- What does onematrix/tracing-sdk actually do?
- It is a framework-agnostic PHP client with one narrow job: take a payload, canonicalize it (RFC 8785 JCS for JSON, W3C C14N for XML), hash it with Keccak-256, and POST the resulting record to an external Indexer service. Architecturally it is an outbound adapter for tamper-evidence and provenance, not a span-based tracer. Despite the name there is no span model, no sampling, and no context propagation, so set expectations with stakeholders early.
- How do I install onematrix/tracing-sdk in a Laravel application?
- Install it with composer require onematrix/tracing-sdk, then construct the client with your Indexer endpoint and credentials and call the record-emitting method. There is no auto-discovery, service provider, or publishable config, so plan on writing roughly 150 lines of Laravel glue such as a singleton binding and a config file. Verify the required PHP version and HTTP transport before you commit.
- Is onematrix/tracing-sdk a real Laravel package with a service provider and facade?
- No. It ships no service provider, facade, or config stub, so Laravel package auto-discovery does nothing for it. You bind the client yourself in a service provider and inject it wherever records are emitted. Treat it as a plain PHP library that happens to run fine inside a Laravel app.
- Which PHP versions and extensions does onematrix/tracing-sdk require?
- Assume PHP 8.1 or newer given the modern typing, but confirm against composer.json rather than guessing. The highest-risk requirement is Keccak-256: PHP's hash('sha3-256') is not Keccak-256, so expect a polyfill such as kornrunner/keccak, which needs GMP or falls back to a slower pure-PHP implementation. Also check whether it uses Guzzle, Symfony HttpClient, or raw cURL so you can anticipate version conflicts.
- Does onematrix/tracing-sdk correctly implement RFC 8785 JCS and W3C XML C14N?
- The XML side is low risk because PHP's native DOMNode::C14N() is well tested. The JSON side is riskier: JCS requires ECMAScript-compatible number serialization and UTF-16 code-unit key sorting, and PHP's json_encode float handling diverges from that. Ask the maintainer for the RFC reference test vectors and run them yourself before trusting the hashes in production.
- Can I use onematrix/tracing-sdk for distributed tracing with spans, sampling, and context propagation?
- No. There are no spans, no sampling, and no context propagation, so it will not replace OpenTelemetry, Jaeger, or Laravel Telescope. If your actual requirement is observability, this package is the wrong tool despite the name. It fits when you need tamper-evident audit records, chain-of-custody, or document notarization.
- How do I test code that calls onematrix/tracing-sdk in Laravel?
- Because there is likely no Laravel HTTP facade integration, Http::fake() may not intercept the outbound call. Wrap the client behind your own interface and fake that in tests, or inject a mocked PSR-18 or Guzzle handler if the SDK accepts one. Always add a canonicalization fixture test with known hashes so a dependency bump cannot silently change your fingerprints.
- Is it safe to call onematrix/tracing-sdk on a user request path in production?
- No. It makes a blocking HTTP call to the Indexer, so it inherits that service's latency and availability. Dispatch the write from a queued job instead of inline in a controller. Also decide what happens when the Indexer is down, since a failed call means the record never lands.
- Does onematrix/tracing-sdk send payload data or PII to a third party?
- Potentially yes. Canonicalization is not anonymization: the payload is hashed and also transmitted to the Indexer, so any PII in the record leaves your boundary. Confirm exactly which fields are sent and whether the Indexer is self-hosted or operated by someone else. Redact or minimize data before calling the SDK.
- Is onematrix/tracing-sdk actively maintained and safe to depend on in production?
- Treat it as high supply-chain risk: zero stars, zero dependents, and a single maintainer sitting on the write path of your audit records. Pin to an exact commit SHA, vendor the package, and read the code before it touches production. Also note the immutability trap: once records are written, changing canonicalization rules invalidates every prior hash, so the rules behave like a schema you can never migrate.