rigortype 0.3.8 → 0.3.9

data/plugins/rigor-activerecord/sig/active_record/framework.rbs

@@ -0,0 +1,123 @@
+# Active Record's framework namespaces — issue #534 item 7.
+#
+# The 2026-09-01 corpus opacity sweep counted `ActiveRecord::RecordNotFound` 115 times on
+# mastodon, modal in `rescue` clauses, and `ActiveModel` 165 / `Arel` 35 — every one of them
+# resolving to `untyped` because nothing in the bundle named the constant. This file names them,
+# and nothing more.
+#
+# ## The admission rule: a namespace or a rescued error, never a base class
+#
+# Declaring a constant makes it RBS-KNOWN, and a known class with an incomplete signature turns
+# every member the signature omits into a false `call.undefined-method`. That risk is not
+# uniform, so this file admits exactly two shapes:
+#
+# - **Bare namespace modules.** Nobody dispatches on a module used only as a constant path
+#   (`ActiveModel::Type::Boolean`, `Arel::Nodes`), so an empty declaration asserts nothing.
+# - **Exception classes**, which are dispatched on — as the `=> e` of a rescue — but whose whole
+#   inherited surface is `StandardError`'s, which Rigor's core RBS already carries. Each is listed
+#   in the manifest's `open_receivers:` (ADR-26) as well, so the framework-specific readers this
+#   file does not enumerate (`RecordInvalid#record`, `StatementInvalid#cause`, …) stay lenient.
+#
+# What is deliberately NOT here is every class a project INHERITS from. `ActiveRecord::Base` is
+# the case that matters: declaring it empty would close every model in the project, and turn
+# `Account.where(...)`, `record.save!` and the whole generated column surface into
+# `call.undefined-method` on working Rails code. The plugin types models through its model index
+# instead, and the namespace stays open for it. The same argument keeps `ActiveModel::Model` and
+# the other mixin modules bare rather than populated.
+#
+# The exception hierarchy is transcribed from Rails v8.0.2 `activerecord/lib/active_record/errors.rb`;
+# a class whose superclass could not be stated with certainty was left out rather than guessed,
+# because a wrong superclass is a wrong `rescue` reachability answer.
+
+module ActiveRecord
+  class ActiveRecordError < StandardError
+  end
+
+  class RecordNotFound < ActiveRecordError
+  end
+
+  class RecordInvalid < ActiveRecordError
+  end
+
+  class RecordNotSaved < ActiveRecordError
+  end
+
+  class RecordNotDestroyed < ActiveRecordError
+  end
+
+  class ReadOnlyRecord < ActiveRecordError
+  end
+
+  class Rollback < ActiveRecordError
+  end
+
+  class StaleObjectError < ActiveRecordError
+  end
+
+  class ConnectionNotEstablished < ActiveRecordError
+  end
+
+  class StatementInvalid < ActiveRecordError
+  end
+
+  class WrappedDatabaseException < StatementInvalid
+  end
+
+  class RecordNotUnique < WrappedDatabaseException
+  end
+end
+
+# Active Model ships as its own gem, but `activerecord` depends on it unconditionally, so a project
+# that enables this plugin always has it. There is no `rigor-activemodel`, and inventing one to hold
+# eleven empty modules would be a plugin whose whole content is this file.
+module ActiveModel
+  module Model
+  end
+
+  module API
+  end
+
+  module Validations
+  end
+
+  module Serialization
+  end
+
+  module Conversion
+  end
+
+  module Naming
+  end
+
+  module Attributes
+  end
+
+  module Dirty
+  end
+
+  module SecurePassword
+  end
+
+  module Callbacks
+  end
+
+  module Type
+  end
+
+  class ValidationError < StandardError
+  end
+end
+
+# Arel ships INSIDE the activerecord gem, so this plugin is its owner by the "the row lives in the
+# plugin that owns the gem" rule. `Arel.sql` is the one member the corpus calls; the signature is
+# written to accept anything because its extra binds are positional-or-keyword and an arity claim
+# here would be a false `call.wrong-arity` on a shape this file has no reason to police.
+module Arel
+  module Nodes
+  end
+
+  module Predications
+  end
+
+  def self.sql: (untyped, *untyped, **untyped) -> untyped
+end

data/plugins/rigor-activestorage/lib/rigor/plugin/activestorage.rb

@@ -37,6 +37,7 @@ module Rigor
     class Activestorage < Rigor::Plugin::Base
       manifest(
         id: "activestorage",
+        target_gems: ["activestorage"],
         # Bumped 2026-09-02 (#621) — attachment owners are keyed by their de-rooted name and a reopened
         # class's attachments are UNIONed rather than clobbered, so a cached 0.1.0 index can be missing the
         # attachments the merge restores.

data/plugins/rigor-activesupport-core-ext/lib/rigor/plugin/activesupport_core_ext.rb

@@ -42,9 +42,13 @@ module Rigor
     class ActivesupportCoreExt < Rigor::Plugin::Base
       manifest(
         id: "activesupport-core-ext",
+        target_gems: ["activesupport"],
+        # Bumped 2026-09-10 (#534 item 7) — `ActiveSupport::Concern` is declared, so `extend
+        # ActiveSupport::Concern` resolves instead of reading as an unresolved constant.
+        #
         # Bumped 2026-09-02 (#632) — `ActiveSupport::Duration`'s reader surface (`ago`/`to_i`/`iso8601`/…)
         # is now declared, open_receivers-protected; see the class comment above.
-        version: "0.4.0",
+        version: "0.5.0",
         description: "RBS bundle for the most-frequently-flagged ActiveSupport core_ext extensions, " \
                      "plus the `ActiveSupport::Duration` type of the numeric time multipliers and its " \
                      "reader surface.",
@@ -55,7 +59,10 @@ module Rigor
         # `call.undefined-method` fire against it. Distinct from the RECEIVER-side FP the multiplier
         # `dynamic_return` gate guards (`Time#day` vs `Duration#day`, in the class comment above) — this is
         # the class's OWN unenumerable member set.
-        open_receivers: ["ActiveSupport::Duration"],
+        # `ActiveSupport::Concern` (#534 item 7) is here for the same reason at a different scale: the
+        # declaration names `included` / `prepended` / `class_methods` so `extend ActiveSupport::Concern`
+        # resolves, and everything else the module really responds to must stay lenient.
+        open_receivers: ["ActiveSupport::Duration", "ActiveSupport::Concern"],
         # ADR-103 WD10 (#387) — the IMPURE half of ActiveSupport: the clock, the notification bus and
         # `CurrentAttributes`. The `%a{pure}` sweep over the predicate surface is issue #388 and lands in
         # `sig/`, not here. See {Effects}.

data/plugins/rigor-activesupport-core-ext/sig/active_support/core_ext.rbs

@@ -163,6 +163,34 @@ class Object
   # exception to the try-shaped-dispatch rule above (design note § 11.2).
   %a{pure}
   def in?: (untyped) -> bool
+
+  # Issue #673 — `core_ext/object/to_query`, `core_ext/object/duplicable` and
+  # `core_ext/object/instance_variables` all hang off `Object`, so every
+  # RBS-known receiver reaches them; declaring them only on `Hash` (as
+  # `to_param` / `to_query` were) or only on `NilClass` (as `duplicable?` /
+  # `instance_values` were) left `"x".to_param`, `1.duplicable?` and friends a
+  # `call.undefined-method` on ordinary Rails code.
+  #
+  # `to_param` is `to_s`; `to_query(key)` interpolates two `CGI.escape` results.
+  # `key` is `untyped` because the body only calls `to_param` on it, and both
+  # `:name` and `"user[name]"` are ordinary call sites. Neither is `%a{pure}`:
+  # both dispatch `to_param` on a value whose own override is invisible here,
+  # the same reason `Hash#to_query` below carries no envelope.
+  def to_param: () -> String
+  def to_query: (untyped key) -> String
+
+  # `bool` and not `true`: `Object#duplicable?` answers true, but the
+  # `Singleton` (and, on a Ruby where methods are not duplicable, `Method` /
+  # `UnboundMethod`) overrides answer false. `-> true` on the universal
+  # receiver would make every `if x.duplicable?` an always-truthy branch —
+  # a false positive on the only shape anybody writes.
+  %a{pure}
+  def duplicable?: () -> bool
+
+  # Keys without the leading `@` for `instance_values`, with it for
+  # `instance_variable_names`.
+  def instance_values: () -> Hash[String, untyped]
+  def instance_variable_names: () -> Array[String]
 end
 
 # `nil.blank?` / `nil.present?` / `nil.try` are the most frequent
@@ -185,6 +213,13 @@ class NilClass
   %a{pure}
   def duplicable?: () -> true
   def instance_values: () -> Hash[String, untyped]
+  # `core_ext/object/to_query` overrides `to_param` on the three singleton
+  # values to return `self` rather than `Object#to_param`'s `to_s`, so the
+  # `Object` row above would carry a wrong return here. `NilClass#to_query`
+  # is its own method (`CGI.escape(key.to_param)`), still a String.
+  %a{pure}
+  def to_param: () -> nil
+  def to_query: (untyped key) -> String
 end
 
 class TrueClass
@@ -192,6 +227,8 @@ class TrueClass
   def blank?: () -> false
   %a{pure}
   def present?: () -> true
+  %a{pure}
+  def to_param: () -> true
 end
 
 class FalseClass
@@ -199,6 +236,8 @@ class FalseClass
   def blank?: () -> true
   %a{pure}
   def present?: () -> false
+  %a{pure}
+  def to_param: () -> false
 end
 
 # ---------------------------------------------------------------
@@ -486,6 +525,22 @@ end
 # purpose — some are already covered by the separate `dynamic_return` rule for `+`/`-`/`*` below, the rest
 # are simply outside this issue's scope and remain silently `Dynamic` rather than a guess.
 module ActiveSupport
+  # Issue #534 item 7 — `ActiveSupport::Concern` was 87 unresolved constant sites on mastodon, essentially
+  # all of them the `extend ActiveSupport::Concern` line at the top of a concern module. Naming it is a
+  # constant-resolution fix and nothing more: the three members are declared because `extend`ing a module
+  # puts them on the extender's singleton, and leaving them out of a now-RBS-known module is what would
+  # turn `included do … end` into a false `call.undefined-method` in every concern in the project. The
+  # blocks are `(?) -> untyped` because their body is evaluated against the INCLUDING class, which this
+  # signature has no way to name.
+  #
+  # `Concern` is listed in the manifest's `open_receivers:` for the rest of its surface (`append_features`,
+  # `class_methods`' generated `ClassMethods` constant, …).
+  module Concern
+    def included: (?untyped base) ?{ (?) -> untyped } -> untyped
+    def prepended: (?untyped base) ?{ (?) -> untyped } -> untyped
+    def class_methods: () { (?) -> untyped } -> untyped
+  end
+
   class Duration
     # The `ago` family (issue #659). `since(time = ::Time.current)` and `ago(time = ::Time.current)` are
     # the only two real methods; `from_now` / `after` are `alias`es of the first and `until` / `before`
@@ -501,13 +556,17 @@ module ActiveSupport
     # help there: it protects a Duration receiver, and the diagnostic lands on the `Time` the call
     # RETURNS. #658 declared that surface and #670 the `Date` / `DateTime` twins, so the chains resolve.
     #
-    # `() -> Time` is the correct class, not a compromise. Under a zone these answer an
-    # `ActiveSupport::TimeWithZone` (verified by calling them), and Rails overrides `TimeWithZone#is_a?`
-    # to answer true for `::Time` — so `Time` is the class Rails ITSELF tells callers the value is, and
-    # `Time.current` above already answers `Time` for the same reason. A `Time | TimeWithZone` union was
-    # measured and rejected: it draws no `undefined-method`, but types every downstream call
-    # `Dynamic[top]` (`iso8601`, `beginning_of_day`, `to_date`, `- 1.day`), which is worth no more than
-    # leaving them undeclared while still firing a parameter mismatch on the TimeWithZone arm.
+    # `() -> TimeWithZone` since #673, where the class these actually build under a zone (verified by
+    # calling them) was finally declared — as a `::Time` SUBCLASS, so nothing a `Time` return bought is
+    # given up: every `Time` instance method still resolves on the result, every `Time`-typed parameter
+    # still accepts it, and the four TWZ-only readers (`time_zone`, `time`, `period`, `comparable_time`)
+    # stop being a false `call.undefined-method` on `1.hour.ago`. It was `() -> Time` before that, on the
+    # ground that Rails overrides `TimeWithZone#is_a?` to answer true for `::Time` — true, and the
+    # subclass is the same claim made where the analyser can also see the extra readers. A
+    # `Time | TimeWithZone` UNION was measured and rejected: it draws no `undefined-method`, but types
+    # every downstream call `Dynamic[top]` (`iso8601`, `beginning_of_day`, `to_date`, `- 1.day`), which is
+    # worth no more than leaving them undeclared while still firing a parameter mismatch on the
+    # TimeWithZone arm.
     #
     # The with-an-argument form stays `(untyped) -> untyped` on purpose, and this is not caution: the
     # runtime return depends on the argument's class AND on whether the duration carries a date-scale
@@ -520,17 +579,17 @@ module ActiveSupport
     # what stops `created_at > 7.days.ago` folding to a constant. They are already attributed `nondet.time`
     # in `lib/rigor/plugin/activesupport_core_ext/effects.rb` — annotating them here would duplicate an
     # envelope the manifest already owns, and risk the two disagreeing.
-    def ago: () -> Time
+    def ago: () -> TimeWithZone
            | (untyped time) -> untyped
-    def until: () -> Time
+    def until: () -> TimeWithZone
              | (untyped time) -> untyped
-    def before: () -> Time
+    def before: () -> TimeWithZone
               | (untyped time) -> untyped
-    def since: () -> Time
+    def since: () -> TimeWithZone
              | (untyped time) -> untyped
-    def from_now: () -> Time
+    def from_now: () -> TimeWithZone
                 | (untyped time) -> untyped
-    def after: () -> Time
+    def after: () -> TimeWithZone
              | (untyped time) -> untyped
 
     # `to_i` returns `@value.to_i` — always Integer, whether `@value` itself is Integer (`1.day`) or Float
@@ -574,6 +633,48 @@ module ActiveSupport
     %a{pure}
     def parts: () -> Hash[Symbol, Integer | Float]
   end
+
+  # ---------------------------------------------------------------
+  # ActiveSupport::TimeWithZone — issue #673
+  # ---------------------------------------------------------------
+  #
+  # `Time.current` and the `Duration#ago` family above really answer a `TimeWithZone` under a zone, and
+  # this class was not modelled at all, so the four readers a TWZ has and a `Time` does not —
+  # `time_zone`, `time`, `period`, `comparable_time` — were a false `call.undefined-method` on every
+  # `Time.current` receiver. Declaring them on `Time` instead would have been wrong: a plain `Time`
+  # genuinely lacks all four, and the diagnostic would stop firing where it is correct.
+  #
+  # `< ::Time` rather than a `Time | TimeWithZone` union at the producers. The union was measured during
+  # #632 and rejected — it types every downstream call `Dynamic[top]`. Inheritance is both cheaper and
+  # more honest: Rails overrides `TimeWithZone#is_a?` to answer true for `::Time`, so `Time` is the class
+  # Rails itself tells callers a TWZ is, and TWZ's `method_missing` forwards every name it does not
+  # define to the wrapped `::Time`, which is exactly what inheriting `Time`'s surface models. A TWZ
+  # therefore satisfies every `Time`-typed parameter, and chains keep resolving instead of collapsing.
+  #
+  # The cost, taken deliberately: `Time.current` answers a plain `Time` when `Time.zone` is nil, so
+  # `Time.current.time_zone` in a zone-less activesupport-only project is a real `NoMethodError` this
+  # now types. Rails sets `config.time_zone` ("UTC") by default, so the shape is rare, and the false
+  # positive it replaces fired on correct Rails code.
+  class TimeWithZone < ::Time
+    # `Time`'s own `initialize` takes the `(year, month, …)` parts; inheriting it would make
+    # `TimeWithZone.new(utc, zone)` — how Rails constructs one — a `call.argument-type-mismatch`.
+    # `untyped` because the zone and period carriers (`ActiveSupport::TimeZone`,
+    # `TZInfo::TimezonePeriod`) are not declared anywhere in this bundle.
+    def initialize: (untyped utc_time, untyped time_zone, ?untyped local_time, ?untyped period) -> void
+
+    # The `attr_reader`; an `ActiveSupport::TimeZone`, undeclared here.
+    %a{pure}
+    def time_zone: () -> untyped
+
+    # The wall-clock `::Time` in the zone. `utc` / `getutc` / `getgm` / `gmtime` are `Time`'s own names
+    # and stay inherited; `comparable_time` is the alias of `utc` that `Time` does not carry. Neither is
+    # `%a{pure}`: both memoise into an ivar on first call.
+    def time: () -> ::Time
+    def comparable_time: () -> ::Time
+
+    # A `TZInfo::TimezonePeriod`, undeclared here. Memoised like `time`, so not `%a{pure}`.
+    def period: () -> untyped
+  end
 end
 
 # ---------------------------------------------------------------
@@ -584,7 +685,11 @@ class Time
   # NOT %a{pure}: already attributed nondet.time/global.read/global.write
   # by `lib/rigor/plugin/activesupport_core_ext/effects.rb` (issue #387).
   # Duplicating an RBS envelope here risks the two disagreeing.
-  def self.current: () -> Time
+  #
+  # `Time.zone ? Time.zone.now : Time.now` — an `ActiveSupport::TimeWithZone` under a zone, which since
+  # #673 is declared as a `::Time` subclass so the four TWZ-only readers resolve without the rest of the
+  # chain losing its `Time` typing. See that class's own note for the zone-less cost.
+  def self.current: () -> ActiveSupport::TimeWithZone
   def self.zone: () -> untyped # ActiveSupport::TimeZone | nil
   def self.zone=: (String | Symbol | untyped) -> untyped
 

data/plugins/rigor-devise/lib/rigor/plugin/devise.rb

@@ -60,6 +60,7 @@ module Rigor
     class Devise < Rigor::Plugin::Base
       manifest(
         id: "devise",
+        target_gems: ["devise"],
         version: "0.1.0",
         description: "Recognises Devise's `devise :strategy` DSL via ADR-16 Tier B.",
         trait_registries: [

data/plugins/rigor-dry-monads/lib/rigor/plugin/dry_monads.rb

@@ -44,6 +44,7 @@ module Rigor
 
       manifest(
         id: "dry-monads",
+        target_gems: ["dry-monads"],
         version: "0.1.0",
         description: "Lightweight HKT support for dry-monads Result and Maybe carriers",
         hkt_registrations: [RESULT_REGISTRATION, MAYBE_REGISTRATION],

data/plugins/rigor-dry-schema/lib/rigor/plugin/dry_schema/schema_scanner.rb

@@ -40,24 +40,26 @@ module Rigor
 
         module_function
 
-        # @param paths [Array<String>] absolute paths to `.rb` files the project's `paths:` resolves to.
-        # @param type_aliases [Hash{String => String}] the ADR-9 `:dry_type_aliases` fact published by
+        # @param paths — absolute paths to `.rb` files the project's `paths:` resolves to.
+        # @param io_boundary — the plugin's {Rigor::Plugin::IoBoundary}; every source read goes
+        #   through it (#630) so each scanned file is a recorded cache dependency.
+        # @param type_aliases — the ADR-9 `:dry_type_aliases` fact published by
         #   `rigor-dry-types` when loaded. Used to resolve `value(Types::Email)` references to their
         #   underlying class. Empty when the plugin isn't loaded.
-        # @return [Hash{String => Hash{Symbol => Hash{Symbol => String}}}] frozen per-schema typed-key
+        # @return frozen per-schema typed-key
         #   table. Empty when no recognisable schema declaration is found.
-        def scan(paths:, type_aliases: {})
+        def scan(paths:, io_boundary:, type_aliases: {})
           table = {}
           paths.each do |path|
-            scan_file(path, type_aliases).each do |schema_const, shape|
+            scan_file(path, io_boundary, type_aliases).each do |schema_const, shape|
               table[schema_const] ||= shape
             end
           end
           table.freeze
         end
 
-        def scan_file(path, type_aliases)
-          source = File.read(path)
+        def scan_file(path, io_boundary, type_aliases)
+          source = io_boundary.read_file(path)
           parse_result = Prism.parse(source, filepath: path)
           return {} unless parse_result.errors.empty?
 

data/plugins/rigor-dry-schema/lib/rigor/plugin/dry_schema.rb

@@ -78,6 +78,7 @@ module Rigor
     class DrySchema < Rigor::Plugin::Base
       manifest(
         id: "dry-schema",
+        target_gems: ["dry-schema"],
         version: "0.1.0",
         description: "Recognises `Dry::Schema.{Params,JSON,define} { ... }` declarations " \
                      "and publishes the per-schema typed-key table.",
@@ -130,7 +131,8 @@ module Rigor
       # `paths:`, parse errors degrade silently.
       def prepare(services)
         type_aliases = services.fact_store.read(plugin_id: "dry-types", name: :dry_type_aliases) || {}
-        table = SchemaScanner.scan(paths: scannable_paths(services), type_aliases: type_aliases)
+        table = SchemaScanner.scan(paths: scannable_paths(services), io_boundary: io_boundary,
+                                   type_aliases: type_aliases)
         return if table.empty?
 
         services.fact_store.publish(
@@ -164,11 +166,13 @@ module Rigor
         shapes[name] = entry.nil? ? nil : ResultShape.build(entry)
       end
 
+      # ADR-45 WD1b (#613 / #630) — the classification probes go through the boundary, so an entry that
+      # is not there yet (or stops being a directory) is a recorded dependency of the scan's input set.
       def scannable_paths(services)
         @scannable_paths ||= services.configuration.paths.flat_map do |entry|
-          if File.directory?(entry)
+          if io_boundary.directory?(entry)
             Dir.glob(File.join(entry, "**", "*.rb"), sort: true)
-          elsif File.file?(entry) && entry.end_with?(".rb")
+          elsif io_boundary.file?(entry) && entry.end_with?(".rb")
             [entry]
           else
             []

data/plugins/rigor-dry-struct/lib/rigor/plugin/dry_struct.rb

@@ -51,6 +51,7 @@ module Rigor
     class DryStruct < Rigor::Plugin::Base
       manifest(
         id: "dry-struct",
+        target_gems: ["dry-struct"],
         version: "0.2.0",
         description: "Recognises dry-struct `attribute :name, T` DSL via ADR-16 Tier C; " \
                      "promotes the reader's return type through ADR-18's `returns_from_arg:` " \

data/plugins/rigor-dry-types/lib/rigor/plugin/dry_types/alias_scanner.rb

@@ -42,11 +42,13 @@ module Rigor
 
         module_function
 
-        # @param paths [Array<String>] absolute paths to `.rb` files the project's `paths:` resolves to.
-        # @return [Hash{String => String}] frozen `{aliased_name => underlying_class_name}` map. Empty
+        # @param paths — absolute paths to `.rb` files the project's `paths:` resolves to.
+        # @param io_boundary — the plugin's {Rigor::Plugin::IoBoundary}; every source read goes
+        #   through it (#630) so each scanned file is a recorded cache dependency.
+        # @return frozen `{aliased_name => underlying_class_name}` map. Empty
         #   when no `include Dry.Types()` declaration is found.
-        def scan(paths:)
-          results = paths.flat_map { |path| scan_file(path) }
+        def scan(paths:, io_boundary:)
+          results = paths.flat_map { |path| scan_file(path, io_boundary) }
           modules = results.map { |r| r[:module_name] }.uniq
           return {}.freeze if modules.empty?
 
@@ -75,8 +77,8 @@ module Rigor
         end
         private_class_method :canonical_table
 
-        def scan_file(path)
-          source = File.read(path)
+        def scan_file(path, io_boundary)
+          source = io_boundary.read_file(path)
           parse_result = Prism.parse(source, filepath: path)
           return [] unless parse_result.errors.empty?
 

data/plugins/rigor-dry-types/lib/rigor/plugin/dry_types.rb

@@ -58,6 +58,7 @@ module Rigor
     class DryTypes < Rigor::Plugin::Base
       manifest(
         id: "dry-types",
+        target_gems: ["dry-types"],
         version: "0.1.0",
         description: "Recognises `module X; include Dry.Types(); end` and publishes the alias table.",
         produces: [:dry_type_aliases]
@@ -74,10 +75,11 @@ module Rigor
       # `watch:` covers exactly the files the scan reads: one glob per project `paths:` entry, co-extensive
       # with {#scannable_paths}. A {Cache::Descriptor::GlobEntry} digests every file matching its glob, so a
       # content edit, a file addition, and a file removal anywhere under those paths all move the digest and
-      # invalidate the entry. The scan reads no file individually through the `IoBoundary`, so the evaluated
-      # `watch:` globs are the entire dependency descriptor — and they fully cover the scan's input.
+      # invalidate the entry. Since #630 the scan ALSO reads each file through the `IoBoundary`, so the
+      # descriptor carries a per-file row beside the globs: the globs alone already covered the scan's
+      # input, and the per-file rows are what a subset or incremental run has to invalidate on.
       producer :dry_type_aliases, watch: -> { alias_watch_globs } do |_params|
-        AliasScanner.scan(paths: scannable_paths)
+        AliasScanner.scan(paths: scannable_paths, io_boundary: io_boundary)
       end
 
       # Builds the (cached) alias table and publishes it via the ADR-9 fact store. `producer_value` runs the
@@ -102,11 +104,13 @@ module Rigor
       # Resolves the project's `paths:` to a flat list of `.rb` files the scanner walks. Mirrors
       # `Analysis::Runner`'s `expand_paths` floor; we don't need the runner's full exclude/sort surface
       # because the alias table is a union — any duplicate scan is a no-op.
+      # ADR-45 WD1b (#613 / #630) — the classification probes go through the boundary, so an entry that
+      # is not there yet (or stops being a directory) is a recorded dependency of the scan's input set.
       def scannable_paths
         @scannable_paths ||= services.configuration.paths.flat_map do |entry|
-          if File.directory?(entry)
+          if io_boundary.directory?(entry)
             Dir.glob(File.join(entry, "**", "*.rb"), sort: true)
-          elsif File.file?(entry) && entry.end_with?(".rb")
+          elsif io_boundary.file?(entry) && entry.end_with?(".rb")
             [entry]
           else
             []
@@ -122,9 +126,9 @@ module Rigor
       # would read is watched, so any edit / addition / removal under those paths invalidates the cache.
       def alias_watch_globs
         services.configuration.paths.filter_map do |entry|
-          if File.directory?(entry)
+          if io_boundary.directory?(entry)
             [entry, "**/*.rb"]
-          elsif File.file?(entry) && entry.end_with?(".rb")
+          elsif io_boundary.file?(entry) && entry.end_with?(".rb")
             [File.dirname(entry), File.basename(entry)]
           end
         end

data/plugins/rigor-dry-validation/lib/rigor/plugin/dry_validation/contract_scanner.rb

@@ -22,17 +22,19 @@ module Rigor
 
         module_function
 
-        # @param paths [Array<String>] absolute paths to `.rb` files the project's `paths:` resolves to.
-        # @return [Array<String>] frozen, sorted list of recognized contract class FQNs (e.g.
+        # @param paths — absolute paths to `.rb` files the project's `paths:` resolves to.
+        # @param io_boundary — the plugin's {Rigor::Plugin::IoBoundary}; every source read goes
+        #   through it (#630) so each scanned file is a recorded cache dependency.
+        # @return frozen, sorted list of recognized contract class FQNs (e.g.
         #   `["App::NewUserContract", "Types::EmailContract"]`).
-        def scan(paths:)
+        def scan(paths:, io_boundary:)
           contracts = []
-          paths.each { |path| contracts.concat(scan_file(path)) }
+          paths.each { |path| contracts.concat(scan_file(path, io_boundary)) }
           contracts.uniq.sort.freeze
         end
 
-        def scan_file(path)
-          source = File.read(path)
+        def scan_file(path, io_boundary)
+          source = io_boundary.read_file(path)
           parse_result = Prism.parse(source, filepath: path)
           return [] unless parse_result.errors.empty?
 
@@ -50,24 +52,24 @@ module Rigor
         # not a degrade-gracefully fallback, because this plugin ships no required/optional walker of
         # its own.
         #
-        # @return [Hash{String => Hash{Symbol => Hash}}] contract FQN => `{params: <shape>}` and/or
+        # @return contract FQN => `{params: <shape>}` and/or
         #   `{json: <shape>}` (only the recognised key(s) are present; a contract with neither present
         #   contributes nothing). Each `<shape>` is exactly {DrySchema::SchemaScanner.collect_schema_shape}'s
         #   `{required:, optional:, unmodelled:}` return.
-        def scan_schema_blocks(paths:, type_aliases: {})
+        def scan_schema_blocks(paths:, io_boundary:, type_aliases: {})
           return {} unless Rigor::Plugin.registered_for("dry-schema")
 
           table = {}
           paths.each do |path|
-            scan_file_schema_blocks(path, type_aliases).each do |fqn, shapes|
+            scan_file_schema_blocks(path, io_boundary, type_aliases).each do |fqn, shapes|
               table[fqn] ||= shapes
             end
           end
           table.freeze
         end
 
-        def scan_file_schema_blocks(path, type_aliases)
-          source = File.read(path)
+        def scan_file_schema_blocks(path, io_boundary, type_aliases)
+          source = io_boundary.read_file(path)
           parse_result = Prism.parse(source, filepath: path)
           return {} unless parse_result.errors.empty?
 

data/plugins/rigor-dry-validation/lib/rigor/plugin/dry_validation.rb

@@ -44,6 +44,7 @@ module Rigor
     class DryValidation < Rigor::Plugin::Base
       manifest(
         id: "dry-validation",
+        target_gems: ["dry-validation"],
         version: "0.1.0",
         description: "Recognises `class T < Dry::Validation::Contract` subclasses, publishes the " \
                      "contract FQN set, and (with rigor-dry-schema loaded) refines each contract's " \
@@ -94,7 +95,7 @@ module Rigor
       end
 
       def prepare(services)
-        contracts = ContractScanner.scan(paths: scannable_paths(services))
+        contracts = ContractScanner.scan(paths: scannable_paths(services), io_boundary: io_boundary)
         unless contracts.empty?
           services.fact_store.publish(
             plugin_id: manifest.id,
@@ -104,7 +105,9 @@ module Rigor
         end
 
         type_aliases = services.fact_store.read(plugin_id: "dry-types", name: :dry_type_aliases) || {}
-        params_table = ContractScanner.scan_schema_blocks(paths: scannable_paths(services), type_aliases: type_aliases)
+        params_table = ContractScanner.scan_schema_blocks(paths: scannable_paths(services),
+                                                          io_boundary: io_boundary,
+                                                          type_aliases: type_aliases)
         return if params_table.empty?
 
         services.fact_store.publish(
@@ -137,11 +140,13 @@ module Rigor
         shapes[name] = row.nil? ? nil : ParamsShape.build(row)
       end
 
+      # ADR-45 WD1b (#613 / #630) — the classification probes go through the boundary, so an entry that
+      # is not there yet (or stops being a directory) is a recorded dependency of the scan's input set.
       def scannable_paths(services)
         @scannable_paths ||= services.configuration.paths.flat_map do |entry|
-          if File.directory?(entry)
+          if io_boundary.directory?(entry)
             Dir.glob(File.join(entry, "**", "*.rb"), sort: true)
-          elsif File.file?(entry) && entry.end_with?(".rb")
+          elsif io_boundary.file?(entry) && entry.end_with?(".rb")
             [entry]
           else
             []

data/plugins/rigor-ethon/lib/rigor/plugin/ethon.rb

@@ -8,6 +8,7 @@ module Rigor
     class Ethon < Base
       manifest(
         id: "ethon",
+        target_gems: ["ethon"],
         version: "0.1.0",
         description: "Models Ethon / Libcurl options, dynamic return types, and multi-loop operations.",
         signature_paths: ["sig"]