rigortype 0.3.4 → 0.3.6

data/lib/rigor/plugin/effect_ancestry.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require_relative "effect_attribution"
+
+module Rigor
+  module Plugin
+    # One entry of a plugin's `effect_ancestry:` — an ancestry edge the plugin's own gem introduces and
+    # the project's source never writes down (ADR-103 WD17; [#465](https://github.com/rigortype/rigor/issues/465)).
+    #
+    # `Effects::PluginFacts` walks the project's own `class … <` and `include` lines and nothing else,
+    # deliberately: reading the RBS ancestor chain instead would make a row's reach a function of whether
+    # anyone happened to run `rbs prototype`. The cost is that a chain which leaves project source never
+    # comes back. `class UserMailer < Devise::Mailer` is the measured case — `Devise::Mailer <
+    # ActionMailer::Base` is a line in the devise gem, so `rigor-actionmailer`'s rows stop one step short
+    # of every mailer a Devise application writes, and the five `Auth::*Controller < Devise::*Controller`
+    # subclasses beside it are entry points.
+    #
+    # A plugin that models a gem knows that gem's own inheritance. Declaring it here keeps the rule that
+    # Rigor reads *declarations* rather than RBS: the declaration simply comes from the plugin instead of
+    # from project source.
+    #
+    # ## What a claim may say
+    #
+    # `parent:` need only be a **true ancestor**, not the immediate superclass. The sole use of the
+    # ancestry is to make a row reachable, and no plugin row is ever keyed on a project class, so
+    # skipping intermediate links loses nothing — while insisting on the immediate parent would force a
+    # claim that is sometimes false: `Devise::SessionsController`'s real parent is `DeviseController`,
+    # whose own parent is `Devise.parent_controller` and therefore configurable per project. A claim that
+    # skips links MUST say so in its `why:`.
+    #
+    # ## Who may make one
+    #
+    # Bundled plugins only ({Rigor::Plugin::FirstParty}), enforced in `PluginFacts`. An ancestry claim
+    # carries no labels of its own, so it looks harmless — but it makes *other* plugins' rows reachable,
+    # and a third-party plugin asserting `Foo < ActiveRecord::Base` would pull rigor-activerecord's
+    # first-party discharging rows onto `Foo`. The `effect_root:` demotion and the `discharge:` grant
+    # both answer their own version of that question the same way.
+    class EffectAncestry
+      attr_reader :child, :parent, :why
+
+      def initialize(child:, parent:, why:)
+        @child = validate_class_name!(child, "child")
+        @parent = validate_class_name!(parent, "parent")
+        @why = validate_why!(why)
+        freeze
+      end
+
+      def to_h
+        { "child" => @child, "parent" => @parent }
+      end
+
+      def ==(other)
+        other.is_a?(EffectAncestry) && to_h == other.to_h
+      end
+      alias eql? ==
+
+      def hash
+        to_h.hash
+      end
+
+      private
+
+      def validate_class_name!(value, role)
+        name = value.to_s
+        unless EffectAttribution::CLASS_NAME.match?(name)
+          raise ArgumentError, "effect ancestry #{role} must be a class name, got #{value.inspect}"
+        end
+
+        name.dup.freeze
+      end
+
+      def validate_why!(why)
+        value = why.to_s
+        raise ArgumentError, "effect ancestry #{@child} < #{@parent} needs a `why:` justification" if value.empty?
+
+        value.dup.freeze
+      end
+    end
+  end
+end

data/lib/rigor/plugin/manifest.rb

@@ -5,6 +5,7 @@ require_relative "protocol_contract"
 require_relative "additional_initializer"
 require_relative "effect_attribution"
 require_relative "effect_edge"
+require_relative "effect_ancestry"
 require_relative "effect_entry_points"
 require_relative "first_party"
 
@@ -46,7 +47,8 @@ module Rigor
                   :heredoc_templates, :nested_class_templates, :trait_registries,
                   :hkt_registrations, :hkt_definitions, :signature_paths, :protocol_contracts,
                   :source_rbs_synthesizer, :additional_initializers,
-                  :effect_root, :effect_labels, :effect_attributions, :effect_edges, :effect_entry_points
+                  :effect_root, :effect_labels, :effect_attributions, :effect_edges, :effect_entry_points,
+                  :effect_ancestry
 
       def initialize( # rubocop:disable Metrics/ParameterLists
         id:, version:,
@@ -57,7 +59,7 @@ module Rigor
         hkt_registrations: [], hkt_definitions: [], signature_paths: [], protocol_contracts: [],
         source_rbs_synthesizer: nil, additional_initializers: [],
         effect_root: nil, effect_labels: [], effect_attributions: [], effect_edges: [],
-        effect_entry_points: []
+        effect_entry_points: [], effect_ancestry: []
       )
         validate_id!(id)
         validate_version!(version)
@@ -76,11 +78,8 @@ module Rigor
         validate_protocol_contracts!(protocol_contracts)
         validate_source_rbs_synthesizer!(source_rbs_synthesizer)
         validate_additional_initializers!(additional_initializers)
-        validate_effect_root!(effect_root)
-        validate_effect_labels!(effect_labels)
-        validate_effect_attributions!(effect_attributions)
-        validate_effect_edges!(effect_edges)
-        validate_effect_entry_points!(effect_entry_points)
+        validate_effect_fields!(effect_root, effect_labels, effect_attributions, effect_edges,
+                                effect_entry_points, effect_ancestry)
 
         assign_fields(id, version, description, config_schema, produces, consumes, owns_receivers,
                       open_receivers, type_node_resolvers, block_as_methods, heredoc_templates, trait_registries,
@@ -88,7 +87,8 @@ module Rigor
                       source_rbs_synthesizer)
         assign_nested_class_templates(nested_class_templates)
         assign_additional_initializers(additional_initializers)
-        assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges, effect_entry_points)
+        assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges,
+                             effect_entry_points, effect_ancestry)
         freeze
       end
 
@@ -135,12 +135,26 @@ module Rigor
 
       # ADR-103 WD2 / WD6 / WD10 / WD14 — the effect contract's five fields, assigned together and outside
       # `assign_fields` (which already carries the maximum positional arity).
-      def assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges, effect_entry_points)
+      # The six `effect_*` fields validate together, so {#initialize} carries one call rather than six.
+      def validate_effect_fields!(effect_root, effect_labels, effect_attributions, effect_edges,
+                                  effect_entry_points, effect_ancestry)
+        validate_effect_root!(effect_root)
+        validate_effect_labels!(effect_labels)
+        validate_effect_attributions!(effect_attributions)
+        validate_effect_edges!(effect_edges)
+        validate_effect_entry_points!(effect_entry_points)
+        validate_effect_ancestry!(effect_ancestry)
+      end
+      private :validate_effect_fields!
+
+      def assign_effect_fields(effect_root, effect_labels, effect_attributions, effect_edges,
+                               effect_entry_points, effect_ancestry)
         @effect_root = effect_root.nil? ? nil : effect_root.to_s.dup.freeze
         @effect_labels = effect_labels.map { |label| label.to_s.dup.freeze }.uniq.sort.freeze
         @effect_attributions = effect_attributions.dup.freeze
         @effect_edges = effect_edges.dup.freeze
         @effect_entry_points = effect_entry_points.dup.freeze
+        @effect_ancestry = effect_ancestry.dup.freeze
       end
       private :assign_effect_fields
       # rubocop:enable Metrics/ParameterLists, Metrics/AbcSize
@@ -194,7 +208,8 @@ module Rigor
           "effect_labels" => effect_labels,
           "effect_attributions" => effect_attributions.map(&:to_h),
           "effect_edges" => effect_edges.map(&:to_h),
-          "effect_entry_points" => effect_entry_points.map(&:to_h)
+          "effect_entry_points" => effect_entry_points.map(&:to_h),
+          "effect_ancestry" => effect_ancestry.map(&:to_h)
         }
       end
 
@@ -506,6 +521,15 @@ module Rigor
         end
       end
 
+      # ADR-103 WD17 (#465) — `effect_ancestry:` states an ancestry edge the plugin's own gem introduces
+      # and the project's source never writes. Each entry MUST be a {Rigor::Plugin::EffectAncestry}; only
+      # a bundled plugin's survives, which `Effects::PluginFacts` enforces.
+      def validate_effect_ancestry!(entries)
+        validate_array_of!("effect_ancestry", entries, "Rigor::Plugin::EffectAncestry instances") do |e|
+          e.is_a?(EffectAncestry)
+        end
+      end
+
       # ADR-103 WD14 — `effect_entry_points:` names the `effects.snapshot.reach:` presets this plugin
       # supplies. Each entry MUST be a {Rigor::Plugin::EffectEntryPoints}.
       def validate_effect_entry_points!(entries)

data/lib/rigor/plugin/registry.rb

@@ -262,9 +262,15 @@ module Rigor
       # plugin may open, and `discharge_allowed`, whether its attributions may discharge — so nothing
       # downstream has to re-derive who is first-party.
       Contribution = Data.define(:id, :owner, :requested_root, :discharge_allowed, :labels, :attributions,
-                                 :edges, :entry_points) do
+                                 :edges, :entry_points, :ancestry) do
+        # `ancestry:` defaults so a caller written before #465 — and every spec that constructs one by
+        # hand — keeps working; a plugin that declares none contributes none.
+        def initialize(ancestry: [], **rest)
+          super
+        end
+
         def empty?
-          labels.empty? && attributions.empty? && edges.empty? && entry_points.empty?
+          labels.empty? && attributions.empty? && edges.empty? && entry_points.empty? && ancestry.empty?
         end
       end
 
@@ -422,7 +428,8 @@ module Rigor
           id: manifest.id, owner: manifest.effect_owner, requested_root: manifest.effect_root,
           discharge_allowed: manifest.effect_discharge_allowed?,
           labels: plugin.effect_labels, attributions: plugin.effect_attributions,
-          edges: plugin.effect_edges, entry_points: plugin.effect_entry_points
+          edges: plugin.effect_edges, entry_points: plugin.effect_entry_points,
+          ancestry: plugin.effect_ancestry
         )
         contribution.empty? ? nil : contribution
       rescue StandardError

data/lib/rigor/rbs_extended/envelope_scanner.rb

@@ -2,6 +2,7 @@
 
 require "rbs"
 
+require_relative "../effects/signature_sources"
 require_relative "../rbs_extended"
 require_relative "reporter"
 
@@ -50,11 +51,19 @@ module Rigor
       #   `.rbs` files, plus the virtual entries rbs-inline and plugin `source_rbs` synthesis contribute.
       # @param registry [Rigor::Effects::Registry] the vocabulary an unknown label is judged against.
       # @return [Result]
+      #
+      # The `ANNOTATION_HINT` routing test runs here, before any parse: a source with no honoured
+      # payload can contribute neither an envelope nor an unresolved report, so a signature tree with
+      # no effect annotation is answered by one regex per file — which is what that hint's own
+      # documentation promises, and what every warm envelope-lane run was paying a full
+      # `RBS::Parser.parse_signature` per file for.
       def scan(sources:, registry:)
         reporter = Reporter.new
         methods = {}
         classes = {}
         sources.each do |name, content|
+          next unless Effects::SignatureSources::ANNOTATION_HINT.match?(content)
+
           declarations(name, content).each do |decl|
             walk(decl, [], methods, classes, registry, reporter)
           end

data/lib/rigor/rbs_extended.rb

@@ -4,6 +4,7 @@ require_relative "type"
 require_relative "builtins/imported_refinements"
 require_relative "flow_contribution"
 require_relative "effects/envelope"
+require_relative "effects/inline_anchor"
 require_relative "effects/label"
 require_relative "effects/label_set"
 require_relative "effects/signature_sources"
@@ -769,6 +770,12 @@ module Rigor
 
     # `path:line` for the annotation, project-relative when it sits under the working directory, so a
     # diagnostic message names `sig/foo.rbs:12` rather than an absolute path.
+    #
+    # A synthesized buffer is re-anchored here rather than at any of the surfaces that render it
+    # ({Effects::InlineAnchor}; #432). The buffer's own line numbers describe a document the author
+    # never saw, so an envelope carrying one is wrong for every consumer at once — the diagnostic, the
+    # `effect.unknown-label` position, `rigor explain`, the JSON formatter, LSP hover. Correcting it
+    # where the value is *built* is what makes them agree without each learning the mapping.
     def render_annotation_location(annotation)
       location = annotation_location(annotation)
       return nil if location.nil?
@@ -777,12 +784,25 @@ module Rigor
       name = buffer.respond_to?(:name) ? buffer.name.to_s : nil
       return nil if name.nil? || name.empty?
 
-      line = location.respond_to?(:start_line) ? location.start_line : 1
-      "#{relative_annotation_path(name)}:#{line}"
+      path = relative_annotation_path(name)
+      "#{path}:#{annotation_line(annotation, location, buffer, path)}"
     rescue StandardError
       nil
     end
 
+    # The line a reader can open. For a real `.rbs` that is the parser's own answer; for the
+    # `virtual:rbs-inline:…rb` buffer the writer produced, the annotation is found again in the Ruby
+    # source by its own spelling.
+    def annotation_line(annotation, location, buffer, path)
+      line = location.respond_to?(:start_line) ? location.start_line : 1
+      content = buffer.respond_to?(:content) ? buffer.content : nil
+      return line if content.nil?
+
+      Effects::InlineAnchor.ruby_line(
+        path: path, buffer: content, buffer_line: line, spelling: "%a{#{annotation.string}}"
+      )
+    end
+
     # The buffer-name → readable-path rule lives with the walk that produces the buffers
     # ({Effects::SignatureSources}), so a `virtual:` name is stripped identically wherever it surfaces.
     def relative_annotation_path(name)

data/lib/rigor/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rigor
-  VERSION = "0.3.4"
+  VERSION = "0.3.6"
 end

data/plugins/rigor-activesupport-core-ext/sig/active_support/core_ext.rbs

@@ -598,8 +598,23 @@ class Date
   %a{pure}
   def advance: (untyped options) -> Date
   def all_day: () -> Range[Time]
-  %a{pure}
-  def to_time: (?Symbol form) -> Time
+  # NOTE: `Date#to_time` is an OVERLOAD CONTINUATION (`| ...`), not a plain
+  # declaration — stdlib `date` already types `to_time: () -> Time`, and a
+  # second full declaration of the same method from a second signature source
+  # makes `RBS::DefinitionBuilder` raise `DuplicatedMethodDefinitionError`,
+  # which collapses `Date` AND `DateTime` to `Dynamic[top]` for every project
+  # that activates this plugin (#437 — the same failure the `DateTime#to_time`
+  # note below records). The row cannot simply be DROPPED the way
+  # `DateTime#to_time` was: ActiveSupport genuinely widens the arity, and
+  # without the row `date.to_time(:utc)` — correct Rails code — would draw an
+  # arity diagnostic. `| ...` appends this overload ahead of the stdlib one, so
+  # both arities resolve and the `%a{pure}` envelope stays attached to the
+  # ActiveSupport overload (which is the one a no-argument call selects).
+  # `| ...` requires the base declaration to exist, which `Environment.for_project`
+  # guarantees: it merges `DEFAULT_LIBRARIES` — including `date` — into every
+  # environment that loads a plugin's `signature_paths`.
+  %a{pure}
+  def to_time: (?Symbol form) -> Time | ...
 end
 
 # ---------------------------------------------------------------

data/plugins/rigor-devise/lib/rigor/plugin/devise.rb

@@ -82,6 +82,33 @@ module Rigor
             },
             always_included: ["Devise::Models::Authenticatable"]
           )
+        ],
+        # ADR-103 WD17 (#465) — the ancestry Devise introduces and a project's own source never writes.
+        #
+        # `class UserMailer < Devise::Mailer` and `class Auth::SessionsController <
+        # Devise::SessionsController` are what a Devise application looks like, and the walk that reaches
+        # a plugin row climbs the project's own `class … <` lines only — so it stopped at the gem class
+        # and `rigor-actionmailer`'s and `rigor-actionpack`'s rows never arrived. Measured on Mastodon:
+        # six classes, five of them controllers, which are entry points.
+        #
+        # Every `parent:` below is a **true ancestor and not the immediate one**, deliberately. Devise's
+        # controllers descend through `DeviseController`, whose own parent is `Devise.parent_controller`
+        # — configurable per project, defaulting to the application's own `ApplicationController`. Naming
+        # the intermediate links would state something a project can make false; naming a true ancestor
+        # loses nothing, because no plugin row is ever keyed on a project class.
+        effect_ancestry: [
+          Rigor::Plugin::EffectAncestry.new(
+            child: "Devise::Mailer", parent: "ActionMailer::Base",
+            why: "Devise::Mailer is an ActionMailer; a true ancestor, skipping Devise's own intermediates"
+          ),
+          *%w[SessionsController RegistrationsController PasswordsController ConfirmationsController
+              UnlocksController OmniauthCallbacksController].map do |controller|
+            Rigor::Plugin::EffectAncestry.new(
+              child: "Devise::#{controller}", parent: "ActionController::Base",
+              why: "a Devise controller is an ActionController; a true ancestor, skipping DeviseController " \
+                   "and `Devise.parent_controller`, which a project may configure"
+            )
+          end
         ]
       )
     end

data/plugins/rigor-rbs-inline/lib/rigor/plugin/rbs_inline.rb

@@ -50,6 +50,19 @@ module Rigor
         # space-free spelling is affected; `# :nodoc:` never reaches upstream's annotation grammar.
         RDOC_DIRECTIVE_COMMENT = /\A#:[a-z_][\w-]*:/
 
+        # An `%a{…}` the author wrote above a `class` / `module`, as upstream's writer echoes it: an ordinary
+        # comment, because the writer emits no annotation on a declaration
+        # ([#452](https://github.com/rigortype/rigor/issues/452)).
+        ECHOED_ANNOTATION = /\A\s*#\s*@rbs\s+(%a\{[^}]*\})\s*\z/
+
+        # The declaration the pending annotations belong to. `class`/`module` and the whitespace after the
+        # keyword, so `class_eval` is not one and the indentation to re-emit at is captured.
+        DECLARATION_LINE = /\A(\s*)(?:class|module)\s/
+
+        COMMENT_LINE = /\A\s*#/
+
+        private_constant :ECHOED_ANNOTATION, :DECLARATION_LINE, :COMMENT_LINE
+
         # @param require_magic_comment [Boolean] when `false` (the default since ADR-93 WD1), the magic
         #   comment is not required and the file is processed only if it actually carries an annotation — see
         #   {#annotated?}. When `true` (the old ADR-32 WD2 gate), only files opening with
@@ -82,7 +95,7 @@ module Rigor
           return nil if parsed.nil?
 
           uses, decls, rbs_decls = parsed
-          rendered = ::RBS::Inline::Writer.write(uses, decls, rbs_decls)
+          rendered = reattach_declaration_annotations(::RBS::Inline::Writer.write(uses, decls, rbs_decls))
           return nil if rendered.nil? || rendered.strip.empty?
 
           notices = unhonoured_annotations(result)
@@ -96,6 +109,48 @@ module Rigor
 
         private
 
+        # Re-attaches a class- or module-level `%a{…}` that upstream's writer dropped (#452).
+        #
+        # `RBS::Inline::Writer` emits a member's annotations as real annotation lines and a *declaration's*
+        # as nothing at all — it echoes the author's comment block above `class Foo` and stops there. So the
+        # cheapest bound in the feature, one line above a class, reached the envelope reader as a comment:
+        # no bound, no diagnostic, and a clean run that had checked nothing. The `.rbs` lane, writing the
+        # same `%a{pure}` above the same `class`, worked. Both lanes now answer the same.
+        #
+        # The rewrite reads only what the writer itself emitted, in one pass, and is deliberately literal:
+        # an annotation the author spelled in a comment block that the writer echoed is re-emitted, at the
+        # declaration's own indentation, on the line the RBS grammar wants it on. Three properties make that
+        # safe rather than clever:
+        #
+        # - a comment block is echoed **only when its member is emitted**, so a detached annotation (one a
+        #   blank line separates from the declaration, which upstream drops) is never echoed and so never
+        #   re-attached — the two lanes agree about that too;
+        # - any non-comment line clears the pending set, so a member's own annotation — which the writer
+        #   *does* emit, on the line between the echo and the `def` — ends the run before a declaration can
+        #   claim it, and no annotation is ever attached twice;
+        # - the same property makes this forward-compatible: if upstream some day emits the declaration
+        #   annotation itself, that line clears the pending set and this contributes nothing.
+        def reattach_declaration_annotations(rendered)
+          return rendered if rendered.nil? || !rendered.include?("%a{")
+
+          pending = []
+          rendered.lines.flat_map do |line|
+            if (annotation = ECHOED_ANNOTATION.match(line))
+              pending << annotation[1]
+              line
+            elsif COMMENT_LINE.match?(line)
+              line
+            elsif (declaration = DECLARATION_LINE.match(line)) && !pending.empty?
+              emitted = pending.map { |spelling| "#{declaration[1]}#{spelling}\n" } << line
+              pending = []
+              emitted
+            else
+              pending = []
+              line
+            end
+          end.join
+        end
+
         # True when the file carries at least one rbs-inline annotation. Gates the magic-comment-free mode,
         # and is the difference between "honour annotations wherever they are" and "fabricate signatures for
         # code nobody annotated" — upstream's opt-out mode does the latter, emitting a full

data/plugins/rigor-sidekiq/lib/rigor/plugin/sidekiq/effects.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "rigor/plugin"
+
+module Rigor
+  module Plugin
+    class Sidekiq < Rigor::Plugin::Base
+      # rigor-sidekiq's effect contract (ADR-103 WD4 / WD10; [#456](https://github.com/rigortype/rigor/issues/456)).
+      #
+      # `job.enqueue` shipped in the vocabulary with nothing producing it. Across two Rails applications
+      # the corpus census found zero instances of it, while Mastodon alone writes 219 `perform_async`-shaped
+      # call sites with this plugin loaded — so the label a policy would actually name ("nothing on this
+      # path may enqueue work") could not be written against anything.
+      #
+      # ## Why the rows key on a module
+      #
+      # A Sidekiq worker has no base class: it is `class TriggerWebhookWorker; include Sidekiq::Job`. Every
+      # other first-party plugin's rows key on a base class and reach a project subclass through the
+      # project's own `class … <` lines, which is a walk that cannot see an `include` — so until #456 taught
+      # `Effects::PluginFacts#ancestry` to walk included modules beside the superclass, no spelling of these
+      # rows could have matched. The marker modules are the plugin's existing `worker_marker_modules:`
+      # config, so a project that includes its own concern instead names it once and gets both the arity
+      # check and these rows.
+      #
+      # ## What is deliberately not here
+      #
+      # `perform_inline` / `perform_sync` run the job on the caller's stack. They are not an enqueue and
+      # must not carry `job.enqueue`; the honest reading is an edge into the worker's own `#perform`, which
+      # {Rigor::Plugin::EffectEdge::TARGETS} spells only for the ActiveJob shape today. A row claiming the
+      # enqueue for them would be worse than the silence.
+      module Effects
+        # Redis is the transport, and unlike ActiveJob's adapter there is nothing to read: a project that
+        # loads Sidekiq has chosen it. `io.net` rather than `io` because the round trip is a socket in every
+        # deployment worth naming — a unix socket is still `io.net`'s subsystem, not the filesystem's.
+        TRANSPORT = ["io.net"].freeze
+
+        # The meaning half, and the reason this file exists: what a policy names.
+        MEANING = ["job.enqueue"].freeze
+
+        LABELS = (TRANSPORT + MEANING).freeze
+
+        # The class-side enqueues. `perform_bulk` takes an array of argument arrays and enqueues each.
+        SINGLETON_ENQUEUES = %w[perform_async perform_in perform_at perform_bulk].freeze
+
+        # `Worker.set(queue: "low").perform_async(…)` — `set` returns a lazy `Setter` that has enqueued
+        # nothing, so the enqueue is one link further out, keyed on the class that produced the Setter.
+        RESULT_ENQUEUES = %w[perform_async perform_in perform_at perform_bulk].freeze
+
+        WHY = "Sidekiq's enqueue is a Redis round trip; `job.enqueue` is the meaning a policy names. " \
+              "The row is keyed on the marker module because a Sidekiq worker includes rather than " \
+              "inherits."
+
+        module_function
+
+        # @param marker_modules [Array<String>] the modules a worker includes — the plugin's own
+        #   `worker_marker_modules:` config, so one project setting drives the arity check and these rows.
+        def attributions(marker_modules)
+          marker_modules.flat_map do |marker|
+            SINGLETON_ENQUEUES.map do |selector|
+              EffectAttribution.new(receiver: marker, method: selector, labels: LABELS, singleton: true,
+                                    discharge: true, why: WHY)
+            end +
+              RESULT_ENQUEUES.map do |selector|
+                EffectAttribution.new(
+                  receiver: marker, method: selector, labels: LABELS, on_result: true, discharge: true,
+                  why: "#{WHY} Matched on the RESULT of a call to the worker class, which is the shape " \
+                       "`Worker.set(queue: \"low\").perform_async(…)` takes."
+                )
+              end
+          end
+        end
+      end
+    end
+  end
+end

data/plugins/rigor-sidekiq/lib/rigor/plugin/sidekiq.rb

@@ -6,6 +6,7 @@ require_relative "sidekiq/worker_index"
 require_relative "sidekiq/worker_discoverer"
 require_relative "sidekiq/schedule_scan"
 require_relative "sidekiq/analyzer"
+require_relative "sidekiq/effects"
 
 module Rigor
   module Plugin
@@ -62,9 +63,20 @@ module Rigor
           # these are file paths, not directories, because a schedule is a named document rather than a tree.
           "schedule_paths" => { kind: :array, default: ["config/schedule.yml", "config/sidekiq.yml"] }
         },
-        produces: [:reachability_roots]
+        produces: [:reachability_roots],
+        # ADR-103 WD4 / WD10 (#456). The rows themselves are NOT here: they key on the project's own
+        # `worker_marker_modules:` setting, so they are built in `#effect_attributions` below.
+        effect_labels: []
       )
 
+      # ADR-103 WD10 — the enqueue rows, keyed on whichever modules this project's workers include.
+      # Overridden rather than declared on the manifest because the marker set is configuration;
+      # `Plugin::Registry#effect_contributions` is lazy and asks once per process, and only on a run with
+      # collection on.
+      def effect_attributions
+        Effects.attributions(@worker_marker_modules || Array(config.fetch("worker_marker_modules")).map(&:to_s))
+      end
+
       producer :worker_index, watch: -> { [[@worker_search_paths, "**/*.rb"]] } do |_params|
         WorkerDiscoverer.new(
           io_boundary: io_boundary,

data/skills/rigor-ci-setup/SKILL.md

@@ -168,9 +168,9 @@ The exact recipe (the `BUNDLE_GEMFILE` wiring, the Dependabot entry) is in
   `rigor docs ci` (ready files: `rigor docs --list manual | grep
   ci-templates`). Web fallback, before Rigor is installed:
   <https://github.com/rigortype/rigor/blob/master/docs/manual/11-ci.md>.
-- [ADR-51](https://github.com/rigortype/rigor/blob/master/docs/adr/51-ci-diagnostic-output-formats.md)
+- [ADR-51](../../docs/adr/51-ci-diagnostic-output-formats.md)
   — the output-format surface (the severity / identifier contract).
-- [ADR-27](https://github.com/rigortype/rigor/blob/master/docs/adr/27-tool-distribution-model.md)
+- [ADR-27](../../docs/adr/27-tool-distribution-model.md)
   — why Rigor installs standalone and runs in its own job.
 - [reviewdog](https://github.com/reviewdog/reviewdog) /
   [action-setup](https://github.com/reviewdog/action-setup).

data/skills/rigor-editor-setup/SKILL.md

@@ -24,7 +24,7 @@ rigor docs editor-integration
 ```
 
 (Web fallback, only before Rigor is installed:
-**[Rigor LSP — Editor Integration](https://github.com/rigortype/rigor/blob/master/docs/manual/09-editor-integration.md)**.)
+**[Rigor LSP — Editor Integration](../../docs/manual/09-editor-integration.md)**.)
 This skill is the *workflow* around it (identify the editor → apply the
 manual's snippet → verify), so it does not duplicate (and cannot
 stale-out) the config details.
@@ -62,7 +62,7 @@ Every editor snippet simply launches **`rigor lsp`** (stdio) and needs
 **`rigor` on the editor's `PATH`** — the same executable `rigor check`
 uses. For GUI editors that do not inherit your shell, the `mise` shim
 path is the most reliable channel (see `rigor docs install`, or
-[Installing Rigor](https://github.com/rigortype/rigor/blob/master/docs/install.md)
+[Installing Rigor](../../docs/install.md)
 on the web). Do **not** add `rigortype` to the project's `Gemfile` — it
 is a tool, not a library.
 

data/skills/rigor-mcp-setup/SKILL.md

@@ -26,7 +26,7 @@ rigor docs mcp-server
 ```
 
 (Web fallback, only before Rigor is installed:
-**[Rigor MCP Server — AI Agent Integration](https://github.com/rigortype/rigor/blob/master/docs/manual/10-mcp-server.md)**.)
+**[Rigor MCP Server — AI Agent Integration](../../docs/manual/10-mcp-server.md)**.)
 This skill is the *workflow* around it (identify the client → apply the
 manual's snippet → verify the handshake), so it does not duplicate (and
 cannot stale-out) the config details.
@@ -70,7 +70,7 @@ Every client config simply launches **`rigor mcp`** (stdio) and needs
 **`rigor` on the agent's `PATH`** — the same executable `rigor check`
 uses. For agents that do not inherit your shell, the `mise` shim path is
 the most reliable channel (see `rigor docs install`, or
-[Installing Rigor](https://github.com/rigortype/rigor/blob/master/docs/install.md)
+[Installing Rigor](../../docs/install.md)
 on the web). Do **not** add `rigortype` to the project's `Gemfile` — it
 is a tool, not a library.
 

data/skills/rigor-monkeypatch-resolve/SKILL.md

@@ -14,7 +14,7 @@ When a project adds methods to existing classes in its own files — the
 classic `lib/core_ext/*.rb` `class String; def squish; …; end` pattern —
 Rigor does not see them unless told to, so every call to the added method
 fires `call.undefined-method` (or `call.unresolved-toplevel` for a
-top-level helper). `pre_eval:` ([ADR-17](https://github.com/rigortype/rigor/blob/master/docs/adr/17-monkey-patch-pre-evaluation.md))
+top-level helper). `pre_eval:` ([ADR-17](../../docs/adr/17-monkey-patch-pre-evaluation.md))
 fixes this: it pre-evaluates the listed project files and registers every
 method they define with a **literal** `def` / `def self.`.
 

data/skills/rigor-plugin-review/SKILL.md

@@ -80,14 +80,14 @@ rigor plugin path  rigor-<id>     # its directory, to browse
 The **authoritative** authoring surface — the one this review scores
 against — is the internal spec, not this file:
 
-- [`docs/internal-spec/plugin.md`](https://github.com/rigortype/rigor/blob/master/docs/internal-spec/plugin.md)
+- [`docs/internal-spec/plugin.md`](../../docs/internal-spec/plugin.md)
   — manifest, `node_rule` / `node_file_context`, `dynamic_return` /
   `narrowing_facts`, the `#diagnostic` / `#diagnostics_for` / `.suggest`
   / `#read_fact` author helpers, `config_schema` `{kind:, default:}`.
-- [`docs/internal-spec/plugin-cache-producers.md`](https://github.com/rigortype/rigor/blob/master/docs/internal-spec/plugin-cache-producers.md)
+- [`docs/internal-spec/plugin-cache-producers.md`](../../docs/internal-spec/plugin-cache-producers.md)
   — `producer` / `#cache_for` / `#producer_value` / `#producer_error`,
   ADR-60 WD3 record-and-validate.
-- [`docs/internal-spec/plugin-trust.md`](https://github.com/rigortype/rigor/blob/master/docs/internal-spec/plugin-trust.md)
+- [`docs/internal-spec/plugin-trust.md`](../../docs/internal-spec/plugin-trust.md)
   — `TrustPolicy` / `IoBoundary`.
 
 When the checklist below and the spec disagree, **the spec binds** —