[rocklambros]

11 commit(s) ahead. Merging publishes the site and every schema $id URI. Merge with a merge commit, not a squash: squashing flattens the specification history that makes a schema change reviewable later.

What this ships

This is release 0.1.4. Merging it changes version.txt on main, so tag-release.yml tags v0.1.4. The full list is in the 0.1.4 section of CHANGELOG.md (PR #281).

• Trace specification:
  • the join pair and decision failures, and the OCSF Security Control profile (PR Carry the decision's replay facts and decision failures on Trace #275);
  • the OCSF 1.9.0 pin (PR Pin the OCSF mapping to 1.9.0 and use OCSF's class names #258);
  • per-hook conditional attributes (PR Add per-hook conditional attributes to the OTel mapping #261);
  • skill lifecycle hook mappings (PR Add the skill lifecycle hooks to the Trace mappings #63).
• Reference Guardian:
  • OTLP trace export and the audit converter (PR Export Guardian traces as OTLP to a file and over HTTP #244);
  • the sample trace and the "Produce a trace" walkthrough (PR Commit a sample trace and a walkthrough anyone can run, and fix the collector setup #277);
  • the proxy and rerun fixes (PR Keep a user's proxy exemptions, warn when loopback would reach a proxy, and stop everything before a rerun #279);
  • the trace pipeline docs with diagrams (PR Explain how the reference Guardian produces a trace, with diagrams #280).
• Dependencies: urllib3 2.8.0 (PR deps: bump urllib3 from 2.7.0 to 2.8.0 #202).

The Trace changes are breaking in principle, while the spec version stays v0.1.0. No producer in this repository is affected, because the reference exporter already conforms and nothing here emits OCSF yet.

[rocklambros]

@afogel @bar-capsule, this is the step that ships 0.1.4, and it needs an approval from one of you. It promotes everything from this week from integration to main, and merging it tags v0.1.4. The changes have already been reviewed on their own PRs, which are listed in the description, so this is a check that the set is right, not a line-by-line review. The CHANGELOG's 0.1.4 section is the best single place to read it. Please approve rather than using "Commit suggestion", because a commit here would make you the last pusher. I'll merge it with a merge commit, which is what main requires.

[github-actions]

Thanks for this. It is queued rather than ignored.

This pull request does not reference an issue carrying status:accepted, so a maintainer has not looked at it yet and will not until the underlying issue is triaged. Nothing here is rejected. See Current Priority Scope for what the project is working on, and help wanted for work that is already accepted.

If this is an editorial correction, tick that box in the description and this comment stops applying.

[afogel]

Code-quality nits on the trace exporter, measured against the rest of the reference implementation. None of them is a bug, and the typing is clean: no any, no bare containers, no @ts- suppressions, and it passes bun run typecheck under the strict config. The exporter follows the envelope-log-sink.ts pattern well (total by construction, null object, test seams). The comments mark where it departs from that pattern.

[afogel]

added a few code quality nits, but lgtm

[rocklambros]

@afogel, your approval was dismissed because your six code-quality comments are now in, as PR #289. That pushed new commits to integration, which is this PR's head. Every comment is addressed, with tests for each, and the trace output is identical to before the change in the end-to-end run. Could you re-approve when you get a minute? That's the last step before 0.1.4 ships.