Application instrumentation owns semantics
An instrumented agent can record the model call, tool name, arguments, policy decision, retrieval step, evaluator result, and application-specific identifiers because the code already knows those concepts. Modern agent CLIs demonstrate how rich this can be: Claude Code and Gemini CLI expose detailed OpenTelemetry events for tool calls, decisions, API activity, and selected file operations. A system profiler should not pretend those semantics are inferior.
System observation owns independent execution facts
Once a tool launches a shell, compiler, test runner, package manager, MCP server, browser, or other child, the parent trace contains only what it or the child chooses to emit. AgentSight can add the process family, observed file activity, network destinations, and local resources around that execution. This is especially useful for closed-source CLIs or descendants with no tracing configuration.
The same word can hide different measurement sources
A “file operation” in application telemetry can mean an event emitted by a tool implementation; a system file event means an operating-system-visible operation attributed to a process. A “tool duration” may include approval wait, orchestration, and execution; a child-process duration measures the actual process lifetime. These are complementary measurements, not interchangeable fields.
Use correlation instead of forcing one universal trace
Keep the application trace as the semantic spine when it exists. Add a system profile for questions about descendants and host effects, and correlate by time, command, session, provider request, or another stable run identifier. AgentSight can also export captured model calls as OpenTelemetry GenAI spans, but its own documentation is explicit that tool/workflow spans are not emitted yet, so the two sources should remain distinguishable.
Choose by the question, not by the logo
For prompt quality, evaluation, agent graph, or application business logic, start with application tracing. For “what executable ran?”, “what path was touched?”, “where did this process connect?”, or “what happened in an uninstrumented child?”, start with system observation. Use both when the answer requires intent and effect. The useful architecture is layered rather than winner-take-all.