OpenTelemetry W3C Baggage Bounded Propagation & Verification Guardrail

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Unrestricted W3C Baggage Injection Causing Header Explosion and Security Context Spoofing) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

OpenTelemetry W3C Baggage Bounded Propagation & Verification Guardrail

--- description: OpenTelemetry W3C Baggage Bounded Propagation & Verification Guardrail - Unbounded propagation of W3C distributed tracing baggage risks HTTP 431 Request Header Fields Too Large errors across reverse proxies, high memory overhead, and context tampering. Services must enforce strict total-byte quotas, key allowlisting, and cryptographic verification on cross-boundary baggage propagation. globs: src/telemetry/**/*.{ts,js,go,py}, src/middleware/**/*.{ts,js,go,py}, src/tracing/**/*.{ts,js,go,py}, src/lib/telemetry/**/*.{ts,js,go,py} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/opentelemetry-w3c-baggage-bounded-propagation-guardrail-opentelemetry-w3-554" --- # OpenTelemetry W3C Baggage Bounded Propagation & Verification Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Unrestricted W3C Baggage Injection Causing Header Explosion and Security Context Spoofing ## System Constraints You are a Principal Software Architect enforcing production-grade OpenTelemetry W3C Baggage bounded propagation and security guardrails. Reject any unbounded, unauthenticated baggage propagation. Enforce deterministic byte budgets, strict schema allowlists, and cryptographic boundary validation. ## Strict Guidelines - Engineers MUST ALWAYS enforce a hard byte budget (maximum 512 bytes aggregate, maximum 64 bytes per entry) on incoming and outgoing W3C baggage headers. - Engineers MUST NOT propagate raw, unparsed, or untrusted baggage headers directly across trust boundaries without schema validation. - Services MUST validate baggage keys against an explicit runtime allowlist; arbitrary ad-hoc metadata propagation is strictly forbidden. - Edge ingress services MUST strip untrusted external baggage headers or verify an accompanying HMAC signature header before promoting values to tracing context. - Tracing middleware MUST drop non-conforming baggage entries silently or emit structured security drop metrics rather than panicking or crashing requests. - Components NEVER store sensitive PII, authentication tokens, or high-cardinality payloads within W3C baggage. ## Bad vs Good Implementations ### Bounded Baggage Propagator with Quota Enforcement and Key Allowlist #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Default or unconstrained W3C baggage propagation permits upstream callers to inject massive headers or unauthorized keys. This can exceed proxy buffer limits (e.g., Envoy 8KB limit), trigger cascading HTTP 431/502 errors, and cause context poisoning. ```typescript import { W3CBaggagePropagator } from '@opentelemetry/core'; import { Context, TextMapGetter, TextMapSetter } from '@opentelemetry/api'; // ANTI-PATTERN: Blindly propagating arbitrary baggage without byte quotas or schema filtering export class UnsafeBaggagePropagator extends W3CBaggagePropagator { override inject(context: Context, carrier: unknown, setter: TextMapSetter): void { // Directly propagates unbounded baggage, causing HTTP 431 errors downriver super.inject(context, carrier, setter); } override extract(context: Context, carrier: unknown, getter: TextMapGetter): Context { // Allows untrusted external clients to inject unbounded keys and arbitrary payloads return super.extract(context, carrier, getter); } } ``` #### Production Standard (Correct) > **Standard**: The BoundedBaggagePropagator strictly enforces an explicit key allowlist, caps total aggregate bytes to 512 bytes, restricts total entries to 8, and guards against both ingress and egress header bloat. ```typescript import { Context, TextMapGetter, TextMapSetter, baggageEntryMetadataSymbol, propagation } from '@opentelemetry/api'; import { W3CBaggagePropagator } from '@opentelemetry/core'; const MAX_BAGGAGE_BYTES = 512; const MAX_ENTRY_COUNT = 8; const ALLOWED_KEYS = new Set(['tenant.id', 'traffic.tier', 'routing.region']); export class BoundedBaggagePropagator extends W3CBaggagePropagator { override inject(context: Context, carrier: unknown, setter: TextMapSetter): void { const activeBaggage = propagation.getBaggage(context); if (!activeBaggage) return; let boundedBaggage = propagation.createBaggage(); let currentByteCount = 0; let entryCount = 0; for (const [key, entry] of activeBaggage.getAllEntries()) { if (!ALLOWED_KEYS.has(key)) continue; if (entryCount >= MAX_ENTRY_COUNT) break; const entrySize = Buffer.byteLength(key, 'utf8') + Buffer.byteLength(entry.value, 'utf8'); if (currentByteCount + entrySize > MAX_BAGGAGE_BYTES) break; boundedBaggage = boundedBaggage.setEntry(key, entry); currentByteCount += entrySize; entryCount++; } const boundedContext = propagation.setBaggage(context, boundedBaggage); super.inject(boundedContext, carrier, setter); } override extract(context: Context, carrier: unknown, getter: TextMapGetter): Context { const rawHeader = getter.get(carrier, 'baggage'); const headerValue = Array.isArray(rawHeader) ? rawHeader.join(',') : rawHeader; if (headerValue && Buffer.byteLength(headerValue, 'utf8') > MAX_BAGGAGE_BYTES) { // Drop malformed/oversized baggage header early to protect downstream memory return context; } const extractedContext = super.extract(context, carrier, getter); const extractedBaggage = propagation.getBaggage(extractedContext); if (!extractedBaggage) return context; let sanitizedBaggage = propagation.createBaggage(); for (const [key, entry] of extractedBaggage.getAllEntries()) { if (ALLOWED_KEYS.has(key) && entry.value.length <= 64) { sanitizedBaggage = sanitizedBaggage.setEntry(key, entry); } } return propagation.setBaggage(context, sanitizedBaggage); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry W3C Baggage Bounded Propagation & Verification Guardrail

OpenTelemetry W3C Baggage Bounded Propagation & Verification Guardrail defines an industrial-grade behavioral standard for devops engineering. Unbounded propagation of W3C distributed tracing baggage risks HTTP 431 Request Header Fields Too Large errors across reverse proxies, high memory overhead, and context tampering. Services must enforce strict total-byte quotas, key allowlisting, and cryptographic verification on cross-boundary baggage propagation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unrestricted W3C Baggage Injection Causing Header Explosion and Security Context Spoofing Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unrestricted W3C Baggage Injection Causing Header Explosion and Security Context Spoofing	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce a hard byte budget (maximum 512 bytes aggregate, maximum 64 bytes per entry) on incoming and outgoing W3C baggage headers.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.