rigortype 0.3.8 → 0.3.9

data/plugins/rigor-factorybot/lib/rigor/plugin/factorybot/analyzer.rb

@@ -28,11 +28,6 @@ module Rigor
         # The violations for a single entry call (`FactoryBot.create(...)` etc.), or `[]` when the node
         # is not an entry call or its first argument is not a literal factory name. ADR-37: the engine
         # owns the walk.
-        #
-        # @param call_node [Prism::Node]
-        # @param factory_index [FactoryIndex]
-        # @param model_index [Hash, nil]
-        # @return [Array<Violation>]
         def violations_for(call_node:, factory_index:, model_index: nil)
           return [] unless entry_call?(call_node)
 

data/plugins/rigor-factorybot/lib/rigor/plugin/factorybot/factory_discoverer.rb

@@ -37,7 +37,6 @@ module Rigor
           @search_paths = search_paths
         end
 
-        # @return [FactoryIndex]
         def discover
           entries = {}
           ruby_files_under(@search_paths).each do |path|

data/plugins/rigor-factorybot/lib/rigor/plugin/factorybot/factory_index.rb

@@ -29,7 +29,6 @@ module Rigor
           freeze
         end
 
-        # @return [Entry, nil]
         def find(factory_name)
           @entries[factory_name.to_s]
         end

data/plugins/rigor-factorybot/lib/rigor/plugin/factorybot.rb

@@ -58,6 +58,7 @@ module Rigor
     class Factorybot < Rigor::Plugin::Base
       manifest(
         id: "factorybot",
+        target_gems: ["factory_bot"],
         # Bumped 2026-08-16 — publishes `:reachability_references` for `rigor unused` (ADR-102 WD3 / #350).
         version: "0.3.0",
         description: "Validates FactoryBot.create / build / attributes_for call shapes; " \
@@ -69,7 +70,7 @@ module Rigor
         consumes: [
           { plugin_id: "activerecord", name: :model_index, optional: true }
         ],
-        produces: [:reachability_references]
+        produces: %i[reachability_references factory_index]
       )
 
       producer :factory_index, watch: -> { [[@factory_search_paths, "**/*.rb"]] } do |_params|
@@ -101,6 +102,12 @@ module Rigor
         index = producer_value(:factory_index)
         return if index.nil? || index.empty?
 
+        # The producer value and the ADR-9 fact are different channels (#921) — `producer_value` is this
+        # plugin's own cached computation, read back via `producer_value` above; `fact_store.publish` is
+        # what makes it visible to another plugin's `read_fact`, which is how rigor-rspec binds
+        # `create(:name)` to the factory's model class.
+        services.fact_store.publish(plugin_id: manifest.id, name: :factory_index, value: index)
+
         references = index.entries.values.filter_map do |entry|
           { name: entry.model_class, role: :test } if entry.model_class
         end.uniq

data/plugins/rigor-ffi/lib/rigor/plugin/ffi.rb

@@ -13,9 +13,21 @@ module Rigor
     class FFI < Base
       manifest(
         id: "ffi",
-        version: "0.1.0",
+        target_gems: ["ffi"],
+        # Bumped 2026-09-10 (#918) — declares `config_schema` for the two `.rigor.yml` surfaces ADR-30
+        # WD4 (`exceptions`) and WD6 (`target`) already read off `config` but the manifest never
+        # published, so both keys were rejected by `Manifest#validate_config` as unknown.
+        version: "0.2.0",
         description: "Models FFI library bindings, struct layouts, callbacks, carrier types, and ffx target compatibility.",
-        signature_paths: ["sig"]
+        signature_paths: ["sig"],
+        config_schema: {
+          # WD4 — typedef alias names the nominal-opaque-pointer heuristic should treat as a transparent
+          # `:pointer` alias even though they match the `_ptr$` / `_handle$` naming pattern.
+          "exceptions" => { kind: :array, default: [] },
+          # WD6 — forces ffx-target detection instead of the `extconf.rb` / `Gemfile.lock` cascade.
+          # `"auto"` (the default) keeps the cascade; `"ffi"` / `"ffx"` pin the target outright.
+          "target" => { kind: :string, default: "auto" }
+        }
       )
 
       producer :ffi_catalog do
@@ -25,7 +37,13 @@ module Rigor
 
       # Dynamic return rule for attached FFI functions
       # Gated on known FFI library receivers and attached function names
-      dynamic_return receivers: -> { producer_value(:ffi_catalog)&.libraries || [] },
+      #
+      # Issue #701 — both receiver kinds are declared because the block below already resolved
+      # `Nominal` and `Singleton` alike: `attach_function` installs the binding on the library module
+      # itself (`MyLib.strlen`) and `include`ing that module makes the same name an instance call, so
+      # neither kind is an accident. The kind-aware gate makes that intent explicit rather than relying
+      # on a `receivers:` entry answering for both.
+      dynamic_return receivers: -> { both_receiver_kinds(producer_value(:ffi_catalog)&.libraries) },
                      methods: -> { producer_value(:ffi_catalog)&.function_method_names || [] } do |call_node, scope|
         catalog = producer_value(:ffi_catalog)
         next nil if catalog.nil?
@@ -51,7 +69,11 @@ module Rigor
 
       # Dynamic return rule for FFI struct field accessors
       # Gated on known FFI struct class names and field names
-      dynamic_return receivers: -> { producer_value(:ffi_catalog)&.struct_names || [] },
+      #
+      # Issue #701 — both kinds again, for the same reason: the block resolves the receiver itself and
+      # answers only for a name the discovered layout carries, so restricting the gate to instances
+      # would narrow a shipped rule on a shape nothing in the corpus has adjudicated.
+      dynamic_return receivers: -> { both_receiver_kinds(producer_value(:ffi_catalog)&.struct_names) },
                      methods: -> { producer_value(:ffi_catalog)&.struct_field_names || [] } do |call_node, scope|
         catalog = producer_value(:ffi_catalog)
         next nil if catalog.nil?
@@ -114,6 +136,16 @@ module Rigor
         @target = TargetDetector.detect(root: root, config: config)
         @exceptions = config["exceptions"] || []
       end
+
+      private
+
+      # Every discovered name in both `dynamic_return receivers:` kinds (#701), for the two rules whose
+      # blocks accept an instance and a class receiver alike.
+      #
+      # @param names — discovered class / module names, or nil when the catalog producer did not run
+      def both_receiver_kinds(names)
+        Array(names).flat_map { |name| [name, "singleton(#{name})"] }
+      end
     end
   end
 end

data/plugins/rigor-ffi-rzmq/lib/rigor/plugin/ffi_rzmq.rb

@@ -8,6 +8,7 @@ module Rigor
     class FFIRZMQ < Base
       manifest(
         id: "ffi-rzmq",
+        target_gems: ["ffi-rzmq"],
         version: "0.1.0",
         description: "Models ffi-rzmq / LibZMQ wrappers, socket operations, and cross-gem bindings.",
         signature_paths: ["sig"]

data/plugins/rigor-graphql/lib/rigor/plugin/graphql/type_scanner.rb

@@ -40,16 +40,18 @@ module Rigor
 
         module_function
 
-        # @param paths [Array<String>] absolute paths to `.rb` files the project's `paths:` resolves to.
-        # @return [Hash{Symbol => Hash}] frozen 4-key result: `:types` (per-`Schema::Object` field
+        # @param paths — absolute paths to `.rb` files the project's `paths:` resolves to.
+        # @param io_boundary — the plugin's {Rigor::Plugin::IoBoundary}; every source read goes
+        #   through it (#630) so each scanned file is a recorded cache dependency.
+        # @return frozen 4-key result: `:types` (per-`Schema::Object` field
         #   table), `:enums` (per-`Schema::Enum` value list), `:input_objects`
         #   (per-`Schema::InputObject` argument table), `:mutations` (per-`Schema::Mutation`
         #   arguments+fields table). Any subset may be empty when no recognisable declaration of that
         #   kind is found.
-        def scan(paths:)
+        def scan(paths:, io_boundary:)
           acc = empty_accumulator
           paths.each do |path|
-            merge_accumulator(acc, scan_file(path))
+            merge_accumulator(acc, scan_file(path, io_boundary))
           end
           freeze_accumulator(acc)
         end
@@ -75,8 +77,8 @@ module Rigor
         end
         private_class_method :freeze_accumulator
 
-        def scan_file(path)
-          source = File.read(path)
+        def scan_file(path, io_boundary)
+          source = io_boundary.read_file(path)
           parse_result = Prism.parse(source, filepath: path)
           return empty_accumulator unless parse_result.errors.empty?
 

data/plugins/rigor-graphql/lib/rigor/plugin/graphql.rb

@@ -50,6 +50,7 @@ module Rigor
     class Graphql < Rigor::Plugin::Base
       manifest(
         id: "graphql",
+        target_gems: ["graphql"],
         version: "0.1.0",
         description: "Recognises `class T < GraphQL::Schema::{Object,Enum,InputObject,Mutation}` " \
                      "subclasses; publishes the per-type field-type table, the per-enum value " \
@@ -59,7 +60,7 @@ module Rigor
       )
 
       def prepare(services)
-        scanned = TypeScanner.scan(paths: scannable_paths(services))
+        scanned = TypeScanner.scan(paths: scannable_paths(services), io_boundary: io_boundary)
         publish_if_present(services, :graphql_type_table, scanned.fetch(:types))
         publish_if_present(services, :graphql_enum_table, scanned.fetch(:enums))
         publish_if_present(services, :graphql_input_object_table, scanned.fetch(:input_objects))
@@ -78,11 +79,13 @@ module Rigor
         services.fact_store.publish(plugin_id: manifest.id, name: name, value: value)
       end
 
+      # ADR-45 WD1b (#613 / #630) — the classification probes go through the boundary, so an entry that
+      # is not there yet (or stops being a directory) is a recorded dependency of the scan's input set.
       def scannable_paths(services)
         @scannable_paths ||= services.configuration.paths.flat_map do |entry|
-          if File.directory?(entry)
+          if io_boundary.directory?(entry)
             Dir.glob(File.join(entry, "**", "*.rb"), sort: true)
-          elsif File.file?(entry) && entry.end_with?(".rb")
+          elsif io_boundary.file?(entry) && entry.end_with?(".rb")
             [entry]
           else
             []

data/plugins/rigor-hanami/lib/rigor/plugin/hanami.rb

@@ -51,6 +51,7 @@ module Rigor
     class Hanami < Rigor::Plugin::Base
       manifest(
         id: "hanami",
+        target_gems: ["hanami"],
         version: "0.1.0",
         description: "Enforces the Hanami::Action protocol: #handle(request, response) → void.",
         config_schema: {

data/plugins/rigor-mangrove/lib/rigor/plugin/mangrove.rb

@@ -56,6 +56,7 @@ module Rigor
     class Mangrove < Rigor::Plugin::Base
       manifest(
         id: "mangrove",
+        target_gems: ["mangrove"],
         version: "0.2.0",
         description: "Instantiates Mangrove Result/Option carrier generics at unwrap call sites, " \
                      "sharpening `unwrap!` / `unwrap_in` / `unwrap_or` from `untyped` to the carried type; " \
@@ -134,7 +135,7 @@ module Rigor
 
       private
 
-      # @return [Rigor::Type, nil] the receiver's inferred type, or nil when the engine raises on a synthetic
+      # @return the receiver's inferred type, or nil when the engine raises on a synthetic
       #   / unrecognised node (mirrors rigor-sorbet's defensive degrade).
       def receiver_type_of(receiver, scope)
         scope.type_of(receiver)

data/plugins/rigor-minitest/lib/rigor/plugin/minitest/assertion_analyzer.rb

@@ -59,9 +59,6 @@ module Rigor
       module AssertionAnalyzer
         module_function
 
-        # @param call_node [Prism::CallNode]
-        # @param environment [Rigor::Environment, nil]
-        # @return [Rigor::FlowContribution, nil]
         def contribution_for(call_node, environment:)
           return nil unless call_node.is_a?(Prism::CallNode)
 

data/plugins/rigor-minitest/lib/rigor/plugin/minitest.rb

@@ -37,6 +37,7 @@ module Rigor
     class Minitest < Rigor::Plugin::Base
       manifest(
         id: "minitest",
+        target_gems: ["minitest"],
         version: "0.1.0",
         description: "Narrows locals through Minitest / Test::Unit `assert_*` / `refute_*` " \
                      "and Minitest/spec `_(x).must_*` / `.wont_*` matchers.",

data/plugins/rigor-pundit/lib/rigor/plugin/pundit/analyzer.rb

@@ -33,11 +33,6 @@ module Rigor
         # The policy violations for a single call node (0..2 of them), or `[]` when the node is not a
         # Pundit entry call or its record type is not statically determinable. ADR-37: the engine owns the
         # walk, so this is per-node logic.
-        #
-        # @param call_node [Prism::Node]
-        # @param policy_index [PolicyIndex]
-        # @param scope [Rigor::Scope, nil]
-        # @return [Array<Violation>]
         def violations_for(call_node:, policy_index:, scope:)
           return [] unless call_node.is_a?(Prism::CallNode) && entry_call?(call_node)
 

data/plugins/rigor-pundit/lib/rigor/plugin/pundit/authorization_scan.rb

@@ -42,7 +42,7 @@ module Rigor
           @search_paths = search_paths
         end
 
-        # @return [Array<String>] policy class names named by an authorization call, sorted and unique. Not
+        # @return policy class names named by an authorization call, sorted and unique. Not
         #   yet intersected with the discovered policies — the caller does that.
         def policy_names
           names = Set.new
@@ -93,7 +93,7 @@ module Rigor
           names << name if name
         end
 
-        # @return [String, nil] the policy class the argument names, or nil when the argument is an
+        # @return the policy class the argument names, or nil when the argument is an
         #   expression this reading cannot attribute to a record (a method call with arguments, a literal, an
         #   index read). Silence, not a guess: an unattributable call contributes nothing.
         def policy_name_for(node)

data/plugins/rigor-pundit/lib/rigor/plugin/pundit/policy_discoverer.rb

@@ -28,7 +28,6 @@ module Rigor
           @base_classes = base_classes.to_set
         end
 
-        # @return [PolicyIndex]
         def discover
           entries = []
           ruby_files_under(@search_paths).each do |path|

data/plugins/rigor-pundit/lib/rigor/plugin/pundit/policy_index.rb

@@ -35,7 +35,6 @@ module Rigor
           freeze
         end
 
-        # @return [Entry, nil]
         def find(policy_class_name)
           @by_name[policy_class_name.to_s]
         end

data/plugins/rigor-pundit/lib/rigor/plugin/pundit.rb

@@ -46,6 +46,7 @@ module Rigor
     class Pundit < Rigor::Plugin::Base
       manifest(
         id: "pundit",
+        target_gems: ["pundit"],
         # Bumped 2026-08-16 — publishes `:reachability_roots` for `rigor unused` (ADR-102 WD3): the policy
         # classes the project's own `authorize` / `policy` / `policy_scope` calls name by convention.
         version: "0.2.0",

data/plugins/rigor-rails-i18n/lib/rigor/plugin/rails_i18n/analyzer.rb

@@ -91,22 +91,10 @@ module Rigor
           RAILS_SHIPPED_KEY_PREFIXES.any? { |prefix| key_str.start_with?(prefix) }
         end
 
-        # @param path [String]
-        # @param root [Prism::Node]
-        # @param locale_index [LocaleIndex]
-        # @param configured_locales [Array<String>]
-        # @return [Array<Diagnostic>]
         # The translation violations for a single call node, or `[]` when it is not a recognised `t` /
         # `translate` call with a literal key. ADR-37: the engine owns the walk; `action` (the enclosing
         # method, for lazy `t('.key')` expansion) comes from the node-rule `NodeContext`, and
         # `controller_scope` from the file path.
-        #
-        # @param call_node [Prism::Node]
-        # @param locale_index [LocaleIndex]
-        # @param configured_locales [Array<String>]
-        # @param controller_scope [String, nil]
-        # @param action [String, nil]
-        # @return [Array<Violation>]
         def violations_for(call_node:, locale_index:, configured_locales:, controller_scope:, action:)
           return [] unless call_node.is_a?(Prism::CallNode) && translate_call_candidate?(call_node)
 

data/plugins/rigor-rails-i18n/lib/rigor/plugin/rails_i18n/locale_index.rb

@@ -36,8 +36,7 @@ module Rigor
 
         attr_reader :entries, :locales
 
-        # @param entries [Array<Entry>]
-        # @param locales [Array<String>] all locale names that contributed at least one key.
+        # @param locales — all locale names that contributed at least one key.
         def initialize(entries, locales:)
           @entries = entries.freeze
           @locales = locales.dup.freeze
@@ -45,7 +44,6 @@ module Rigor
           freeze
         end
 
-        # @return [Entry, nil]
         def find(dotted_key)
           @by_key[dotted_key.to_s]
         end

data/plugins/rigor-rails-i18n/lib/rigor/plugin/rails_i18n/locale_loader.rb

@@ -35,7 +35,6 @@ module Rigor
           @load_errors = []
         end
 
-        # @return [LocaleIndex]
         def load
           per_key = {} # dotted_key => { locale => Set<String> }
           per_key_kinds = {} # dotted_key => { locale => :string|:array|:hash }

data/plugins/rigor-rails-i18n/lib/rigor/plugin/rails_i18n.rb

@@ -57,6 +57,7 @@ module Rigor
     class RailsI18n < Rigor::Plugin::Base
       manifest(
         id: "rails-i18n",
+        target_gems: ["i18n"],
         # Bumped 2026-06-23 — view template lazy-key scanning (`t('.key')` inside ERB / Haml / Slim under
         # `view_search_paths`).
         version: "0.3.0",

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes/acronyms.rb

@@ -24,8 +24,8 @@ module Rigor
       module Acronyms
         module_function
 
-        # @param contents [String, nil] the source of `config/initializers/inflections.rb`.
-        # @return [Array<String>] declared acronyms in declaration order. Empty for a missing / unparseable
+        # @param contents — the source of `config/initializers/inflections.rb`.
+        # @return declared acronyms in declaration order. Empty for a missing / unparseable
         #   file, or one that declares none — which leaves composition exactly as it was.
         def discover(contents)
           return [] if contents.nil? || contents.empty?
@@ -51,9 +51,9 @@ module Rigor
         # camelization of the acronym appears at a camel-word boundary — `Oauth` in `OauthMetadata` and in
         # `WellKnown::Oauth`, but never the `Oauth` inside a hypothetical `Xoauth`.
         #
-        # @param name [String] e.g. `"Activitypub::CollectionsController"`.
-        # @param acronyms [Enumerable<String>] as returned by {.discover}.
-        # @return [String] e.g. `"ActivityPub::CollectionsController"`.
+        # @param name — e.g. `"Activitypub::CollectionsController"`.
+        # @param acronyms — as returned by {.discover}.
+        # @return e.g. `"ActivityPub::CollectionsController"`.
         def apply(name, acronyms)
           acronyms.reduce(name) do |current, acronym|
             plain = Rigor::Plugin::Inflector.camelize(acronym.to_s.downcase)

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes/analyzer.rb

@@ -61,20 +61,11 @@ module Rigor
           %r{(?:\A|/)config/}
         ].freeze
 
-        # @param path [String] file being analysed
-        # @param root [Prism::Node]
-        # @param helper_table [HelperTable]
-        # @return [Array<Diagnostic>]
+        # @param path — file being analysed
         # The route-helper violations for a single call node (0..2), or `[]` when the node is not an
         # implicit `*_path` / `*_url` helper call, is shadowed by a same-file binding, or is in a
         # suppressed directory. ADR-37: the engine owns the walk; the same-file `shadowing` set is built
         # once as the node-rule file context.
-        #
-        # @param call_node [Prism::Node]
-        # @param helper_table [HelperTable]
-        # @param shadowing [Set<String>]
-        # @param path [String]
-        # @return [Array<Violation>]
         def violations_for(call_node:, helper_table:, shadowing:, path:)
           return [] unless call_node.is_a?(Prism::CallNode) && implicit_helper_call?(call_node)
 

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes/devise_routes.rb

@@ -70,11 +70,11 @@ module Rigor
 
         module_function
 
-        # @param resource [String, Symbol] the `devise_for` argument — typically `:users`. Used as both the
+        # @param resource — the `devise_for` argument — typically `:users`. Used as both the
         #   helper-name segment (`new_user_session_path`) and to derive the resource path.
-        # @param skip [Array<Symbol>] controllers the project disables via `devise_for :users, skip:
+        # @param skip — controllers the project disables via `devise_for :users, skip:
         #   [:registrations]`.
-        # @return [Array<HelperTable::Entry>] one entry per generated `_path` helper. The caller is
+        # @return one entry per generated `_path` helper. The caller is
         #   expected to pair `_url` variants the same way `RoutesParser` does for other entries.
         def generate(resource:, skip: [])
           resource_segment = singularize(resource.to_s)

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes/doorkeeper_routes.rb

@@ -66,8 +66,8 @@ module Rigor
 
         module_function
 
-        # @param skip [Array<Symbol>] controller names the project omits via `skip_controllers :name, ...`.
-        # @return [Array<HelperTable::Entry>] flattened entries.
+        # @param skip — controller names the project omits via `skip_controllers :name, ...`.
+        # @return flattened entries.
         def generate(skip: [])
           skip_set = skip.to_set(&:to_sym)
           CONTROLLER_HELPERS.flat_map do |controller, rows|

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes/grape_api_discoverer.rb

@@ -43,9 +43,9 @@ module Rigor
 
         module_function
 
-        # @param contents_per_path [Hash{String => String}] file path → source text, read by the caller
+        # @param contents_per_path — file path → source text, read by the caller
         #   (through the trusted `IoBoundary`, so cache invalidation works).
-        # @return [Array<String>] the recognised helper-name prefixes (`["api_v3", "api_v4"]`). Empty when
+        # @return the recognised helper-name prefixes (`["api_v3", "api_v4"]`). Empty when
         #   the project declares no grape API — nothing changes for such a project.
         def discover(contents_per_path)
           declarations = {}

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes/helper_discoverer.rb

@@ -43,10 +43,10 @@ module Rigor
 
         module_function
 
-        # @param contents_per_path [Hash{String => String}] file path → source text. The caller is
+        # @param contents_per_path — file path → source text. The caller is
         #   responsible for reading files (typically through the trusted `IoBoundary` so cache invalidation
         #   works).
-        # @return [Set<String>] method names suitable for inclusion in the `HelperTable`'s custom-helper set.
+        # @return method names suitable for inclusion in the `HelperTable`'s custom-helper set.
         def discover(contents_per_path)
           names = []
           contents_per_path.each_value do |contents|

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes/helper_table.rb

@@ -26,21 +26,21 @@ module Rigor
 
         attr_reader :entries, :custom_helpers, :devise_resources
 
-        # @param entries [Array<Entry>] freshly built; the factory below is the canonical construction path.
-        # @param custom_helpers [Enumerable<String>] names of project-defined helper methods (typically
+        # @param entries — freshly built; the factory below is the canonical construction path.
+        # @param custom_helpers — names of project-defined helper methods (typically
         #   pulled from `app/helpers/**/*.rb` by {HelperDiscoverer}) that the analyzer should treat as
         #   known — they do NOT correspond to a route but their presence MUST NOT fire `unknown-helper`. No
         #   arity / path metadata is recorded; the analyzer skips the route-side checks for these names.
-        # @param devise_resources [Enumerable<String>] resource names declared via `devise_for :resource`
+        # @param devise_resources — resource names declared via `devise_for :resource`
         #   (already singularised, e.g. `"user"`). Used to recognise the dynamic OmniAuth helper family
         #   (`<resource>_<provider>_omniauth_(authorize|callback)_(path|url)`) whose provider segment is
         #   supplied at runtime — no per-name entry is registered for them but they MUST NOT fire
         #   `unknown-helper` either.
-        # @param grape_prefixes [Enumerable<String>] helper-name prefixes generated by `grape-path-helpers`
+        # @param grape_prefixes — helper-name prefixes generated by `grape-path-helpers`
         #   (`"api_v4"`), composed by {GrapeApiDiscoverer} from the project's own `prefix` / `version`
         #   declarations. The names beyond the prefix come from grape's runtime route table and cannot be
         #   enumerated statically, so the namespace is open — same contract as the OmniAuth family above.
-        # @param controllers [Enumerable<String>] fully-qualified controller class names the routes file
+        # @param controllers — fully-qualified controller class names the routes file
         #   dispatches to (`"Admin::UsersController"`). Published as the plugin's `:reachability_roots` fact
         #   (ADR-102 WD3) — a controller is an entry point nothing in the project references, so without this
         #   every routed controller reads as unused. Deliberately NOT consulted by any helper-name check.
@@ -58,20 +58,19 @@ module Rigor
           freeze
         end
 
-        # @return [Array<String>] the routed controller class names (see the `controllers:` parameter). Reads
+        # @return the routed controller class names (see the `controllers:` parameter). Reads
         #   through a nil guard rather than `attr_reader` so a table deserialised from a cache slot written
         #   before this field existed answers `[]` instead of `nil`.
         def controllers
           @controllers || []
         end
 
-        # @return [Entry, nil] First matching entry; for the uncountable-noun case this is the index helper
+        # @return First matching entry; for the uncountable-noun case this is the index helper
         #   (the show helper is also registered but starts second).
         def find(helper_name)
           @by_name[helper_name.to_s]&.first
         end
 
-        # @return [Boolean]
         def known?(helper_name)
           @by_name.key?(helper_name.to_s)
         end
@@ -118,7 +117,7 @@ module Rigor
           end
         end
 
-        # @return [Boolean] true when any entry under this helper name accepts the given positional arity.
+        # @return true when any entry under this helper name accepts the given positional arity.
         #
         # Rails helpers have the signature `helper(*segments, options = {})`, so `expected + 1` is always
         # valid — the extra argument is treated as a query-params/options hash (e.g. `users_path(page: 2)`
@@ -127,7 +126,7 @@ module Rigor
           (@by_name[helper_name.to_s] || []).any? { |entry| entry.arity == arity || entry.arity + 1 == arity }
         end
 
-        # @return [Array<Integer>] all accepted positional arities for a helper name. Empty when unknown.
+        # @return all accepted positional arities for a helper name. Empty when unknown.
         def acceptable_arities(helper_name)
           (@by_name[helper_name.to_s] || []).map(&:arity).uniq
         end

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes/routes_parser.rb

@@ -54,11 +54,10 @@ module Rigor
 
         module_function
 
-        # @param contents [String] raw `config/routes.rb` source
-        # @param file_reader [Proc, nil] called with `"name.rb"` to load a
+        # @param contents — raw `config/routes.rb` source
+        # @param file_reader — called with `"name.rb"` to load a
         #   draw partial from `config/routes/name.rb`. Returns file contents
         #   or nil when the file is absent.
-        # @return [HelperTable]
         def parse(contents, file_reader: nil, custom_helpers: [], grape_prefixes: [], acronyms: [])
           parse_result = Prism.parse(contents)
           unless parse_result.errors.empty?

data/plugins/rigor-rails-routes/lib/rigor/plugin/rails_routes.rb

@@ -52,6 +52,7 @@ module Rigor
     class RailsRoutes < Rigor::Plugin::Base
       manifest(
         id: "rails-routes",
+        target_gems: %w[actionpack railties],
         # Bumped 2026-05-28 — GitLab FOSS sweep adds: (a) `draw_all :name` support (action_dispatch-draw_all
         # gem; single-file load semantics matching `draw :name`); (b) keyword-style `scope(path:
         # ':project_id', as: :project)` — path read from the `:path` keyword, not only from the positional

data/plugins/rigor-railties/lib/rigor/plugin/railties.rb

@@ -52,6 +52,7 @@ module Rigor
     class Railties < Rigor::Plugin::Base
       manifest(
         id: "railties",
+        target_gems: ["railties"],
         # Bumped 2026-09-01 (#534 item 2) — the four `Rails.` singleton readers now return lenient
         # nominals instead of `Dynamic[top]`.
         version: "0.2.0",

data/plugins/rigor-rbnacl/lib/rigor/plugin/rbnacl.rb

@@ -8,8 +8,18 @@ module Rigor
     class RbNaCl < Base
       manifest(
         id: "rbnacl",
+        target_gems: ["rbnacl"],
         version: "0.1.0",
-        description: "Rigor type support for RbNaCl libsodium bindings"
+        description: "Rigor type support for RbNaCl libsodium bindings",
+        signature_paths: ["sig"],
+        # ADR-26 — `sig/rbnacl.rbs` declares three methods of a class that has many more (`nonce_bytes`,
+        # `key_bytes`, …). Contributing it without opening the receivers would close those classes and
+        # manufacture `call.undefined-method` on correct code, which is the trade the project refuses.
+        open_receivers: [
+          "RbNaCl::SecretBox",
+          "RbNaCl::Signatures::Ed25519::SigningKey",
+          "RbNaCl::Signatures::Ed25519::VerifyKey"
+        ]
       )
 
       # Issue 2 & 5: use robust positional binding extractor and preserve module context
@@ -28,3 +38,5 @@ module Rigor
     end
   end
 end
+
+Rigor::Plugin.register(Rigor::Plugin::RbNaCl)