chronos-ruby 0.9.0.pre.2 → 0.9.0.pre.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ba6053cbe8155fba7fa99c0adf09db9e0aa38d33314b2355c49f1760233183fe
-  data.tar.gz: 138ee6958622e5e03d24863c553066c6368459fe423731950bcfcc63bfb12e02
+  metadata.gz: a834300cdaf9acd0d75e625d6cc811c677bd8cf2f701aed885e0bbae417aaca0
+  data.tar.gz: 1b2e992ee0c9428e25bac17a8cbe21ae0bc167ebb519b63ae9c2e1cdb3ec3cc7
 SHA512:
-  metadata.gz: 58b5255dacdb15e3df4147cceb563e247989fa8cc2e72c23e79166e51c772ffc9ba0e87120c025de5d20cff04be21a7625cafb39d9f47793f82d156bdcb5cf09
-  data.tar.gz: 981f49d6f3d12314278456338e975797c27df3f7d93217eb2a8c9df630faa6081a683159b7694e0963cd7f9fa4ed6fae5f095b697a1ea9ce1c3159f388a5b36d
+  metadata.gz: 53be3a9634f8a47b9701897f4b6b58e1f0d023b536a2f6f4a7649f2d31344cb07f161e9f5d11c7636217194bdf31fe8181f5c6d1e916ef6049020f59b1ff2c4a
+  data.tar.gz: 40b56150fed7170583f514552cd34894c98e6b8011c09f8a188af29accc5dfe36ab72b78375875e88059324025b7d82f7ef4cbb13b184a034b0bff22e7a38ca5

data/CHANGELOG.md

@@ -4,13 +4,20 @@ All notable changes are documented here. The project follows Semantic Versioning
 
 ## [Unreleased]
 
+## [0.9.0.pre.3] - 2026-07-21
+
+### Changed
+
+- version advanced to `0.9.0.pre.3` because `0.9.0.pre.2` had already been published before these fixes were completed.
+
 ### Fixed
 
+- exception notices now copy request and application values before freezing their immutable representation, preventing `can't modify frozen String` on repeated Rack/Rails failures;
 - `WorkerPool#flush` no longer returns before a worker marks a just-popped event as active;
-- release publishing now updates RubyGems to a Ruby 2.6-compatible version that supports `GEM_HOST_API_KEY`.
-- Updated the legacy development toolchain to non-vulnerable Rake and RuboCop versions.
-- legacy CI now resolves Bundler 1.17.3 through `Gem.bin_path` on RubyGems versions that do not support the `_version_` executable selector.
-- documentation verification now reads source and Markdown files explicitly as UTF-8 on legacy container locales.
+- release publishing now uses RubyGems Trusted Publishing with short-lived GitHub OIDC credentials, avoiding interactive MFA and long-lived API secrets in CI;
+- the legacy development toolchain uses non-vulnerable Rake and RuboCop versions;
+- legacy CI resolves Bundler 1.17.3 through `Gem.bin_path` on RubyGems versions that do not support the `_version_` executable selector;
+- documentation verification reads source and Markdown files explicitly as UTF-8 on legacy container locales.
 
 ## [0.9.0.pre.2] - 2026-07-21
 
@@ -30,7 +37,7 @@ All notable changes are documented here. The project follows Semantic Versioning
 
 ### Fixed
 
-- the Sidekiq 5 compatibility smoke now resolves the shared Sidekiq 4/5 fixture inside `examples/` instead of the nonexistent `/app/sidekiq-4` path.
+- the Sidekiq 5 compatibility smoke resolves the shared Sidekiq 4/5 fixture inside `examples/` instead of the nonexistent `/app/sidekiq-4` path.
 
 ### Security
 

data/README.md

@@ -33,7 +33,7 @@ See [Compatibility](docs/compatibility.md).
 The current public build is a pre-release. Add its exact version to the application's `Gemfile`:
 
 ```ruby
-gem "chronos-ruby", "0.9.0.pre.2"
+gem "chronos-ruby", "0.9.0.pre.3"
 ```
 
 Install with a Bundler version compatible with the application. For the oldest supported runtime:
@@ -54,7 +54,7 @@ gem install chronos-ruby --pre
 Version 0.5 exposes Rails support explicitly, keeping Rails and ActiveSupport out of plain Ruby applications:
 
 ```ruby
-gem "chronos-ruby", "0.9.0.pre.2", :require => "chronos/rails"
+gem "chronos-ruby", "0.9.0.pre.3", :require => "chronos/rails"
 ```
 
 Generate the initializer with:
@@ -201,7 +201,7 @@ Version `0.6.0.pre.1` adds optional Sidekiq 4/5 middleware:
 
 ```ruby
 gem "sidekiq", "~> 5.0"
-gem "chronos-ruby", "0.9.0.pre.2", :require => "chronos/sidekiq"
+gem "chronos-ruby", "0.9.0.pre.3", :require => "chronos/sidekiq"
 ```
 
 The client middleware propagates only trace/request identifiers in a versioned Sidekiq-envelope field and never changes worker arguments. The server records class, queue, JID, retry count, duration, calculable queue latency, bounded arguments/tags, status, and error class. Values pass through the shared sanitizer before delivery. Failed jobs are notified once and the original exception is re-raised. See [Sidekiq 4/5 legacy integration](docs/modules/sidekiq-legacy.md).

data/SECURITY.md

@@ -8,4 +8,4 @@ The Chronos 0.x line provides technical compatibility with end-of-life Ruby vers
 
 Security fixes in the agent will be assessed for backporting to maintained Chronos version lines. No response-time commitment is made before a formal security process is published.
 
-The current prerelease review and residual risks are recorded in [docs/security-review.md](docs/security-review.md). Release publishing uses a protected GitHub environment and a scoped RubyGems key. Package signing is deferred until the project has a trusted certificate issuance, rotation, revocation, and offline-key process; do not add a private signing key to the repository or workflow secrets without that process.
+The current prerelease review and residual risks are recorded in [docs/security-review.md](docs/security-review.md). Release publishing uses a protected GitHub environment and RubyGems Trusted Publishing with short-lived OIDC credentials; no long-lived RubyGems API key is stored in GitHub. Package signing is deferred until the project has a trusted certificate issuance, rotation, revocation, and offline-key process; do not add a private signing key to the repository or workflow secrets without that process.

data/docs/modules/sidekiq-legacy.md

@@ -4,7 +4,7 @@ Version `0.6.0.pre.1` starts the legacy jobs line with optional Sidekiq 4 and 5
 
 ```ruby
 gem "sidekiq", "~> 5.0"
-gem "chronos-ruby", "0.9.0.pre.2", :require => "chronos/sidekiq"
+gem "chronos-ruby", "0.9.0.pre.3", :require => "chronos/sidekiq"
 ```
 
 `chronos/sidekiq` installs middleware through the public `configure_client` and `configure_server` APIs. It does nothing when Sidekiq is unavailable, and the core gem never requires Sidekiq. Installation adds no Chronos thread or Redis/database connection per job; delivery continues through the agent's existing fixed worker pool.

data/docs/performance.md

@@ -29,7 +29,7 @@ Current controls:
 
 Run the scripts under `benchmarks/` and record Ruby version, operating system, CPU, warmup, iteration count, median, and dispersion before publishing results. `benchmarks/filtering.rb` measures privacy filtering, `benchmarks/retry_backlog.rb` measures fixed-memory outage behavior, `benchmarks/request_overhead.rb` compares Rack-protocol calls, and `benchmarks/rails_notifications.rb` isolates subscriber normalization overhead.
 
-## Version 0.9.0.pre.2 release gates
+## Version 0.9.0.pre.3 release gates
 
 `benchmarks/comparative.rb` compares the same successful Rack fixture without and with Chronos instrumentation. It performs configurable warmup, at least three samples, and reports median plus median absolute deviation. `benchmarks/fake_endpoint_load.rb` sends asynchronous exception events to a local TCP endpoint, verifies the v1 schema marker, ensures the secret key is absent from every payload, and fails on loss, rejection, invalid payload, or timeout.
 

data/docs/protocol-v1.md

@@ -1,5 +1,5 @@
 # Protocol v1 stability
 
-The schemas under `contracts/` are the source of truth for protocol v1. Version `0.9.0.pre.2` keeps `schema_version: "1.0"` and treats every required field, enum value, privacy exclusion, and maximum as a compatibility contract.
+The schemas under `contracts/` are the source of truth for protocol v1. Version `0.9.0.pre.3` keeps `schema_version: "1.0"` and treats every required field, enum value, privacy exclusion, and maximum as a compatibility contract.
 
 Compatible changes may add optional bounded fields or new event types accepted by the server. Removing or renaming a field, changing its type/meaning, weakening a bound, or making an optional field required needs a new protocol major schema. Authentication remains outside the JSON payload. Contract tests and `script/verify_docs` must pass before a release.

data/docs/release-1.0-readiness.md

@@ -1,6 +1,6 @@
 # Version 1.0 readiness
 
-Version `0.9.0.pre.2` is a hardening release, not the stable release. The local suite, lint, documentation verifier, build, load test, and comparative benchmark are required evidence. The release can advance to `1.0.0` only after the GitHub Actions matrix is green for every declared legacy Ruby/framework/job combination.
+Version `0.9.0.pre.3` is a hardening release, not the stable release. The local suite, lint, documentation verifier, build, load test, and comparative benchmark are required evidence. The release can advance to `1.0.0` only after the GitHub Actions matrix is green for every declared legacy Ruby/framework/job combination.
 
 | Gate | State in pre.2 |
 |---|---|

data/docs/security-review.md

@@ -1,4 +1,4 @@
-# Security review for 0.9.0.pre.2
+# Security review for 0.9.0.pre.3
 
 Review date: 2026-07-21. Scope: capture, serialization, transport, remote configuration, framework/job integrations, release workflow, examples, and fixtures.
 

data/lib/chronos/core/notice.rb

@@ -23,7 +23,7 @@ module Chronos
 
       def initialize(attributes)
         ATTRIBUTES.each do |attribute|
-          instance_variable_set("@#{attribute}", deep_freeze(attributes[attribute]))
+          instance_variable_set("@#{attribute}", immutable_copy(attributes[attribute]))
         end
         freeze
       end
@@ -36,17 +36,29 @@ module Chronos
 
       private
 
-      def deep_freeze(value)
+      def immutable_copy(value)
         case value
         when Hash
-          value.each do |key, child|
-            deep_freeze(key)
-            deep_freeze(child)
+          value.each_with_object({}) do |(key, child), copy|
+            copy[immutable_copy(key)] = immutable_copy(child)
           end
         when Array
-          value.each { |child| deep_freeze(child) }
+          value.map { |child| immutable_copy(child) }
+        when String
+          value.dup
+        when NilClass, TrueClass, FalseClass, Symbol, Numeric
+          value
+        else
+          value.dup
+        end.freeze
+      rescue TypeError
+        value
+      rescue StandardError
+        begin
+          value.dup.freeze
+        rescue StandardError
+          value
         end
-        value.freeze
       end
     end
   end

data/lib/chronos/version.rb

@@ -1,4 +1,4 @@
 module Chronos
   # Current version of the legacy Chronos Ruby agent.
-  VERSION = "0.9.0.pre.2".freeze
+  VERSION = "0.9.0.pre.3".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: chronos-ruby
 version: !ruby/object:Gem::Version
-  version: 0.9.0.pre.2
+  version: 0.9.0.pre.3
 platform: ruby
 authors:
 - Antonio Jefferson
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-21 00:00:00.000000000 Z
+date: 2026-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler