rigortype 0.2.8 → 0.2.9

data/lib/rigor/inference/scope_indexer.rb

@@ -1989,13 +1989,12 @@ module Rigor
       # reads for the bound logical path to the buffer's physical path so editor-mode pre-passes see the in-flight
       # bytes.
       #
-      # **Modules are intentionally excluded** from the project-wide seed: a `module M; module_function; def x; end;
-      # end` body, when surfaced as `singleton(M)` to the dispatcher, falls through to `Kernel#x` (or any Module
-      # ancestor method) when the project's per-file `discovered_methods` doesn't know `M.x` — leading to surprising
-      # types like `Kernel.select → Array[String]`. Until cross-file `discovered_methods` follows the same project-wide
-      # seed, registering modules here would introduce regressions in modules-with-module_function idioms that
-      # previously resolved to `Dynamic[Top]`. Class declarations are safe because per-file `discovered_methods` already
-      # tracks `def self.x` / `def x` instance and singleton methods consistently.
+      # Modules are registered on the same terms as classes, matching `record_declarations`' per-file behaviour (ADR-57
+      # WD3). An earlier revision excluded them, fearing an undiscovered `M.x` would fall through to `Kernel#x`; the
+      # exclusion was retired once measurement showed Kernel's private instance methods (`select`, `puts`, `load`, …)
+      # resolve to nothing on a `Singleton[M]` receiver, and that a project-side `def self.x` body wins over the lenient
+      # `Singleton[Object]` fallback anyway. The residual leak is `Class`-only (`M.new`, `M.superclass`), which mistypes
+      # only code that raises `NoMethodError` at runtime.
       #
       # @param paths [Array<String>] project file paths.
       # @param buffer [Rigor::Analysis::BufferBinding, nil]
@@ -2136,22 +2135,19 @@ module Rigor
         end
       end
 
-      # Class-only variant of `record_declarations` — descends into nested module bodies (so `module Foo; class Bar`
-      # registers `Foo::Bar`) but never registers the module itself in `accumulator`.
+      # Cross-file counterpart of `record_declarations` — registers every `class` / `module` declaration under its
+      # qualified name and descends into the body (so `module Foo; class Bar` registers both `Foo` and `Foo::Bar`).
       def collect_class_decls(node, qualified_prefix, accumulator)
         return unless node.is_a?(Prism::Node)
 
         case node
-        when Prism::ClassNode
+        when Prism::ClassNode, Prism::ModuleNode
           name = Source::ConstantPath.qualified_name(node.constant_path)
           if name
             full = (qualified_prefix + [name]).join("::")
             accumulator[full] = Type::Combinator.singleton_of(full)
             return collect_class_decls(node.body, qualified_prefix + [name], accumulator) if node.body
           end
-        when Prism::ModuleNode
-          name = Source::ConstantPath.qualified_name(node.constant_path)
-          return collect_class_decls(node.body, qualified_prefix + [name], accumulator) if name && node.body
         when Prism::ConstantWriteNode
           record_class_new_constant_decl(node, qualified_prefix, accumulator)
         end

data/lib/rigor/inference/statement_evaluator.rb

@@ -1825,10 +1825,19 @@ module Rigor
         def_node = resolve_self_callee_def(node)
         return base_scope if def_node.nil?
 
-        escaped = escaped_content_parameters(def_node)
-        return base_scope if escaped.empty?
+        mutated = callee_content_mutated_parameters(def_node)
+        return base_scope if mutated.empty?
 
-        floor_arguments_at_positions(node, escaped, base_scope)
+        floor_arguments_at_positions(node, mutated, base_scope)
+      end
+
+      # The `{ name => position }` positional parameters whose content the callee mutates, from either channel: those
+      # escape-mutated inside a block (which may run later / repeatedly) AND those mutated directly in the method body
+      # during the call itself (`declaration[:prefix] = v`). Both leave the caller's argument binding stale after the
+      # call, so both floor it. Memoised per def node (the merge is otherwise recomputed at every call site).
+      def callee_content_mutated_parameters(def_node)
+        cache = (@callee_mutated_param_cache ||= {}.compare_by_identity)
+        cache[def_node] ||= escaped_content_parameters(def_node).merge(direct_content_parameters(def_node))
       end
 
       # The user def a self-dispatch `node` resolves to in the enclosing class, or nil. Reuses the discovery index
@@ -1872,6 +1881,42 @@ module Rigor
         positions.slice(*mutated)
       end
 
+      # The `{ name => position }` positional parameters whose CONTENT the callee mutates directly in its method body —
+      # a top-level `param[k] = v` / `param << x`, outside a nested block. Memoised per def node. The block-nested case
+      # is `escaped_content_parameters`'s job; walking only outside nested blocks / defs / lambdas here means a matching
+      # parameter-name read is genuinely at method scope (depth 0) rather than a block-local of the same name that
+      # merely shadows the parameter — so we never floor a caller argument the callee did not actually mutate.
+      def direct_content_parameters(def_node)
+        cache = (@direct_param_cache ||= {}.compare_by_identity)
+        cache[def_node] ||= compute_direct_content_parameters(def_node)
+      end
+
+      def compute_direct_content_parameters(def_node)
+        positions = positional_parameter_positions(def_node)
+        return {} if positions.empty?
+
+        mutated = Set.new
+        each_node_outside_nested_scopes(def_node.body) do |descendant|
+          name, = content_mutation_target(descendant) { |r| r.is_a?(Prism::LocalVariableReadNode) && r.depth.zero? }
+          mutated << name if !name.nil? && positions.key?(name)
+        end
+        positions.slice(*mutated)
+      end
+
+      # Yields every node reachable from `body` without crossing into a nested block / def / lambda — i.e. the nodes
+      # that execute in the method's own scope. A local-variable read found here has depth 0 relative to the method, so
+      # a content mutation whose receiver is a positional-parameter name is a genuine mutation of that parameter.
+      def each_node_outside_nested_scopes(node, &)
+        return if node.nil?
+
+        yield node
+        node.compact_child_nodes.each do |child|
+          next if child.is_a?(Prism::BlockNode) || child.is_a?(Prism::DefNode) || child.is_a?(Prism::LambdaNode)
+
+          each_node_outside_nested_scopes(child, &)
+        end
+      end
+
       # A receiver-independent over-approximation of `ClosureEscapeAnalyzer`'s non-escaping verdict, used when scanning
       # a callee body where the block- owning call's receiver TYPE is not available. A call whose method name is a known
       # structural iterator (`each` / `map` / `tap` / …) runs its block synchronously and does not retain it, so its

data/lib/rigor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rigor
-  VERSION = "0.2.8"
+  VERSION = "0.2.9"
 end

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/analyzer.rb

@@ -58,6 +58,12 @@ module Rigor
         # receiver is `params.require(:symbol)`.
         STRONG_PARAMS_RECEIVER_NAMES = %i[require permit_params strong_params].freeze
 
+        # Max edit distance between a non-column permit key and a real column for the key to count as a
+        # typo (and fire `unknown-permit-key`) rather than a legitimate virtual attribute. A tight bound
+        # keeps genuine typos (`emial`→`email`, distance 2) while never firing on a virtual attribute,
+        # whose name is nothing like any column.
+        PERMIT_KEY_TYPO_MAX_DISTANCE = 2
+
         # One Action Pack observation. Carries no path — the caller (the `node_rule` block) positions
         # it via `Plugin::Base#diagnostic`. `location` is the Prism location the diagnostic should point
         # at (a call's `message_loc` for the call itself, or a sub-argument's location for
@@ -150,12 +156,11 @@ module Rigor
           return [] if entry.nil? # unknown model — skip; the model lookup is best-effort.
 
           columns = entry[:columns]
-          spell_checker = DidYouMean::SpellChecker.new(dictionary: columns)
-          literal_permit_keys(call_node).map do |key_node, key_name|
+          literal_permit_keys(call_node).filter_map do |key_node, key_name|
             if columns.include?(key_name)
               permit_call_violation(call_node, model_class, key_name)
             else
-              unknown_permit_key_violation(key_node, model_class, key_name, spell_checker)
+              unknown_permit_key_violation(key_node, model_class, key_name, columns)
             end
           end
         end
@@ -347,13 +352,23 @@ module Rigor
           )
         end
 
-        def unknown_permit_key_violation(key_node, model_class, key_name, spell_checker)
-          base = "Action Pack permit `#{key_name}` is not a column on `#{model_class}`."
-          suggestion = spell_checker.correct(key_name).first
-          message = suggestion ? "#{base} Did you mean `:#{suggestion}`?" : base
+        # A permit key that is not a column is only a violation when it is a near-miss TYPO of a real
+        # column. Permitting a non-column is ordinary Rails: a Devise virtual attribute (`password`,
+        # `remember_me`, `otp_attempt`), a state-machine `*_event`, an `attr_accessor` setter, or a nested
+        # `*_attributes` key are all mass-assignable but absent from the schema. So fire only when a column
+        # sits within a tight edit distance of the key (a typo like `emial`→`email`); a key with no close
+        # column is presumed a deliberate virtual attribute and passes silently. Firing on every non-column
+        # key false-positives across the whole strong-params surface of a Devise/state-machine app.
+        def unknown_permit_key_violation(key_node, model_class, key_name, columns)
+          nearest = columns.min_by { |col| DidYouMean::Levenshtein.distance(key_name, col) }
+          return nil if nearest.nil?
+          return nil if DidYouMean::Levenshtein.distance(key_name, nearest) > PERMIT_KEY_TYPO_MAX_DISTANCE
+
           Violation.new(
             location: key_node.location,
-            message: message, severity: :error, rule: "unknown-permit-key"
+            message: "Action Pack permit `#{key_name}` is not a column on `#{model_class}`. " \
+                     "Did you mean `:#{nearest}`?",
+            severity: :error, rule: "unknown-permit-key"
           )
         end
 

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -182,6 +182,27 @@ module Rigor
         Rigor::Type::Combinator.nominal_of(class_name)
       end
 
+      # Phase 5b (2026-07-10) — keep the strong-parameters fluent chain typed. `params` types to
+      # `ActionController::Parameters` (above), but the chained `params.require(:user).permit(:name)` /
+      # `params.permit(...)` calls returned `Dynamic` at the first hop (Parameters ships no bundled RBS,
+      # so a call on it resolves lenient-to-Dynamic), leaking every downstream site (`.permit`, `.to_h`,
+      # `.each`) to unprotected. These three methods return another `Parameters`, so gate on a
+      # `Parameters` receiver and re-type the result as the same lenient nominal — the chain stays a
+      # concrete receiver end-to-end and `coverage --protection` counts the sites as protected.
+      #
+      # `require` may return a scalar for a flat key at runtime (`params.require(:id) → String`), but
+      # typing it as the RBS-less `Parameters` is FP-safe by the same argument as the readers: every
+      # method on a Parameters value stays engine-lenient (no `undefined-method`), and this types the
+      # container only, never a caller's argument (ADR-5). The GitLab strong-params survey (108 leaked
+      # `.permit` sites) is the demand.
+      STRONG_PARAMS_CHAIN_METHODS = %i[require permit permit!].freeze
+
+      dynamic_return receivers: [REQUEST_CONTEXT_READER_TYPES[:params]], methods: STRONG_PARAMS_CHAIN_METHODS do |call_node, _scope|
+        next nil unless call_node.is_a?(Prism::CallNode)
+
+        Rigor::Type::Combinator.nominal_of(REQUEST_CONTEXT_READER_TYPES[:params])
+      end
+
       private
 
       # True when the current `self` is a controller — the enclosing class is one the discoverer

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/analyzer.rb

@@ -90,7 +90,7 @@ module Rigor
           # than firing a false `unknown-column` against every key.
           return push_recognised(node, entry, keyword_pairs.map { |p| p[:key] }) if entry.column_names.empty?
 
-          unknown = keyword_pairs.reject { |pair| valid_query_key?(entry, pair[:key]) }
+          unknown = keyword_pairs.reject { |pair| nested_condition?(pair[:value]) || valid_query_key?(entry, pair[:key]) }
           if unknown.empty?
             keyword_pairs.each { |pair| validate_enum_value(node, entry, pair) }
             push_recognised(node, entry, keyword_pairs.map { |p| p[:key] })
@@ -129,6 +129,15 @@ module Rigor
           assoc && assoc[:kind] == :singular
         end
 
+        # A keyword pair with a Hash value is a nested / joined-table condition (`Approval.where(approvals:
+        # { user_id: 1 })`, `where(users: { name: 'x' })`), where the key names an association or a joined
+        # table, not a column on the receiver. Rails resolves it through the join, so it must not be checked
+        # against the receiver's own columns. (An Array value — `where(status: [:a, :b])` — is an IN query on
+        # a real column, not nested, so only a Hash is skipped.)
+        def nested_condition?(value_node)
+          value_node.is_a?(Prism::HashNode) || value_node.is_a?(Prism::KeywordHashNode)
+        end
+
         # When the column is an enum-bearing column AND the passed value is a Symbol literal, the value
         # MUST be one of the declared enum values. Non-Symbol values (variables, expressions) decline so
         # dynamic call sites stay silent. Sequences (`status: [:active, :archived]`) are intentionally NOT

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/model_discoverer.rb

@@ -33,12 +33,25 @@ module Rigor
         # @param io_boundary [Rigor::Plugin::IoBoundary]
         # @param search_paths [Array<String>] absolute or project-relative paths.
         # @param base_classes [Array<String>] superclass names that identify a class as an AR model.
+        # Declaration macros whose column's runtime value is a rich object, not the SQL scalar. Their column
+        # must NOT be narrowed to the schema type (see {ModelIndex.build}'s type-override remap).
+        TYPE_OVERRIDE_METHODS = %i[serialize mount_uploader mount_uploaders].freeze
+
         def initialize(io_boundary:, search_paths:, base_classes:)
           @io_boundary = io_boundary
           @search_paths = search_paths
           @base_classes = base_classes.to_set
+          # Global set of column names whose declared runtime type overrides the schema scalar
+          # (`serialize` / `mount_uploader` / `attribute :x, CustomType`). Collected across every class AND
+          # concern module walked — a serialize inside a concern's `included do … end` is invisible to the
+          # per-model view (the discoverer doesn't follow `include`), so overrides are tracked globally by
+          # column name and applied wherever that column appears. Over-suppresses a same-named scalar
+          # column elsewhere (a precision cost, never a false positive).
+          @type_override_columns = Set.new
         end
 
+        attr_reader :type_override_columns
+
         # @return [Array<Hash>] rows of { class_name:, table_name_override:, sti_parent:, ... }
         def discover
           candidates = []
@@ -141,6 +154,8 @@ module Rigor
           full_name = (lexical_path + [class_local_name]).join("::")
           superclass = constant_path_name(node.superclass) if node.superclass
 
+          collect_type_overrides(node.body)
+
           yield({
             class_name: full_name,
             superclass_name: superclass,
@@ -162,10 +177,56 @@ module Rigor
           module_local_name = constant_path_name(node.constant_path)
           return if module_local_name.nil?
 
+          # Concerns (`module DiffPositionableNote`) carry `serialize` / `mount_uploader` inside an
+          # `included do … end` block; collect their overrides even though the module itself is not a model.
+          collect_type_overrides(node.body)
+
           inner_path = lexical_path + [module_local_name]
           walk_for_classes(node.body, inner_path, &) if node.body
         end
 
+        # Records the column name of every `serialize :col` / `mount_uploader(s) :col` / `attribute :col,
+        # CustomType` in `body` (descending into `with_options` and concern `included do` blocks) into the
+        # global {#type_override_columns} set. `attribute :col, :symbol_type` (a built-in scalar type) is
+        # NOT an override — only a custom type CONSTANT is.
+        def collect_type_overrides(body)
+          type_override_declaration_calls(body).each do |node|
+            next if node.receiver
+
+            column = Rigor::Source::Literals.symbol_name(node.arguments&.arguments&.first)
+            next if column.nil?
+
+            if TYPE_OVERRIDE_METHODS.include?(node.name)
+              @type_override_columns << column
+            elsif node.name == :attribute && custom_type_attribute?(node)
+              @type_override_columns << column
+            end
+          end
+        end
+
+        # `declaration_calls` variant that also descends into a concern's `included do … end` block (the
+        # ActiveSupport::Concern idiom where models' shared `serialize` declarations live).
+        def type_override_declaration_calls(body)
+          return [] if body.nil?
+
+          body.compact_child_nodes.flat_map do |node|
+            next [] unless node.is_a?(Prism::CallNode)
+
+            if %i[with_options included].include?(node.name) && node.block.is_a?(Prism::BlockNode)
+              type_override_declaration_calls(node.block.body)
+            else
+              [node]
+            end
+          end
+        end
+
+        # True when an `attribute :col, <type>` call's type argument is a custom type CLASS (a constant),
+        # whose runtime value is a rich object — not a built-in `:symbol` type, which stays a scalar.
+        def custom_type_attribute?(node)
+          type_arg = node.arguments&.arguments&.[](1)
+          type_arg.is_a?(Prism::ConstantReadNode) || type_arg.is_a?(Prism::ConstantPathNode)
+        end
+
         # Renders a constant-path node (`Admin::User`, `::ApplicationRecord`) as a String. Returns nil for
         # shapes the discoverer chooses not to handle.
         def constant_path_name(node)

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/model_index.rb

@@ -88,15 +88,16 @@ module Rigor
         def class_names = entries.keys
         def empty? = entries.empty?
 
-        def self.build(model_rows:, schema_table:)
+        def self.build(model_rows:, schema_table:, type_override_columns: nil)
           rows_by_name = model_rows.to_h { |row| [row.fetch(:class_name), row] }
+          overrides = type_override_columns || []
 
           entries = model_rows.each_with_object({}) do |row, acc|
             class_name = row.fetch(:class_name)
             # The STI ancestry chain, root → self. For a plain (non-STI) model this is just `[row]`.
             chain = sti_chain(row, rows_by_name)
             table_name = sti_table_name(chain)
-            columns = schema_table.columns_for(table_name) || []
+            columns = apply_type_overrides(schema_table.columns_for(table_name) || [], overrides)
 
             # STI children inherit their ancestors' declared associations / enums / aliases / scopes /
             # validations / callbacks. Without the merge a `where(<parent-association>: ...)` on the
@@ -116,6 +117,23 @@ module Rigor
           new(entries.freeze)
         end
 
+        # Remaps every type-overridden column's `ruby_type` to `"Object"` so instance-side column narrowing
+        # declines to narrow it (the `"Object"` case in `ruby_type_to_type`). A `serialize` / `mount_uploader`
+        # / custom-`attribute` column reads as a rich object at runtime, not its SQL scalar, so narrowing it
+        # to e.g. `String` false-positives on the object's methods (`note.position.diff_refs`). The column
+        # stays in the set, so `where(col: ...)` existence validation is unaffected — only its value type.
+        def self.apply_type_overrides(columns, overrides)
+          return columns if overrides.empty?
+
+          columns.map do |column|
+            next column unless overrides.include?(column.name)
+
+            SchemaTable::Column.new(
+              name: column.name, type: column.type, ruby_type: "Object", array: column.array
+            )
+          end
+        end
+
         # The STI ancestry chain for a row, ordered root → self. Walks `sti_parent` pointers, guarding
         # against a cycle.
         def self.sti_chain(row, rows_by_name, seen = [])

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/structure_sql_parser.rb

@@ -0,0 +1,172 @@
+# frozen_string_literal: true
+
+require_relative "schema_table"
+
+module Rigor
+  module Plugin
+    class Activerecord < Rigor::Plugin::Base
+      # Parses a PostgreSQL `db/structure.sql` (the `schema_format = :sql` schema dump) into the same
+      # {SchemaTable} the Ruby-DSL {SchemaParser} produces, so a project that commits `structure.sql`
+      # instead of `schema.rb` is no longer inert (GitLab-class apps use `structure.sql`; without this the
+      # plugin skips every AR call check and — worse — degrades ordinary relation chains to `Array`,
+      # cascading false diagnostics).
+      #
+      # The dump is regular enough to read line-by-line without a SQL parser. `pg_dump` emits, per table:
+      #
+      #   CREATE TABLE namespaces (
+      #       id bigint NOT NULL,
+      #       name character varying NOT NULL,
+      #       visibility_level integer DEFAULT 20 NOT NULL,
+      #       tag_ids bigint[],
+      #       created_at timestamp without time zone
+      #   );
+      #
+      # Load-bearing regularities this relies on: column names / types are lowercase, column modifiers
+      # (`NOT NULL`, `DEFAULT …`, `GENERATED …`, `COLLATE …`) are UPPERCASE, one column per line, the body
+      # closes on a line starting with `)`. So the type is the run of tokens before the first
+      # uppercase-initial token, and a table-level constraint line (`CONSTRAINT …`, `PRIMARY KEY …`) is
+      # recognised by its uppercase leading keyword and skipped. Anything it cannot map (custom enum,
+      # `tsvector`, `ltree`) degrades to `Object` via {SchemaTable.ruby_type_for} — never a dropped column,
+      # which would turn every query on it into a false `unknown-column`.
+      class StructureSqlParser
+        # Normalised PostgreSQL type (lowercased, length/precision + `[]` stripped) → the Rails column-type
+        # symbol {SchemaTable.ruby_type_for} already understands. Unmapped types fall through to their own
+        # symbol, which `ruby_type_for` maps to `Object` (the safe "do not narrow" default).
+        PG_TYPE_TO_RAILS = {
+          "bigint" => :bigint, "int8" => :bigint, "bigserial" => :bigint,
+          "integer" => :integer, "int" => :integer, "int4" => :integer, "serial" => :integer,
+          "smallint" => :integer, "int2" => :integer, "smallserial" => :integer,
+          "boolean" => :boolean, "bool" => :boolean,
+          "text" => :text,
+          "character varying" => :string, "varchar" => :string,
+          "character" => :string, "char" => :string, "name" => :string, "citext" => :citext,
+          "timestamp without time zone" => :datetime, "timestamp with time zone" => :datetime,
+          "timestamp" => :datetime, "timestamptz" => :datetime,
+          "date" => :date,
+          "time without time zone" => :time, "time with time zone" => :time, "time" => :time,
+          "numeric" => :decimal, "decimal" => :decimal, "money" => :decimal,
+          "double precision" => :float, "real" => :float, "float8" => :float, "float4" => :float,
+          "bytea" => :binary,
+          "json" => :json, "jsonb" => :jsonb,
+          "uuid" => :uuid, "inet" => :inet, "cidr" => :string, "macaddr" => :string
+        }.freeze
+
+        # Uppercase leading keywords that mark a table-level constraint line rather than a column.
+        CONSTRAINT_KEYWORDS = %w[CONSTRAINT PRIMARY UNIQUE CHECK FOREIGN EXCLUDE LIKE PARTITION].freeze
+
+        # @param source [String] contents of `db/structure.sql`
+        # @return [SchemaTable]
+        def self.parse(source)
+          new.parse(source)
+        end
+
+        def parse(source)
+          tables = {}
+          each_create_table(source.to_s) do |table_name, body_lines|
+            columns = parse_columns(body_lines)
+            tables[table_name] = columns unless columns.empty?
+          end
+          SchemaTable.new(tables.freeze)
+        end
+
+        private
+
+        # Yields `[table_name, body_lines]` for every `CREATE TABLE … (` … `)` block. Body lines are the raw
+        # lines between the opening `(` line and the closing `)` line.
+        def each_create_table(source)
+          lines = source.lines
+          index = 0
+          while index < lines.length
+            match = lines[index].match(/\ACREATE (?:UNLOGGED |TEMPORARY )?TABLE (?:IF NOT EXISTS )?(\S+)\s*\(/)
+            unless match
+              index += 1
+              next
+            end
+
+            table_name = normalize_table_name(match[1])
+            index += 1
+            body = []
+            while index < lines.length && lines[index] !~ /\A\s*\)/
+              body << lines[index]
+              index += 1
+            end
+            yield(table_name, body) if table_name
+            index += 1 # step past the closing `)` line
+          end
+        end
+
+        # Strips quotes and a leading schema qualifier. Only the default `public` schema (or an unqualified
+        # name) is accepted; other schemas (`gitlab_partitions_dynamic.*`, etc.) are partitions of a base
+        # table already emitted unqualified, so returning nil skips them without losing a real table.
+        def normalize_table_name(raw)
+          name = raw.delete('"')
+          if name.include?(".")
+            schema, table = name.split(".", 2)
+            return nil unless schema == "public"
+
+            name = table
+          end
+          name.empty? ? nil : name
+        end
+
+        def parse_columns(body_lines)
+          columns = {}
+          # A column's `DEFAULT` may carry a multi-line single-quoted string (a serialized YAML default,
+          # `DEFAULT '--- []\n'::character varying`). The column name + type sit before the `DEFAULT`, so
+          # the first physical line still parses correctly; the continuation lines must be skipped or they
+          # read as bogus columns (`'::character varying`). A line with an ODD count of single quotes opens
+          # (or closes) such a string — PG doubles a literal quote (`''`), so escapes stay even and only a
+          # genuinely unterminated string toggles the state.
+          in_string = false
+          body_lines.each do |raw|
+            if in_string
+              in_string = false if raw.count("'").odd?
+              next
+            end
+            in_string = true if raw.count("'").odd?
+
+            line = raw.strip.chomp(",")
+            next if line.empty?
+
+            name, rest = line.split(/\s+/, 2)
+            next if name.nil? || rest.nil?
+            next if CONSTRAINT_KEYWORDS.include?(name) # a table-level constraint, not a column
+
+            column = build_column(name.delete('"'), rest)
+            columns[column.name] = column if column
+          end
+          columns.freeze
+        end
+
+        def build_column(name, rest)
+          type_str, array = extract_type(rest)
+          return nil if type_str.empty?
+
+          rails_type = PG_TYPE_TO_RAILS.fetch(type_str, type_str.to_sym)
+          SchemaTable::Column.new(
+            name: name,
+            type: rails_type,
+            ruby_type: SchemaTable.ruby_type_for(rails_type),
+            array: array
+          )
+        end
+
+        # The type is every token before the first uppercase-initial token (a column modifier such as
+        # `NOT`, `NULL`, `DEFAULT`, `GENERATED`, `COLLATE`). A trailing `[]` marks a Postgres array column;
+        # a `(length[,scale])` specifier is dropped. Returns `[normalized_type, array?]`.
+        def extract_type(rest)
+          type_tokens = []
+          rest.split(/\s+/).each do |token|
+            break if token.match?(/\A[A-Z]/)
+
+            type_tokens << token
+          end
+          type_str = type_tokens.join(" ")
+          array = type_str.include?("[]")
+          type_str = type_str.gsub("[]", "").gsub(/\([0-9,\s]*\)/, "").strip.downcase
+          [type_str, array]
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord.rb

@@ -4,6 +4,7 @@ require "rigor/plugin"
 
 require_relative "activerecord/schema_table"
 require_relative "activerecord/schema_parser"
+require_relative "activerecord/structure_sql_parser"
 require_relative "activerecord/model_index"
 require_relative "activerecord/model_discoverer"
 require_relative "activerecord/analyzer"
@@ -18,7 +19,8 @@ module Rigor
     # Two cached producers per plugin run:
     #
     # 1. `:schema_table` reads `db/schema.rb` via the `IoBoundary` and parses it through {SchemaParser} into
-    #    a {SchemaTable} mapping `table_name → { column_name → Column }`.
+    #    a {SchemaTable} mapping `table_name → { column_name → Column }`. When `db/schema.rb` is absent it
+    #    falls back to a PostgreSQL `db/structure.sql` (`schema_format = :sql` apps) via {StructureSqlParser}.
     # 2. `:model_index` walks every `.rb` file under the configured `model_search_paths`, finds class
     #    declarations whose direct superclass is in `model_base_classes`, and composes them with the schema
     #    table into a {ModelIndex}.
@@ -57,6 +59,9 @@ module Rigor
         description: "Types ActiveRecord finders against the project's db/schema.rb and AR models.",
         config_schema: {
           "schema_file" => { kind: :string, default: "db/schema.rb" },
+          # `schema_format = :sql` projects (GitLab-class apps) commit a PostgreSQL `db/structure.sql`
+          # instead of `db/schema.rb`. Used as the fallback schema source when `schema_file` is absent.
+          "structure_sql_file" => { kind: :string, default: "db/structure.sql" },
           "model_search_paths" => { kind: :array, default: ["app/models"] },
           "model_base_classes" => { kind: :array, default: %w[ApplicationRecord ActiveRecord::Base] }
         },
@@ -76,26 +81,34 @@ module Rigor
       RELATION_CLASS_NAME = "ActiveRecord::Relation"
 
       # Cached: parsed schema table. The producer reads `@schema_file` via `io_boundary.read_file` so the
-      # descriptor picks up the digest, then parses through {SchemaParser}.
+      # descriptor picks up the digest, then parses through {SchemaParser}. When `db/schema.rb` is absent
+      # the producer falls back to a PostgreSQL `db/structure.sql` (`schema_format = :sql` apps) parsed
+      # through {StructureSqlParser} — both reads are captured into the record-and-validate descriptor.
       producer :schema_table do |_params|
-        contents = io_boundary.read_file(@schema_file)
-        SchemaParser.parse(contents)
+        SchemaParser.parse(io_boundary.read_file(@schema_file))
+      rescue Errno::ENOENT
+        StructureSqlParser.parse(io_boundary.read_file(@structure_sql_file))
       end
 
       # Cached: model index. Walks every model file, then composes the rows with the cached schema table.
       # `watch:` (ADR-60 WD3) covers model-file additions; the discoverer's in-block reads are captured
       # into the record-and-validate dependency descriptor after the block runs.
       producer :model_index, watch: -> { [[@model_search_paths, "**/*.rb"]] } do |_params|
-        rows = ModelDiscoverer.new(
+        discoverer = ModelDiscoverer.new(
           io_boundary: io_boundary,
           search_paths: @model_search_paths,
           base_classes: @model_base_classes
-        ).discover
-        ModelIndex.build(model_rows: rows, schema_table: schema_table_or_nil)
+        )
+        rows = discoverer.discover
+        ModelIndex.build(
+          model_rows: rows, schema_table: schema_table_or_nil,
+          type_override_columns: discoverer.type_override_columns
+        )
       end
 
       def init(_services)
         @schema_file = config.fetch("schema_file")
+        @structure_sql_file = config.fetch("structure_sql_file")
         @model_search_paths = Array(config.fetch("model_search_paths")).map(&:to_s)
         @model_base_classes = Array(config.fetch("model_base_classes")).map(&:to_s)
         @schema_table = nil
@@ -518,7 +531,8 @@ module Rigor
         @load_errors << "rigor-activerecord: #{e.message}"
         nil
       rescue Errno::ENOENT
-        @load_errors << "rigor-activerecord: schema file `#{@schema_file}` not found; AR call checks skipped"
+        @load_errors << "rigor-activerecord: schema file `#{@schema_file}` (or `#{@structure_sql_file}`) " \
+                        "not found; AR call checks skipped"
         nil
       rescue StandardError => e
         @load_errors << "rigor-activerecord: failed to parse `#{@schema_file}`: #{e.class}: #{e.message}"