rigortype 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47346567152367cb408115b6a33214e43468f2255bd632b4894d8c68164b8ada
-  data.tar.gz: 407d5cda9e08342670a4eeb05ae2c565d398866174d292c586793cb213a77fdb
+  metadata.gz: 8142401ce01630e0adcc3e1d59dedfc0a123ae247617b7bf91d33cbffe4cb193
+  data.tar.gz: ca747bb44214c0bf7dca8203f1c2fcf84657b8a639dbdc5448ede1f32b3f48ae
 SHA512:
-  metadata.gz: f6ffecd573e1bbb387c861cbe3a6d909d217dfadef453a7a84339a4f7fd44e2c86dbbac54c8369298b56a2de3771c0f75c28cfe098cb895355a52155657f4f9d
-  data.tar.gz: 6f924aed4bc15581bae58ffa62a5d8194db3fabbdc3056f2b6cfc4f068f972063e0148f85df8b8ef3e5f5003fad35b4e9016e534ef604cbfc581d0cdab76bb7b
+  metadata.gz: 02ef30047bcbf17ee716634315664522449610396c0645cf2e9f289fab7b1bc5667ac60a3cbe4069b59c7435bc1ad2ff9142f35f525df019b439ef74ad58191b
+  data.tar.gz: 6e6fe48ffce033b46a1f44be6b2eff62c3e11733f6fd5a583a17e631e18a752d3b77464783da88e9c9f5f0ee345440ca5c751d05e3d77d5253334f3a988bbcf4

data/README.md

@@ -79,6 +79,12 @@ bundle exec rigor type-of lib/foo.rb:10:5
 # Report Scope#type_of coverage across a tree (handy when
 # diagnosing why a particular call site reads as `untyped`).
 bundle exec rigor type-scan lib
+
+# Emit RBS skeletons from inference results — review with
+# `--diff`, write to `sig/` with `--write`. ADR-14 sig-gen.
+bundle exec rigor sig-gen --print lib/foo.rb
+bundle exec rigor sig-gen --diff  lib/foo.rb
+bundle exec rigor sig-gen --write lib/foo.rb
 ```
 
 ### Sample output
@@ -145,6 +151,7 @@ out of the box, without you writing a single annotation.
 | **Intersection** (`Type::Intersection`) | Composition of multiple refinements | `non-empty-lowercase-string = non-empty-string ∩ lowercase-string` |
 | **Tuple / HashShape** | Heterogeneous arrays / known-key hashes that carry per-position / per-key types | `[1, "two", :three]` types as `Tuple[Constant<1>, Constant<"two">, Constant<:three>]`; `{name: "Alice", age: 30}` as `HashShape{name: Constant<"Alice">, age: Constant<30>}` |
 | **Union** (`Type::Union`) | "One of these literal values" — finite enums Rigor can enumerate | `Constant<:zero> \| Constant<:small> \| Constant<:large>` |
+| **`Method` binding** (`Type::BoundMethod`) | The receiver / method-name pair `Object#method(:sym)` produces, so `.call` / `.()` / `[]` recover the precise backing dispatch | `"1".method(:to_i).call` resolves to `Constant<1>` instead of `untyped` |
 | **`Dynamic[T]`** | The gradual carrier — wraps a static facet with a "could be anything" admission | `Dynamic[Top]` is the conservative fallback Rigor uses when it cannot prove a narrower type |
 
 Each refinement / range / literal carrier **erases to its base
@@ -188,6 +195,12 @@ label = case n
 label                          # Constant<:zero> | Constant<:small>
                                #   | Constant<:large>
 
+# Method bindings keep their receiver — `.method(:sym).call`
+# round-trips through the original dispatch.
+[:to_i, :to_f, :to_sym].map { |m| "1".method(m).call }
+                       # Tuple[Constant<1>, Constant<1.0>, Constant<:"1">]
+                       # — per-element fold + BoundMethod backward fold
+
 # RBS::Extended directives let you tighten beyond what RBS expresses.
 class Slug
   %a{rigor:v1:return: non-empty-string}
@@ -239,6 +252,16 @@ Rigor consults, in order:
    Rigor walks `def` / `define_method` / `attr_*` /
    `Data.define(*Symbol)` so user-defined methods on a class
    are recognised.
+5. **Opt-in gem-source inference (ADR-10).** Gems listed
+   under `dependencies.source_inference:` in `.rigor.yml`
+   have their `lib/` walked the same way project source is,
+   so methods on those gems' classes resolve even without
+   RBS. Inferred returns crossing the gem boundary are
+   wrapped in `Dynamic[T]` so the call site retains the
+   provenance — RBS / RBS::Inline / generated stubs / plugin
+   contracts always win on conflict. Default behaviour is
+   unchanged: gems not listed stay at the
+   RBS-or-`Dynamic[Top]` boundary.
 
 If a type cannot be proved, the engine returns `Dynamic[Top]`
 (Rigor's gradual carrier) and stays silent — Rigor never invents
@@ -343,6 +366,10 @@ sees `id` as `non-empty-string` (so `id.empty?` reduces to
   optional policies, per-element block fold over
   `map`, `select`, `filter_map`, `flat_map`, `find` /
   `find_index`, `count`, `any?` / `all?` / `none?`, `zip`.
+  `&:symbol` block-pass on these methods is treated as
+  `{ |x| x.symbol }` and dispatches against the element type
+  so `Hash#transform_values(&:freeze)` returns `Hash[K, V]`
+  instead of `Enumerator[...]`.
 - **Constant folding** — aggressive arithmetic / string /
   Symbol / Tuple-shaped `divmod` folding, cartesian fold over
   `Union[Constant…]`, integer-range arithmetic
@@ -360,26 +387,48 @@ sees `id` as `non-empty-string` (so `id.empty?` reduces to
 - **Refinement carriers** — `Type::Difference`,
   `Type::Refined`, `Type::Intersection` provide the
   imported-built-in catalogue end-to-end through
-  `Builtins::ImportedRefinements`.
+  `Builtins::ImportedRefinements`. The parser accepts Symbol
+  / String literals and `|`-unions at type-arg position
+  (`pick_of[Shape, :a | :b]`, `Pick[T, "name" | "email"]`).
+- **`Method` carrier (`Type::BoundMethod`)** —
+  `Object#method(:sym)` lifts into a binding carrier so
+  `.call` / `.()` / `[]` recover the precise dispatch
+  (`"1".method(:to_i).call` resolves to `Constant<1>`).
+  Reflective Method members (`#owner` / `#name` / `#arity`)
+  still resolve via the Method RBS sig.
 - **`RBS::Extended` directive routes** — `return:`, `param:`
   (call-site + body-side), `assert:` /
   `predicate-if-(true|false)` accept refinement payloads, and
   roll up into a single `Rigor::FlowContribution` bundle per
   method (the v0.1.0 plugin contribution merger reads bundles
   directly).
+- **Opt-in gem-source inference (ADR-10)** — gems listed under
+  `dependencies.source_inference:` have their `lib/` walked.
+  Per-gem budget, per-gem-version cache slice,
+  `dynamic.dependency-source.*` diagnostic family covering
+  gem-not-found / budget-exceeded / config-conflict /
+  boundary-cross (the last surfaces RBS+gem-source overlap
+  on `mode: :full` gems for audit).
 
 The full per-release surface lives in
 [`CHANGELOG.md`](CHANGELOG.md). The internal contracts the
 analyzer guarantees live under
 [`docs/internal-spec/`](docs/internal-spec/).
 
-## Plugins (v0.1.0)
+## Plugins
+
+`v0.1.0` introduced the extension API; `v0.1.x` rounds it out
+with the [ADR-9](docs/adr/9-cross-plugin-api.md) cross-plugin
+fact channel (one plugin publishes a fact like `:model_index`,
+another consumes it), [ADR-11](docs/adr/11-sorbet-input-adapter.md)
+Sorbet ingestion, and [ADR-13](docs/adr/13-typenode-resolver-plugin.md)
+plugin-supplied type-vocabulary resolvers. **Nineteen worked
+examples** ship under [`examples/`](examples/) — each is a
+fully-shaped plugin gem with a runnable demo and an end-to-end
+integration spec.
 
-`v0.1.0` adds an extension API so projects can teach Rigor about
-their own DSLs. Seven worked examples ship under
-[`examples/`](examples/) — each is a fully-shaped plugin gem
-with a runnable demo and an end-to-end integration spec, and
-each spotlights a different facet of the plugin contract:
+**Plugin-contract teaching examples** (focus on a single
+extension-point):
 
 - [`rigor-deprecations`](examples/rigor-deprecations/) —
   smallest possible plugin (~80 lines); config-driven rules.
@@ -393,21 +442,45 @@ each spotlights a different facet of the plugin contract:
 - [`rigor-units`](examples/rigor-units/) — local-variable flow
   tracking through arithmetic.
 - [`rigor-routes`](examples/rigor-routes/) — `Plugin::IoBoundary`
-  reads under `TrustPolicy` plus cache producers (slice 2 +
-  slice 6).
-- [`rigor-activerecord`](examples/rigor-activerecord/) —
-  validates `Model.find` / `.find_by` / `.where` against
-  `db/schema.rb` and discovered AR model classes; combines
-  DSL interpretation, multi-file `IoBoundary`, and chained
-  cache producers — the most architecturally complete example.
+  reads under `TrustPolicy` plus cache producers.
+- [`rigor-typescript-utility-types`](examples/rigor-typescript-utility-types/)
+  — `Plugin::TypeNodeResolver` chain wiring TS-canonical names
+  (`Pick` / `Omit` / `Partial` / `Required` / `Readonly`) onto
+  Rigor's shape-projection type functions.
+
+**Rails ecosystem plugins** (Tier 1 + Tier 2 + Tier 3 + Sorbet):
+
+- Tier 1: [`rigor-rails-routes`](examples/rigor-rails-routes/),
+  [`rigor-rails-i18n`](examples/rigor-rails-i18n/),
+  [`rigor-actionmailer`](examples/rigor-actionmailer/),
+  [`rigor-activejob`](examples/rigor-activejob/).
+- Tier 2: [`rigor-actionpack`](examples/rigor-actionpack/)
+  (4 phases — routes / filters / renders / strong-params),
+  [`rigor-factorybot`](examples/rigor-factorybot/),
+  [`rigor-activerecord`](examples/rigor-activerecord/) —
+  publishes `:model_index` via ADR-9 for the other two
+  to consume.
+- Tier 3: [`rigor-pundit`](examples/rigor-pundit/),
+  [`rigor-sidekiq`](examples/rigor-sidekiq/),
+  [`rigor-rspec`](examples/rigor-rspec/),
+  [`rigor-actioncable`](examples/rigor-actioncable/).
+- Parallel: [`rigor-sorbet`](examples/rigor-sorbet/) — ingests
+  Sorbet `sig` / `T.let` / `T.cast` / `T.must` / `T.bind` /
+  `T.assert_type!` / `T.reveal_type` / `T.absurd` and RBI
+  files as type sources.
 
 [`examples/README.md`](examples/README.md) is the plugin
 authoring landing page — comparison table, recommended reading
 order, and the architectural map of which surface each example
 exercises. The binding contract for the plugin API lives in
-[`docs/adr/2-extension-api.md`](docs/adr/2-extension-api.md)
-and the slice-by-slice normative specs under
-[`docs/internal-spec/plugin*.md`](docs/internal-spec/).
+[`docs/adr/2-extension-api.md`](docs/adr/2-extension-api.md);
+the slice-by-slice normative specs are under
+[`docs/internal-spec/plugin*.md`](docs/internal-spec/); the
+sibling ADRs that extend it ride the same surface
+([ADR-9](docs/adr/9-cross-plugin-api.md) cross-plugin facts,
+[ADR-11](docs/adr/11-sorbet-input-adapter.md) Sorbet adapter,
+[ADR-13](docs/adr/13-typenode-resolver-plugin.md) TypeNode
+resolver).
 
 ## Configuration
 
@@ -437,22 +510,53 @@ Common knobs the file exposes:
 
 ## Status
 
-Current released version: **`v0.0.8`** (the eighth preview).
-The analyzer is usable on real Ruby code today but the rule
-catalogue is deliberately narrow — Rigor's stance is to surface
-zero false positives while the inference surface stabilises.
-The roadmap is tracked in
-[`docs/MILESTONES.md`](docs/MILESTONES.md); release-by-release
+Current released version: **`v0.1.2`**. The analyzer is usable
+on real Ruby code today; the rule catalogue is deliberately
+narrow — Rigor's stance is to surface zero false positives
+while the inference surface stabilises. The roadmap is tracked
+in [`docs/MILESTONES.md`](docs/MILESTONES.md); release-by-release
 detail lives in [`CHANGELOG.md`](CHANGELOG.md).
 
-`v0.0.9` is the active development cluster on `master` and
-covers the persistent cache infrastructure (`.rigor/cache/`,
-`--cache-stats`, `--clear-cache`, `--no-cache`),
-paired-complement Refined narrowing, `literal-string` flow
-tracking, the `Rigor::FlowContribution` bundle struct, and
-six additional built-in catalogues (Random, Struct, Encoding,
-Regexp + MatchData, Proc / Method / UnboundMethod, Exception).
-The next release after `0.0.9` will be `0.1.0`.
+`v0.1.4` is the active development cluster on `master` and
+delivers:
+
+- **[ADR-10](docs/adr/10-dependency-source-inference.md) closed
+  end-to-end** — opt-in gem-source inference, per-gem budget,
+  cache slice, and the `dynamic.dependency-source.boundary-cross`
+  `:info` diagnostic that surfaces RBS / gem-source overlap
+  under `mode: :full`.
+- **[ADR-11](docs/adr/11-sorbet-input-adapter.md) primary surface
+  + per-call-site assertion gating** — `rigor-sorbet` ingests
+  Sorbet `sig { ... }` blocks, `T.let` / `T.cast` / `T.must` /
+  `T.bind` / `T.assert_type!` / `T.reveal_type` / `T.absurd`,
+  and RBI files. Per-call-site `enforce_sigil` gates assertion
+  recognisers by the caller file's `# typed:` sigil.
+- **[ADR-13](docs/adr/13-typenode-resolver-plugin.md) plugin
+  TypeNode resolver + TypeScript-utility-type adapter** —
+  `Plugin::TypeNodeResolver` extension point + five
+  Rigor-canonical shape-projection type functions
+  (`pick_of` / `omit_of` / `partial_of` / `required_of` /
+  `readonly_of`) + the opt-in `rigor-typescript-utility-types`
+  plugin mapping TS spellings onto the core functions.
+  `Pick[T, :a | :b]` round-trips through the directive grammar.
+- **[ADR-14](docs/adr/14-rbs-sig-generation.md) — `rigor sig-gen`
+  CLI** — emits RBS from inference results across five
+  classifications (`new-file` / `new-method` / `tighter-return`
+  / `equivalent` / `skipped`); `--params=untyped` default,
+  `--params=observed` opt-in via `--observe=PATH`.
+- **`Method` carrier (`Type::BoundMethod`)** —
+  `Object#method(:sym).call` / `.()` / `[]` round-trip with
+  full precision instead of collapsing to `untyped`.
+- **Rails ecosystem (Tier 1 + Tier 2)** — `rigor-rails-routes`,
+  `rigor-rails-i18n`, `rigor-actionmailer`, `rigor-activejob`,
+  `rigor-actionpack` (4 phases), `rigor-factorybot`, and
+  `rigor-activerecord` publishing `:model_index` via the
+  ADR-9 cross-plugin fact channel.
+
+Nineteen worked plugin examples now ship under
+[`examples/`](examples/) — see
+[`examples/README.md`](examples/README.md) for the comparison
+table.
 
 ## Contributing
 

data/lib/rigor/analysis/check_rules.rb

@@ -262,7 +262,7 @@ module Rigor
       # errors, internal analyzer errors) are NEVER
       # suppressed — they represent failures the user cannot
       # silence away.
-      def filter_suppressed(diagnostics, comments:, disabled_rules:) # rubocop:disable Metrics/CyclomaticComplexity
+      def filter_suppressed(diagnostics, comments:, disabled_rules:)
         line_suppressions, file_suppressions = parse_suppression_comments(comments)
         disabled = expand_rule_tokens(disabled_rules)
 
@@ -329,7 +329,7 @@ module Rigor
       class << self
         private
 
-        def undefined_method_diagnostic(path, call_node, scope_index) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        def undefined_method_diagnostic(path, call_node, scope_index)
           return nil if call_node.receiver.nil?
 
           scope = scope_index[call_node]
@@ -429,7 +429,7 @@ module Rigor
         # by `undefined_method_diagnostic`; it returns nil
         # when the call's receiver / RBS coverage / call shape
         # disqualifies the rule.
-        # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         def wrong_arity_diagnostic(path, call_node, scope_index)
           return nil if call_node.receiver.nil?
           return nil unless plain_positional_call?(call_node)
@@ -459,7 +459,7 @@ module Rigor
 
           build_arity_diagnostic(path, call_node, class_name, min, max, actual)
         end
-        # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
         def plain_positional_call?(call_node)
           arguments = call_node.arguments
@@ -534,7 +534,7 @@ module Rigor
         # and union receivers where every member already
         # disqualifies the call (avoid duplicating the
         # undefined-method diagnostic).
-        def nil_receiver_diagnostic(path, call_node, scope_index) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        def nil_receiver_diagnostic(path, call_node, scope_index)
           return nil if call_node.receiver.nil?
           # Safe-navigation calls (`recv&.method`) already
           # short-circuit on nil at runtime, so a nil-bearing
@@ -615,7 +615,7 @@ module Rigor
         # The diagnostic does NOT count toward `Result#error_count`
         # so a fixture peppered with `dump_type` calls still
         # passes `rigor check`.
-        def dump_type_diagnostic(path, call_node, scope_index) # rubocop:disable Metrics/CyclomaticComplexity
+        def dump_type_diagnostic(path, call_node, scope_index)
           return nil unless rigor_testing_call?(call_node, :dump_type)
           return nil if call_node.arguments.nil? || call_node.arguments.arguments.empty?
 
@@ -644,7 +644,7 @@ module Rigor
         # is emitted; matching calls produce no output. This
         # lets a fixture document its expected types inline:
         # subsequent `rigor check` runs flag any drift.
-        def assert_type_diagnostic(path, call_node, scope_index) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        def assert_type_diagnostic(path, call_node, scope_index)
           return nil unless rigor_testing_call?(call_node, :assert_type)
           return nil if call_node.arguments.nil? || call_node.arguments.arguments.size < 2
 
@@ -972,7 +972,6 @@ module Rigor
           )
         end
 
-        # rubocop:disable Metrics/ParameterLists
         def build_ivar_write_mismatch_diagnostic(path, node, class_name, ivar_name, first_class, other_class)
           location = node.name_loc || node.location
           Diagnostic.new(
@@ -985,7 +984,6 @@ module Rigor
             severity: :error
           )
         end
-        # rubocop:enable Metrics/ParameterLists
 
         # Returns the dead-branch node for a literal-predicate
         # if/unless, or nil when no observable branch is dead.
@@ -1034,7 +1032,6 @@ module Rigor
         #   (no splat / kw / block-pass / forwarded).
         # - Per-argument: skip when EITHER side is `Dynamic`
         #   (the call cannot be statically refuted).
-        # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
         def argument_type_diagnostic(path, call_node, scope_index)
           return nil if call_node.receiver.nil?
           return nil unless plain_positional_call?(call_node)
@@ -1059,15 +1056,13 @@ module Rigor
           return nil if method_def.nil? || method_def == true
           return nil unless method_def.method_types.size == 1
 
-          param_overrides = Rigor::RbsExtended.param_type_override_map(method_def)
+          param_overrides = Rigor::RbsExtended.param_type_override_map(method_def, environment: scope.environment)
           mismatch = first_argument_mismatch(method_def.method_types.first, call_node, scope, param_overrides)
           return nil if mismatch.nil?
 
           build_argument_type_diagnostic(path, call_node, class_name, mismatch)
         end
-        # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
 
-        # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
         def first_argument_mismatch(method_type, call_node, scope, param_overrides)
           function = method_type.type
           return nil unless argument_check_eligible?(function)
@@ -1094,7 +1089,6 @@ module Rigor
           end
           nil
         end
-        # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
 
         def argument_check_eligible?(function)
           # See `arity_eligible?`: `UntypedFunction` lacks
@@ -1132,7 +1126,6 @@ module Rigor
           )
         end
 
-        # rubocop:disable Metrics/ParameterLists
         def build_arity_diagnostic(path, call_node, class_name, min, max, actual)
           location = call_node.message_loc || call_node.location
           range = min == max ? min.to_s : "#{min}..#{max}"
@@ -1147,7 +1140,6 @@ module Rigor
             severity: :error
           )
         end
-        # rubocop:enable Metrics/ParameterLists
 
         def build_undefined_method_diagnostic(path, call_node, receiver_type)
           location = call_node.message_loc || call_node.location
@@ -1186,7 +1178,7 @@ module Rigor
         #     :maybe → emit at :warning. Promoted to :error
         #              under `severity_profile: strict` per
         #              ADR-8 § "Severity profile".
-        def return_type_mismatch_diagnostic(path, def_node, scope_index) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        def return_type_mismatch_diagnostic(path, def_node, scope_index)
           return nil if def_node.body.nil?
 
           last_expr = body_last_expression(def_node.body)
@@ -1255,7 +1247,7 @@ module Rigor
             end
           return nil if method_def.nil?
 
-          override = Rigor::RbsExtended.read_return_type_override(method_def)
+          override = Rigor::RbsExtended.read_return_type_override(method_def, environment: scope.environment)
           return override if override
 
           declared_return_union(method_def, scope.environment)

data/lib/rigor/analysis/dependency_source_inference/boundary_cross_reporter.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Analysis
+    module DependencySourceInference
+      # ADR-10 slice 5c — per-run accumulator for the
+      # `dynamic.dependency-source.boundary-cross` `:info`
+      # diagnostic.
+      #
+      # The diagnostic fires when both an authoritative source
+      # (RBS today; plugins later) AND a `mode: :full` opt-in
+      # gem's source catalog resolve the same `(class_name,
+      # method_name)`. The dispatcher takes the authoritative
+      # source's answer (per ADR-10's tier order), but records
+      # the boundary crossing so the user can audit whether RBS
+      # and the gem source have drifted.
+      #
+      # The accumulator deduplicates per `(class_name,
+      # method_name, gem_name)` so a method called from many
+      # files yields one diagnostic.
+      #
+      # Used in the same pattern as
+      # {Rigor::RbsExtended::Reporter}: the dispatcher writes
+      # events into the per-run instance; {Rigor::Analysis::Runner}
+      # drains it at end-of-run into a flat
+      # `Rigor::Analysis::Diagnostic` list.
+      class BoundaryCrossReporter
+        Entry = Data.define(:class_name, :method_name, :gem_name, :rbs_display)
+
+        def initialize
+          @entries = []
+          @mutex = Mutex.new
+        end
+
+        # @return [Array<Entry>] frozen snapshot of the recorded
+        #   boundary-cross events. Each entry is a Data with
+        #   `class_name` (String), `method_name` (Symbol),
+        #   `gem_name` (String), and `rbs_display` (String —
+        #   the authoritative-side type's human-facing form,
+        #   embedded into the diagnostic message).
+        def entries
+          @mutex.synchronize { @entries.dup.freeze }
+        end
+
+        def empty?
+          @mutex.synchronize { @entries.empty? }
+        end
+
+        # Records one boundary-cross event. Deduplicates on the
+        # `(class_name, method_name, gem_name)` triple — the
+        # diagnostic per-receiver-per-method-per-owning-gem is
+        # the actionable unit.
+        def record(class_name:, method_name:, gem_name:, rbs_display:)
+          entry = Entry.new(
+            class_name: class_name, method_name: method_name,
+            gem_name: gem_name, rbs_display: rbs_display
+          )
+          @mutex.synchronize do
+            return if @entries.any? { |existing| same_key?(existing, entry) }
+
+            @entries << entry
+          end
+        end
+
+        private
+
+        def same_key?(existing, entry)
+          existing.class_name == entry.class_name &&
+            existing.method_name == entry.method_name &&
+            existing.gem_name == entry.gem_name
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/dependency_source_inference/builder.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require_relative "gem_resolver"
+require_relative "index"
+require_relative "walker"
+
+module Rigor
+  module Analysis
+    module DependencySourceInference
+      # Folds a `Configuration::Dependencies` value into a
+      # frozen {Index}. Resolves each non-disabled entry through
+      # {GemResolver}, walks each resolved gem's `roots:` via
+      # {Walker.walk} under the configured `budget_per_gem` cap,
+      # and aggregates the per-gem method catalogs into the
+      # Index's flat `(class_name, method_name) → kind` table.
+      #
+      # Entries with `mode: :disabled` are skipped without
+      # resolution attempts so users can "list and disable" a
+      # gem in configuration without provoking a missing-gem
+      # diagnostic.
+      module Builder
+        module_function
+
+        # @param dependencies [Rigor::Configuration::Dependencies]
+        # @return [Index]
+        def build(dependencies)
+          return Index::EMPTY if dependencies.empty?
+
+          state = BuildState.new
+          dependencies.source_inference.each do |entry|
+            next if entry.disabled?
+
+            state.absorb(GemResolver.resolve(entry), dependencies.budget_per_gem, self)
+          end
+
+          state.to_index(dependencies)
+        end
+
+        # Per-build mutable accumulator. The original inline
+        # variables (`resolved` / `unresolvable` / `catalog` /
+        # `class_to_gem` / `budget_exceeded` / `gem_modes`)
+        # pushed the method past the AbcSize budget; the
+        # struct collects the same fields, narrows
+        # `absorb`'s branching, and yields one
+        # `Index.new(...)` call from `to_index`.
+        class BuildState
+          def initialize
+            @resolved = []
+            @unresolvable = []
+            @catalog = {}
+            @class_to_gem = {}
+            @budget_exceeded = []
+            @gem_modes = {}
+          end
+
+          def absorb(outcome, budget, builder)
+            case outcome
+            when GemResolver::Resolved
+              absorb_resolved(outcome, budget, builder)
+            when GemResolver::Unresolvable
+              @unresolvable << outcome
+            end
+          end
+
+          def absorb_resolved(resolved, budget, builder)
+            @resolved << resolved
+            @gem_modes[resolved.gem_name] = resolved.mode
+            walked = builder.walker_outcome_for(resolved, budget)
+            @catalog.merge!(walked.catalog)
+            builder.record_class_to_gem(walked.catalog, resolved.gem_name, @class_to_gem)
+            @budget_exceeded << resolved.gem_name if walked.truncated?
+          end
+
+          def to_index(dependencies)
+            Index.new(
+              resolved_gems: @resolved, unresolvable: @unresolvable,
+              method_catalog: @catalog, budget_exceeded: @budget_exceeded,
+              class_to_gem: @class_to_gem,
+              budget_overrun_strategy: dependencies.budget_overrun_strategy,
+              gem_modes: @gem_modes
+            )
+          end
+        end
+
+        # ADR-10 5b — per-class reverse-lookup table (β budget
+        # semantics). Records `class_name → gem_name` for every
+        # class observed in the gem's catalog. First-write-wins:
+        # if two opt-in gems re-open the same class, the first
+        # gem to harvest the class owns it in the reverse index.
+        # The dispatcher only consults this map when the
+        # `budget_overrun_strategy` is `:dependency_silence`,
+        # so the storage cost is never paid back unless the
+        # user opts in.
+        def record_class_to_gem(catalog, gem_name, class_to_gem)
+          catalog.each_key do |(class_name, _method_name)|
+            class_to_gem[class_name] ||= gem_name
+          end
+        end
+
+        # Per-resolved-gem walk. Isolated so a single gem's
+        # filesystem error / parse failure cannot abort the
+        # build; the walker swallows its own per-file errors,
+        # and a top-level raise here degrades the gem to "no
+        # contributions" without touching the rest of the run.
+        def walker_outcome_for(resolved, budget)
+          Walker.walk(gem_dir: resolved.gem_dir, roots: resolved.roots, budget: budget)
+        rescue StandardError
+          Walker::Outcome.new(catalog: {}.freeze, truncated: false)
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/dependency_source_inference/gem_resolver.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Analysis
+    module DependencySourceInference
+      # Maps a `Configuration::Dependencies::Entry` to the gem's
+      # on-disk installation directory by consulting RubyGems
+      # (`Gem.loaded_specs` first, falling back to
+      # `Gem::Specification.find_by_name`). Returns either a
+      # frozen {Resolved} value object or an {Unresolvable} value
+      # describing why the gem cannot participate in this run.
+      #
+      # Resolution failures are surfaced as
+      # `dynamic.dependency-source.gem-not-found` diagnostics by
+      # {Analysis::Runner} rather than crashing the run, so a
+      # missing gem in `dependencies.source_inference` degrades
+      # cleanly to "no contributions from that gem" — every other
+      # gem and the project source remain unaffected.
+      module GemResolver
+        # Successful resolution. `version` is the spec version as
+        # a String so it round-trips into cache descriptors
+        # (slice 3) without leaking a `Gem::Version` instance
+        # through public surfaces.
+        class Resolved < Data.define(:gem_name, :version, :gem_dir, :mode, :roots)
+          def descriptor_key
+            [gem_name, version, mode].freeze
+          end
+        end
+
+        # Unresolvable reasons. `:not_in_bundle` covers both the
+        # "RubyGems doesn't know this gem" case and the
+        # `LoadError`-style raise from `find_by_name`. Future
+        # reasons (`:c_extension_only`, `:no_lib_root`) are
+        # introduced as the walker discovers them in slice 2b.
+        Unresolvable = Data.define(:gem_name, :reason)
+
+        VALID_REASONS = %i[not_in_bundle].freeze
+
+        module_function
+
+        # @param entry [Rigor::Configuration::Dependencies::Entry]
+        # @return [Resolved, Unresolvable]
+        def resolve(entry)
+          spec = locate_gem_spec(entry.gem)
+          return Unresolvable.new(gem_name: entry.gem, reason: :not_in_bundle) if spec.nil?
+
+          Resolved.new(
+            gem_name: entry.gem,
+            version: spec.version.to_s,
+            gem_dir: spec.full_gem_path, # rigor:disable undefined-method
+            mode: entry.mode,
+            roots: entry.roots
+          )
+        end
+
+        # Locator. `Gem.loaded_specs` reflects the bundle (cheap
+        # lookup, no filesystem walk); `find_by_name` is the
+        # broader fallback for gems present on the gem path but
+        # not yet `require`'d. `Gem::MissingSpecError` is a
+        # `LoadError` subclass, so the rescue covers both
+        # missing-spec and load-error signals.
+        def locate_gem_spec(name)
+          Gem.loaded_specs[name] || begin
+            Gem::Specification.find_by_name(name)
+          rescue LoadError
+            nil
+          end
+        end
+      end
+    end
+  end
+end