main is red on all three required checks: opentelemetry 0.33 split from tracing-opentelemetry, and RUSTSEC-2026-0285 (rustls) #166

main (dbeee8a, 2026-09-25) fails all three required checks, so no PR can merge cleanly until it is fixed. Found while landing #164.

1. Compile failure → rust-ci / Cargo check + clippy + fmt and Proof protocol contracts (exit 101)

error[E0277]: the trait bound `SdkTracer: opentelemetry::trace::tracer::Tracer` is not satisfied   (×4)
error[E0599]: the method `init` exists for struct `Layered<OpenTelemetryLayer<…>>`, but its trait bounds were not satisfied

Cause: #162 (a9061f9, Dependabot "bump the opentelemetry group with 3 updates") moved opentelemetry, opentelemetry_sdk and opentelemetry-otlp to 0.33. But tracing-opentelemetry 0.33.0 depends on opentelemetry 0.32.0 (Cargo.lock lists both 0.32.0 and 0.33.0). Its major line runs one ahead of opentelemetry's, so the SDK tracer and the layer use two different Tracer traits.

2. rust-ci / Cargo audit (security) (exit 1)

RUSTSEC-2026-0285 — rustls 0.23.40: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries. Solution: upgrade to >=0.23.45.

Acceptance criteria

• tracing-opentelemetry is on the release that depends on opentelemetry 0.33, or the opentelemetry group is held at 0.32 together. Either way, cargo tree -d -i opentelemetry shows a single version.
• rustls ≥ 0.23.45 in Cargo.lock; cargo audit exits 0.
• The three required checks are green on main.
• The Dependabot opentelemetry group includes tracing-opentelemetry, so the pair cannot be split again.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B2ARtAVppZ7x7mVY5u6nAz