diff --git a/lib/components/fabro-sandbox/src/daytona/mod.rs b/lib/components/fabro-sandbox/src/daytona/mod.rs
index 7337d9cf0..2c67d4c9f 100644
--- a/lib/components/fabro-sandbox/src/daytona/mod.rs
+++ b/lib/components/fabro-sandbox/src/daytona/mod.rs
@@ -1554,6 +1554,7 @@ impl Sandbox for DaytonaSandbox {
         Ok(Some((preview.url, headers)))
     }
 
+    #[tracing::instrument(name = "git_op", skip_all, fields(op = "refresh-credentials"))]
     async fn refresh_push_credentials(&self) -> crate::Result<RefreshOutcome> {
         if !self.repo_cloned() {
             return Ok(RefreshOutcome::none());
diff --git a/lib/components/fabro-sandbox/src/docker.rs b/lib/components/fabro-sandbox/src/docker.rs
index 5232487f4..e8440e66b 100644
--- a/lib/components/fabro-sandbox/src/docker.rs
+++ b/lib/components/fabro-sandbox/src/docker.rs
@@ -2216,6 +2216,7 @@ impl Sandbox for DockerSandbox {
         self.origin_url.get().map(String::as_str)
     }
 
+    #[tracing::instrument(name = "git_op", skip_all, fields(op = "refresh-credentials"))]
     async fn refresh_push_credentials(&self) -> crate::Result<RefreshOutcome> {
         if !self.repo_cloned() {
             return Ok(RefreshOutcome::none());
diff --git a/lib/components/fabro-sandbox/src/sandbox.rs b/lib/components/fabro-sandbox/src/sandbox.rs
index d5adfc701..73cbc8d34 100644
--- a/lib/components/fabro-sandbox/src/sandbox.rs
+++ b/lib/components/fabro-sandbox/src/sandbox.rs
@@ -1513,6 +1513,7 @@ pub async fn setup_git_via_exec(
     })
 }
 
+#[tracing::instrument(name = "git_op", skip_all, fields(op = "fetch"))]
 pub(crate) async fn fetch_source_run_ref(
     sandbox: &dyn Sandbox,
     source_run_id: &str,
@@ -1643,6 +1644,11 @@ fn push_failure_looks_auth_shaped(error: &crate::Error) -> bool {
 /// operation. `credentials` is the provider's push-credential state plus the
 /// origin URL; `None` pushes with whatever the remote already carries (the
 /// local sandbox, or a workspace without managed credentials).
+// Async-safe by construction: the span is attached to the future, so it
+// follows the task across worker threads, and the providers' `exec_command:
+// entered` lines inherit it — the log renders as
+// `git_op{op=push}: exec_command: entered ...`.
+#[tracing::instrument(name = "git_op", skip_all, fields(op = "push"))]
 pub(crate) async fn git_push_via_exec(
     sandbox: &dyn Sandbox,
     credentials: Option<(&PushCredentialState, &str)>,
diff --git a/lib/components/fabro-workflow/src/run_metadata.rs b/lib/components/fabro-workflow/src/run_metadata.rs
index 6f18632da..e609fc760 100644
--- a/lib/components/fabro-workflow/src/run_metadata.rs
+++ b/lib/components/fabro-workflow/src/run_metadata.rs
@@ -225,6 +225,7 @@ impl RunMetadataWriterHandle {
         .unwrap()
     }
 
+    #[tracing::instrument(name = "git_op", skip_all, fields(op = "metadata-push"))]
     pub(crate) async fn write_snapshot(
         &self,
         dump: &RunDump,
diff --git a/lib/components/fabro-workflow/src/sandbox_git.rs b/lib/components/fabro-workflow/src/sandbox_git.rs
index 914153955..c6084a977 100644
--- a/lib/components/fabro-workflow/src/sandbox_git.rs
+++ b/lib/components/fabro-workflow/src/sandbox_git.rs
@@ -158,6 +158,7 @@ pub async fn git_checkpoint(
     clippy::too_many_arguments,
     reason = "Checkpointing needs explicit run metadata, checkpoint settings, and author inputs."
 )]
+#[tracing::instrument(name = "git_op", skip_all, fields(op = "checkpoint-commit"))]
 pub(crate) async fn checked_git_checkpoint(
     runtime: &SandboxGitRuntime,
     sandbox: &dyn Sandbox,