auditea 0.1.0.beta.3 → 0.1.0.beta.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 587d3b57a35018f55c5e82c15a485715913e911a714971797a47fde50d788251
-  data.tar.gz: beae506f6609e933baa4d4513e9015cc7b11c919a75ed83ba912eeb546aae0e5
+  metadata.gz: 5459c8f22551f101e1aa2f32689bf47623c3ec2890f448ff5dd92c4980ee8c91
+  data.tar.gz: 2fb620c50bc457db6f85df2d1745b1c761e3141571a14451caef9080db109e7c
 SHA512:
-  metadata.gz: 16e6ebde275b1f03f12028ca1c746fdedd9efb907706560ecae52b1fed188e90944f0e827c40e7a1cb909742d381fe37d26deb385ee66d82965c8185444ac99f
-  data.tar.gz: e0c7097c1f146d724befdaf2df850e30a556c670a06406f459003b46a2b52fc77687b36d3fa366d3db4662e13718ddf70ea12698480555858bf51650ee9781c8
+  metadata.gz: faf9f0876938d536fe4aad106bba8b13ee72031ecb78c14d259a9a313eb046c84601b2b0ec3af9cb510d0b9581c7eb142aea169170f364e813b79ef7ae65f32d
+  data.tar.gz: df66f3cab946bb98383c903d550f4f7cf842386e4fea0b2fb11b6d037b4c0a2beee1d652c3381199e9c35a30c743a17039844b68c78494429fc64d04448fbc96

data/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.1.0.beta.4 (unreleased)
+
+### Platform component inventory (AUD-PLATFORM-INVENTORY01)
+
+- Additive optional `evidence.inventory.components[]` on `runtime.inventory` and `host.inventory` (schema_version remains 1)
+- Component fields: `product`, `version`, `scope`, `observation_method`, optional `package` / `evidence`
+- Scopes: `application_runtime`, `application_server`, `database_server`, `linked_library`, `host_os`, `host_component`, `reverse_proxy`, `externally_observed`
+- Runtime: promote Ruby/Rails/Bundler/RubyGems/linked OpenSSL; promote Puma (and peers) from packages; PostgreSQL server via fail-open `SHOW server_version` (never host-attached)
+- Host: OS/kernel components; allowlisted detectors (`openssl version`, `apache2`/`httpd -v`, `nginx -v`) with timeout, bounded I/O, no shell, no sudo
+- Absent reverse proxies are simply not observed (never claimed “not installed”)
+
+### FIX01 hardening
+
+- Detectors resolve allowlisted basenames from fixed trusted system directories only (realpath boundary); never `ENV["PATH"]`
+- Detector evidence is basename + observation metadata only — no raw stdout/stderr
+- Aggregate detector wall-clock budget; hanging children are process-group killed and reaped
+- Rails `after_initialize` schedules existing background inventory refresh (does not block boot)
+- PostgreSQL version uses `connection_pool.with_connection` and releases the checkout
+
+### FIX02 executable trust
+
+- After realpath containment, require root-owned (uid 0) directory and executable
+- Reject group/world-writable directories or executables; reject app-UID-owned material
+- Ordinary `/bin` → `/usr/bin` realpath equivalence remains supported; symlink escapes fail open as not observed
+
+### FIX03 process lifecycle
+
+- After `Process.spawn`, every exit path terminates/reaps the child (ensure-owned cleanup; not timeout-only)
+- Fail-open cleanup tolerates ESRCH / ECHILD / EINTR; no double-wait escape
+
 ## 0.1.0.beta.3 (unreleased)
 
 ### Exception capture parity (AUD-ERROR-PARITY01)

data/README.md

@@ -2,7 +2,7 @@
 
 Ruby / Rails SDK for [AudiTea](https://github.com/reznis/AudiTea) event collection.
 
-Version: **0.1.0.beta.3** (not published yet)
+Version: **0.1.0.beta.4** (not published yet)
 
 Captures durable technical and business evidence. AudiTea **server** owns taxonomy, dictionary, human labels, vulnerability matching, correlation, and reinterpretation.
 
@@ -12,7 +12,7 @@ The SDK does **not** perform vulnerability scanning, OS package/CVE inventory, d
 
 ```ruby
 # Gemfile
-gem "auditea", "0.1.0.beta.3"
+gem "auditea", "0.1.0.beta.4"
 ```
 
 ```bash
@@ -48,6 +48,19 @@ Without a Source token (and with the SDK enabled), capture is skipped (`not_conf
 | `capture_host_inventory` | `true` only if multi-host/container identity matters | Default OFF; enable per environment decision |
 | `capture_requests` | `false` initially | Avoid high-volume request spam on first connect |
 
+Example environment (replace the secret and release id; never commit real tokens):
+
+```text
+AUDITEA_ENDPOINT=https://auditea.ca
+AUDITEA_SOURCE_TOKEN=<secret>
+AUDITEA_RELEASE=<actual deployed SHA>
+AUDITEA_CAPTURE_EXCEPTIONS=true
+AUDITEA_CAPTURE_RUNTIME_INVENTORY=true
+AUDITEA_CAPTURE_HOST_INVENTORY=true
+AUDITEA_RAISE_ERRORS=false
+```
+
+
 ### Optional
 
 Async tuning (`AUDITEA_ASYNC`, batch/flush/queue/timeouts), `AUDITEA_INVENTORY_REFRESH_INTERVAL`, `AUDITEA_HOST_KEY` / `AUDITEA_HOST_LABEL`, `capture_request_params`, `raise_errors` (debug only).
@@ -155,7 +168,7 @@ AUDITEA_CAPTURE_RUNTIME_INVENTORY=true
 # optional: AUDITEA_INVENTORY_REFRESH_INTERVAL=86400
 ```
 
-With Rails, when capture is enabled, the Railtie may emit once after `after_initialize`. Opportunistic Rack refresh only **schedules** a single-flight background job when due — collection/delivery are never inline on the request path.
+With Rails, when capture is enabled, the Railtie **schedules** a single-flight background inventory refresh after `after_initialize` (boot is not blocked on detectors or database work). Opportunistic Rack refresh uses the same scheduler when due — collection/delivery are never inline on the request path.
 
 Enabling inventory reveals internal gem names to AudiTea. Keep it off unless that is intentional.
 

data/RELEASE.md

@@ -1,4 +1,4 @@
-# Release: auditea 0.1.0.beta.3
+# Release: auditea 0.1.0.beta.4
 
 Authoritative runbook for controlled beta publication of the Ruby SDK.
 
@@ -153,10 +153,10 @@ PR status may say `READY FOR HUMAN PUBLICATION REVIEW` while still listing exter
 ```bash
 git checkout main
 git pull
-# confirm VERSION and CHANGELOG still say 0.1.0.beta.3
+# confirm VERSION and CHANGELOG still say 0.1.0.beta.4
 gem build auditea.gemspec
 # inspect package once more
-gem push auditea-0.1.0.beta.3.gem
+gem push auditea-0.1.0.beta.4.gem
 ```
 
 Then mark CHANGELOG released with the publication date in a follow-up commit.
@@ -166,9 +166,9 @@ Then mark CHANGELOG released with the publication date in a follow-up commit.
 ## Post-publication verification
 
 ```bash
-gem install auditea -v 0.1.0.beta.3 --pre
+gem install auditea -v 0.1.0.beta.4 --pre
 ruby -rauditea -e 'puts Auditea::VERSION'
-# expect: 0.1.0.beta.3
+# expect: 0.1.0.beta.4
 ```
 
 Prefer installing the RubyGems artifact (not a git branch) into the controlled TEST app.

data/lib/auditea/host_inventory/collector.rb

@@ -6,6 +6,8 @@ require "rbconfig"
 require "socket"
 require_relative "../inventory/string_bound"
 require_relative "../inventory/digest"
+require_relative "../inventory/components"
+require_relative "component_detectors"
 
 module Auditea
   module HostInventory
@@ -17,7 +19,7 @@ module Auditea
       MAX_FIELD_BYTES = 128
       MAX_HOST_KEY = 128
       HOST_KEY_FORMAT = /\A[A-Za-z0-9._:-]{8,128}\z/
-      MAX_INVENTORY_BYTES = 8_192
+      MAX_INVENTORY_BYTES = 16_384
       OS_RELEASE_PATH = "/etc/os-release"
 
       module_function
@@ -38,11 +40,54 @@ module Auditea
         label = configured_label
         inventory["label"] = label if label
 
+        components = Inventory::Components.compact_list(
+          host_os_components(inventory["platform"]) + ComponentDetectors.collect
+        )
+        inventory["components"] = components unless components.empty?
+
         inventory = enforce_size_bound(inventory)
         inventory["digest"] = Inventory::DigestComputer.compute(inventory)
         inventory
       end
 
+      def host_os_components(platform)
+        list = []
+        os_name = platform["os_name"]
+        os_version = platform["os_version"]
+        if present?(os_name) || present?(os_version)
+          product =
+            if os_name.to_s.match?(/ubuntu/i)
+              "Ubuntu"
+            elsif os_name.to_s.match?(/debian/i)
+              "Debian"
+            elsif present?(os_name)
+              os_name
+            else
+              "Host OS"
+            end
+          version = present?(os_version) ? os_version : "unknown"
+          list << Inventory::Components.build(
+            product: product,
+            version: version,
+            scope: "host_os",
+            observation_method: "os_release"
+          )
+        end
+
+        kernel_name = platform["kernel_name"]
+        kernel_release = platform["kernel_release"]
+        if present?(kernel_release)
+          list << Inventory::Components.build(
+            product: present?(kernel_name) ? "#{kernel_name} kernel" : "Linux kernel",
+            version: kernel_release,
+            scope: "host_os",
+            observation_method: "uname"
+          )
+        end
+
+        list
+      end
+
       def resolve_host_key!
         configured = Auditea.configuration.host_key.to_s.strip
         configured = ENV.fetch("AUDITEA_HOST_KEY", "").to_s.strip if configured.empty?
@@ -224,6 +269,7 @@ module Auditea
         # Drop optional fields first; keep identity + required platform.
         trimmed = inventory.dup
         trimmed.delete("label")
+        trimmed.delete("components")
         trimmed["hardware"] = {}
         trimmed["runtime_context"] = {}
         trimmed

data/lib/auditea/host_inventory/component_detectors.rb

@@ -0,0 +1,312 @@
+# frozen_string_literal: true
+
+require "timeout"
+
+module Auditea
+  module HostInventory
+    # Allowlisted local component detectors.
+    # Fixed argv only — no shell, no sudo, no PATH search, no caller-supplied paths.
+    module ComponentDetectors
+      # Wall-clock budget for the entire collect pass (all detectors/candidates).
+      AGGREGATE_TIMEOUT_SECONDS = 2.5
+      # Per-command cap; also clipped by remaining aggregate budget.
+      PER_COMMAND_TIMEOUT_SECONDS = 1.0
+      MAX_OUTPUT_BYTES = 2_048
+      ALLOWED_BASENAMES = %w[openssl apache2 httpd nginx].freeze
+
+      # Fixed trusted system directories only — never ENV["PATH"] or writable app/tmp dirs.
+      TRUSTED_BIN_DIRS = %w[
+        /usr/bin
+        /bin
+        /usr/sbin
+        /sbin
+        /usr/local/bin
+        /usr/local/sbin
+      ].freeze
+
+      DETECTORS = [
+        {
+          product: "OpenSSL",
+          scope: "host_component",
+          observation_method: "host.openssl_version",
+          candidates: [%w[openssl version]],
+          parser: :parse_openssl
+        },
+        {
+          product: "Apache HTTP Server",
+          scope: "reverse_proxy",
+          observation_method: "host.apache_v",
+          candidates: [%w[apache2 -v], %w[httpd -v]],
+          parser: :parse_apache
+        },
+        {
+          product: "nginx",
+          scope: "reverse_proxy",
+          observation_method: "host.nginx_v",
+          candidates: [%w[nginx -v]],
+          parser: :parse_nginx
+        }
+      ].freeze
+
+      module_function
+
+      def collect
+        deadline = monotonic_now + AGGREGATE_TIMEOUT_SECONDS
+        DETECTORS.filter_map { |detector| detect(detector, deadline: deadline) }
+      rescue StandardError
+        []
+      end
+
+      def detect(detector, deadline: monotonic_now + AGGREGATE_TIMEOUT_SECONDS)
+        detector.fetch(:candidates).each do |argv|
+          break if monotonic_now >= deadline
+
+          output = capture(argv, deadline: deadline)
+          next if output.nil?
+
+          version = send(detector.fetch(:parser), output)
+          next if version.nil? || version.empty?
+
+          return Inventory::Components.build(
+            product: detector.fetch(:product),
+            version: version,
+            scope: detector.fetch(:scope),
+            observation_method: detector.fetch(:observation_method),
+            evidence: {
+              "command" => argv.first.to_s
+            }
+          )
+        end
+        nil
+      rescue StandardError
+        nil
+      end
+
+      # Resolve basename from trusted directories only; execute absolute path + fixed args.
+      def capture(argv, deadline: monotonic_now + AGGREGATE_TIMEOUT_SECONDS)
+        basename = argv.first.to_s
+        return nil unless ALLOWED_BASENAMES.include?(basename)
+
+        remaining = deadline - monotonic_now
+        return nil if remaining <= 0
+
+        executable = resolve_executable(basename)
+        return nil unless executable
+
+        full_argv = [executable] + argv.drop(1).map(&:to_s)
+        timeout_seconds = [PER_COMMAND_TIMEOUT_SECONDS, remaining].min
+        return nil if timeout_seconds <= 0
+
+        run_bounded(full_argv, timeout_seconds)
+      rescue StandardError
+        nil
+      end
+
+      def resolve_executable(basename)
+        return nil unless ALLOWED_BASENAMES.include?(basename)
+        return nil if basename.include?("/") || basename.include?("\\") || basename.include?("\0")
+
+        TRUSTED_BIN_DIRS.each do |dir|
+          next if dir.empty? || dir.include?("\0")
+
+          candidate = File.join(dir, basename)
+          next unless File.file?(candidate)
+          next unless File.executable?(candidate)
+
+          real_dir = begin
+            File.realpath(dir)
+          rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
+            next
+          end
+
+          real_file = begin
+            File.realpath(candidate)
+          rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
+            next
+          end
+
+          # Symlinks must not escape the trusted real directory boundary
+          # (supports ordinary /bin -> /usr/bin realpath equivalence).
+          next unless File.dirname(real_file) == real_dir
+          next unless trusted_material?(real_dir, real_file)
+
+          return real_file
+        end
+        nil
+      rescue StandardError
+        nil
+      end
+
+      # Trust is ownership + mode on the resolved real paths — not directory-name
+      # membership alone. Fail open (reject) when trust cannot be established.
+      #
+      # Policy:
+      # - material must be root-owned (uid 0); app-UID ownership is never enough
+      # - directory and executable must not be group- or world-writable
+      # - caller-configurable paths are never accepted
+      def trusted_material?(real_dir, real_file)
+        dir_stat = stat_path(real_dir)
+        file_stat = stat_path(real_file)
+        return false unless dir_stat && file_stat
+
+        trusted_stats?(dir_stat, file_stat)
+      rescue StandardError
+        false
+      end
+
+      def trusted_stats?(dir_stat, file_stat)
+        return false unless root_owned?(dir_stat) && root_owned?(file_stat)
+        return false if group_or_world_writable?(dir_stat)
+        return false if group_or_world_writable?(file_stat)
+        return false if app_user_owned_untrusted?(dir_stat)
+        return false if app_user_owned_untrusted?(file_stat)
+
+        true
+      end
+
+      def root_owned?(stat)
+        stat.uid.zero?
+      end
+
+      # Root-owned system material remains trusted even when the process euid is 0.
+      # Non-root owners (including the effective application user) are rejected.
+      def app_user_owned_untrusted?(stat)
+        return false if stat.uid.zero?
+
+        stat.uid == Process.euid
+      end
+
+      def group_or_world_writable?(stat)
+        (stat.mode & 0o022).nonzero?
+      end
+
+      def stat_path(path)
+        File.stat(path)
+      rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
+        nil
+      end
+
+      def run_bounded(full_argv, timeout_seconds)
+        out_r, out_w = IO.pipe
+        err_r, err_w = IO.pipe
+        pid = nil
+
+        begin
+          pid = Process.spawn(
+            *full_argv,
+            in: :close,
+            out: out_w,
+            err: err_w,
+            pgroup: true,
+            close_others: true
+          )
+          out_w.close
+          err_w.close
+          out_w = err_w = nil
+
+          stdout = ""
+          stderr = ""
+          status = nil
+
+          Timeout.timeout(timeout_seconds) do
+            stdout = out_r.read(MAX_OUTPUT_BYTES).to_s
+            stderr = err_r.read(MAX_OUTPUT_BYTES).to_s
+            _pid, status = Process.wait2(pid)
+            pid = nil
+          end
+
+          combined = "#{stdout}\n#{stderr}".byteslice(0, MAX_OUTPUT_BYTES).to_s
+          return nil if combined.strip.empty?
+          return nil if status && !status.success? && combined !~ /version|Server version|nginx/i
+
+          combined
+        rescue Timeout::Error
+          nil
+        ensure
+          # Any post-spawn exit path (timeout, other exceptions, early return after wait)
+          # must account for the child while pid remains owned by this method.
+          if pid
+            begin
+              reap_process_group(pid)
+            rescue StandardError
+              nil
+            end
+            pid = nil
+          end
+
+          begin
+            out_w&.close
+          rescue StandardError
+            nil
+          end
+          begin
+            err_w&.close
+          rescue StandardError
+            nil
+          end
+          begin
+            out_r.close
+          rescue StandardError
+            nil
+          end
+          begin
+            err_r.close
+          rescue StandardError
+            nil
+          end
+        end
+      end
+
+      def reap_process_group(pid)
+        return unless pid
+
+        begin
+          Process.kill("KILL", -pid)
+        rescue Errno::ESRCH, Errno::EPERM
+          begin
+            Process.kill("KILL", pid)
+          rescue Errno::ESRCH, Errno::EPERM
+            nil
+          end
+        end
+
+        loop do
+          Process.waitpid(pid)
+          break
+        rescue Errno::ECHILD
+          break
+        rescue Errno::EINTR
+          # Child may still be exiting; retry wait.
+          next
+        end
+      rescue StandardError
+        nil
+      end
+
+      def parse_openssl(output)
+        # OpenSSL 3.0.2 15 Mar 2022
+        if (match = output.match(/OpenSSL\s+([0-9][^\s]*)/i))
+          match[1]
+        end
+      end
+
+      def parse_apache(output)
+        # Server version: Apache/2.4.52 (Ubuntu)
+        if (match = output.match(%r{Apache/([0-9][^\s)]*)}i))
+          match[1]
+        end
+      end
+
+      def parse_nginx(output)
+        # nginx version: nginx/1.18.0 (Ubuntu)
+        if (match = output.match(%r{nginx/([0-9][^\s)]*)}i))
+          match[1]
+        end
+      end
+
+      def monotonic_now
+        Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+    end
+  end
+end

data/lib/auditea/inventory/collector.rb

@@ -3,11 +3,14 @@
 require "digest"
 require "json"
 require_relative "string_bound"
+require_relative "components"
+require_relative "database_server"
 
 module Auditea
   module Inventory
     # Collects a normalized runtime + dependency inventory for AudiTea.
     # Never includes filesystem paths, remote URLs, tokens, or env vars.
+    # rubocop:disable-next Metrics/ModuleLength -- cohesive collector + component promotion
     module Collector
       SCHEMA_VERSION = 1
       MAX_PACKAGES = 400
@@ -15,6 +18,16 @@ module Auditea
       MAX_REQUIREMENT_BYTES = 256
       # Leave headroom under Transport::Limits::SINGLE_MAX_BYTES after envelope/provenance.
       MAX_INVENTORY_BYTES = 110_000
+      PROMOTED_SERVER_GEMS = {
+        "puma" => { "product" => "Puma", "scope" => "application_server" },
+        "unicorn" => { "product" => "Unicorn", "scope" => "application_server" },
+        "passenger" => { "product" => "Phusion Passenger", "scope" => "application_server" }
+      }.freeze
+      PROMOTED_ADAPTER_GEMS = {
+        "pg" => { "product" => "pg (PostgreSQL adapter)", "scope" => "linked_library" },
+        "trilogy" => { "product" => "Trilogy", "scope" => "linked_library" },
+        "mysql2" => { "product" => "mysql2", "scope" => "linked_library" }
+      }.freeze
 
       module_function
 
@@ -41,11 +54,124 @@ module Auditea
         release = Auditea.configuration.release
         inventory["application"] = { "release" => bound_string(release) } if present?(release)
 
+        components = Components.compact_list(
+          runtime_components(inventory) +
+          promoted_gem_components(packages) +
+          [DatabaseServer.collect]
+        )
+        inventory["components"] = components unless components.empty?
+
         inventory = enforce_size_bound(inventory)
         inventory["digest"] = DigestComputer.compute(inventory)
         inventory
       end
 
+      def runtime_components(inventory)
+        list = []
+        runtime = inventory["runtime"] || {}
+        list << Components.build(
+          product: "Ruby",
+          version: runtime["version"],
+          scope: "application_runtime",
+          observation_method: "ruby_constants"
+        )
+
+        framework = inventory["framework"]
+        if framework
+          list << Components.build(
+            product: "Rails",
+            version: framework["version"],
+            scope: "application_runtime",
+            observation_method: "rails_version"
+          )
+        end
+
+        pm = inventory["package_manager"] || {}
+        if present?(pm["rubygems_version"])
+          list << Components.build(
+            product: "RubyGems",
+            version: pm["rubygems_version"],
+            scope: "application_runtime",
+            observation_method: "rubygems_version"
+          )
+        end
+        if present?(pm["bundler_version"])
+          list << Components.build(
+            product: "Bundler",
+            version: pm["bundler_version"],
+            scope: "application_runtime",
+            observation_method: "bundler_version"
+          )
+        end
+
+        openssl = inventory["openssl"] || {}
+        openssl_version = first_present(
+          openssl["library_version"],
+          openssl["build_version"],
+          openssl["extension_version"]
+        )
+        if present?(openssl_version)
+          list << Components.build(
+            product: "OpenSSL",
+            version: openssl_version,
+            scope: "linked_library",
+            observation_method: "ruby_openssl_constants",
+            evidence: {
+              "extension_version" => openssl["extension_version"],
+              "build_version" => openssl["build_version"],
+              "library_version" => openssl["library_version"]
+            }.compact
+          )
+        end
+
+        list
+      end
+
+      def promoted_gem_components(packages)
+        by_name = Array(packages).to_h { |pkg| [pkg["name"].to_s, pkg] }
+        list = []
+
+        PROMOTED_SERVER_GEMS.each do |gem_name, meta|
+          pkg = by_name[gem_name]
+          next unless pkg
+
+          list << Components.build(
+            product: meta["product"],
+            version: pkg["version"],
+            scope: meta["scope"],
+            observation_method: "bundler_package",
+            package: {
+              "ecosystem" => pkg["ecosystem"],
+              "name" => pkg["name"],
+              "version" => pkg["version"]
+            }
+          )
+        end
+
+        PROMOTED_ADAPTER_GEMS.each do |gem_name, meta|
+          pkg = by_name[gem_name]
+          next unless pkg
+
+          list << Components.build(
+            product: meta["product"],
+            version: pkg["version"],
+            scope: meta["scope"],
+            observation_method: "bundler_package",
+            package: {
+              "ecosystem" => pkg["ecosystem"],
+              "name" => pkg["name"],
+              "version" => pkg["version"]
+            }
+          )
+        end
+
+        list
+      end
+
+      def first_present(*values)
+        values.find { |value| present?(value) }
+      end
+
       def runtime_metadata
         {
           "language" => "ruby",

data/lib/auditea/inventory/components.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Auditea
+  module Inventory
+    # Normalized platform/software component observations (inventory only — not vulnerability).
+    module Components
+      SCOPES = %w[
+        application_runtime
+        application_server
+        database_server
+        linked_library
+        host_os
+        host_component
+        reverse_proxy
+        externally_observed
+      ].freeze
+
+      MAX_COMPONENTS = 40
+      MAX_PRODUCT = 128
+      MAX_VERSION = 128
+      MAX_METHOD = 64
+      MAX_EVIDENCE_VALUE = 64
+      # Strict allowlist — never transmit raw command output, paths, or host details.
+      EVIDENCE_KEYS = %w[command adapter].freeze
+
+      module_function
+
+      def build(product:, version:, scope:, observation_method:, package: nil, evidence: nil)
+        return nil unless SCOPES.include?(scope.to_s)
+        return nil if blank?(product) || blank?(version)
+
+        entry = {
+          "product" => truncate(product, MAX_PRODUCT),
+          "version" => truncate(version, MAX_VERSION),
+          "scope" => scope.to_s,
+          "observation_method" => truncate(observation_method, MAX_METHOD)
+        }
+        entry["package"] = package if package.is_a?(Hash) && !package.empty?
+        sanitized = sanitize_evidence(evidence)
+        entry["evidence"] = sanitized if sanitized
+        entry
+      end
+
+      def sanitize_evidence(value)
+        return nil unless value.is_a?(Hash)
+
+        out = {}
+        value.each do |key, child|
+          key_s = key.to_s
+          next unless EVIDENCE_KEYS.include?(key_s)
+          next if child.nil?
+
+          case child
+          when String
+            next if child.empty?
+
+            out[key_s] = truncate(child, MAX_EVIDENCE_VALUE)
+          when Numeric, TrueClass, FalseClass
+            out[key_s] = child
+          else
+            next
+          end
+        end
+        out.empty? ? nil : out
+      end
+
+      def compact_list(list)
+        Array(list).compact.first(MAX_COMPONENTS)
+      end
+
+      def truncate(value, max)
+        StringBound.truncate(value.to_s, max)
+      end
+
+      def blank?(value)
+        value.nil? || value.to_s.strip.empty?
+      end
+    end
+  end
+end

data/lib/auditea/inventory/database_server.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Auditea
+  module Inventory
+    # Fail-open database server version collectors.
+    # Never transmits credentials, connection strings, or DB hostnames.
+    module DatabaseServer
+      module_function
+
+      def collect
+        return nil unless defined?(::ActiveRecord::Base)
+        return nil unless ::ActiveRecord::Base.respond_to?(:connection_pool)
+
+        pool = ::ActiveRecord::Base.connection_pool
+        return nil unless pool.respond_to?(:with_connection)
+
+        pool.with_connection do |connection|
+          return nil unless connection
+
+          adapter = connection.adapter_name.to_s.downcase
+          collector = collector_for(adapter)
+          return nil unless collector
+
+          collector.call(connection)
+        end
+      rescue StandardError
+        nil
+      end
+
+      def collector_for(adapter)
+        case adapter
+        when /postgre/
+          method(:postgresql)
+        end
+      end
+
+      def postgresql(connection)
+        version = nil
+        version = connection.select_value("SHOW server_version") if connection.respond_to?(:select_value)
+        version = version.to_s.strip
+        return nil if version.empty?
+
+        Components.build(
+          product: "PostgreSQL",
+          version: version,
+          scope: "database_server",
+          observation_method: "active_record.show_server_version",
+          evidence: {
+            "adapter" => "postgresql"
+          }
+        )
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/auditea/railtie.rb

@@ -24,9 +24,10 @@ module Auditea
     config.after_initialize do
       at_exit { Auditea.shutdown }
       begin
-        # Startup capture is explicit (force) so long-lived refresh can stay gated.
-        Auditea.capture_runtime_inventory! if Auditea.configuration.capture_runtime_inventory?
-        Auditea.capture_host_inventory! if Auditea.configuration.capture_host_inventory?
+        # Schedule via existing single-flight background refresh — never block boot on
+        # detector processes or database inventory work.
+        Auditea::Inventory.schedule_refresh! if Auditea.configuration.capture_runtime_inventory?
+        Auditea::HostInventory.schedule_refresh! if Auditea.configuration.capture_host_inventory?
       rescue StandardError => error
         Auditea.handle_error(error)
       end

data/lib/auditea/sanitizer.rb

@@ -50,8 +50,18 @@ module Auditea
       path.to_s == "evidence.inventory.packages"
     end
 
+    def inventory_components_path?(path)
+      path.to_s == "evidence.inventory.components"
+    end
+
     def array_limit_for(path)
-      inventory_packages_path?(path) ? INVENTORY_PACKAGES_ARRAY_MAX : DEFAULT_ARRAY_MAX
+      if inventory_packages_path?(path)
+        INVENTORY_PACKAGES_ARRAY_MAX
+      elsif inventory_components_path?(path)
+        40
+      else
+        DEFAULT_ARRAY_MAX
+      end
     end
 
     def deep_sanitize(value, depth:, path:, redacted:)

data/lib/auditea/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Auditea
-  VERSION = "0.1.0.beta.3"
+  VERSION = "0.1.0.beta.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: auditea
 version: !ruby/object:Gem::Version
-  version: 0.1.0.beta.3
+  version: 0.1.0.beta.4
 platform: ruby
 authors:
 - AudiTea
@@ -33,6 +33,7 @@ files:
 - lib/auditea/host_inventory.rb
 - lib/auditea/host_inventory/background_refresh.rb
 - lib/auditea/host_inventory/collector.rb
+- lib/auditea/host_inventory/component_detectors.rb
 - lib/auditea/host_inventory/emitter.rb
 - lib/auditea/instrumentation/active_job.rb
 - lib/auditea/instrumentation/error_subscriber.rb
@@ -43,6 +44,8 @@ files:
 - lib/auditea/inventory.rb
 - lib/auditea/inventory/background_refresh.rb
 - lib/auditea/inventory/collector.rb
+- lib/auditea/inventory/components.rb
+- lib/auditea/inventory/database_server.rb
 - lib/auditea/inventory/digest.rb
 - lib/auditea/inventory/emitter.rb
 - lib/auditea/inventory/string_bound.rb