Summary

Add IContextValidator to vet inbound context/header values before the manager rebuilds a context, plus a SizeBoundaryValidator that rejects empty, oversized, or malformed values.

Goal

Make header/queue ingestion safe — validate on entry, treat as untrusted surface, and never trust that headers exist.

Problem

Propagation examples accept inbound headers and immediately rebuild context. Spoofed/oversized/garbled values flow straight into BeginContext. There is no uniform validation gate, so each consumer re-implements the check (see 1.1 spoofing risk and 1.8).

Scope & Results

• IContextValidator abstraction with Validate(..., out errors).
• SizeBoundaryValidator: empty, over-limit, and malformed-value detection.
• Optional key-set allow-list for inbound headers/keys.
• Wire into the middleware/queue examples so invalid context is rejected, not started.
• Unit tests for boundary and malformed inputs.

Design Expectations

• Composes with propagators ([Context]: add distributed context propagation for cross-boundary correlation #10/[Context]: add W3C/B3/composite propagator adapters and queue carriers #12) as the gate before BeginContext.
• Default opt-in; never blocks the path unless a validator is configured.
• Cheap to run; geared toward headers/queues (spoofing & overload).
• Treats inbound values as fully untrusted.

Acceptance Criteria

• Invalid inbound context (empty/oversized/malformed) is rejected before BeginContext.
• Validators are trivially composable (can chain size + proper format).
• No behavior change when no validator is registered.

Non-Goals

• No cryptographic authenticity (HMAC/signature is a later adapter).
• No changes to outbound propagation or core runtime.