mirrord-header-propagation

1# mirrord Header Propagation Skill
2 
3> mirrord routes traffic to a developer's session by matching a header. The convention is W3C `baggage` with a `mirrord-session=<key>` entry: HTTP filters use `"header_filter": "^baggage: .*mirrord-session={{ key }}.*$"`, and queue splitting filters on a message header or attribute named `baggage`. That only works past the first hop if **every service forwards `baggage` on every outgoing call and every message it publishes**, and every consumer restores it from each message it handles. This skill makes a codebase do that, preferring the observability stack it already has.
4 
5## Security Boundaries
6 
7> **IMPORTANT:** Follow these rules for all operations in this skill.
8 
9- **Code changes only, on a branch:** Edit application code, dependency manifests, and app config in the user's repo. Don't commit to `main`, push, or open PRs unless the user asks.
10- **No infrastructure changes:** Never run `kubectl apply/patch`, `helm upgrade`, `terraform apply`, or cloud CLI commands that modify buckets, topics, queues, subscriptions, or notifications. If a fix needs infra (e.g. a GCS notification payload format, SNS raw delivery), describe it for the user to apply.
11- **Read-only discovery:** `kubectl get`, `aws ... describe/get/list`, `gcloud ... describe/list`, and reading env vars from manifests are fine. Don't read Secret values.
12…