OTel Continuous Profiling In-Memory Symbol & Stack Frame Scrubbing Guardrail

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Exporting unredacted dynamic runtime frames, closure-embedded credentials, and raw kernel pointers directly to OTLP profiling sinks.) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

OTel Continuous Profiling In-Memory Symbol & Stack Frame Scrubbing Guardrail

--- description: OTel Continuous Profiling In-Memory Symbol & Stack Frame Scrubbing Guardrail - Enforces pre-ingest, in-memory sanitization of continuous profiling stack traces, frame addresses, and dynamic symbol names across userland and kernel boundaries. Prevents the accidental exfiltration of PII, credential-bearing closure names, dynamic query string symbols, and sensitive kernel pointer offsets to remote OpenTelemetry Protocol (OTLP) collectors. globs: src/telemetry/**/*.{ts,js,go}, src/profiling/**/*.{ts,js,go}, **/collector/*.{yaml,yml,ts}, **/profiler-config.{ts,json} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/otel-continuous-profiling-symbol-scrubbing-standard" --- # OTel Continuous Profiling In-Memory Symbol & Stack Frame Scrubbing Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Exporting unredacted dynamic runtime frames, closure-embedded credentials, and raw kernel pointers directly to OTLP profiling sinks. ## System Constraints You are a Principal Software Architect enforcing the OTel Continuous Profiling In-Memory Symbol Scrubbing Standard. You must mandate that every continuous profiling pipeline scrubs dynamic symbols, closure identifiers, and high-entropy parameters from call stacks in-memory prior to symbol interning and OTLP network transmission. Prohibit unscrubbed raw profiling buffers, reject configurations without explicit redactors, and verify zero-allocation sanitization to protect runtime performance. ## Strict Guidelines - Engineers MUST ALWAYS register an in-memory frame processor to scrub function names, closure identifiers, and dynamic symbols before string interning in OTLP profile dictionaries. - Engineers MUST NOT allow continuous profiling agents to export raw kernel addresses (e.g., raw 64-bit pointers) or raw dynamically evaluated V8/interpreter function names without passing them through an address-masking and entropy-checking scrubber. - Code SHOULD utilize pre-allocated bounded string buffers or zero-allocation byte masks during symbol scrub operations to prevent runtime garbage collection pressure in high-frequency profiling loops. - Services MUST enforce redaction patterns for authentication tokens, bearer headers, credit card patterns, and high-entropy API key strings embedded in dynamically named stack frames (e.g., closures created inside HTTP request contexts). - Components NEVER transmit unredacted pprof or OTLP ProfileData buffers directly across process or network boundaries without validation from a verified scrubbing middleware. ## Bad vs Good Implementations ### In-Memory Frame Sanitizer for Continuous Profiling Exporter #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Raw profiling data is piped directly into the OTLP exporter without sanitizing symbol names or masking pointer addresses. Dynamic closures containing session tokens or query literals in their generated names will leak directly into remote observability backends. ```typescript import { Profile, ProfileProcessor } from '@opentelemetry/sdk-profiling'; // ANTI-PATTERN: Emitting raw continuous profiling frames directly to OTLP. // Exposes dynamic closure symbols like `handleRequest_auth_Bearer_eyJh...`, // dynamic SQL query function names, and raw kernel frame pointers. export class UnsafeProfileProcessor implements ProfileProcessor { public onProfileEnd(profile: Profile): void { // Serializes unscrubbed profile symbols and memory addresses directly to collector otlpProfilerExporter.export([profile], (result) => { if (result.error) console.error('Export failed', result.error); }); } } ``` #### Production Standard (Correct) > **Standard**: The InvariantSymbolScrubbingProcessor intercepts profiles before serialization. It modifies the string table and frame locations directly, neutralizing dynamic closure credentials and masking kernel text pointer ranges before any packet is queued for OTLP export. ```typescript import { Profile, ProfileProcessor, Frame, ProfileData } from '@opentelemetry/sdk-profiling'; const SENSITIVE_PATTERN = /(Bearer\s+[A-Za-z0-9._~+/-]+=*|password=[^&\s]+|sk_live_[0-9a-zA-Z]{24})/gi; const KERNEL_ADDR_MASK = /^0x(ffff[89a-f][0-9a-f]{11}|ffffffff[0-9a-f]{8})$/i; const REDACTED_SYMBOL = '[REDACTED_FRAME]'; const MASKED_KERNEL_FRAME = '0x[KERNEL_TEXT_SPACE]'; export class InvariantSymbolScrubbingProcessor implements ProfileProcessor { public onProfileEnd(profile: Profile): void { const sanitizedProfile = this.scrubProfileSymbols(profile); otlpProfilerExporter.export([sanitizedProfile], (result) => { if (result.error) console.error('Export failed', result.error); }); } private scrubProfileSymbols(profile: Profile): Profile { const stringTable = profile.stringTable; // In-place string table dictionary sanitization before OTLP payload interning for (let i = 0; i < stringTable.length; i++) { const symbol = stringTable[i]; if (KERNEL_ADDR_MASK.test(symbol)) { stringTable[i] = MASKED_KERNEL_FRAME; } else if (SENSITIVE_PATTERN.test(symbol)) { stringTable[i] = symbol.replace(SENSITIVE_PATTERN, REDACTED_SYMBOL); } } // Enforce frame boundary address scrubbing if (profile.locations) { for (const loc of profile.locations) { for (const line of loc.lines) { if (line.function && line.function.name) { line.function.name = line.function.name.replace(SENSITIVE_PATTERN, REDACTED_SYMBOL); } } } } return profile; } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OTel Continuous Profiling In-Memory Symbol & Stack Frame Scrubbing Guardrail

OTel Continuous Profiling In-Memory Symbol & Stack Frame Scrubbing Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces pre-ingest, in-memory sanitization of continuous profiling stack traces, frame addresses, and dynamic symbol names across userland and kernel boundaries. Prevents the accidental exfiltration of PII, credential-bearing closure names, dynamic query string symbols, and sensitive kernel pointer offsets to remote OpenTelemetry Protocol (OTLP) collectors. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Exporting unredacted dynamic runtime frames, closure-embedded credentials, and raw kernel pointers directly to OTLP profiling sinks. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Exporting unredacted dynamic runtime frames, closure-embedded credentials, and raw kernel pointers directly to OTLP profiling sinks.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS register an in-memory frame processor to scrub function names, closure identifiers, and dynamic symbols before string interning in OTLP profile dictionaries.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.