rigortype 0.1.8 → 0.1.9

data/lib/rigor/inference/method_dispatcher.rb

@@ -13,6 +13,13 @@ require_relative "method_dispatcher/rbs_dispatch"
 require_relative "method_dispatcher/iterator_dispatch"
 require_relative "method_dispatcher/block_folding"
 require_relative "method_dispatcher/file_folding"
+require_relative "method_dispatcher/shellwords_folding"
+require_relative "method_dispatcher/math_folding"
+require_relative "method_dispatcher/time_folding"
+require_relative "method_dispatcher/regexp_folding"
+require_relative "method_dispatcher/cgi_folding"
+require_relative "method_dispatcher/uri_folding"
+require_relative "method_dispatcher/set_folding"
 require_relative "method_dispatcher/kernel_dispatch"
 require_relative "method_dispatcher/method_folding"
 
@@ -643,7 +650,7 @@ module Rigor
         ConstantFolding.try_fold(receiver: receiver_type, method_name: method_name, args: arg_types) ||
           LiteralStringFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
           ShapeDispatch.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
-          FileFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
+          dispatch_stdlib_module_tiers(receiver_type, method_name, arg_types) ||
           KernelDispatch.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
           MethodFolding.try_forward(receiver: receiver_type, method_name: method_name, args: arg_types) ||
           BlockFolding.try_fold(
@@ -651,6 +658,21 @@ module Rigor
           )
       end
 
+      # Stdlib module singleton-folding tiers: File, Shellwords, Math,
+      # Time, Regexp, CGI, URI, Set. Extracted from
+      # `dispatch_precise_tiers` to keep the parent method within the
+      # cyclomatic-complexity limit.
+      def dispatch_stdlib_module_tiers(receiver_type, method_name, arg_types)
+        FileFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
+          ShellwordsFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
+          MathFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
+          TimeFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
+          RegexpFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
+          CGIFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
+          URIFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types) ||
+          SetFolding.try_dispatch(receiver: receiver_type, method_name: method_name, args: arg_types)
+      end
+
       def try_user_class_fallback(receiver_type, method_name, arg_types, environment, block_type, call_node = nil)
         return nil if environment.nil?
 
@@ -771,6 +793,18 @@ module Rigor
         array_lift = array_new_lift(receiver_type.class_name, arg_types)
         return array_lift if array_lift
 
+        range_lift = range_new_lift(receiver_type.class_name, arg_types)
+        return range_lift if range_lift
+
+        set_lift = set_new_lift(receiver_type.class_name, arg_types)
+        return set_lift if set_lift
+
+        regexp_lift = regexp_new_lift(receiver_type.class_name, arg_types)
+        return regexp_lift if regexp_lift
+
+        date_lift = date_new_lift(receiver_type.class_name, arg_types)
+        return date_lift if date_lift
+
         Type::Combinator.nominal_of(receiver_type.class_name)
       end
 
@@ -840,6 +874,119 @@ module Rigor
         type
       end
 
+      # `Range.new(b, e)` / `Range.new(b, e, excl)` — folds to
+      # `Constant[Range]` when both endpoints are `Constant[Integer]`
+      # or both are `Constant[String]`, and the optional third argument
+      # is a `Constant[true/false]`. Nil endpoints (beginless /
+      # endless ranges) are not folded because the useful instance
+      # methods (`to_a`, `first`, `last`) are not defined for them;
+      # the RBS tier answers `Nominal[Range]` for those forms.
+      def range_new_lift(class_name, arg_types)
+        return nil unless class_name == "Range"
+        return nil if arg_types.size < 2 || arg_types.size > 3
+
+        b_type = arg_types[0]
+        e_type = arg_types[1]
+
+        return nil unless b_type.is_a?(Type::Constant) && e_type.is_a?(Type::Constant)
+
+        b_val = b_type.value
+        e_val = e_type.value
+
+        # Only fold homogeneous Integer or String endpoint pairs.
+        return nil unless b_val.instance_of?(e_val.class)
+        return nil unless b_val.is_a?(Integer) || b_val.is_a?(String)
+
+        excl = range_new_excl(arg_types[2])
+        return nil if excl.nil?
+
+        Type::Combinator.constant_of(Range.new(b_val, e_val, excl))
+      rescue StandardError
+        nil
+      end
+
+      # Resolves the optional `exclude_end` argument for `range_new_lift`.
+      # Returns `false` (no arg), `true`/`false` (Constant[bool] arg),
+      # or `nil` to signal "decline" (wrong type / wrong value class).
+      def range_new_excl(excl_type)
+        case excl_type
+        when nil then false
+        when Type::Constant
+          excl_type.value if [true, false].include?(excl_type.value)
+        end
+      end
+
+      # `Set.new` / `Set.new(tuple_of_constants)` — folds to `Constant[Set]`
+      # when zero arguments are given or the single argument is a `Tuple`
+      # whose every element is a `Constant[T]`. Mirrors `SetFolding#fold_new`
+      # but lives here so the `:new` path in `try_meta_introspection` can
+      # reach it before the RBS tier answers `Nominal[Set]`.
+      def set_new_lift(class_name, arg_types)
+        return nil unless class_name == "Set"
+        return Type::Combinator.constant_of(::Set.new) if arg_types.empty?
+        return nil if arg_types.size > 1
+
+        arg = arg_types.first
+        return nil unless arg.is_a?(Type::Tuple)
+        return nil unless arg.elements.all?(Type::Constant)
+
+        values = arg.elements.map(&:value)
+        Type::Combinator.constant_of(::Set.new(values))
+      rescue StandardError
+        nil
+      end
+
+      # `Regexp.new(pattern)` / `Regexp.new(pattern, opts)` — folds to
+      # `Constant[Regexp]` when the pattern is a `Constant[String]`.
+      # Mirrors `RegexpFolding#fold_new` but lives here so the `:new` path
+      # in `try_meta_introspection` can reach it.
+      def regexp_new_lift(class_name, arg_types)
+        return nil unless class_name == "Regexp"
+        return nil if arg_types.empty? || arg_types.size > 2
+
+        pattern_arg = arg_types.first
+        return nil unless pattern_arg.is_a?(Type::Constant) && pattern_arg.value.is_a?(String)
+
+        opts = if arg_types.size == 2
+                 opt_type = arg_types[1]
+                 return nil unless opt_type.is_a?(Type::Constant)
+
+                 opt_type.value
+               else
+                 0
+               end
+
+        Type::Combinator.constant_of(Regexp.new(pattern_arg.value, opts))
+      rescue StandardError
+        nil
+      end
+
+      # `Date.new(y, m, d)` / `DateTime.new(y, m, d, h, min, s, off)`
+      # — folds to `Constant[Date]` / `Constant[DateTime]` when every
+      # argument is a `Constant` carrying an Integer (or, for the
+      # `DateTime` offset / `start` slots, a Rational or String).
+      # `Date.new` carries no timezone, and `DateTime.new`'s offset
+      # defaults to UTC, so the literal is machine-independent.
+      # `Date.today` / `Date.parse` are not constructors here — they
+      # are non-deterministic / string-dependent and stay
+      # `Nominal[Date]`.
+      DATE_NEW_CLASSES = %w[Date DateTime].freeze
+      private_constant :DATE_NEW_CLASSES
+
+      def date_new_lift(class_name, arg_types)
+        return nil unless DATE_NEW_CLASSES.include?(class_name)
+        return nil unless arg_types.size.between?(1, 8)
+        return nil unless arg_types.all?(Type::Constant)
+
+        values = arg_types.map(&:value)
+        return nil unless values.all? { |v| v.is_a?(Integer) || v.is_a?(Rational) || v.is_a?(String) }
+
+        klass = class_name == "Date" ? Date : DateTime
+        Type::Combinator.constant_of(klass.new(*values))
+      rescue StandardError
+        nil
+      end
+
       CONSTANT_METACLASSES = {
         Integer => "Integer", Float => "Float", String => "String",
         Symbol => "Symbol", Range => "Range",

data/lib/rigor/inference/method_parameter_binder.rb

@@ -43,10 +43,15 @@ module Rigor
       #   method (either `def self.foo` or a `def foo` inside
       #   `class << self`); routes the lookup through
       #   `RbsLoader#singleton_method`.
-      def initialize(environment:, class_path:, singleton:)
+      # @param source_path [String, nil] the project-relative path of
+      #   the file the method is defined in. Used to match ADR-28
+      #   path-scoped protocol contracts; `nil` (the default for
+      #   synthetic / probe scopes) disables the contract tier.
+      def initialize(environment:, class_path:, singleton:, source_path: nil)
         @environment = environment
         @class_path = class_path
         @singleton = singleton
+        @source_path = source_path
       end
 
       # @param def_node [Prism::DefNode]
@@ -58,15 +63,22 @@ module Rigor
         types = default_types_for(slots)
 
         rbs_method = lookup_rbs_method(def_node)
-        return types unless rbs_method
-
-        apply_rbs_overloads(types, slots, rbs_method.method_types) unless rbs_method.method_types.empty?
-        # `rigor:v1:param: <name> <refinement>` annotations
-        # tighten the bound type for matching slots. Applied
-        # after the RBS-overload pass so the override is the
-        # authoritative answer regardless of what the RBS
-        # signature declared.
-        apply_param_overrides(types, slots, rbs_method)
+        if rbs_method
+          apply_rbs_overloads(types, slots, rbs_method.method_types) unless rbs_method.method_types.empty?
+          # `rigor:v1:param: <name> <refinement>` annotations
+          # tighten the bound type for matching slots. Applied
+          # after the RBS-overload pass so the override is the
+          # authoritative answer regardless of what the RBS
+          # signature declared.
+          apply_param_overrides(types, slots, rbs_method)
+        end
+        # ADR-28 — a path-scoped protocol contract supplies the
+        # parameter type for a matching `def`. Applied last (most
+        # authoritative) and regardless of RBS presence: the
+        # methods a contract targets — controller actions and the
+        # like — typically have no RBS signature at all, so this
+        # tier must run even when `rbs_method` is nil.
+        apply_protocol_contract(types, slots, def_node)
         types
       end
 
@@ -75,6 +87,10 @@ module Rigor
       ParamSlot = Data.define(:kind, :name, :index)
       private_constant :ParamSlot
 
+      # Slot kinds a contract's positional `index` can address.
+      POSITIONAL_KINDS = %i[required_positional optional_positional].freeze
+      private_constant :POSITIONAL_KINDS
+
       # Walk the Prism `ParametersNode` and emit one slot per named
       # parameter, in declaration order. Anonymous slots (rest /
       # keyword-rest with no name) are skipped because we have no
@@ -187,6 +203,47 @@ module Rigor
         end
       end
 
+      # ADR-28 — when a path-scoped protocol contract targets this
+      # `def` (file path matches the contract's `path_glob`, method
+      # name + singleton-ness match), replace each contracted
+      # positional slot's binding with the contract's declared type.
+      # The type name resolves against the environment lazily here;
+      # an unresolvable name (the protocol's RBS not loaded) falls
+      # through to whatever the prior tiers bound, fail-soft.
+      def apply_protocol_contract(types, slots, def_node)
+        return if @source_path.nil?
+
+        registry = @environment.respond_to?(:plugin_registry) ? @environment.plugin_registry : nil
+        return if registry.nil?
+
+        contract = matching_contract(registry, def_node)
+        return if contract.nil?
+
+        contract.param_types.each do |param_type|
+          slot = positional_slot_at(slots, param_type.index)
+          next if slot.nil? || slot.name.nil?
+
+          resolved = @environment.nominal_for_name(param_type.type_name)
+          next if resolved.nil?
+
+          types[slot.name] = resolved
+        end
+      end
+
+      def matching_contract(registry, def_node)
+        contracts = registry.contracts_for_path(@source_path)
+        return nil if contracts.empty?
+
+        singleton = def_node.receiver.is_a?(Prism::SelfNode) || @singleton
+        contracts.find do |contract|
+          contract.method_name == def_node.name && contract.singleton == singleton
+        end
+      end
+
+      def positional_slot_at(slots, index)
+        slots.find { |slot| POSITIONAL_KINDS.include?(slot.kind) && slot.index == index }
+      end
+
       def collect_translated_types(method_types, slot)
         rbs_types = method_types.flat_map do |mt|
           t = rbs_type_for_slot(mt.type, slot)

data/lib/rigor/inference/narrowing.rb

@@ -386,8 +386,8 @@ module Rigor
           analyse_local_read(node, scope)
         when Prism::LocalVariableWriteNode
           analyse_local_write(node, scope)
-        when Prism::InstanceVariableWriteNode
-          analyse_ivar_write(node, scope)
+        when Prism::InstanceVariableReadNode, Prism::InstanceVariableWriteNode
+          analyse_ivar(node, scope)
         when Prism::ClassVariableWriteNode
           analyse_cvar_write(node, scope)
         when Prism::GlobalVariableWriteNode
@@ -767,7 +767,17 @@ module Rigor
           ]
         end
 
-        def analyse_ivar_write(node, scope)
+        # Truthy guard on an instance variable. Covers both the bare
+        # read — `if @ivar`, the left arm of `@ivar && @ivar.foo`,
+        # the receiver of `unless @ivar.nil?` once `!` reverses it —
+        # and the assignment-in-condition write `if @ivar = expr`.
+        # Mirrors `analyse_local_read` / `analyse_local_write`: the
+        # truthy edge narrows the ivar by `narrow_truthy` (dropping
+        # `nil` / `false`), the falsey edge by `narrow_falsey`. The
+        # narrowing is scoped to the guarded branch only, so it is
+        # purely additive — it never widens or re-narrows the ivar
+        # binding seen elsewhere.
+        def analyse_ivar(node, scope)
           current = scope.ivar(node.name)
           return nil if current.nil?
 
@@ -2024,15 +2034,24 @@ module Rigor
         end
 
         def analyse_nil_predicate(receiver, scope)
-          return nil unless receiver.is_a?(Prism::LocalVariableReadNode)
+          case receiver
+          when Prism::LocalVariableReadNode
+            current = scope.local(receiver.name)
+            return nil if current.nil?
 
-          current = scope.local(receiver.name)
-          return nil if current.nil?
+            [
+              scope.with_local(receiver.name, narrow_nil(current)),
+              scope.with_local(receiver.name, narrow_non_nil(current))
+            ]
+          when Prism::InstanceVariableReadNode
+            current = scope.ivar(receiver.name)
+            return nil if current.nil?
 
-          [
-            scope.with_local(receiver.name, narrow_nil(current)),
-            scope.with_local(receiver.name, narrow_non_nil(current))
-          ]
+            [
+              scope.with_ivar(receiver.name, narrow_nil(current)),
+              scope.with_ivar(receiver.name, narrow_non_nil(current))
+            ]
+          end
         end
 
         # `a && b` short-circuits: the truthy edge is the truthy edge

data/lib/rigor/inference/statement_evaluator.rb

@@ -1421,7 +1421,8 @@ module Rigor
         binder = MethodParameterBinder.new(
           environment: scope.environment,
           class_path: current_class_path,
-          singleton: singleton
+          singleton: singleton,
+          source_path: scope.source_path
         )
         bindings = binder.bind(def_node)
 
@@ -1486,6 +1487,7 @@ module Rigor
       # remain reachable from inside nested bodies.
       def build_fresh_body_scope # rubocop:disable Metrics/AbcSize
         Scope.empty(environment: scope.environment)
+             .with_source_path(scope.source_path)
              .with_declared_types(scope.declared_types)
              .with_discovered_classes(scope.discovered_classes)
              .with_in_source_constants(scope.in_source_constants)

data/lib/rigor/plugin/base.rb

@@ -183,6 +183,45 @@ module Rigor
         self.class.manifest
       end
 
+      # ADR-25 — absolute RBS signature directories this plugin
+      # contributes. Resolves each `manifest.signature_paths` entry
+      # (declared relative to the plugin gem root) against that
+      # root. The gem root is the directory above `lib/` in the
+      # file that defined the plugin class (falling back to that
+      # file's directory for a non-conventional layout). Returns
+      # `[]` when the manifest declares no `signature_paths:` or
+      # the class is anonymous (an anonymous class cannot ship a
+      # gem). `Plugin::Loader` validates the resolved dirs exist at
+      # load time; `Environment.for_project` merges them into the
+      # signature-path set fed to `RbsLoader`.
+      def signature_paths
+        relative = manifest.signature_paths
+        return [] if relative.empty?
+
+        class_name = self.class.name
+        return [] if class_name.nil?
+
+        file, = Object.const_source_location(class_name)
+        return [] if file.nil?
+
+        before, separator, = file.rpartition("/lib/")
+        root = separator.empty? ? File.dirname(file) : before
+        relative.map { |rel| File.expand_path(rel, root) }
+      end
+
+      # ADR-28 — the path-scoped method-protocol contracts this
+      # plugin contributes. Defaults to the manifest-declared
+      # `protocol_contracts:`; the same indirection
+      # `#signature_paths` uses, so a plugin MAY override this to
+      # fold per-project config into the contract set (e.g.
+      # substituting the convention `path_glob` with a user-supplied
+      # one) without the manifest having to be config-aware.
+      # `Plugin::Registry#protocol_contracts` aggregates the result
+      # across loaded plugins.
+      def protocol_contracts
+        manifest.protocol_contracts
+      end
+
       # ADR-7 § "Slice 6-A/6-B" — per-plugin {IoBoundary}.
       # Memoised so the boundary's accumulated `FileEntry`
       # rows persist across producer invocations within the

data/lib/rigor/plugin/loader.rb

@@ -125,7 +125,28 @@ module Rigor
         seen_ids[manifest.id] = entry[:gem]
 
         validate_config!(manifest, entry[:config])
-        instantiate(plugin_class, entry[:config])
+        plugin = instantiate(plugin_class, entry[:config])
+        validate_signature_paths!(plugin)
+        plugin
+      end
+
+      # ADR-25 — a plugin's manifest-declared `signature_paths:`
+      # are resolved (by `Plugin::Base#signature_paths`) against
+      # the plugin gem root. A declared directory that does not
+      # exist is a load-time failure for that plugin — loud, not
+      # silent, because a missing `sig/` means the bundle gem is
+      # broken. The raised LoadError is collected like any other
+      # load failure and the plugin drops from the registry.
+      def validate_signature_paths!(plugin)
+        plugin.signature_paths.each do |dir|
+          next if File.directory?(dir)
+
+          raise LoadError.new(
+            "plugin #{plugin.manifest.id.inspect} declares signature path #{dir.inspect} " \
+            "which is not a directory",
+            plugin_ref: plugin.manifest.id
+          )
+        end
       end
 
       def require_gem!(entry)

data/lib/rigor/plugin/manifest.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../inference/hkt_registry"
+require_relative "protocol_contract"
 
 module Rigor
   module Plugin
@@ -40,15 +41,16 @@ module Rigor
       end
 
       attr_reader :id, :version, :description, :protocols, :config_schema, :produces, :consumes,
-                  :owns_receivers, :type_node_resolvers, :block_as_methods, :heredoc_templates,
-                  :trait_registries, :external_files, :hkt_registrations, :hkt_definitions
+                  :owns_receivers, :open_receivers, :type_node_resolvers, :block_as_methods,
+                  :heredoc_templates, :trait_registries, :external_files, :hkt_registrations,
+                  :hkt_definitions, :signature_paths, :protocol_contracts
 
       def initialize( # rubocop:disable Metrics/ParameterLists
         id:, version:,
         description: nil, protocols: [], config_schema: {},
-        produces: [], consumes: [], owns_receivers: [], type_node_resolvers: [],
+        produces: [], consumes: [], owns_receivers: [], open_receivers: [], type_node_resolvers: [],
         block_as_methods: [], heredoc_templates: [], trait_registries: [], external_files: [],
-        hkt_registrations: [], hkt_definitions: []
+        hkt_registrations: [], hkt_definitions: [], signature_paths: [], protocol_contracts: []
       )
         validate_id!(id)
         validate_version!(version)
@@ -56,6 +58,7 @@ module Rigor
         validate_config_schema!(config_schema)
         validate_produces!(produces)
         validate_owns_receivers!(owns_receivers)
+        validate_open_receivers!(open_receivers)
         validate_type_node_resolvers!(type_node_resolvers)
         validate_block_as_methods!(block_as_methods)
         validate_heredoc_templates!(heredoc_templates)
@@ -63,10 +66,12 @@ module Rigor
         validate_external_files!(external_files)
         validate_hkt_registrations!(hkt_registrations)
         validate_hkt_definitions!(hkt_definitions)
+        validate_signature_paths!(signature_paths)
+        validate_protocol_contracts!(protocol_contracts)
 
         assign_fields(id, version, description, protocols, config_schema, produces, consumes, owns_receivers,
-                      type_node_resolvers, block_as_methods, heredoc_templates, trait_registries, external_files,
-                      hkt_registrations, hkt_definitions)
+                      open_receivers, type_node_resolvers, block_as_methods, heredoc_templates, trait_registries,
+                      external_files, hkt_registrations, hkt_definitions, signature_paths, protocol_contracts)
         freeze
       end
 
@@ -74,8 +79,8 @@ module Rigor
 
       # rubocop:disable Metrics/ParameterLists, Metrics/AbcSize
       def assign_fields(id, version, description, protocols, config_schema, produces, consumes, owns_receivers,
-                        type_node_resolvers, block_as_methods, heredoc_templates, trait_registries, external_files,
-                        hkt_registrations, hkt_definitions)
+                        open_receivers, type_node_resolvers, block_as_methods, heredoc_templates, trait_registries,
+                        external_files, hkt_registrations, hkt_definitions, signature_paths, protocol_contracts)
         @id = id.dup.freeze
         @version = version.dup.freeze
         @description = description.nil? ? nil : description.to_s.dup.freeze
@@ -84,6 +89,7 @@ module Rigor
         @produces = produces.map(&:to_sym).freeze
         @consumes = coerce_consumes(consumes)
         @owns_receivers = owns_receivers.map { |c| c.to_s.dup.freeze }.freeze
+        @open_receivers = open_receivers.map { |c| c.to_s.dup.freeze }.freeze
         @type_node_resolvers = type_node_resolvers.dup.freeze
         @block_as_methods = block_as_methods.dup.freeze
         @heredoc_templates = heredoc_templates.dup.freeze
@@ -91,6 +97,8 @@ module Rigor
         @external_files = external_files.dup.freeze
         @hkt_registrations = hkt_registrations.dup.freeze
         @hkt_definitions = hkt_definitions.dup.freeze
+        @signature_paths = signature_paths.map { |p| p.to_s.dup.freeze }.freeze
+        @protocol_contracts = protocol_contracts.dup.freeze
       end
       # rubocop:enable Metrics/ParameterLists, Metrics/AbcSize
 
@@ -119,7 +127,7 @@ module Rigor
         errors
       end
 
-      def to_h # rubocop:disable Metrics/AbcSize
+      def to_h # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
         {
           "id" => id,
           "version" => version,
@@ -129,13 +137,16 @@ module Rigor
           "produces" => produces.map(&:to_s),
           "consumes" => consumes.map { |c| consumption_hash(c) },
           "owns_receivers" => owns_receivers,
+          "open_receivers" => open_receivers,
           "type_node_resolvers" => type_node_resolvers.map { |r| r.class.name },
           "block_as_methods" => block_as_methods.map(&:to_h),
           "heredoc_templates" => heredoc_templates.map(&:to_h),
           "trait_registries" => trait_registries.map(&:to_h),
           "external_files" => external_files.map(&:to_h),
           "hkt_registrations" => hkt_registrations.map(&:to_h),
-          "hkt_definitions" => hkt_definitions.map { |d| { "uri" => d.uri, "params" => d.params } }
+          "hkt_definitions" => hkt_definitions.map { |d| { "uri" => d.uri, "params" => d.params } },
+          "signature_paths" => signature_paths,
+          "protocol_contracts" => protocol_contracts.map(&:to_h)
         }
       end
 
@@ -217,6 +228,24 @@ module Rigor
               "got #{owns_receivers.inspect}"
       end
 
+      # ADR-26 — `open_receivers:` declares the class names this
+      # plugin marks as "open": statically known to respond beyond
+      # their RBS-declared method surface (e.g. `ActiveRecord::Relation`,
+      # which delegates an unbounded set of user-defined scopes to
+      # its model). `Analysis::CheckRules` skips the
+      # `call.undefined-method` rule for a receiver whose class any
+      # loaded plugin lists here — flagging a method on a class
+      # with an open dynamic surface is unsound. Distinct from
+      # `owns_receivers:` (which routes dispatch); this one only
+      # suppresses the diagnostic.
+      def validate_open_receivers!(open_receivers)
+        return if open_receivers.is_a?(Array) && open_receivers.all? { |c| c.is_a?(String) && !c.empty? }
+
+        raise ArgumentError,
+              "plugin manifest open_receivers must be an Array of non-empty String, " \
+              "got #{open_receivers.inspect}"
+      end
+
       # ADR-13 slice 2 — `type_node_resolvers:` declares the
       # plugin-supplied `TypeNodeResolver` instances the parser
       # consults (in slice 3) when an RBS::Extended payload's
@@ -326,6 +355,40 @@ module Rigor
               "Rigor::Inference::HktRegistry::Definition instances, got #{entries.inspect}"
       end
 
+      # ADR-25 — `signature_paths:` declares the RBS signature
+      # directories this plugin gem ships, as paths relative to the
+      # plugin's own gem root (e.g. `["sig"]`). `Plugin::Base#signature_paths`
+      # resolves them to absolute dirs against the gem root; the
+      # loader validates each exists and `Environment.for_project`
+      # merges the resolved set into the RBS environment.
+      def validate_signature_paths!(paths)
+        return if paths.is_a?(Array) && paths.all? { |p| p.is_a?(String) && !p.empty? }
+
+        raise ArgumentError,
+              "plugin manifest signature_paths must be an Array of non-empty String, " \
+              "got #{paths.inspect}"
+      end
+
+      # ADR-28 — `protocol_contracts:` declares the path-scoped
+      # method-protocol contracts the plugin contributes. Each
+      # entry MUST be a `Rigor::Plugin::ProtocolContract`. The
+      # registry aggregator on `Plugin::Registry` flattens
+      # contracts across loaded plugins; the engine consults them
+      # in two places — `MethodParameterBinder` provides the
+      # declared parameter types into matching method bodies, and
+      # the contributing plugin's `#diagnostics_for_file` checks
+      # method presence + return-type conformance. The manifest
+      # field carries the plugin's *default* contracts; a plugin
+      # MAY override `Plugin::Base#protocol_contracts` to fold in
+      # per-project config (e.g. a custom convention path).
+      def validate_protocol_contracts!(entries)
+        return if entries.is_a?(Array) && entries.all?(ProtocolContract)
+
+        raise ArgumentError,
+              "plugin manifest protocol_contracts must be an Array of " \
+              "Rigor::Plugin::ProtocolContract instances, got #{entries.inspect}"
+      end
+
       def coerce_consumes(consumes)
         unless consumes.is_a?(Array)
           raise ArgumentError, "plugin manifest consumes must be an Array, got #{consumes.inspect}"