chronos-ruby 1.1.2 → 1.1.4

data/docs/deploy-cli.md

@@ -0,0 +1,36 @@
+# Deploy pela CLI legada
+
+A CLI está incluída na release legada 1.1.4 em preparação. Após sua publicação e instalação, configure pelo ambiente:
+
+```sh
+export CHRONOS_PROJECT_ID=seu-projeto
+# Injete CHRONOS_PROJECT_KEY pelo mecanismo de secrets da publicação.
+export CHRONOS_ENVIRONMENT=production
+export CHRONOS_DEPLOY_ID=identidade-estavel-da-publicacao
+export CHRONOS_DEPLOY_REVISION=revisao-do-artefato-publicado
+bundle exec chronos deploy notify
+```
+
+Não é necessário copiar um script Ruby. A CLI não inicializa Rails e não lê credentials ou initializer. `CHRONOS_SERVICE_NAME` deve corresponder ao serviço do runtime. `CHRONOS_DEPLOY_VERSION` pode substituir a revisão. Host padrão: https://chronosmonitor.com.br; override: CHRONOS_HOST, somente HTTPS sem credenciais, query ou fragmento. TLS mantém a verificação existente.
+
+Aliases: DEPLOY_ENVIRONMENT, SERVICE_NAME, DEPLOY_ID, GIT_SHA e APP_VERSION. Conflitos com ENV canônica são erros. Opções públicas explícitas prevalecem sobre ENV e `config/chronos-deploy.yml`; a chave somente entra por CHRONOS_PROJECT_KEY. YAML aceita apenas project_id, host, environment, service_name, deploy_id, revision e version, com valores string. Nunca grave secrets nesse arquivo.
+
+`deploy diagnose --offline` exige a configuração completa de notify e verifica sua leitura local, sem autenticar credenciais. `deploy verify` usa o receipt existente, sem criar Deployment; receipt não comprova projeção. `--help` e `--version` são locais. `--timeout` aceita 0 < segundos <= 60; tentativas adicionais do transporte e backlog são desativados na CLI. O timeout limita operações do transporte e flush, não é um deadline global do processo.
+
+Saída operacional JSON schema_version=1: success e state; erros de configuração incluem orientação estática e, quando necessário, missing_fields. Verify acrescenta verification_status do contrato de receipt. Códigos: 0 sucesso local ou entrega confirmada pela gem, 1 configuração/uso inválidos, 2 entrega não confirmada, 3 falha interna. `--on-error=warn` converte somente entrega não confirmada em status 0 e preserva success=false. Um false pode acontecer após aceite remoto; não faça retry cego. Reenvio com mesmo deploy ID pode consumir outro evento; dependências podem adicionar eventos. Não há garantia de cobrança única.
+
+Gere integrações explicitamente:
+
+```sh
+bundle exec chronos deploy install --provider kamal --dry-run
+bundle exec chronos deploy install --provider kamal
+bundle exec chronos deploy install --provider kamal --check
+```
+
+Providers: kamal, capistrano, github-actions, gitlab-ci, jenkins, azure-devops. Use `--root PATH` para destino explícito. O generator `rails generate chronos:deploy:install --provider=kamal` usa o mesmo instalador. Arquivos iguais não mudam; conflitos falham. A resposta de conflito oferece a proposta de template, omitindo o conteúdo anterior por privacidade. Faça merge manual antes de considerar `--force`. Symlinks no caminho de destino são rejeitados. O instalador usa operações relativas a descritores de diretórios POSIX (Linux/macOS), sem mudar o diretório global do processo, para impedir redirecionamento por troca concorrente de symlinks. Leituras de arquivos existentes são limitadas a 64 KiB e não seguem symlinks. A raiz deve pertencer a um contexto de publicação confiável; isso não protege contra uma conta local já autorizada a modificar o projeto inteiro. Nenhum pipeline é ativado automaticamente.
+
+Kamal cria .kamal/hooks/post-deploy; Capistrano cria lib/capistrano/tasks/chronos_deploy.rake após deploy:published, localmente uma vez. Não combine com chronos/capistrano. Os quatro CI criam fragmentos em config/chronos/deploy: faça merge no job real depois da publicação bem sucedida, exportando identidade e revisão do artefato efetivamente publicado. O template GitLab é oculto e precisa ser incorporado ao job existente.
+
+Aplicações antigas continuam usando API/receitas existentes até confirmar a capability da versão instalada. O SaaS deve selecionar a receita por faixa explícita de versões, sem remover scripts customizados. Publicação, backport e promoção dependem dos gates em docs/adr/legacy-deploy-cli.md.
+
+Preparação de testes: [guia Docker para macOS](legacy-test-environment.md). Não é necessário instalar Rubies antigos ou alterar o Bundler global do Mac.

data/docs/legacy-test-environment.md

@@ -0,0 +1,59 @@
+# Preparar o ambiente de testes legado no macOS
+
+Este procedimento testa a trilha `legacy/1`. Não publica a gem nem usa credenciais reais do SaaS.
+
+## 1. Iniciar Docker Desktop
+
+Instale ou atualize a edição correspondente ao processador do Mac, conforme a [documentação oficial](https://docs.docker.com/desktop/setup/install/mac-install/). Abra o aplicativo e aguarde o engine iniciar:
+
+```sh
+open -a Docker
+docker version
+docker info
+```
+
+`docker version` precisa mostrar Client e Server. Se aparecer erro no socket ou “Cannot connect”, o engine ainda não está disponível. Confirme o contexto com `docker context ls`; selecione o contexto local do Docker Desktop caso outro contexto esteja ativo.
+
+## 2. Entrar no repositório e executar o primeiro Ruby
+
+```sh
+cd /Users/antoniojefferson/Develop/Projects/Rails/chronos-ruby
+sh script/test_legacy_docker 2.2.10
+```
+
+O helper usa linux/amd64 explicitamente para uniformizar as imagens antigas em Mac Intel e Apple Silicon. A [documentação de plataformas do Docker](https://docs.docker.com/build/building/multi-platform/) explica a emulação; ela pode ser mais lenta.
+
+O repositório é montado somente para leitura. O helper copia os arquivos para /work no container, exclui configuração local do Bundler, .git, .aws e .env, e remove somente os lockfiles dessa cópia. Isso é necessário porque o lockfile atual do repositório foi gerado com ferramentas modernas e não corresponde ao gemspec legado. Nenhum lockfile local é alterado.
+
+O container instala Bundler 1.17.3 e resolve as dependências do gemspec, incluindo Rake 12.3, RuboCop 0.49 e Minitest 5.10.3. O script executa a suíte existente, os testes da CLI/adaptadores/receptor HTTPS e o smoke da gem instalada. Certificado de teste é gerado temporariamente e explicitamente confiado; verificação TLS não é desligada.
+
+## 3. Executar a matriz Ruby completa
+
+```sh
+for version in 2.2.10 2.3.8 2.4.10 2.5.9 2.6.10; do
+  sh script/test_legacy_docker "$version" || break
+done
+```
+
+Pare no primeiro erro e preserve o log. Uma execução interrompida não aprova os demais Rubies. Registre por imagem: versão Ruby, OpenSSL/JSON, resultado da suíte e resultado do pacote instalado.
+
+## 4. Executar os pares Rails suportados
+
+```sh
+sh script/test_legacy_docker 2.2.10 examples/rails-4.2
+sh script/test_legacy_docker 2.3.8 examples/rails-4.2
+sh script/test_legacy_docker 2.5.9 examples/rails-5.2
+sh script/test_legacy_docker 2.6.10 examples/rails-5.2
+```
+
+Esses comandos executam o smoke existente da aplicação e o novo smoke do generator de deploy, em diretório temporário. Eles não ampliam os pares suportados.
+
+## 5. Tratar falhas de preparação
+
+- Falha no pull ou acesso a rubygems.org: verificar conexão, proxy e disponibilidade do registro.
+- Erro de certificado/OpenSSL nas imagens antigas: registrar imagem e mensagem, corrigir CA ou preparar imagem derivada com certificados confiáveis compatíveis. Não usar HTTP, ssl_verify=false ou mirrors sem validação TLS.
+- Dependência incompatível: identificar a dependência e fixar versão compatível na definição da imagem/matriz antes de repetir. Não modernizar o gemspec legado para fazer o teste passar.
+- Erro de arquitetura: confirmar execução linux/amd64 e suporte de emulação no Docker Desktop.
+- Erro RuboCop/RSpec/CLI: é resultado da validação do código, não falha de instalação; corrigir antes de promover a release.
+
+O helper prepara execuções isoladas, mas ainda não substitui imagens reproduzíveis fixadas por digest e dependências resolvidas por runtime. A aprovação final da matriz deve preservar esses registros. Depois dos gates locais, permanecem os testes SaaS de receipt/ingestão/ledger/projeção e os smokes autorizados dos fornecedores.

data/docs/modules/sidekiq-legacy.md

@@ -1,10 +1,10 @@
 # Sidekiq 4/5 legacy integration
 
-Version `0.6.0.pre.1` starts the legacy jobs line with optional Sidekiq 4 and 5 client and server middleware. Version `1.1.2` installs it automatically when Sidekiq is available in a Rails application:
+Version `0.6.0.pre.1` starts the legacy jobs line with optional Sidekiq 4 and 5 client and server middleware. Version `1.1.3` installs it automatically when Sidekiq is available in a Rails application:
 
 ```ruby
 gem "sidekiq", "~> 5.0"
-gem "chronos-ruby", "~> 1.1.2", :require => "chronos/rails"
+gem "chronos-ruby", "~> 1.1.4", :require => "chronos/rails"
 ```
 
 Plain Ruby applications continue to use `require "chronos/sidekiq"` explicitly. Both entry points install middleware through the public `configure_client` and `configure_server` APIs. They do nothing when Sidekiq is unavailable, and the framework-independent core never requires Sidekiq. Installation adds no Chronos thread or Redis/database connection per job; delivery continues through the agent's existing fixed worker pool.

data/docs/release-1.1.3-readiness.md

@@ -0,0 +1,22 @@
+# Version 1.1.3 release evidence
+
+Version `1.1.3` is a backward-compatible documentation and package-metadata maintenance release of the stable legacy line. It clarifies that the gem captures exceptions, metrics, and telemetry from Ruby and Rails applications and identifies https://chronosmonitor.com.br as the official Chronos Monitor platform for receiving and visualizing those observability signals.
+
+The release preserves Ruby 2.2.10–2.6.10, Rails 4.2/5.2, Sidekiq 4.2.10/5.2.10, and protocol `schema_version: "1.0"`. It changes no runtime behavior, public API, collected field, framework dependency, or compatibility claim.
+
+## Required gates
+
+- complete unit, integration, contract, privacy, concurrency, transport, and lint suite on Ruby 2.2.10–2.6.10;
+- real Rails 4.2 applications on Ruby 2.2.10/2.3.8 and Rails 5.2 applications on Ruby 2.5.9/2.6.10;
+- real Sidekiq 4.2.10 and 5.2.10 client/server middleware smoke tests;
+- documentation and pull request description verification;
+- dependency audit with the CI-pinned tooling;
+- repeatable query-analysis and Rack benchmarks plus the bounded fake-endpoint privacy/load gate;
+- gem build, package inspection, SHA-256 checksum, SPDX SBOM, and RubyGems Trusted Publishing.
+
+The release tag must be exactly `v1.1.3` and match `Chronos::VERSION`. Do not publish manually. After the reviewed commit and all gates are green:
+
+```bash
+git tag v1.1.3
+git push origin v1.1.3
+```

data/docs/release-1.1.4-readiness.md

@@ -0,0 +1,44 @@
+# Version 1.1.4 release preparation
+
+Version `1.1.4` prepares deploy automation for the stable legacy line. It packages the `chronos` CLI, explicit ENV/YAML configuration, optional provider installers and Rails/Rake adapters. It preserves Ruby >= 2.2.10 and < 2.7, the existing Rails/Sidekiq pairs, and protocol `schema_version: "1.0"`. This is a limited maintenance exception; it does not reopen general feature development on the legacy line.
+
+## Operational contract
+
+- No notification, generator execution, or application file changes on install, require, help, or version.
+- Notify requires explicit project credentials, environment, stable publication ID, and actual published revision/version. It uses `Chronos.notify_deploy` and always closes the agent.
+- Verify reuses `Chronos.verify_integration`, validates its receipt, disables dependency reporting, and does not create a deploy. A receipt is not proof of SaaS projection.
+- CLI transport requires verified HTTPS. Retries and backlog are disabled for this short-lived process; transport and flush operations have bounded timeouts, not a single global process deadline.
+- Exit codes: 0 confirmed/local success, 1 invalid configuration, 2 unconfirmed delivery, 3 internal failure. Warning policy only converts code 2 to 0 and retains `success=false`.
+- Repeated notify calls keep deployment identity but can generate another event and consumption. Dependency events can add consumption. Do not retry blindly after an unconfirmed result.
+- Installers preserve conflicting files, offer a privacy-safe proposed template, and reject destination symlinks. POSIX descriptor-relative operations prevent parent-path swaps from redirecting creation or publication. CI fragments require manual merge after the actual publication.
+
+## Evidence and pending gates
+
+Local Ruby 3.4 checks are supplementary evidence only. They do not establish compatibility with the supported legacy runtimes.
+
+Before tagging, require:
+
+- core suite, CLI, transport, privacy, shutdown/fork, and RuboCop 0.49 gates on Ruby 2.2.10, 2.3.8, 2.4.10, 2.5.9, and 2.6.10;
+- Rails 4.2 on Ruby 2.2.10/2.3.8 and Rails 5.2 on Ruby 2.5.9/2.6.10, including deploy generator smoke;
+- Sidekiq 4.2.10 on Ruby 2.2.10 and Sidekiq 5.2.10 on Ruby 2.5.9;
+- built gem installed into clean supported runtimes, executable/help/offline diagnostics and HTTPS notification/receipt tests;
+- dependency audit with the CI-pinned tooling, documentation and PR-body verification;
+- query-analysis/Rack benchmarks and fake-endpoint load/privacy gates;
+- authorized provider smoke tests and SaaS evidence for receipt, ingestion, identity, consumption, and projection; keep these distinct;
+- reviewed source, package inspection, checksum, SPDX SBOM, and maintainer approval.
+
+Use the [Docker test instructions](../README.md#tests). The working-tree lockfile originated from modern tooling; the isolated Docker helper resolves dependencies only in its container copy. It does not prove the direct CI workflow's dependency resolution will pass; that remains a required check.
+
+## SaaS rollout and transitional backport
+
+The CLI capability is introduced by legacy release `1.1.4`. The transitional main-line backport is not included in this release. The SaaS must select recipes using explicitly validated release ranges for each line, never a single cross-line minimum. Keep old script recipes for older clients and do not delete customer-edited scripts.
+
+## Publication
+
+No release has been published by this preparation. Never replace previously published artifacts. After all gates and approval, the release tag must be exactly `v1.1.4` and match `Chronos::VERSION`. Pushing that tag triggers the release workflow and its publication job; do not create or push it before approval. Publish through the configured Trusted Publishing workflow rather than a manual gem push.
+
+## Security regression coverage
+
+`spec/security/` covers SQL literal confidentiality through the final APM envelope, complete original-query validation before inspection, sensitive symbols through final serialization, cyclic/deep diagnostic input and caller ownership, and deterministic symlink/concurrent-file interleavings. Conservative SQL handling omits oversized or ambiguous queries; plan evidence remains best effort. The installer uses fixed POSIX calls through standard-library Fiddle and does not execute shell commands. Unsupported filesystem backends must fail closed.
+
+Security-fix validation: the core/security suite passed on MRI 2.2.10, 2.3.8, 2.4.10, 2.5.9 and 2.6.10 in isolated Linux/amd64 containers: 221 RSpec examples, the complete RuboCop 0.49.1 inspection (225 files), 25 standalone source tests (127 assertions), gem build/install, local diagnostics, and six installed-executable HTTPS tests (36 assertions) per runtime. The expanded installed-gem smoke also verifies explicit Kamal hook generation and idempotent check in a path containing spaces. These results do not close the separate Rails/Sidekiq, supplier, SaaS, audit, benchmark, or remote CI gates.

data/docs/troubleshooting.md

@@ -56,7 +56,7 @@ Require `chronos/capistrano` after the Capistrano/Rake task DSL is loaded. The i
 
 ## Sidekiq telemetry is missing
 
-In Rails, require `chronos/rails` and configure Chronos before jobs run; version 1.1.2 detects Sidekiq and installs its public client/server middleware automatically. In plain Ruby, require `chronos/sidekiq` explicitly after Sidekiq is available. Sidekiq remains optional in both cases. A job already enqueued before client middleware installation may lack propagated trace context, but server timing and failure capture can still run.
+In Rails, require `chronos/rails` and configure Chronos before jobs run; version 1.1.3 detects Sidekiq and installs its public client/server middleware automatically. In plain Ruby, require `chronos/sidekiq` explicitly after Sidekiq is available. Sidekiq remains optional in both cases. A job already enqueued before client middleware installation may lack propagated trace context, but server timing and failure capture can still run.
 
 ## A failed Sidekiq job appears twice
 

data/exe/chronos

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require "chronos/cli"
+exit Chronos::CLI.new.run(ARGV)

data/lib/chronos/agent.rb

@@ -242,12 +242,17 @@ module Chronos
     end
 
     def context_for_capture(additional)
-      merged = deep_merge(context_hash(@context_store.get), context_hash(additional))
+      current = context_hash(@context_store.get)
+      additions = context_hash(additional)
+      buffer = breadcrumb_buffer(additions) || breadcrumb_buffer(current)
+      copier = Core::BoundedCopy.new
+      merged = deep_merge(copier.call(current), copier.call(additions))
       merged.delete(:__chronos_captured_exceptions)
       merged.delete("__chronos_captured_exceptions")
       merged.delete(:__chronos_captured_events)
       merged.delete("__chronos_captured_events")
-      buffer = merged.delete(:__chronos_breadcrumbs) || merged.delete("__chronos_breadcrumbs")
+      merged.delete(:__chronos_breadcrumbs)
+      merged.delete("__chronos_breadcrumbs")
       if buffer.respond_to?(:to_a)
         merged[:context] = context_hash(merged[:context]).merge("breadcrumbs" => buffer.to_a)
       end
@@ -256,9 +261,13 @@ module Chronos
       context_hash(additional)
     end
 
+    def breadcrumb_buffer(context)
+      context[:__chronos_breadcrumbs] || context["__chronos_breadcrumbs"]
+    end
+
     def telemetry_context(additional)
       merged = context_for_capture(additional)
-      context = context_hash(merged.delete(:context) || merged.delete("context"))
+      context = context_hash(merged.delete(:context) || merged.delete("context")).dup
       parameters = merged.delete(:parameters) || merged.delete("parameters")
       user = merged.delete(:user) || merged.delete("user")
       context["parameters"] = parameters if parameters.is_a?(Hash) && !parameters.empty?
@@ -266,9 +275,11 @@ module Chronos
       context.merge(merged)
     end
 
-    def deep_merge(left, right)
+    def deep_merge(left, right, depth = 0)
+      return {} if depth >= Core::BoundedCopy::MAX_DEPTH
+
       left.merge(right) do |_key, old_value, new_value|
-        old_value.is_a?(Hash) && new_value.is_a?(Hash) ? deep_merge(old_value, new_value) : new_value
+        old_value.is_a?(Hash) && new_value.is_a?(Hash) ? deep_merge(old_value, new_value, depth + 1) : new_value
       end
     end
 

data/lib/chronos/cli.rb

@@ -0,0 +1,117 @@
+require "optparse"
+require "json"
+require "chronos/version"
+require "chronos/deploy/configuration"
+require "chronos/deploy/installer"
+
+module Chronos
+  # @responsibility Parse explicit deployment commands and return sanitized operational results.
+  # Local command parser; operational responses use a versioned, allowlisted JSON envelope.
+  class CLI
+    HELP = "chronos deploy notify|verify|diagnose --offline|install --provider NAME\n" \
+           "Options: --root PATH, --project-id ID, --environment NAME, --service-name NAME,\n" \
+           "--deploy-id ID, --revision SHA, --version VERSION, --host URL, --timeout SECONDS,\n" \
+           "--json, --on-error=warn, --dry-run, --check, --force\n" \
+           "Project key: CHRONOS_PROJECT_KEY only. No application boot.\n" \
+           "Exit: 0 confirmed/local success; 1 invalid configuration; 2 unconfirmed delivery; 3 internal failure.\n" \
+           "warn returns 0 for unconfirmed delivery, retaining success=false. Never retry blindly.\n".freeze
+
+    def initialize(output = $stdout, env = ENV)
+      @output = output
+      @env = env
+    end
+
+    def run(arguments)
+      args = arguments.dup
+      return local(HELP) if help?(args)
+      return local(Chronos::VERSION) if args == ["--version"]
+      raise ArgumentError unless args.shift == "deploy"
+
+      command = args.shift
+      raise ArgumentError unless %w(notify verify diagnose install).include?(command)
+
+      options = parse_options(args)
+      return local(HELP) if options[:help]
+      raise ArgumentError unless args.empty? && options[:timeout] > 0 && options[:timeout] <= 60
+
+      validate_options!(command, options)
+      execute(command, options)
+    rescue Deploy::Error => e
+      result(false, "invalid_configuration_or_usage", 1, e.details.merge(:message => e.message))
+    rescue OptionParser::ParseError, ArgumentError, Psych::Exception
+      result(false, "invalid_configuration_or_usage", 1,
+             :message => "Invalid options or public configuration; see chronos --help.")
+    rescue StandardError
+      result(false, "internal_failure", 3)
+    end
+
+    private
+
+    def help?(args)
+      args.empty? || %w(help --help -h).include?(args.first)
+    end
+
+    def parse_options(args)
+      options = {:timeout => 5.0}
+      parser = OptionParser.new
+      %w(root project-id environment service-name deploy-id revision version host provider).each do |name|
+        parser.on("--#{name} VALUE") { |value| options[name.tr("-", "_").to_sym] = value }
+      end
+      %w(json offline dry-run check force).each do |name|
+        parser.on("--#{name}") { options[name.tr("-", "_").to_sym] = true }
+      end
+      parser.on("--timeout SECONDS", Float) { |value| options[:timeout] = value }
+      parser.on("--on-error POLICY", %w(warn fail)) { |value| options[:on_error] = value }
+      parser.on("--help") { options[:help] = true }
+      parser.parse!(args)
+      options
+    end
+
+    def execute(command, options)
+      return result(true, Deploy::Installer.new.install(options), 0) if command == "install"
+
+      values = Deploy::Configuration.read(options, @env)
+      if command == "diagnose"
+        raise Deploy::Error, "Diagnose requires --offline." unless options[:offline]
+
+        Deploy::Configuration.validate!(values, "notify")
+        return result(true, "local_configuration_only", 0,
+                      :message => "Local configuration is complete; credentials and delivery were not authenticated.")
+      end
+      deliver(command, values, options)
+    end
+
+    def deliver(command, values, options)
+      require "chronos/deploy/runner"
+      delivery = Deploy::Runner.new.call(command, values, options[:timeout])
+      success = command == "verify" ? delivery.success? : delivery == true
+      details = command == "verify" ? {:verification_status => delivery.status} : {}
+      code = success || options[:on_error] == "warn" ? 0 : 2
+      result(success, success ? "confirmed" : "unconfirmed", code, details)
+    end
+
+    def validate_options!(command, options)
+      common = [:root, :json, :help]
+      operational = [:project_id, :environment, :service_name, :deploy_id, :revision, :version, :host, :timeout]
+      allowed = command == "install" ? common + [:provider, :dry_run, :check, :force, :timeout] : common + operational
+      allowed += [:offline] if command == "diagnose"
+      allowed += [:on_error] if %w(notify verify).include?(command)
+      unless (options.keys - allowed).empty?
+        raise Deploy::Error, "Option does not apply to this command; see chronos --help."
+      end
+      raise Deploy::Error, "Use --check without --force." if options[:force] && options[:check]
+    end
+
+    def local(message)
+      @output.puts(message)
+      0
+    end
+
+    def result(success, state, code, details = {})
+      data = {:schema_version => 1, :success => success, :state => state}.merge(details)
+      # JSON is the default operational format; --json makes that intent explicit.
+      @output.puts(JSON.generate(data))
+      code
+    end
+  end
+end

data/lib/chronos/core/bounded_copy.rb

@@ -0,0 +1,69 @@
+module Chronos
+  module Core
+    # @responsibility Copy untrusted diagnostic trees without cycles, unbounded recursion or caller mutation.
+    # Ruby 2.2-compatible structural budgets apply before immutable event construction.
+    class BoundedCopy
+      MAX_DEPTH = 10
+      MAX_ITEMS = 100
+      MAX_NODES = 2_000
+      MAX_STRING_BYTES = 8192
+
+      def call(value)
+        copy(value, 0, :nodes => 0, :seen => {}.compare_by_identity)
+      end
+
+      private
+
+      def copy(value, depth, state)
+        state[:nodes] += 1
+        return "<node limit reached>".freeze if state[:nodes] > MAX_NODES
+        return "<maximum depth reached>".freeze if depth >= MAX_DEPTH
+        return container(value, depth, state) if value.is_a?(Hash) || value.is_a?(Array)
+
+        scalar(value)
+      end
+
+      def container(value, depth, state)
+        return "<circular reference>".freeze if state[:seen][value]
+
+        state[:seen][value] = true
+        result = value.is_a?(Hash) ? copy_hash(value, depth, state) : copy_array(value, depth, state)
+        state[:seen].delete(value)
+        result.freeze
+      end
+
+      def copy_hash(value, depth, state)
+        result = {}
+        value.each do |key, child|
+          break if result.length >= MAX_ITEMS || state[:nodes] >= MAX_NODES
+
+          result[copy(key, depth + 1, state)] = copy(child, depth + 1, state)
+        end
+        result
+      end
+
+      def copy_array(value, depth, state)
+        result = []
+        value.each do |child|
+          break if result.length >= MAX_ITEMS || state[:nodes] >= MAX_NODES
+
+          result << copy(child, depth + 1, state)
+        end
+        result
+      end
+
+      def scalar(value)
+        case value
+        when String
+          return "<string limit reached>".freeze if value.bytesize > MAX_STRING_BYTES
+
+          value.dup.freeze
+        when NilClass, TrueClass, FalseClass, Symbol, Numeric
+          value
+        else
+          "<#{value.class.name}>".freeze
+        end
+      end
+    end
+  end
+end

data/lib/chronos/core/notice.rb

@@ -1,3 +1,5 @@
+require "chronos/core/bounded_copy"
+
 module Chronos
   module Core
     # Immutable value object containing a normalized Ruby exception.
@@ -22,8 +24,9 @@ module Chronos
       attr_reader(*ATTRIBUTES)
 
       def initialize(attributes)
+        copied = BoundedCopy.new.call(attributes)
         ATTRIBUTES.each do |attribute|
-          instance_variable_set("@#{attribute}", immutable_copy(attributes[attribute]))
+          instance_variable_set("@#{attribute}", copied[attribute])
         end
         freeze
       end
@@ -33,33 +36,6 @@ module Chronos
           result[attribute] = public_send(attribute)
         end
       end
-
-      private
-
-      def immutable_copy(value)
-        case value
-        when Hash
-          value.each_with_object({}) do |(key, child), copy|
-            copy[immutable_copy(key)] = immutable_copy(child)
-          end
-        when Array
-          value.map { |child| immutable_copy(child) }
-        when String
-          value.dup
-        when NilClass, TrueClass, FalseClass, Symbol, Numeric
-          value
-        else
-          value.dup
-        end.freeze
-      rescue TypeError
-        value
-      rescue StandardError
-        begin
-          value.dup.freeze
-        rescue StandardError
-          value
-        end
-      end
     end
   end
 end

data/lib/chronos/core/sanitizer.rb

@@ -53,7 +53,7 @@ module Chronos
       def sanitize_type(value, depth, state)
         return sanitize_hash(value, depth, state) if value.is_a?(Hash)
         return sanitize_array(value, depth, state) if value.is_a?(Array)
-        return @sensitive_value_filter.call(value) if value.is_a?(String)
+        return @sensitive_value_filter.call(value.to_s) if value.is_a?(String) || value.is_a?(Symbol)
 
         value
       end

data/lib/chronos/core/sql_lexer.rb

@@ -0,0 +1,73 @@
+require "strscan"
+
+module Chronos
+  module Core
+    # @responsibility Mask SQL literals before truncation and reject incomplete or ambiguous lexical input.
+    # Conservative lexical validation is not a dialect-complete SQL parser.
+    class SqlLexer
+      MAX_BYTES = 4096
+
+      def initialize(sql, adapter = "")
+        @sql = sql
+        @postgres = adapter.to_s =~ /postgres/i
+      end
+
+      def call
+        return nil unless @sql.is_a?(String) && @sql.valid_encoding? && @sql.bytesize <= MAX_BYTES
+
+        @scanner = StringScanner.new(@sql)
+        result = ""
+        until @scanner.eos?
+          token = next_token
+          return nil if token.nil?
+
+          result << token
+        end
+        result
+      end
+
+      def single_select?
+        text = call
+        return false unless text && text.lstrip =~ /\ASELECT\b/i
+
+        text.sub(/;\s*\z/, "") !~ /;/
+      end
+
+      private
+
+      def next_token
+        return " " if @scanner.scan(/\s+|--[^\r\n]*|\#[^\r\n]*/)
+        return block_comment if @scanner.peek(2) == "/*"
+        return quoted if ["'", '"', "`"].include?(@scanner.peek(1))
+        return dollar_literal if @scanner.check(/\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/)
+
+        @scanner.getch
+      end
+
+      def block_comment
+        text = @scanner.scan(%r{/\*.*?\*/}m)
+        return nil unless text
+        return nil if text.start_with?("/*!", "/*M!") || text[2...-2].include?("/*")
+
+        " "
+      end
+
+      def quoted
+        quote = @scanner.peek(1)
+        delimiter = Regexp.escape(quote)
+        pattern = /#{delimiter}(?:#{delimiter * 2}|[^#{delimiter}\\])*#{delimiter}/m
+        text = @scanner.scan(pattern)
+        return nil unless text
+        return "?" if quote == "'" || (quote == '"' && !@postgres)
+
+        identifier = text[1...-1]
+        identifier =~ /\A[A-Za-z_][A-Za-z0-9_$]*\z/ ? text : "?"
+      end
+
+      def dollar_literal
+        delimiter = @scanner.scan(/\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/)
+        @scanner.scan_until(/#{Regexp.escape(delimiter)}/m) ? "?" : nil
+      end
+    end
+  end
+end

data/lib/chronos/core/sql_normalizer.rb

@@ -1,4 +1,5 @@
 require "digest"
+require "chronos/core/sql_lexer"
 
 module Chronos
   module Core
@@ -15,7 +16,7 @@ module Chronos
     # @errors Malformed or unreadable input returns bounded unknown metadata.
     # @performance Input and normalized output are capped before fingerprinting.
     class SqlNormalizer
-      MAX_SQL_BYTES = 4096
+      MAX_SQL_BYTES = SqlLexer::MAX_BYTES
       MAX_NORMALIZED_BYTES = 512
       KEYWORDS = %w(
         select insert update delete from into where join left right inner outer on set values
@@ -23,7 +24,7 @@ module Chronos
       ).freeze
 
       def call(sql, metadata = {})
-        normalized = normalize(sql)
+        normalized = normalize(sql, metadata)
         {
           "adapter" => adapter(metadata), "operation" => operation(normalized),
           "table" => table(normalized), "normalized_query" => normalized,
@@ -41,11 +42,10 @@ module Chronos
 
       private
 
-      def normalize(sql)
-        text = bounded(sql.to_s, MAX_SQL_BYTES)
-        text = text.gsub(%r{/\*.*?\*/}m, " ").gsub(/--[^\r\n]*/, " ")
-        text = text.gsub(/'(?:''|[^'])*'/, "?")
-        text = text.gsub(/\$([A-Za-z_][A-Za-z0-9_]*)?\$.*?\$\1\$/m, "?")
+      def normalize(sql, metadata)
+        text = SqlLexer.new(sql, adapter(metadata)).call
+        return "" unless text
+
         text = text.gsub(/\b(?:0x[0-9a-f]+|\d+(?:\.\d+)?)\b/i, "?")
         text = text.gsub(/\b(?:true|false|null)\b/i, "?")
         text = text.gsub(/\(\s*\?(?:\s*,\s*\?)+\s*\)/, "(?)")

data/lib/chronos/core/telemetry_event.rb

@@ -1,5 +1,6 @@
 require "securerandom"
 require "time"
+require "chronos/core/bounded_copy"
 
 module Chronos
   module Core
@@ -21,31 +22,17 @@ module Chronos
       attr_reader :event_id, :event_type, :timestamp, :context, :payload
 
       def initialize(event_type, payload = {}, context = {}, options = {})
-        type = event_type.to_s
+        type = event_type.to_s.dup
         raise ArgumentError, "unsupported telemetry event type" unless TYPES.include?(type)
 
         clock = options[:clock] || proc { Time.now }
-        @event_id = (options[:event_id] || SecureRandom.uuid).to_s.freeze
+        @event_id = (options[:event_id] || SecureRandom.uuid).to_s.dup.freeze
         @event_type = type.freeze
         @timestamp = clock.call.utc.iso8601(6).freeze
-        @context = deep_freeze(context.is_a?(Hash) ? context : {})
-        @payload = deep_freeze(payload.is_a?(Hash) ? payload : {})
+        @context = BoundedCopy.new.call(context.is_a?(Hash) ? context : {})
+        @payload = BoundedCopy.new.call(payload.is_a?(Hash) ? payload : {})
         freeze
       end
-
-      private
-
-      def deep_freeze(value)
-        if value.is_a?(Hash)
-          value.each do |key, child|
-            deep_freeze(key)
-            deep_freeze(child)
-          end
-        elsif value.is_a?(Array)
-          value.each { |child| deep_freeze(child) }
-        end
-        value.freeze
-      end
     end
 
     # Serializes framework telemetry into the common Chronos event envelope.