feat(traces): W3C trace context ids and traceparent parsing - #949
Open
turnipdabeets wants to merge 2 commits into
Open
turnipdabeets wants to merge 2 commits into
turnipdabeets wants to merge 2 commits into
Conversation
Contributor
Prompt To Fix All With AI### Issue 1
posthog/tracing/_traceparent.py:117-121
**Malformed tracestate members accepted**
`sanitize_tracestate` only checks whether each nonempty member contains `=`, so it accepts empty members, invalid keys, empty values, multiple separators, and duplicate keys. When this value is propagated, downstream W3C implementations may discard the entire header and lose vendor state. Validate each member against the W3C key/value grammar, reject duplicates and empty members, and update the test at `posthog/test/tracing/test_traceparent.py:147-148` that currently requires empty-member preservation.
### Issue 2
posthog/tracing/_traceparent.py:13-15
**Invalid future extensions accepted**
The future-version pattern accepts any printable suffix, including invalid values such as `-extra`, spaces, or a dangling `-`. W3C future extensions are restricted to nonempty lowercase hexadecimal/hyphen fields, so malformed inbound headers can be continued and echoed instead of causing a new trace. Restrict the suffix to the future-version extension grammar and replace the tests at `posthog/test/tracing/test_traceparent.py:35-37` and `posthog/test/tracing/test_traceparent.py:98-102` with valid extension values.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "feat(traces): W3C trace context ids and ..." | Re-trigger Greptile |
Contributor
posthog-python Compliance ReportDate: 2026-09-15 14:21:57 UTC ✅ All Tests Passed!111/111 tests passed Capture_V1 Tests✅ 94/94 tests passed View Details
Feature_Flags Tests✅ 17/17 tests passed View Details
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
This was referenced Sep 14, 2026
turnipdabeets
added this pull request to stack #958
September 14, 2026 23:03
turnipdabeets
marked this pull request as ready for review
September 14, 2026 23:04
marandaneto
reviewed
Sep 15, 2026
marandaneto
left a comment
marandaneto
left a comment
Member
There was a problem hiding this comment.
Automated advisory code review.
Starts the posthog.tracing package with W3C Trace Context: random 16-byte trace ids and 8-byte span ids (never all zeros), and traceparent/tracestate parsing per the spec. A header with uppercase hex, version ff, or a version 00 header with trailing fields is invalid; a higher version is echoed whole. Only the sampled flag is kept. A tracestate with more than 32 members or non-printable characters is discarded, and one over 512 characters is trimmed by whole members. Not reachable from the client. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TkZAsCciW4PV8ZdcCHmAbA
`$` matches before a final newline, so the length check plus `match` accepted a 31-hex trace id or 15-hex span id followed by `\n`. Use `fullmatch` so the validators enforce their contract.
turnipdabeets
force-pushed
the
traces/01-ids-traceparent
branch
from
September 15, 2026 14:17
78a005d to
eafebf9
Compare
marandaneto
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
💡 Motivation and Context
First slice of native tracing for the Python SDK. Starts the
posthog.tracingpackage with W3C Trace Context: random 16-byte trace ids and 8-byte span ids (never all zeros), plustraceparent/tracestateparsing per the spec. Invalid headers (uppercase hex, versionff, version00with trailing fields) are rejected, a higher version is echoed whole, and only the sampled flag is kept. Atracestatewith more than 32 members or non-printable characters is discarded; one over 512 characters is trimmed by whole members.Not reachable from the client yet.
Stack (PR 1 of 9, based on
main):traces/01-ids-traceparent← this PRtraces/02-otlp-encodingtraces/03-span-handlestraces/04-transporttraces/05-pipelinetraces/06-exporttraces/07-span-limitstraces/08-before-span-sendtraces/09-client-wiring💚 How did you test it?
Unit tests in
posthog/test/tracing/test_ids.pyandtest_traceparent.pycover id generation and every header validity rule above.📝 Checklist
If releasing new changes
sampo addto generate a changeset file🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Implemented with Claude Code (Claude Opus 5) against the traces spec, one commit per slice so each PR reviews on its own. Rebased onto main and opened as a stacked draft in a later Claude Code session (Claude Fable 5.1).
🤖 Generated with Claude Code
https://claude.ai/code/session_012o7CtHLfcypjmXL7g9ZGRC