feat(docker): export driver traces over OTLP

AGENTS.md

@@ -38,6 +38,7 @@ These pipelines connect skills into end-to-end workflows. Individual skill files
 | `crates/openshell-gateway-interceptors/` | Gateway interceptors | Intercepts and transforms configured gRPC requests at the gateway routing boundary |
 | `crates/openshell-ocsf/` | OCSF logging | OCSF v1.7.0 event types, builders, shorthand/JSONL formatters, tracing layers |
 | `crates/openshell-otel/` | OpenTelemetry support | Shared OTLP trace provider, resource, and tracing-layer construction |
+| `crates/openshell-otel-test-support/` | OpenTelemetry test support | Shared loopback OTLP collector fixture for tracing tests |
 | `crates/openshell-core/` | Shared core | Common types, configuration, error handling |
 | `crates/openshell-extension-core/` | Extension core | Shared extension identity, JWT claims, bearer-token rotation, and TLS transport primitives |
 | `crates/openshell-sdk/` | Shared client SDK | Async Rust gateway client (gRPC transport, TLS, OIDC refresh, edge tunnel); consumed by CLI, TUI, and `@openshell/sdk` |

architecture/gateway.md

@@ -707,7 +707,9 @@ inbound request to provide a parent. gRPC status is recorded when response
 trailers arrive.
 
 The gateway forwards OTLP configuration and W3C trace context to managed
-external drivers. Each driver exports under its own service name.
+external drivers. Built-in drivers use dedicated in-process providers that
+preserve the same RPC trace boundary. Each driver exports to the configured
+collector under its own service name.
 
 Two invariants shape the failure behavior. Telemetry is diagnostic, so no OTLP
 failure stops the gateway from serving: a malformed endpoint is logged at

crates/openshell-driver-docker/Cargo.toml

@@ -16,12 +16,16 @@ path = "src/main.rs"
 
 [dependencies]
 openshell-core = { path = "../openshell-core", default-features = false, features = ["driver-extraction"] }
+openshell-otel = { path = "../openshell-otel" }
 
+opentelemetry = { workspace = true }
+tracing-opentelemetry = { workspace = true }
 tokio = { workspace = true }
 tonic = { workspace = true, features = ["transport"] }
 futures = { workspace = true }
 tokio-stream = { workspace = true }
 tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
 bytes = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
@@ -31,13 +35,16 @@ url = { workspace = true }
 clap = { workspace = true }
 miette = { workspace = true }
 toml = { workspace = true }
-tracing-subscriber = { workspace = true }
 
 [dev-dependencies]
+openshell-otel-test-support = { path = "../openshell-otel-test-support" }
+opentelemetry = { workspace = true }
+opentelemetry_sdk = { workspace = true, features = ["testing"] }
 prost-types = { workspace = true }
 tar = "0.4"
 temp-env = "0.3"
 tempfile = "3"
+tracing-subscriber = { workspace = true }
 
 [lints]
 workspace = true

crates/openshell-driver-docker/README.md

@@ -2,6 +2,12 @@
 
 Docker-backed compute driver for local OpenShell gateways.
 
+When the gateway configures `[openshell.gateway.otlp]`, Docker compute-driver
+spans export to the same OTLP/gRPC collector with the service name
+`openshell-driver-docker`. The in-process driver preserves the gateway trace
+context and emits the compute-driver RPC boundary that a standalone driver
+would expose.
+
 The driver manages sandbox containers through the local Docker daemon with the
 `bollard` client. It is intended for developer environments where Docker is
 already available and running Kubernetes would be unnecessary.