rigortype 0.3.2 → 0.3.4

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes/routes_parser.rb

@@ -5,6 +5,7 @@ require "rigor/source/node_children"
 require "prism"
 require "rigor/source/literals"
 
+require_relative "acronyms"
 require_relative "helper_table"
 
 module Rigor
@@ -58,13 +59,13 @@ module Rigor
         #   draw partial from `config/routes/name.rb`. Returns file contents
         #   or nil when the file is absent.
         # @return [HelperTable]
-        def parse(contents, file_reader: nil, custom_helpers: [], grape_prefixes: [])
+        def parse(contents, file_reader: nil, custom_helpers: [], grape_prefixes: [], acronyms: [])
           parse_result = Prism.parse(contents)
           unless parse_result.errors.empty?
             return HelperTable.new([], custom_helpers: custom_helpers, grape_prefixes: grape_prefixes)
           end
 
-          context = Context.new(file_reader: file_reader)
+          context = Context.new(file_reader: file_reader, acronyms: acronyms)
           interpret(parse_result.value, context)
 
           # Apply name-transform alias rules discovered during the walk (the `direct(name.sub(X, Y)) do
@@ -85,7 +86,8 @@ module Rigor
             ]
           end
           HelperTable.new(paired, custom_helpers: custom_helpers, devise_resources: context.devise_resources,
-                                  grape_prefixes: grape_prefixes)
+                                  grape_prefixes: grape_prefixes,
+                                  controllers: context.controller_class_names)
         end
 
         # For every registered alias rule `(from_str, to_str, arity_delta)`, find every existing entry whose
@@ -127,9 +129,10 @@ module Rigor
         class Context
           attr_reader :entries, :file_reader, :devise_resources, :alias_rules
 
-          def initialize(file_reader: nil)
+          def initialize(file_reader: nil, acronyms: [])
             @entries = []
             @file_reader = file_reader
+            @acronyms = acronyms
             # Stack of prefix segments. Each entry is one of:
             # - `{ kind: :namespace, name: "admin" }`
             # - `{ kind: :scope, parent: "user", arity_segments: [":user_id"] }`
@@ -145,6 +148,47 @@ module Rigor
             # patterns. Applied after parsing via `apply_alias_rules` to generate substituted-name aliases
             # for every matching entry — closes GitLab's `namespace_project_*` → `project_*` shorthand idiom.
             @alias_rules = []
+            # ADR-102 WD3 — controller PATHS ("admin/users") in Rails' own `module/controller` spelling,
+            # accumulated as routes are interpreted and camelized to class names once at the end. Stored as
+            # paths rather than class names so the module chain composes by string join, exactly as Rails
+            # composes it, and inflection runs once per unique controller instead of once per route.
+            @controllers = []
+          end
+
+          # ADR-102 WD3 — records the controller a route dispatches to.
+          #
+          # `raw` is the controller as WRITTEN at the route site: a resource name (`users`), an explicit
+          # `controller:` value, or the left half of a `"posts#index"` target. Rails resolves it against the
+          # enclosing module chain (`namespace :admin` / `scope module: :admin`), and a leading `/` opts out
+          # of that chain — both are exactly what this reproduces.
+          def record_controller(raw)
+            name = raw.to_s.strip
+            return if name.empty?
+
+            if name.start_with?("/")
+              @controllers << name.delete_prefix("/")
+              return
+            end
+
+            prefix = controller_module_path
+            @controllers << (prefix.empty? ? name : "#{prefix}/#{name}")
+          end
+
+          # The `module/` chain in force, from `namespace :admin` and `scope module: :admin` frames. A nested
+          # `resources` frame contributes NOTHING here — `resources :users do resources :posts end` serves
+          # `PostsController`, not `Users::PostsController` — which is why the module chain is its own frame
+          # key rather than being read off the helper-prefix segments.
+          def controller_module_path
+            @stack.filter_map { |frame| frame[:module] }.join("/")
+          end
+
+          # The accumulated controller paths as Ruby class names. `admin/users` → `Admin::UsersController`,
+          # via the ADR-39 shared inflector (the authority Rails itself uses) rather than a local camelizer,
+          # then respelled through the project's own declared acronyms ({Acronyms}).
+          def controller_class_names
+            @controllers.uniq.sort.map do |path|
+              Acronyms.apply("#{Rigor::Plugin::Inflector.camelize(path)}Controller", @acronyms)
+            end.uniq.sort
           end
 
           def register_alias_rule(from, to)
@@ -163,13 +207,30 @@ module Rigor
             @concerns[name.to_sym]
           end
 
+          # `namespace :admin` is Rails shorthand for `scope path: 'admin', module: 'admin', as: 'admin'`, so
+          # the frame carries the module segment too — that is what makes `resources :users` inside it read
+          # as `Admin::UsersController`.
           def push_namespace(name)
-            @stack.push(kind: :namespace, name: name.to_s)
+            @stack.push(kind: :namespace, name: name.to_s, module: name.to_s)
             yield
           ensure
             @stack.pop
           end
 
+          # `scope module: :admin do ... end` — contributes to the CONTROLLER chain only: no helper prefix,
+          # no path segment, no arity. Pushed around whatever other frame `handle_scope` decides on, so a
+          # `scope path: '/x', module: :admin` composes both.
+          def push_module(name)
+            return yield if name.nil? || name.to_s.empty?
+
+            @stack.push(kind: :module_scope, module: name.to_s)
+            begin
+              yield
+            ensure
+              @stack.pop
+            end
+          end
+
           def push_resource(parent_name)
             singular = singularize(parent_name.to_s)
             @stack.push(kind: :scope, parent: singular, parent_plural: parent_name.to_s,
@@ -653,6 +714,16 @@ module Rigor
         # When `as:` is absent the block is interpreted without any prefix change — helper names are
         # unaffected by the scope's path, which matches Rails' behaviour for path-only scopes.
         def handle_scope(node, context)
+          options = options_hash(node)
+          context.push_module(options[:module]) do
+            # `scope(path: 'groups/*id', controller: :groups) do get :edit end` — the scope names the serving
+            # controller and the inner routes carry no `to:`, so the root is only visible here.
+            context.record_controller(options[:controller]) if options[:controller]
+            interpret_scope_frame(node, context)
+          end
+        end
+
+        def interpret_scope_frame(node, context)
           as_name = keyword_symbol(node, :as)
           # `scope :path_arg, as: :name` (path as a positional arg) vs `scope(path: ':project_id', as:
           # :project)` (path as a `:path` keyword). GitLab's project routes rely on the latter for the
@@ -695,9 +766,17 @@ module Rigor
 
           register_resourceful_helpers(helper_name, actions, base_arity, context, plural: true)
 
-          context.push_resource(name) do
-            replay_concerns_from_options(options, context)
-            interpret_block_body(node, context)
+          # `resources :actions, only: [:create], module: :reports` — `module:` moves the SERVING CONTROLLER
+          # into a sub-namespace without touching helper names, paths or arity, which is why the frame wraps
+          # only the controller recording and the block. Mastodon uses it 8 times in `config/routes/admin.rb`
+          # alone; without it every one of those controllers reads as unused.
+          context.push_module(options[:module]) do
+            record_resource_controller(context, options, name, plural: true) if routed?(node, actions)
+
+            context.push_resource(name) do
+              replay_concerns_from_options(options, context)
+              interpret_block_body(node, context)
+            end
           end
         end
 
@@ -714,16 +793,119 @@ module Rigor
           # `<name>_path` (singular).
           register_resourceful_helpers(helper_name, actions, base_arity, context, plural: false)
 
-          # Push a `:singular_scope` frame so nested declarations pick up the singular resource's name in
-          # their helper prefix (Mastodon's `resource :instance do; scope module: :instances do; resources
-          # :domain_blocks; end; end` → `instance_domain_blocks_path`). The singular frame adds NO `:id`
-          # segment to arity — singular resources don't carry one.
-          context.push_singular_resource(name) do
-            replay_concerns(node, context)
-            interpret_block_body(node, context)
+          context.push_module(options[:module]) do
+            record_resource_controller(context, options, name, plural: false) if routed?(node, actions)
+
+            # Push a `:singular_scope` frame so nested declarations pick up the singular resource's name in
+            # their helper prefix (Mastodon's `resource :instance do; scope module: :instances do; resources
+            # :domain_blocks; end; end` → `instance_domain_blocks_path`). The singular frame adds NO `:id`
+            # segment to arity — singular resources don't carry one.
+            context.push_singular_resource(name) do
+              replay_concerns(node, context)
+              interpret_block_body(node, context)
+            end
           end
         end
 
+        # ADR-102 WD3 — the controller a `resources` / `resource` declaration dispatches to.
+        #
+        # `resources :users` serves `UsersController`; a SINGULAR `resource :profile` serves the PLURAL
+        # `ProfilesController` — Rails pluralises the controller even though the routes are singular, and
+        # that is the one point where the two shapes disagree. An explicit `controller:` wins outright,
+        # including its `controller: "admin/users"` module-path and `controller: "/users"` absolute forms.
+        #
+        # Whether a `resources` / `resource` declaration actually routes anything to its own controller.
+        #
+        # `only: []` strips every default action, and the two shapes it appears in mean opposite things:
+        # `resource :secret, only: [] do post :rotate end` still routes (Mastodon's
+        # `Admin::Webhooks::SecretsController`), while `resources :foo, only: [] do resources :bar end` is a
+        # pure nesting wrapper that routes nothing to `FooController`. Distinguishing them is the difference
+        # between a missing root and an over-supplied one, so the test is "does the block declare an action
+        # of its OWN?" — direct HTTP-verb statements plus those inside a direct `member` / `collection`
+        # block — rather than the cheap "does it have a block?".
+        def routed?(node, actions)
+          return true unless actions.empty?
+
+          body = node.block&.body
+          return false if body.nil?
+
+          body.child_nodes.compact.any? { |stmt| own_action?(stmt) }
+        end
+
+        ROUTE_VERBS = %i[get post patch put delete match].freeze
+
+        def own_action?(stmt)
+          return false unless stmt.is_a?(Prism::CallNode) && stmt.receiver.nil?
+          return true if ROUTE_VERBS.include?(stmt.name)
+          return false unless %i[member collection].include?(stmt.name)
+
+          inner = stmt.block&.body
+          return false if inner.nil?
+
+          inner.child_nodes.compact.any? do |s|
+            s.is_a?(Prism::CallNode) && s.receiver.nil? && ROUTE_VERBS.include?(s.name)
+          end
+        end
+
+        # `only: []` (or an `except:` that removes every action) declares no routes at all and so names no
+        # controller; the callers gate on {#routed?} rather than this method re-deriving it.
+        def record_resource_controller(context, options, name, plural:)
+          explicit = options[:controller]
+          return context.record_controller(explicit) if explicit
+
+          context.record_controller(plural ? name.to_s : Rigor::Plugin::Inflector.pluralize(name.to_s))
+        end
+
+        # ADR-102 WD3 — the controller named by an explicit route's target, in the spellings Rails accepts:
+        # `to: "posts#index"`, the hashrocket `get "help/*path" => "help#show"`, a bare positional
+        # `root "welcome#index"`, and a `controller:` option carrying no action. A non-literal target
+        # (`to: redirect("/x")`, `to: Foo.action(:show)`) yields nothing — a target this reading cannot
+        # resolve MUST name no root rather than a guessed one, because an over-supplied root silently hides
+        # real dead code (ADR-102 § Consequences).
+        def record_target_controller(node, context)
+          controller = route_target_controller(node, context)
+          context.record_controller(controller) if controller
+        end
+
+        def route_target_controller(node, context)
+          # `effective_options_for`, not `options_hash`: Mastodon routes its streaming endpoint as
+          # `with_options to: 'streaming#index' do get '/streaming' end`, where the target lives on the
+          # enclosing `with_options` frame and the route call itself carries none.
+          options = effective_options_for(node, context)
+          target = controller_action_string(options[:to]) || hashrocket_target(node) || positional_target(node)
+          return target.split("#", 2).first if target
+
+          options[:controller]&.to_s
+        end
+
+        # The `"controller#action"` shape, or nil for anything else (a Symbol `to: :index`, a non-literal).
+        def controller_action_string(value)
+          value.is_a?(String) && value.include?("#") ? value : nil
+        end
+
+        def positional_target(node)
+          (node.arguments&.arguments || [])
+            .filter_map { |arg| controller_action_string(string_value(arg)) }
+            .first
+        end
+
+        # `get 'help/*path' => 'help#show'` — the target is the VALUE of a String-keyed AssocNode in the
+        # trailing hash (`hashrocket_path_key` reads the key of the same pair).
+        def hashrocket_target(node)
+          args = node.arguments&.arguments || []
+          last = args.last
+          return nil unless last.is_a?(Prism::KeywordHashNode)
+
+          last.elements.each do |element|
+            next unless element.is_a?(Prism::AssocNode)
+            next unless element.key.is_a?(Prism::StringNode)
+
+            target = controller_action_string(string_value(element.value))
+            return target if target
+          end
+          nil
+        end
+
         # `concern :account_resources do ... end` registers the body for later replay; we DO NOT interpret
         # it at the definition site (the body has no parent-resource context yet). Concerns at the top
         # level land in the Context's `concerns` map by Symbol name.
@@ -769,6 +951,7 @@ module Rigor
         end
 
         def handle_root(node, context)
+          record_target_controller(node, context)
           # `root to: "..."` / `root "..."` — single helper `root_path`, arity 0, GET. Real-world Rails
           # apps also use `root :to => 'welcome#index', :as => 'home'` (the canonical Redmine idiom across
           # 230+ call sites), which registers an additional `home_path` / `home_url` alias for the same
@@ -790,6 +973,10 @@ module Rigor
         end
 
         def handle_explicit_route(node, context)
+          # Recorded before every early return below: a `get :preview, to: "previews#show"` inside a
+          # `member do ... end` block leaves through the shorthand branch, and its target is still a root.
+          record_target_controller(node, context)
+
           # Member / collection block shorthand: `post :memorialize` inside `member do ... end` (no path
           # arg, just a SymbolNode). Rails generates a helper based on the action name + the enclosing
           # resource: a member action becomes `<action>_<singular_chain>_path(id)`, a collection action

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes.rb

@@ -2,6 +2,7 @@
 
 require "rigor/plugin"
 
+require_relative "rails_routes/acronyms"
 require_relative "rails_routes/helper_table"
 require_relative "rails_routes/routes_parser"
 require_relative "rails_routes/helper_discoverer"
@@ -59,7 +60,11 @@ module Rigor
         # shorten `namespace_project_*` → `project_*`. Bumped 2026-07-10 — recognises the open helper
         # namespace `grape-path-helpers` generates (`api_v4_*_path`), grounded in the project's own Grape
         # `prefix` / `version` declarations (see {GrapeApiDiscoverer}).
-        version: "0.28.0",
+        # Bumped 2026-08-15 — the parser now also accumulates the CONTROLLER classes the routes file
+        # dispatches to, published as the `:reachability_roots` fact for `rigor unused` (ADR-102 WD3). The
+        # bump matters mechanically as well as editorially: the manifest version is part of the producer
+        # cache key, so it retires `:helper_table` slots written before the table carried `controllers`.
+        version: "0.29.0",
         description: "Validates Rails route-helper calls against `config/routes.rb`.",
         config_schema: {
           "routes_file" => { kind: :string, default: "config/routes.rb" },
@@ -78,7 +83,7 @@ module Rigor
           # API declares no prefixes and nothing changes for it.
           "grape_api_paths" => { kind: :array, default: ["lib/api", "app/api"] }
         },
-        produces: [:helper_table]
+        produces: %i[helper_table reachability_roots]
       )
 
       # Cached producer — reads `config/routes.rb` through the trusted `IoBoundary` and parses through
@@ -100,11 +105,16 @@ module Rigor
         end
         contents = io_boundary.read_file(@routes_file)
         RoutesParser.parse(contents, file_reader: file_reader, custom_helpers: discover_custom_helpers,
-                                     grape_prefixes: discover_grape_prefixes)
+                                     grape_prefixes: discover_grape_prefixes,
+                                     acronyms: discover_acronyms)
       end
 
       def init(_services)
         @routes_file = config.fetch("routes_file")
+        # Derived from `routes_file:` rather than configured separately: both live under the same `config/`
+        # tree in every Rails layout, and a second knob for a file the user never has to think about is a
+        # setting nobody will set correctly.
+        @inflections_file = File.join(File.dirname(@routes_file), "initializers", "inflections.rb")
         @helper_paths = Array(config.fetch("helper_paths")).map(&:to_s)
         @grape_api_paths = Array(config.fetch("grape_api_paths")).map(&:to_s)
         @helper_table = nil
@@ -140,6 +150,15 @@ module Rigor
         GrapeApiDiscoverer.discover(contents_per_path)
       end
 
+      # Reads the project's `config/initializers/inflections.rb` through the trusted `IoBoundary` and returns
+      # the acronyms it declares, for controller-class-name composition ({Acronyms}). The file is *parsed*,
+      # never executed. Absent file → no acronyms → composition behaves exactly as it did before.
+      def discover_acronyms
+        Acronyms.discover(io_boundary.read_file(@inflections_file))
+      rescue Plugin::AccessDeniedError, Errno::ENOENT
+        []
+      end
+
       def each_helper_file(&) = each_ruby_file(@helper_paths, &)
 
       def each_ruby_file(dirs, &)
@@ -153,6 +172,12 @@ module Rigor
 
       # Publishes the parsed table to the cross-plugin fact store; `rigor-actionpack` Phase 4 reads it via
       # `services.fact_store.read`.
+      #
+      # ADR-102 WD3 — also publishes `:reachability_roots`, the controller classes `config/routes.rb`
+      # dispatches to. A controller is an entry point *nothing in the project references*: Rails reaches it
+      # by name at request time, so a reference index sees a live controller exactly as it sees a dead one.
+      # `rigor unused` reads this fact from every loaded plugin and seeds its mark-and-sweep with the union.
+      # Nothing else consumes it, and it never reaches the `rigor check` diagnostic stream (WD1).
       def prepare(services)
         table = helper_table_or_nil
         return if table.nil?
@@ -162,6 +187,7 @@ module Rigor
           name: :helper_table,
           value: table.to_h
         )
+        publish_reachability_roots(services, table)
       end
 
       # File-level only: the once-per-run load-error emission. Per-call helper validation runs over the
@@ -194,6 +220,20 @@ module Rigor
 
       private
 
+      # Publishes nothing when the routes file named no controller — an empty root set is indistinguishable
+      # from "this plugin contributed nothing", and an absent fact says so without a consumer having to
+      # special-case an empty Array.
+      def publish_reachability_roots(services, table)
+        roots = table.controllers
+        return if roots.empty?
+
+        services.fact_store.publish(
+          plugin_id: manifest.id,
+          name: :reachability_roots,
+          value: roots
+        )
+      end
+
       # The load-error path used to emit the same warning on every analyzed file in the project. On large
       # monorepos (Mastodon: 1,302 files; Solidus: ~1,000 files) and on legacy projects without a top-level
       # `config/routes.rb`, this multiplied a single root cause into 1,000+ identical diagnostics. The

data/plugins/rigor-railties/lib/rigor/plugin/railties/effects.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+module Rigor
+  module Plugin
+    class Railties < Rigor::Plugin::Base
+      # rigor-railties' effect contract (ADR-103 WD10; design note § 11.2; issue #387).
+      #
+      # The rows for the `Rails.` namespace itself — the cache, the logger, the environment, the
+      # configuration, the credentials. Every one of them is spelled as a **receiver path**, because that
+      # is the only handle there is: `Rails.cache` returns whatever `config.cache_store` names, and
+      # `Rails.logger` whatever the app assigned, so the receiver has no class a row could key on. The
+      # path the programmer wrote is stable where the type is not.
+      #
+      # ## `Rails.env` is `global.read`, and that is not pedantry
+      #
+      # `Rails.env = "test"` is a real thing people do, and a memoisation keyed on `Rails.env` in a class
+      # loaded before the environment is set is a real bug. So the label is honest — and then a project
+      # writes `tolerated: [rails.config.read]` and stops seeing it, which is the mechanism working
+      # correctly: the record stays true, the judgment gets quiet.
+      #
+      # ## The credentials read is a file read
+      #
+      # `Rails.application.credentials.secret_key_base` decrypts `config/credentials.yml.enc` on first
+      # access. `io.fs.read` plus `global.read` (the decrypted bag is memoised process-wide) plus
+      # `rails.credentials.read`, which is the one a "this layer touches no secrets" policy names.
+      module Effects
+        CACHE = "Rails.cache"
+        LOGGER = "Rails.logger"
+        ERROR = "Rails.error"
+        RAILS = "Rails"
+
+        CACHE_READ = ["io", "cache.read"].freeze
+        CACHE_WRITE = ["io", "cache.write"].freeze
+        TELEMETRY = %w[io telemetry].freeze
+        CONFIG_READ = ["global.read", "rails.config.read"].freeze
+        CREDENTIALS = ["io.fs.read", "global.read", "rails.credentials.read"].freeze
+        STATIC_WRITE = ["global.write", "mutate.static"].freeze
+
+        CACHE_READERS = %w[read read_multi exist? fetch fetch_multi].freeze
+        CACHE_WRITERS = %w[write write_multi delete delete_matched delete_multi increment decrement
+                           clear cleanup].freeze
+        LOG_LEVELS = %w[debug info warn error fatal unknown add log tagged silence].freeze
+        CONFIG_READERS = %w[env root configuration application logger cache version public_path
+                            groups autoloaders].freeze
+
+        # Where a project's own logger lives, in the classes Rails gives one to. Spelled as a self path so
+        # a receiver-less `logger` inside a model or a controller is coloured and a `logger` method on some
+        # unrelated project class is not.
+        LOGGER_HOSTS = %w[ActiveRecord::Base ActionController::Base ActiveJob::Base ActionMailer::Base].freeze
+
+        module_function
+
+        def attributions
+          cache_rows + logger_rows + error_rows + config_rows + credentials_rows + mutation_rows
+        end
+
+        def cache_rows
+          CACHE_READERS.map do |selector|
+            path_row(CACHE, selector, CACHE_READ,
+                     "reads the configured cache store — memory, Redis or the filesystem, which is why " \
+                     "the transport is bare `io`. `fetch`'s block is this method's own code and joins by " \
+                     "containment, so a cache miss's cost shows up in the caller either way")
+          end +
+            CACHE_WRITERS.map do |selector|
+              path_row(CACHE, selector, CACHE_WRITE, "writes the configured cache store")
+            end
+        end
+
+        def logger_rows
+          LOG_LEVELS.map do |selector|
+            path_row(LOGGER, selector, TELEMETRY,
+                     "writes to whatever the app assigned as the logger — a file, stdout, a log " \
+                     "aggregator. `telemetry` is the label a project tolerates once and then stops " \
+                     "thinking about, which is exactly what it is for")
+          end +
+            LOGGER_HOSTS.flat_map do |host|
+              LOG_LEVELS.map do |selector|
+                EffectAttribution.new(
+                  receiver: "self.logger", method: selector, labels: TELEMETRY, within: host,
+                  discharge: true,
+                  why: "a receiver-less `logger` inside a Rails class is `Rails.logger`; `within:` is what " \
+                       "keeps a `logger` method on an unrelated project class out of this row"
+                )
+              end
+            end
+        end
+
+        def error_rows
+          %w[report handle record].map do |selector|
+            path_row(ERROR, selector, TELEMETRY,
+                     "reports to the error subscribers — Sentry, Honeybadger, a log line; the destination " \
+                     "is registered at boot and is not statically knowable")
+          end
+        end
+
+        def config_rows
+          CONFIG_READERS.map do |selector|
+            EffectAttribution.new(
+              receiver: RAILS, method: selector, labels: CONFIG_READ, singleton: true, discharge: true,
+              why: "reads mutable process state. `Rails.env = \"test\"` is a real thing people do, and a " \
+                   "value memoised from it before boot finishes is a real bug — so the row is honest and " \
+                   "`tolerated: [rails.config.read]` is how a project makes it quiet"
+            )
+          end + config_path_rows
+        end
+
+        def config_path_rows
+          %w[Rails.configuration Rails.application.config Rails.application.config.x].flat_map do |path|
+            %w[[] method_missing].map do |selector|
+              EffectAttribution.new(receiver: path, method: selector, labels: CONFIG_READ, discharge: true,
+                                    why: "reads the application configuration object, which is mutable " \
+                                         "process state")
+            end
+          end
+        end
+
+        def credentials_rows
+          %w[Rails.application.credentials Rails.application.secrets].flat_map do |path|
+            %w[[] dig fetch config].map do |selector|
+              EffectAttribution.new(
+                receiver: path, method: selector, labels: CREDENTIALS, discharge: true,
+                why: "decrypts `config/credentials.yml.enc` on first access and memoises it process-wide; " \
+                     "`rails.credentials.read` is what a 'this layer touches no secrets' policy names"
+              )
+            end
+          end
+        end
+
+        def mutation_rows
+          [
+            EffectAttribution.new(
+              receiver: "Rails.application", method: :reload_routes!, labels: STATIC_WRITE, discharge: true,
+              why: "rebuilds the route set on the application object — process-global mutation"
+            ),
+            EffectAttribution.new(
+              receiver: "Rails.autoloaders.main", method: :reload, labels: STATIC_WRITE, discharge: true,
+              why: "unloads and reloads every autoloaded constant"
+            ),
+            EffectAttribution.new(
+              receiver: "ActiveRecord::Base", method: :establish_connection, labels: STATIC_WRITE,
+              singleton: true, discharge: true,
+              why: "replaces the connection pool for the class and everything below it"
+            )
+          ]
+        end
+
+        def path_row(path, selector, labels, why)
+          EffectAttribution.new(receiver: path, method: selector, labels: labels, discharge: true, why: why)
+        end
+
+        # The `rails` preset: everything a request or a queue can enter the application through.
+        # Expressed as globs rather than as a class-ancestry filter because `reach:` is resolved from the
+        # snapshot's own method table, which carries a defining path per key and no ancestry — and in a
+        # Rails app the layout IS the ancestry, which is why the convention exists.
+        def entry_points
+          [
+            EffectEntryPoints.new(
+              name: "rails",
+              globs: ["app/controllers/**/*.rb", "app/jobs/**/*.rb", "app/mailers/**/*.rb",
+                      "app/channels/**/*.rb"],
+              why: "every way the outside world enters a Rails application: controller actions, job " \
+                   "`perform`, mailer actions, channel callbacks"
+            )
+          ]
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-railties/lib/rigor/plugin/railties.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+require_relative "railties/effects"
+
+module Rigor
+  module Plugin
+    # rigor-railties — the Rails **framework core** as an effect vocabulary.
+    #
+    # Unlike its siblings this plugin runs no analysis: it emits no diagnostic, types no receiver and
+    # declares no producer. What it contributes is the part of ADR-103's Rails layer that belongs to no
+    # single component gem — `Rails.cache`, `Rails.logger`, `Rails.env`, the application configuration and
+    # the credentials — plus the `rails` entry-point preset that `effects.snapshot.reach:` adopts by name.
+    #
+    # ## Why it is its own plugin
+    #
+    # The rule ADR-103 WD10 works to is "the row lives in the plugin that owns the gem". `Rails.cache` and
+    # `Rails.application` come from railties and activesupport, not from Action Pack or Active Record, and
+    # putting them in whichever Rails plugin a project happened to enable would make a model's
+    # `Rails.logger.info` visible or invisible depending on whether the app has controllers. A project that
+    # wants the Rails effect vocabulary lists this plugin; a project that wants only Active Record's rows
+    # does not.
+    #
+    # It is also the natural owner of the `rails` preset. A preset name may be registered once with one
+    # glob set ({Rigor::Effects::EntryPoints.register}), and `rails` spans four directories owned by four
+    # different component plugins — so exactly one plugin has to declare the union, and it is this one.
+    # Each component plugin additionally declares its own narrower preset (`rails-controllers`,
+    # `rails-jobs`, `rails-mailers`, `rails-channels`) for a project that wants a slice.
+    #
+    #     plugins:
+    #       - gem: rigor-railties
+    #
+    #     effects:
+    #       snapshot:
+    #         reach: [rails]
+    #       tolerated: [telemetry, rails.config.read]
+    #
+    # ## Cost when effects are off
+    #
+    # None beyond the load. The manifest's effect fields are frozen arrays; nothing reads them unless the
+    # project has an `effects:` block ({Rigor::Plugin::Registry#effect_contributions} is lazy), and the
+    # plugin implements no per-call contribution path at all, so `ContributionIndex` never consults it.
+    class Railties < Rigor::Plugin::Base
+      manifest(
+        id: "railties",
+        version: "0.1.0",
+        description: "The Rails framework-core effect vocabulary: cache, logger, environment, " \
+                     "configuration, credentials, and the `rails` entry-point preset.",
+        # ADR-103 WD2 — rigor-railties models Rails itself, so it opens the `rails.*` root. Granted only
+        # because the engine bundles this plugin ({Rigor::Plugin::FirstParty}); the same declaration from a
+        # third-party gem would open `railties.*` and earn a warning.
+        effect_root: "rails",
+        effect_labels: %w[rails.config.read rails.credentials.read],
+        effect_attributions: Effects.attributions,
+        effect_entry_points: Effects.entry_points
+      )
+    end
+
+    Rigor::Plugin.register(Railties)
+  end
+end

data/plugins/rigor-railties/lib/rigor-railties.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative "rigor/plugin/railties"