Guard Trace Context

W3C Trace Context (traceparent + tracestate) shape validator. The agent-trace primitive (v0.9.29) injects traceparent strings into queue envelopes + event-bus payloads + sub-agent calls; consumers extract + start child spans. This guard refuses malformed traceparent strings (cross-boundary tampering, operator bugs, attacker-controlled trace IDs).

W3C Trace Context section 3.2: --- in hex form. v00 is the only currently-defined version; future versions get refused under strict profile.

tracestate (W3C section 3.3) is a comma-separated list of vendor key= value pairs, capped at 32 entries.

b.guardTraceContext.validate(ctx, opts?) #

{
  profile:   "strict" | "balanced" | "permissive",
  posture:   "hipaa" | "pci-dss" | "gdpr" | "soc2",
}

Validate a traceparent + optional tracestate envelope. Returns the input on success; throws on shape refusal.

b.guardTraceContext.validate({
  traceparent: "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
});

b.guardTraceContext.compliancePosture(name) #

Return the effective profile NAME for a compliance posture, or null for a name this parser does not map. Unlike the content-guard variant this returns the resolved profile string (every line-protocol parser composes gateContract.ALL_STRICT_POSTURES, so "hipaa" / "pci-dss" / "gdpr" / "soc2" all resolve to "strict") and never throws — the parser shape carries no overlay-clone, no buildProfile, and no loadRulePack. Wired by gateContract.defineParser.

b.guardTraceContext.compliancePosture("hipaa");                   // → "strict"
b.guardTraceContext.compliancePosture("not-a-regime");            // → null

Last updated 2026-08-08T16:39:49.652Z by seeder.