chronos-ruby 1.2.0 → 1.2.2

data/docs/compatibility.md

@@ -1,37 +1,50 @@
 # Compatibility
 
-Chronos Ruby 1.2.0 is the current stable release of the transitional line for modern Ruby, Rails, and Sidekiq applications. Individual combinations remain `Best effort` until their dedicated CI and real-application gates pass; a stable package version does not by itself promote an unverified combination to `Supported`. Technical compatibility does not make an end-of-life Ruby, Rails, Rack, or Sidekiq release secure. Versions 1.0 and 1.1 remain the frozen legacy line.
+Chronos Ruby 1.2.2 is prepared as a maintenance release of the transitional line for modern Ruby, Rails, and Sidekiq applications. Individual combinations remain `Best effort` until their dedicated CI and real-application gates pass; a stable package version does not by itself promote an unverified combination to `Supported`. Technical compatibility does not make an end-of-life Ruby, Rails, Rack, or Sidekiq release secure. Versions 1.0 and 1.1 remain the frozen legacy line.
 
 ## Core and Rack
 
-| Ruby | Status | Evidence |
-|---|---|---|
-| 2.7–3.2 | Best effort | Transitional matrix introduced in this candidate; promotion requires green CI evidence |
-| 3.3–3.4 | Best effort | Core checks run in modern CI; Rails 8-specific behavior belongs to 2.x |
-| Earlier than 2.7 | Unsupported in 1.2 | Use an appropriate frozen legacy release |
+| Ruby             | Status             | Evidence                                                                               |
+| ---------------- | ------------------ | -------------------------------------------------------------------------------------- |
+| 2.7–3.2          | Best effort        | Local core/security/package gates passed; remote CI/promotion evidence remains required |
+| 3.3–3.4          | Best effort        | Local core/package gates passed; Rails 8 belongs to 2.x                 |
+| Earlier than 2.7 | Unsupported in 1.2 | Use an appropriate frozen legacy release                                               |
 
 ## Rails
 
-| Ruby | Rails | Status | Evidence |
-|---|---|---|---|
-| 2.7–3.2 | 7.0–7.1 | Best effort | Real Rails applications and the complete integration gate are pending |
-| 3.1–3.4 | 7.2 | Best effort | Feature and package checks; use a validated application combination before production rollout |
-| Rails 4–6 | — | Unsupported in 1.2 | Use a matching earlier Chronos release |
+| Ruby      | Rails   | Status             | Evidence                                                                                      |
+| --------- | ------- | ------------------ | --------------------------------------------------------------------------------------------- |
+| 2.7–3.2   | 7.0–7.1 | Best effort        | Real Rails applications and the complete integration gate are pending                         |
+| 3.1–3.4   | 7.2     | Best effort        | Feature and package checks; use a validated application combination before production rollout |
+| Rails 4–6 | —       | Unsupported in 1.2 | Use a matching earlier Chronos release                                                        |
 
 ## Sidekiq
 
-| Ruby | Sidekiq | Status | Evidence |
-|---|---|---|---|
-| 2.7–3.4 | 7.x | Best effort | Real Sidekiq 7 smoke applications are pending |
-| Sidekiq 4–6 | — | Unsupported in 1.2 | Use a matching earlier Chronos release |
+| Ruby        | Sidekiq | Status             | Evidence                                      |
+| ----------- | ------- | ------------------ | --------------------------------------------- |
+| 2.7–3.4     | 7.x     | Best effort        | Pinned 7.3.10 middleware-chain fixture; Redis-backed worker lifecycle is a separate gate |
+| Sidekiq 4–6 | —       | Unsupported in 1.2 | Use a matching earlier Chronos release        |
 
 Active Job uses the public `serialize`, `deserialize`, and `perform_now` extension points with a bounded namespaced field. Support follows the validated Rails pairs above. Adapters that bypass these hooks require their own evidence.
 
-Release evidence is recorded in [Version 1.2 readiness](release-1.2-readiness.md). Historical evidence remains in [Version 1.0 readiness](release-1.0-readiness.md) and [Version 1.1 readiness](release-1.1-readiness.md).
+Release evidence is recorded in [Version 1.2.2 readiness](release-1.2.2-readiness.md). Historical evidence remains in [Version 1.0 readiness](release-1.0-readiness.md) and [Version 1.1 readiness](release-1.1-readiness.md).
 
 Status meanings:
 
 - Supported: every mandatory compatibility gate for the exact pair passes.
-- Best effort: intended to work but missing a complete gate; no 1.1 pair is advertised this way.
+- Best effort: intended to work but missing a complete gate; passing focused smokes alone does not promote a pair.
 - Deprecated: still tested while removal is planned.
-- Unsupported: outside the tested 1.1 contract.
+- Unsupported: outside the declared transitional contract.
+
+## Selected transitional smoke matrix
+
+| Framework patch | Ruby versions | Scope |
+| --- | --- | --- |
+| Rails 7.0.10 | 2.7, 3.0 | Real app boot, controller/SQL, Active Job, Error Reporter, deploy generator |
+| Rails 7.1.6 | 2.7, 3.1, 3.2 | Same application checks |
+| Rails 7.2.4 | 3.1, 3.3, 3.4 | Same checks; Ruby >= 3.1 is required by Rails |
+| Sidekiq 7.3.10 | 2.7, 3.0, 3.1, 3.2, 3.3, 3.4 | Actual client/server middleware chains; no Redis or worker process |
+
+Framework patches are pinned in the fixture Gemfiles. Dependency locks and execution logs must be retained for promotion; PR/release CI uploads resolved lockfiles. Ruby images in the local helper follow the selected minor and print their exact runtime patch. These are technical compatibility checks, not an assertion of upstream security maintenance. See [official Rails requirements](https://guides.rubyonrails.org/v7.2.0/upgrading_ruby_on_rails.html#ruby-versions).
+
+The local 1.2.2 runs passed every selected smoke above. Status remains Best effort because these focused gates do not close provider/SaaS/Redis-backed lifecycle and final promotion requirements.

data/docs/deploy-cli.md

@@ -0,0 +1,35 @@
+# Transitional deploy CLI
+
+Version 1.2.2 ports the CLI/security contract from legacy 1.1.4 while preserving Ruby >= 2.7 and < 3.5 and the existing transitional integrations. After the release is published and installed:
+
+```sh
+export CHRONOS_PROJECT_ID=your-project
+# Inject CHRONOS_PROJECT_KEY through the deployment secret mechanism.
+export CHRONOS_ENVIRONMENT=production
+export CHRONOS_DEPLOY_ID=stable-publication-identity
+export CHRONOS_DEPLOY_REVISION=revision-of-the-actually-published-artifact
+bundle exec chronos deploy notify
+```
+
+No Ruby notification script needs to be copied. The CLI does not boot Rails or read credentials/initializers implicitly. CHRONOS_SERVICE_NAME must match runtime service configuration; CHRONOS_DEPLOY_VERSION can replace the revision. The default host is https://chronosmonitor.com.br; CHRONOS_HOST overrides it with HTTPS only, without URL credentials, query or fragment.
+
+Canonical variables: CHRONOS_PROJECT_ID, CHRONOS_PROJECT_KEY, CHRONOS_HOST, CHRONOS_ENVIRONMENT, CHRONOS_SERVICE_NAME, CHRONOS_DEPLOY_ID, CHRONOS_DEPLOY_REVISION, CHRONOS_DEPLOY_VERSION. Aliases: DEPLOY_ENVIRONMENT, SERVICE_NAME, DEPLOY_ID, GIT_SHA, APP_VERSION. Conflicting aliases are errors. Explicit public options override ENV, which overrides optional config/chronos-deploy.yml. The key is ENV-only. YAML accepts only string values for project_id, host, environment, service_name, deploy_id, revision and version; never persist secrets there.
+
+`deploy diagnose --offline` validates complete notify configuration locally without authenticating credentials. `deploy verify` uses the existing correlated receipt and sends no deploy or dependency inventory. A receipt is not proof of SaaS projection. Help/version are local. `--timeout` accepts 0 < seconds <= 60 and bounds transport/flush operations, not one global process deadline. Retries/backlog are disabled for this short-lived CLI. Notify can still produce dependency events.
+
+Operational JSON uses schema_version=1, success and state; verify also exposes verification_status. Exit codes: 0 local/confirmed success, 1 invalid configuration, 2 unconfirmed delivery, 3 internal failure. `--on-error=warn` converts only unconfirmed delivery to process status 0 and retains success=false. Do not retry blindly: the receiver may already have accepted an event. A stable deployment ID does not guarantee exactly-once event consumption or billing.
+
+Generate integrations explicitly:
+
+```sh
+bundle exec chronos deploy install --provider kamal --dry-run
+bundle exec chronos deploy install --provider kamal
+bundle exec chronos deploy install --provider kamal --check
+bundle exec rails generate chronos:deploy:install --provider=kamal
+```
+
+Providers: kamal, capistrano, github-actions, gitlab-ci, jenkins and azure-devops. Use --root for an explicit destination. Equal content is unchanged; conflicts preserve customer files and expose only the proposed template. Merge manually before considering --force. POSIX installation (Linux/macOS) uses descriptor-relative operations, bounded reads and no-follow opens to prevent symlink redirection. No pipeline is activated automatically and no Gemfile/lockfile/dependency is modified by the installer.
+
+Kamal creates .kamal/hooks/post-deploy; Capistrano creates lib/capistrano/tasks/chronos_deploy.rake and runs locally after deploy:published. Do not also load chronos/capistrano. CI fragments are generated in config/chronos/deploy for manual merge after the real successful publication; explicitly export its actual identity/revision outputs. The GitLab fragment is hidden and must be incorporated into an existing job. A modern deployment runner does not automatically belong to this gem's Ruby matrix.
+
+Use [transitional Docker tests](../README.md#tests) and [1.2.2 readiness](release-1.2.2-readiness.md). The historical legacy ADR describes the origin; current publication and capability decisions belong to this release's readiness document. SaaS recipe selection must use explicit per-line capabilities and retain fallback for older clients. Rails boot/credentials integration and the Ruby 4/Rails 8 line remain separate work.

data/docs/legacy-test-environment.md

@@ -0,0 +1,59 @@
+# Preparar o ambiente de testes legado no macOS
+
+Este procedimento testa a trilha `legacy/1`. Não publica a gem nem usa credenciais reais do SaaS.
+
+## 1. Iniciar Docker Desktop
+
+Instale ou atualize a edição correspondente ao processador do Mac, conforme a [documentação oficial](https://docs.docker.com/desktop/setup/install/mac-install/). Abra o aplicativo e aguarde o engine iniciar:
+
+```sh
+open -a Docker
+docker version
+docker info
+```
+
+`docker version` precisa mostrar Client e Server. Se aparecer erro no socket ou “Cannot connect”, o engine ainda não está disponível. Confirme o contexto com `docker context ls`; selecione o contexto local do Docker Desktop caso outro contexto esteja ativo.
+
+## 2. Entrar no repositório e executar o primeiro Ruby
+
+```sh
+cd /Users/antoniojefferson/Develop/Projects/Rails/chronos-ruby
+sh script/test_legacy_docker 2.2.10
+```
+
+O helper usa linux/amd64 explicitamente para uniformizar as imagens antigas em Mac Intel e Apple Silicon. A [documentação de plataformas do Docker](https://docs.docker.com/build/building/multi-platform/) explica a emulação; ela pode ser mais lenta.
+
+O repositório é montado somente para leitura. O helper copia os arquivos para /work no container, exclui configuração local do Bundler, .git, .aws e .env, e remove somente os lockfiles dessa cópia. Isso é necessário porque o lockfile atual do repositório foi gerado com ferramentas modernas e não corresponde ao gemspec legado. Nenhum lockfile local é alterado.
+
+O container instala Bundler 1.17.3 e resolve as dependências do gemspec, incluindo Rake 12.3, RuboCop 0.49 e Minitest 5.10.3. O script executa a suíte existente, os testes da CLI/adaptadores/receptor HTTPS e o smoke da gem instalada. Certificado de teste é gerado temporariamente e explicitamente confiado; verificação TLS não é desligada.
+
+## 3. Executar a matriz Ruby completa
+
+```sh
+for version in 2.2.10 2.3.8 2.4.10 2.5.9 2.6.10; do
+  sh script/test_legacy_docker "$version" || break
+done
+```
+
+Pare no primeiro erro e preserve o log. Uma execução interrompida não aprova os demais Rubies. Registre por imagem: versão Ruby, OpenSSL/JSON, resultado da suíte e resultado do pacote instalado.
+
+## 4. Executar os pares Rails suportados
+
+```sh
+sh script/test_legacy_docker 2.2.10 examples/rails-4.2
+sh script/test_legacy_docker 2.3.8 examples/rails-4.2
+sh script/test_legacy_docker 2.5.9 examples/rails-5.2
+sh script/test_legacy_docker 2.6.10 examples/rails-5.2
+```
+
+Esses comandos executam o smoke existente da aplicação e o novo smoke do generator de deploy, em diretório temporário. Eles não ampliam os pares suportados.
+
+## 5. Tratar falhas de preparação
+
+- Falha no pull ou acesso a rubygems.org: verificar conexão, proxy e disponibilidade do registro.
+- Erro de certificado/OpenSSL nas imagens antigas: registrar imagem e mensagem, corrigir CA ou preparar imagem derivada com certificados confiáveis compatíveis. Não usar HTTP, ssl_verify=false ou mirrors sem validação TLS.
+- Dependência incompatível: identificar a dependência e fixar versão compatível na definição da imagem/matriz antes de repetir. Não modernizar o gemspec legado para fazer o teste passar.
+- Erro de arquitetura: confirmar execução linux/amd64 e suporte de emulação no Docker Desktop.
+- Erro RuboCop/RSpec/CLI: é resultado da validação do código, não falha de instalação; corrigir antes de promover a release.
+
+O helper prepara execuções isoladas, mas ainda não substitui imagens reproduzíveis fixadas por digest e dependências resolvidas por runtime. A aprovação final da matriz deve preservar esses registros. Depois dos gates locais, permanecem os testes SaaS de receipt/ingestão/ledger/projeção e os smokes autorizados dos fornecedores.

data/docs/modules/rails-legacy.md

@@ -1,6 +1,6 @@
-# Rails 4.2 and 5.2 legacy integration
+# Rails 7 transitional integration
 
-Version 0.5 adds an explicit Rails entry point:
+Version 0.5 introduced the explicit Rails entry point. In the 1.2 line it targets the documented Rails 7 combinations; Rails 4/5 belong to the legacy 1.1 line:
 
 ```ruby
 require "chronos/rails"

data/docs/modules/sidekiq-legacy.md

@@ -1,23 +1,20 @@
-# Sidekiq 4/5 legacy integration
+# Sidekiq 7 transitional integration
 
-Version `0.6.0.pre.1` starts the legacy jobs line with optional Sidekiq 4 and 5 client and server middleware. Load it after declaring Sidekiq:
+The historical integration began in `0.6.0.pre.1`. The current 1.2.2 line targets Sidekiq 7 through its public middleware APIs. Sidekiq 4/5 consumers must use a matching legacy release. Load the optional integration after declaring Sidekiq:
 
 ```ruby
-gem "sidekiq", "~> 5.0"
-gem "chronos-ruby", "~> 1.1.0", :require => "chronos/sidekiq"
+gem "sidekiq", "~> 7.3"
+gem "chronos-ruby", "~> 1.2.2", :require => "chronos/sidekiq"
 ```
 
 `chronos/sidekiq` installs middleware through the public `configure_client` and `configure_server` APIs. It does nothing when Sidekiq is unavailable, and the core gem never requires Sidekiq. Installation adds no Chronos thread or Redis/database connection per job; delivery continues through the agent's existing fixed worker pool.
 
-The client middleware adds a top-level `chronos` metadata object to the Sidekiq envelope. It never changes the public `args` array. Only `trace_id` and `request_id` propagate, with schema version and enqueue time. The server scopes that context for the worker, measures duration and calculable queue latency, and emits one `job` event.
+The client middleware adds a top-level `chronos` metadata object to the Sidekiq envelope. It never changes the public `args` array. Only bounded trace/span/request identifiers and flags propagate, with schema version and enqueue time. The server scopes that context for the worker, measures duration and calculable queue latency, and emits one `job` event.
 
 Collected Sidekiq fields are worker class, queue, JID, retry count, duration, queue latency, status, error class, bounded tags, and bounded arguments. At most 20 top-level arguments, 20 values per nested collection, four levels, and 512 bytes per string are traversed. Arguments then pass through the standard sensitive-key/content sanitizer before queueing. Limits reduce exposure and resource use but do not make unnecessary personal data safe to collect.
 
 On failure, the server middleware records a failed-job observation, invokes `notify_once`, and re-raises the identical exception so Sidekiq retains ownership of retries and failure handlers. A shared execution marker prevents a nested Active Job hook and the Sidekiq middleware from sending the same exception twice. Version 0.7 aggregates the job observation; the exception retains sanitized bounded arguments. Chronos does not install an additional global Sidekiq error handler.
 
-Known limitations for this first 0.6 prerelease:
+## Validation scope
 
-- the compatibility contract uses Sidekiq 4/5 public middleware signatures; dedicated real Sidekiq matrix jobs must pass before status becomes `Supported`;
-- Active Job propagation, Resque, and Delayed Job are subsequent 0.6 increments;
-- argument collection is automatic in this prerelease; applications should avoid placing secrets or unnecessary personal data in job arguments;
-- context propagation is limited to trace and request identifiers.
+The pinned Sidekiq 7.3.10 fixture exercises actual middleware chains, argument preservation, context propagation, job telemetry and error re-raising across Ruby 2.7–3.4. It does not start Redis or a worker process. Redis-backed lifecycle evidence remains a separate promotion gate. See [Compatibility](../compatibility.md) and [1.2.2 readiness](../release-1.2.2-readiness.md).

data/docs/release-1.1.4-readiness.md

@@ -0,0 +1,44 @@
+# Version 1.1.4 release preparation
+
+Version `1.1.4` prepares deploy automation for the stable legacy line. It packages the `chronos` CLI, explicit ENV/YAML configuration, optional provider installers and Rails/Rake adapters. It preserves Ruby >= 2.2.10 and < 2.7, the existing Rails/Sidekiq pairs, and protocol `schema_version: "1.0"`. This is a limited maintenance exception; it does not reopen general feature development on the legacy line.
+
+## Operational contract
+
+- No notification, generator execution, or application file changes on install, require, help, or version.
+- Notify requires explicit project credentials, environment, stable publication ID, and actual published revision/version. It uses `Chronos.notify_deploy` and always closes the agent.
+- Verify reuses `Chronos.verify_integration`, validates its receipt, disables dependency reporting, and does not create a deploy. A receipt is not proof of SaaS projection.
+- CLI transport requires verified HTTPS. Retries and backlog are disabled for this short-lived process; transport and flush operations have bounded timeouts, not a single global process deadline.
+- Exit codes: 0 confirmed/local success, 1 invalid configuration, 2 unconfirmed delivery, 3 internal failure. Warning policy only converts code 2 to 0 and retains `success=false`.
+- Repeated notify calls keep deployment identity but can generate another event and consumption. Dependency events can add consumption. Do not retry blindly after an unconfirmed result.
+- Installers preserve conflicting files, offer a privacy-safe proposed template, and reject destination symlinks. POSIX descriptor-relative operations prevent parent-path swaps from redirecting creation or publication. CI fragments require manual merge after the actual publication.
+
+## Evidence and pending gates
+
+Local Ruby 3.4 checks are supplementary evidence only. They do not establish compatibility with the supported legacy runtimes.
+
+Before tagging, require:
+
+- core suite, CLI, transport, privacy, shutdown/fork, and RuboCop 0.49 gates on Ruby 2.2.10, 2.3.8, 2.4.10, 2.5.9, and 2.6.10;
+- Rails 4.2 on Ruby 2.2.10/2.3.8 and Rails 5.2 on Ruby 2.5.9/2.6.10, including deploy generator smoke;
+- Sidekiq 4.2.10 on Ruby 2.2.10 and Sidekiq 5.2.10 on Ruby 2.5.9;
+- built gem installed into clean supported runtimes, executable/help/offline diagnostics and HTTPS notification/receipt tests;
+- dependency audit with the CI-pinned tooling, documentation and PR-body verification;
+- query-analysis/Rack benchmarks and fake-endpoint load/privacy gates;
+- authorized provider smoke tests and SaaS evidence for receipt, ingestion, identity, consumption, and projection; keep these distinct;
+- reviewed source, package inspection, checksum, SPDX SBOM, and maintainer approval.
+
+Use the [Docker test instructions](../README.md#tests). The working-tree lockfile originated from modern tooling; the isolated Docker helper resolves dependencies only in its container copy. It does not prove the direct CI workflow's dependency resolution will pass; that remains a required check.
+
+## SaaS rollout and transitional backport
+
+The CLI capability is introduced by legacy release `1.1.4`. The transitional main-line backport is not included in this release. The SaaS must select recipes using explicitly validated release ranges for each line, never a single cross-line minimum. Keep old script recipes for older clients and do not delete customer-edited scripts.
+
+## Publication
+
+No release has been published by this preparation. Never replace previously published artifacts. After all gates and approval, the release tag must be exactly `v1.1.4` and match `Chronos::VERSION`. Pushing that tag triggers the release workflow and its publication job; do not create or push it before approval. Publish through the configured Trusted Publishing workflow rather than a manual gem push.
+
+## Security regression coverage
+
+`spec/security/` covers SQL literal confidentiality through the final APM envelope, complete original-query validation before inspection, sensitive symbols through final serialization, cyclic/deep diagnostic input and caller ownership, and deterministic symlink/concurrent-file interleavings. Conservative SQL handling omits oversized or ambiguous queries; plan evidence remains best effort. The installer uses fixed POSIX calls through standard-library Fiddle and does not execute shell commands. Unsupported filesystem backends must fail closed.
+
+Security-fix validation: the core/security suite passed on MRI 2.2.10, 2.3.8, 2.4.10, 2.5.9 and 2.6.10 in isolated Linux/amd64 containers: 221 RSpec examples, the complete RuboCop 0.49.1 inspection (225 files), 25 standalone source tests (127 assertions), gem build/install, local diagnostics, and six installed-executable HTTPS tests (36 assertions) per runtime. The expanded installed-gem smoke also verifies explicit Kamal hook generation and idempotent check in a path containing spaces. These results do not close the separate Rails/Sidekiq, supplier, SaaS, audit, benchmark, or remote CI gates.

data/docs/release-1.2.2-readiness.md

@@ -0,0 +1,27 @@
+# Version 1.2.2 release preparation
+
+This release ports packaged deployment automation and the five security corrections from legacy 1.1.4 into the transitional Ruby >= 2.7 and < 3.5 line. It preserves the main-line integrations and protocol v1. It does not introduce Ruby 4, Rails 8, or the planned 2.x line.
+
+The gates include core/security/lint, standalone CLI/adapters, real Rails 7 applications, real Sidekiq 7 middleware chains, installed-package tests, documentation, audit, benchmarks, and maintainer approval. Local execution evidence is recorded below as verification proceeds; a configured workflow is not proof of success.
+
+Rails fixtures pin railties/actionpack/activejob/activerecord 7.0.10, 7.1.6 and 7.2.4. Sidekiq is pinned to 7.3.10. Official RubyGems metadata reports Ruby >= 2.7 for Rails 7.0/7.1 and Sidekiq 7.3.10, and >= 3.1 for Rails 7.2.4. See [Rails requirements](https://guides.rubyonrails.org/v7.2.0/upgrading_ruby_on_rails.html#ruby-versions), [Rails 7.2.4 metadata](https://rubygems.org/gems/rails/versions/7.2.4), and [Sidekiq metadata](https://rubygems.org/gems/sidekiq/versions/7.3.10).
+
+The Sidekiq smoke exercises its actual public middleware chains, context, preserved arguments, and error propagation; it does not start Redis or a worker process. The Rails smoke boots a real app with SQLite, controller/SQL notifications, Active Job, Error Reporter deduplication and the deploy generator. The in-memory test transport prevents SaaS requests.
+
+Do not promote any Best effort combination solely because these focused smokes pass. SaaS receipts, ingestion/ledger/projection, authorized provider execution, Redis-backed worker lifecycle, dependency audit, load/benchmark gates and remote CI retain their own evidence requirements.
+
+No tag or publication is authorized by preparation. After approval and green gates, only tag `v1.2.2`, matching Chronos::VERSION, triggers the protected Trusted Publishing workflow. Never replace a previously published artifact. The SaaS must select CLI recipes by explicitly supported release ranges per line and retain scripts for older clients.
+
+## Local execution evidence
+
+The reviewed main-line integration implementations remain intact; the adapted port passed the following local Linux/amd64 gates:
+
+- MRI 2.7.8, 3.0.7, 3.1.7, 3.2.11, 3.3.13 and 3.4.12: 227 RSpec examples (including modern integration and security regressions), RuboCop 1.57.2 with 241 files and no offenses, and 25 standalone tests with 127 assertions per runtime.
+- Built artifact installation, HTTPS receipt/notification checks, safe integration generation, and an isolated Bundler frozen client verifying the loaded gem path. The HTTPS suite runs directly and through a Bundler-generated binstub.
+- All eight Rails pairs in compatibility.md, now including automatic Sidekiq installation in the actual app: single initialization/request capture, SQL privacy, Active Job, genuine Error Reporter capture/deduplication and deploy generator namespace/idempotence/state.
+- Standalone Sidekiq 7.3.10 configuration/middleware chains on all six Rubies. Actual failure re-raising is asserted; Redis/worker lifecycle is not exercised.
+- Bundler Audit 0.9.1 on Ruby 3.3.13 core dependencies: no vulnerabilities found against ruby-advisory-db commit 92c25ce091b117bfe9ac54a5bbb0877356e9de7f (1290 advisories). This does not certify consumer/framework/stdlib graphs or EOL runtimes.
+- Query-analysis benchmark (10000 iterations/1000 warmup), Rack comparison (10000 iterations/1000 warmup/5 samples), and fake-endpoint load/privacy (500 received of 500 events) passed. Measurements under emulation/concurrent tests are not production performance claims.
+- Gem construction, SHA-256 calculation, SPDX SBOM (25 loaded build-environment packages), documentation/PR validation, workflow YAML and README shell syntax checks passed. The SBOM is build-environment evidence, not a complete inventory of native OS dependencies.
+
+Local test containers are disposable; no customer or host Gemfile.lock was modified. Remote CI, provider/SaaS validation, Redis-backed lifecycle and final approval remain open. No tag was created and no package was published.

data/exe/chronos

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+require "chronos/cli"
+exit Chronos::CLI.new.run(ARGV)

data/lib/chronos/agent.rb

@@ -248,12 +248,17 @@ module Chronos
     end
 
     def context_for_capture(additional)
-      merged = deep_merge(context_hash(@context_store.get), context_hash(additional))
+      current = context_hash(@context_store.get)
+      additions = context_hash(additional)
+      buffer = breadcrumb_buffer(additions) || breadcrumb_buffer(current)
+      copier = Core::BoundedCopy.new
+      merged = deep_merge(copier.call(current), copier.call(additions))
       merged.delete(:__chronos_captured_exceptions)
       merged.delete("__chronos_captured_exceptions")
       merged.delete(:__chronos_captured_events)
       merged.delete("__chronos_captured_events")
-      buffer = merged.delete(:__chronos_breadcrumbs) || merged.delete("__chronos_breadcrumbs")
+      merged.delete(:__chronos_breadcrumbs)
+      merged.delete("__chronos_breadcrumbs")
       if buffer.respond_to?(:to_a)
         merged[:context] = context_hash(merged[:context]).merge("breadcrumbs" => buffer.to_a)
       end
@@ -262,9 +267,13 @@ module Chronos
       context_hash(additional)
     end
 
+    def breadcrumb_buffer(context)
+      context[:__chronos_breadcrumbs] || context["__chronos_breadcrumbs"]
+    end
+
     def telemetry_context(additional)
       merged = context_for_capture(additional)
-      context = context_hash(merged.delete(:context) || merged.delete("context"))
+      context = context_hash(merged.delete(:context) || merged.delete("context")).dup
       parameters = merged.delete(:parameters) || merged.delete("parameters")
       user = merged.delete(:user) || merged.delete("user")
       context["parameters"] = parameters if parameters.is_a?(Hash) && !parameters.empty?
@@ -272,9 +281,11 @@ module Chronos
       context.merge(merged)
     end
 
-    def deep_merge(left, right)
+    def deep_merge(left, right, depth = 0)
+      return {} if depth >= Core::BoundedCopy::MAX_DEPTH
+
       left.merge(right) do |_key, old_value, new_value|
-        old_value.is_a?(Hash) && new_value.is_a?(Hash) ? deep_merge(old_value, new_value) : new_value
+        old_value.is_a?(Hash) && new_value.is_a?(Hash) ? deep_merge(old_value, new_value, depth + 1) : new_value
       end
     end
 

data/lib/chronos/cli.rb

@@ -0,0 +1,117 @@
+require "optparse"
+require "json"
+require "chronos/version"
+require "chronos/deploy/configuration"
+require "chronos/deploy/installer"
+
+module Chronos
+  # @responsibility Parse explicit deployment commands and return sanitized operational results.
+  # Local command parser; operational responses use a versioned, allowlisted JSON envelope.
+  class CLI
+    HELP = "chronos deploy notify|verify|diagnose --offline|install --provider NAME\n" \
+           "Options: --root PATH, --project-id ID, --environment NAME, --service-name NAME,\n" \
+           "--deploy-id ID, --revision SHA, --version VERSION, --host URL, --timeout SECONDS,\n" \
+           "--json, --on-error=warn, --dry-run, --check, --force\n" \
+           "Project key: CHRONOS_PROJECT_KEY only. No application boot.\n" \
+           "Exit: 0 confirmed/local success; 1 invalid configuration; 2 unconfirmed delivery; 3 internal failure.\n" \
+           "warn returns 0 for unconfirmed delivery, retaining success=false. Never retry blindly.\n".freeze
+
+    def initialize(output = $stdout, env = ENV)
+      @output = output
+      @env = env
+    end
+
+    def run(arguments)
+      args = arguments.dup
+      return local(HELP) if help?(args)
+      return local(Chronos::VERSION) if args == ["--version"]
+      raise ArgumentError unless args.shift == "deploy"
+
+      command = args.shift
+      raise ArgumentError unless %w(notify verify diagnose install).include?(command)
+
+      options = parse_options(args)
+      return local(HELP) if options[:help]
+      raise ArgumentError unless args.empty? && options[:timeout] > 0 && options[:timeout] <= 60
+
+      validate_options!(command, options)
+      execute(command, options)
+    rescue Deploy::Error => e
+      result(false, "invalid_configuration_or_usage", 1, e.details.merge(:message => e.message))
+    rescue OptionParser::ParseError, ArgumentError, Psych::Exception
+      result(false, "invalid_configuration_or_usage", 1,
+             :message => "Invalid options or public configuration; see chronos --help.")
+    rescue StandardError
+      result(false, "internal_failure", 3)
+    end
+
+    private
+
+    def help?(args)
+      args.empty? || %w(help --help -h).include?(args.first)
+    end
+
+    def parse_options(args)
+      options = {:timeout => 5.0}
+      parser = OptionParser.new
+      %w(root project-id environment service-name deploy-id revision version host provider).each do |name|
+        parser.on("--#{name} VALUE") { |value| options[name.tr("-", "_").to_sym] = value }
+      end
+      %w(json offline dry-run check force).each do |name|
+        parser.on("--#{name}") { options[name.tr("-", "_").to_sym] = true }
+      end
+      parser.on("--timeout SECONDS", Float) { |value| options[:timeout] = value }
+      parser.on("--on-error POLICY", %w(warn fail)) { |value| options[:on_error] = value }
+      parser.on("--help") { options[:help] = true }
+      parser.parse!(args)
+      options
+    end
+
+    def execute(command, options)
+      return result(true, Deploy::Installer.new.install(options), 0) if command == "install"
+
+      values = Deploy::Configuration.read(options, @env)
+      if command == "diagnose"
+        raise Deploy::Error, "Diagnose requires --offline." unless options[:offline]
+
+        Deploy::Configuration.validate!(values, "notify")
+        return result(true, "local_configuration_only", 0,
+                      :message => "Local configuration is complete; credentials and delivery were not authenticated.")
+      end
+      deliver(command, values, options)
+    end
+
+    def deliver(command, values, options)
+      require "chronos/deploy/runner"
+      delivery = Deploy::Runner.new.call(command, values, options[:timeout])
+      success = command == "verify" ? delivery.success? : delivery == true
+      details = command == "verify" ? {:verification_status => delivery.status} : {}
+      code = success || options[:on_error] == "warn" ? 0 : 2
+      result(success, success ? "confirmed" : "unconfirmed", code, details)
+    end
+
+    def validate_options!(command, options)
+      common = [:root, :json, :help]
+      operational = [:project_id, :environment, :service_name, :deploy_id, :revision, :version, :host, :timeout]
+      allowed = command == "install" ? common + [:provider, :dry_run, :check, :force, :timeout] : common + operational
+      allowed += [:offline] if command == "diagnose"
+      allowed += [:on_error] if %w(notify verify).include?(command)
+      unless (options.keys - allowed).empty?
+        raise Deploy::Error, "Option does not apply to this command; see chronos --help."
+      end
+      raise Deploy::Error, "Use --check without --force." if options[:force] && options[:check]
+    end
+
+    def local(message)
+      @output.puts(message)
+      0
+    end
+
+    def result(success, state, code, details = {})
+      data = {:schema_version => 1, :success => success, :state => state}.merge(details)
+      # JSON is the default operational format; --json makes that intent explicit.
+      @output.puts(JSON.generate(data))
+      code
+    end
+  end
+end

data/lib/chronos/core/bounded_copy.rb

@@ -0,0 +1,69 @@
+module Chronos
+  module Core
+    # @responsibility Copy untrusted diagnostic trees without cycles, unbounded recursion or caller mutation.
+    # Ruby 2.2-compatible structural budgets apply before immutable event construction.
+    class BoundedCopy
+      MAX_DEPTH = 10
+      MAX_ITEMS = 100
+      MAX_NODES = 2_000
+      MAX_STRING_BYTES = 8192
+
+      def call(value)
+        copy(value, 0, :nodes => 0, :seen => {}.compare_by_identity)
+      end
+
+      private
+
+      def copy(value, depth, state)
+        state[:nodes] += 1
+        return "<node limit reached>".freeze if state[:nodes] > MAX_NODES
+        return "<maximum depth reached>".freeze if depth >= MAX_DEPTH
+        return container(value, depth, state) if value.is_a?(Hash) || value.is_a?(Array)
+
+        scalar(value)
+      end
+
+      def container(value, depth, state)
+        return "<circular reference>".freeze if state[:seen][value]
+
+        state[:seen][value] = true
+        result = value.is_a?(Hash) ? copy_hash(value, depth, state) : copy_array(value, depth, state)
+        state[:seen].delete(value)
+        result.freeze
+      end
+
+      def copy_hash(value, depth, state)
+        result = {}
+        value.each do |key, child|
+          break if result.length >= MAX_ITEMS || state[:nodes] >= MAX_NODES
+
+          result[copy(key, depth + 1, state)] = copy(child, depth + 1, state)
+        end
+        result
+      end
+
+      def copy_array(value, depth, state)
+        result = []
+        value.each do |child|
+          break if result.length >= MAX_ITEMS || state[:nodes] >= MAX_NODES
+
+          result << copy(child, depth + 1, state)
+        end
+        result
+      end
+
+      def scalar(value)
+        case value
+        when String
+          return "<string limit reached>".freeze if value.bytesize > MAX_STRING_BYTES
+
+          value.dup.freeze
+        when NilClass, TrueClass, FalseClass, Symbol, Numeric
+          value
+        else
+          "<#{value.class.name}>".freeze
+        end
+      end
+    end
+  end
+end

data/lib/chronos/core/notice.rb

@@ -1,3 +1,5 @@
+require "chronos/core/bounded_copy"
+
 module Chronos
   module Core
     # Immutable value object containing a normalized Ruby exception.
@@ -22,8 +24,9 @@ module Chronos
       attr_reader(*ATTRIBUTES)
 
       def initialize(attributes)
+        copied = BoundedCopy.new.call(attributes)
         ATTRIBUTES.each do |attribute|
-          instance_variable_set("@#{attribute}", immutable_copy(attributes[attribute]))
+          instance_variable_set("@#{attribute}", copied[attribute])
         end
         freeze
       end
@@ -33,33 +36,6 @@ module Chronos
           result[attribute] = public_send(attribute)
         end
       end
-
-      private
-
-      def immutable_copy(value)
-        case value
-        when Hash
-          value.each_with_object({}) do |(key, child), copy|
-            copy[immutable_copy(key)] = immutable_copy(child)
-          end
-        when Array
-          value.map { |child| immutable_copy(child) }
-        when String
-          value.dup
-        when NilClass, TrueClass, FalseClass, Symbol, Numeric
-          value
-        else
-          value.dup
-        end.freeze
-      rescue TypeError
-        value
-      rescue StandardError
-        begin
-          value.dup.freeze
-        rescue StandardError
-          value
-        end
-      end
     end
   end
 end

data/lib/chronos/core/sanitizer.rb

@@ -53,7 +53,7 @@ module Chronos
       def sanitize_type(value, depth, state)
         return sanitize_hash(value, depth, state) if value.is_a?(Hash)
         return sanitize_array(value, depth, state) if value.is_a?(Array)
-        return @sensitive_value_filter.call(value) if value.is_a?(String)
+        return @sensitive_value_filter.call(value.to_s) if value.is_a?(String) || value.is_a?(Symbol)
 
         value
       end