The WAI server-span middleware for the request stack: one server span per request, built over the handle's tracer and meter providers. When telemetry is disabled it is id — the stack is unchanged and no span is opened — so it is additive and inert exactly as the substrate's off posture requires.

It belongs outermost in the stack so the span covers the whole request, including the other middlewares (see Ecluse.Server).

Instrument a data-plane ManagerSettings so every upstream fetch through the resulting manager opens a client span and carries W3C trace-context headers, or return the settings untouched when telemetry is disabled.

The gate is the handle, not a per-request check: when telemetry is enabled the substrate has installed the process-global providers the http-client instrumentation reads, so the spans hang off the same tracer as everything else; when disabled the settings are returned verbatim and the data plane runs exactly as it would without this layer.

The configuration is dataPlaneInstrumentationConfig, which records no headers, so a forwarded client token never reaches a span.

The http-client instrumentation configuration the data plane uses: the default, which records no request or response headers. This is the secret-scrub guarantee at the configuration boundary — an Authorization header is never lifted onto a span — so it is named rather than inlined, and the scrub test pins the very same value.

Run a rule-evaluation domain span around an action that yields its result and the verdict to record. The span carries the package and version and, from the verdict, the decision and — on a denial — the deciding rule, the reason class, and the human-readable message, so a refusal is explainable from the trace alone.

Inert when telemetry is disabled: the action runs against no span and its result is returned unchanged.

Run a mirror-enqueue domain span around the serve-time hand-off to the asynchronous mirror, carrying the package, version, and the artifact's authoritative URL. A Producer span, since it produces the work the worker later consumes. Inert when telemetry is disabled.

Run a mirror-worker-job domain span around the worker's fetch → verify → publish, carrying the package and version and, once the job finishes, its outcome. A Consumer span (it consumes the enqueued work); the outcome projection names the bounded outcome label and, for a non-success, the detail that sets the span status to Error. Inert when telemetry is disabled.

The projection a caller supplies for the mirror-job span: the bounded outcome label always, and, for a job that did not publish, the detail that marks the span Error. Kept a small record here — rather than the worker's own outcome type — so the tracing layer does not depend on Ecluse.Worker.

Map a serve verdict to the rule-evaluation span's attribute fields. Pure and total.

An Admit records only the decision; a Reject records the decision, the bounded reason class, the human-readable message, and — for a policy denial — the deciding RuleName. None of these fields can carry a secret: the rule name and reason class are a closed vocabulary and the message is the rendered decision, never a credential.