rigortype 0.3.2 → 0.3.4

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/effects.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+module Rigor
+  module Plugin
+    class Activejob < Rigor::Plugin::Base
+      # rigor-activejob's effect contract (ADR-103 WD4 / WD10; design note § 11.2 "Deferred execution";
+      # issue #387).
+      #
+      # ## Attribution follows the code, not the clock
+      #
+      # `perform_later` is the effect; `perform` is not. The job body runs in another process on another
+      # stack, so the caller's code does not contain it and there is **no edge** from `perform_later` to
+      # `perform` — {Rigor::Plugin::EffectEdge::TARGETS} has no spelling for one. `perform_now` is an
+      # ordinary edge, because it is an ordinary call.
+      #
+      # `set(wait: 1.hour)` returns a `ConfiguredJob` and does nothing, exactly like a Relation builder; the
+      # `.perform_later` on it is the origin, which is what `on_result:` expresses.
+      #
+      # ## The transport is a project fact
+      #
+      # Argument-blind, an enqueue is bare `io` — true and useless for policy. But a Rails app declares its
+      # adapter once, in `config.active_job.queue_adapter`, and reading it turns the row into something a
+      # reviewer can act on: under Solid Queue the enqueue is an `INSERT` into `solid_queue_jobs`, and a
+      # "no database on this path" envelope is right to object to it. Under Sidekiq it is a Redis round
+      # trip. Under `:async` it is a thread in this process and no transport at all; under `:inline` Rails
+      # runs the job on the caller's stack, which — and only which — makes `perform_later` a real edge.
+      #
+      # This is the configuration-level twin of the argument-dependent narrowing the catalogue does for
+      # `File.open`'s mode: the same discipline, one scope wider. An unread or per-environment adapter keeps
+      # the honest `io`.
+      module Effects
+        BASE = "ActiveJob::Base"
+
+        # Where a Rails app declares its adapter. Per-environment files are read too, because an app that
+        # sets the adapter only in `config/environments/production.rb` is common; agreement across every
+        # file that names one is what licenses the narrowing (see {.transport_for}).
+        CONFIG_PATHS = ["config/application.rb", "config/environments"].freeze
+
+        SETTING = /queue_adapter\s*=\s*[:"']([a-z_]+)["']?/
+
+        # What each adapter's enqueue actually touches. The absent adapters are the point: anything not
+        # listed keeps bare `io`, which is the truthful upper bound for a transport nobody named.
+        TRANSPORTS = {
+          "solid_queue" => ["io.db.write"], "delayed_job" => ["io.db.write"], "delayed" => ["io.db.write"],
+          "que" => ["io.db.write"], "good_job" => ["io.db.write"], "queue_classic" => ["io.db.write"],
+          "sidekiq" => ["io.net"], "resque" => ["io.net"], "sneakers" => ["io.net"],
+          "shoryuken" => ["io.net"], "backburner" => ["io.net"], "sucker_punch" => [],
+          "async" => [], "inline" => [], "test" => []
+        }.freeze
+
+        # The meaning half, which is adapter-independent and is what a policy actually names.
+        MEANING = ["rails.activejob.enqueue", "job.enqueue"].freeze
+
+        # `X.perform_later`, `X.perform_all_later`, `X.enqueue` — the class-side enqueues.
+        SINGLETON_ENQUEUES = %w[perform_later perform_all_later enqueue enqueue_at].freeze
+
+        # `job.enqueue`, and the enqueue on whatever `set(…)` returned.
+        RESULT_ENQUEUES = %w[perform_later enqueue enqueue_at].freeze
+
+        module_function
+
+        # @param adapter [String, nil] the adapter the project declares, or nil when it declares none
+        #   (or more than one, across environments)
+        def attributions(adapter)
+          labels = (TRANSPORTS[adapter] || ["io"]) + MEANING
+          why = transport_why(adapter)
+          SINGLETON_ENQUEUES.map do |selector|
+            EffectAttribution.new(receiver: BASE, method: selector, labels: labels, singleton: true,
+                                  discharge: true, why: why)
+          end +
+            RESULT_ENQUEUES.map do |selector|
+              EffectAttribution.new(
+                receiver: BASE, method: selector, labels: labels, on_result: true, discharge: true,
+                why: "#{why} Matched on the RESULT of a call to the job class, which is the shape " \
+                     "`WelcomeJob.set(wait: 1.hour).perform_later` takes: `set` is a builder and returns a " \
+                     "lazy ConfiguredJob, so the enqueue is one link further out."
+              )
+            end +
+            [EffectAttribution.new(receiver: BASE, method: :enqueue, labels: labels, discharge: true,
+                                   why: why)]
+        end
+
+        def transport_why(adapter)
+          if adapter.nil?
+            return "the queue adapter is unread or differs per environment, so the transport stays the " \
+                   "honest `io`; `rails.activejob.enqueue` is the meaning a policy names."
+          end
+
+          transport = TRANSPORTS[adapter]
+          if transport.nil?
+            return "`config.active_job.queue_adapter = :#{adapter}` is not an adapter this plugin has a " \
+                   "transport for, so the row keeps bare `io`."
+          end
+          if transport.empty?
+            return "`config.active_job.queue_adapter = :#{adapter}` runs the queue inside this process, so " \
+                   "the enqueue crosses no transport at all."
+          end
+
+          "`config.active_job.queue_adapter = :#{adapter}` makes the enqueue a #{transport.first} — the " \
+            "project's own configuration narrowing a transport that is otherwise unknowable."
+        end
+
+        # `perform_now` is always an edge. Under `:inline`, so is `perform_later`: Rails genuinely runs the
+        # job on the caller's stack there, and refusing the edge would understate a controller action that
+        # sends the whole email inline.
+        def edges(adapter)
+          list = [
+            EffectEdge.new(receiver: BASE, target: :perform_now,
+                           why: "`Job.perform_now(...)` runs `Job#perform` synchronously, in this process")
+          ]
+          return list unless adapter == "inline"
+
+          list << EffectEdge.new(
+            receiver: BASE, target: :perform_now, method: :perform_later,
+            why: "`config.active_job.queue_adapter = :inline` makes `perform_later` run `perform` on the " \
+                 "caller's stack; the edge is licensed by the project's own declaration and by nothing else"
+          )
+        end
+
+        # `reach: [rails-jobs]` — a job's `perform` is an entry point: nothing in the project calls it, and
+        # its footprint is what a reviewer asking "what does this job do" wants.
+        def entry_points
+          [
+            EffectEntryPoints.new(
+              name: "rails-jobs", globs: ["app/jobs/**/*.rb"],
+              why: "ActiveJob jobs — `perform` is invoked by the queue, never by project code"
+            )
+          ]
+        end
+
+        # Reads `config.active_job.queue_adapter` out of the project's configuration. Returns the adapter
+        # name when every file that names one agrees, and nil when none does or they disagree — a
+        # per-environment split has no single transport, and guessing one would be the wrong kind of
+        # precision.
+        def detect_adapter(io_boundary, root)
+          found = config_files(root).filter_map do |path|
+            io_boundary.read_file(path).force_encoding("UTF-8")[SETTING, 1]
+          rescue StandardError
+            nil
+          end.uniq
+          found.length == 1 ? found.first : nil
+        end
+
+        def config_files(root)
+          application = File.join(root, CONFIG_PATHS.first)
+          environments = Dir.glob(File.join(root, CONFIG_PATHS.last, "*.rb"))
+          ([application] + environments).select { |path| File.file?(path) }
+        rescue StandardError
+          []
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/recurring_scan.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module Rigor
+  module Plugin
+    class Activejob < Rigor::Plugin::Base
+      # ADR-102 WD3 / #369 — which jobs does this project run on a schedule it names them in by STRING?
+      #
+      # `MyJob.perform_later(...)` writes the job's name as an ordinary constant, so the reachability scan
+      # already records that edge and a root would add nothing. Solid Queue's recurring tasks are the
+      # opposite case, and they are why this file exists: a recurring job is named only as
+      # `class: "SendReminderJob"` in `config/recurring.yml`, so a repository running it every three minutes
+      # may contain no `perform_later` for it anywhere. The constant scan sees nothing and `rigor unused`
+      # reports a production job as dead code — measured on a real Rails 8 application, where one miss
+      # cascaded into a second row because the only caller of a helper class was the job itself.
+      #
+      # Solid Queue is the default Active Job backend from Rails 8, so this is a mainstream layout rather
+      # than a niche one. This is also the ONLY root source this plugin has: #350 declined to publish the
+      # discovered job set, because "a file exists under `app/jobs`" is not evidence that anything enqueues
+      # it, and an over-claiming root source silently hides real dead code (ADR-102 § Consequences).
+      #
+      # **Two layouts, one key.** Rails 8 keys `recurring.yml` by environment at the top level
+      # (`production:` → task name → entry), unlike `sidekiq-cron`'s flat document. Both depths are read
+      # rather than guessed at, and reading both is safe because neither layout yields anything under the
+      # other's reading: an environment block's values are entry Hashes whose own `class:` is absent, and a
+      # flat entry's values are Strings rather than Hashes. Every environment is read — a job scheduled only
+      # in `staging:` is still live code, and picking `production:` would report it dead.
+      #
+      # **A `command:` entry supplies nothing.** Solid Queue also accepts inline Ruby
+      # (`command: "SomeModel.cleanup"`), which names no class the way `class:` does. Parsing a constant out
+      # of an arbitrary Ruby snippet would manufacture roots from a string, so `class:` is the only key read.
+      #
+      # Names are not trusted either: the caller intersects them with the jobs {JobDiscoverer} actually
+      # found, so a typo or an out-of-tree class costs coverage rather than manufacturing a root, and the
+      # report's `matched no declaration` counter stays meaningful.
+      #
+      # Fail-soft throughout, because this reads user-authored config Rigor does not own: an absent file, an
+      # unreadable one, a YAML syntax error, or a document that is not a Hash contributes nothing rather than
+      # raising. Never boots Rails and never loads Solid Queue.
+      class RecurringScan
+        # The key naming the job class. `command:` is deliberately not read; see the class comment.
+        CLASS_KEY = "class"
+
+        # Errno classes that mean "this path is not readable as a schedule" — swallowed so one bad path does
+        # not cost the roots the other paths supply.
+        IO_ERRORS = [Errno::ENOENT, Errno::EACCES, Errno::EISDIR].freeze
+
+        def initialize(io_boundary:, recurring_paths:)
+          @io_boundary = io_boundary
+          @recurring_paths = recurring_paths
+        end
+
+        # @return [Array<String>] the class names named by a `class:` key in a recurring-task entry, sorted
+        #   and unique. NOT yet intersected with the discovered jobs — the caller does that.
+        def job_names
+          names = Set.new
+          @recurring_paths.each do |path|
+            document = load_document(path)
+            next unless document.is_a?(Hash)
+
+            collect_tasks(document, names)
+            document.each_value { |block| collect_tasks(block, names) }
+          end
+          names.to_a.sort
+        end
+
+        private
+
+        def load_document(path)
+          absolute = File.expand_path(path.to_s)
+          return nil unless File.file?(absolute)
+
+          contents = read_safely(absolute)
+          contents && parse_safely(contents)
+        end
+
+        def read_safely(path)
+          @io_boundary.read_file(path)
+        rescue Plugin::AccessDeniedError, *IO_ERRORS
+          nil
+        end
+
+        # `safe_load` with no permitted classes beyond Symbol: a schedule file is data, and Rigor never loads
+        # the Rails environment or the Solid Queue runtime to read it. `aliases: true` because YAML anchors
+        # are ordinary style in a hand-maintained schedule that repeats a task across environments.
+        def parse_safely(contents)
+          YAML.safe_load(contents, aliases: true, permitted_classes: [Symbol])
+        rescue Psych::Exception
+          nil
+        end
+
+        # A task block maps an arbitrary task NAME to an entry Hash. Only the entry's own `class:` is read —
+        # no recursion into the value, so an `args:` payload that happens to carry a `class` key cannot
+        # enter.
+        def collect_tasks(block, names)
+          return unless block.is_a?(Hash)
+
+          block.each_value do |entry|
+            next unless entry.is_a?(Hash)
+
+            value = fetch_either(entry, CLASS_KEY)
+            names << value if value.is_a?(String) && !value.empty?
+          end
+        end
+
+        def fetch_either(hash, key)
+          hash.fetch(key) { hash[key.to_sym] }
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-activejob/lib/rigor/plugin/activejob.rb

@@ -5,6 +5,8 @@ require "rigor/plugin"
 require_relative "activejob/job_index"
 require_relative "activejob/job_discoverer"
 require_relative "activejob/analyzer"
+require_relative "activejob/effects"
+require_relative "activejob/recurring_scan"
 
 module Rigor
   module Plugin
@@ -22,6 +24,7 @@ module Rigor
     #         config:
     #           job_search_paths: ["app/jobs"]                  # default; optional
     #           job_base_classes: ["ApplicationJob", "ActiveJob::Base"]  # default; optional
+    #           recurring_paths: ["config/recurring.yml"]        # default; optional
     #
     # ## Limitations (v0.1.0)
     #
@@ -34,14 +37,47 @@ module Rigor
     class Activejob < Rigor::Plugin::Base
       manifest(
         id: "activejob",
-        version: "0.1.0",
+        # Bumped — publishes `:reachability_roots` for `rigor unused` (ADR-102 WD3): the jobs Solid Queue's
+        # recurring schedule runs by name, which no `perform_later` call site writes down.
+        version: "0.2.0",
         description: "Validates ActiveJob `Job.perform_later` argument arity.",
         config_schema: {
           "job_search_paths" => { kind: :array, default: ["app/jobs"] },
-          "job_base_classes" => { kind: :array, default: %w[ApplicationJob ActiveJob::Base] }
-        }
+          "job_base_classes" => { kind: :array, default: %w[ApplicationJob ActiveJob::Base] },
+          # `recurring_paths` — the schedule configuration {RecurringScan} reads for the reachability roots
+          # below. The default is Solid Queue's conventional location, the Active Job backend Rails ships by
+          # default from 8.0. A project that keeps its schedule elsewhere lists the file itself; these are
+          # file paths, not directories, because a schedule is a named document rather than a tree.
+          "recurring_paths" => { kind: :array, default: ["config/recurring.yml"] }
+        },
+        produces: [:reachability_roots],
+        # ADR-103 WD4 / WD10 (#387). The rows themselves are NOT here: they depend on
+        # `config.active_job.queue_adapter`, which is a project fact, so they are built in
+        # `#effect_attributions` below. `effect_root: "rails"` is granted because the engine bundles this
+        # plugin ({Rigor::Plugin::FirstParty}); a third-party plugin declaring it would open `activejob.*`.
+        effect_root: "rails",
+        effect_labels: ["rails.activejob.enqueue"],
+        effect_entry_points: Effects.entry_points
       )
 
+      # ADR-103 WD10 — the enqueue's transport, read off the project's own configuration. Overridden rather
+      # than declared on the manifest because the answer is per project; memoised because
+      # `Plugin::Registry#effect_contributions` is lazy and asks once per process, and only on a run with
+      # collection on — a `rigor check` with no `effects:` block never opens `config/application.rb` for this.
+      def effect_attributions
+        Effects.attributions(detected_queue_adapter)
+      end
+
+      def effect_edges
+        Effects.edges(detected_queue_adapter)
+      end
+
+      def detected_queue_adapter
+        return @detected_queue_adapter if defined?(@detected_queue_adapter)
+
+        @detected_queue_adapter = Effects.detect_adapter(io_boundary, Dir.pwd)
+      end
+
       # Cached: discovered job index. `watch:` (ADR-60 WD3) covers every `.rb` under `job_search_paths`
       # so the cache invalidates when a job is added, removed, or edited; the discoverer's in-block
       # `IoBoundary` reads are captured into the record-and-validate dependency descriptor after the
@@ -54,9 +90,38 @@ module Rigor
         ).discover
       end
 
+      # Cached separately from `:job_index` because the two invalidate on different files: editing a
+      # schedule changes which jobs are reached without touching `app/jobs` at all. The `watch:` roots the
+      # glob at the working directory so that CREATING a schedule file — not just editing one — is seen.
+      producer :recurring_jobs, watch: -> { [[".", *@recurring_paths]] } do |_params|
+        RecurringScan.new(
+          io_boundary: io_boundary,
+          recurring_paths: @recurring_paths
+        ).job_names
+      end
+
       def init(_services)
         @job_search_paths = Array(config.fetch("job_search_paths")).map(&:to_s)
         @job_base_classes = Array(config.fetch("job_base_classes")).map(&:to_s)
+        @recurring_paths = Array(config.fetch("recurring_paths")).map(&:to_s)
+      end
+
+      # ADR-102 WD3 — publishes the jobs Solid Queue's recurring schedule runs BY NAME, for `rigor unused`.
+      #
+      # The intersection is what keeps the contribution honest, exactly as in `rigor-sidekiq` and
+      # `rigor-pundit`. {RecurringScan} says which names the schedule WRITES; {JobIndex} says which jobs
+      # EXIST. A `class:` value matching no discovered job — a typo, a renamed class, a job living outside
+      # `job_search_paths` — is dropped rather than published, so the failure mode is a missing root (a
+      # candidate row a human can judge) instead of a spurious one (silence where dead code used to be).
+      def prepare(services)
+        index = producer_value(:job_index)
+        scheduled = producer_value(:recurring_jobs)
+        return if index.nil? || scheduled.nil?
+
+        roots = scheduled.select { |name| index.known?(name) }
+        return if roots.empty?
+
+        services.fact_store.publish(plugin_id: manifest.id, name: :reachability_roots, value: roots)
       end
 
       # File-level only: the load-error emission. Per-call arity validation runs over the engine-owned

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord/effects.rb

@@ -0,0 +1,186 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+module Rigor
+  module Plugin
+    class Activerecord < Rigor::Plugin::Base
+      # rigor-activerecord's effect contract (ADR-103 WD10; design note § 11.2; issue #387).
+      #
+      # ## The two channels, and which row goes where
+      #
+      # The plugin already ships `sig/active_record/relation.rbs`, so **every `ActiveRecord::Relation`
+      # method it declares carries its own `%a{…}` annotation there** — the tier-1 channel, read as an
+      # accepted signature and therefore discharging (ADR-103 WD6). That file is also where the builder /
+      # materializer split lives, because it is the file that already draws it.
+      #
+      # What is left over lands here, and each item is left over for a reason RBS cannot fix:
+      #
+      # - **`ActiveRecord::Base`'s own surface.** The plugin ships no `ActiveRecord::Base` signature and
+      #   should not: an app's models are typed from `db/schema.rb`, per project, and a generic base-class
+      #   RBS would fight whatever the project's own `rbs collection` supplies.
+      # - **The `Enumerable` delegations on a Relation.** `map`, `filter_map`, `each_with_object` and the
+      #   rest materialise by delegating to `each`, and declaring them in the bundled RBS would change how
+      #   they *type* (`Enumerable#map`'s block-return element type is the whole point of the include).
+      # - **The connection adapter and the migration DSL**, neither of which the plugin types at all.
+      #
+      # ## Why the reads and writes are worth spelling out at all
+      #
+      # An `ActiveRecord::Base` row reaches `User.find` through the project's own
+      # `User < ApplicationRecord < ActiveRecord::Base` lines, so one row covers every model in the app.
+      # That is the whole economy of the framework layer: thirty-odd rows here colour the several thousand
+      # database touches a Rails app performs, and none of them needed a line of application code.
+      module Effects
+        BASE = "ActiveRecord::Base"
+        RELATION = "ActiveRecord::Relation"
+        ADAPTER = "ActiveRecord::ConnectionAdapters::AbstractAdapter"
+        MIGRATION = "ActiveRecord::Migration"
+
+        READ = ["io.db.read"].freeze
+        WRITE = ["io.db.write"].freeze
+        TRANSACTION = ["io.db.transaction"].freeze
+        SCHEMA_WRITE = ["io.db.write", "rails.schema.write"].freeze
+
+        # Class-side finders. Every one issues a `SELECT` the moment it is called — that is what separates
+        # them from `where`, which returns a relation and issues nothing.
+        SINGLETON_READS = %w[
+          find find_by find_by! first first! last last! take take! sole find_sole_by
+          second third fourth fifth forty_two second_to_last third_to_last
+          exists? any? none? one? many? empty? count sum average minimum maximum calculate
+          pluck pick ids find_each find_in_batches in_batches find_by_sql count_by_sql
+          find_or_initialize_by
+        ].freeze
+
+        # Class-side writers.
+        SINGLETON_WRITES = %w[
+          create create! insert insert! insert_all insert_all! upsert upsert_all
+          update update! update_all delete delete_all delete_by destroy destroy_all destroy_by
+          find_or_create_by find_or_create_by! create_or_find_by create_or_find_by! touch_all
+        ].freeze
+
+        # Instance-side readers. `reload` re-issues the `SELECT` and replaces the record's attributes,
+        # which is a receiver mutation as well as a read.
+        INSTANCE_READS = %w[valid? invalid? reload].freeze
+
+        # Instance-side writers. Each is a statement issued now; `save`'s callbacks and validators are the
+        # `effect_edges:` half, and arrive as edges rather than labels.
+        INSTANCE_WRITES = %w[
+          save save! update update! update_attribute update_attributes update_attributes!
+          update_column update_columns destroy destroy! delete touch increment! decrement!
+          toggle! becomes! insert
+        ].freeze
+
+        # The `Enumerable` surface a Relation inherits. Every one of these runs the query, because every
+        # one of them calls `each`.
+        RELATION_MATERIALIZERS = %w[
+          map flat_map filter_map collect collect_concat select filter reject find detect find_all
+          each_with_object each_with_index each_entry each_slice each_cons reduce inject
+          group_by partition sort sort_by min min_by max max_by minmax tally zip
+          take_while drop_while chunk_while slice_when lazy to_set to_h
+          all? any? none? one? include? member? first count sum
+        ].freeze
+
+        # Raw SQL, narrowed by the statement's own leading verb ({Rigor::Effects::Narrowing} `sql_verb`).
+        ADAPTER_SQL = %w[execute exec_query exec_insert exec_update exec_delete select_all select_one
+                         select_value select_values select_rows query query_value query_values].freeze
+
+        # The migration DSL. `rails.schema.write` is the meaning a reviewer names ("this changes the
+        # schema"); `io.db.write` is the transport that makes the summary honest.
+        MIGRATION_DSL = %w[
+          create_table drop_table rename_table change_table create_join_table drop_join_table
+          add_column remove_column rename_column change_column change_column_null
+          change_column_default change_column_comment
+          add_index remove_index rename_index add_reference remove_reference
+          add_foreign_key remove_foreign_key add_check_constraint remove_check_constraint
+          add_timestamps remove_timestamps enable_extension disable_extension
+          execute add_belongs_to remove_belongs_to
+        ].freeze
+
+        ADAPTER_WHY = "raw SQL; the statement's own leading verb narrows the direction, so a literal " \
+                      "`execute(\"UPDATE …\")` reads as a write and a computed string keeps the honest " \
+                      "`io.db`."
+
+        # Ambient AR calls that are neither a read nor a write of rows.
+        TRANSACTIONAL = %w[transaction with_lock lock!].freeze
+
+        module_function
+
+        def attributions
+          singleton_rows + instance_rows + relation_rows + adapter_rows + migration_rows
+        end
+
+        def singleton_rows
+          rows(BASE, SINGLETON_READS, READ, singleton: true,
+                                            why: "issues the SELECT at the call — this is the materializing " \
+                                                 "half of the builder/materializer split") +
+            rows(BASE, SINGLETON_WRITES, WRITE, singleton: true,
+                                                why: "issues an INSERT / UPDATE / DELETE at the call") +
+            rows(BASE, TRANSACTIONAL, TRANSACTION, singleton: true,
+                                                   why: "opens a transaction; the block's own origins join " \
+                                                        "by containment, so the row states only the BEGIN")
+        end
+
+        def instance_rows
+          rows(BASE, INSTANCE_READS, READ,
+               why: "re-reads the row (`reload`) or runs the validators, whose uniqueness checks query") +
+            rows(BASE, INSTANCE_WRITES, WRITE,
+                 why: "persists the record — the write a `db: none` envelope is written to catch") +
+            rows(BASE, TRANSACTIONAL, TRANSACTION,
+                 why: "opens a transaction / takes a row lock around the block")
+        end
+
+        def relation_rows
+          rows(RELATION, RELATION_MATERIALIZERS, READ,
+               why: "an Enumerable delegation on a Relation: it calls `each`, which runs the query. Not " \
+                    "declared in the bundled RBS because declaring it would change how it types")
+        end
+
+        # Two rows per selector, because raw SQL is written two ways and only one of them names a type.
+        # `adapter.execute(sql)` on a receiver the typer managed to name is the first; the second matches
+        # `ActiveRecord::Base.connection.execute(sql)` and `User.connection.exec_query(sql)`, where the
+        # connection object has no declared type but the class that handed it over is written in the source.
+        def adapter_rows
+          ADAPTER_SQL.flat_map do |selector|
+            [
+              EffectAttribution.new(
+                receiver: ADAPTER, method: selector, labels: ["io.db"], narrow: "sql_verb", discharge: true,
+                why: ADAPTER_WHY
+              ),
+              EffectAttribution.new(
+                receiver: BASE, method: selector, labels: ["io.db"], narrow: "sql_verb", on_result: true,
+                discharge: true,
+                why: "#{ADAPTER_WHY} Matched on the result of `Model.connection`, which is how raw SQL is " \
+                     "actually spelled in a Rails app."
+              )
+            ]
+          end
+        end
+
+        def migration_rows
+          rows(MIGRATION, MIGRATION_DSL, SCHEMA_WRITE,
+               why: "the migration DSL issues DDL: `io.db.write` is the transport, `rails.schema.write` " \
+                    "the meaning a `db/migrate/**` envelope names")
+        end
+
+        def rows(receiver, selectors, labels, why:, singleton: false)
+          selectors.map do |selector|
+            EffectAttribution.new(receiver: receiver, method: selector, labels: labels,
+                                  singleton: singleton, discharge: true, why: why)
+          end
+        end
+
+        # ADR-103 WD10 — the one edge ActiveRecord contributes: `save` runs the class body's callbacks and
+        # validators. The engine owns the walk; this names the base class whose descendants it applies to.
+        def edges
+          [
+            EffectEdge.new(
+              receiver: BASE, target: :activerecord_callbacks,
+              why: "`before_save :normalize` / `validate :check` / `after_commit :notify` are real, " \
+                   "synchronous, in-process calls that no syntax at the call site contains"
+            )
+          ]
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-activerecord/lib/rigor/plugin/activerecord.rb

@@ -8,6 +8,7 @@ require_relative "activerecord/structure_sql_parser"
 require_relative "activerecord/model_index"
 require_relative "activerecord/model_discoverer"
 require_relative "activerecord/analyzer"
+require_relative "activerecord/effects"
 
 module Rigor
   module Plugin
@@ -72,7 +73,17 @@ module Rigor
         # ADR-26 — `ActiveRecord::Relation` is an "open" receiver: it delegates an unbounded set of
         # user-defined scopes / class methods to its model, so `call.undefined-method` must not fire for
         # it. `CheckRules` reads this manifest field and skips the rule for the class.
-        open_receivers: ["ActiveRecord::Relation"]
+        open_receivers: ["ActiveRecord::Relation"],
+        # ADR-103 WD2 / WD10 (#387) — the effect layer. rigor-activerecord models ActiveRecord, which is
+        # part of Rails, so it opens the framework's own `rails.*` root rather than one named after the
+        # plugin; `effect_root:` is granted only because the engine bundles this plugin
+        # ({Rigor::Plugin::FirstParty}). Every row's justification is in {Effects}, and the
+        # `ActiveRecord::Relation` half is in the bundled `sig/active_record/relation.rbs` instead —
+        # tier 1, because the plugin already ships that signature.
+        effect_root: "rails",
+        effect_labels: ["rails.schema.write"],
+        effect_attributions: Effects.attributions,
+        effect_edges: Effects.edges
       )
 
       # The class the bundled `sig/active_record/relation.rbs` describes; `dynamic_return` contributes