rigortype 0.1.9 → 0.1.11

data/plugins/rigor-rspec-rails/lib/rigor/plugin/rspec_rails/have_http_status_analyzer.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require "prism"
+
+require_relative "http_status_codes"
+
+module Rigor
+  module Plugin
+    class RspecRails < Rigor::Plugin::Base
+      # Validates `expect(response).to have_http_status(arg)` /
+      # the negated `.not_to have_http_status(arg)` and the
+      # bare matcher form `should have_http_status(arg)`.
+      #
+      # Recognised argument shapes:
+      #
+      # - **IntegerNode**: must be in `100..599`. Numbers outside
+      #   that range fire `have_http_status.out-of-range`.
+      # - **SymbolNode**: must be one of the known
+      #   `Rack::Utils::SYMBOL_TO_STATUS_CODE` keys OR a Rails
+      #   status-group alias (`:success` / `:successful` /
+      #   `:missing` / `:redirect` / `:error` / `:client_error` /
+      #   `:server_error` / `:informational`). Unknown symbols
+      #   fire `have_http_status.unknown-symbol` (typo-flavoured).
+      # - **StringNode**: passed through silently (a literal
+      #   `"200"` is accepted by Rails at runtime; we don't
+      #   second-guess the user's intent for the String form).
+      # - **Anything else** (variable, method call, computed
+      #   expression): skipped — the plugin can't statically
+      #   prove the runtime value.
+      #
+      # Walks every `Prism::CallNode` looking for matcher
+      # invocations rather than only the `expect(...).to ...`
+      # chain because `have_http_status` is also used as a
+      # plain matcher inside Rails' `assert_response` shim and
+      # in shared-context bodies; the diagnostic is the same
+      # regardless of the surrounding chain.
+      module HaveHttpStatusAnalyzer
+        Diagnostic = Struct.new(:path, :line, :column, :severity, :rule, :message, keyword_init: true)
+
+        MATCHER_NAME = :have_http_status
+
+        module_function
+
+        # @param path [String]
+        # @param root [Prism::Node]
+        # @return [Array<Diagnostic>]
+        def diagnose(path:, root:)
+          diagnostics = []
+          walk(root) do |call_node|
+            diagnostic = diagnostic_for(call_node, path)
+            diagnostics << diagnostic if diagnostic
+          end
+          diagnostics
+        end
+
+        def walk(node, &)
+          return unless node.is_a?(Prism::Node)
+
+          yield node if call_to_matcher?(node)
+          node.compact_child_nodes.each { |child| walk(child, &) }
+        end
+
+        # `have_http_status` is a matcher — called either with
+        # no receiver (`have_http_status(200)` inside `.to(...)`)
+        # or with a receiver chain we don't care about here.
+        # Either way we want the call node whose name is
+        # `have_http_status` and that carries exactly one
+        # positional argument.
+        def call_to_matcher?(node)
+          node.is_a?(Prism::CallNode) &&
+            node.name == MATCHER_NAME &&
+            single_positional?(node)
+        end
+
+        def single_positional?(call_node)
+          args = call_node.arguments&.arguments || []
+          args.size == 1
+        end
+
+        def diagnostic_for(call_node, path)
+          arg = call_node.arguments.arguments.first
+          case arg
+          when Prism::IntegerNode then integer_diagnostic(call_node, path, arg)
+          when Prism::SymbolNode then symbol_diagnostic(call_node, path, arg)
+          end
+        end
+
+        def integer_diagnostic(call_node, path, integer_node)
+          value = integer_node.value
+          return nil if HttpStatusCodes::VALID_NUMERIC_RANGE.cover?(value)
+
+          build_diagnostic(
+            call_node, path,
+            rule: "have_http_status.out-of-range",
+            message: "have_http_status(#{value}) is outside the valid HTTP status " \
+                     "range #{HttpStatusCodes::VALID_NUMERIC_RANGE}"
+          )
+        end
+
+        def symbol_diagnostic(call_node, path, symbol_node)
+          sym = symbol_node.unescaped.to_sym
+          return nil if HttpStatusCodes::KNOWN_SYMBOLS.include?(sym)
+
+          build_diagnostic(
+            call_node, path,
+            rule: "have_http_status.unknown-symbol",
+            message: "have_http_status(:#{sym}) is not a recognised HTTP status symbol " \
+                     "(see Rack::Utils::SYMBOL_TO_STATUS_CODE) or Rails status-group " \
+                     "alias (:success / :successful / :missing / :redirect / :error / " \
+                     ":client_error / :server_error / :informational)"
+          )
+        end
+
+        def build_diagnostic(call_node, path, rule:, message:)
+          location = call_node.message_loc || call_node.location
+          Diagnostic.new(
+            path: path,
+            line: location.start_line,
+            column: location.start_column + 1,
+            severity: :warning,
+            rule: rule,
+            message: message
+          )
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-rspec-rails/lib/rigor/plugin/rspec_rails/http_status_codes.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Plugin
+    class RspecRails < Rigor::Plugin::Base
+      # Curated set of HTTP-status symbols `have_http_status`
+      # accepts. Derived from `Rack::Utils::SYMBOL_TO_STATUS_CODE`
+      # (Rack 3.x snapshot) plus Rails' status-group aliases
+      # accepted by `ActionDispatch::TestResponse`.
+      #
+      # Vendored as a frozen Set so the plugin has no
+      # `rack` / `actionpack` runtime dependency — checking
+      # against a static catalogue is intentional: a future
+      # Rack release that adds a new alias would require
+      # bumping this constant, but the false-positive risk is
+      # bounded (the diagnostic just suggests a typo when in
+      # fact the symbol is newly-added).
+      module HttpStatusCodes
+        SYMBOL_TO_STATUS_CODE = {
+          # 1xx Informational
+          continue: 100, switching_protocols: 101, processing: 102, early_hints: 103,
+          # 2xx Success
+          ok: 200, created: 201, accepted: 202, non_authoritative_information: 203,
+          no_content: 204, reset_content: 205, partial_content: 206, multi_status: 207,
+          already_reported: 208, im_used: 226,
+          # 3xx Redirection
+          multiple_choices: 300, moved_permanently: 301, found: 302, see_other: 303,
+          not_modified: 304, use_proxy: 305, temporary_redirect: 307,
+          permanent_redirect: 308,
+          # 4xx Client Error
+          bad_request: 400, unauthorized: 401, payment_required: 402, forbidden: 403,
+          not_found: 404, method_not_allowed: 405, not_acceptable: 406,
+          proxy_authentication_required: 407, request_timeout: 408, conflict: 409,
+          gone: 410, length_required: 411, precondition_failed: 412,
+          payload_too_large: 413, uri_too_long: 414, unsupported_media_type: 415,
+          range_not_satisfiable: 416, expectation_failed: 417, misdirected_request: 421,
+          unprocessable_entity: 422, unprocessable_content: 422, locked: 423,
+          failed_dependency: 424, too_early: 425, upgrade_required: 426,
+          precondition_required: 428, too_many_requests: 429,
+          request_header_fields_too_large: 431, unavailable_for_legal_reasons: 451,
+          # 5xx Server Error
+          internal_server_error: 500, not_implemented: 501, bad_gateway: 502,
+          service_unavailable: 503, gateway_timeout: 504, http_version_not_supported: 505,
+          variant_also_negotiates: 506, insufficient_storage: 507, loop_detected: 508,
+          not_extended: 510, network_authentication_required: 511,
+          # Rails status-group aliases (see
+          # ActionDispatch::TestResponse RESPONSE_PREDICATES)
+          informational: :informational_group, success: :success_group,
+          successful: :success_group, redirect: :redirect_group,
+          client_error: :client_error_group, missing: :client_error_group,
+          server_error: :server_error_group, error: :server_error_group
+        }.freeze
+
+        KNOWN_SYMBOLS = SYMBOL_TO_STATUS_CODE.keys.to_set.freeze
+
+        VALID_NUMERIC_RANGE = (100..599)
+      end
+    end
+  end
+end

data/plugins/rigor-rspec-rails/lib/rigor/plugin/rspec_rails.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+require_relative "rspec_rails/have_http_status_analyzer"
+
+module Rigor
+  module Plugin
+    # rigor-rspec-rails — validates rspec-rails matchers whose
+    # arguments are statically checkable.
+    #
+    # v0.1.0 covers `have_http_status(int_or_symbol)`:
+    #
+    # - Integer: must be in `100..599`.
+    # - Symbol: must be one of the
+    #   `Rack::Utils::SYMBOL_TO_STATUS_CODE` keys or one of
+    #   Rails' status-group aliases (`:success`, `:successful`,
+    #   `:missing`, `:redirect`, `:error`, `:client_error`,
+    #   `:server_error`, `:informational`).
+    #
+    # ## Why this is a separate plugin from rigor-rspec
+    #
+    # `rigor-rspec` handles the **type-narrowing** matchers
+    # (`be_a`, `be_kind_of`, `be_nil`, `eq(literal)`, etc.) —
+    # ones that refine a local's static type so downstream
+    # calls in the same `it` body resolve at the narrowed
+    # type. `rigor-rspec-rails` handles the **behavioral**
+    # matchers — ones that assert runtime state (HTTP status,
+    # rendered template, route shape) without narrowing a
+    # type. The two are activated independently in `.rigor.yml`.
+    #
+    # ## Deferred matchers
+    #
+    # - `render_template(...)` — overlaps with
+    #   `rigor-actionpack`'s render-target validation
+    #   (`render :show` against the view tree). A separate
+    #   slice would coordinate the two to avoid
+    #   double-firing.
+    # - `route_to(...)` / `redirect_to(...)` — needs the
+    #   routes table from `rigor-rails-routes`
+    #   (`:helper_table` cross-plugin fact). Future slice.
+    # - `have_enqueued_job(JobClass)` /
+    #   `have_enqueued_mail(MailerClass)` — class-existence
+    #   check overlaps with engine's
+    #   `inference.unresolved-constant`; queued behind a
+    #   decision on which surface owns the diagnostic.
+    # - `have_received(:method)` — overlaps with engine's
+    #   `call.undefined-method`; same coordination question.
+    # - `be_routable` — needs routes table.
+    # - `match_response_schema(...)` (rswag / OpenAPI) — out
+    #   of scope, separate plugin.
+    class RspecRails < Rigor::Plugin::Base
+      manifest(
+        id: "rspec-rails",
+        version: "0.1.0",
+        description: "Validates rspec-rails behavioral matchers (have_http_status floor)."
+      )
+
+      def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
+        HaveHttpStatusAnalyzer.diagnose(path: path, root: root).map { |diag| build_diagnostic(diag) }
+      end
+
+      private
+
+      def build_diagnostic(diag)
+        Rigor::Analysis::Diagnostic.new(
+          path: diag.path, line: diag.line, column: diag.column,
+          message: diag.message, severity: diag.severity, rule: diag.rule
+        )
+      end
+    end
+
+    Rigor::Plugin.register(RspecRails)
+  end
+end

data/plugins/rigor-rspec-rails/lib/rigor-rspec-rails.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative "rigor/plugin/rspec_rails"

data/plugins/rigor-shoulda-matchers/lib/rigor/plugin/shoulda_matchers/analyzer.rb

@@ -0,0 +1,266 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Plugin
+    class ShouldaMatchers < Rigor::Plugin::Base
+      # Walks every `RSpec.describe <ModelConst> do ... end` /
+      # `describe <ModelConst> do ... end` block and validates
+      # the shoulda-matchers calls inside its body (any depth
+      # of nested `describe` / `context`) against the
+      # `:model_index` published by `rigor-activerecord`.
+      #
+      # The "anchor" for cross-checking is the OUTERMOST
+      # describe block whose argument is a constant — that
+      # constant names the model being specced. Nested
+      # `describe ".some_method"` (String / Symbol args) does
+      # NOT change the anchor.
+      #
+      # ## Recognised matcher calls (v0.1.0)
+      #
+      # ### Column / db matchers
+      #
+      #   validate_presence_of(:col)
+      #   validate_uniqueness_of(:col)
+      #   validate_length_of(:col)
+      #   validate_numericality_of(:col)
+      #   validate_acceptance_of(:col)
+      #   validate_inclusion_of(:col)
+      #   validate_exclusion_of(:col)
+      #   validate_absence_of(:col)
+      #   validate_format_of(:col)
+      #   validate_confirmation_of(:col)
+      #   allow_value(...).for(:col)
+      #   have_db_column(:col)
+      #   have_db_index(:col)
+      #
+      # All look up `:col` against the model's columns
+      # (`Entry#column?`). Unknown columns fire
+      # `shoulda-matchers.unknown-column`.
+      #
+      # ### Association matchers
+      #
+      #   belong_to(:assoc)           ← expects :singular
+      #   have_one(:assoc)            ← expects :singular
+      #   have_many(:assoc)           ← expects :collection
+      #   have_and_belong_to_many(:assoc) ← expects :collection
+      #
+      # Unknown associations fire
+      # `shoulda-matchers.unknown-association`. Known
+      # associations with mismatched kind (`should belong_to(:posts)`
+      # where `:posts` is `has_many`) fire
+      # `shoulda-matchers.association-kind-mismatch`.
+      module Analyzer
+        Diagnostic = Struct.new(:path, :line, :column, :severity, :rule, :message, keyword_init: true)
+
+        # `(matcher_name) => (:column | :association_singular | :association_collection)`
+        # — the validation lane each matcher routes to.
+        MATCHER_TABLE = {
+          # Column matchers — validate the named column exists on the model.
+          validate_presence_of: :column,
+          validate_uniqueness_of: :column,
+          validate_length_of: :column,
+          validate_numericality_of: :column,
+          validate_acceptance_of: :column,
+          validate_inclusion_of: :column,
+          validate_exclusion_of: :column,
+          validate_absence_of: :column,
+          validate_format_of: :column,
+          validate_confirmation_of: :column,
+          have_db_column: :column,
+          have_db_index: :column,
+          # Association matchers — validate the association
+          # exists AND its kind matches the matcher.
+          belong_to: :association_singular,
+          have_one: :association_singular,
+          have_many: :association_collection,
+          have_and_belong_to_many: :association_collection
+        }.freeze
+
+        module_function
+
+        # @param path [String]
+        # @param root [Prism::Node]
+        # @param model_index [Object, nil] the `:model_index`
+        #   fact value. When nil the analyzer falls silent.
+        # @return [Array<Diagnostic>]
+        def diagnose(path:, root:, model_index:)
+          return [] if model_index.nil?
+
+          diagnostics = []
+          walk_describe(root, anchor_model: nil) do |matcher_call, anchor|
+            entry = model_index.find(anchor)
+            next if entry.nil?
+
+            diagnostic = diagnostic_for(matcher_call, path, anchor, entry)
+            diagnostics << diagnostic if diagnostic
+          end
+          diagnostics
+        end
+
+        # Walks for `RSpec.describe(Const)` / `describe(Const)`
+        # blocks (the Const is the model anchor) and yields
+        # every matcher call found in their body.
+        #
+        # The anchor stays the OUTERMOST describe-with-const
+        # — nested describes / contexts inherit it without
+        # overriding (a nested `describe ".active"` is not a
+        # model constant). When a nested describe DOES name a
+        # different model, the nested anchor wins inside that
+        # subtree (rare; we still honour it).
+        def walk_describe(node, anchor_model:, &)
+          return unless node.is_a?(Prism::Node)
+
+          if describe_with_constant?(node)
+            inner_anchor = describe_const_name(node) || anchor_model
+            collect_matchers(node.block.body, inner_anchor, &) if node.block&.body
+            return
+          end
+
+          node.compact_child_nodes.each do |child|
+            walk_describe(child, anchor_model: anchor_model, &)
+          end
+        end
+
+        # Walks the body of a describe block looking for:
+        #   (a) matcher calls — `should MATCHER` or
+        #       `expect(...).to MATCHER` chains; we yield the
+        #       inner MATCHER call.
+        #   (b) nested describe / context blocks — we recurse
+        #       so deeper matchers are reachable.
+        def collect_matchers(body, anchor, &)
+          return unless body.is_a?(Prism::Node)
+          return if anchor.nil?
+
+          if matcher_invocation?(body)
+            yield body, anchor
+            return
+          end
+
+          if describe_with_constant?(body)
+            inner_anchor = describe_const_name(body) || anchor
+            collect_matchers(body.block.body, inner_anchor, &) if body.block&.body
+            return
+          end
+
+          body.compact_child_nodes.each do |child|
+            collect_matchers(child, anchor, &)
+          end
+        end
+
+        # A direct matcher invocation is a `CallNode` whose
+        # `name` is in `MATCHER_TABLE` and whose first argument
+        # is a `SymbolNode`. The chain shape (`should`,
+        # `expect(...).to`, `is_expected.to`) is irrelevant —
+        # we always recurse to the inner matcher, so a
+        # diagnostic fires on the matcher regardless of the
+        # surrounding chain.
+        def matcher_invocation?(node)
+          node.is_a?(Prism::CallNode) && MATCHER_TABLE.key?(node.name) && symbol_first_arg?(node)
+        end
+
+        def symbol_first_arg?(call_node)
+          args = call_node.arguments&.arguments || []
+          !args.empty? && args.first.is_a?(Prism::SymbolNode)
+        end
+
+        # Detects `RSpec.describe(Const) do ... end` and
+        # `describe(Const) do ... end`. Either form opens a
+        # scope whose anchor is `Const`. The receiver shape
+        # (RSpec vs nil) is allowed in both cases.
+        def describe_with_constant?(node)
+          return false unless node.is_a?(Prism::CallNode)
+          return false unless node.name == :describe
+          return false unless node.block.is_a?(Prism::BlockNode)
+
+          args = node.arguments&.arguments || []
+          first = args.first
+          first.is_a?(Prism::ConstantReadNode) || first.is_a?(Prism::ConstantPathNode)
+        end
+
+        def describe_const_name(node)
+          arg = node.arguments.arguments.first
+          render_constant_path(arg)
+        end
+
+        def render_constant_path(node)
+          case node
+          when Prism::ConstantReadNode then node.name.to_s
+          when Prism::ConstantPathNode
+            parts = []
+            current = node
+            while current.is_a?(Prism::ConstantPathNode)
+              parts.unshift(current.name.to_s)
+              current = current.parent
+            end
+            case current
+            when nil then "::#{parts.join('::')}"
+            when Prism::ConstantReadNode then "#{current.name}::#{parts.join('::')}"
+            end
+          end
+        end
+
+        # --- diagnostics ---
+
+        def diagnostic_for(matcher_call, path, anchor, entry)
+          lane = MATCHER_TABLE.fetch(matcher_call.name)
+          target = matcher_call.arguments.arguments.first.unescaped.to_sym
+
+          case lane
+          when :column
+            column_diagnostic(matcher_call, path, anchor, entry, target)
+          when :association_singular
+            association_diagnostic(matcher_call, path, anchor, entry, target, expected_kind: :singular)
+          when :association_collection
+            association_diagnostic(matcher_call, path, anchor, entry, target, expected_kind: :collection)
+          end
+        end
+
+        def column_diagnostic(matcher_call, path, anchor, entry, column_name)
+          return nil if entry.column?(column_name)
+
+          build_diagnostic(
+            matcher_call, path,
+            rule: "shoulda-matchers.unknown-column",
+            message: "#{matcher_call.name}(:#{column_name}) — no column `#{column_name}` on " \
+                     "#{anchor} (columns: #{entry.column_names.sort.join(', ')})"
+          )
+        end
+
+        def association_diagnostic(matcher_call, path, anchor, entry, assoc_name, expected_kind:)
+          if entry.association?(assoc_name)
+            actual = entry.association(assoc_name)[:kind]
+            return nil if actual == expected_kind
+
+            build_diagnostic(
+              matcher_call, path,
+              rule: "shoulda-matchers.association-kind-mismatch",
+              message: "#{matcher_call.name}(:#{assoc_name}) on #{anchor} — `#{assoc_name}` is " \
+                       "a #{actual} association; #{matcher_call.name} expects #{expected_kind}"
+            )
+          else
+            build_diagnostic(
+              matcher_call, path,
+              rule: "shoulda-matchers.unknown-association",
+              message: "#{matcher_call.name}(:#{assoc_name}) — no association `#{assoc_name}` on " \
+                       "#{anchor} (associations: #{entry.association_names.sort.join(', ')})"
+            )
+          end
+        end
+
+        def build_diagnostic(call_node, path, rule:, message:)
+          location = call_node.message_loc || call_node.location
+          Diagnostic.new(
+            path: path,
+            line: location.start_line,
+            column: location.start_column + 1,
+            severity: :warning,
+            rule: rule,
+            message: message
+          )
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-shoulda-matchers/lib/rigor/plugin/shoulda_matchers.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+require_relative "shoulda_matchers/analyzer"
+
+module Rigor
+  module Plugin
+    # rigor-shoulda-matchers — validates shoulda-matchers
+    # matchers against the `:model_index` cross-plugin fact
+    # (ADR-9) published by `rigor-activerecord`.
+    #
+    # The plugin walks every `RSpec.describe <ModelConst> do
+    # ... end` block and validates the matchers inside
+    # against the model's known columns / associations.
+    #
+    # ## Recognised matchers (v0.1.0)
+    #
+    # **Column matchers** (validate the named column exists on
+    # the model):
+    #
+    #   validate_presence_of(:col), validate_uniqueness_of(:col),
+    #   validate_length_of(:col), validate_numericality_of(:col),
+    #   validate_acceptance_of(:col), validate_inclusion_of(:col),
+    #   validate_exclusion_of(:col), validate_absence_of(:col),
+    #   validate_format_of(:col), validate_confirmation_of(:col),
+    #   have_db_column(:col), have_db_index(:col)
+    #
+    # **Association matchers** (validate the association exists
+    # AND its kind matches):
+    #
+    #   belong_to(:assoc), have_one(:assoc)            ← :singular
+    #   have_many(:assoc), have_and_belong_to_many(:assoc) ← :collection
+    #
+    # ## Cross-plugin dependency
+    #
+    # The plugin consumes `:model_index` from `rigor-activerecord`.
+    # When `rigor-activerecord` is NOT loaded (or hasn't
+    # published an index for the analysed model), the plugin
+    # falls silent — the cross-check is opt-in. Adding
+    # `rigor-activerecord` to `.rigor.yml` unlocks the
+    # diagnostics.
+    #
+    # ## Limitations (v0.1.0)
+    #
+    # - **No chained-matcher arg validation.** The chain
+    #   options on `validate_length_of(:col).is_at_most(50)`,
+    #   `validate_inclusion_of(:col).in_array([...])`,
+    #   `allow_value("foo").for(:col)`, etc. are NOT validated
+    #   (the `.is_at_most` etc. terminals are runtime-only).
+    # - **No polymorphic / through validation.** `belong_to(:user).polymorphic`,
+    #   `have_many(:posts, through: :memberships)` only check
+    #   the named association; the chain modifiers are
+    #   ignored.
+    # - **No nested-attribute matchers.** `accept_nested_attributes_for(:posts)`
+    #   not yet covered.
+    # - **No callback matchers.** `callback(:before_save).before(:save)`
+    #   would need a separate slice (overlaps with the
+    #   model_index's `callbacks` column already exposed but
+    #   no rspec-side recogniser yet).
+    class ShouldaMatchers < Rigor::Plugin::Base
+      manifest(
+        id: "shoulda-matchers",
+        version: "0.1.0",
+        description: "Validates shoulda-matchers matchers (validate_presence_of / belong_to / " \
+                     "have_many / have_db_column / ...) against :model_index from " \
+                     "rigor-activerecord.",
+        consumes: [
+          { plugin_id: "activerecord", name: :model_index, optional: true }
+        ]
+      )
+
+      def init(services)
+        @services = services
+        @model_index = nil
+        @model_index_resolved = false
+      end
+
+      def diagnostics_for_file(path:, scope:, root:) # rubocop:disable Lint/UnusedMethodArgument
+        index = model_index_or_nil
+        return [] if index.nil?
+
+        Analyzer.diagnose(
+          path: path, root: root, model_index: index
+        ).map { |diag| build_diagnostic(diag) }
+      end
+
+      private
+
+      # Lazily resolves `:model_index` from
+      # `rigor-activerecord`. Returns nil when the plugin
+      # isn't loaded or no index has been published; the
+      # analyzer treats nil as "no cross-check available" and
+      # falls silent.
+      def model_index_or_nil
+        return @model_index if @model_index_resolved
+
+        @model_index = @services.fact_store.read(plugin_id: "activerecord", name: :model_index)
+        @model_index_resolved = true
+        @model_index
+      end
+
+      def build_diagnostic(diag)
+        Rigor::Analysis::Diagnostic.new(
+          path: diag.path, line: diag.line, column: diag.column,
+          message: diag.message, severity: diag.severity, rule: diag.rule
+        )
+      end
+    end
+
+    Rigor::Plugin.register(ShouldaMatchers)
+  end
+end

data/plugins/rigor-shoulda-matchers/lib/rigor-shoulda-matchers.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative "rigor/plugin/shoulda_matchers"