rigortype 0.3.2 → 0.3.4

data/lib/rigor/analysis/worker_session.rb

@@ -10,6 +10,9 @@ require_relative "../rbs_extended/reporter"
 require_relative "../reflection"
 require_relative "../type/combinator"
 require_relative "../inference/coverage_scanner"
+require_relative "../effects/attribution"
+require_relative "../effects/collector"
+require_relative "../effects/envelope_index"
 require_relative "../inference/scope_indexer"
 require_relative "../inference/method_dispatcher/file_folding"
 require_relative "check_rules"
@@ -93,6 +96,14 @@ module Rigor
         # normal `--workers N` run leaves it false and pays nothing (the recorder's disabled fast path).
         @record_dependencies = record_dependencies
         @file_dependencies = {}
+        # ADR-103 WD13 — effect collection, derived from the configuration exactly as `Runner` derives it,
+        # so a worker and the parent agree without a flag to keep in sync. Records marshal back through
+        # {#drain_effects}.
+        @record_effects = configuration.effects_enabled?
+        # ADR-103 WD6 / #385 — same table, derived the same way, for the same reason as `@record_effects`
+        # above: a worker and the parent agree without a flag to keep in sync.
+        @effect_attribution = Effects::Attribution.build(configuration.effects_attribution)
+        @file_effects = {}
         # ADR-32 WD4 — full project file list (frozen Array<String>) for env-build-time invocation of any
         # loaded plugin's `source_rbs_synthesizer` callable.
         @source_files = source_files
@@ -144,14 +155,50 @@ module Rigor
       # worker captures the file's cross-file reads for {#drain_dependencies}; the recorder's own disabled
       # fast path makes the unwrapped case free.
       def analyze(path)
-        return analyze_body(path) unless @record_dependencies
+        return analyze_with_effects(path) unless @record_dependencies
 
         diagnostics = nil
-        record = DependencyRecorder.record_for(path) { diagnostics = analyze_body(path) }
+        record = DependencyRecorder.record_for(path) { diagnostics = analyze_with_effects(path) }
         @file_dependencies[path] = record
         diagnostics
       end
 
+      # ADR-103 WD13 — the worker-side mirror of `Runner#analyze_with_effects`.
+      def analyze_with_effects(path)
+        return analyze_body(path) unless @record_effects
+
+        diagnostics = nil
+        collection = Effects::Collector.collect_for(
+          path, attribution: @effect_attribution, envelopes: effect_envelope_index,
+                plugin_facts: effect_plugin_facts
+        ) do
+          diagnostics = analyze_body(path)
+        end
+        @file_effects[path] = collection
+        diagnostics
+      end
+      private :analyze_with_effects
+
+      # ADR-103 WD6 / #386 — the worker-side mirror of `Runner#effect_envelope_index`. Derived from the
+      # same configuration and the session's own environment, so a worker's `≤` lane is the one the
+      # parent would have computed for the same file.
+      # ADR-103 WD10 / #387 — the worker-side mirror of `Runner#effect_plugin_facts`. The superclass table
+      # arrives with the coordinator's scope seed, so a worker resolves an `ActiveRecord::Base` row through
+      # the same project ancestry the parent would have walked.
+      def effect_plugin_facts
+        @effect_plugin_facts ||= Effects::PluginFacts.build(
+          @plugin_registry, superclasses: @project_scope_seed[:discovered_superclasses] || {}
+        )
+      end
+      private :effect_plugin_facts
+
+      def effect_envelope_index
+        @effect_envelope_index ||= Effects::EnvelopeIndex.build(
+          configuration: @configuration, environment: @environment, plugin_facts: effect_plugin_facts
+        )
+      end
+      private :effect_envelope_index
+
       def analyze_body(path)
         parse_result = parse_source(path)
         unless parse_result.errors.empty?
@@ -160,6 +207,7 @@ module Rigor
           return parse_diagnostics(path, parse_result)
         end
 
+        Effects::Collector.record_root(parse_result.value)
         scope = seed_project_scope(Scope.empty(environment: @environment, source_path: path))
         index = Inference::ScopeIndexer.index(parse_result.value, default_scope: scope)
         # ADR-53 B4 — built-in collectors + plugin node rules share one walk.
@@ -204,6 +252,14 @@ module Rigor
         @file_dependencies
       end
 
+      # ADR-103 WD12 — the per-file {Effects::FileCollection}s this session collected (empty unless the
+      # configuration carries an `effects:` block). Marshal-clean by construction — frozen Hashes of
+      # Strings, `LabelSet`s of frozen Arrays, and `Data` edges — so the fork pool ships them back to the
+      # coordinator, which folds them into the runner's collection exactly as the sequential path would.
+      def drain_effects
+        @file_effects
+      end
+
       private
 
       # Mirrors {Runner#seed_project_scope}: applies the cross-file pre-pass discovery tables the

data/lib/rigor/bleeding_edge.rb

@@ -159,6 +159,28 @@ module Rigor
                  "the two corpora measured so far (Rigor's own `lib`, redmine `app/models`) it added no " \
                  "kills — every surviving breakage there is one the analyzer reports nowhere at all, not one " \
                  "it reports in a caller."
+      ),
+      # ADR-103 WD15 — the owner-ruled preview of the v0.4.0 default. `:behaviour` because it moves no rule's
+      # severity; safe under the header comment's cache-identity rule for a reason specific to this feature
+      # rather than the generic WD13 argument, so it is spelled out here: `effects:` collection is
+      # OBSERVATIONAL (ADR-103 WD13) and the `effects:` block itself is deliberately absent from the
+      # diagnostics cache-key identity, so whether this feature is adopted never changes what a `rigor check`
+      # diagnostics entry holds — only whether the (separately identity-keyed) effects sidecar slot
+      # (`Effects::Identity.descriptor`, `lib/rigor/analysis/runner.rb`) gets populated. Envelope findings
+      # (`effect.envelope-exceeded`) are recomputed every run from that sidecar and are never written into
+      # the diagnostics entry (ADR-103 WD12), so a warm diagnostics HIT is correct whichever way this feature
+      # is set, exactly like every other `:behaviour` feature. Verified against `Runner#compute_run_diagnostics`
+      # / `#serve_effect_collections` on 2026-08-17.
+      Feature.new(
+        id: "effects-on-by-default",
+        kind: :behaviour,
+        summary: "With it, a project whose `.rigor.yml` carries no `effects:` key at all behaves as though " \
+                 "it had written `effects: {}` — effect collection, the `rigor effects` verbs' cache sharing, " \
+                 "and `effects.check` all turn on with every sub-key at its default. Writing `effects: false` " \
+                 "explicitly still opts out, and a project that writes its own `effects:` block keeps that " \
+                 "block's shape untouched either way. Graduates to default-on at v0.4.0 (owner ruling, " \
+                 "2026-08-17): ADR-50 § WD7 reads \"at a major\" as \"at v0.4.0\" for this feature on the 0.x " \
+                 "evaluation line. See ADR-103 § WD15 for the preconditions that gate the flip."
       )
     ].freeze
 

data/lib/rigor/cache/incremental_snapshot.rb

@@ -51,8 +51,11 @@ module Rigor
       # nil (a clean cold rebuild — no migration). 11: ADR-67 WD6c lift adds `param_table` (the inferred-param
       # seed table the run's diagnostics were computed under, diffed on the next recheck to invalidate a
       # callee whose seeds moved because a caller changed); a pre-11 blob mismatches the SCHEMA gate and
-      # loads as nil (a clean cold rebuild — no migration).
-      SCHEMA = 11
+      # loads as nil (a clean cold rebuild — no migration). 12: ADR-103 WD13 / issue #382 adds the effects
+      # sidecar — `effect_collections` (the per-file {Rigor::Effects::FileCollection}s a collecting run
+      # produced) and the `effects_identity` they were produced under; a pre-12 blob mismatches the SCHEMA
+      # gate and loads as nil (a clean cold rebuild — no migration).
+      SCHEMA = 12
 
       # The persisted per-file state.
       # `cache` maps an analyzed file to its diagnostics.
@@ -87,10 +90,22 @@ module Rigor
       # recomputes the table fresh (the pre-pass is whole-project by design) and diffs it against this copy;
       # a changed entry invalidates the callee's file and its symbol dependents. The types are Marshal-clean
       # by the session's per-entry filter; a dropped entry re-checks its callee, the conservative direction.
+      # ADR-103 WD13 / issue #382 — the effects sidecar, ADR-46's half of "one cache, two identities, one
+      # extra slot":
+      # `effect_collections` maps an analyzed path to the {Rigor::Effects::FileCollection} that file
+      # contributed (`{}` when collection is off), so a recheck re-collects only the changed closure and
+      # serves the rest from here. The propagated table is NEVER stored — it is recomputed from the merged
+      # whole every run, because a leaf's summary reaches every caller and a stored table would have to be
+      # invalidated by all of them.
+      # `effects_identity` is {Rigor::Effects::Identity.digest} at the run that wrote them (nil when
+      # collection was off). It is a SEPARATE gate from the global `fingerprint`: the `effects:` block is
+      # deliberately absent from `Configuration#to_h`, so turning collection on invalidates no diagnostics,
+      # and a vocabulary / catalogue / `effects:` change must invalidate the summaries alone.
       Payload = Data.define(:cache, :sources, :digests, :analyzed,
                             :symbol_sources, :ancestry_sources, :symbol_fingerprints,
                             :missing, :class_decls, :seed_bundles, :plugin_fact_digest,
-                            :return_summaries, :param_table)
+                            :return_summaries, :param_table,
+                            :effect_collections, :effects_identity)
 
       # The global fingerprint that gates a snapshot load: a digest of the inputs whose change requires a full
       # rebuild — the engine version + schema, the engine's own SOURCE when the version does not pin it, the
@@ -206,7 +221,9 @@ module Rigor
           seed_bundles: data[:seed_bundles] || {},
           plugin_fact_digest: data[:plugin_fact_digest],
           return_summaries: data[:return_summaries] || {},
-          param_table: data[:param_table] || {}
+          param_table: data[:param_table] || {},
+          effect_collections: data[:effect_collections] || {},
+          effects_identity: data[:effects_identity]
         )
       end
       private :payload_from
@@ -227,7 +244,9 @@ module Rigor
           seed_bundles: payload.seed_bundles,
           plugin_fact_digest: payload.plugin_fact_digest,
           return_summaries: payload.return_summaries,
-          param_table: payload.param_table
+          param_table: payload.param_table,
+          effect_collections: payload.effect_collections,
+          effects_identity: payload.effects_identity
         )
         blob = Zlib::Deflate.deflate(raw)
         tmp = "#{@path}.#{Process.pid}.tmp"

data/lib/rigor/cli/check_command.rb

@@ -459,6 +459,11 @@ module Rigor
           # key. `:unset` means "no flag — use the configured selection"; `true` adopts the whole overlay, `false`
           # adopts none, and an Array of ids adopts only those (see `apply_bleeding_edge_override`).
           bleeding_edge: :unset,
+          # ADR-103 WD1 / #385 — the effect-policy audit switch. Judges `effect.envelope-exceeded` as if
+          # `effects.tolerated:` were empty, so a project can see what its discharge policy is hiding
+          # without editing the policy. Judgment-time only: the run, its collection and its cache identity
+          # are identical either way.
+          no_tolerated_effects: false,
           # Type-precision coverage block. Off by default — it is a second precision pass over the analyzed files (the
           # same scan `rigor coverage` runs), so it is opt-in to keep the default check path's cost unchanged. When set,
           # `--format json` gains a `coverage` object (scan_files + precision tiers) and the text output prints a
@@ -528,6 +533,10 @@ module Rigor
                   "ADR-50: ignore any configured bleeding_edge: selection for this run") do
             options[:bleeding_edge] = false
           end
+          opts.on("--no-tolerated-effects",
+                  "ADR-103: check effect envelopes as if effects.tolerated: were empty") do
+            options[:no_tolerated_effects] = true
+          end
         end
         parser.parse!(@argv)
         options
@@ -558,9 +567,12 @@ module Rigor
 
         path = options.fetch(:config) || Configuration.discover
         data = path && File.exist?(path) ? Configuration.load_with_includes(path) : {}
+        # ADR-103 WD15 — captured before `DEFAULTS.merge` below folds "no `effects:` key" and "`effects:
+        # false`" into the same value; see `Configuration.load`'s identical capture.
+        effects_key_present = data.key?("effects")
         data = data.dup
         data["plugins"] = inject_treat_all_as_inline_rbs(Array(data["plugins"]))
-        Configuration.new(Configuration::DEFAULTS.merge(data))
+        Configuration.new(Configuration::DEFAULTS.merge(data), effects_key_present)
       end
 
       # ADR-50 § WD2 — applies the `--bleeding-edge[=ids]` / `--no-bleeding-edge` CLI selection over the configured

data/lib/rigor/cli/check_runner_factory.rb

@@ -35,7 +35,10 @@ module Rigor
           cache_store: cache_store,
           collect_stats: options.fetch(:stats),
           workers: resolve_workers(options, configuration),
-          buffer: buffer
+          buffer: buffer,
+          # ADR-103 #385 — absent from `doctor`'s option hash and every other reuser's, so it defaults off
+          # for them without each having to declare a key about a feature they do not surface.
+          no_tolerated_effects: options.fetch(:no_tolerated_effects, false)
         )
       end
 

data/lib/rigor/cli/effects_command.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require "optionparser"
+
+require_relative "../configuration"
+require_relative "../analysis/runner"
+require_relative "../cache/store"
+require_relative "command"
+require_relative "effects_renderer"
+require_relative "effects_report"
+require_relative "effects_snapshot_command"
+require_relative "options"
+
+module Rigor
+  class CLI
+    # ADR-103 — executes `rigor effects`.
+    #
+    # Two surfaces behind one command, the shape `rigor baseline` already has:
+    #
+    # - `rigor effects [PATH…]` — the **report**. Runs the same analysis `rigor check` runs, with effect
+    #   collection on, and prints the resulting summaries instead of the diagnostic stream.
+    # - `rigor effects {update,check,diff,explain}` — the committed **effect snapshot** and its drift
+    #   gate, in {EffectsSnapshotCommand}.
+    #
+    # Neither emits a diagnostic nor enters `rigor check`'s stream; the report always exits 0, and only
+    # `check` ever exits non-zero (1 on drift, 64 on a usage error).
+    #
+    # The command turns collection on for its own run by loading the project's configuration and enabling
+    # an implicit `effects: {}` when the file carries no `effects:` block — the ad-hoc mode ADR-103 WD14
+    # describes. A project that *does* configure `effects:` gets its own settings instead, and then this
+    # run shares the whole cache with `rigor check`: the diagnostics come from the ADR-45 run entry and the
+    # summaries from the effects sidecar keyed beside it (#382), so `rigor effects` after `rigor check` in
+    # the same job is a warm hit plus the fixpoint. The ad-hoc mode digests a different `effects:` block
+    # than the project's, so it shares the diagnostics entry and keys its own effects slot.
+    class EffectsCommand < Command
+      USAGE = "Usage: rigor effects [options] [paths]"
+
+      # @return [Integer] CLI exit status: 0 on success, 1 on `check` drift, 64 on a usage error.
+      def run
+        verb = @argv.first
+        return run_verb(verb) if EffectsSnapshotCommand::VERBS.include?(verb)
+        return print_help if %w[help --help -h].include?(verb)
+
+        run_report
+      end
+
+      private
+
+      def run_verb(verb)
+        @argv.shift
+        EffectsSnapshotCommand.new(argv: @argv, verb: verb, out: @out, err: @err).run
+      end
+
+      def print_help
+        @out.puts(help)
+        0
+      end
+
+      def help
+        <<~HELP
+          #{USAGE}
+
+          With no subcommand, prints one line per method: its proven effect labels and whether that
+          list is exhaustive.
+
+          Subcommands (the committed effect snapshot, ADR-103 WD7):
+            update      Write the snapshot to effects.snapshot.path. Commit it; review its diff.
+            check       Recompute and compare; exits 1 on drift, 0 when fresh.
+            diff        The same comparison, never gating.
+            explain     The shortest edge path behind a reach change (--symbol KEY for one unit).
+
+          Run `rigor effects <subcommand> --help` for subcommand options.
+        HELP
+      end
+
+      def run_report
+        options = parse_options
+        return usage_error("unsupported format: #{options.fetch(:format)}") unless FORMATS.include?(options[:format])
+
+        configuration = Configuration.load(options.fetch(:config)).with_effects_enabled
+        table = analyze(configuration)
+        report = EffectsReport.build(table, full: options.fetch(:full))
+        EffectsRenderer.new(out: @out).render(report, format: options.fetch(:format))
+        0
+      end
+
+      FORMATS = %w[text json].freeze
+      private_constant :FORMATS
+
+      def parse_options
+        options = { config: nil, format: "text", full: false, no_tolerated: false }
+        OptionParser.new do |opts|
+          opts.banner = USAGE
+          Options.add_config(opts, options)
+          opts.on("--format=FORMAT", "Output format: text (default) or json") { |value| options[:format] = value }
+          opts.on("--full", "List every method, including exhaustive ones with no effects beyond mutate.local") do
+            options[:full] = true
+          end
+          # Accepted here and deliberately inert, exactly as it is on `update`: the report is an
+          # observation, and observations are undischarged. Only a JUDGMENT reads `effects.tolerated:` —
+          # `rigor effects check` / `diff`, and `rigor check`'s envelope contract.
+          opts.on("--no-tolerated-effects", "Judge as if effects.tolerated: were empty (inert on the report)") do
+            options[:no_tolerated] = true
+          end
+        end.parse!(@argv)
+        options
+      end
+
+      def usage_error(message)
+        @err.puts(message)
+        @err.puts(USAGE)
+        CLI::EXIT_USAGE
+      end
+
+      # Sequential and cache-backed, through the same ADR-45 whole-run result cache `rigor check` uses:
+      # the diagnostics entry serves the run and the #382 effects sidecar serves the collections, leaving
+      # only the fixpoint. Sequential is not a cache decision — the run-result cache declines pool mode —
+      # but a collecting run is pinned to the fork backend anyway, so `workers: 0` costs nothing here.
+      def analyze(configuration)
+        runner = Analysis::Runner.new(
+          configuration: configuration,
+          cache_store: Cache::Store.new(root: configuration.cache_path),
+          collect_stats: false,
+          workers: 0
+        )
+        runner.run(@argv.empty? ? configuration.paths : @argv)
+        runner.effect_table
+      end
+    end
+  end
+end

data/lib/rigor/cli/effects_diff_renderer.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "../effects/snapshot_diff"
+require_relative "renderable"
+
+module Rigor
+  class CLI
+    # Prints a {Rigor::Effects::SnapshotDiff} — what `rigor effects check` and `rigor effects diff` show a
+    # reviewer (ADR-103 WD7).
+    #
+    # The text form is grouped by table and then by policy: real drift under `methods:` / `reach:`,
+    # policy-discharged drift under `tolerated:`, and a regeneration event — a record written by a
+    # different Rigor, vocabulary or `effects:` block — under `regeneration:` above both. It closes with
+    # the one line the whole workflow turns on: intent is expressed by regenerating and committing the
+    # file, not by annotating the code.
+    #
+    # It is deliberately not a diagnostic format: no severities, no positions, no exit-code weight of its
+    # own. The exit code comes from the gate.
+    class EffectsDiffRenderer
+      include Renderable
+
+      # How each category renders as the marker after the symbol. Steins' event vocabulary, made
+      # symmetric: `≤` is the declared lane, and a hedged removal says why it is hedged.
+      MARKERS = {
+        Effects::SnapshotDiff::LABEL_ADDED => "+ %<label>s",
+        Effects::SnapshotDiff::LABEL_REMOVED => "- %<label>s",
+        Effects::SnapshotDiff::DECLARED_ADDED => "≤+ %<label>s",
+        Effects::SnapshotDiff::DECLARED_REMOVED => "≤- %<label>s",
+        Effects::SnapshotDiff::MATERIALISED => "materialised %<label>s (declared → proven)",
+        Effects::SnapshotDiff::SYMBOL_ADDED => "+symbol %<detail>s",
+        Effects::SnapshotDiff::SYMBOL_REMOVED => "-symbol %<detail>s"
+      }.freeze
+
+      HEDGED_REMOVAL = "-? %<label>s (current summary is not exhaustive)"
+
+      CLOSING_LINE = "Run `rigor effects update` and commit the result if this change is intended."
+
+      def initialize(out:, path:)
+        @out = out
+        @path = path
+      end
+
+      private
+
+      def render_text(diff)
+        if diff.fresh?
+          @out.puts("No effect drift against #{@path}.")
+          return
+        end
+
+        @out.puts("Effect drift against #{@path}:")
+        %w[snapshot header methods reach].each { |table| render_section(table, diff.events_for(table)) }
+        render_section("tolerated", diff.tolerated_events, qualified: true)
+        render_footer(diff)
+      end
+
+      # `qualified:` names each event's table inline, which the `tolerated:` heading needs: it pools events
+      # from both tables, and one symbol commonly appears in each.
+      def render_section(table, events, qualified: false)
+        return if events.empty?
+
+        @out.puts("")
+        @out.puts("#{section_name(table)}:")
+        events.each do |event|
+          suffix = qualified ? "  (#{event.table})" : ""
+          @out.puts("  #{render_event(event)}#{suffix}")
+        end
+      end
+
+      def section_name(table)
+        case table
+        when "header" then "regeneration"
+        when "snapshot" then "snapshot"
+        else table
+        end
+      end
+
+      def render_event(event)
+        marker = marker_for(event)
+        event.symbol.nil? ? marker : "#{event.symbol}  #{marker}"
+      end
+
+      def marker_for(event)
+        return format(HEDGED_REMOVAL, label: event.label) if
+          event.category == Effects::SnapshotDiff::LABEL_REMOVED && event.hedged?
+
+        template = MARKERS[event.category]
+        return event.detail.to_s unless template
+
+        format(template, label: event.label.to_s, detail: event.detail.to_s)
+      end
+
+      def render_footer(diff)
+        footer = diff.footer
+        @out.puts("")
+        unless footer[:added_symbols].zero? && footer[:removed_symbols].zero?
+          @out.puts("symbols: +#{footer[:added_symbols]} / -#{footer[:removed_symbols]} " \
+                    "(a rename is one of each)")
+        end
+        @out.puts(CLOSING_LINE)
+      end
+
+      def render_json(diff)
+        @out.puts(JSON.pretty_generate(
+                    "fresh" => diff.fresh?,
+                    "events" => diff.events.map(&:to_h),
+                    "footer" => {
+                      "added_symbols" => diff.footer[:added_symbols],
+                      "removed_symbols" => diff.footer[:removed_symbols]
+                    },
+                    "header" => {
+                      "snapshot" => @path,
+                      "gate" => diff.gate.to_s,
+                      "recorded" => diff.recorded&.header,
+                      "current" => diff.current.header
+                    }
+                  ))
+      end
+    end
+  end
+end

data/lib/rigor/cli/effects_explain_renderer.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "renderable"
+
+module Rigor
+  class CLI
+    # Prints what `rigor effects explain` found: for a `reach:` change, the shortest edge path from the
+    # entry point to the origin that introduced the label; for a `methods:` change, the origin itself
+    # (ADR-103 WD7).
+    #
+    #   reach:
+    #     OrdersController#create → OrderService#place → PaymentGateway#charge → Net::HTTP.get [io.net.http]
+    #   methods:
+    #     PaymentGateway#charge [io.net.http] ← catalogue:Net::HTTP.get
+    #
+    # A `methods:` change has no path to walk — the label came from this method's own body — so what
+    # explains it is the origin: the catalogue row or language construct, and which of the two it was.
+    # Origins are line-free by design (a summary must be stable under a line move), so no position is
+    # printed; call sites are per-run data the report carries.
+    class EffectsExplainRenderer
+      include Renderable
+
+      # One printed explanation. `path` is empty for a `methods:` row, whose explanation is the origin.
+      Row = Data.define(:table, :symbol, :label, :path, :origin)
+
+      def initialize(out:)
+        @out = out
+      end
+
+      private
+
+      def render_text(rows)
+        if rows.empty?
+          @out.puts("Nothing to explain.")
+          return
+        end
+
+        rows.group_by(&:table).each do |table, group|
+          @out.puts("#{table}:")
+          group.each { |row| @out.puts("  #{render_row(row)}") }
+        end
+      end
+
+      def render_row(row)
+        return "#{row.path.join(' → ')} [#{row.label}]" unless row.path.empty?
+
+        origin = row.origin ? " ← #{row.origin}" : ""
+        "#{row.symbol} [#{row.label}]#{origin}"
+      end
+
+      def render_json(rows)
+        @out.puts(JSON.pretty_generate(
+                    "paths" => rows.map do |row|
+                      {
+                        "table" => row.table,
+                        "symbol" => row.symbol,
+                        "label" => row.label,
+                        "path" => row.path,
+                        "origin" => row.origin
+                      }
+                    end
+                  ))
+      end
+    end
+  end
+end

data/lib/rigor/cli/effects_renderer.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "renderable"
+
+module Rigor
+  class CLI
+    # Prints an {EffectsReport}. Text is the review surface; JSON is what a bot reads.
+    #
+    # The text form says three things per method and nothing else: what it is proven to do, what a source
+    # Rigor trusts merely *claims* it does (`≤`, the declared lane), and whether the list is complete. The
+    # `…?` suffix is the exhaustiveness bit — "these effects, and possibly more" — and the indented lines
+    # under it are the closed-enum causes behind it. Deliberately not a diagnostic format: no severities,
+    # no positions, no exit-code weight.
+    class EffectsRenderer
+      include Renderable
+
+      def initialize(out:)
+        @out = out
+      end
+
+      private
+
+      def render_text(report)
+        report.rows.each do |row|
+          @out.puts("#{row.key}: [#{row.effects.join(', ')}]#{declared(row)}#{' …?' unless row.exhaustive?}")
+          row.causes.each { |cause, detail| @out.puts("    #{cause}#{" (#{detail})" if detail}") }
+        end
+      end
+
+      # `≤` is the lane's spelling everywhere in the model — an upper bound, not an observation — so the
+      # report writes it rather than inventing a second word for it.
+      def declared(row)
+        row.declared.empty? ? "" : " ≤ [#{row.declared.join(', ')}]"
+      end
+
+      def render_json(report)
+        payload = {
+          "methods" => report.rows.to_h do |row|
+            [row.key, {
+              "effects" => row.effects,
+              "declared" => row.declared,
+              "exhaustive" => row.exhaustive?,
+              "causes" => row.causes.map { |cause, detail| [cause, detail] },
+              "direct" => row.direct
+            }]
+          end
+        }
+        @out.puts(JSON.pretty_generate(payload))
+      end
+    end
+  end
+end

data/lib/rigor/cli/effects_report.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Rigor
+  class CLI
+    # The value `EffectsCommand` assembles and `EffectsRenderer` prints — one row per effect unit, already
+    # projected out of {Rigor::Effects::EffectTable} so the renderer never touches an engine value.
+    #
+    # Rows are sorted by key and every collection inside one is sorted, so two runs over the same tree
+    # print byte-identical output whether analysis ran sequentially or across the fork pool.
+    class EffectsReport < Data.define(:rows, :full)
+      # One method's line in the report.
+      #
+      # `effects` is the transitive proven lane — this method's labels joined with every project method it
+      # reaches. `exhaustive` false reads "these effects, and possibly more", and `causes` says why.
+      # `direct` is what this method's own body contributed, per origin, which is the attributable half a
+      # snapshot records (#381).
+      #
+      # `declared` is the `≤` lane, transitive like `effects`: what a source Rigor trusts but did not
+      # verify *claims* this method reaches — today the project's `effects.attribution:` table (#385). It
+      # is printed apart from `effects` and never folded into it, because the two answer different
+      # questions: one is proven, the other is asserted. A declared label the proven lane already admits
+      # is dropped here, where output is rendered; the table keeps both lanes raw.
+      class Row < Data.define(:key, :effects, :declared, :exhaustive, :causes, :direct)
+        def exhaustive?
+          exhaustive
+        end
+      end
+
+      # Builds a report from an effect table. `full:` keeps the rows the report otherwise omits — an
+      # exhaustive method proving nothing beyond `mutate.local`, which is the reading of `%a{pure}`.
+      def self.build(table, full: false)
+        rows = table.filter_map { |entry| row_for(entry) unless !full && entry.trivial? }
+        new(rows: rows.freeze, full: full)
+      end
+
+      def self.row_for(entry)
+        Row.new(
+          key: entry.key,
+          effects: entry.proven.to_a,
+          declared: entry.rendered_declared.to_a,
+          exhaustive: entry.exhaustive?,
+          causes: entry.causes,
+          direct: entry.direct.bundles.to_h { |origin, labels| [origin.to_s, labels.to_a] }.freeze
+        )
+      end
+      private_class_method :row_for
+
+      def empty?
+        rows.empty?
+      end
+    end
+  end
+end