rigortype 0.3.3 → 0.3.5

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack/effects.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+module Rigor
+  module Plugin
+    class Actionpack < Rigor::Plugin::Base
+      # rigor-actionpack's effect contract (ADR-103 WD10 / WD14; design note § 11.2; issue #387).
+      #
+      # A controller action's effects are mostly writes to the response and to per-request state, and the
+      # vocabulary distinguishes them because a reviewer does: `rails.response.write` is "this action
+      # answers the request", `rails.session.write` is "this action changes who the user is logged in as".
+      #
+      # ## `mutate.self`, not `io`
+      #
+      # `render` and `redirect_to` do not write to a socket. They set `@_response_body` and the status on
+      # the controller instance; Rack writes it later, outside any project method. So the honest label is
+      # `mutate.self` plus the framework meaning — and an envelope forbidding `io` in a service object is
+      # not violated by a helper that happens to call `render_to_string`.
+      #
+      # `render` additionally keeps a **taint**: the template is not an effect unit yet (ADR-103 WD11 /
+      # issue #392), so what the view does is genuinely unknown and the summary says so rather than
+      # pretending the action stops at the `render` line.
+      #
+      # ## The self-path rows
+      #
+      # `session[:user_id] = id` is `[]=` on the result of a receiver-less `session`, and nothing types
+      # that result. The `self.session` spelling matches the receiver expression as written, scoped by
+      # `within:` to classes whose project ancestry reaches `ActionController::Base` — so a `session`
+      # method on some unrelated project class is not mistaken for this one.
+      module Effects
+        CONTROLLER = "ActionController::Base"
+
+        RESPONSE = ["mutate.self", "rails.response.write"].freeze
+        SESSION_WRITE = ["mutate", "rails.session.write"].freeze
+        SESSION_READ = ["io", "rails.session.read"].freeze
+        COOKIE_WRITE = ["mutate", "rails.cookie.write"].freeze
+        FLASH_WRITE = ["mutate", "rails.flash.write"].freeze
+
+        # Response writers that say everything about themselves.
+        RESPONSE_WRITERS = %w[redirect_to redirect_back redirect_back_or_to head].freeze
+
+        # The render family. Same labels, plus the `template-not-analysed` taint: what the controller does
+        # is fully stated, and what the TEMPLATE does is unknown until views are effect units (ADR-103
+        # WD11 / issue #392). A summary that stopped at the `render` line and read exhaustive would be
+        # the one genuinely misleading row in the whole Rails layer.
+        RENDERERS = %w[render render_to_string render_to_body].freeze
+
+        # The cookie jars a Rails app writes through.
+        COOKIE_JARS = ["self.cookies", "self.cookies.signed", "self.cookies.encrypted",
+                       "self.cookies.permanent"].freeze
+
+        module_function
+
+        def attributions
+          response_rows + file_rows + session_rows + cookie_rows + flash_rows
+        end
+
+        def response_rows
+          RESPONSE_WRITERS.map do |selector|
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true,
+              why: "sets the response on the controller instance — Rack writes the socket later, outside " \
+                   "any project method, so this is `mutate.self` and deliberately not `io`"
+            )
+          end + render_rows
+        end
+
+        def render_rows
+          RENDERERS.map do |selector|
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: selector, labels: RESPONSE, discharge: true,
+              taint: "template-not-analysed",
+              why: "sets the response body from a template. The controller half is fully stated; the " \
+                   "template's own effects are unknown until views become effect units, and the taint " \
+                   "is how the summary says so rather than reading exhaustive"
+            )
+          end
+        end
+
+        # `send_file` streams from disk; `send_data` does not.
+        def file_rows
+          [
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: :send_data, labels: RESPONSE, discharge: true,
+              why: "sets the response body from an in-memory string"
+            ),
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: :send_file, labels: RESPONSE + ["io.fs.read"], discharge: true,
+              why: "sets the response AND reads the named file off disk"
+            )
+          ]
+        end
+
+        def session_rows
+          [
+            EffectAttribution.new(
+              receiver: "self.session", method: :[]=, labels: SESSION_WRITE, within: CONTROLLER,
+              discharge: true,
+              why: "writes per-request state whose store may be a cookie, a cache or the database"
+            ),
+            EffectAttribution.new(
+              receiver: "self.session", method: :delete, labels: SESSION_WRITE, within: CONTROLLER,
+              discharge: true, why: "same store, same write"
+            ),
+            EffectAttribution.new(
+              receiver: "self.session", method: :[], labels: SESSION_READ, within: CONTROLLER,
+              discharge: true,
+              why: "reads the session store — `io` because a cache- or database-backed store really does " \
+                   "go out to fetch it"
+            ),
+            EffectAttribution.new(
+              receiver: CONTROLLER, method: :reset_session, labels: SESSION_WRITE, discharge: true,
+              why: "discards the whole session — the logout write"
+            )
+          ]
+        end
+
+        def cookie_rows
+          COOKIE_JARS.flat_map do |jar|
+            %i[[]= delete].map do |selector|
+              EffectAttribution.new(
+                receiver: jar, method: selector, labels: COOKIE_WRITE, within: CONTROLLER, discharge: true,
+                why: "queues a Set-Cookie header on the response — state that outlives the request"
+              )
+            end
+          end
+        end
+
+        def flash_rows
+          ["self.flash", "self.flash.now"].flat_map do |jar|
+            %i[[]= alert= notice=].map do |selector|
+              EffectAttribution.new(
+                receiver: jar, method: selector, labels: FLASH_WRITE, within: CONTROLLER, discharge: true,
+                why: "writes the flash, which rides the session into the next request"
+              )
+            end
+          end
+        end
+
+        def entry_points
+          [
+            EffectEntryPoints.new(
+              name: "rails-controllers", globs: ["app/controllers/**/*.rb"],
+              why: "controller actions — the request entry points; nothing in the project calls them"
+            )
+          ]
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-actionpack/lib/rigor/plugin/actionpack.rb

@@ -3,6 +3,7 @@
 require "rigor/plugin"
 
 require_relative "actionpack/analyzer"
+require_relative "actionpack/effects"
 require_relative "actionpack/controller_discoverer"
 require_relative "actionpack/controller_index"
 
@@ -69,7 +70,14 @@ module Rigor
         consumes: [
           { plugin_id: "rails-routes", name: :helper_table, optional: true },
           { plugin_id: "activerecord", name: :model_index, optional: true }
-        ]
+        ],
+        # ADR-103 WD10 / WD14 (#387) — see {Effects} for what each row is and why.
+        effect_root: "rails",
+        effect_labels: %w[
+          rails.response.write rails.session.read rails.session.write rails.cookie.write rails.flash.write
+        ],
+        effect_attributions: Effects.attributions,
+        effect_entry_points: Effects.entry_points
       )
 
       # Phase 2 cached producer — the controller index built from `controller_search_paths`. `watch:`

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/effects.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+module Rigor
+  module Plugin
+    class Activejob < Rigor::Plugin::Base
+      # rigor-activejob's effect contract (ADR-103 WD4 / WD10; design note § 11.2 "Deferred execution";
+      # issue #387).
+      #
+      # ## Attribution follows the code, not the clock
+      #
+      # `perform_later` is the effect; `perform` is not. The job body runs in another process on another
+      # stack, so the caller's code does not contain it and there is **no edge** from `perform_later` to
+      # `perform` — {Rigor::Plugin::EffectEdge::TARGETS} has no spelling for one. `perform_now` is an
+      # ordinary edge, because it is an ordinary call.
+      #
+      # `set(wait: 1.hour)` returns a `ConfiguredJob` and does nothing, exactly like a Relation builder; the
+      # `.perform_later` on it is the origin, which is what `on_result:` expresses.
+      #
+      # ## The transport is a project fact
+      #
+      # Argument-blind, an enqueue is bare `io` — true and useless for policy. But a Rails app declares its
+      # adapter once, in `config.active_job.queue_adapter`, and reading it turns the row into something a
+      # reviewer can act on: under Solid Queue the enqueue is an `INSERT` into `solid_queue_jobs`, and a
+      # "no database on this path" envelope is right to object to it. Under Sidekiq it is a Redis round
+      # trip. Under `:async` it is a thread in this process and no transport at all; under `:inline` Rails
+      # runs the job on the caller's stack, which — and only which — makes `perform_later` a real edge.
+      #
+      # This is the configuration-level twin of the argument-dependent narrowing the catalogue does for
+      # `File.open`'s mode: the same discipline, one scope wider. An unread or per-environment adapter keeps
+      # the honest `io`.
+      module Effects
+        BASE = "ActiveJob::Base"
+
+        # Where a Rails app declares its adapter. Per-environment files are read too, because an app that
+        # sets the adapter only in `config/environments/production.rb` is common; agreement across every
+        # file that names one is what licenses the narrowing (see {.transport_for}).
+        CONFIG_PATHS = ["config/application.rb", "config/environments"].freeze
+
+        SETTING = /queue_adapter\s*=\s*[:"']([a-z_]+)["']?/
+
+        # What each adapter's enqueue actually touches. The absent adapters are the point: anything not
+        # listed keeps bare `io`, which is the truthful upper bound for a transport nobody named.
+        TRANSPORTS = {
+          "solid_queue" => ["io.db.write"], "delayed_job" => ["io.db.write"], "delayed" => ["io.db.write"],
+          "que" => ["io.db.write"], "good_job" => ["io.db.write"], "queue_classic" => ["io.db.write"],
+          "sidekiq" => ["io.net"], "resque" => ["io.net"], "sneakers" => ["io.net"],
+          "shoryuken" => ["io.net"], "backburner" => ["io.net"], "sucker_punch" => [],
+          "async" => [], "inline" => [], "test" => []
+        }.freeze
+
+        # The meaning half, which is adapter-independent and is what a policy actually names.
+        MEANING = ["rails.activejob.enqueue", "job.enqueue"].freeze
+
+        # `X.perform_later`, `X.perform_all_later`, `X.enqueue` — the class-side enqueues.
+        SINGLETON_ENQUEUES = %w[perform_later perform_all_later enqueue enqueue_at].freeze
+
+        # `job.enqueue`, and the enqueue on whatever `set(…)` returned.
+        RESULT_ENQUEUES = %w[perform_later enqueue enqueue_at].freeze
+
+        module_function
+
+        # @param adapter [String, nil] the adapter the project declares, or nil when it declares none
+        #   (or more than one, across environments)
+        def attributions(adapter)
+          labels = (TRANSPORTS[adapter] || ["io"]) + MEANING
+          why = transport_why(adapter)
+          SINGLETON_ENQUEUES.map do |selector|
+            EffectAttribution.new(receiver: BASE, method: selector, labels: labels, singleton: true,
+                                  discharge: true, why: why)
+          end +
+            RESULT_ENQUEUES.map do |selector|
+              EffectAttribution.new(
+                receiver: BASE, method: selector, labels: labels, on_result: true, discharge: true,
+                why: "#{why} Matched on the RESULT of a call to the job class, which is the shape " \
+                     "`WelcomeJob.set(wait: 1.hour).perform_later` takes: `set` is a builder and returns a " \
+                     "lazy ConfiguredJob, so the enqueue is one link further out."
+              )
+            end +
+            [EffectAttribution.new(receiver: BASE, method: :enqueue, labels: labels, discharge: true,
+                                   why: why)]
+        end
+
+        def transport_why(adapter)
+          if adapter.nil?
+            return "the queue adapter is unread or differs per environment, so the transport stays the " \
+                   "honest `io`; `rails.activejob.enqueue` is the meaning a policy names."
+          end
+
+          transport = TRANSPORTS[adapter]
+          if transport.nil?
+            return "`config.active_job.queue_adapter = :#{adapter}` is not an adapter this plugin has a " \
+                   "transport for, so the row keeps bare `io`."
+          end
+          if transport.empty?
+            return "`config.active_job.queue_adapter = :#{adapter}` runs the queue inside this process, so " \
+                   "the enqueue crosses no transport at all."
+          end
+
+          "`config.active_job.queue_adapter = :#{adapter}` makes the enqueue a #{transport.first} — the " \
+            "project's own configuration narrowing a transport that is otherwise unknowable."
+        end
+
+        # `perform_now` is always an edge. Under `:inline`, so is `perform_later`: Rails genuinely runs the
+        # job on the caller's stack there, and refusing the edge would understate a controller action that
+        # sends the whole email inline.
+        def edges(adapter)
+          list = [
+            EffectEdge.new(receiver: BASE, target: :perform_now,
+                           why: "`Job.perform_now(...)` runs `Job#perform` synchronously, in this process")
+          ]
+          return list unless adapter == "inline"
+
+          list << EffectEdge.new(
+            receiver: BASE, target: :perform_now, method: :perform_later,
+            why: "`config.active_job.queue_adapter = :inline` makes `perform_later` run `perform` on the " \
+                 "caller's stack; the edge is licensed by the project's own declaration and by nothing else"
+          )
+        end
+
+        # `reach: [rails-jobs]` — a job's `perform` is an entry point: nothing in the project calls it, and
+        # its footprint is what a reviewer asking "what does this job do" wants.
+        def entry_points
+          [
+            EffectEntryPoints.new(
+              name: "rails-jobs", globs: ["app/jobs/**/*.rb"],
+              why: "ActiveJob jobs — `perform` is invoked by the queue, never by project code"
+            )
+          ]
+        end
+
+        # Reads `config.active_job.queue_adapter` out of the project's configuration. Returns the adapter
+        # name when every file that names one agrees, and nil when none does or they disagree — a
+        # per-environment split has no single transport, and guessing one would be the wrong kind of
+        # precision.
+        def detect_adapter(io_boundary, root)
+          found = config_files(root).filter_map do |path|
+            io_boundary.read_file(path).force_encoding("UTF-8")[SETTING, 1]
+          rescue StandardError
+            nil
+          end.uniq
+          found.length == 1 ? found.first : nil
+        end
+
+        def config_files(root)
+          application = File.join(root, CONFIG_PATHS.first)
+          environments = Dir.glob(File.join(root, CONFIG_PATHS.last, "*.rb"))
+          ([application] + environments).select { |path| File.file?(path) }
+        rescue StandardError
+          []
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-activejob/lib/rigor/plugin/activejob/recurring_scan.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module Rigor
+  module Plugin
+    class Activejob < Rigor::Plugin::Base
+      # ADR-102 WD3 / #369 — which jobs does this project run on a schedule it names them in by STRING?
+      #
+      # `MyJob.perform_later(...)` writes the job's name as an ordinary constant, so the reachability scan
+      # already records that edge and a root would add nothing. Solid Queue's recurring tasks are the
+      # opposite case, and they are why this file exists: a recurring job is named only as
+      # `class: "SendReminderJob"` in `config/recurring.yml`, so a repository running it every three minutes
+      # may contain no `perform_later` for it anywhere. The constant scan sees nothing and `rigor unused`
+      # reports a production job as dead code — measured on a real Rails 8 application, where one miss
+      # cascaded into a second row because the only caller of a helper class was the job itself.
+      #
+      # Solid Queue is the default Active Job backend from Rails 8, so this is a mainstream layout rather
+      # than a niche one. This is also the ONLY root source this plugin has: #350 declined to publish the
+      # discovered job set, because "a file exists under `app/jobs`" is not evidence that anything enqueues
+      # it, and an over-claiming root source silently hides real dead code (ADR-102 § Consequences).
+      #
+      # **Two layouts, one key.** Rails 8 keys `recurring.yml` by environment at the top level
+      # (`production:` → task name → entry), unlike `sidekiq-cron`'s flat document. Both depths are read
+      # rather than guessed at, and reading both is safe because neither layout yields anything under the
+      # other's reading: an environment block's values are entry Hashes whose own `class:` is absent, and a
+      # flat entry's values are Strings rather than Hashes. Every environment is read — a job scheduled only
+      # in `staging:` is still live code, and picking `production:` would report it dead.
+      #
+      # **A `command:` entry supplies nothing.** Solid Queue also accepts inline Ruby
+      # (`command: "SomeModel.cleanup"`), which names no class the way `class:` does. Parsing a constant out
+      # of an arbitrary Ruby snippet would manufacture roots from a string, so `class:` is the only key read.
+      #
+      # Names are not trusted either: the caller intersects them with the jobs {JobDiscoverer} actually
+      # found, so a typo or an out-of-tree class costs coverage rather than manufacturing a root, and the
+      # report's `matched no declaration` counter stays meaningful.
+      #
+      # Fail-soft throughout, because this reads user-authored config Rigor does not own: an absent file, an
+      # unreadable one, a YAML syntax error, or a document that is not a Hash contributes nothing rather than
+      # raising. Never boots Rails and never loads Solid Queue.
+      class RecurringScan
+        # The key naming the job class. `command:` is deliberately not read; see the class comment.
+        CLASS_KEY = "class"
+
+        # Errno classes that mean "this path is not readable as a schedule" — swallowed so one bad path does
+        # not cost the roots the other paths supply.
+        IO_ERRORS = [Errno::ENOENT, Errno::EACCES, Errno::EISDIR].freeze
+
+        def initialize(io_boundary:, recurring_paths:)
+          @io_boundary = io_boundary
+          @recurring_paths = recurring_paths
+        end
+
+        # @return [Array<String>] the class names named by a `class:` key in a recurring-task entry, sorted
+        #   and unique. NOT yet intersected with the discovered jobs — the caller does that.
+        def job_names
+          names = Set.new
+          @recurring_paths.each do |path|
+            document = load_document(path)
+            next unless document.is_a?(Hash)
+
+            collect_tasks(document, names)
+            document.each_value { |block| collect_tasks(block, names) }
+          end
+          names.to_a.sort
+        end
+
+        private
+
+        def load_document(path)
+          absolute = File.expand_path(path.to_s)
+          return nil unless File.file?(absolute)
+
+          contents = read_safely(absolute)
+          contents && parse_safely(contents)
+        end
+
+        def read_safely(path)
+          @io_boundary.read_file(path)
+        rescue Plugin::AccessDeniedError, *IO_ERRORS
+          nil
+        end
+
+        # `safe_load` with no permitted classes beyond Symbol: a schedule file is data, and Rigor never loads
+        # the Rails environment or the Solid Queue runtime to read it. `aliases: true` because YAML anchors
+        # are ordinary style in a hand-maintained schedule that repeats a task across environments.
+        def parse_safely(contents)
+          YAML.safe_load(contents, aliases: true, permitted_classes: [Symbol])
+        rescue Psych::Exception
+          nil
+        end
+
+        # A task block maps an arbitrary task NAME to an entry Hash. Only the entry's own `class:` is read —
+        # no recursion into the value, so an `args:` payload that happens to carry a `class` key cannot
+        # enter.
+        def collect_tasks(block, names)
+          return unless block.is_a?(Hash)
+
+          block.each_value do |entry|
+            next unless entry.is_a?(Hash)
+
+            value = fetch_either(entry, CLASS_KEY)
+            names << value if value.is_a?(String) && !value.empty?
+          end
+        end
+
+        def fetch_either(hash, key)
+          hash.fetch(key) { hash[key.to_sym] }
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-activejob/lib/rigor/plugin/activejob.rb

@@ -5,6 +5,8 @@ require "rigor/plugin"
 require_relative "activejob/job_index"
 require_relative "activejob/job_discoverer"
 require_relative "activejob/analyzer"
+require_relative "activejob/effects"
+require_relative "activejob/recurring_scan"
 
 module Rigor
   module Plugin
@@ -22,6 +24,7 @@ module Rigor
     #         config:
     #           job_search_paths: ["app/jobs"]                  # default; optional
     #           job_base_classes: ["ApplicationJob", "ActiveJob::Base"]  # default; optional
+    #           recurring_paths: ["config/recurring.yml"]        # default; optional
     #
     # ## Limitations (v0.1.0)
     #
@@ -34,14 +37,47 @@ module Rigor
     class Activejob < Rigor::Plugin::Base
       manifest(
         id: "activejob",
-        version: "0.1.0",
+        # Bumped — publishes `:reachability_roots` for `rigor unused` (ADR-102 WD3): the jobs Solid Queue's
+        # recurring schedule runs by name, which no `perform_later` call site writes down.
+        version: "0.2.0",
         description: "Validates ActiveJob `Job.perform_later` argument arity.",
         config_schema: {
           "job_search_paths" => { kind: :array, default: ["app/jobs"] },
-          "job_base_classes" => { kind: :array, default: %w[ApplicationJob ActiveJob::Base] }
-        }
+          "job_base_classes" => { kind: :array, default: %w[ApplicationJob ActiveJob::Base] },
+          # `recurring_paths` — the schedule configuration {RecurringScan} reads for the reachability roots
+          # below. The default is Solid Queue's conventional location, the Active Job backend Rails ships by
+          # default from 8.0. A project that keeps its schedule elsewhere lists the file itself; these are
+          # file paths, not directories, because a schedule is a named document rather than a tree.
+          "recurring_paths" => { kind: :array, default: ["config/recurring.yml"] }
+        },
+        produces: [:reachability_roots],
+        # ADR-103 WD4 / WD10 (#387). The rows themselves are NOT here: they depend on
+        # `config.active_job.queue_adapter`, which is a project fact, so they are built in
+        # `#effect_attributions` below. `effect_root: "rails"` is granted because the engine bundles this
+        # plugin ({Rigor::Plugin::FirstParty}); a third-party plugin declaring it would open `activejob.*`.
+        effect_root: "rails",
+        effect_labels: ["rails.activejob.enqueue"],
+        effect_entry_points: Effects.entry_points
       )
 
+      # ADR-103 WD10 — the enqueue's transport, read off the project's own configuration. Overridden rather
+      # than declared on the manifest because the answer is per project; memoised because
+      # `Plugin::Registry#effect_contributions` is lazy and asks once per process, and only on a run with
+      # collection on — a `rigor check` with no `effects:` block never opens `config/application.rb` for this.
+      def effect_attributions
+        Effects.attributions(detected_queue_adapter)
+      end
+
+      def effect_edges
+        Effects.edges(detected_queue_adapter)
+      end
+
+      def detected_queue_adapter
+        return @detected_queue_adapter if defined?(@detected_queue_adapter)
+
+        @detected_queue_adapter = Effects.detect_adapter(io_boundary, Dir.pwd)
+      end
+
       # Cached: discovered job index. `watch:` (ADR-60 WD3) covers every `.rb` under `job_search_paths`
       # so the cache invalidates when a job is added, removed, or edited; the discoverer's in-block
       # `IoBoundary` reads are captured into the record-and-validate dependency descriptor after the
@@ -54,9 +90,38 @@ module Rigor
         ).discover
       end
 
+      # Cached separately from `:job_index` because the two invalidate on different files: editing a
+      # schedule changes which jobs are reached without touching `app/jobs` at all. The `watch:` roots the
+      # glob at the working directory so that CREATING a schedule file — not just editing one — is seen.
+      producer :recurring_jobs, watch: -> { [[".", *@recurring_paths]] } do |_params|
+        RecurringScan.new(
+          io_boundary: io_boundary,
+          recurring_paths: @recurring_paths
+        ).job_names
+      end
+
       def init(_services)
         @job_search_paths = Array(config.fetch("job_search_paths")).map(&:to_s)
         @job_base_classes = Array(config.fetch("job_base_classes")).map(&:to_s)
+        @recurring_paths = Array(config.fetch("recurring_paths")).map(&:to_s)
+      end
+
+      # ADR-102 WD3 — publishes the jobs Solid Queue's recurring schedule runs BY NAME, for `rigor unused`.
+      #
+      # The intersection is what keeps the contribution honest, exactly as in `rigor-sidekiq` and
+      # `rigor-pundit`. {RecurringScan} says which names the schedule WRITES; {JobIndex} says which jobs
+      # EXIST. A `class:` value matching no discovered job — a typo, a renamed class, a job living outside
+      # `job_search_paths` — is dropped rather than published, so the failure mode is a missing root (a
+      # candidate row a human can judge) instead of a spurious one (silence where dead code used to be).
+      def prepare(services)
+        index = producer_value(:job_index)
+        scheduled = producer_value(:recurring_jobs)
+        return if index.nil? || scheduled.nil?
+
+        roots = scheduled.select { |name| index.known?(name) }
+        return if roots.empty?
+
+        services.fact_store.publish(plugin_id: manifest.id, name: :reachability_roots, value: roots)
       end
 
       # File-level only: the load-error emission. Per-call arity validation runs over the engine-owned