Beacon Ruby v1.1.0

Beacon Ruby v1.1.0

Beacon Ruby v1.1.0 adds opt-in Security to the source distribution. The Release
contains beacon-ruby-1.1.0-source.tar.gz, beacon-security-0.1.0.gem, SOURCE.txt
and SHA256SUMS. The Security gem has its own package version and is distributed
through GitHub, not RubyGems. Existing upstream instrumentation gem identities and
versions remain unchanged.

Security

• Disabled by default; explicit Rack middleware and SDK initialization are required.
• Bounded request-local correlation of query/header inputs with selected PostgreSQL,
  mysql2, Kernel command, File and Net::HTTP calls. Matching is approximate and all
  attack evidence remains unknown, not confirmation of exploitation.
• Schema v2 findings, fingerprint v1, and periodic runtime dependency inventories
  through the host OpenTelemetry Logs pipeline, with redaction and trace correlation.
• Runtime SBOM defaults on within the enabled lifecycle; local diagnostic files
  remain off. Inventory observes activated gems, not a complete dependency graph.
• Pinned Security contract: af1b834501210bfd197bf606163680129cc5d09b.

Validation

Linux CRuby 3.3, 3.4 and 4.0 pass Security CI. Local Ubuntu 24.04 x86_64 acceptance
uses CRuby 3.3.12 and Bundler 2.5.22: 22 tests, 133 assertions, no failures/errors/
skips and 95.48% line coverage, including PostgreSQL 16.15 and MySQL 8.4.
All four fingerprint vectors and v2 finding/inventory schema checks pass.

Source and independently installed gem paths deliver actual Security Logs to
Collector Contrib 0.135.0 over HTTP/protobuf. Acceptance verifies service/resource,
scope, severity, native event name, redaction and trace correlation. The source
archive is checked against its committed tree; checksums cover source, gem and
provenance. The downloaded public assets are checked again after publication.

The original base/Net::HTTP trace path remains available and its Collector smoke
check is repeated from the release archive. See the versioned
installation guide, Security reference
and release acceptance.

Limits and rollback

No zero-code launcher, executable agent or RubyGems publication is introduced.
Security does not model bodies, asynchronous propagation, streaming responses,
complete taint/sanitizer analysis or every client API. Rails-specific adapters,
JRuby, other operating systems, profiling, DataKit and production backend acceptance
remain outside this release's validated scope. CI coverage does not establish
Collector acceptance on every runtime. Performance measurements are local
benchmarks, not production overhead guarantees.

Set BEACON_SECURITY_ENABLED=false and restart to disable Security. To roll back,
restore the previous verified source/gem references, application lockfile and SDK
initialization, restart and verify telemetry. Beacon Ruby v1.0.0 has no Security.