the branch parent for a sub-agent Run, else the Run's own
+// session, both threaded via ctx) is stamped as a prop and a running placeholder
 // node is published immediately, so the flow graph shows work in flight.
 func (l *Loop) span(ctx context.Context, name string, kind trace.SpanKind) (context.Context, *trace.Span) {
 	if l.tracer == nil {
 		return ctx, nil
 	}
 	sctx, sp := l.tracer.StartSpan(ctx, name, kind)
-	if sid := loopSession(ctx); sid != "" {
+	if sid := flowOwner(ctx, loopSession(ctx)); sid != "" {
 		_ = sp.SetProp("session", sid)
 		if l.flow != nil {
 			l.flow.SpanStarted(sid, sp)