0.1.4

To produce a trace of your own from this release, follow Produce a trace. The committed sample trace shows the output without running anything.

This release changes ACS-Trace for producers and consumers. The specification version stays v0.1.0, so the files at the /schema/v0.1.0/ URIs change in place, and the handshake cannot tell the old rules from the new. Name this release, or its commit, when you claim ACS-Trace conformance.

Changed: Trace (breaking)

• Every step span now requires acs.request_id and acs.session.id. A reader joins the two parties' spans on that pair. An exporter that omits either no longer conforms (PR #275, issue #228).
• The OCSF decision class now requires finding_info, finding_info.title, action_id, action, disposition_id, disposition, evidences and metadata.correlation_uid, and decision events list the security_control profile. defer maps to disposition_id 99. is_alert is true exactly when severity_id is 3 or higher, so deny, ask and defer alert, and allow and modify don't. A decision that arrives late is emitted and flagged in finding_info.types, where it used to be suppressed (PR #275).
• A decision event records the Guardian's verdict, not the enforced outcome. A matching acs.decision.failure in either party's stream means the decision MUST NOT be counted as enforced (PR #275).
• The four policy_references fields and the provenance source_id now require minLength: 1 (PR #275, issue #263).
• The OCSF mapping is pinned to OCSF 1.9.0 and uses its class names. Three rows on class 5001 set activity_id 2, and required_fields includes finding_info (PR #258).

Added

• The acs.decision.failure span event, and the extra acs.decision attributes a reader needs to replay a decision from the trace alone (PR #275).
• Per-hook conditional_attributes in otel-mapping.json (PR #261).
• Trace mappings for the skill lifecycle hooks, steps/skillRegister, steps/skillLoad and steps/skillUnload, in both OpenTelemetry and OCSF (PR #63, issue #57, issue #58).
• The reference Guardian exports OTLP traces to a file and over HTTP, and a converter turns the host adapter's audit log into the same format. It covers the two hook methods the Guardian evaluates and is not an ACS-Trace conformance claim (PR #244, issue #91).
• A committed sample trace, a test that holds the exporter to the mapping, and "Produce a trace", a walkthrough from a fresh clone to a trace file, tested natively and with Docker (PR #277, issue #266).
• "How the reference Guardian produces a trace" on the Trace with OpenTelemetry page, with diagrams of both streams and of one tool call, and a Troubleshooting list in the Guardian README (PR #280).

Changed: reference implementation

• The audit converter's spans carry service.name acs-reference-audit-converter, no longer the Guardian's acs-reference-guardian. A query that filtered on the old value for converter spans needs updating (PR #277, issue #274).
• The converter refuses to write to an output file that already exists and exits 1. It used to append, which could write OTLP lines into the audit log or double every span on a rerun (PR #277).
• otel-collector.yaml stays on loopback, keeps its file across restarts, writes owner-only, and pins its container image by digest (PR #277, issue #276).
• OTEL_TRACES_*, OTEL_SPAN_*, OTEL_ATTRIBUTE_*, OTEL_BSP_* and OTLP compression variables no longer change what the Guardian or the converter exports. OTEL_EXPORTER_OTLP_*HEADERS still apply (PR #277).
• A loopback trace endpoint is added to whichever of NO_PROXY and no_proxy is set, keeping the user's own entries, and the Guardian warns at startup when a proxy is set and loopback isn't exempt. The walkthrough says to stop the Guardian and the collector before deleting .acs (PR #279, issue #274).
• The Guardian's main.ts, not the trace exporter, now reads the proxy environment and applies the loopback exemption, and close() applies the same bounded drain whether trace export is on or off (Ariel's review on PR #286).

Removed

• acs.provenance.lineage_depth and acs.provenance.origins_compacted from the OTel mapping (PR #261).

Changed: dependencies

• urllib3 2.7.0 to 2.8.0 (PR #202).