rigortype 0.3.1 → 0.3.3

data/plugins/rigor-dry-schema/lib/rigor/plugin/dry_schema.rb

@@ -5,6 +5,7 @@ require "prism"
 require "rigor/plugin"
 
 require_relative "dry_schema/schema_scanner"
+require_relative "dry_schema/result_shape"
 
 module Rigor
   module Plugin
@@ -58,14 +59,22 @@ module Rigor
     #   above.
     # - Publishes the table; no user-facing diagnostics yet.
     #
-    # The **ceiling** (slice 2+):
+    # Landed since: typed `result.to_h` returns, via the {.dynamic_return} rule below rather than the
+    # ADR-16 Tier C substrate the README originally projected — Tier C synthesises methods on a class
+    # from a class-level DSL call, and this is a return type for a call chain off a constant.
     #
-    # - Synthesise typed `result.to_h` returns from each schema via ADR-16 Tier C heredoc-template
-    #   substrate.
-    # - Nested schemas (`schema(do ... end)` inside another row).
-    # - `predicates(:size?)` / `each { ... }` recursion.
-    # - Per-row `dry-schema.unknown-predicate` / `dry-schema.unknown-type` `:info` diagnostics when a
-    #   row's predicate or type symbol isn't recognised.
+    # Landed since (issue #137): `each do ... end` element-type recursion ({SchemaScanner#each_block_type_info})
+    # and the `dry-schema.unknown-type` `:info` diagnostic ({SchemaScanner#unknown_type_issues}), wired
+    # below via {.node_file_context} + {.node_rule}.
+    #
+    # The **ceiling** (still open):
+    #
+    # - Nested schemas OUTSIDE an `each` (`required(:x).schema do ... end` with no `each` in the chain) —
+    #   the key is still kept as untyped; only the `each`-wrapped nested form recurses.
+    # - `predicates(:size?)` / other fine-grained predicate constraint walks.
+    # - `dry-schema.unknown-predicate` — deliberately NOT shipped; see {SchemaScanner.unknown_type_issues}
+    #   for why (no reliable static signal without a full predicate registry; risks flagging correct code).
+    # - `rigor-dry-validation` integration — landed separately in that plugin's own slices 2/3 (issue #137).
     class DrySchema < Rigor::Plugin::Base
       manifest(
         id: "dry-schema",
@@ -76,6 +85,46 @@ module Rigor
         consumes: [{ plugin_id: "dry-types", name: :dry_type_aliases, optional: true }]
       )
 
+      # ADR-37 dynamic return — `NewUserSchema.call(input).to_h` yields the schema's own
+      # `HashShape[{email: String, ?nickname: String}]` instead of the untyped hash the DSL's boundary
+      # otherwise leaves behind. The shape's required/optional split and its open extra-key policy are
+      # argued in {ResultShape}.
+      #
+      # Gated on the method name alone, not on a `Dry::Schema::Result` receiver: this plugin ships no RBS
+      # overlay for dry-schema, so in an ordinary project the receiver of `.to_h` is untyped and a
+      # `receivers:` gate would never fire. The cost of the wider gate is bounded — the engine compiles
+      # `methods:` into its registry name gate, so the block is consulted only for `.to_h` calls, and its
+      # first act rejects any chain that is not `<Const>.call(...).to_h` before the table is touched.
+      dynamic_return methods: [:to_h] do |call_node, _scope|
+        result_shape_for(call_node)
+      end
+
+      # ADR-37 slice 1c two-pass: the "collect" half of `dry-schema.unknown-type` (issue #137's ceiling
+      # diagnostic). Walks the already-parsed file root once via {SchemaScanner.unknown_type_issues}; the
+      # `node_rule` below is the "validate" half that turns each collected issue into a Diagnostic.
+      node_file_context do |root, _scope|
+        SchemaScanner.unknown_type_issues(root)
+      end
+
+      # Fires exactly once per file: `Prism::ProgramNode` is the AST root, and the engine's node walker
+      # visits the root itself before descending (see `Source::NodeWalker#walk_with_ancestors`). Cheaper
+      # than a `Prism::CallNode` rule re-matching every call site in the file — the collect pass already
+      # did the real walk.
+      node_rule Prism::ProgramNode do |_node, _scope, path, issues|
+        next [] if issues.nil? || issues.empty?
+
+        issues.map do |issue|
+          diagnostic(
+            issue[:node],
+            path: path,
+            message: "`#{issue[:key]}` uses `:#{issue[:symbol]}`, which is not a recognised dry-schema " \
+                     "canonical type symbol (see the plugin README's predicate type table)",
+            severity: :info,
+            rule: "dry-schema.unknown-type"
+          )
+        end
+      end
+
       # Walks every project file once during `prepare(services)` to build the schema table, then publishes
       # via the ADR-9 fact store. Mirrors the rigor-dry-types `#prepare` shape — the walk is bounded by
       # `paths:`, parse errors degrade silently.
@@ -93,10 +142,28 @@ module Rigor
 
       def init(_services)
         @scannable_paths = nil
+        @result_shapes = {}
       end
 
       private
 
+      # The HashShape for a `<Const>.call(...).to_h` chain, or nil when the chain isn't that shape, names
+      # no schema in the table, or names one that declares no key.
+      # Memoised per schema name INCLUDING nil: a carrier is a value object, and the miss is the common
+      # case on any project that calls `to_h` on something that isn't a schema result.
+      def result_shape_for(call_node)
+        name = ResultShape.schema_name(call_node)
+        return nil if name.nil?
+
+        # `||=` rather than a plain read of an `init`-assigned ivar: `dynamic_return_type` rescues every
+        # StandardError to nil, so a NoMethodError here would turn the whole feature off in silence.
+        shapes = (@result_shapes ||= {})
+        return shapes[name] if shapes.key?(name)
+
+        entry = read_fact(plugin_id: manifest.id, name: :dry_schema_table)&.[](name)
+        shapes[name] = entry.nil? ? nil : ResultShape.build(entry)
+      end
+
       def scannable_paths(services)
         @scannable_paths ||= services.configuration.paths.flat_map do |entry|
           if File.directory?(entry)

data/plugins/rigor-dry-validation/lib/rigor/plugin/dry_validation/contract_scanner.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "prism"
+require "rigor/source/literals"
 
 module Rigor
   module Plugin
@@ -41,6 +42,262 @@ module Rigor
         end
         private_class_method :scan_file
 
+        # Issue #137 slices 2/3 — per-Contract `params { ... }` / `json { ... }` shapes, delegating the
+        # actual required/optional walk to `rigor-dry-schema`'s {DrySchema::SchemaScanner.collect_schema_shape}
+        # (the SAME dry-schema DSL, just under a bare `params`/`json` call instead of
+        # `Dry::Schema.Params { ... }`). Returns `{}` immediately, without touching a single file, when
+        # `rigor-dry-schema` isn't loaded — the companion plugin's absence is a hard precondition here,
+        # not a degrade-gracefully fallback, because this plugin ships no required/optional walker of
+        # its own.
+        #
+        # @return [Hash{String => Hash{Symbol => Hash}}] contract FQN => `{params: <shape>}` and/or
+        #   `{json: <shape>}` (only the recognised key(s) are present; a contract with neither present
+        #   contributes nothing). Each `<shape>` is exactly {DrySchema::SchemaScanner.collect_schema_shape}'s
+        #   `{required:, optional:, unmodelled:}` return.
+        def scan_schema_blocks(paths:, type_aliases: {})
+          return {} unless Rigor::Plugin.registered_for("dry-schema")
+
+          table = {}
+          paths.each do |path|
+            scan_file_schema_blocks(path, type_aliases).each do |fqn, shapes|
+              table[fqn] ||= shapes
+            end
+          end
+          table.freeze
+        end
+
+        def scan_file_schema_blocks(path, type_aliases)
+          source = File.read(path)
+          parse_result = Prism.parse(source, filepath: path)
+          return {} unless parse_result.errors.empty?
+
+          collect_params_blocks(parse_result.value, [], type_aliases)
+        rescue StandardError
+          {}
+        end
+        private_class_method :scan_file_schema_blocks
+
+        # Mirrors {#collect_contracts}'s recursive shape, additionally capturing each recognised
+        # Contract's own `params { ... }` / `json { ... }` shape.
+        def collect_params_blocks(node, qualified_prefix, type_aliases)
+          return {} if node.nil?
+
+          case node
+          when Prism::ClassNode
+            collect_class_params_blocks(node, qualified_prefix, type_aliases)
+          when Prism::ModuleNode
+            inner_name = constant_name_for(node.constant_path)
+            return {} if inner_name.nil?
+
+            collect_params_blocks(node.body, qualified_prefix + [inner_name], type_aliases)
+          else
+            node.compact_child_nodes.each_with_object({}) do |child, acc|
+              collect_params_blocks(child, qualified_prefix, type_aliases).each { |k, v| acc[k] ||= v }
+            end
+          end
+        end
+        private_class_method :collect_params_blocks
+
+        def collect_class_params_blocks(node, qualified_prefix, type_aliases)
+          inner_name = constant_name_for(node.constant_path)
+          return {} if inner_name.nil?
+
+          new_prefix = qualified_prefix + [inner_name]
+          inner = collect_params_blocks(node.body, new_prefix, type_aliases)
+
+          if contract_subclass?(node)
+            shapes = class_body_schema_shapes(node.body, type_aliases)
+            inner[new_prefix.join("::")] = shapes unless shapes.empty?
+          end
+          inner
+        end
+        private_class_method :collect_class_params_blocks
+
+        # ONLY a top-level `params do ... end` / `json do ... end` call directly inside the Contract's
+        # class body — a bare call, no receiver, no positional/keyword arguments, exactly one block.
+        # A call nested inside a conditional, a method def, or wrapped in any other construct is NOT
+        # this floor; it's indistinguishable here from a dynamically-built or externally-shared schema,
+        # and the conservative read is to contribute nothing rather than guess.
+        def class_body_schema_shapes(body, type_aliases)
+          return {} if body.nil?
+
+          children = body.is_a?(Prism::StatementsNode) ? body.body : [body]
+          shapes = {}
+          children.each do |child|
+            next unless bare_block_call?(child)
+
+            case child.name
+            when :params then shapes[:params] ||= DrySchema::SchemaScanner.collect_schema_shape(child.block, type_aliases, nested: false)
+            when :json then shapes[:json] ||= DrySchema::SchemaScanner.collect_schema_shape(child.block, type_aliases, nested: false)
+            end
+          end
+          shapes
+        end
+        private_class_method :class_body_schema_shapes
+
+        def bare_block_call?(node)
+          node.is_a?(Prism::CallNode) && node.receiver.nil? && node.arguments.nil? &&
+            node.block.is_a?(Prism::BlockNode)
+        end
+        private_class_method :bare_block_call?
+
+        # `dry-validation.rule-key-mismatch` (issue #137's remaining ceiling checkbox) — walks an
+        # ALREADY-PARSED file's root node collecting `{node:, key:, contract_fqn:}` issues for a
+        # `rule(:sym, ...) do ... end` call whose Symbol argument names a key that is NOT in the
+        # Contract's OWN, cleanly-recognised `params`/`json` key set.
+        #
+        # FP-gated hard, per two independent all-or-nothing checks:
+        #
+        # - {#clean_known_keys} — the Contract's key universe is trusted ONLY when EVERY top-level
+        #   statement in EVERY `params`/`json` block is a recognised `required`/`optional` row (typed or
+        #   not — an unmodelled row is still a DECLARED key) or the inert `config.<x> = <literal>` idiom.
+        #   A loop building keys dynamically, a splat, an `include`, a nested schema merge, or a
+        #   `params`/`json(SomeSchema)` delegating to an externally-shared schema — ANY of these makes
+        #   the WHOLE Contract's key universe untrustworthy, not just the offending row, and the
+        #   Contract is skipped outright (no diagnostic against any of its `rule()` calls).
+        # - {#rule_arguments_or_nil} — a `rule(...)` call is checked ONLY when EVERY argument is a
+        #   literal Symbol. A splat (`rule(*keys)`), a String, a local variable, or a Hash (the
+        #   nested-key form `rule(user: [:name])`) makes the WHOLE call unresolvable, not just that one
+        #   argument, and it is skipped rather than partially validated.
+        #
+        # Returns `[]` immediately, without touching a single file, when `rigor-dry-schema` isn't loaded
+        # — there is no key universe to check a `rule()` call against without it.
+        def rule_key_issues(root, type_aliases)
+          return [] unless Rigor::Plugin.registered_for("dry-schema")
+
+          issues = []
+          walk_for_rule_issues(root, [], type_aliases, issues)
+          issues
+        end
+
+        def walk_for_rule_issues(node, qualified_prefix, type_aliases, issues)
+          return if node.nil?
+
+          case node
+          when Prism::ClassNode
+            inner_name = constant_name_for(node.constant_path)
+            return if inner_name.nil?
+
+            new_prefix = qualified_prefix + [inner_name]
+            check_contract_rules(node, new_prefix.join("::"), type_aliases, issues) if contract_subclass?(node)
+            walk_for_rule_issues(node.body, new_prefix, type_aliases, issues)
+          when Prism::ModuleNode
+            inner_name = constant_name_for(node.constant_path)
+            return if inner_name.nil?
+
+            walk_for_rule_issues(node.body, qualified_prefix + [inner_name], type_aliases, issues)
+          else
+            node.compact_child_nodes.each { |child| walk_for_rule_issues(child, qualified_prefix, type_aliases, issues) }
+          end
+        end
+        private_class_method :walk_for_rule_issues
+
+        def check_contract_rules(class_node, contract_fqn, type_aliases, issues)
+          body = class_node.body
+          return if body.nil?
+
+          children = body.is_a?(Prism::StatementsNode) ? body.body : [body]
+          known_keys = clean_known_keys(children, type_aliases)
+          return if known_keys.nil?
+
+          children.each do |child|
+            next unless rule_call?(child)
+
+            check_rule_call(child, contract_fqn, known_keys, issues)
+          end
+        end
+        private_class_method :check_contract_rules
+
+        # The Contract's full declared key set (required + optional + unmodelled, across BOTH `params`
+        # and `json` if both are present — a Contract having both is unusual, so the conservative read
+        # is the union rather than guessing which one a given `rule()` targets), or nil when the
+        # Contract has no `params`/`json` block at all OR either block fails {#clean_schema_block?}.
+        def clean_known_keys(children, type_aliases)
+          blocks = children.select { |c| bare_block_call?(c) && %i[params json].include?(c.name) }
+          return nil if blocks.empty?
+
+          keys = Set.new
+          blocks.each do |block_call|
+            return nil unless clean_schema_block?(block_call.block)
+
+            shape = DrySchema::SchemaScanner.collect_schema_shape(block_call.block, type_aliases, nested: false)
+            keys.merge(shape[:required].keys)
+            keys.merge(shape[:optional].keys)
+            keys.merge(shape[:unmodelled][:required])
+            keys.merge(shape[:unmodelled][:optional])
+          end
+          keys
+        end
+        private_class_method :clean_known_keys
+
+        def clean_schema_block?(block_node)
+          body = block_node.body
+          return true if body.nil? # empty block — vacuously clean, contributes no keys
+
+          children = body.is_a?(Prism::StatementsNode) ? body.body : [body]
+          children.all? { |child| required_or_optional_row?(child) || inert_config_assignment?(child) }
+        end
+        private_class_method :clean_schema_block?
+
+        # A `required(:key)...` / `optional(:key)...` chain, ANY predicate suffix (even one this
+        # scanner can't type — an unmodelled row is still a row that DECLARES the key, which is all
+        # {#clean_known_keys} needs).
+        def required_or_optional_row?(node)
+          return false unless node.is_a?(Prism::CallNode)
+
+          current = node
+          while current.is_a?(Prism::CallNode)
+            if %i[required optional].include?(current.name)
+              return !Rigor::Source::Literals.symbol(current.arguments&.arguments&.first).nil?
+            end
+
+            current = current.receiver
+          end
+          false
+        end
+        private_class_method :required_or_optional_row?
+
+        # `config.validate_keys = true` and similar — dry-schema's own `config.<x> = <literal>` idiom.
+        # Declares no key, so it's safe to ignore rather than treat as "unrecognised" (over-declining a
+        # perfectly common line would silently drop valid diagnostics, not risk a false positive, but
+        # there's no reason to pay that cost).
+        def inert_config_assignment?(node)
+          node.is_a?(Prism::CallNode) && node.name.end_with?("=") &&
+            node.receiver.is_a?(Prism::CallNode) && node.receiver.name == :config && node.receiver.receiver.nil?
+        end
+        private_class_method :inert_config_assignment?
+
+        def rule_call?(node)
+          node.is_a?(Prism::CallNode) && node.name == :rule && node.receiver.nil? && node.block.is_a?(Prism::BlockNode)
+        end
+        private_class_method :rule_call?
+
+        def check_rule_call(rule_node, contract_fqn, known_keys, issues)
+          symbols = rule_arguments_or_nil(rule_node)
+          return if symbols.nil?
+
+          symbols.each do |arg|
+            key = arg.unescaped.to_sym
+            next if known_keys.include?(key)
+
+            issues << { node: arg, key: key, contract_fqn: contract_fqn, known_keys: known_keys }
+          end
+        end
+        private_class_method :check_rule_call
+
+        # Every positional argument of `rule(...)`, as `Prism::SymbolNode`s, or nil when there are none,
+        # or ANY of them isn't a literal Symbol (a splat, a String, a local variable, or a Hash — the
+        # `rule(user: [:name])` nested-key form). One non-Symbol argument makes the WHOLE call
+        # unresolvable, not just that argument.
+        def rule_arguments_or_nil(rule_node)
+          args = rule_node.arguments&.arguments
+          return nil if args.nil? || args.empty?
+          return nil unless args.all?(Prism::SymbolNode)
+
+          args
+        end
+        private_class_method :rule_arguments_or_nil
+
         def collect_contracts(node, qualified_prefix)
           return [] if node.nil?
 

data/plugins/rigor-dry-validation/lib/rigor/plugin/dry_validation/params_shape.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Plugin
+    class DryValidation < Rigor::Plugin::Base
+      # Issue #137 slices 2/3 — recognises the `<Const>.new.call(...).to_h` call chain and builds the
+      # per-contract `HashShape` from the entry {ContractScanner.scan_schema_blocks} collected.
+      module ParamsShape
+        module_function
+
+        # The Contract constant `to_h_node`'s receiver chain, or nil when the chain isn't the recognised
+        # `<Const>.new.call(...).to_h` form.
+        #
+        # Mirrors rigor-dry-schema's `ResultShape.schema_name` with one extra hop: a schema's `.call` is a
+        # bare class method on the schema constant itself, but a Contract's `.call` is an INSTANCE method
+        # (`NewUserContract.new.call(input)`), so the chain has to walk through `.new` first. Floor,
+        # matching dry-schema's own posture: the contract must be named by a constant as written at the
+        # call site. Reached through a local (`c = NewUserContract.new; c.call(x).to_h`) or a relative
+        # constant path, the chain contributes nothing and `to_h` types per the RBS overlay's generic
+        # `Hash[Symbol, untyped]` as it did before.
+        def contract_name(to_h_node)
+          return nil unless to_h_node.is_a?(Prism::CallNode) && to_h_node.name == :to_h
+          return nil unless to_h_node.arguments.nil? && to_h_node.block.nil?
+
+          call_node = to_h_node.receiver
+          return nil unless call_node.is_a?(Prism::CallNode) && call_node.name == :call
+
+          new_node = call_node.receiver
+          return nil unless new_node.is_a?(Prism::CallNode) && new_node.name == :new
+          return nil unless new_node.arguments.nil? && new_node.block.nil?
+
+          constant_name(new_node.receiver)
+        end
+
+        # Delegates the entry -> HashShape build to rigor-dry-schema's own
+        # {DrySchema::ResultShape.build} — the identical algorithm the entry was collected with (via
+        # {ContractScanner.scan_schema_blocks}, which itself delegates to
+        # {DrySchema::SchemaScanner.collect_schema_shape}). Only ever called once the caller has already
+        # confirmed rigor-dry-schema is loaded.
+        def build(entry)
+          DrySchema::ResultShape.build(entry)
+        end
+
+        # Renders `Foo` / `Foo::Bar` / `::Foo::Bar` as the `::`-joined String {ContractScanner}'s table is
+        # keyed by. Duplicated from rigor-dry-schema's identical helper rather than shared — five lines,
+        # no dependency on anything ELSE in that plugin, and reusing it would need a `registered_for`
+        # guard here too even though this leaf never touches dry-schema's own type/alias machinery.
+        def constant_name(node)
+          case node
+          when Prism::ConstantReadNode then node.name.to_s
+          when Prism::ConstantPathNode then constant_path_name(node)
+          end
+        end
+
+        def constant_path_name(node)
+          parent = node.parent
+          name = node.name&.to_s
+          return nil if name.nil?
+          return name if parent.nil? # `::Foo` — the table keys are unrooted, so drop the leading `::`
+
+          prefix = constant_name(parent)
+          prefix.nil? ? nil : "#{prefix}::#{name}"
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-dry-validation/lib/rigor/plugin/dry_validation.rb

@@ -5,6 +5,7 @@ require "prism"
 require "rigor/plugin"
 
 require_relative "dry_validation/contract_scanner"
+require_relative "dry_validation/params_shape"
 
 module Rigor
   module Plugin
@@ -21,13 +22,21 @@ module Rigor
     #   Result) and `Dry::Validation::Result#{success?, failure?, to_h}`. The manifest's
     #   `signature_paths: ["sig"]` auto-contributes the overlay (ADR-25) — no project-side wiring needed.
     #
-    # Slice 2 (deferred, per design note):
+    # Landed since (issue #137):
     #
-    # - Integrate with `:dry_schema_table` (published by `rigor-dry-schema`) so the `params { ... }`
-    #   block inside a Contract contributes a typed `result.to_h` shape per the schema. Until this lands,
-    #   `result.to_h` types as `Hash[Symbol, untyped]` (the generic RBS overlay shape).
+    # - **Slice 2** — when `rigor-dry-schema` is loaded, a Contract's `params { ... }` block (the SAME
+    #   dry-schema DSL a top-level `Dry::Schema.X { ... }` body uses) refines
+    #   `NewUserContract.new.call(input).to_h` from the RBS overlay's generic `Hash[Symbol, untyped]` to
+    #   the schema-typed `HashShape`. See {ContractScanner.scan_schema_blocks} + {ParamsShape}.
+    # - **Slice 3** — `json { ... }` adapter parity with `params { ... }`. Same mechanism, same fact.
+    # - **`dry-validation.rule-key-mismatch`** — a `rule(:key)` referencing a key absent from the
+    #   Contract's own `params`/`json` block. Hard-gated: see {ContractScanner.rule_key_issues}'s doc for
+    #   the two all-or-nothing checks that keep it silent on anything not statically resolvable.
     #
-    # Slice 3 (deferred): `json { ... }` adapter parity with `params { ... }`. Same shape as slice 2.
+    # Without `rigor-dry-schema` loaded, `result.to_h` still types per the RBS overlay's generic
+    # `Hash[Symbol, untyped]` and `rule-key-mismatch` never fires — this plugin ships no required/optional
+    # walker of its own; it delegates to dry-schema's (see {ContractScanner}'s module doc for why that is
+    # a deliberate hard precondition, not a degrade-gracefully fallback).
     #
     # No ADR-3 amendment is needed for the validation surface itself; `Dry::Validation::Result` is a
     # generic class, not a sum type (the `success?` / `failure?` predicates narrow via existing bool flow
@@ -36,31 +45,98 @@ module Rigor
       manifest(
         id: "dry-validation",
         version: "0.1.0",
-        description: "Recognises `class T < Dry::Validation::Contract` subclasses and " \
-                     "publishes the contract FQN set.",
-        produces: [:dry_validation_contracts],
+        description: "Recognises `class T < Dry::Validation::Contract` subclasses, publishes the " \
+                     "contract FQN set, and (with rigor-dry-schema loaded) refines each contract's " \
+                     "`result.to_h` to its `params`/`json` schema shape.",
+        produces: %i[dry_validation_contracts dry_validation_params],
+        consumes: [{ plugin_id: "dry-types", name: :dry_type_aliases, optional: true }],
         # Auto-contribute the bundled RBS overlay (Contract#call -> Result, Result#success?/#to_h/...)
         # per ADR-25, so no project-side signature_paths wiring is needed.
         signature_paths: ["sig"]
       )
 
+      # ADR-37 dynamic return — refines `NewUserContract.new.call(input).to_h` to the per-contract
+      # `HashShape` when {#result_shape_for} finds one. Gated on the method name alone (mirrors
+      # rigor-dry-schema's own `.to_h` rule): the RBS overlay types `Contract#call`'s return as the
+      # generic `Result`, but that alone can't select a PER-CONTRACT shape, so the block does its own
+      # syntactic chain match via {ParamsShape.contract_name} before touching the table. When
+      # rigor-dry-schema isn't loaded, or the chain isn't a Contract call, this returns nil and the RBS
+      # overlay's generic `Hash[Symbol, untyped]` stands.
+      dynamic_return methods: [:to_h] do |call_node, _scope|
+        result_shape_for(call_node)
+      end
+
+      # ADR-37 slice 1c two-pass — the "collect" half of `dry-validation.rule-key-mismatch`. Reads the
+      # SAME `:dry_type_aliases` fact `#prepare` does (a plain `services.fact_store.read`, not
+      # `#read_fact`'s memoised wrapper — `services` at collect time is the run-wide instance, so an
+      # in-block memo isn't needed here the way it is across many per-call `dynamic_return` invocations).
+      node_file_context do |root, _scope|
+        type_aliases = services.fact_store.read(plugin_id: "dry-types", name: :dry_type_aliases) || {}
+        ContractScanner.rule_key_issues(root, type_aliases)
+      end
+
+      # Fires once per file (see rigor-dry-schema's identical `Prism::ProgramNode` rule for why).
+      node_rule Prism::ProgramNode do |_node, _scope, path, issues|
+        next [] if issues.nil? || issues.empty?
+
+        issues.map do |issue|
+          hint = Rigor::Plugin::Base.suggest(issue[:key], issue[:known_keys])
+          suffix = hint ? " (did you mean `:#{hint}`?)" : ""
+          diagnostic(
+            issue[:node],
+            path: path,
+            message: "rule(:#{issue[:key]}) references a key not declared by " \
+                     "`#{issue[:contract_fqn]}`'s params/json schema#{suffix}",
+            severity: :error,
+            rule: "dry-validation.rule-key-mismatch"
+          )
+        end
+      end
+
       def prepare(services)
         contracts = ContractScanner.scan(paths: scannable_paths(services))
-        return if contracts.empty?
+        unless contracts.empty?
+          services.fact_store.publish(
+            plugin_id: manifest.id,
+            name: :dry_validation_contracts,
+            value: contracts
+          )
+        end
+
+        type_aliases = services.fact_store.read(plugin_id: "dry-types", name: :dry_type_aliases) || {}
+        params_table = ContractScanner.scan_schema_blocks(paths: scannable_paths(services), type_aliases: type_aliases)
+        return if params_table.empty?
 
         services.fact_store.publish(
           plugin_id: manifest.id,
-          name: :dry_validation_contracts,
-          value: contracts
+          name: :dry_validation_params,
+          value: params_table
         )
       end
 
       def init(_services)
         @scannable_paths = nil
+        @params_shapes = {}
       end
 
       private
 
+      # The HashShape for a `<Const>.new.call(...).to_h` chain, or nil when the chain isn't that shape,
+      # names no contract in the table, or the contract's `params`/`json` shape declares no key.
+      # `params` wins over `json` when (unusually) a Contract declares both — mirrors dry-schema's own
+      # per-name memoisation, including nil, for the same reason: the miss is the common case.
+      def result_shape_for(call_node)
+        name = ParamsShape.contract_name(call_node)
+        return nil if name.nil?
+
+        shapes = (@params_shapes ||= {})
+        return shapes[name] if shapes.key?(name)
+
+        entry = read_fact(plugin_id: manifest.id, name: :dry_validation_params)&.[](name)
+        row = entry && (entry[:params] || entry[:json])
+        shapes[name] = row.nil? ? nil : ParamsShape.build(row)
+      end
+
       def scannable_paths(services)
         @scannable_paths ||= services.configuration.paths.flat_map do |entry|
           if File.directory?(entry)

data/plugins/rigor-rbs-inline/lib/rigor/plugin/rbs_inline.rb

@@ -60,9 +60,11 @@ module Rigor
         end
 
         # Return value contract:
-        # - `String` (non-empty)         → successful synthesis
-        # - `nil`                        → no contribution
-        # - `[:error, message_string]`   → parse failed, surface info diagnostic per ADR-32 WD6
+        # - `String` (non-empty)          → successful synthesis
+        # - `nil`                         → no contribution
+        # - `[:error, message_string]`    → parse failed, surface info diagnostic per ADR-32 WD6
+        # - `[:ok, source, [message, …]]` → synthesis succeeded, but an annotation was parsed and NOT
+        #                                   honoured; surface info diagnostics per ADR-32 WD12
         def call(source_file_path)
           return nil unless RBS_INLINE_AVAILABLE
           return nil unless File.file?(source_file_path)
@@ -83,7 +85,8 @@ module Rigor
           rendered = ::RBS::Inline::Writer.write(uses, decls, rbs_decls)
           return nil if rendered.nil? || rendered.strip.empty?
 
-          rendered
+          notices = unhonoured_annotations(result)
+          notices.empty? ? rendered : [:ok, rendered, notices]
         rescue ::StandardError => e
           # WD6 fail-soft — surface a structured error tuple so the engine's `Environment.for_project` can
           # emit a `source-rbs-synthesis-failed` info diagnostic naming the file + the upstream error
@@ -113,6 +116,33 @@ module Rigor
                                          .any? { |parsed| parsed.each_annotation.any? }
         end
 
+        # ADR-32 WD12 — annotations upstream's parser ACCEPTS and its writer then contributes nothing from.
+        # These are invisible without a report: synthesis succeeds, and the annotation comment is even echoed
+        # into the generated RBS, so the omission shows up neither in the output nor at runtime.
+        #
+        # The one case today is `module-self`, where the two inline-RBS dialects disagree on spelling. rbs's
+        # own `docs/inline.md` documents `# @rbs module-self: Foo`; the rbs-inline gem's grammar is
+        # `# @rbs module-self Foo`, without the colon. Handed the colon form the gem still builds a
+        # `ModuleSelf` annotation but extracts no types from it, so an empty `self_types` on a parsed
+        # annotation is a precise signature for "the author asked for a constraint we did not apply".
+        # Measured both ways in `docs/notes/20260730-inline-rbs-parser-grammar-diff.md`.
+        #
+        # Deliberately narrow. A construct the gem's parser REJECTS already routes through WD6's error path,
+        # and one it never recognised at all is upstream's grammar to define (WD3) — guessing at those would
+        # make this a lint on comment prose, which is exactly the false-positive cost ADR-5 ranks first.
+        def unhonoured_annotations(prism_result)
+          ::RBS::Inline::AnnotationParser.parse(prism_result.comments).flat_map do |parsed|
+            parsed.each_annotation.filter_map do |annotation|
+              next unless annotation.is_a?(::RBS::Inline::AST::Annotations::ModuleSelf)
+              next unless annotation.self_types.empty?
+
+              "`@rbs module-self` contributed no self-type constraint. Rigor reads the " \
+                "`# @rbs module-self Foo` spelling; `# @rbs module-self: Foo` (the spelling in rbs's own " \
+                "inline documentation) is not honoured here."
+            end
+          end.uniq
+        end
+
         # Rewrite every RDoc directive comment to its spaced spelling (`#:nodoc:` -> `# :nodoc:`) so
         # upstream's annotation grammar never sees it, and re-parse. Two reasons this happens here rather
         # than in {#annotated?}: the directive must not gate a file in, AND it must not reach the synthesis,