ReadonlyenabledThe explicit opt-in, and deliberately the LITERAL true rather than a
boolean: this is an acknowledgement, not a toggle. A JavaScript or
configuration-driven caller passing enabled: false is refused at
construction rather than silently opted in.
ReadonlyoperationsExact raw span name → approved display alias. Only spans whose name appears here are observed; the alias replaces the name before anything is retained. At most 128 operations, each alias unique and of the safe alias shape.
ReadonlyserviceThe approved display alias for this service. Never derived from the OTel
resource service.name, which the application may have set to anything.
The opt-in trace-observation policy (M98g).
Span names and tracing relationships are treated as sensitive: only the exact raw span names listed in
operationsare observed, each under its approved display alias, and a span whose name is outside the map is counted and dropped before anything is retained. Span attributes, events, resource labels, tracestate, baggage and exception data are structurally unreachable — the processor reads only the fixed field set the design approves."Safe" is a SHAPE, not secret detection:
serviceAliasand every alias inoperationsare strings of1–64UTF-8 bytes containing no control character, and operation aliases are unique. Approving an exact alias IS authorizing its disclosure.Example
Since
0.8.0