chronos-ruby 0.1.0.pre.2 → 0.2.0.pre.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 203d12bad0a790efdb2bb89bcbc9127f067fc096507c6345aefbbdc7ed13966c
-  data.tar.gz: 2fb4eb956405f099b10b3e6f9429800446faf24127bc35b3e092dce316c1edb2
+  metadata.gz: 8d204c1595d7029ae32a43aacacdcc561bdc0b264e52a77e8eceb9acd4fa397d
+  data.tar.gz: 99696fa1feee48e384c3563473d1c77786fb2e0c54e261a41cf6778c0ce2468c
 SHA512:
-  metadata.gz: 30be78abcf064b43e2f395c7493f5e7b037c8f1b8ac8dd5a4fc507ea86eae7c89fe0104f094551e3e92d68b4dded9010949fc9a79e43c01880217266bcebaa9c
-  data.tar.gz: 907ba0c16f873d533714b1a06448e857e7a4c8bfcf2b524a150bf0906244d507cf5e6b961d3db219bf63da6d3bf6933474e25360f3715d3e93b0e7d07929db21
+  metadata.gz: 50ba51c92e8436616b1fe56b012d3c9ede3f8e1ec0d50df9a778f9790b876e3bd781c97cf42bac50b08d320e3ab07d8f675dbcdd746f6884d268fc222fc15d52
+  data.tar.gz: 480f16b60ba6162552ffca1f120c6a36d31b5debf639d99060ffda4a052b68d86d68f58849033b227582cf4cd6feac0ade70fe5e0d4e5fcac18148ca463b84bc

data/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes are documented here. The project follows Semantic Versioning
 
 ## [Unreleased]
 
+### Fixed
+
+- release publishing now updates RubyGems to a Ruby 2.6-compatible version that supports `GEM_HOST_API_KEY`.
+- Updated the legacy development toolchain to non-vulnerable Rake and RuboCop versions.
+- legacy CI now resolves Bundler 1.17.3 through `Gem.bin_path` on RubyGems versions that do not support the `_version_` executable selector.
+- documentation verification now reads source and Markdown files explicitly as UTF-8 on legacy container locales.
+
+## [0.2.0.pre.1] - 2026-07-19
+
+### Added
+
+- recursive sensitive-key sanitization with String, Symbol, and Regexp matchers;
+- content detection for Bearer tokens, JWTs, e-mail addresses, CPF, CNPJ, and payment cards;
+- configurable identifier hashing and IPv4 anonymization;
+- bounded safe serialization with cycle and node-budget protection;
+- custom privacy filters with contained failures;
+- privacy contract tests, audit example, module documentation, and filtering benchmark.
+
+### Changed
+
+- all exception fields are sanitized before JSON serialization and transport;
+- configuration snapshots now recursively freeze privacy settings;
+- ADR-005 is accepted for the sanitization boundary.
+
+### Known limitations
+
+- sensitive-data detection is defensive and cannot replace an application privacy review;
+- IPv6 anonymization is not implemented;
+- no retry or backlog;
+- no automatic Rack, Rails, or job integration.
+
 ## [0.1.0.pre.2] - 2026-07-19
 
 ### Changed

data/README.md

@@ -1,10 +1,10 @@
 # Chronos Ruby
 
-Chronos Ruby is the framework-independent client for sending Ruby application errors to Chronos. Version 0.1 is the legacy foundation: it captures exceptions manually, builds a bounded JSON event, and delivers it synchronously or through a fixed-size asynchronous queue.
+Chronos Ruby is the framework-independent client for sending Ruby application errors to Chronos. Version 0.2 is the privacy-focused legacy foundation: it captures exceptions manually, sanitizes sensitive data, builds a bounded JSON event, and delivers it synchronously or through a fixed-size asynchronous queue.
 
 ## What the gem collects
 
-For each exception, version 0.1 can collect:
+For each exception, version 0.2 can collect:
 
 - exception class, message, structured backtrace, and chained causes;
 - timestamp, severity, tags, and an optional fingerprint;
@@ -16,11 +16,11 @@ See [Data collected](docs/data-collected.md) for the complete field table.
 
 ## What is not collected by default
 
-Chronos Ruby does not inspect environment variables, request bodies, cookies, HTTP headers, source code, database contents, or installed gems. Version 0.1 does not automatically sanitize application-supplied context. Do not pass passwords, tokens, cookies, personal documents, or payment data. Advanced redaction belongs to version 0.2.
+Chronos Ruby does not inspect environment variables, request bodies, cookies, HTTP headers, source code, database contents, or installed gems. Application-supplied fields are recursively sanitized, but applications should still avoid sending unnecessary personal, health, financial, or authentication data.
 
 ## Supported Ruby and Rails versions
 
-Version 0.x targets Ruby 2.2.10 through Ruby 2.6. Version 0.1 is independent of Rails and does not yet declare support for any Rails integration. All supported combinations must pass dedicated CI before being listed as supported.
+Version 0.x targets Ruby 2.2.10 through Ruby 2.6. Version 0.2 is independent of Rails and does not yet declare support for any Rails integration. All supported combinations must pass dedicated CI before being listed as supported.
 
 See [Compatibility](docs/compatibility.md).
 
@@ -29,7 +29,7 @@ See [Compatibility](docs/compatibility.md).
 The current public build is a pre-release. Add its exact version to the application's `Gemfile`:
 
 ```ruby
-gem "chronos-ruby", "0.1.0.pre.2"
+gem "chronos-ruby", "0.2.0.pre.1"
 ```
 
 Install with a Bundler version compatible with the application. For the oldest supported runtime:
@@ -47,7 +47,7 @@ gem install chronos-ruby --pre
 
 ## Rails installation
 
-Rails automatic integration is not part of version 0.1. A Rails application may use the plain Ruby API, but this does not constitute declared Rails support. Rack and Rails adapters are planned for later legacy releases.
+Rails automatic integration is not part of version 0.2. A Rails application may use the plain Ruby API, but this does not constitute declared Rails support. Rack and Rails adapters are planned for later legacy releases.
 
 ## Minimum configuration
 
@@ -70,7 +70,7 @@ HTTPS verification is enabled by default. HTTP requires explicitly setting `ssl_
 
 ## Automatic capture
 
-Automatic exception capture is not implemented in version 0.1. Applications must call `Chronos.notify` or `Chronos.notify_sync`. Rack, Rails, and worker hooks will be introduced only after their compatibility suites exist.
+Automatic exception capture is not implemented in version 0.2. Applications must call `Chronos.notify` or `Chronos.notify_sync`. Rack, Rails, and worker hooks will be introduced only after their compatibility suites exist.
 
 ## Manual capture
 
@@ -101,15 +101,26 @@ User data is opt-in and must contain only values your application is allowed to
 Chronos.notify(error, :user => {"id" => "customer-42", "role" => "operator"})
 ```
 
-Avoid names, e-mail addresses, documents, tokens, and other personal or secret fields in version 0.1.
+Version 0.2 sanitizes this context before delivery. Data minimization remains the application's responsibility.
 
 ## Breadcrumbs
 
-Breadcrumbs are not implemented in version 0.1.
+Breadcrumbs are not implemented in version 0.2.
 
 ## Filters and LGPD
 
-Version 0.1 limits depth, collection length, string length, backtrace length, and total payload size. It does not provide the recursive sensitive-data filter planned for version 0.2. Review all supplied context before production use. See [Privacy and LGPD](docs/privacy-lgpd.md).
+Version 0.2 recursively redacts sensitive keys and detects Bearer tokens, JWTs, e-mail addresses, CPF, CNPJ, and valid payment-card candidates in free text. IPv4 addresses are anonymized by default. Applications can add blocklist matchers, hash selected identifiers, or install custom filters:
+
+```ruby
+Chronos.configure do |config|
+  # required options omitted
+  config.blocklist_keys += [:medical_record, /bank_account/i]
+  config.hash_keys += [:customer_id]
+  config.filters << proc { |key, value| key.to_s == "internal_reference" ? "[REMOVED]" : value }
+end
+```
+
+Sanitization runs before queueing and transport. See [Privacy and LGPD](docs/privacy-lgpd.md) for behavior, limitations, health and financial examples, and a payload audit procedure.
 
 ## Ignore rules
 
@@ -122,19 +133,19 @@ Chronos.configure do |config|
 end
 ```
 
-Exception-specific ignore rules are not available in version 0.1.
+Exception-specific ignore rules are not available in version 0.2.
 
 ## Performance monitoring
 
-Request, SQL, cache, job, and external HTTP monitoring are not implemented in version 0.1. The local capture pipeline is bounded and HTTP delivery runs outside the caller thread when `Chronos.notify` is used.
+Request, SQL, cache, job, and external HTTP monitoring are not implemented in version 0.2. The local capture pipeline is bounded and HTTP delivery runs outside the caller thread when `Chronos.notify` is used.
 
 ## Sidekiq and Active Job
 
-Sidekiq and Active Job integrations are not implemented in version 0.1. Calling the manual API from a job is possible, but automatic capture and deduplication are not yet guaranteed.
+Sidekiq and Active Job integrations are not implemented in version 0.2. Calling the manual API from a job is possible, but automatic capture and deduplication are not yet guaranteed.
 
 ## Deploy tracking
 
-Deploy notifications are not implemented in version 0.1. `app_version` may be included in exception events for release correlation.
+Deploy notifications are not implemented in version 0.2. `app_version` may be included in exception events for release correlation.
 
 ## Asynchronous queue
 
@@ -143,7 +154,8 @@ The queue has a fixed capacity and drops the newest event when full. Worker thre
 ```mermaid
 flowchart LR
   E[Exception] --> N[Notice builder]
-  N --> S[Bounded serializer]
+  N --> P[Privacy sanitizer]
+  P --> S[Safe bounded serializer]
   S --> Q[Bounded queue]
   Q --> W[Fixed worker pool]
   W --> H[Net::HTTP transport]
@@ -153,13 +165,13 @@ Use `Chronos.flush(timeout)` to wait for accepted events and `Chronos.close(time
 
 ## Retry and backlog
 
-Version 0.1 classifies network failures, `429`, `4xx`, and `5xx`, but does not retry or persist events. Failed deliveries are dropped after the attempt. Bounded retry and backlog are planned for version 0.3.
+Version 0.2 classifies network failures, `429`, `4xx`, and `5xx`, but does not retry or persist events. Failed deliveries are dropped after the attempt. Bounded retry and backlog are planned for version 0.3.
 
 ## How it works internally
 
 The code follows hexagonal boundaries:
 
-- `Chronos::Core` contains immutable notices and normalization;
+- `Chronos::Core` contains immutable notices, sanitization, and safe normalization;
 - `Chronos::Application` coordinates capture;
 - `Chronos::Ports` defines delivery behavior;
 - `Chronos::Adapters` implements Net::HTTP delivery;
@@ -193,11 +205,12 @@ Configuration errors are raised during `Chronos.configure`. Capture and delivery
 
 ## Benchmark
 
-Run the version 0.1 benchmarks with:
+Run the version 0.2 benchmarks with:
 
 ```bash
 bundle _1.17.3_ exec ruby benchmarks/capture_exception.rb
 bundle _1.17.3_ exec ruby benchmarks/serialization.rb
+bundle _1.17.3_ exec ruby benchmarks/filtering.rb
 bundle _1.17.3_ exec ruby benchmarks/queue.rb
 ```
 
@@ -205,7 +218,7 @@ Results depend on runtime, hardware, and payload. No performance comparison is c
 
 ## Migration from Airbrake
 
-An Airbrake migration guide will be added before the legacy 1.0 release. Version 0.1 does not claim API compatibility or automatic replacement.
+An Airbrake migration guide will be added before the legacy 1.0 release. Version 0.2 does not claim API compatibility or automatic replacement.
 
 ## Local development
 

data/docs/adr/ADR-005-sanitize-before-backlog.md

@@ -2,7 +2,7 @@
 
 ## Status
 
-Proposed for versions 0.2 and 0.3; no backlog exists in 0.1.
+Accepted for version 0.2; no backlog exists yet.
 
 ## Context
 
@@ -10,7 +10,7 @@ Persisting unsanitized events would increase privacy and credential exposure ris
 
 ## Decision
 
-Any future retry or persistent backlog must receive only data that has already passed sanitization and structural limits.
+`PayloadSerializer` must run `Sanitizer` before `SafeSerializer`, queueing, transport, or any future retry and persistent backlog. Raw notices remain transient in process memory and never enter delivery storage.
 
 ## Alternatives
 

data/docs/architecture.md

@@ -1,6 +1,6 @@
 # Architecture
 
-Chronos Ruby 0.1 uses hexagonal boundaries so the legacy core remains independent of frameworks and delivery infrastructure.
+Chronos Ruby 0.2 uses hexagonal boundaries so the legacy core remains independent of frameworks and delivery infrastructure.
 
 ```mermaid
 flowchart TB
@@ -24,7 +24,7 @@ The `Chronos` module is a thin facade. Rails, Rack, ActiveSupport, Sidekiq, and
 
 ## Capture flow
 
-An exception becomes an immutable notice, then a bounded JSON envelope. Asynchronous capture inserts the serialized event into a bounded queue. A fixed worker sends it through the transport. Synchronous capture bypasses the queue.
+An exception becomes an immutable notice. `Sanitizer` removes sensitive values before `SafeSerializer` creates a bounded JSON envelope. Asynchronous capture inserts only that sanitized serialized event into the queue. A fixed worker sends it through the transport. Synchronous capture bypasses the queue but uses the same privacy boundary.
 
 ## Failure policy
 

data/docs/compatibility.md

@@ -11,7 +11,7 @@ Chronos Ruby 0.x is the legacy line. Technical compatibility does not make an en
 | 2.6.10 | None in 0.1 | Best effort | Dedicated CI job pending first successful run |
 | 2.7 and newer | None in 0.x | Unsupported | Belongs to transitional or modern lines |
 
-No Rails version is declared supported by version 0.1. Rails applications may call the plain Ruby API manually. Rails support requires a real example application, framework integration tests, and a successful dedicated matrix job.
+No Rails version is declared supported by version 0.2. Rails applications may call the plain Ruby API manually. Rails support requires a real example application, framework integration tests, and a successful dedicated matrix job.
 
 Status meanings:
 

data/docs/configuration.md

@@ -24,6 +24,11 @@
 | `user_agent` | Optional | Agent version | HTTP user agent |
 | `max_payload_size` | Optional | `1048576` | Maximum serialized payload bytes |
 | `gzip` | Optional | `false` | Compresses request bodies with gzip |
+| `blocklist_keys` | Recommended | Sensitive-key defaults | String, Symbol, or Regexp keys whose values are redacted |
+| `allowlist_keys` | Optional | `[]` | Explicit key-name exceptions; content detection still runs |
+| `hash_keys` | Optional | `[]` | Scalar identifier keys replaced by scoped SHA-256 values |
+| `filters` | Optional | `[]` | Callable application-specific privacy filters |
+| `anonymize_ip` | Recommended | `true` | Replaces the final octet of supplied IPv4 addresses |
 
 ```ruby
 Chronos.configure do |config|
@@ -34,7 +39,11 @@ Chronos.configure do |config|
   config.service_name = "billing"
   config.queue_size = 100
   config.workers = 1
+  config.blocklist_keys += [:medical_record, /bank_account/i]
+  config.hash_keys += [:customer_id]
 end
 ```
 
-The gem never reads all environment variables automatically. The host application decides which values to pass.
+Privacy matcher collections and filters are copied into the immutable runtime snapshot. Matchers must be String, Symbol, or Regexp values, and every custom filter must respond to `call`.
+
+The gem never reads all environment variables automatically. The host application decides which values to pass. See [Privacy and LGPD](privacy-lgpd.md) before adding application context.

data/docs/data-collected.md

@@ -1,20 +1,23 @@
 # Data collected
 
-Version 0.1 emits only manual exception events.
+Version 0.2 emits only manually submitted exception events. All fields pass through the privacy sanitizer and bounded safe serializer before delivery.
 
 | Data | Default | Source |
 |---|---|---|
-| Exception class and message | Collected | Ruby exception |
+| Exception class and sanitized message | Collected | Ruby exception |
 | Structured backtrace | Collected when present | Ruby exception |
-| Cause class and message | Collected when present | `Exception#cause` |
+| Sanitized cause class and message | Collected when present | `Exception#cause` |
 | Ruby version, engine, platform | Collected | Ruby constants |
 | PID and opaque thread ID | Collected | Ruby runtime |
 | Hostname | Collected when available | Standard library |
 | Environment and service | Configuration | Host application |
 | Application version | Optional | Host application |
-| Context, parameters, session, user | Optional | Explicit capture arguments |
-| Tags and fingerprint | Optional | Explicit capture arguments |
+| Context, parameters, session, user | Optional and sanitized | Explicit capture arguments |
+| Tags and fingerprint | Optional and sanitized | Explicit capture arguments |
+| IPv4 address in supplied text | Anonymized | Explicit capture arguments |
 
-The gem never collects request bodies, response bodies, cookies, HTTP authorization headers, environment variables in bulk, source code, SQL bind values, database rows, or installed gems in version 0.1.
+The gem never collects request bodies, response bodies, cookies, HTTP authorization headers, environment variables in bulk, source code, SQL bind values, database rows, or installed gems in version 0.2.
 
-The secret `project_key` is an authentication header and is excluded from the JSON payload and logger diagnostics.
+The secret `project_key` is an authentication header and is excluded from the JSON payload and logger diagnostics. The envelope field named `project_key` contains the public `project_id` required by the current v1 server contract.
+
+See [Privacy and LGPD](privacy-lgpd.md) for redaction rules and the payload audit procedure.

data/docs/examples/plain-ruby.md

@@ -10,3 +10,11 @@ bundle _1.17.3_ exec ruby examples/plain-ruby/example.rb
 ```
 
 The example reports one manual exception and closes the agent with a two-second timeout. Use a local fake endpoint when auditing the payload.
+
+For a network-free privacy audit, run:
+
+```bash
+bundle _1.17.3_ exec ruby examples/plain-ruby/privacy_audit.rb
+```
+
+The example builds the final event locally and demonstrates key redaction, e-mail and Bearer-token detection, application-specific blocklisting, and identifier hashing.

data/docs/modules/async-queue.md

@@ -14,4 +14,4 @@ stateDiagram-v2
   Accepted --> Dropped: queue full
 ```
 
-Version 0.1 has no disk persistence and no retry. Queue statistics expose current size, capacity, accepted events, and dropped events. Tests cover full queues, waiter wakeup, lazy startup, contained failures, timed shutdown, double close, flush, and fork behavior.
+Version 0.2 has no disk persistence and no retry. Only sanitized serialized events enter the queue. Queue statistics expose current size, capacity, accepted events, and dropped events. Tests cover full queues, waiter wakeup, lazy startup, contained failures, timed shutdown, double close, flush, and fork behavior.

data/docs/modules/notice-pipeline.md

@@ -9,12 +9,14 @@ flowchart LR
   NoticeBuilder --> CauseCollector
   NoticeBuilder --> RuntimeInfo
   NoticeBuilder --> Notice
-  Notice --> PayloadSerializer
+  Notice --> Sanitizer
+  Sanitizer --> SafeSerializer
+  SafeSerializer --> PayloadSerializer
   PayloadSerializer --> SerializedEvent
 ```
 
-`Notice` is immutable. Parsers are stateless. The serializer accepts only JSON primitives, bounds nested structures, tolerates invalid encoding, and represents unknown objects without arbitrary `to_json` calls.
+`Notice` is immutable. Parsers are stateless. Raw notice values exist only in process memory. The sanitizer removes sensitive keys and recognized personal data before the safe serializer accepts JSON primitives, bounds nested structures, tolerates invalid encoding, and represents unknown objects without arbitrary application serialization.
 
-Version 0.1 deliberately excludes the advanced sanitizer, sampler, and fingerprint policy. These can be inserted before serialization without changing transport or queue code.
+Version 0.2 deliberately excludes sampling, retry, and fingerprint policy. These can be inserted after sanitization without changing transport or queue code.
 
 Unit and contract tests verify missing backtraces, cyclic causes, invalid encoding, unsafe objects, payload limits, and the v1 envelope.

data/docs/modules/sanitization.md

@@ -0,0 +1,19 @@
+# Sanitization module
+
+`Chronos::Core::Sanitizer` prevents raw secrets and common personal identifiers from crossing the serialization boundary. It is separate from `SafeSerializer`: privacy policy decides what may remain, while serialization decides which Ruby values can safely become JSON.
+
+```mermaid
+flowchart LR
+  Notice --> Envelope
+  Envelope --> Sanitizer
+  Sanitizer --> SafeSerializer
+  SafeSerializer --> JSON
+  JSON --> Queue
+  JSON --> Transport
+```
+
+`Sanitizer` recursively processes hashes and arrays, supports String, Symbol, and Regexp key matchers, anonymizes IPv4 addresses, and optionally hashes selected scalar identifiers. `SensitiveValueFilter` validates and redacts common sensitive patterns in free text. Depth, visited nodes, hash keys, and array items are bounded before safe serialization. Custom filters can remove application-specific fields. A failing filter redacts its field and cannot interrupt the application.
+
+The module deliberately does not inspect global variables, environment variables, request bodies, database records, or arbitrary object methods. Pattern detection can produce false positives or miss domain-specific formats, so applications must extend the blocklist and audit representative payloads.
+
+Tests in `spec/unit/core/sanitizer_spec.rb` cover recursive keys, allowlisting, content detection, hashing, IP anonymization, and filter failure. `spec/contract/privacy_spec.rb` ensures sensitive fixtures never occur in the final JSON payload.

data/docs/modules/serialization.md

@@ -0,0 +1,9 @@
+# Safe serialization module
+
+`Chronos::Core::SafeSerializer` converts sanitized values into JSON primitives without invoking `to_json` or `to_s` on arbitrary application objects. Unknown objects become a class-name placeholder.
+
+The serializer limits depth, visited nodes, hash keys, array items, key bytes, and string bytes. It detects circular hashes and arrays, repairs invalid UTF-8, and contains unreadable values. These structural budgets bound processing time and memory without using asynchronous interruption such as `Timeout` inside application code.
+
+`PayloadSerializer` owns the versioned event envelope and composes `Sanitizer` before `SafeSerializer`. If the resulting JSON exceeds `max_payload_size`, caller-controlled fields are compacted. An event that still cannot fit is rejected before queueing.
+
+The serializer is stateless across calls and safe for concurrent capture. Tests in `spec/unit/core/safe_serializer_spec.rb` and `spec/unit/core/payload_serializer_spec.rb` cover unsafe objects, cycles, invalid encoding, structural limits, and total payload limits.

data/docs/modules/transport.md

@@ -4,6 +4,6 @@
 
 Each event uses bounded open and read timeouts. TLS verification is enabled by default. Authentication and idempotency values are headers. Redirects are not followed. Statuses are classified as success, client error, rate limited, server error, network error, or closed.
 
-The adapter creates a connection per event in version 0.1. This is conservative for legacy applications and avoids shared socket lifecycle state. Batch optimization and retry may be added behind the same port.
+The adapter creates a connection per event in version 0.2. This is conservative for legacy applications and avoids shared socket lifecycle state. Batch optimization and retry may be added behind the same port.
 
 Risks include proxy credential exposure, TLS incompatibility on old operating systems, and endpoint latency. Tests use a local fake HTTP server to verify headers, `2xx`, `429`, `500`, timeout, and invalid TLS behavior.

data/docs/performance.md

@@ -1,16 +1,28 @@
 # Performance
 
-Performance is a functional requirement, but version 0.1 makes no unverified speed claim.
+Performance is a functional requirement, but version 0.2 makes no unverified speed claim.
 
 Current controls:
 
 - backtraces are limited to 200 frames;
 - hashes and arrays are bounded during serialization;
 - strings and total payload size are bounded;
+- sanitizer traversal and serializer node count are bounded by the event structure;
 - the asynchronous queue has fixed capacity;
 - worker count is fixed and threads start lazily;
 - producers never wait for queue capacity;
 - HTTP open and read timeouts are explicit;
 - shutdown and flush have caller-controlled timeouts.
 
-Run the scripts under `benchmarks/` and record Ruby version, operating system, CPU, warmup, iteration count, median, and dispersion before publishing results. Request overhead is not measured because automatic request integration is outside version 0.1.
+Run the scripts under `benchmarks/` and record Ruby version, operating system, CPU, warmup, iteration count, median, and dispersion before publishing results. `benchmarks/filtering.rb` measures the version 0.2 privacy pass. Request overhead is not measured because automatic request integration is outside version 0.2.
+
+## Version 0.2 development measurement
+
+A local diagnostic run on 2026-07-19 used macOS arm64 (`T8103`), legacy x86_64 Ruby builds, 100 warmup iterations, and 500 measured iterations per script:
+
+| Runtime | Asynchronous local capture | Full serialization | Privacy filtering fixture |
+|---|---:|---:|---:|
+| Ruby 2.2.10 | 1,857 µs/event | 4,047 µs/event | 798 µs/pass |
+| Ruby 2.6.3 | 1,904 µs/event | 4,705 µs/event | 1,037 µs/pass |
+
+The capture benchmark uses an in-memory transport and includes queue draining. The serialization fixture contains 20 backtrace frames; the filtering fixture contains nested fields and 20 repeated items. These are single aggregate development runs, not published performance claims: they do not provide median or dispersion and must be repeated on controlled hardware before comparison with another agent.

data/docs/privacy-lgpd.md

@@ -1,16 +1,84 @@
 # Privacy and LGPD
 
-Version 0.1 enforces structural limits but does not yet implement the recursive sensitive-data sanitizer planned for version 0.2.
+Version 0.2 sanitizes every exception event before JSON serialization, queueing, or transport. This reduces accidental exposure, but the host application remains responsible for lawful purpose, minimization, access control, retention, and responses to data-subject requests.
 
-Applications must not pass passwords, tokens, authorization headers, cookies, session secrets, private keys, card data, CPF, CNPJ, health data, or other unnecessary personal information.
+## Default policy
 
-Recommended practice:
+| Data | Default behavior |
+|---|---|
+| Keys such as `password`, `secret`, `token`, `authorization`, `cookie`, `session`, `card_number`, `cpf`, and `cnpj` | Replaced with `[FILTERED]` |
+| Bearer tokens and JWT-like strings | Replaced in free text |
+| E-mail addresses | Replaced with `[FILTERED_EMAIL]` |
+| CPF and CNPJ candidates with valid check digits | Replaced with `[FILTERED_DOCUMENT]` |
+| Payment-card candidates that pass the Luhn check | Replaced with `[FILTERED_CARD]` |
+| IPv4 addresses | Last octet replaced with `0` |
+| Unknown Ruby objects | Represented by class name without calling application serialization |
+| Request/response bodies, cookies, HTTP headers, SQL binds, environment variables | Never collected automatically in version 0.2 |
 
-1. pass opaque internal identifiers instead of names or e-mail addresses;
-2. allowlist context fields in application code;
-3. inspect payloads against a local fake server before production;
-4. keep TLS verification enabled;
-5. document the lawful purpose and retention policy in the SaaS;
-6. disable the agent in environments where collection is not authorized.
+Blocklist matching accepts `String`, `Symbol`, and `Regexp`. String and Symbol matching is case-insensitive after punctuation normalization and also protects namespaced keys such as `user_password`.
 
-Version 0.1 limits object depth, hash keys, array items, string bytes, backtrace frames, queue capacity, and total payload size. Unknown Ruby objects are represented by class name without calling their `to_json` implementation.
+## Configuration
+
+```ruby
+Chronos.configure do |config|
+  # required connection settings omitted
+  config.blocklist_keys += [:medical_record, /bank_account/i]
+  config.allowlist_keys += [:authorization_state]
+  config.hash_keys += [:customer_id]
+  config.anonymize_ip = true
+
+  config.filters << proc do |key, value|
+    key.to_s == "internal_reference" ? "[REMOVED]" : value
+  end
+end
+```
+
+An allowlisted key bypasses only key-name redaction. Content detection remains active, so an allowlisted field containing a Bearer token or e-mail address is still filtered. Identifier hashing uses SHA-256 scoped by the public project identifier. It is irreversible output, but low-entropy identifiers may still be guessable and should not be treated as anonymized data.
+
+Custom filters receive the key and already sanitized value. If a filter raises, that field becomes `[FILTERED]`; the error does not escape into the host application.
+
+## Health applications
+
+Do not send diagnoses, exam results, prescriptions, patient names, or free-form clinical notes. Use a scoped opaque identifier only when it is necessary and authorized:
+
+```ruby
+config.blocklist_keys += [:patient_name, :diagnosis, :clinical_notes]
+config.hash_keys += [:patient_id]
+
+Chronos.notify(error, :context => {
+  "operation" => "schedule_exam",
+  "patient_id" => "internal-opaque-id"
+})
+```
+
+## Financial applications
+
+Do not send cardholder names, full account identifiers, CVV, authentication tokens, or transaction payloads. Prefer categorical operational context:
+
+```ruby
+config.blocklist_keys += [:account_number, :pix_key, :bank_payload]
+config.hash_keys += [:customer_id]
+
+Chronos.notify(error, :context => {
+  "operation" => "authorize_payment",
+  "provider" => "example-gateway",
+  "customer_id" => "internal-opaque-id"
+})
+```
+
+## Payload audit procedure
+
+1. Point `host` to a local fake HTTP server controlled by the development team.
+2. Exercise representative exception paths with synthetic sensitive fixtures.
+3. Inspect the final JSON body, including exception messages and causes.
+4. Search for every fixture value in plaintext.
+5. Add missing application keys to `blocklist_keys` and repeat the audit.
+6. Keep the audit fixtures synthetic and run the privacy contract in CI.
+
+Run the included local example with:
+
+```bash
+bundle _1.17.3_ exec ruby examples/plain-ruby/privacy_audit.rb
+```
+
+The output must contain redaction placeholders and must not contain any fixture secret.

data/docs/troubleshooting.md

@@ -10,7 +10,7 @@ The agent may be unconfigured, disabled, ignored in the current environment, una
 
 ## `Chronos.notify_sync` returns false
 
-Check DNS, TLS certificates, credentials, HTTP status, proxy configuration, and timeout values. Version 0.1 does not retry.
+Check DNS, TLS certificates, credentials, HTTP status, proxy configuration, and timeout values. Version 0.2 does not retry.
 
 ## Events disappear during shutdown
 
@@ -22,4 +22,4 @@ Workers are recreated after a process fork. Configure before or after forking, t
 
 ## Sensitive data
 
-Version 0.1 does not redact arbitrary context. Stop sending the affected field, rotate exposed credentials, and follow the incident process for the Chronos SaaS.
+Stop sending the affected field, rotate exposed credentials, and follow the incident process for the Chronos SaaS. Add the application-specific key to `blocklist_keys`, create a privacy contract fixture, and repeat the local payload audit. Pattern detection is defensive and cannot recognize every domain-specific identifier.

data/lib/chronos/adapters/net_http_transport.rb

@@ -10,14 +10,14 @@ module Chronos
     #
     # @responsibility Send serialized events over bounded HTTPS requests.
     # @motivation Use the Ruby standard library to preserve legacy compatibility.
-    # @limits It classifies failures but does not retry or persist events in version 0.1.
+    # @limits It classifies failures but does not retry or persist events in version 0.2.
     # @collaborators Configuration::Snapshot, SerializedEvent, and TransportResult.
     # @thread_safety Creates a new Net::HTTP connection per call and synchronizes health state.
     # @compatibility Ruby 2.2.10 through Ruby 2.6; no Rails dependency.
     # @example
     #   result = transport.send_event(serialized_event)
     # @errors Network, TLS, and HTTP errors are returned, never raised to callers.
-    # @performance One bounded network request per event in version 0.1.
+    # @performance One bounded network request per event in version 0.2.
     class NetHttpTransport
       EVENT_PATH = "/api/v1/events".freeze
 

data/lib/chronos/application/capture_exception.rb

@@ -2,9 +2,9 @@ module Chronos
   module Application
     # Orchestrates exception normalization, serialization, queueing, and delivery.
     #
-    # @responsibility Execute the version 0.1 exception capture pipeline.
+    # @responsibility Execute the version 0.2 exception capture pipeline.
     # @motivation Keep the public facade and transport adapters free of use-case logic.
-    # @limits It does not implement advanced sanitization, sampling, retry, or backlog.
+    # @limits It does not implement sampling, retry, backlog, or framework hooks.
     # @collaborators NoticeBuilder, PayloadSerializer, WorkerPool, and Transport.
     # @thread_safety Collaborators are immutable or synchronized; calls may run concurrently.
     # @compatibility Ruby 2.2.10 through Ruby 2.6; independent of Rails.