rigortype 0.3.2 → 0.3.4

data/lib/rigor/scope.rb

@@ -23,6 +23,7 @@ module Rigor
                 :indexed_narrowings, :method_chain_narrowings,
                 :declaration_sourced,
                 :source_path, :discovery, :struct_fold_safe_locals,
+                :opaque_block_self,
                 :dynamic_origins, :local_origins, :ivar_origins,
                 :void_origins,
                 :optimistic_origins, :optimistic_locals, :optimistic_ivars
@@ -147,6 +148,7 @@ module Rigor
       declaration_sourced: EMPTY_DECLARATION_SOURCED,
       source_path: nil,
       struct_fold_safe_locals: EMPTY_FOLD_SAFE,
+      opaque_block_self: false,
       dynamic_origins: {}.compare_by_identity,
       local_origins: EMPTY_ORIGINS,
       ivar_origins: EMPTY_ORIGINS,
@@ -168,6 +170,7 @@ module Rigor
       @declaration_sourced = declaration_sourced
       @source_path = source_path
       @struct_fold_safe_locals = struct_fold_safe_locals
+      @opaque_block_self = opaque_block_self
       @dynamic_origins = dynamic_origins
       @local_origins = local_origins
       @ivar_origins = ivar_origins
@@ -274,6 +277,21 @@ module Rigor
       rebuild(struct_fold_safe_locals: locals)
     end
 
+    # Issue #316 — marks a block body whose `self` Rigor does not model. Ruby gives a block no `self` of its
+    # own: the yielding method decides, and `instance_eval` / `instance_exec` (the mechanism behind every
+    # `self`-rebinding DSL — RSpec example groups, `Class.new { … }`, Rake, Sinatra) is indistinguishable from
+    # `Array#each` without knowing the callee. The flag is set at every block entry that leaves `self_type`
+    # unnarrowed and is inherited by every scope derived inside the block; it never leaks past the block,
+    # because `eval_call` returns the caller's scope unchanged.
+    def entering_opaque_block
+      return self if @opaque_block_self
+
+      rebuild(opaque_block_self: true)
+    end
+
+    # True when this scope sits inside a block whose `self` is unmodelled ({#entering_opaque_block}).
+    def opaque_block_self? = @opaque_block_self
+
     # True when `name`'s `Struct` member reads are fold-safe in this body (the local is provably never mutated /
     # aliased / escaped).
     def struct_fold_safe?(name)
@@ -352,8 +370,11 @@ module Rigor
     # whose type is an open-call-site *lower bound* — firing against a lower bound is a false positive by
     # construction (the ADR-67 WD1 reasoning at the parameter boundary, carried one hop into the body). The
     # distinct kind keeps the inferred-param sites separable from ADR-58's ivar-copy `:local` mark, which a
-    # later un-guarding slice (WD6b) needs. `with_local` drops it on any flow-live rewrite of the local
-    # (`drop_local_declaration_marks`), so only the pristine parameter binding carries it.
+    # later un-guarding slice (WD6b) needs — and the two kinds behave OPPOSITELY on both axes: `:local` is
+    # dropped by `with_local` and intersected by `join`, while `:inferred_param` is sticky across `with_local`
+    # and unioned by `join`. See {#without_inferred_param_mark} below for the clearing contract, and
+    # `docs/internal-spec/inference-engine.md` § "Declaration-sourced provenance mark (ADR-58)" for the
+    # normative statement of both.
     def with_inferred_param_mark(name)
       rebuild(declaration_sourced: add_declaration_sourced(:inferred_param, name))
     end
@@ -505,6 +526,43 @@ module Rigor
       Inference::DefNodeResolver.resolve(entry)
     end
 
+    # Issue #316 — the CONFIDENCE-GATED companion of {#top_level_def_for}, and the only accessor the type
+    # inference may bind through. {#top_level_def_for} stays unrestricted because it also serves the
+    # *suppression* side (`call.unresolved-toplevel`, `call.undefined-method`): a name the project defines at
+    # the top level must never be reported as unresolved, whatever this gate decides.
+    #
+    # Returns nil — decline to bind, stay silent — when BOTH hold:
+    #
+    # 1. The call site sits inside a block whose `self` is unmodelled ({#opaque_block_self?}) and no narrowed
+    #    `self_type` says otherwise. A top-level `def` is a private method on `Object`, so it is *callable*
+    #    from any `self`; what the analyzer cannot see is whether the block's real `self` gained a PUBLIC
+    #    same-named method by `include` / `extend`, which wins the MRO over the private `Object` def. RSpec's
+    #    `output` / `include` / `match` matchers against a project's own `def output` are exactly this.
+    # 2. The `def` lives in a DIFFERENT file from the call site. Collocation is the evidence that the two
+    #    belong to one lexical structure — the `RSpec.describe do; def helper; end; it { helper } end` case
+    #    v0.0.3 A and #319 deliberately serve. Cross-file, the two share only a name.
+    #
+    # Both conditions are required, so a top-level helper called from genuine top-level code keeps resolving
+    # (cross-file included), and a helper defined beside its DSL-block call site keeps resolving too. When the
+    # project pre-pass recorded no source for the name, the file test cannot be answered and the historical
+    # bind is kept.
+    def bindable_top_level_def_for(method_name)
+      node = top_level_def_for(method_name)
+      return node if node.nil?
+      return node unless @opaque_block_self && @self_type.nil?
+
+      same_file_top_level_def?(method_name) ? node : nil
+    end
+
+    def same_file_top_level_def?(method_name)
+      key = Inference::ScopeIndexer::TOP_LEVEL_DEF_KEY
+      site = discovered_def_sources.dig(key, method_name.to_sym)
+      return true if site.nil? || @source_path.nil?
+
+      File.expand_path(site.sub(/:\d+\z/, "")) == File.expand_path(@source_path)
+    end
+    private :same_file_top_level_def?
+
     # ADR-46 slice 3 — a top-level (`def helper` outside any class) call has NO class ancestry to walk, so unlike
     # {#user_def_for} a miss here records no positive ancestry edge that would re-check the consumer when the
     # method later appears. Record the cross-file edge explicitly: the file defining the top-level method
@@ -756,6 +814,7 @@ module Rigor
       declaration_sourced: @declaration_sourced,
       source_path: @source_path,
       struct_fold_safe_locals: @struct_fold_safe_locals,
+      opaque_block_self: @opaque_block_self,
       dynamic_origins: @dynamic_origins,
       local_origins: @local_origins,
       ivar_origins: @ivar_origins,
@@ -774,6 +833,7 @@ module Rigor
         declaration_sourced: declaration_sourced,
         source_path: source_path,
         struct_fold_safe_locals: struct_fold_safe_locals,
+        opaque_block_self: opaque_block_self,
         dynamic_origins: dynamic_origins,
         local_origins: local_origins,
         ivar_origins: ivar_origins,

data/lib/rigor/source/node_walker.rb

@@ -14,6 +14,14 @@ module Rigor
     #
     # Non-Prism children (literals embedded in node attributes, virtual nodes, or `nil` slots) are silently
     # skipped so callers can rely on every yielded value responding to the `Prism::Node` API.
+    #
+    # Issue #318 — a `Prism::DefinedNode`'s operand is never evaluated at runtime (`defined?` inspects the
+    # expression statically; it does not run it), so the walk yields the `DefinedNode` itself but does NOT
+    # descend into its `value` subtree. Every consumer of this walker treats a yielded node as "reachable,
+    # evaluated code" (mutation/break/return scans, the check-rules main-pass oracle, coverage and precision
+    # probes); walking into the operand would make them reason about code that can never run, which is
+    # exactly the false-positive class the issue reports (`defined?(@x) && ...` flagging a call that is
+    # actually inert).
     module NodeWalker
       module_function
 
@@ -30,6 +38,8 @@ module Rigor
         return unless node.is_a?(Prism::Node)
 
         yield node
+        return if node.is_a?(Prism::DefinedNode)
+
         node.rigor_each_child { |child| walk(child, &) }
       end
 
@@ -52,6 +62,8 @@ module Rigor
         return unless node.is_a?(Prism::Node)
 
         block.call(node, ancestors)
+        return if node.is_a?(Prism::DefinedNode)
+
         ancestors.push(node)
         node.rigor_each_child { |child| walk_with_ancestors(child, ancestors, &block) }
         ancestors.pop

data/lib/rigor/type/anonymous_class_name.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Rigor
+  module Type
+    # #319 — the spelling of a class that Ruby created without a name: the `Class.new do ... end` /
+    # `Module.new do ... end` form away from constant-write position, which owns whatever its block body defines
+    # but has no constant to be keyed by.
+    #
+    # `Inference::AnonymousMetaClass` decides WHICH call sites get one and what goes in the key; this module owns
+    # the spelling, because the two places a name reaches a human live here. `#<Label:key>` is deliberately
+    # unspellable as a Ruby constant path, so a synthetic name can never collide with a real class in the
+    # discovery tables.
+    #
+    # Both renderings drop the key. `describe` keeps only the label (`#<Class>`) because the key is a file
+    # position — reproducing it would pin every `assert_type` fixture and precision snapshot to a line number.
+    # `erase_to_rbs` answers `untyped`: the name is not valid RBS, and emitting it from `rigor sig-gen` would
+    # produce a signature file that does not parse.
+    module AnonymousClassName
+      module_function
+
+      PREFIX = "#<"
+
+      # `build("Class", "lib/a.rb:3:17") #=> "#<Class:lib/a.rb:3:17>"`
+      def build(label, key)
+        "#{PREFIX}#{label}:#{key}>"
+      end
+
+      def match?(class_name)
+        class_name.is_a?(String) && class_name.start_with?(PREFIX)
+      end
+
+      # The display form: the label alone, key dropped.
+      def display(class_name)
+        return class_name unless match?(class_name)
+
+        "#{PREFIX}#{class_name.delete_prefix(PREFIX).split(':', 2).first}>"
+      end
+    end
+  end
+end

data/lib/rigor/type/nominal.rb

@@ -3,6 +3,7 @@
 require_relative "../trinary"
 require_relative "../value_semantics"
 require_relative "acceptance_router"
+require_relative "anonymous_class_name"
 require_relative "plain_lattice"
 
 module Rigor
@@ -35,13 +36,15 @@ module Rigor
       end
 
       def describe(verbosity = :short)
-        return class_name if type_args.empty?
+        rendered_name = AnonymousClassName.display(class_name)
+        return rendered_name if type_args.empty?
 
         rendered = type_args.map { |t| t.describe(verbosity) }.join(", ")
-        "#{class_name}[#{rendered}]"
+        "#{rendered_name}[#{rendered}]"
       end
 
       def erase_to_rbs
+        return "untyped" if AnonymousClassName.match?(class_name)
         return class_name if type_args.empty?
 
         rendered = type_args.map(&:erase_to_rbs).join(", ")

data/lib/rigor/type/singleton.rb

@@ -3,6 +3,7 @@
 require_relative "../trinary"
 require_relative "../value_semantics"
 require_relative "acceptance_router"
+require_relative "anonymous_class_name"
 require_relative "plain_lattice"
 
 module Rigor
@@ -26,10 +27,12 @@ module Rigor
       end
 
       def describe(_verbosity = :short)
-        "singleton(#{class_name})"
+        "singleton(#{AnonymousClassName.display(class_name)})"
       end
 
       def erase_to_rbs
+        return "untyped" if AnonymousClassName.match?(class_name)
+
         "singleton(#{class_name})"
       end
 

data/lib/rigor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rigor
-  VERSION = "0.3.2"
+  VERSION = "0.3.4"
 end

data/lib/rigor.rb

@@ -32,6 +32,7 @@ require_relative "rigor/cache/rbs_class_ancestor_table"
 require_relative "rigor/cache/rbs_class_type_param_names"
 require_relative "rigor/cache/rbs_environment"
 require_relative "rigor/type_node"
+require_relative "rigor/effects"
 require_relative "rigor/flow_contribution"
 require_relative "rigor/flow_contribution/fact"
 require_relative "rigor/flow_contribution/conflict"

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable/effects.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+module Rigor
+  module Plugin
+    class Actioncable < Rigor::Plugin::Base
+      # rigor-actioncable's effect contract (ADR-103 WD10; design note § 11.2; issue #387).
+      #
+      # A broadcast leaves the process — through Redis, through the async in-memory adapter, or through
+      # Solid Cable's database table, depending on `config/cable.yml`. Bare `io` is the only sound
+      # transport, and `rails.actioncable.broadcast` is what a reviewer means when they say "this model
+      # callback pushes to every connected browser".
+      #
+      # Turbo Streams' `broadcast_*` family rides the same rows: it is ActionCable underneath, and a
+      # `broadcast_replace_later_to` in a model callback is exactly the effect a policy on `app/models/**`
+      # exists to surface.
+      module Effects
+        CHANNEL = "ActionCable::Channel::Base"
+        SERVER = "ActionCable.server"
+        BROADCASTING = ["io", "rails.actioncable.broadcast"].freeze
+
+        # `Turbo::Broadcastable`'s class-body-declared broadcasts, called on a model instance.
+        TURBO_SELECTORS = %w[
+          broadcast_append_to broadcast_prepend_to broadcast_replace_to broadcast_update_to
+          broadcast_remove_to broadcast_before_to broadcast_after_to broadcast_action_to
+          broadcast_render_to broadcast_refresh_to
+        ].freeze
+
+        # The `_later` twins enqueue an ActiveJob that broadcasts, so they carry the enqueue meaning too.
+        TURBO_LATER_SELECTORS = TURBO_SELECTORS.map { |name| "#{name.delete_suffix('_to')}_later_to" }.freeze
+
+        LATER = (BROADCASTING + ["rails.activejob.enqueue", "job.enqueue"]).freeze
+
+        module_function
+
+        def attributions
+          channel_rows + server_rows + turbo_rows
+        end
+
+        def channel_rows
+          [
+            row(CHANNEL, :broadcast_to, BROADCASTING, singleton: true,
+                                                      why: "publishes to the channel's stream — out of this process, through whatever " \
+                                                           "`config/cable.yml` names"),
+            row(CHANNEL, :transmit, BROADCASTING,
+                why: "sends a message down this subscriber's own connection"),
+            row(CHANNEL, :stream_from, BROADCASTING,
+                why: "subscribes the connection to a stream, which registers with the pubsub adapter"),
+            row(CHANNEL, :stream_for, BROADCASTING, why: "the model-keyed `stream_from`")
+          ]
+        end
+
+        def server_rows
+          [
+            row(SERVER, :broadcast, BROADCASTING, why: "the bare pubsub publish"),
+            row("ActionCable.server.pubsub", :broadcast, BROADCASTING, why: "the adapter-level publish")
+          ]
+        end
+
+        def turbo_rows
+          TURBO_SELECTORS.map do |selector|
+            row("ActiveRecord::Base", selector, BROADCASTING,
+                why: "Turbo Streams broadcasts over ActionCable — a model callback that pushes HTML to " \
+                     "every connected browser is exactly the effect an `app/models/**` policy names")
+          end +
+            TURBO_LATER_SELECTORS.map do |selector|
+              row("ActiveRecord::Base", selector, LATER,
+                  why: "the `_later` twin enqueues a job that broadcasts, so it carries the enqueue " \
+                       "meaning as well as the broadcast one")
+            end
+        end
+
+        def row(receiver, selector, labels, why:, singleton: false)
+          EffectAttribution.new(receiver: receiver, method: selector, labels: labels,
+                                singleton: singleton, discharge: true, why: why)
+        end
+
+        def entry_points
+          [
+            EffectEntryPoints.new(
+              name: "rails-channels", globs: ["app/channels/**/*.rb"],
+              why: "channel callbacks — `subscribed`, `receive` and friends are invoked by the framework"
+            )
+          ]
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-actioncable/lib/rigor/plugin/actioncable.rb

@@ -5,6 +5,7 @@ require "rigor/plugin"
 require_relative "actioncable/channel_index"
 require_relative "actioncable/channel_discoverer"
 require_relative "actioncable/analyzer"
+require_relative "actioncable/effects"
 
 module Rigor
   module Plugin
@@ -80,7 +81,12 @@ module Rigor
             param_types: [{ index: 0, type_name: "Hash" }]
             # return_type_name: nil — receive's return value is discarded by the framework dispatcher.
           )
-        ]
+        ],
+        # ADR-103 WD10 (#387) — see {Effects} for what each row is and why.
+        effect_root: "rails",
+        effect_labels: ["rails.actioncable.broadcast"],
+        effect_attributions: Effects.attributions,
+        effect_entry_points: Effects.entry_points
       )
 
       # `watch:` covers every `.rb` file under the channel search paths so the cache invalidates when

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer/effects.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+module Rigor
+  module Plugin
+    class Actionmailer < Rigor::Plugin::Base
+      # rigor-actionmailer's effect contract (ADR-103 WD10; design note § 11.2; issue #387).
+      #
+      # ActionMailer is the clearest case in Rails of a lazy builder followed by a transport, and the
+      # design note's deferred-execution rule reads it straight off the syntax:
+      #
+      #     UserMailer.welcome(user).deliver_now
+      #     └──────── builder ─────┘└─ the effect ┘
+      #
+      # `UserMailer.welcome(u)` runs the mailer method and returns a `MessageDelivery` that has sent
+      # nothing. So it is an **edge** into `UserMailer#welcome` (whose own body may well read the
+      # database) and contributes no transport of its own. `deliver_now` is the send. `deliver_later`
+      # enqueues, which is ActiveJob's row plus the mail meaning — `email.send` still belongs there,
+      # because the mail WILL go out and a policy that forbids sending mail from a presenter means to
+      # forbid both spellings.
+      #
+      # The `on_result:` rows are what make this work on the idiom people actually write: the
+      # `MessageDelivery` in the middle has no type the project declares, but the class that produced it
+      # is written right there.
+      module Effects
+        BASE = "ActionMailer::Base"
+        DELIVERY = "ActionMailer::MessageDelivery"
+
+        NOW = ["io", "email.send", "rails.actionmailer.deliver"].freeze
+        LATER = ["io", "email.send", "rails.actionmailer.deliver", "rails.activejob.enqueue",
+                 "job.enqueue"].freeze
+
+        module_function
+
+        def attributions
+          rows(:deliver_now, NOW,
+               why: "the SMTP / API round trip itself — `io` because the delivery method is configured " \
+                    "per environment and is statically unknowable, `email.send` because that is what a " \
+                    "policy names") +
+            rows(:deliver_now!, NOW, why: "`deliver_now!` is `deliver_now` ignoring the perform-deliveries " \
+                                          "setting; the same send") +
+            rows(:deliver_later, LATER,
+                 why: "enqueues a delivery job: the enqueue rows, plus `email.send` — the mail goes out, " \
+                      "and a policy forbidding mail from this layer means both spellings") +
+            rows(:deliver_later!, LATER, why: "`deliver_later!` raises rather than serialising a missing " \
+                                              "record; the same enqueue")
+        end
+
+        # Each selector twice: once on a `MessageDelivery` receiver the typer managed to name, and once on
+        # the RESULT of a call to the mailer class, which is the spelling in every Rails codebase.
+        def rows(selector, labels, why:)
+          [
+            EffectAttribution.new(receiver: DELIVERY, method: selector, labels: labels, discharge: true,
+                                  why: why),
+            EffectAttribution.new(receiver: BASE, method: selector, labels: labels, on_result: true,
+                                  discharge: true,
+                                  why: "#{why} Matched on the result of `UserMailer.welcome(u)`, whose " \
+                                       "MessageDelivery has no type the project declares.")
+          ]
+        end
+
+        def edges
+          [
+            EffectEdge.new(
+              receiver: BASE, target: :mailer_body,
+              why: "`UserMailer.welcome(u)` instantiates the mailer and runs `#welcome` — synchronously, " \
+                   "in this process, before any delivery is attempted. The mailer body's own effects " \
+                   "(the records it reads to build the mail) belong to the caller"
+            )
+          ]
+        end
+
+        def entry_points
+          [
+            EffectEntryPoints.new(
+              name: "rails-mailers", globs: ["app/mailers/**/*.rb"],
+              why: "mailer actions — invoked by the framework through the class-method mapping"
+            )
+          ]
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-actionmailer/lib/rigor/plugin/actionmailer.rb

@@ -5,6 +5,7 @@ require "rigor/plugin"
 require_relative "actionmailer/mailer_index"
 require_relative "actionmailer/mailer_discoverer"
 require_relative "actionmailer/analyzer"
+require_relative "actionmailer/effects"
 
 module Rigor
   module Plugin
@@ -52,7 +53,13 @@ module Rigor
           "mailer_search_paths" => { kind: :array, default: ["app/mailers"] },
           "mailer_base_classes" => { kind: :array, default: %w[ApplicationMailer ActionMailer::Base] },
           "views_root" => { kind: :string, default: "app/views" }
-        }
+        },
+        # ADR-103 WD10 (#387) — see {Effects} for what each row is and why.
+        effect_root: "rails",
+        effect_labels: ["rails.actionmailer.deliver"],
+        effect_attributions: Effects.attributions,
+        effect_edges: Effects.edges,
+        effect_entry_points: Effects.entry_points
       )
 
       # `watch:` covers every mailer class under `mailer_search_paths` AND every view template under

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/effects.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+module Rigor
+  module Plugin
+    class Actionpack < Rigor::Plugin::Base
+      # rigor-actionpack's effect contract (ADR-103 WD10 / WD14; design note § 11.2; issue #387).
+      #
+      # A controller action's effects are mostly writes to the response and to per-request state, and the
+      # vocabulary distinguishes them because a reviewer does: `rails.response.write` is "this action
+      # answers the request", `rails.session.write` is "this action changes who the user is logged in as".
+      #
+      # ## `mutate.self`, not `io`
+      #
+      # `render` and `redirect_to` do not write to a socket. They set `@_response_body` and the status on
+      # the controller instance; Rack writes it later, outside any project method. So the honest label is
+      # `mutate.self` plus the framework meaning — and an envelope forbidding `io` in a service object is
+      # not violated by a helper that happens to call `render_to_string`.
+      #
+      # `render` additionally keeps a **taint**: the template is not an effect unit yet (ADR-103 WD11 /
+      # issue #392), so what the view does is genuinely unknown and the summary says so rather than
+      # pretending the action stops at the `render` line.
+      #
+      # ## The self-path rows
+      #
+      # `session[:user_id] = id` is `[]=` on the result of a receiver-less `session`, and nothing types
+      # that result. The `self.session` spelling matches the receiver expression as written, scoped by
+      # `within:` to classes whose project ancestry reaches `ActionController::Base` — so a `session`
+      # method on some unrelated project class is not mistaken for this one.
+      module Effects
+        CONTROLLER = "ActionController::Base"
+
+        RESPONSE = ["mutate.self", "rails.response.write"].freeze
+        SESSION_WRITE = ["mutate", "rails.session.write"].freeze
+        SESSION_READ = ["io", "rails.session.read"].freeze
+        COOKIE_WRITE = ["mutate", "rails.cookie.write"].freeze
+        FLASH_WRITE = ["mutate", "rails.flash.write"].freeze
+
+        # Response writers that say everything about themselves.
+        RESPONSE_WRITERS = %w[redirect_to redirect_back redirect_back_or_to head].freeze
+
+        # The render family. Same labels, plus the `template-not-analysed` taint: what the controller does
+        # is fully stated, and what the TEMPLATE does is unknown until views are effect units (ADR-103
+        # WD11 / issue #392). A summary that stopped at the `render` line and read exhaustive would be
+        # the one genuinely misleading row in the whole Rails layer.
+        RENDERERS = %w[render render_to_string render_to_body].freeze
+
+        # The cookie jars a Rails app writes through.
+        COOKIE_JARS = ["self.cookies", "self.cookies.signed", "self.cookies.encrypted",
+                       "self.cookies.permanent"].freeze
+
+        module_function
+
+        def attributions
+          response_rows + file_rows + session_rows + cookie_rows + flash_rows
+        end
+
+        def response_rows
+          RESPONSE_WRITERS.map do |selector|
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true,
+              why: "sets the response on the controller instance — Rack writes the socket later, outside " \
+                   "any project method, so this is `mutate.self` and deliberately not `io`"
+            )
+          end + render_rows
+        end
+
+        def render_rows
+          RENDERERS.map do |selector|
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true,
+              taint: "template-not-analysed",
+              why: "sets the response body from a template. The controller half is fully stated; the " \
+                   "template's own effects are unknown until views become effect units, and the taint " \
+                   "is how the summary says so rather than reading exhaustive"
+            )
+          end
+        end
+
+        # `send_file` streams from disk; `send_data` does not.
+        def file_rows
+          [
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: :send_data, labels: RESPONSE, discharge: true,
+              why: "sets the response body from an in-memory string"
+            ),
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: :send_file, labels: RESPONSE + ["io.fs.read"], discharge: true,
+              why: "sets the response AND reads the named file off disk"
+            )
+          ]
+        end
+
+        def session_rows
+          [
+            EffectAttribution.new(
+              receiver: "self.session", method: :[]=, labels: SESSION_WRITE, within: CONTROLLER,
+              discharge: true,
+              why: "writes per-request state whose store may be a cookie, a cache or the database"
+            ),
+            EffectAttribution.new(
+              receiver: "self.session", method: :delete, labels: SESSION_WRITE, within: CONTROLLER,
+              discharge: true, why: "same store, same write"
+            ),
+            EffectAttribution.new(
+              receiver: "self.session", method: :[], labels: SESSION_READ, within: CONTROLLER,
+              discharge: true,
+              why: "reads the session store — `io` because a cache- or database-backed store really does " \
+                   "go out to fetch it"
+            ),
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: :reset_session, labels: SESSION_WRITE, discharge: true,
+              why: "discards the whole session — the logout write"
+            )
+          ]
+        end
+
+        def cookie_rows
+          COOKIE_JARS.flat_map do |jar|
+            %i[[]= delete].map do |selector|
+              EffectAttribution.new(
+                receiver: jar, method: selector, labels: COOKIE_WRITE, within: CONTROLLER, discharge: true,
+                why: "queues a Set-Cookie header on the response — state that outlives the request"
+              )
+            end
+          end
+        end
+
+        def flash_rows
+          ["self.flash", "self.flash.now"].flat_map do |jar|
+            %i[[]= alert= notice=].map do |selector|
+              EffectAttribution.new(
+                receiver: jar, method: selector, labels: FLASH_WRITE, within: CONTROLLER, discharge: true,
+                why: "writes the flash, which rides the session into the next request"
+              )
+            end
+          end
+        end
+
+        def entry_points
+          [
+            EffectEntryPoints.new(
+              name: "rails-controllers", globs: ["app/controllers/**/*.rb"],
+              why: "controller actions — the request entry points; nothing in the project calls them"
+            )
+          ]
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -3,6 +3,7 @@
 require "rigor/plugin"
 
 require_relative "actionpack/analyzer"
+require_relative "actionpack/effects"
 require_relative "actionpack/controller_discoverer"
 require_relative "actionpack/controller_index"
 
@@ -69,7 +70,14 @@ module Rigor
         consumes: [
           { plugin_id: "rails-routes", name: :helper_table, optional: true },
           { plugin_id: "activerecord", name: :model_index, optional: true }
-        ]
+        ],
+        # ADR-103 WD10 / WD14 (#387) — see {Effects} for what each row is and why.
+        effect_root: "rails",
+        effect_labels: %w[
+          rails.response.write rails.session.read rails.session.write rails.cookie.write rails.flash.write
+        ],
+        effect_attributions: Effects.attributions,
+        effect_entry_points: Effects.entry_points
       )
 
       # Phase 2 cached producer — the controller index built from `controller_search_paths`. `watch:`